source: vendor/current/source3/utils/net_rpc.c

Last change on this file was 989, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.7
File size: 201.3 KB
Line 
1/*
2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
22
23#include "includes.h"
24#include "utils/net.h"
25#include "rpc_client/cli_pipe.h"
26#include "../libcli/auth/libcli_auth.h"
27#include "../librpc/gen_ndr/ndr_samr_c.h"
28#include "rpc_client/cli_samr.h"
29#include "rpc_client/init_samr.h"
30#include "../librpc/gen_ndr/ndr_lsa_c.h"
31#include "rpc_client/cli_lsarpc.h"
32#include "../librpc/gen_ndr/ndr_netlogon_c.h"
33#include "../librpc/gen_ndr/ndr_srvsvc_c.h"
34#include "../librpc/gen_ndr/ndr_spoolss.h"
35#include "../librpc/gen_ndr/ndr_initshutdown_c.h"
36#include "../librpc/gen_ndr/ndr_winreg_c.h"
37#include "secrets.h"
38#include "lib/netapi/netapi.h"
39#include "lib/netapi/netapi_net.h"
40#include "librpc/gen_ndr/libnet_join.h"
41#include "libnet/libnet_join.h"
42#include "rpc_client/init_lsa.h"
43#include "../libcli/security/security.h"
44#include "libsmb/libsmb.h"
45#include "libsmb/clirap.h"
46#include "nsswitch/libwbclient/wbclient.h"
47#include "passdb.h"
48#include "../libcli/smb/smbXcli_base.h"
49
50static int net_mode_share;
51static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask);
52
53/**
54 * @file net_rpc.c
55 *
56 * @brief RPC based subcommands for the 'net' utility.
57 *
58 * This file should contain much of the functionality that used to
59 * be found in rpcclient, execpt that the commands should change
60 * less often, and the fucntionality should be sane (the user is not
61 * expected to know a rid/sid before they conduct an operation etc.)
62 *
63 * @todo Perhaps eventually these should be split out into a number
64 * of files, as this could get quite big.
65 **/
66
67
68/**
69 * Many of the RPC functions need the domain sid. This function gets
70 * it at the start of every run
71 *
72 * @param cli A cli_state already connected to the remote machine
73 *
74 * @return The Domain SID of the remote machine.
75 **/
76
77NTSTATUS net_get_remote_domain_sid(struct cli_state *cli, TALLOC_CTX *mem_ctx,
78 struct dom_sid **domain_sid,
79 const char **domain_name)
80{
81 struct rpc_pipe_client *lsa_pipe = NULL;
82 struct policy_handle pol;
83 NTSTATUS status, result;
84 union lsa_PolicyInformation *info = NULL;
85 struct dcerpc_binding_handle *b;
86
87 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
88 &lsa_pipe);
89 if (!NT_STATUS_IS_OK(status)) {
90 d_fprintf(stderr, _("Could not initialise lsa pipe\n"));
91 return status;
92 }
93
94 b = lsa_pipe->binding_handle;
95
96 status = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, false,
97 SEC_FLAG_MAXIMUM_ALLOWED,
98 &pol);
99 if (!NT_STATUS_IS_OK(status)) {
100 d_fprintf(stderr, "open_policy %s: %s\n",
101 _("failed"),
102 nt_errstr(status));
103 return status;
104 }
105
106 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
107 &pol,
108 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
109 &info,
110 &result);
111 if (!NT_STATUS_IS_OK(status)) {
112 d_fprintf(stderr, "lsaquery %s: %s\n",
113 _("failed"),
114 nt_errstr(status));
115 return status;
116 }
117 if (!NT_STATUS_IS_OK(result)) {
118 d_fprintf(stderr, "lsaquery %s: %s\n",
119 _("failed"),
120 nt_errstr(result));
121 return result;
122 }
123
124 *domain_name = info->account_domain.name.string;
125 *domain_sid = info->account_domain.sid;
126
127 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
128 TALLOC_FREE(lsa_pipe);
129
130 return NT_STATUS_OK;
131}
132
133/**
134 * Run a single RPC command, from start to finish.
135 *
136 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
137 * @param conn_flag a NET_FLAG_ combination. Passed to
138 * net_make_ipc_connection.
139 * @param argc Standard main() style argc.
140 * @param argv Standard main() style argv. Initial components are already
141 * stripped.
142 * @return A shell status integer (0 for success).
143 */
144
145int run_rpc_command(struct net_context *c,
146 struct cli_state *cli_arg,
147 const struct ndr_interface_table *table,
148 int conn_flags,
149 rpc_command_fn fn,
150 int argc,
151 const char **argv)
152{
153 struct cli_state *cli = NULL;
154 struct rpc_pipe_client *pipe_hnd = NULL;
155 TALLOC_CTX *mem_ctx;
156 NTSTATUS nt_status;
157 struct dom_sid *domain_sid;
158 const char *domain_name;
159 int ret = -1;
160
161 /* make use of cli_state handed over as an argument, if possible */
162 if (!cli_arg) {
163 nt_status = net_make_ipc_connection(c, conn_flags, &cli);
164 if (!NT_STATUS_IS_OK(nt_status)) {
165 DEBUG(1, ("failed to make ipc connection: %s\n",
166 nt_errstr(nt_status)));
167 return -1;
168 }
169 } else {
170 cli = cli_arg;
171 }
172
173 if (!cli) {
174 return -1;
175 }
176
177 /* Create mem_ctx */
178
179 if (!(mem_ctx = talloc_init("run_rpc_command"))) {
180 DEBUG(0, ("talloc_init() failed\n"));
181 goto fail;
182 }
183
184 nt_status = net_get_remote_domain_sid(cli, mem_ctx, &domain_sid,
185 &domain_name);
186 if (!NT_STATUS_IS_OK(nt_status)) {
187 goto fail;
188 }
189
190 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
191 if (lp_client_schannel()
192 && (ndr_syntax_id_equal(&table->syntax_id,
193 &ndr_table_netlogon.syntax_id))) {
194 /* Always try and create an schannel netlogon pipe. */
195 TALLOC_FREE(c->netlogon_creds);
196 nt_status = cli_rpc_pipe_open_schannel(
197 cli, c->msg_ctx, table, NCACN_NP,
198 domain_name,
199 &pipe_hnd, c, &c->netlogon_creds);
200 if (!NT_STATUS_IS_OK(nt_status)) {
201 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
202 nt_errstr(nt_status) ));
203 goto fail;
204 }
205 } else {
206 if (conn_flags & NET_FLAGS_SEAL) {
207 nt_status = cli_rpc_pipe_open_generic_auth(
208 cli, table,
209 (conn_flags & NET_FLAGS_TCP) ?
210 NCACN_IP_TCP : NCACN_NP,
211 CRED_DONT_USE_KERBEROS,
212 DCERPC_AUTH_TYPE_NTLMSSP,
213 DCERPC_AUTH_LEVEL_PRIVACY,
214 smbXcli_conn_remote_name(cli->conn),
215 lp_workgroup(), c->opt_user_name,
216 c->opt_password, &pipe_hnd);
217 } else {
218 nt_status = cli_rpc_pipe_open_noauth(
219 cli, table,
220 &pipe_hnd);
221 }
222 if (!NT_STATUS_IS_OK(nt_status)) {
223 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
224 table->name,
225 nt_errstr(nt_status) ));
226 goto fail;
227 }
228 }
229 }
230
231 nt_status = fn(c, domain_sid, domain_name, cli, pipe_hnd, mem_ctx, argc, argv);
232
233 if (!NT_STATUS_IS_OK(nt_status)) {
234 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status)));
235 } else {
236 ret = 0;
237 DEBUG(5, ("rpc command function succedded\n"));
238 }
239
240 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
241 if (pipe_hnd) {
242 TALLOC_FREE(pipe_hnd);
243 }
244 }
245
246fail:
247 /* close the connection only if it was opened here */
248 if (!cli_arg) {
249 cli_shutdown(cli);
250 }
251
252 talloc_destroy(mem_ctx);
253 return ret;
254}
255
256/**
257 * Force a change of the trust acccount password.
258 *
259 * All parameters are provided by the run_rpc_command function, except for
260 * argc, argv which are passed through.
261 *
262 * @param domain_sid The domain sid acquired from the remote server.
263 * @param cli A cli_state connected to the server.
264 * @param mem_ctx Talloc context, destroyed on completion of the function.
265 * @param argc Standard main() style argc.
266 * @param argv Standard main() style argv. Initial components are already
267 * stripped.
268 *
269 * @return Normal NTSTATUS return.
270 **/
271
272static NTSTATUS rpc_changetrustpw_internals(struct net_context *c,
273 const struct dom_sid *domain_sid,
274 const char *domain_name,
275 struct cli_state *cli,
276 struct rpc_pipe_client *pipe_hnd,
277 TALLOC_CTX *mem_ctx,
278 int argc,
279 const char **argv)
280{
281 NTSTATUS status;
282
283 status = trust_pw_change(c->netlogon_creds,
284 c->msg_ctx,
285 pipe_hnd->binding_handle,
286 c->opt_target_workgroup,
287 true); /* force */
288 if (!NT_STATUS_IS_OK(status)) {
289 d_fprintf(stderr, _("Failed to change machine account password: %s\n"),
290 nt_errstr(status));
291 return status;
292 }
293
294 return NT_STATUS_OK;
295}
296
297/**
298 * Force a change of the trust acccount password.
299 *
300 * @param argc Standard main() style argc.
301 * @param argv Standard main() style argv. Initial components are already
302 * stripped.
303 *
304 * @return A shell status integer (0 for success).
305 **/
306
307int net_rpc_changetrustpw(struct net_context *c, int argc, const char **argv)
308{
309 if (c->display_usage) {
310 d_printf( "%s\n"
311 "net rpc changetrustpw\n"
312 " %s\n",
313 _("Usage:"),
314 _("Change the machine trust password"));
315 return 0;
316 }
317
318 return run_rpc_command(c, NULL, &ndr_table_netlogon,
319 NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
320 rpc_changetrustpw_internals,
321 argc, argv);
322}
323
324/**
325 * Join a domain, the old way. This function exists to allow
326 * the message to be displayed when oldjoin was explicitly
327 * requested, but not when it was implied by "net rpc join".
328 *
329 * This uses 'machinename' as the inital password, and changes it.
330 *
331 * The password should be created with 'server manager' or equiv first.
332 *
333 * @param argc Standard main() style argc.
334 * @param argv Standard main() style argv. Initial components are already
335 * stripped.
336 *
337 * @return A shell status integer (0 for success).
338 **/
339
340static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)
341{
342 struct libnet_JoinCtx *r = NULL;
343 TALLOC_CTX *mem_ctx;
344 WERROR werr;
345 const char *domain = lp_workgroup(); /* FIXME */
346 bool modify_config = lp_config_backend_is_registry();
347 enum netr_SchannelType sec_chan_type;
348 char *pw = NULL;
349
350 if (c->display_usage) {
351 d_printf("Usage:\n"
352 "net rpc oldjoin\n"
353 " Join a domain the old way\n");
354 return 0;
355 }
356
357 mem_ctx = talloc_init("net_rpc_oldjoin");
358 if (!mem_ctx) {
359 return -1;
360 }
361
362 werr = libnet_init_JoinCtx(mem_ctx, &r);
363 if (!W_ERROR_IS_OK(werr)) {
364 goto fail;
365 }
366
367 /*
368 check what type of join - if the user want's to join as
369 a BDC, the server must agree that we are a BDC.
370 */
371 if (argc >= 0) {
372 sec_chan_type = get_sec_channel_type(argv[0]);
373 } else {
374 sec_chan_type = get_sec_channel_type(NULL);
375 }
376
377 if (!c->msg_ctx) {
378 d_fprintf(stderr, _("Could not initialise message context. "
379 "Try running as root\n"));
380 werr = WERR_ACCESS_DENIED;
381 goto fail;
382 }
383
384 pw = talloc_strndup(r, lp_netbios_name(), 14);
385 if (pw == NULL) {
386 werr = WERR_NOMEM;
387 goto fail;
388 }
389
390 r->in.msg_ctx = c->msg_ctx;
391 r->in.domain_name = domain;
392 r->in.secure_channel_type = sec_chan_type;
393 r->in.dc_name = c->opt_host;
394 r->in.admin_account = "";
395 r->in.admin_password = strlower_talloc(r, pw);
396 if (r->in.admin_password == NULL) {
397 werr = WERR_NOMEM;
398 goto fail;
399 }
400 r->in.debug = true;
401 r->in.modify_config = modify_config;
402 r->in.join_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
403 WKSSVC_JOIN_FLAGS_JOIN_UNSECURE |
404 WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED;
405
406 werr = libnet_Join(mem_ctx, r);
407 if (!W_ERROR_IS_OK(werr)) {
408 goto fail;
409 }
410
411 /* Check the short name of the domain */
412
413 if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
414 d_printf("The workgroup in %s does not match the short\n", get_dyn_CONFIGFILE());
415 d_printf("domain name obtained from the server.\n");
416 d_printf("Using the name [%s] from the server.\n", r->out.netbios_domain_name);
417 d_printf("You should set \"workgroup = %s\" in %s.\n",
418 r->out.netbios_domain_name, get_dyn_CONFIGFILE());
419 }
420
421 d_printf("Using short domain name -- %s\n", r->out.netbios_domain_name);
422
423 if (r->out.dns_domain_name) {
424 d_printf("Joined '%s' to realm '%s'\n", r->in.machine_name,
425 r->out.dns_domain_name);
426 } else {
427 d_printf("Joined '%s' to domain '%s'\n", r->in.machine_name,
428 r->out.netbios_domain_name);
429 }
430
431 /* print out informative error string in case there is one */
432 if (r->out.error_string != NULL) {
433 d_printf("%s\n", r->out.error_string);
434 }
435
436 TALLOC_FREE(mem_ctx);
437
438 return 0;
439
440fail:
441 if (c->opt_flags & NET_FLAGS_EXPECT_FALLBACK) {
442 goto cleanup;
443 }
444
445 /* issue an overall failure message at the end. */
446 d_fprintf(stderr, _("Failed to join domain: %s\n"),
447 r && r->out.error_string ? r->out.error_string :
448 get_friendly_werror_msg(werr));
449
450cleanup:
451 TALLOC_FREE(mem_ctx);
452
453 return -1;
454}
455
456/**
457 * check that a join is OK
458 *
459 * @return A shell status integer (0 for success)
460 *
461 **/
462int net_rpc_testjoin(struct net_context *c, int argc, const char **argv)
463{
464 NTSTATUS status;
465 TALLOC_CTX *mem_ctx;
466 const char *domain = c->opt_target_workgroup;
467 const char *dc = c->opt_host;
468
469 if (c->display_usage) {
470 d_printf("Usage\n"
471 "net rpc testjoin\n"
472 " Test if a join is OK\n");
473 return 0;
474 }
475
476 mem_ctx = talloc_init("net_rpc_testjoin");
477 if (!mem_ctx) {
478 return -1;
479 }
480
481 if (!dc) {
482 struct netr_DsRGetDCNameInfo *info;
483
484 if (!c->msg_ctx) {
485 d_fprintf(stderr, _("Could not initialise message context. "
486 "Try running as root\n"));
487 talloc_destroy(mem_ctx);
488 return -1;
489 }
490
491 status = dsgetdcname(mem_ctx,
492 c->msg_ctx,
493 domain,
494 NULL,
495 NULL,
496 DS_RETURN_DNS_NAME,
497 &info);
498 if (!NT_STATUS_IS_OK(status)) {
499 talloc_destroy(mem_ctx);
500 return -1;
501 }
502
503 dc = strip_hostname(info->dc_unc);
504 }
505
506 /* Display success or failure */
507 status = libnet_join_ok(c->msg_ctx,
508 c->opt_workgroup,
509 dc,
510 c->opt_kerberos);
511 if (!NT_STATUS_IS_OK(status)) {
512 fprintf(stderr,"Join to domain '%s' is not valid: %s\n",
513 domain, nt_errstr(status));
514 talloc_destroy(mem_ctx);
515 return -1;
516 }
517
518 printf("Join to '%s' is OK\n",domain);
519 talloc_destroy(mem_ctx);
520
521 return 0;
522}
523
524/**
525 * Join a domain using the administrator username and password
526 *
527 * @param argc Standard main() style argc
528 * @param argc Standard main() style argv. Initial components are already
529 * stripped. Currently not used.
530 * @return A shell status integer (0 for success)
531 *
532 **/
533
534static int net_rpc_join_newstyle(struct net_context *c, int argc, const char **argv)
535{
536 struct libnet_JoinCtx *r = NULL;
537 TALLOC_CTX *mem_ctx;
538 WERROR werr;
539 const char *domain = lp_workgroup(); /* FIXME */
540 bool modify_config = lp_config_backend_is_registry();
541 enum netr_SchannelType sec_chan_type;
542
543 if (c->display_usage) {
544 d_printf("Usage:\n"
545 "net rpc join\n"
546 " Join a domain the new way\n");
547 return 0;
548 }
549
550 mem_ctx = talloc_init("net_rpc_join_newstyle");
551 if (!mem_ctx) {
552 return -1;
553 }
554
555 werr = libnet_init_JoinCtx(mem_ctx, &r);
556 if (!W_ERROR_IS_OK(werr)) {
557 goto fail;
558 }
559
560 /*
561 check what type of join - if the user want's to join as
562 a BDC, the server must agree that we are a BDC.
563 */
564 if (argc >= 0) {
565 sec_chan_type = get_sec_channel_type(argv[0]);
566 } else {
567 sec_chan_type = get_sec_channel_type(NULL);
568 }
569
570 if (!c->msg_ctx) {
571 d_fprintf(stderr, _("Could not initialise message context. "
572 "Try running as root\n"));
573 werr = WERR_ACCESS_DENIED;
574 goto fail;
575 }
576
577 r->in.msg_ctx = c->msg_ctx;
578 r->in.domain_name = domain;
579 r->in.secure_channel_type = sec_chan_type;
580 r->in.dc_name = c->opt_host;
581 r->in.admin_account = c->opt_user_name;
582 r->in.admin_password = net_prompt_pass(c, c->opt_user_name);
583 r->in.debug = true;
584 r->in.use_kerberos = c->opt_kerberos;
585 r->in.modify_config = modify_config;
586 r->in.join_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
587 WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
588 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
589
590 werr = libnet_Join(mem_ctx, r);
591 if (!W_ERROR_IS_OK(werr)) {
592 goto fail;
593 }
594
595 /* Check the short name of the domain */
596
597 if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
598 d_printf("The workgroup in %s does not match the short\n", get_dyn_CONFIGFILE());
599 d_printf("domain name obtained from the server.\n");
600 d_printf("Using the name [%s] from the server.\n", r->out.netbios_domain_name);
601 d_printf("You should set \"workgroup = %s\" in %s.\n",
602 r->out.netbios_domain_name, get_dyn_CONFIGFILE());
603 }
604
605 d_printf("Using short domain name -- %s\n", r->out.netbios_domain_name);
606
607 if (r->out.dns_domain_name) {
608 d_printf("Joined '%s' to realm '%s'\n", r->in.machine_name,
609 r->out.dns_domain_name);
610 } else {
611 d_printf("Joined '%s' to domain '%s'\n", r->in.machine_name,
612 r->out.netbios_domain_name);
613 }
614
615 /* print out informative error string in case there is one */
616 if (r->out.error_string != NULL) {
617 d_printf("%s\n", r->out.error_string);
618 }
619
620 TALLOC_FREE(mem_ctx);
621
622 return 0;
623
624fail:
625 /* issue an overall failure message at the end. */
626 d_printf("Failed to join domain: %s\n",
627 r && r->out.error_string ? r->out.error_string :
628 get_friendly_werror_msg(werr));
629
630 TALLOC_FREE(mem_ctx);
631
632 return -1;
633}
634
635/**
636 * 'net rpc join' entrypoint.
637 * @param argc Standard main() style argc.
638 * @param argv Standard main() style argv. Initial components are already
639 * stripped
640 *
641 * Main 'net_rpc_join()' (where the admin username/password is used) is
642 * in net_rpc_join.c.
643 * Try to just change the password, but if that doesn't work, use/prompt
644 * for a username/password.
645 **/
646
647int net_rpc_join(struct net_context *c, int argc, const char **argv)
648{
649 int ret;
650
651 if (c->display_usage) {
652 d_printf("%s\n%s",
653 _("Usage:"),
654 _("net rpc join -U <username>[%%password] <type>\n"
655 " Join a domain\n"
656 " username\tName of the admin user"
657 " password\tPassword of the admin user, will "
658 "prompt if not specified\n"
659 " type\tCan be one of the following:\n"
660 "\t\tMEMBER\tJoin as member server (default)\n"
661 "\t\tBDC\tJoin as BDC\n"
662 "\t\tPDC\tJoin as PDC\n"));
663 return 0;
664 }
665
666 if (lp_server_role() == ROLE_STANDALONE) {
667 d_printf(_("cannot join as standalone machine\n"));
668 return -1;
669 }
670
671 if (strlen(lp_netbios_name()) > 15) {
672 d_printf(_("Our netbios name can be at most 15 chars long, "
673 "\"%s\" is %u chars long\n"),
674 lp_netbios_name(), (unsigned int)strlen(lp_netbios_name()));
675 return -1;
676 }
677
678 c->opt_flags |= NET_FLAGS_EXPECT_FALLBACK;
679 ret = net_rpc_oldjoin(c, argc, argv);
680 c->opt_flags &= ~NET_FLAGS_EXPECT_FALLBACK;
681 if (ret == 0) {
682 return 0;
683 }
684
685 return net_rpc_join_newstyle(c, argc, argv);
686}
687
688/**
689 * display info about a rpc domain
690 *
691 * All parameters are provided by the run_rpc_command function, except for
692 * argc, argv which are passed through.
693 *
694 * @param domain_sid The domain sid acquired from the remote server
695 * @param cli A cli_state connected to the server.
696 * @param mem_ctx Talloc context, destroyed on completion of the function.
697 * @param argc Standard main() style argc.
698 * @param argv Standard main() style argv. Initial components are already
699 * stripped.
700 *
701 * @return Normal NTSTATUS return.
702 **/
703
704NTSTATUS rpc_info_internals(struct net_context *c,
705 const struct dom_sid *domain_sid,
706 const char *domain_name,
707 struct cli_state *cli,
708 struct rpc_pipe_client *pipe_hnd,
709 TALLOC_CTX *mem_ctx,
710 int argc,
711 const char **argv)
712{
713 struct policy_handle connect_pol, domain_pol;
714 NTSTATUS status, result;
715 union samr_DomainInfo *info = NULL;
716 fstring sid_str;
717 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
718
719 sid_to_fstring(sid_str, domain_sid);
720
721 /* Get sam policy handle */
722 status = dcerpc_samr_Connect2(b, mem_ctx,
723 pipe_hnd->desthost,
724 MAXIMUM_ALLOWED_ACCESS,
725 &connect_pol,
726 &result);
727 if (!NT_STATUS_IS_OK(status)) {
728 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
729 nt_errstr(status));
730 goto done;
731 }
732
733 if (!NT_STATUS_IS_OK(result)) {
734 status = result;
735 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
736 nt_errstr(result));
737 goto done;
738 }
739
740 /* Get domain policy handle */
741 status = dcerpc_samr_OpenDomain(b, mem_ctx,
742 &connect_pol,
743 MAXIMUM_ALLOWED_ACCESS,
744 discard_const_p(struct dom_sid2, domain_sid),
745 &domain_pol,
746 &result);
747 if (!NT_STATUS_IS_OK(status)) {
748 d_fprintf(stderr, _("Could not open domain: %s\n"),
749 nt_errstr(status));
750 goto done;
751 }
752 if (!NT_STATUS_IS_OK(result)) {
753 status = result;
754 d_fprintf(stderr, _("Could not open domain: %s\n"),
755 nt_errstr(result));
756 goto done;
757 }
758
759 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
760 &domain_pol,
761 2,
762 &info,
763 &result);
764 if (!NT_STATUS_IS_OK(status)) {
765 goto done;
766 }
767 status = result;
768 if (NT_STATUS_IS_OK(result)) {
769 d_printf(_("Domain Name: %s\n"),
770 info->general.domain_name.string);
771 d_printf(_("Domain SID: %s\n"), sid_str);
772 d_printf(_("Sequence number: %llu\n"),
773 (unsigned long long)info->general.sequence_num);
774 d_printf(_("Num users: %u\n"), info->general.num_users);
775 d_printf(_("Num domain groups: %u\n"),info->general.num_groups);
776 d_printf(_("Num local groups: %u\n"),info->general.num_aliases);
777 }
778
779 done:
780 return status;
781}
782
783/**
784 * 'net rpc info' entrypoint.
785 * @param argc Standard main() style argc.
786 * @param argv Standard main() style argv. Initial components are already
787 * stripped.
788 **/
789
790int net_rpc_info(struct net_context *c, int argc, const char **argv)
791{
792 if (c->display_usage) {
793 d_printf( "%s\n"
794 "net rpc info\n"
795 " %s\n",
796 _("Usage:"),
797 _("Display information about the domain"));
798 return 0;
799 }
800
801 return run_rpc_command(c, NULL, &ndr_table_samr,
802 NET_FLAGS_PDC, rpc_info_internals,
803 argc, argv);
804}
805
806/**
807 * Fetch domain SID into the local secrets.tdb.
808 *
809 * All parameters are provided by the run_rpc_command function, except for
810 * argc, argv which are passed through.
811 *
812 * @param domain_sid The domain sid acquired from the remote server.
813 * @param cli A cli_state connected to the server.
814 * @param mem_ctx Talloc context, destroyed on completion of the function.
815 * @param argc Standard main() style argc.
816 * @param argv Standard main() style argv. Initial components are already
817 * stripped.
818 *
819 * @return Normal NTSTATUS return.
820 **/
821
822static NTSTATUS rpc_getsid_internals(struct net_context *c,
823 const struct dom_sid *domain_sid,
824 const char *domain_name,
825 struct cli_state *cli,
826 struct rpc_pipe_client *pipe_hnd,
827 TALLOC_CTX *mem_ctx,
828 int argc,
829 const char **argv)
830{
831 fstring sid_str;
832
833 sid_to_fstring(sid_str, domain_sid);
834 d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
835 sid_str, domain_name);
836
837 if (!secrets_store_domain_sid(domain_name, domain_sid)) {
838 DEBUG(0,("Can't store domain SID\n"));
839 return NT_STATUS_UNSUCCESSFUL;
840 }
841
842 return NT_STATUS_OK;
843}
844
845/**
846 * 'net rpc getsid' entrypoint.
847 * @param argc Standard main() style argc.
848 * @param argv Standard main() style argv. Initial components are already
849 * stripped.
850 **/
851
852int net_rpc_getsid(struct net_context *c, int argc, const char **argv)
853{
854 int conn_flags = NET_FLAGS_PDC;
855
856 if (!c->opt_user_specified) {
857 conn_flags |= NET_FLAGS_ANONYMOUS;
858 }
859
860 if (c->display_usage) {
861 d_printf( "%s\n"
862 "net rpc getsid\n"
863 " %s\n",
864 _("Usage:"),
865 _("Fetch domain SID into local secrets.tdb"));
866 return 0;
867 }
868
869 return run_rpc_command(c, NULL, &ndr_table_samr,
870 conn_flags,
871 rpc_getsid_internals,
872 argc, argv);
873}
874
875/****************************************************************************/
876
877/**
878 * Basic usage function for 'net rpc user'.
879 * @param argc Standard main() style argc.
880 * @param argv Standard main() style argv. Initial components are already
881 * stripped.
882 **/
883
884static int rpc_user_usage(struct net_context *c, int argc, const char **argv)
885{
886 return net_user_usage(c, argc, argv);
887}
888
889/**
890 * Add a new user to a remote RPC server.
891 *
892 * @param argc Standard main() style argc.
893 * @param argv Standard main() style argv. Initial components are already
894 * stripped.
895 *
896 * @return A shell status integer (0 for success).
897 **/
898
899static int rpc_user_add(struct net_context *c, int argc, const char **argv)
900{
901 NET_API_STATUS status;
902 struct USER_INFO_1 info1;
903 uint32_t parm_error = 0;
904
905 if (argc < 1 || c->display_usage) {
906 rpc_user_usage(c, argc, argv);
907 return 0;
908 }
909
910 ZERO_STRUCT(info1);
911
912 info1.usri1_name = argv[0];
913 if (argc == 2) {
914 info1.usri1_password = argv[1];
915 }
916
917 status = NetUserAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
918
919 if (status != 0) {
920 d_fprintf(stderr,_("Failed to add user '%s' with error: %s.\n"),
921 argv[0], libnetapi_get_error_string(c->netapi_ctx,
922 status));
923 return -1;
924 } else {
925 d_printf(_("Added user '%s'.\n"), argv[0]);
926 }
927
928 return 0;
929}
930
931/**
932 * Rename a user on a remote RPC server.
933 *
934 * @param argc Standard main() style argc.
935 * @param argv Standard main() style argv. Initial components are already
936 * stripped.
937 *
938 * @return A shell status integer (0 for success).
939 **/
940
941static int rpc_user_rename(struct net_context *c, int argc, const char **argv)
942{
943 NET_API_STATUS status;
944 struct USER_INFO_0 u0;
945 uint32_t parm_err = 0;
946
947 if (argc != 2 || c->display_usage) {
948 rpc_user_usage(c, argc, argv);
949 return 0;
950 }
951
952 u0.usri0_name = argv[1];
953
954 status = NetUserSetInfo(c->opt_host, argv[0],
955 0, (uint8_t *)&u0, &parm_err);
956 if (status) {
957 d_fprintf(stderr,
958 _("Failed to rename user from %s to %s - %s\n"),
959 argv[0], argv[1],
960 libnetapi_get_error_string(c->netapi_ctx, status));
961 } else {
962 d_printf(_("Renamed user from %s to %s\n"), argv[0], argv[1]);
963 }
964
965 return status;
966}
967
968/**
969 * Set a user's primary group
970 *
971 * @param argc Standard main() style argc.
972 * @param argv Standard main() style argv. Initial components are already
973 * stripped.
974 *
975 * @return A shell status integer (0 for success).
976 **/
977
978static int rpc_user_setprimarygroup(struct net_context *c, int argc,
979 const char **argv)
980{
981 NET_API_STATUS status;
982 uint8_t *buffer;
983 struct GROUP_INFO_2 *g2;
984 struct USER_INFO_1051 u1051;
985 uint32_t parm_err = 0;
986
987 if (argc != 2 || c->display_usage) {
988 rpc_user_usage(c, argc, argv);
989 return 0;
990 }
991
992 status = NetGroupGetInfo(c->opt_host, argv[1], 2, &buffer);
993 if (status) {
994 d_fprintf(stderr, _("Failed to find group name %s -- %s\n"),
995 argv[1],
996 libnetapi_get_error_string(c->netapi_ctx, status));
997 return status;
998 }
999 g2 = (struct GROUP_INFO_2 *)buffer;
1000
1001 u1051.usri1051_primary_group_id = g2->grpi2_group_id;
1002
1003 NetApiBufferFree(buffer);
1004
1005 status = NetUserSetInfo(c->opt_host, argv[0], 1051,
1006 (uint8_t *)&u1051, &parm_err);
1007 if (status) {
1008 d_fprintf(stderr,
1009 _("Failed to set user's primary group %s to %s - "
1010 "%s\n"), argv[0], argv[1],
1011 libnetapi_get_error_string(c->netapi_ctx, status));
1012 } else {
1013 d_printf(_("Set primary group of user %s to %s\n"), argv[0],
1014 argv[1]);
1015 }
1016 return status;
1017}
1018
1019/**
1020 * Delete a user from a remote RPC server.
1021 *
1022 * @param argc Standard main() style argc.
1023 * @param argv Standard main() style argv. Initial components are already
1024 * stripped.
1025 *
1026 * @return A shell status integer (0 for success).
1027 **/
1028
1029static int rpc_user_delete(struct net_context *c, int argc, const char **argv)
1030{
1031 NET_API_STATUS status;
1032
1033 if (argc < 1 || c->display_usage) {
1034 rpc_user_usage(c, argc, argv);
1035 return 0;
1036 }
1037
1038 status = NetUserDel(c->opt_host, argv[0]);
1039
1040 if (status != 0) {
1041 d_fprintf(stderr, _("Failed to delete user '%s' with: %s.\n"),
1042 argv[0],
1043 libnetapi_get_error_string(c->netapi_ctx, status));
1044 return -1;
1045 } else {
1046 d_printf(_("Deleted user '%s'.\n"), argv[0]);
1047 }
1048
1049 return 0;
1050}
1051
1052/**
1053 * Set a user's password on a remote RPC server.
1054 *
1055 * @param argc Standard main() style argc.
1056 * @param argv Standard main() style argv. Initial components are already
1057 * stripped.
1058 *
1059 * @return A shell status integer (0 for success).
1060 **/
1061
1062static int rpc_user_password(struct net_context *c, int argc, const char **argv)
1063{
1064 NET_API_STATUS status;
1065 char *prompt = NULL;
1066 struct USER_INFO_1003 u1003;
1067 uint32_t parm_err = 0;
1068 int ret;
1069
1070 if (argc < 1 || c->display_usage) {
1071 rpc_user_usage(c, argc, argv);
1072 return 0;
1073 }
1074
1075 if (argv[1]) {
1076 u1003.usri1003_password = argv[1];
1077 } else {
1078 char pwd[256] = {0};
1079 ret = asprintf(&prompt, _("Enter new password for %s:"),
1080 argv[0]);
1081 if (ret == -1) {
1082 return -1;
1083 }
1084
1085 ret = samba_getpass(prompt, pwd, sizeof(pwd), false, false);
1086 SAFE_FREE(prompt);
1087 if (ret < 0) {
1088 return -1;
1089 }
1090
1091 u1003.usri1003_password = talloc_strdup(c, pwd);
1092 if (u1003.usri1003_password == NULL) {
1093 return -1;
1094 }
1095 }
1096
1097 status = NetUserSetInfo(c->opt_host, argv[0], 1003, (uint8_t *)&u1003, &parm_err);
1098
1099 /* Display results */
1100 if (status != 0) {
1101 d_fprintf(stderr,
1102 _("Failed to set password for '%s' with error: %s.\n"),
1103 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1104 status));
1105 return -1;
1106 }
1107
1108 return 0;
1109}
1110
1111/**
1112 * List a user's groups from a remote RPC server.
1113 *
1114 * @param argc Standard main() style argc.
1115 * @param argv Standard main() style argv. Initial components are already
1116 * stripped.
1117 *
1118 * @return A shell status integer (0 for success)
1119 **/
1120
1121static int rpc_user_info(struct net_context *c, int argc, const char **argv)
1122
1123{
1124 NET_API_STATUS status;
1125 struct GROUP_USERS_INFO_0 *u0 = NULL;
1126 uint32_t entries_read = 0;
1127 uint32_t total_entries = 0;
1128 int i;
1129
1130
1131 if (argc < 1 || c->display_usage) {
1132 rpc_user_usage(c, argc, argv);
1133 return 0;
1134 }
1135
1136 status = NetUserGetGroups(c->opt_host,
1137 argv[0],
1138 0,
1139 (uint8_t **)(void *)&u0,
1140 (uint32_t)-1,
1141 &entries_read,
1142 &total_entries);
1143 if (status != 0) {
1144 d_fprintf(stderr,
1145 _("Failed to get groups for '%s' with error: %s.\n"),
1146 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1147 status));
1148 return -1;
1149 }
1150
1151 for (i=0; i < entries_read; i++) {
1152 printf("%s\n", u0->grui0_name);
1153 u0++;
1154 }
1155
1156 return 0;
1157}
1158
1159/**
1160 * List users on a remote RPC server.
1161 *
1162 * All parameters are provided by the run_rpc_command function, except for
1163 * argc, argv which are passed through.
1164 *
1165 * @param domain_sid The domain sid acquired from the remote server.
1166 * @param cli A cli_state connected to the server.
1167 * @param mem_ctx Talloc context, destroyed on completion of the function.
1168 * @param argc Standard main() style argc.
1169 * @param argv Standard main() style argv. Initial components are already
1170 * stripped.
1171 *
1172 * @return Normal NTSTATUS return.
1173 **/
1174
1175static int rpc_user_list(struct net_context *c, int argc, const char **argv)
1176{
1177 NET_API_STATUS status;
1178 uint32_t start_idx=0, num_entries, i, loop_count = 0;
1179 struct NET_DISPLAY_USER *info = NULL;
1180 void *buffer = NULL;
1181
1182 /* Query domain users */
1183 if (c->opt_long_list_entries)
1184 d_printf(_("\nUser name Comment"
1185 "\n-----------------------------\n"));
1186 do {
1187 uint32_t max_entries, max_size;
1188
1189 dcerpc_get_query_dispinfo_params(
1190 loop_count, &max_entries, &max_size);
1191
1192 status = NetQueryDisplayInformation(c->opt_host,
1193 1,
1194 start_idx,
1195 max_entries,
1196 max_size,
1197 &num_entries,
1198 &buffer);
1199 if (status != 0 && status != ERROR_MORE_DATA) {
1200 return status;
1201 }
1202
1203 info = (struct NET_DISPLAY_USER *)buffer;
1204
1205 for (i = 0; i < num_entries; i++) {
1206
1207 if (c->opt_long_list_entries)
1208 printf("%-21.21s %s\n", info->usri1_name,
1209 info->usri1_comment);
1210 else
1211 printf("%s\n", info->usri1_name);
1212 info++;
1213 }
1214
1215 NetApiBufferFree(buffer);
1216
1217 loop_count++;
1218 start_idx += num_entries;
1219
1220 } while (status == ERROR_MORE_DATA);
1221
1222 return status;
1223}
1224
1225/**
1226 * 'net rpc user' entrypoint.
1227 * @param argc Standard main() style argc.
1228 * @param argv Standard main() style argv. Initial components are already
1229 * stripped.
1230 **/
1231
1232int net_rpc_user(struct net_context *c, int argc, const char **argv)
1233{
1234 NET_API_STATUS status;
1235
1236 struct functable func[] = {
1237 {
1238 "add",
1239 rpc_user_add,
1240 NET_TRANSPORT_RPC,
1241 N_("Add specified user"),
1242 N_("net rpc user add\n"
1243 " Add specified user")
1244 },
1245 {
1246 "info",
1247 rpc_user_info,
1248 NET_TRANSPORT_RPC,
1249 N_("List domain groups of user"),
1250 N_("net rpc user info\n"
1251 " List domain groups of user")
1252 },
1253 {
1254 "delete",
1255 rpc_user_delete,
1256 NET_TRANSPORT_RPC,
1257 N_("Remove specified user"),
1258 N_("net rpc user delete\n"
1259 " Remove specified user")
1260 },
1261 {
1262 "password",
1263 rpc_user_password,
1264 NET_TRANSPORT_RPC,
1265 N_("Change user password"),
1266 N_("net rpc user password\n"
1267 " Change user password")
1268 },
1269 {
1270 "rename",
1271 rpc_user_rename,
1272 NET_TRANSPORT_RPC,
1273 N_("Rename specified user"),
1274 N_("net rpc user rename\n"
1275 " Rename specified user")
1276 },
1277 {
1278 "setprimarygroup",
1279 rpc_user_setprimarygroup,
1280 NET_TRANSPORT_RPC,
1281 "Set a user's primary group",
1282 "net rpc user setprimarygroup\n"
1283 " Set a user's primary group"
1284 },
1285 {NULL, NULL, 0, NULL, NULL}
1286 };
1287
1288 status = libnetapi_net_init(&c->netapi_ctx);
1289 if (status != 0) {
1290 return -1;
1291 }
1292 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
1293 libnetapi_set_password(c->netapi_ctx, c->opt_password);
1294 if (c->opt_kerberos) {
1295 libnetapi_set_use_kerberos(c->netapi_ctx);
1296 }
1297
1298 if (argc == 0) {
1299 if (c->display_usage) {
1300 d_printf( "%s\n"
1301 "net rpc user\n"
1302 " %s\n",
1303 _("Usage:"),
1304 _("List all users"));
1305 net_display_usage_from_functable(func);
1306 return 0;
1307 }
1308
1309 return rpc_user_list(c, argc, argv);
1310 }
1311
1312 return net_run_function(c, argc, argv, "net rpc user", func);
1313}
1314
1315static NTSTATUS rpc_sh_user_list(struct net_context *c,
1316 TALLOC_CTX *mem_ctx,
1317 struct rpc_sh_ctx *ctx,
1318 struct rpc_pipe_client *pipe_hnd,
1319 int argc, const char **argv)
1320{
1321 return werror_to_ntstatus(W_ERROR(rpc_user_list(c, argc, argv)));
1322}
1323
1324static NTSTATUS rpc_sh_user_info(struct net_context *c,
1325 TALLOC_CTX *mem_ctx,
1326 struct rpc_sh_ctx *ctx,
1327 struct rpc_pipe_client *pipe_hnd,
1328 int argc, const char **argv)
1329{
1330 return werror_to_ntstatus(W_ERROR(rpc_user_info(c, argc, argv)));
1331}
1332
1333static NTSTATUS rpc_sh_handle_user(struct net_context *c,
1334 TALLOC_CTX *mem_ctx,
1335 struct rpc_sh_ctx *ctx,
1336 struct rpc_pipe_client *pipe_hnd,
1337 int argc, const char **argv,
1338 NTSTATUS (*fn)(
1339 struct net_context *c,
1340 TALLOC_CTX *mem_ctx,
1341 struct rpc_sh_ctx *ctx,
1342 struct rpc_pipe_client *pipe_hnd,
1343 struct policy_handle *user_hnd,
1344 int argc, const char **argv))
1345{
1346 struct policy_handle connect_pol, domain_pol, user_pol;
1347 NTSTATUS status, result;
1348 struct dom_sid sid;
1349 uint32_t rid;
1350 enum lsa_SidType type;
1351 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1352
1353 if (argc == 0) {
1354 d_fprintf(stderr, "%s %s <username>\n", _("Usage:"),
1355 ctx->whoami);
1356 return NT_STATUS_INVALID_PARAMETER;
1357 }
1358
1359 ZERO_STRUCT(connect_pol);
1360 ZERO_STRUCT(domain_pol);
1361 ZERO_STRUCT(user_pol);
1362
1363 status = net_rpc_lookup_name(c, mem_ctx, ctx->cli,
1364 argv[0], NULL, NULL, &sid, &type);
1365 if (!NT_STATUS_IS_OK(status)) {
1366 d_fprintf(stderr, _("Could not lookup %s: %s\n"), argv[0],
1367 nt_errstr(status));
1368 goto done;
1369 }
1370
1371 if (type != SID_NAME_USER) {
1372 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
1373 sid_type_lookup(type));
1374 status = NT_STATUS_NO_SUCH_USER;
1375 goto done;
1376 }
1377
1378 if (!sid_peek_check_rid(ctx->domain_sid, &sid, &rid)) {
1379 d_fprintf(stderr, _("%s is not in our domain\n"), argv[0]);
1380 status = NT_STATUS_NO_SUCH_USER;
1381 goto done;
1382 }
1383
1384 status = dcerpc_samr_Connect2(b, mem_ctx,
1385 pipe_hnd->desthost,
1386 MAXIMUM_ALLOWED_ACCESS,
1387 &connect_pol,
1388 &result);
1389 if (!NT_STATUS_IS_OK(status)) {
1390 goto done;
1391 }
1392 if (!NT_STATUS_IS_OK(result)) {
1393 status = result;
1394 goto done;
1395 }
1396
1397 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1398 &connect_pol,
1399 MAXIMUM_ALLOWED_ACCESS,
1400 ctx->domain_sid,
1401 &domain_pol,
1402 &result);
1403 if (!NT_STATUS_IS_OK(status)) {
1404 goto done;
1405 }
1406 if (!NT_STATUS_IS_OK(result)) {
1407 status = result;
1408 goto done;
1409 }
1410
1411 status = dcerpc_samr_OpenUser(b, mem_ctx,
1412 &domain_pol,
1413 MAXIMUM_ALLOWED_ACCESS,
1414 rid,
1415 &user_pol,
1416 &result);
1417 if (!NT_STATUS_IS_OK(status)) {
1418 goto done;
1419 }
1420 if (!NT_STATUS_IS_OK(result)) {
1421 status = result;
1422 goto done;
1423 }
1424
1425 status = fn(c, mem_ctx, ctx, pipe_hnd, &user_pol, argc-1, argv+1);
1426
1427 done:
1428 if (is_valid_policy_hnd(&user_pol)) {
1429 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1430 }
1431 if (is_valid_policy_hnd(&domain_pol)) {
1432 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1433 }
1434 if (is_valid_policy_hnd(&connect_pol)) {
1435 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
1436 }
1437 return status;
1438}
1439
1440static NTSTATUS rpc_sh_user_show_internals(struct net_context *c,
1441 TALLOC_CTX *mem_ctx,
1442 struct rpc_sh_ctx *ctx,
1443 struct rpc_pipe_client *pipe_hnd,
1444 struct policy_handle *user_hnd,
1445 int argc, const char **argv)
1446{
1447 NTSTATUS status, result;
1448 union samr_UserInfo *info = NULL;
1449 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1450
1451 if (argc != 0) {
1452 d_fprintf(stderr, "%s %s show <username>\n", _("Usage:"),
1453 ctx->whoami);
1454 return NT_STATUS_INVALID_PARAMETER;
1455 }
1456
1457 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1458 user_hnd,
1459 21,
1460 &info,
1461 &result);
1462 if (!NT_STATUS_IS_OK(status)) {
1463 return status;
1464 }
1465 if (!NT_STATUS_IS_OK(result)) {
1466 return result;
1467 }
1468
1469 d_printf(_("user rid: %d, group rid: %d\n"),
1470 info->info21.rid,
1471 info->info21.primary_gid);
1472
1473 return result;
1474}
1475
1476static NTSTATUS rpc_sh_user_show(struct net_context *c,
1477 TALLOC_CTX *mem_ctx,
1478 struct rpc_sh_ctx *ctx,
1479 struct rpc_pipe_client *pipe_hnd,
1480 int argc, const char **argv)
1481{
1482 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1483 rpc_sh_user_show_internals);
1484}
1485
1486#define FETCHSTR(name, rec) \
1487do { if (strequal(ctx->thiscmd, name)) { \
1488 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1489} while (0);
1490
1491#define SETSTR(name, rec, flag) \
1492do { if (strequal(ctx->thiscmd, name)) { \
1493 init_lsa_String(&(info->info21.rec), argv[0]); \
1494 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1495} while (0);
1496
1497static NTSTATUS rpc_sh_user_str_edit_internals(struct net_context *c,
1498 TALLOC_CTX *mem_ctx,
1499 struct rpc_sh_ctx *ctx,
1500 struct rpc_pipe_client *pipe_hnd,
1501 struct policy_handle *user_hnd,
1502 int argc, const char **argv)
1503{
1504 NTSTATUS status, result;
1505 const char *username;
1506 const char *oldval = "";
1507 union samr_UserInfo *info = NULL;
1508 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1509
1510 if (argc > 1) {
1511 d_fprintf(stderr, "%s %s <username> [new value|NULL]\n",
1512 _("Usage:"), ctx->whoami);
1513 return NT_STATUS_INVALID_PARAMETER;
1514 }
1515
1516 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1517 user_hnd,
1518 21,
1519 &info,
1520 &result);
1521 if (!NT_STATUS_IS_OK(status)) {
1522 return status;
1523 }
1524 if (!NT_STATUS_IS_OK(result)) {
1525 return result;
1526 }
1527
1528 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1529
1530 FETCHSTR("fullname", full_name);
1531 FETCHSTR("homedir", home_directory);
1532 FETCHSTR("homedrive", home_drive);
1533 FETCHSTR("logonscript", logon_script);
1534 FETCHSTR("profilepath", profile_path);
1535 FETCHSTR("description", description);
1536
1537 if (argc == 0) {
1538 d_printf(_("%s's %s: [%s]\n"), username, ctx->thiscmd, oldval);
1539 goto done;
1540 }
1541
1542 if (strcmp(argv[0], "NULL") == 0) {
1543 argv[0] = "";
1544 }
1545
1546 ZERO_STRUCT(info->info21);
1547
1548 SETSTR("fullname", full_name, FULL_NAME);
1549 SETSTR("homedir", home_directory, HOME_DIRECTORY);
1550 SETSTR("homedrive", home_drive, HOME_DRIVE);
1551 SETSTR("logonscript", logon_script, LOGON_SCRIPT);
1552 SETSTR("profilepath", profile_path, PROFILE_PATH);
1553 SETSTR("description", description, DESCRIPTION);
1554
1555 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1556 user_hnd,
1557 21,
1558 info,
1559 &result);
1560 if (!NT_STATUS_IS_OK(status)) {
1561 return status;
1562 }
1563
1564 status = result;
1565
1566 d_printf(_("Set %s's %s from [%s] to [%s]\n"), username,
1567 ctx->thiscmd, oldval, argv[0]);
1568
1569 done:
1570
1571 return status;
1572}
1573
1574#define HANDLEFLG(name, rec) \
1575do { if (strequal(ctx->thiscmd, name)) { \
1576 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1577 if (newval) { \
1578 newflags = oldflags | ACB_##rec; \
1579 } else { \
1580 newflags = oldflags & ~ACB_##rec; \
1581 } } } while (0);
1582
1583static NTSTATUS rpc_sh_user_str_edit(struct net_context *c,
1584 TALLOC_CTX *mem_ctx,
1585 struct rpc_sh_ctx *ctx,
1586 struct rpc_pipe_client *pipe_hnd,
1587 int argc, const char **argv)
1588{
1589 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1590 rpc_sh_user_str_edit_internals);
1591}
1592
1593static NTSTATUS rpc_sh_user_flag_edit_internals(struct net_context *c,
1594 TALLOC_CTX *mem_ctx,
1595 struct rpc_sh_ctx *ctx,
1596 struct rpc_pipe_client *pipe_hnd,
1597 struct policy_handle *user_hnd,
1598 int argc, const char **argv)
1599{
1600 NTSTATUS status, result;
1601 const char *username;
1602 const char *oldval = "unknown";
1603 uint32_t oldflags, newflags;
1604 bool newval;
1605 union samr_UserInfo *info = NULL;
1606 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1607
1608 if ((argc > 1) ||
1609 ((argc == 1) && !strequal(argv[0], "yes") &&
1610 !strequal(argv[0], "no"))) {
1611 /* TRANSATORS: The yes|no here are program keywords. Please do
1612 not translate. */
1613 d_fprintf(stderr, _("Usage: %s <username> [yes|no]\n"),
1614 ctx->whoami);
1615 return NT_STATUS_INVALID_PARAMETER;
1616 }
1617
1618 newval = strequal(argv[0], "yes");
1619
1620 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1621 user_hnd,
1622 21,
1623 &info,
1624 &result);
1625 if (!NT_STATUS_IS_OK(status)) {
1626 return status;
1627 }
1628 if (!NT_STATUS_IS_OK(result)) {
1629 return result;
1630 }
1631
1632 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1633 oldflags = info->info21.acct_flags;
1634 newflags = info->info21.acct_flags;
1635
1636 HANDLEFLG("disabled", DISABLED);
1637 HANDLEFLG("pwnotreq", PWNOTREQ);
1638 HANDLEFLG("autolock", AUTOLOCK);
1639 HANDLEFLG("pwnoexp", PWNOEXP);
1640
1641 if (argc == 0) {
1642 d_printf(_("%s's %s flag: %s\n"), username, ctx->thiscmd,
1643 oldval);
1644 goto done;
1645 }
1646
1647 ZERO_STRUCT(info->info21);
1648
1649 info->info21.acct_flags = newflags;
1650 info->info21.fields_present = SAMR_FIELD_ACCT_FLAGS;
1651
1652 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1653 user_hnd,
1654 21,
1655 info,
1656 &result);
1657 if (!NT_STATUS_IS_OK(status)) {
1658 goto done;
1659 }
1660 status = result;
1661 if (NT_STATUS_IS_OK(result)) {
1662 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username,
1663 ctx->thiscmd, oldval, argv[0]);
1664 }
1665
1666 done:
1667
1668 return status;
1669}
1670
1671static NTSTATUS rpc_sh_user_flag_edit(struct net_context *c,
1672 TALLOC_CTX *mem_ctx,
1673 struct rpc_sh_ctx *ctx,
1674 struct rpc_pipe_client *pipe_hnd,
1675 int argc, const char **argv)
1676{
1677 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1678 rpc_sh_user_flag_edit_internals);
1679}
1680
1681struct rpc_sh_cmd *net_rpc_user_edit_cmds(struct net_context *c,
1682 TALLOC_CTX *mem_ctx,
1683 struct rpc_sh_ctx *ctx)
1684{
1685 static struct rpc_sh_cmd cmds[] = {
1686
1687 { "fullname", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1688 N_("Show/Set a user's full name") },
1689
1690 { "homedir", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1691 N_("Show/Set a user's home directory") },
1692
1693 { "homedrive", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1694 N_("Show/Set a user's home drive") },
1695
1696 { "logonscript", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1697 N_("Show/Set a user's logon script") },
1698
1699 { "profilepath", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1700 N_("Show/Set a user's profile path") },
1701
1702 { "description", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1703 N_("Show/Set a user's description") },
1704
1705 { "disabled", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1706 N_("Show/Set whether a user is disabled") },
1707
1708 { "autolock", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1709 N_("Show/Set whether a user locked out") },
1710
1711 { "pwnotreq", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1712 N_("Show/Set whether a user does not need a password") },
1713
1714 { "pwnoexp", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1715 N_("Show/Set whether a user's password does not expire") },
1716
1717 { NULL, NULL, 0, NULL, NULL }
1718 };
1719
1720 return cmds;
1721}
1722
1723struct rpc_sh_cmd *net_rpc_user_cmds(struct net_context *c,
1724 TALLOC_CTX *mem_ctx,
1725 struct rpc_sh_ctx *ctx)
1726{
1727 static struct rpc_sh_cmd cmds[] = {
1728
1729 { "list", NULL, &ndr_table_samr, rpc_sh_user_list,
1730 N_("List available users") },
1731
1732 { "info", NULL, &ndr_table_samr, rpc_sh_user_info,
1733 N_("List the domain groups a user is member of") },
1734
1735 { "show", NULL, &ndr_table_samr, rpc_sh_user_show,
1736 N_("Show info about a user") },
1737
1738 { "edit", net_rpc_user_edit_cmds, 0, NULL,
1739 N_("Show/Modify a user's fields") },
1740
1741 { NULL, NULL, 0, NULL, NULL }
1742 };
1743
1744 return cmds;
1745}
1746
1747/****************************************************************************/
1748
1749/**
1750 * Basic usage function for 'net rpc group'.
1751 * @param argc Standard main() style argc.
1752 * @param argv Standard main() style argv. Initial components are already
1753 * stripped.
1754 **/
1755
1756static int rpc_group_usage(struct net_context *c, int argc, const char **argv)
1757{
1758 return net_group_usage(c, argc, argv);
1759}
1760
1761/**
1762 * Delete group on a remote RPC server.
1763 *
1764 * All parameters are provided by the run_rpc_command function, except for
1765 * argc, argv which are passed through.
1766 *
1767 * @param domain_sid The domain sid acquired from the remote server.
1768 * @param cli A cli_state connected to the server.
1769 * @param mem_ctx Talloc context, destroyed on completion of the function.
1770 * @param argc Standard main() style argc.
1771 * @param argv Standard main() style argv. Initial components are already
1772 * stripped.
1773 *
1774 * @return Normal NTSTATUS return.
1775 **/
1776
1777static NTSTATUS rpc_group_delete_internals(struct net_context *c,
1778 const struct dom_sid *domain_sid,
1779 const char *domain_name,
1780 struct cli_state *cli,
1781 struct rpc_pipe_client *pipe_hnd,
1782 TALLOC_CTX *mem_ctx,
1783 int argc,
1784 const char **argv)
1785{
1786 struct policy_handle connect_pol, domain_pol, group_pol, user_pol;
1787 bool group_is_primary = false;
1788 NTSTATUS status, result;
1789 uint32_t group_rid;
1790 struct samr_RidAttrArray *rids = NULL;
1791 /* char **names; */
1792 int i;
1793 /* struct samr_RidWithAttribute *user_gids; */
1794 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1795
1796 struct samr_Ids group_rids, name_types;
1797 struct lsa_String lsa_acct_name;
1798 union samr_UserInfo *info = NULL;
1799
1800 if (argc < 1 || c->display_usage) {
1801 rpc_group_usage(c, argc,argv);
1802 return NT_STATUS_OK; /* ok? */
1803 }
1804
1805 status = dcerpc_samr_Connect2(b, mem_ctx,
1806 pipe_hnd->desthost,
1807 MAXIMUM_ALLOWED_ACCESS,
1808 &connect_pol,
1809 &result);
1810 if (!NT_STATUS_IS_OK(status)) {
1811 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1812 goto done;
1813 }
1814
1815 if (!NT_STATUS_IS_OK(result)) {
1816 status = result;
1817 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1818 goto done;
1819 }
1820
1821 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1822 &connect_pol,
1823 MAXIMUM_ALLOWED_ACCESS,
1824 discard_const_p(struct dom_sid2, domain_sid),
1825 &domain_pol,
1826 &result);
1827 if (!NT_STATUS_IS_OK(status)) {
1828 d_fprintf(stderr, _("Request open_domain failed\n"));
1829 goto done;
1830 }
1831
1832 if (!NT_STATUS_IS_OK(result)) {
1833 status = result;
1834 d_fprintf(stderr, _("Request open_domain failed\n"));
1835 goto done;
1836 }
1837
1838 init_lsa_String(&lsa_acct_name, argv[0]);
1839
1840 status = dcerpc_samr_LookupNames(b, mem_ctx,
1841 &domain_pol,
1842 1,
1843 &lsa_acct_name,
1844 &group_rids,
1845 &name_types,
1846 &result);
1847 if (!NT_STATUS_IS_OK(status)) {
1848 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1849 goto done;
1850 }
1851
1852 if (!NT_STATUS_IS_OK(result)) {
1853 status = result;
1854 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1855 goto done;
1856 }
1857 if (group_rids.count != 1) {
1858 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1859 goto done;
1860 }
1861 if (name_types.count != 1) {
1862 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
1863 goto done;
1864 }
1865
1866 switch (name_types.ids[0])
1867 {
1868 case SID_NAME_DOM_GRP:
1869 status = dcerpc_samr_OpenGroup(b, mem_ctx,
1870 &domain_pol,
1871 MAXIMUM_ALLOWED_ACCESS,
1872 group_rids.ids[0],
1873 &group_pol,
1874 &result);
1875 if (!NT_STATUS_IS_OK(status)) {
1876 d_fprintf(stderr, _("Request open_group failed"));
1877 goto done;
1878 }
1879
1880 if (!NT_STATUS_IS_OK(result)) {
1881 status = result;
1882 d_fprintf(stderr, _("Request open_group failed"));
1883 goto done;
1884 }
1885
1886 group_rid = group_rids.ids[0];
1887
1888 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
1889 &group_pol,
1890 &rids,
1891 &result);
1892 if (!NT_STATUS_IS_OK(status)) {
1893 d_fprintf(stderr,
1894 _("Unable to query group members of %s"),
1895 argv[0]);
1896 goto done;
1897 }
1898
1899 if (!NT_STATUS_IS_OK(result)) {
1900 status = result;
1901 d_fprintf(stderr,
1902 _("Unable to query group members of %s"),
1903 argv[0]);
1904 goto done;
1905 }
1906
1907 if (c->opt_verbose) {
1908 d_printf(
1909 _("Domain Group %s (rid: %d) has %d members\n"),
1910 argv[0],group_rid, rids->count);
1911 }
1912
1913 /* Check if group is anyone's primary group */
1914 for (i = 0; i < rids->count; i++)
1915 {
1916 status = dcerpc_samr_OpenUser(b, mem_ctx,
1917 &domain_pol,
1918 MAXIMUM_ALLOWED_ACCESS,
1919 rids->rids[i],
1920 &user_pol,
1921 &result);
1922 if (!NT_STATUS_IS_OK(status)) {
1923 d_fprintf(stderr,
1924 _("Unable to open group member %d\n"),
1925 rids->rids[i]);
1926 goto done;
1927 }
1928
1929 if (!NT_STATUS_IS_OK(result)) {
1930 status = result;
1931 d_fprintf(stderr,
1932 _("Unable to open group member %d\n"),
1933 rids->rids[i]);
1934 goto done;
1935 }
1936
1937 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1938 &user_pol,
1939 21,
1940 &info,
1941 &result);
1942 if (!NT_STATUS_IS_OK(status)) {
1943 d_fprintf(stderr,
1944 _("Unable to lookup userinfo for group "
1945 "member %d\n"),
1946 rids->rids[i]);
1947 goto done;
1948 }
1949
1950 if (!NT_STATUS_IS_OK(result)) {
1951 status = result;
1952 d_fprintf(stderr,
1953 _("Unable to lookup userinfo for group "
1954 "member %d\n"),
1955 rids->rids[i]);
1956 goto done;
1957 }
1958
1959 if (info->info21.primary_gid == group_rid) {
1960 if (c->opt_verbose) {
1961 d_printf(_("Group is primary group "
1962 "of %s\n"),
1963 info->info21.account_name.string);
1964 }
1965 group_is_primary = true;
1966 }
1967
1968 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1969 }
1970
1971 if (group_is_primary) {
1972 d_fprintf(stderr, _("Unable to delete group because "
1973 "some of it's members have it as primary "
1974 "group\n"));
1975 status = NT_STATUS_MEMBERS_PRIMARY_GROUP;
1976 goto done;
1977 }
1978
1979 /* remove all group members */
1980 for (i = 0; i < rids->count; i++)
1981 {
1982 if (c->opt_verbose)
1983 d_printf(_("Remove group member %d..."),
1984 rids->rids[i]);
1985 status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
1986 &group_pol,
1987 rids->rids[i],
1988 &result);
1989 if (!NT_STATUS_IS_OK(status)) {
1990 goto done;
1991 }
1992 status = result;
1993 if (NT_STATUS_IS_OK(result)) {
1994 if (c->opt_verbose)
1995 d_printf(_("ok\n"));
1996 } else {
1997 if (c->opt_verbose)
1998 d_printf("%s\n", _("failed"));
1999 goto done;
2000 }
2001 }
2002
2003 status = dcerpc_samr_DeleteDomainGroup(b, mem_ctx,
2004 &group_pol,
2005 &result);
2006 if (!NT_STATUS_IS_OK(status)) {
2007 break;
2008 }
2009
2010 status = result;
2011
2012 break;
2013 /* removing a local group is easier... */
2014 case SID_NAME_ALIAS:
2015 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2016 &domain_pol,
2017 MAXIMUM_ALLOWED_ACCESS,
2018 group_rids.ids[0],
2019 &group_pol,
2020 &result);
2021 if (!NT_STATUS_IS_OK(status)) {
2022 d_fprintf(stderr, _("Request open_alias failed\n"));
2023 goto done;
2024 }
2025 if (!NT_STATUS_IS_OK(result)) {
2026 status = result;
2027 d_fprintf(stderr, _("Request open_alias failed\n"));
2028 goto done;
2029 }
2030
2031 status = dcerpc_samr_DeleteDomAlias(b, mem_ctx,
2032 &group_pol,
2033 &result);
2034 if (!NT_STATUS_IS_OK(status)) {
2035 break;
2036 }
2037
2038 status = result;
2039
2040 break;
2041 default:
2042 d_fprintf(stderr, _("%s is of type %s. This command is only "
2043 "for deleting local or global groups\n"),
2044 argv[0],sid_type_lookup(name_types.ids[0]));
2045 status = NT_STATUS_UNSUCCESSFUL;
2046 goto done;
2047 }
2048
2049 if (NT_STATUS_IS_OK(status)) {
2050 if (c->opt_verbose)
2051 d_printf(_("Deleted %s '%s'\n"),
2052 sid_type_lookup(name_types.ids[0]), argv[0]);
2053 } else {
2054 d_fprintf(stderr, _("Deleting of %s failed: %s\n"), argv[0],
2055 get_friendly_nt_error_msg(status));
2056 }
2057
2058 done:
2059 return status;
2060
2061}
2062
2063static int rpc_group_delete(struct net_context *c, int argc, const char **argv)
2064{
2065 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2066 rpc_group_delete_internals, argc,argv);
2067}
2068
2069static int rpc_group_add_internals(struct net_context *c, int argc, const char **argv)
2070{
2071 NET_API_STATUS status;
2072 struct GROUP_INFO_1 info1;
2073 uint32_t parm_error = 0;
2074
2075 if (argc != 1 || c->display_usage) {
2076 rpc_group_usage(c, argc, argv);
2077 return 0;
2078 }
2079
2080 ZERO_STRUCT(info1);
2081
2082 info1.grpi1_name = argv[0];
2083 if (c->opt_comment && strlen(c->opt_comment) > 0) {
2084 info1.grpi1_comment = c->opt_comment;
2085 }
2086
2087 status = NetGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
2088
2089 if (status != 0) {
2090 d_fprintf(stderr,
2091 _("Failed to add group '%s' with error: %s.\n"),
2092 argv[0], libnetapi_get_error_string(c->netapi_ctx,
2093 status));
2094 return -1;
2095 } else {
2096 d_printf(_("Added group '%s'.\n"), argv[0]);
2097 }
2098
2099 return 0;
2100}
2101
2102static int rpc_alias_add_internals(struct net_context *c, int argc, const char **argv)
2103{
2104 NET_API_STATUS status;
2105 struct LOCALGROUP_INFO_1 info1;
2106 uint32_t parm_error = 0;
2107
2108 if (argc != 1 || c->display_usage) {
2109 rpc_group_usage(c, argc, argv);
2110 return 0;
2111 }
2112
2113 ZERO_STRUCT(info1);
2114
2115 info1.lgrpi1_name = argv[0];
2116 if (c->opt_comment && strlen(c->opt_comment) > 0) {
2117 info1.lgrpi1_comment = c->opt_comment;
2118 }
2119
2120 status = NetLocalGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
2121
2122 if (status != 0) {
2123 d_fprintf(stderr,
2124 _("Failed to add alias '%s' with error: %s.\n"),
2125 argv[0], libnetapi_get_error_string(c->netapi_ctx,
2126 status));
2127 return -1;
2128 } else {
2129 d_printf(_("Added alias '%s'.\n"), argv[0]);
2130 }
2131
2132 return 0;
2133}
2134
2135static int rpc_group_add(struct net_context *c, int argc, const char **argv)
2136{
2137 if (c->opt_localgroup)
2138 return rpc_alias_add_internals(c, argc, argv);
2139
2140 return rpc_group_add_internals(c, argc, argv);
2141}
2142
2143static NTSTATUS get_sid_from_name(struct cli_state *cli,
2144 TALLOC_CTX *mem_ctx,
2145 const char *name,
2146 struct dom_sid *sid,
2147 enum lsa_SidType *type)
2148{
2149 struct dom_sid *sids = NULL;
2150 enum lsa_SidType *types = NULL;
2151 struct rpc_pipe_client *pipe_hnd = NULL;
2152 struct policy_handle lsa_pol;
2153 NTSTATUS status, result;
2154 struct dcerpc_binding_handle *b;
2155
2156 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
2157 &pipe_hnd);
2158 if (!NT_STATUS_IS_OK(status)) {
2159 goto done;
2160 }
2161
2162 b = pipe_hnd->binding_handle;
2163
2164 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, false,
2165 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
2166
2167 if (!NT_STATUS_IS_OK(status)) {
2168 goto done;
2169 }
2170
2171 status = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &lsa_pol, 1,
2172 &name, NULL, 1, &sids, &types);
2173
2174 if (NT_STATUS_IS_OK(status)) {
2175 sid_copy(sid, &sids[0]);
2176 *type = types[0];
2177 }
2178
2179 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
2180
2181 done:
2182 if (pipe_hnd) {
2183 TALLOC_FREE(pipe_hnd);
2184 }
2185
2186 if (!NT_STATUS_IS_OK(status) && (strncasecmp_m(name, "S-", 2) == 0)) {
2187
2188 /* Try as S-1-5-whatever */
2189
2190 struct dom_sid tmp_sid;
2191
2192 if (string_to_sid(&tmp_sid, name)) {
2193 sid_copy(sid, &tmp_sid);
2194 *type = SID_NAME_UNKNOWN;
2195 status = NT_STATUS_OK;
2196 }
2197 }
2198
2199 return status;
2200}
2201
2202static NTSTATUS rpc_add_groupmem(struct rpc_pipe_client *pipe_hnd,
2203 TALLOC_CTX *mem_ctx,
2204 const struct dom_sid *group_sid,
2205 const char *member)
2206{
2207 struct policy_handle connect_pol, domain_pol;
2208 NTSTATUS status, result;
2209 uint32_t group_rid;
2210 struct policy_handle group_pol;
2211 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2212
2213 struct samr_Ids rids, rid_types;
2214 struct lsa_String lsa_acct_name;
2215
2216 struct dom_sid sid;
2217
2218 sid_copy(&sid, group_sid);
2219
2220 if (!sid_split_rid(&sid, &group_rid)) {
2221 return NT_STATUS_UNSUCCESSFUL;
2222 }
2223
2224 /* Get sam policy handle */
2225 status = dcerpc_samr_Connect2(b, mem_ctx,
2226 pipe_hnd->desthost,
2227 MAXIMUM_ALLOWED_ACCESS,
2228 &connect_pol,
2229 &result);
2230 if (!NT_STATUS_IS_OK(status)) {
2231 return status;
2232 }
2233 if (!NT_STATUS_IS_OK(result)) {
2234 return result;
2235 }
2236
2237 /* Get domain policy handle */
2238 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2239 &connect_pol,
2240 MAXIMUM_ALLOWED_ACCESS,
2241 &sid,
2242 &domain_pol,
2243 &result);
2244 if (!NT_STATUS_IS_OK(status)) {
2245 return status;
2246 }
2247 if (!NT_STATUS_IS_OK(result)) {
2248 return result;
2249 }
2250
2251 init_lsa_String(&lsa_acct_name, member);
2252
2253 status = dcerpc_samr_LookupNames(b, mem_ctx,
2254 &domain_pol,
2255 1,
2256 &lsa_acct_name,
2257 &rids,
2258 &rid_types,
2259 &result);
2260 if (!NT_STATUS_IS_OK(status)) {
2261 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2262 member);
2263 goto done;
2264 }
2265
2266 if (!NT_STATUS_IS_OK(result)) {
2267 status = result;
2268 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2269 member);
2270 goto done;
2271 }
2272 if (rids.count != 1) {
2273 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2274 goto done;
2275 }
2276 if (rid_types.count != 1) {
2277 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2278 goto done;
2279 }
2280
2281 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2282 &domain_pol,
2283 MAXIMUM_ALLOWED_ACCESS,
2284 group_rid,
2285 &group_pol,
2286 &result);
2287 if (!NT_STATUS_IS_OK(status)) {
2288 goto done;
2289 }
2290
2291 if (!NT_STATUS_IS_OK(result)) {
2292 status = result;
2293 goto done;
2294 }
2295
2296 status = dcerpc_samr_AddGroupMember(b, mem_ctx,
2297 &group_pol,
2298 rids.ids[0],
2299 0x0005, /* unknown flags */
2300 &result);
2301 if (!NT_STATUS_IS_OK(status)) {
2302 goto done;
2303 }
2304
2305 status = result;
2306
2307 done:
2308 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2309 return status;
2310}
2311
2312static NTSTATUS rpc_add_aliasmem(struct rpc_pipe_client *pipe_hnd,
2313 struct cli_state *cli,
2314 TALLOC_CTX *mem_ctx,
2315 const struct dom_sid *alias_sid,
2316 const char *member)
2317{
2318 struct policy_handle connect_pol, domain_pol;
2319 NTSTATUS status, result;
2320 uint32_t alias_rid;
2321 struct policy_handle alias_pol;
2322 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2323
2324 struct dom_sid member_sid;
2325 enum lsa_SidType member_type;
2326
2327 struct dom_sid sid;
2328
2329 sid_copy(&sid, alias_sid);
2330
2331 if (!sid_split_rid(&sid, &alias_rid)) {
2332 return NT_STATUS_UNSUCCESSFUL;
2333 }
2334
2335 result = get_sid_from_name(cli, mem_ctx,
2336 member, &member_sid, &member_type);
2337
2338 if (!NT_STATUS_IS_OK(result)) {
2339 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2340 member);
2341 return result;
2342 }
2343
2344 /* Get sam policy handle */
2345 status = dcerpc_samr_Connect2(b, mem_ctx,
2346 pipe_hnd->desthost,
2347 MAXIMUM_ALLOWED_ACCESS,
2348 &connect_pol,
2349 &result);
2350 if (!NT_STATUS_IS_OK(status)) {
2351 goto done;
2352 }
2353 if (!NT_STATUS_IS_OK(result)) {
2354 status = result;
2355 goto done;
2356 }
2357
2358 /* Get domain policy handle */
2359 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2360 &connect_pol,
2361 MAXIMUM_ALLOWED_ACCESS,
2362 &sid,
2363 &domain_pol,
2364 &result);
2365 if (!NT_STATUS_IS_OK(status)) {
2366 goto done;
2367 }
2368 if (!NT_STATUS_IS_OK(result)) {
2369 status = result;
2370 goto done;
2371 }
2372
2373 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2374 &domain_pol,
2375 MAXIMUM_ALLOWED_ACCESS,
2376 alias_rid,
2377 &alias_pol,
2378 &result);
2379 if (!NT_STATUS_IS_OK(status)) {
2380 return status;
2381 }
2382 if (!NT_STATUS_IS_OK(result)) {
2383 return result;
2384 }
2385
2386 status = dcerpc_samr_AddAliasMember(b, mem_ctx,
2387 &alias_pol,
2388 &member_sid,
2389 &result);
2390 if (!NT_STATUS_IS_OK(status)) {
2391 return status;
2392 }
2393
2394 status = result;
2395
2396 done:
2397 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2398 return status;
2399}
2400
2401static NTSTATUS rpc_group_addmem_internals(struct net_context *c,
2402 const struct dom_sid *domain_sid,
2403 const char *domain_name,
2404 struct cli_state *cli,
2405 struct rpc_pipe_client *pipe_hnd,
2406 TALLOC_CTX *mem_ctx,
2407 int argc,
2408 const char **argv)
2409{
2410 struct dom_sid group_sid;
2411 enum lsa_SidType group_type;
2412
2413 if (argc != 2 || c->display_usage) {
2414 d_printf("%s\n%s",
2415 _("Usage:"),
2416 _("net rpc group addmem <group> <member>\n"
2417 " Add a member to a group\n"
2418 " group\tGroup to add member to\n"
2419 " member\tMember to add to group\n"));
2420 return NT_STATUS_UNSUCCESSFUL;
2421 }
2422
2423 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2424 &group_sid, &group_type))) {
2425 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2426 argv[0]);
2427 return NT_STATUS_UNSUCCESSFUL;
2428 }
2429
2430 if (group_type == SID_NAME_DOM_GRP) {
2431 NTSTATUS result = rpc_add_groupmem(pipe_hnd, mem_ctx,
2432 &group_sid, argv[1]);
2433
2434 if (!NT_STATUS_IS_OK(result)) {
2435 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2436 argv[1], argv[0], nt_errstr(result));
2437 }
2438 return result;
2439 }
2440
2441 if (group_type == SID_NAME_ALIAS) {
2442 NTSTATUS result = rpc_add_aliasmem(pipe_hnd, cli, mem_ctx,
2443 &group_sid, argv[1]);
2444
2445 if (!NT_STATUS_IS_OK(result)) {
2446 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2447 argv[1], argv[0], nt_errstr(result));
2448 }
2449 return result;
2450 }
2451
2452 d_fprintf(stderr, _("Can only add members to global or local groups "
2453 "which %s is not\n"), argv[0]);
2454
2455 return NT_STATUS_UNSUCCESSFUL;
2456}
2457
2458static int rpc_group_addmem(struct net_context *c, int argc, const char **argv)
2459{
2460 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2461 rpc_group_addmem_internals,
2462 argc, argv);
2463}
2464
2465static NTSTATUS rpc_del_groupmem(struct net_context *c,
2466 struct rpc_pipe_client *pipe_hnd,
2467 TALLOC_CTX *mem_ctx,
2468 const struct dom_sid *group_sid,
2469 const char *member)
2470{
2471 struct policy_handle connect_pol, domain_pol;
2472 NTSTATUS status, result;
2473 uint32_t group_rid;
2474 struct policy_handle group_pol;
2475 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2476
2477 struct samr_Ids rids, rid_types;
2478 struct lsa_String lsa_acct_name;
2479
2480 struct dom_sid sid;
2481
2482 sid_copy(&sid, group_sid);
2483
2484 if (!sid_split_rid(&sid, &group_rid))
2485 return NT_STATUS_UNSUCCESSFUL;
2486
2487 /* Get sam policy handle */
2488 status = dcerpc_samr_Connect2(b, mem_ctx,
2489 pipe_hnd->desthost,
2490 MAXIMUM_ALLOWED_ACCESS,
2491 &connect_pol,
2492 &result);
2493 if (!NT_STATUS_IS_OK(status)) {
2494 return status;
2495 }
2496 if (!NT_STATUS_IS_OK(result)) {
2497 return result;
2498 }
2499
2500
2501 /* Get domain policy handle */
2502 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2503 &connect_pol,
2504 MAXIMUM_ALLOWED_ACCESS,
2505 &sid,
2506 &domain_pol,
2507 &result);
2508 if (!NT_STATUS_IS_OK(status)) {
2509 return status;
2510 }
2511 if (!NT_STATUS_IS_OK(result)) {
2512 return result;
2513 }
2514
2515 init_lsa_String(&lsa_acct_name, member);
2516
2517 status = dcerpc_samr_LookupNames(b, mem_ctx,
2518 &domain_pol,
2519 1,
2520 &lsa_acct_name,
2521 &rids,
2522 &rid_types,
2523 &result);
2524 if (!NT_STATUS_IS_OK(status)) {
2525 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2526 member);
2527 goto done;
2528 }
2529
2530 if (!NT_STATUS_IS_OK(result)) {
2531 status = result;
2532 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2533 member);
2534 goto done;
2535 }
2536 if (rids.count != 1) {
2537 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2538 goto done;
2539 }
2540 if (rid_types.count != 1) {
2541 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2542 goto done;
2543 }
2544
2545 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2546 &domain_pol,
2547 MAXIMUM_ALLOWED_ACCESS,
2548 group_rid,
2549 &group_pol,
2550 &result);
2551 if (!NT_STATUS_IS_OK(status)) {
2552 goto done;
2553 }
2554 if (!NT_STATUS_IS_OK(result)) {
2555 status = result;
2556 goto done;
2557 }
2558
2559 status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
2560 &group_pol,
2561 rids.ids[0],
2562 &result);
2563 if (!NT_STATUS_IS_OK(status)) {
2564 goto done;
2565 }
2566
2567 status = result;
2568 done:
2569 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2570 return status;
2571}
2572
2573static NTSTATUS rpc_del_aliasmem(struct rpc_pipe_client *pipe_hnd,
2574 struct cli_state *cli,
2575 TALLOC_CTX *mem_ctx,
2576 const struct dom_sid *alias_sid,
2577 const char *member)
2578{
2579 struct policy_handle connect_pol, domain_pol;
2580 NTSTATUS status, result;
2581 uint32_t alias_rid;
2582 struct policy_handle alias_pol;
2583 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2584
2585 struct dom_sid member_sid;
2586 enum lsa_SidType member_type;
2587
2588 struct dom_sid sid;
2589
2590 sid_copy(&sid, alias_sid);
2591
2592 if (!sid_split_rid(&sid, &alias_rid))
2593 return NT_STATUS_UNSUCCESSFUL;
2594
2595 result = get_sid_from_name(cli, mem_ctx,
2596 member, &member_sid, &member_type);
2597
2598 if (!NT_STATUS_IS_OK(result)) {
2599 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2600 member);
2601 return result;
2602 }
2603
2604 /* Get sam policy handle */
2605 status = dcerpc_samr_Connect2(b, mem_ctx,
2606 pipe_hnd->desthost,
2607 MAXIMUM_ALLOWED_ACCESS,
2608 &connect_pol,
2609 &result);
2610 if (!NT_STATUS_IS_OK(status)) {
2611 goto done;
2612 }
2613 if (!NT_STATUS_IS_OK(result)) {
2614 status = result;
2615 goto done;
2616 }
2617
2618 /* Get domain policy handle */
2619 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2620 &connect_pol,
2621 MAXIMUM_ALLOWED_ACCESS,
2622 &sid,
2623 &domain_pol,
2624 &result);
2625 if (!NT_STATUS_IS_OK(status)) {
2626 goto done;
2627 }
2628 if (!NT_STATUS_IS_OK(result)) {
2629 status = result;
2630 goto done;
2631 }
2632
2633 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2634 &domain_pol,
2635 MAXIMUM_ALLOWED_ACCESS,
2636 alias_rid,
2637 &alias_pol,
2638 &result);
2639 if (!NT_STATUS_IS_OK(status)) {
2640 return status;
2641 }
2642
2643 if (!NT_STATUS_IS_OK(result)) {
2644 return result;
2645 }
2646
2647 status = dcerpc_samr_DeleteAliasMember(b, mem_ctx,
2648 &alias_pol,
2649 &member_sid,
2650 &result);
2651
2652 if (!NT_STATUS_IS_OK(status)) {
2653 return status;
2654 }
2655
2656 status = result;
2657
2658 done:
2659 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2660 return status;
2661}
2662
2663static NTSTATUS rpc_group_delmem_internals(struct net_context *c,
2664 const struct dom_sid *domain_sid,
2665 const char *domain_name,
2666 struct cli_state *cli,
2667 struct rpc_pipe_client *pipe_hnd,
2668 TALLOC_CTX *mem_ctx,
2669 int argc,
2670 const char **argv)
2671{
2672 struct dom_sid group_sid;
2673 enum lsa_SidType group_type;
2674
2675 if (argc != 2 || c->display_usage) {
2676 d_printf("%s\n%s",
2677 _("Usage:"),
2678 _("net rpc group delmem <group> <member>\n"
2679 " Delete a member from a group\n"
2680 " group\tGroup to delete member from\n"
2681 " member\tMember to delete from group\n"));
2682 return NT_STATUS_UNSUCCESSFUL;
2683 }
2684
2685 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2686 &group_sid, &group_type))) {
2687 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2688 argv[0]);
2689 return NT_STATUS_UNSUCCESSFUL;
2690 }
2691
2692 if (group_type == SID_NAME_DOM_GRP) {
2693 NTSTATUS result = rpc_del_groupmem(c, pipe_hnd, mem_ctx,
2694 &group_sid, argv[1]);
2695
2696 if (!NT_STATUS_IS_OK(result)) {
2697 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2698 argv[1], argv[0], nt_errstr(result));
2699 }
2700 return result;
2701 }
2702
2703 if (group_type == SID_NAME_ALIAS) {
2704 NTSTATUS result = rpc_del_aliasmem(pipe_hnd, cli, mem_ctx,
2705 &group_sid, argv[1]);
2706
2707 if (!NT_STATUS_IS_OK(result)) {
2708 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2709 argv[1], argv[0], nt_errstr(result));
2710 }
2711 return result;
2712 }
2713
2714 d_fprintf(stderr, _("Can only delete members from global or local "
2715 "groups which %s is not\n"), argv[0]);
2716
2717 return NT_STATUS_UNSUCCESSFUL;
2718}
2719
2720static int rpc_group_delmem(struct net_context *c, int argc, const char **argv)
2721{
2722 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2723 rpc_group_delmem_internals,
2724 argc, argv);
2725}
2726
2727/**
2728 * List groups on a remote RPC server.
2729 *
2730 * All parameters are provided by the run_rpc_command function, except for
2731 * argc, argv which are passes through.
2732 *
2733 * @param domain_sid The domain sid acquired from the remote server.
2734 * @param cli A cli_state connected to the server.
2735 * @param mem_ctx Talloc context, destroyed on completion of the function.
2736 * @param argc Standard main() style argc.
2737 * @param argv Standard main() style argv. Initial components are already
2738 * stripped.
2739 *
2740 * @return Normal NTSTATUS return.
2741 **/
2742
2743static NTSTATUS rpc_group_list_internals(struct net_context *c,
2744 const struct dom_sid *domain_sid,
2745 const char *domain_name,
2746 struct cli_state *cli,
2747 struct rpc_pipe_client *pipe_hnd,
2748 TALLOC_CTX *mem_ctx,
2749 int argc,
2750 const char **argv)
2751{
2752 struct policy_handle connect_pol, domain_pol;
2753 NTSTATUS status, result;
2754 uint32_t start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
2755 struct samr_SamArray *groups = NULL;
2756 bool global = false;
2757 bool local = false;
2758 bool builtin = false;
2759 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2760
2761 if (c->display_usage) {
2762 d_printf("%s\n%s",
2763 _("Usage:"),
2764 _("net rpc group list [global] [local] [builtin]\n"
2765 " List groups on RPC server\n"
2766 " global\tList global groups\n"
2767 " local\tList local groups\n"
2768 " builtin\tList builtin groups\n"
2769 " If none of global, local or builtin is "
2770 "specified, all three options are considered "
2771 "set\n"));
2772 return NT_STATUS_OK;
2773 }
2774
2775 if (argc == 0) {
2776 global = true;
2777 local = true;
2778 builtin = true;
2779 }
2780
2781 for (i=0; i<argc; i++) {
2782 if (strequal(argv[i], "global"))
2783 global = true;
2784
2785 if (strequal(argv[i], "local"))
2786 local = true;
2787
2788 if (strequal(argv[i], "builtin"))
2789 builtin = true;
2790 }
2791
2792 /* Get sam policy handle */
2793
2794 status = dcerpc_samr_Connect2(b, mem_ctx,
2795 pipe_hnd->desthost,
2796 MAXIMUM_ALLOWED_ACCESS,
2797 &connect_pol,
2798 &result);
2799 if (!NT_STATUS_IS_OK(status)) {
2800 goto done;
2801 }
2802 if (!NT_STATUS_IS_OK(result)) {
2803 status = result;
2804 goto done;
2805 }
2806
2807 /* Get domain policy handle */
2808
2809 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2810 &connect_pol,
2811 MAXIMUM_ALLOWED_ACCESS,
2812 discard_const_p(struct dom_sid2, domain_sid),
2813 &domain_pol,
2814 &result);
2815 if (!NT_STATUS_IS_OK(status)) {
2816 goto done;
2817 }
2818 if (!NT_STATUS_IS_OK(result)) {
2819 status = result;
2820 goto done;
2821 }
2822
2823 /* Query domain groups */
2824 if (c->opt_long_list_entries)
2825 d_printf(_("\nGroup name Comment"
2826 "\n-----------------------------\n"));
2827 do {
2828 uint32_t max_size, total_size, returned_size;
2829 union samr_DispInfo info;
2830
2831 if (!global) break;
2832
2833 dcerpc_get_query_dispinfo_params(
2834 loop_count, &max_entries, &max_size);
2835
2836 status = dcerpc_samr_QueryDisplayInfo(b, mem_ctx,
2837 &domain_pol,
2838 3,
2839 start_idx,
2840 max_entries,
2841 max_size,
2842 &total_size,
2843 &returned_size,
2844 &info,
2845 &result);
2846 if (!NT_STATUS_IS_OK(status)) {
2847 goto done;
2848 }
2849 num_entries = info.info3.count;
2850 start_idx += info.info3.count;
2851
2852 if (!NT_STATUS_IS_OK(result) &&
2853 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2854 break;
2855
2856 for (i = 0; i < num_entries; i++) {
2857
2858 const char *group = NULL;
2859 const char *desc = NULL;
2860
2861 group = info.info3.entries[i].account_name.string;
2862 desc = info.info3.entries[i].description.string;
2863
2864 if (c->opt_long_list_entries)
2865 printf("%-21.21s %-50.50s\n",
2866 group, desc);
2867 else
2868 printf("%s\n", group);
2869 }
2870 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2871 /* query domain aliases */
2872 start_idx = 0;
2873 do {
2874 if (!local) break;
2875
2876 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2877 &domain_pol,
2878 &start_idx,
2879 &groups,
2880 0xffff,
2881 &num_entries,
2882 &result);
2883 if (!NT_STATUS_IS_OK(status)) {
2884 goto done;
2885 }
2886 if (!NT_STATUS_IS_OK(result) &&
2887 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2888 break;
2889
2890 for (i = 0; i < num_entries; i++) {
2891
2892 const char *description = NULL;
2893
2894 if (c->opt_long_list_entries) {
2895
2896 struct policy_handle alias_pol;
2897 union samr_AliasInfo *info = NULL;
2898 NTSTATUS _result;
2899
2900 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2901 &domain_pol,
2902 0x8,
2903 groups->entries[i].idx,
2904 &alias_pol,
2905 &_result);
2906 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2907 status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2908 &alias_pol,
2909 3,
2910 &info,
2911 &_result);
2912 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2913 status = dcerpc_samr_Close(b, mem_ctx,
2914 &alias_pol,
2915 &_result);
2916 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2917 description = info->description.string;
2918 }
2919 }
2920 }
2921 }
2922
2923 if (description != NULL) {
2924 printf("%-21.21s %-50.50s\n",
2925 groups->entries[i].name.string,
2926 description);
2927 } else {
2928 printf("%s\n", groups->entries[i].name.string);
2929 }
2930 }
2931 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2932 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
2933 /* Get builtin policy handle */
2934
2935 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2936 &connect_pol,
2937 MAXIMUM_ALLOWED_ACCESS,
2938 discard_const_p(struct dom_sid2, &global_sid_Builtin),
2939 &domain_pol,
2940 &result);
2941 if (!NT_STATUS_IS_OK(status)) {
2942 goto done;
2943 }
2944 if (!NT_STATUS_IS_OK(result)) {
2945 status = result;
2946 goto done;
2947 }
2948
2949 /* query builtin aliases */
2950 start_idx = 0;
2951 do {
2952 if (!builtin) break;
2953
2954 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2955 &domain_pol,
2956 &start_idx,
2957 &groups,
2958 max_entries,
2959 &num_entries,
2960 &result);
2961 if (!NT_STATUS_IS_OK(status)) {
2962 break;
2963 }
2964 if (!NT_STATUS_IS_OK(result) &&
2965 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
2966 status = result;
2967 break;
2968 }
2969
2970 for (i = 0; i < num_entries; i++) {
2971
2972 const char *description = NULL;
2973
2974 if (c->opt_long_list_entries) {
2975
2976 struct policy_handle alias_pol;
2977 union samr_AliasInfo *info = NULL;
2978 NTSTATUS _result;
2979
2980 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2981 &domain_pol,
2982 0x8,
2983 groups->entries[i].idx,
2984 &alias_pol,
2985 &_result);
2986 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2987 status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2988 &alias_pol,
2989 3,
2990 &info,
2991 &_result);
2992 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2993 status = dcerpc_samr_Close(b, mem_ctx,
2994 &alias_pol,
2995 &_result);
2996 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2997 description = info->description.string;
2998 }
2999 }
3000 }
3001 }
3002
3003 if (description != NULL) {
3004 printf("%-21.21s %-50.50s\n",
3005 groups->entries[i].name.string,
3006 description);
3007 } else {
3008 printf("%s\n", groups->entries[i].name.string);
3009 }
3010 }
3011 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
3012
3013 status = result;
3014
3015 done:
3016 return status;
3017}
3018
3019static int rpc_group_list(struct net_context *c, int argc, const char **argv)
3020{
3021 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3022 rpc_group_list_internals,
3023 argc, argv);
3024}
3025
3026static NTSTATUS rpc_list_group_members(struct net_context *c,
3027 struct rpc_pipe_client *pipe_hnd,
3028 TALLOC_CTX *mem_ctx,
3029 const char *domain_name,
3030 const struct dom_sid *domain_sid,
3031 struct policy_handle *domain_pol,
3032 uint32_t rid)
3033{
3034 NTSTATUS result, status;
3035 struct policy_handle group_pol;
3036 uint32_t num_members, *group_rids;
3037 int i;
3038 struct samr_RidAttrArray *rids = NULL;
3039 struct lsa_Strings names;
3040 struct samr_Ids types;
3041 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3042
3043 fstring sid_str;
3044 sid_to_fstring(sid_str, domain_sid);
3045
3046 status = dcerpc_samr_OpenGroup(b, mem_ctx,
3047 domain_pol,
3048 MAXIMUM_ALLOWED_ACCESS,
3049 rid,
3050 &group_pol,
3051 &result);
3052 if (!NT_STATUS_IS_OK(status)) {
3053 return status;
3054 }
3055 if (!NT_STATUS_IS_OK(result)) {
3056 return result;
3057 }
3058
3059 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
3060 &group_pol,
3061 &rids,
3062 &result);
3063 if (!NT_STATUS_IS_OK(status)) {
3064 return status;
3065 }
3066 if (!NT_STATUS_IS_OK(result)) {
3067 return result;
3068 }
3069
3070 num_members = rids->count;
3071 group_rids = rids->rids;
3072
3073 while (num_members > 0) {
3074 int this_time = 512;
3075
3076 if (num_members < this_time)
3077 this_time = num_members;
3078
3079 status = dcerpc_samr_LookupRids(b, mem_ctx,
3080 domain_pol,
3081 this_time,
3082 group_rids,
3083 &names,
3084 &types,
3085 &result);
3086 if (!NT_STATUS_IS_OK(status)) {
3087 return status;
3088 }
3089 if (!NT_STATUS_IS_OK(result)) {
3090 return result;
3091 }
3092 if (names.count != this_time) {
3093 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3094 }
3095 if (types.count != this_time) {
3096 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3097 }
3098 /* We only have users as members, but make the output
3099 the same as the output of alias members */
3100
3101 for (i = 0; i < this_time; i++) {
3102
3103 if (c->opt_long_list_entries) {
3104 printf("%s-%d %s\\%s %d\n", sid_str,
3105 group_rids[i], domain_name,
3106 names.names[i].string,
3107 SID_NAME_USER);
3108 } else {
3109 printf("%s\\%s\n", domain_name,
3110 names.names[i].string);
3111 }
3112 }
3113
3114 num_members -= this_time;
3115 group_rids += 512;
3116 }
3117
3118 return NT_STATUS_OK;
3119}
3120
3121static NTSTATUS rpc_list_alias_members(struct net_context *c,
3122 struct rpc_pipe_client *pipe_hnd,
3123 struct cli_state *cli,
3124 TALLOC_CTX *mem_ctx,
3125 struct policy_handle *domain_pol,
3126 uint32_t rid)
3127{
3128 NTSTATUS result, status;
3129 struct rpc_pipe_client *lsa_pipe;
3130 struct policy_handle alias_pol, lsa_pol;
3131 uint32_t num_members;
3132 struct dom_sid *alias_sids;
3133 char **domains;
3134 char **names;
3135 enum lsa_SidType *types;
3136 int i;
3137 struct lsa_SidArray sid_array;
3138 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3139
3140 status = dcerpc_samr_OpenAlias(b, mem_ctx,
3141 domain_pol,
3142 MAXIMUM_ALLOWED_ACCESS,
3143 rid,
3144 &alias_pol,
3145 &result);
3146 if (!NT_STATUS_IS_OK(status)) {
3147 return status;
3148 }
3149 if (!NT_STATUS_IS_OK(result)) {
3150 return result;
3151 }
3152
3153 status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
3154 &alias_pol,
3155 &sid_array,
3156 &result);
3157 if (!NT_STATUS_IS_OK(status)) {
3158 d_fprintf(stderr, _("Couldn't list alias members\n"));
3159 return status;
3160 }
3161 if (!NT_STATUS_IS_OK(result)) {
3162 d_fprintf(stderr, _("Couldn't list alias members\n"));
3163 return result;
3164 }
3165
3166 num_members = sid_array.num_sids;
3167
3168 if (num_members == 0) {
3169 return NT_STATUS_OK;
3170 }
3171
3172 result = cli_rpc_pipe_open_noauth(cli,
3173 &ndr_table_lsarpc,
3174 &lsa_pipe);
3175 if (!NT_STATUS_IS_OK(result)) {
3176 d_fprintf(stderr, _("Couldn't open LSA pipe. Error was %s\n"),
3177 nt_errstr(result) );
3178 return result;
3179 }
3180
3181 result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, true,
3182 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
3183
3184 if (!NT_STATUS_IS_OK(result)) {
3185 d_fprintf(stderr, _("Couldn't open LSA policy handle\n"));
3186 TALLOC_FREE(lsa_pipe);
3187 return result;
3188 }
3189
3190 alias_sids = talloc_zero_array(mem_ctx, struct dom_sid, num_members);
3191 if (!alias_sids) {
3192 d_fprintf(stderr, _("Out of memory\n"));
3193 TALLOC_FREE(lsa_pipe);
3194 return NT_STATUS_NO_MEMORY;
3195 }
3196
3197 for (i=0; i<num_members; i++) {
3198 sid_copy(&alias_sids[i], sid_array.sids[i].sid);
3199 }
3200
3201 result = rpccli_lsa_lookup_sids(lsa_pipe, mem_ctx, &lsa_pol,
3202 num_members, alias_sids,
3203 &domains, &names, &types);
3204
3205 if (!NT_STATUS_IS_OK(result) &&
3206 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
3207 d_fprintf(stderr, _("Couldn't lookup SIDs\n"));
3208 TALLOC_FREE(lsa_pipe);
3209 return result;
3210 }
3211
3212 for (i = 0; i < num_members; i++) {
3213 fstring sid_str;
3214 sid_to_fstring(sid_str, &alias_sids[i]);
3215
3216 if (c->opt_long_list_entries) {
3217 printf("%s %s\\%s %d\n", sid_str,
3218 domains[i] ? domains[i] : _("*unknown*"),
3219 names[i] ? names[i] : _("*unknown*"), types[i]);
3220 } else {
3221 if (domains[i])
3222 printf("%s\\%s\n", domains[i], names[i]);
3223 else
3224 printf("%s\n", sid_str);
3225 }
3226 }
3227
3228 TALLOC_FREE(lsa_pipe);
3229 return NT_STATUS_OK;
3230}
3231
3232static NTSTATUS rpc_group_members_internals(struct net_context *c,
3233 const struct dom_sid *domain_sid,
3234 const char *domain_name,
3235 struct cli_state *cli,
3236 struct rpc_pipe_client *pipe_hnd,
3237 TALLOC_CTX *mem_ctx,
3238 int argc,
3239 const char **argv)
3240{
3241 NTSTATUS result, status;
3242 struct policy_handle connect_pol, domain_pol;
3243 struct samr_Ids rids, rid_types;
3244 struct lsa_String lsa_acct_name;
3245 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3246
3247 /* Get sam policy handle */
3248
3249 status = dcerpc_samr_Connect2(b, mem_ctx,
3250 pipe_hnd->desthost,
3251 MAXIMUM_ALLOWED_ACCESS,
3252 &connect_pol,
3253 &result);
3254 if (!NT_STATUS_IS_OK(status)) {
3255 return status;
3256 }
3257 if (!NT_STATUS_IS_OK(result)) {
3258 return result;
3259 }
3260
3261 /* Get domain policy handle */
3262
3263 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3264 &connect_pol,
3265 MAXIMUM_ALLOWED_ACCESS,
3266 discard_const_p(struct dom_sid2, domain_sid),
3267 &domain_pol,
3268 &result);
3269 if (!NT_STATUS_IS_OK(status)) {
3270 return status;
3271 }
3272 if (!NT_STATUS_IS_OK(result)) {
3273 return result;
3274 }
3275
3276 init_lsa_String(&lsa_acct_name, argv[0]); /* sure? */
3277
3278 status = dcerpc_samr_LookupNames(b, mem_ctx,
3279 &domain_pol,
3280 1,
3281 &lsa_acct_name,
3282 &rids,
3283 &rid_types,
3284 &result);
3285 if (!NT_STATUS_IS_OK(status)) {
3286 return status;
3287 }
3288
3289 if (!NT_STATUS_IS_OK(result)) {
3290
3291 /* Ok, did not find it in the global sam, try with builtin */
3292
3293 struct dom_sid sid_Builtin;
3294
3295 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
3296
3297 sid_copy(&sid_Builtin, &global_sid_Builtin);
3298
3299 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3300 &connect_pol,
3301 MAXIMUM_ALLOWED_ACCESS,
3302 &sid_Builtin,
3303 &domain_pol,
3304 &result);
3305 if (!NT_STATUS_IS_OK(status)) {
3306 return status;
3307 }
3308 if (!NT_STATUS_IS_OK(result)) {
3309 d_fprintf(stderr, _("Couldn't find group %s\n"),
3310 argv[0]);
3311 return result;
3312 }
3313
3314 status = dcerpc_samr_LookupNames(b, mem_ctx,
3315 &domain_pol,
3316 1,
3317 &lsa_acct_name,
3318 &rids,
3319 &rid_types,
3320 &result);
3321 if (!NT_STATUS_IS_OK(status)) {
3322 return status;
3323 }
3324 if (!NT_STATUS_IS_OK(result)) {
3325 d_fprintf(stderr, _("Couldn't find group %s\n"),
3326 argv[0]);
3327 return result;
3328 }
3329 }
3330
3331 if (rids.count != 1) {
3332 d_fprintf(stderr, _("Couldn't find group %s\n"),
3333 argv[0]);
3334 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3335 }
3336 if (rid_types.count != 1) {
3337 d_fprintf(stderr, _("Couldn't find group %s\n"),
3338 argv[0]);
3339 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3340 }
3341
3342
3343 if (rid_types.ids[0] == SID_NAME_DOM_GRP) {
3344 return rpc_list_group_members(c, pipe_hnd, mem_ctx, domain_name,
3345 domain_sid, &domain_pol,
3346 rids.ids[0]);
3347 }
3348
3349 if (rid_types.ids[0] == SID_NAME_ALIAS) {
3350 return rpc_list_alias_members(c, pipe_hnd, cli, mem_ctx, &domain_pol,
3351 rids.ids[0]);
3352 }
3353
3354 return NT_STATUS_NO_SUCH_GROUP;
3355}
3356
3357static int rpc_group_members(struct net_context *c, int argc, const char **argv)
3358{
3359 if (argc != 1 || c->display_usage) {
3360 return rpc_group_usage(c, argc, argv);
3361 }
3362
3363 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3364 rpc_group_members_internals,
3365 argc, argv);
3366}
3367
3368static int rpc_group_rename_internals(struct net_context *c, int argc, const char **argv)
3369{
3370 NET_API_STATUS status;
3371 struct GROUP_INFO_0 g0;
3372 uint32_t parm_err;
3373
3374 if (argc != 2) {
3375 d_printf(_("Usage:\n"));
3376 d_printf("net rpc group rename group newname\n");
3377 return -1;
3378 }
3379
3380 g0.grpi0_name = argv[1];
3381
3382 status = NetGroupSetInfo(c->opt_host,
3383 argv[0],
3384 0,
3385 (uint8_t *)&g0,
3386 &parm_err);
3387
3388 if (status != 0) {
3389 d_fprintf(stderr, _("Renaming group %s failed with: %s\n"),
3390 argv[0], libnetapi_get_error_string(c->netapi_ctx,
3391 status));
3392 return -1;
3393 }
3394
3395 return 0;
3396}
3397
3398static int rpc_group_rename(struct net_context *c, int argc, const char **argv)
3399{
3400 if (argc != 2 || c->display_usage) {
3401 return rpc_group_usage(c, argc, argv);
3402 }
3403
3404 return rpc_group_rename_internals(c, argc, argv);
3405}
3406
3407/**
3408 * 'net rpc group' entrypoint.
3409 * @param argc Standard main() style argc.
3410 * @param argv Standard main() style argv. Initial components are already
3411 * stripped.
3412 **/
3413
3414int net_rpc_group(struct net_context *c, int argc, const char **argv)
3415{
3416 NET_API_STATUS status;
3417
3418 struct functable func[] = {
3419 {
3420 "add",
3421 rpc_group_add,
3422 NET_TRANSPORT_RPC,
3423 N_("Create specified group"),
3424 N_("net rpc group add\n"
3425 " Create specified group")
3426 },
3427 {
3428 "delete",
3429 rpc_group_delete,
3430 NET_TRANSPORT_RPC,
3431 N_("Delete specified group"),
3432 N_("net rpc group delete\n"
3433 " Delete specified group")
3434 },
3435 {
3436 "addmem",
3437 rpc_group_addmem,
3438 NET_TRANSPORT_RPC,
3439 N_("Add member to group"),
3440 N_("net rpc group addmem\n"
3441 " Add member to group")
3442 },
3443 {
3444 "delmem",
3445 rpc_group_delmem,
3446 NET_TRANSPORT_RPC,
3447 N_("Remove member from group"),
3448 N_("net rpc group delmem\n"
3449 " Remove member from group")
3450 },
3451 {
3452 "list",
3453 rpc_group_list,
3454 NET_TRANSPORT_RPC,
3455 N_("List groups"),
3456 N_("net rpc group list\n"
3457 " List groups")
3458 },
3459 {
3460 "members",
3461 rpc_group_members,
3462 NET_TRANSPORT_RPC,
3463 N_("List group members"),
3464 N_("net rpc group members\n"
3465 " List group members")
3466 },
3467 {
3468 "rename",
3469 rpc_group_rename,
3470 NET_TRANSPORT_RPC,
3471 N_("Rename group"),
3472 N_("net rpc group rename\n"
3473 " Rename group")
3474 },
3475 {NULL, NULL, 0, NULL, NULL}
3476 };
3477
3478 status = libnetapi_net_init(&c->netapi_ctx);
3479 if (status != 0) {
3480 return -1;
3481 }
3482 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
3483 libnetapi_set_password(c->netapi_ctx, c->opt_password);
3484 if (c->opt_kerberos) {
3485 libnetapi_set_use_kerberos(c->netapi_ctx);
3486 }
3487
3488 if (argc == 0) {
3489 if (c->display_usage) {
3490 d_printf(_("Usage:\n"));
3491 d_printf(_("net rpc group\n"
3492 " Alias for net rpc group list global "
3493 "local builtin\n"));
3494 net_display_usage_from_functable(func);
3495 return 0;
3496 }
3497
3498 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3499 rpc_group_list_internals,
3500 argc, argv);
3501 }
3502
3503 return net_run_function(c, argc, argv, "net rpc group", func);
3504}
3505
3506/****************************************************************************/
3507
3508static int rpc_share_usage(struct net_context *c, int argc, const char **argv)
3509{
3510 return net_share_usage(c, argc, argv);
3511}
3512
3513/**
3514 * Add a share on a remote RPC server.
3515 *
3516 * @param argc Standard main() style argc.
3517 * @param argv Standard main() style argv. Initial components are already
3518 * stripped.
3519 *
3520 * @return A shell status integer (0 for success).
3521 **/
3522
3523static int rpc_share_add(struct net_context *c, int argc, const char **argv)
3524{
3525 NET_API_STATUS status;
3526 char *sharename;
3527 char *path;
3528 uint32_t type = STYPE_DISKTREE; /* only allow disk shares to be added */
3529 uint32_t num_users=0, perms=0;
3530 char *password=NULL; /* don't allow a share password */
3531 struct SHARE_INFO_2 i2;
3532 uint32_t parm_error = 0;
3533
3534 if ((argc < 1) || !strchr(argv[0], '=') || c->display_usage) {
3535 return rpc_share_usage(c, argc, argv);
3536 }
3537
3538 if ((sharename = talloc_strdup(c, argv[0])) == NULL) {
3539 return -1;
3540 }
3541
3542 path = strchr(sharename, '=');
3543 if (!path) {
3544 return -1;
3545 }
3546
3547 *path++ = '\0';
3548
3549 i2.shi2_netname = sharename;
3550 i2.shi2_type = type;
3551 i2.shi2_remark = c->opt_comment;
3552 i2.shi2_permissions = perms;
3553 i2.shi2_max_uses = c->opt_maxusers;
3554 i2.shi2_current_uses = num_users;
3555 i2.shi2_path = path;
3556 i2.shi2_passwd = password;
3557
3558 status = NetShareAdd(c->opt_host,
3559 2,
3560 (uint8_t *)&i2,
3561 &parm_error);
3562 if (status != 0) {
3563 printf(_("NetShareAdd failed with: %s\n"),
3564 libnetapi_get_error_string(c->netapi_ctx, status));
3565 }
3566
3567 return status;
3568}
3569
3570/**
3571 * Delete a share on a remote RPC server.
3572 *
3573 * @param domain_sid The domain sid acquired from the remote server.
3574 * @param argc Standard main() style argc.
3575 * @param argv Standard main() style argv. Initial components are already
3576 * stripped.
3577 *
3578 * @return A shell status integer (0 for success).
3579 **/
3580static int rpc_share_delete(struct net_context *c, int argc, const char **argv)
3581{
3582 if (argc < 1 || c->display_usage) {
3583 return rpc_share_usage(c, argc, argv);
3584 }
3585
3586 return NetShareDel(c->opt_host, argv[0], 0);
3587}
3588
3589/**
3590 * Formatted print of share info
3591 *
3592 * @param r pointer to SHARE_INFO_1 to format
3593 **/
3594
3595static void display_share_info_1(struct net_context *c,
3596 struct SHARE_INFO_1 *r)
3597{
3598 if (c->opt_long_list_entries) {
3599 d_printf("%-12s %-8.8s %-50s\n",
3600 r->shi1_netname,
3601 net_share_type_str(r->shi1_type & ~(STYPE_TEMPORARY|STYPE_HIDDEN)),
3602 r->shi1_remark);
3603 } else {
3604 d_printf("%s\n", r->shi1_netname);
3605 }
3606}
3607
3608static WERROR get_share_info(struct net_context *c,
3609 struct rpc_pipe_client *pipe_hnd,
3610 TALLOC_CTX *mem_ctx,
3611 uint32_t level,
3612 int argc,
3613 const char **argv,
3614 struct srvsvc_NetShareInfoCtr *info_ctr)
3615{
3616 WERROR result;
3617 NTSTATUS status;
3618 union srvsvc_NetShareInfo info;
3619 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3620
3621 /* no specific share requested, enumerate all */
3622 if (argc == 0) {
3623
3624 uint32_t preferred_len = 0xffffffff;
3625 uint32_t total_entries = 0;
3626 uint32_t resume_handle = 0;
3627
3628 info_ctr->level = level;
3629
3630 status = dcerpc_srvsvc_NetShareEnumAll(b, mem_ctx,
3631 pipe_hnd->desthost,
3632 info_ctr,
3633 preferred_len,
3634 &total_entries,
3635 &resume_handle,
3636 &result);
3637 if (!NT_STATUS_IS_OK(status)) {
3638 return ntstatus_to_werror(status);
3639 }
3640 return result;
3641 }
3642
3643 /* request just one share */
3644 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
3645 pipe_hnd->desthost,
3646 argv[0],
3647 level,
3648 &info,
3649 &result);
3650
3651 if (!NT_STATUS_IS_OK(status)) {
3652 result = ntstatus_to_werror(status);
3653 goto done;
3654 }
3655
3656 if (!W_ERROR_IS_OK(result)) {
3657 goto done;
3658 }
3659
3660 /* construct ctr */
3661 ZERO_STRUCTP(info_ctr);
3662
3663 info_ctr->level = level;
3664
3665 switch (level) {
3666 case 1:
3667 {
3668 struct srvsvc_NetShareCtr1 *ctr1;
3669
3670 ctr1 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr1);
3671 W_ERROR_HAVE_NO_MEMORY(ctr1);
3672
3673 ctr1->count = 1;
3674 ctr1->array = info.info1;
3675
3676 info_ctr->ctr.ctr1 = ctr1;
3677
3678 break;
3679 }
3680 case 2:
3681 {
3682 struct srvsvc_NetShareCtr2 *ctr2;
3683
3684 ctr2 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr2);
3685 W_ERROR_HAVE_NO_MEMORY(ctr2);
3686
3687 ctr2->count = 1;
3688 ctr2->array = info.info2;
3689
3690 info_ctr->ctr.ctr2 = ctr2;
3691
3692 break;
3693 }
3694 case 502:
3695 {
3696 struct srvsvc_NetShareCtr502 *ctr502;
3697
3698 ctr502 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr502);
3699 W_ERROR_HAVE_NO_MEMORY(ctr502);
3700
3701 ctr502->count = 1;
3702 ctr502->array = info.info502;
3703
3704 info_ctr->ctr.ctr502 = ctr502;
3705
3706 break;
3707 }
3708 } /* switch */
3709done:
3710 return result;
3711}
3712
3713/***
3714 * 'net rpc share list' entrypoint.
3715 * @param argc Standard main() style argc.
3716 * @param argv Standard main() style argv. Initial components are already
3717 * stripped.
3718 **/
3719static int rpc_share_list(struct net_context *c, int argc, const char **argv)
3720{
3721 NET_API_STATUS status;
3722 struct SHARE_INFO_1 *i1 = NULL;
3723 uint32_t entries_read = 0;
3724 uint32_t total_entries = 0;
3725 uint32_t resume_handle = 0;
3726 uint32_t i, level = 1;
3727
3728 if (c->display_usage) {
3729 d_printf( "%s\n"
3730 "net rpc share list\n"
3731 " %s\n",
3732 _("Usage:"),
3733 _("List shares on remote server"));
3734 return 0;
3735 }
3736
3737 status = NetShareEnum(c->opt_host,
3738 level,
3739 (uint8_t **)(void *)&i1,
3740 (uint32_t)-1,
3741 &entries_read,
3742 &total_entries,
3743 &resume_handle);
3744 if (status != 0) {
3745 goto done;
3746 }
3747
3748 /* Display results */
3749
3750 if (c->opt_long_list_entries) {
3751 d_printf(_(
3752 "\nEnumerating shared resources (exports) on remote server:\n\n"
3753 "\nShare name Type Description\n"
3754 "---------- ---- -----------\n"));
3755 }
3756 for (i = 0; i < entries_read; i++)
3757 display_share_info_1(c, &i1[i]);
3758 done:
3759 return status;
3760}
3761
3762static bool check_share_availability(struct cli_state *cli, const char *netname)
3763{
3764 NTSTATUS status;
3765
3766 status = cli_tree_connect(cli, netname, "A:", "", 0);
3767 if (!NT_STATUS_IS_OK(status)) {
3768 d_printf(_("skipping [%s]: not a file share.\n"), netname);
3769 return false;
3770 }
3771
3772 status = cli_tdis(cli);
3773 if (!NT_STATUS_IS_OK(status)) {
3774 d_printf(_("cli_tdis returned %s\n"), nt_errstr(status));
3775 return false;
3776 }
3777
3778 return true;
3779}
3780
3781static bool check_share_sanity(struct net_context *c, struct cli_state *cli,
3782 const char *netname, uint32_t type)
3783{
3784 /* only support disk shares */
3785 if (! ( type == STYPE_DISKTREE || type == (STYPE_DISKTREE | STYPE_HIDDEN)) ) {
3786 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname,
3787 type);
3788 return false;
3789 }
3790
3791 /* skip builtin shares */
3792 /* FIXME: should print$ be added too ? */
3793 if (strequal(netname,"IPC$") || strequal(netname,"ADMIN$") ||
3794 strequal(netname,"global"))
3795 return false;
3796
3797 if (c->opt_exclude && in_list(netname, c->opt_exclude, false)) {
3798 printf(_("excluding [%s]\n"), netname);
3799 return false;
3800 }
3801
3802 return check_share_availability(cli, netname);
3803}
3804
3805/**
3806 * Migrate shares from a remote RPC server to the local RPC server.
3807 *
3808 * All parameters are provided by the run_rpc_command function, except for
3809 * argc, argv which are passed through.
3810 *
3811 * @param domain_sid The domain sid acquired from the remote server.
3812 * @param cli A cli_state connected to the server.
3813 * @param mem_ctx Talloc context, destroyed on completion of the function.
3814 * @param argc Standard main() style argc.
3815 * @param argv Standard main() style argv. Initial components are already
3816 * stripped.
3817 *
3818 * @return Normal NTSTATUS return.
3819 **/
3820
3821static NTSTATUS rpc_share_migrate_shares_internals(struct net_context *c,
3822 const struct dom_sid *domain_sid,
3823 const char *domain_name,
3824 struct cli_state *cli,
3825 struct rpc_pipe_client *pipe_hnd,
3826 TALLOC_CTX *mem_ctx,
3827 int argc,
3828 const char **argv)
3829{
3830 WERROR result;
3831 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3832 struct srvsvc_NetShareInfoCtr ctr_src;
3833 uint32_t i;
3834 struct rpc_pipe_client *srvsvc_pipe = NULL;
3835 struct cli_state *cli_dst = NULL;
3836 uint32_t level = 502; /* includes secdesc */
3837 uint32_t parm_error = 0;
3838 struct dcerpc_binding_handle *b;
3839
3840 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3841 &ctr_src);
3842 if (!W_ERROR_IS_OK(result))
3843 goto done;
3844
3845 /* connect destination PI_SRVSVC */
3846 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
3847 &ndr_table_srvsvc);
3848 if (!NT_STATUS_IS_OK(nt_status))
3849 return nt_status;
3850
3851 b = srvsvc_pipe->binding_handle;
3852
3853 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3854
3855 union srvsvc_NetShareInfo info;
3856 struct srvsvc_NetShareInfo502 info502 =
3857 ctr_src.ctr.ctr502->array[i];
3858
3859 /* reset error-code */
3860 nt_status = NT_STATUS_UNSUCCESSFUL;
3861
3862 if (!check_share_sanity(c, cli, info502.name, info502.type))
3863 continue;
3864
3865 /* finally add the share on the dst server */
3866
3867 printf(_("migrating: [%s], path: %s, comment: %s, without "
3868 "share-ACLs\n"),
3869 info502.name, info502.path, info502.comment);
3870
3871 info.info502 = &info502;
3872
3873 nt_status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
3874 srvsvc_pipe->desthost,
3875 502,
3876 &info,
3877 &parm_error,
3878 &result);
3879 if (!NT_STATUS_IS_OK(nt_status)) {
3880 printf(_("cannot add share: %s\n"),
3881 nt_errstr(nt_status));
3882 goto done;
3883 }
3884 if (W_ERROR_V(result) == W_ERROR_V(WERR_FILE_EXISTS)) {
3885 printf(_(" [%s] does already exist\n"),
3886 info502.name);
3887 continue;
3888 }
3889
3890 if (!W_ERROR_IS_OK(result)) {
3891 nt_status = werror_to_ntstatus(result);
3892 printf(_("cannot add share: %s\n"),
3893 win_errstr(result));
3894 goto done;
3895 }
3896
3897 }
3898
3899 nt_status = NT_STATUS_OK;
3900
3901done:
3902 if (cli_dst) {
3903 cli_shutdown(cli_dst);
3904 }
3905
3906 return nt_status;
3907
3908}
3909
3910/**
3911 * Migrate shares from a RPC server to another.
3912 *
3913 * @param argc Standard main() style argc.
3914 * @param argv Standard main() style argv. Initial components are already
3915 * stripped.
3916 *
3917 * @return A shell status integer (0 for success).
3918 **/
3919static int rpc_share_migrate_shares(struct net_context *c, int argc,
3920 const char **argv)
3921{
3922 if (c->display_usage) {
3923 d_printf( "%s\n"
3924 "net rpc share migrate shares\n"
3925 " %s\n",
3926 _("Usage:"),
3927 _("Migrate shares to local server"));
3928 return 0;
3929 }
3930
3931 if (!c->opt_host) {
3932 printf(_("no server to migrate\n"));
3933 return -1;
3934 }
3935
3936 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
3937 rpc_share_migrate_shares_internals,
3938 argc, argv);
3939}
3940
3941/**
3942 * Copy a file/dir
3943 *
3944 * @param f file_info
3945 * @param mask current search mask
3946 * @param state arg-pointer
3947 *
3948 **/
3949static NTSTATUS copy_fn(const char *mnt, struct file_info *f,
3950 const char *mask, void *state)
3951{
3952 static NTSTATUS nt_status;
3953 static struct copy_clistate *local_state;
3954 static fstring filename, new_mask;
3955 fstring dir;
3956 char *old_dir;
3957 struct net_context *c;
3958
3959 local_state = (struct copy_clistate *)state;
3960 nt_status = NT_STATUS_UNSUCCESSFUL;
3961
3962 c = local_state->c;
3963
3964 if (strequal(f->name, ".") || strequal(f->name, ".."))
3965 return NT_STATUS_OK;
3966
3967 DEBUG(3,("got mask: %s, name: %s\n", mask, f->name));
3968
3969 /* DIRECTORY */
3970 if (f->mode & FILE_ATTRIBUTE_DIRECTORY) {
3971
3972 DEBUG(3,("got dir: %s\n", f->name));
3973
3974 fstrcpy(dir, local_state->cwd);
3975 fstrcat(dir, "\\");
3976 fstrcat(dir, f->name);
3977
3978 switch (net_mode_share)
3979 {
3980 case NET_MODE_SHARE_MIGRATE:
3981 /* create that directory */
3982 nt_status = net_copy_file(c, local_state->mem_ctx,
3983 local_state->cli_share_src,
3984 local_state->cli_share_dst,
3985 dir, dir,
3986 c->opt_acls? true : false,
3987 c->opt_attrs? true : false,
3988 c->opt_timestamps? true:false,
3989 false);
3990 break;
3991 default:
3992 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3993 return NT_STATUS_INTERNAL_ERROR;
3994 }
3995
3996 if (!NT_STATUS_IS_OK(nt_status)) {
3997 printf(_("could not handle dir %s: %s\n"),
3998 dir, nt_errstr(nt_status));
3999 return nt_status;
4000 }
4001
4002 /* search below that directory */
4003 if (strlcpy(new_mask, dir, sizeof(new_mask)) >= sizeof(new_mask)) {
4004 return NT_STATUS_NO_MEMORY;
4005 }
4006 if (strlcat(new_mask, "\\*", sizeof(new_mask)) >= sizeof(new_mask)) {
4007 return NT_STATUS_NO_MEMORY;
4008 }
4009
4010 old_dir = local_state->cwd;
4011 local_state->cwd = dir;
4012 nt_status = sync_files(local_state, new_mask);
4013 if (!NT_STATUS_IS_OK(nt_status)) {
4014 printf(_("could not handle files\n"));
4015 }
4016 local_state->cwd = old_dir;
4017
4018 return nt_status;
4019 }
4020
4021
4022 /* FILE */
4023 fstrcpy(filename, local_state->cwd);
4024 fstrcat(filename, "\\");
4025 fstrcat(filename, f->name);
4026
4027 DEBUG(3,("got file: %s\n", filename));
4028
4029 switch (net_mode_share)
4030 {
4031 case NET_MODE_SHARE_MIGRATE:
4032 nt_status = net_copy_file(c, local_state->mem_ctx,
4033 local_state->cli_share_src,
4034 local_state->cli_share_dst,
4035 filename, filename,
4036 c->opt_acls? true : false,
4037 c->opt_attrs? true : false,
4038 c->opt_timestamps? true: false,
4039 true);
4040 break;
4041 default:
4042 d_fprintf(stderr, _("Unsupported file mode %d\n"),
4043 net_mode_share);
4044 return NT_STATUS_INTERNAL_ERROR;
4045 }
4046
4047 if (!NT_STATUS_IS_OK(nt_status))
4048 printf(_("could not handle file %s: %s\n"),
4049 filename, nt_errstr(nt_status));
4050 return nt_status;
4051}
4052
4053/**
4054 * sync files, can be called recursivly to list files
4055 * and then call copy_fn for each file
4056 *
4057 * @param cp_clistate pointer to the copy_clistate we work with
4058 * @param mask the current search mask
4059 *
4060 * @return Boolean result
4061 **/
4062static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask)
4063{
4064 struct cli_state *targetcli;
4065 char *targetpath = NULL;
4066 NTSTATUS status;
4067
4068 DEBUG(3,("calling cli_list with mask: %s\n", mask));
4069
4070 status = cli_resolve_path(talloc_tos(), "", NULL,
4071 cp_clistate->cli_share_src,
4072 mask, &targetcli, &targetpath);
4073 if (!NT_STATUS_IS_OK(status)) {
4074 d_fprintf(stderr, _("cli_resolve_path %s failed with error: "
4075 "%s\n"),
4076 mask, nt_errstr(status));
4077 return status;
4078 }
4079
4080 status = cli_list(targetcli, targetpath, cp_clistate->attribute,
4081 copy_fn, cp_clistate);
4082 if (!NT_STATUS_IS_OK(status)) {
4083 d_fprintf(stderr, _("listing %s failed with error: %s\n"),
4084 mask, nt_errstr(status));
4085 }
4086
4087 return status;
4088}
4089
4090
4091/**
4092 * Set the top level directory permissions before we do any further copies.
4093 * Should set up ACL inheritance.
4094 **/
4095
4096bool copy_top_level_perms(struct net_context *c,
4097 struct copy_clistate *cp_clistate,
4098 const char *sharename)
4099{
4100 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
4101
4102 switch (net_mode_share) {
4103 case NET_MODE_SHARE_MIGRATE:
4104 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename));
4105 nt_status = net_copy_fileattr(c,
4106 cp_clistate->mem_ctx,
4107 cp_clistate->cli_share_src,
4108 cp_clistate->cli_share_dst,
4109 "\\", "\\",
4110 c->opt_acls? true : false,
4111 c->opt_attrs? true : false,
4112 c->opt_timestamps? true: false,
4113 false);
4114 break;
4115 default:
4116 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
4117 break;
4118 }
4119
4120 if (!NT_STATUS_IS_OK(nt_status)) {
4121 printf(_("Could handle directory attributes for top level "
4122 "directory of share %s. Error %s\n"),
4123 sharename, nt_errstr(nt_status));
4124 return false;
4125 }
4126
4127 return true;
4128}
4129
4130/**
4131 * Sync all files inside a remote share to another share (over smb).
4132 *
4133 * All parameters are provided by the run_rpc_command function, except for
4134 * argc, argv which are passed through.
4135 *
4136 * @param domain_sid The domain sid acquired from the remote server.
4137 * @param cli A cli_state connected to the server.
4138 * @param mem_ctx Talloc context, destroyed on completion of the function.
4139 * @param argc Standard main() style argc.
4140 * @param argv Standard main() style argv. Initial components are already
4141 * stripped.
4142 *
4143 * @return Normal NTSTATUS return.
4144 **/
4145
4146static NTSTATUS rpc_share_migrate_files_internals(struct net_context *c,
4147 const struct dom_sid *domain_sid,
4148 const char *domain_name,
4149 struct cli_state *cli,
4150 struct rpc_pipe_client *pipe_hnd,
4151 TALLOC_CTX *mem_ctx,
4152 int argc,
4153 const char **argv)
4154{
4155 WERROR result;
4156 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
4157 struct srvsvc_NetShareInfoCtr ctr_src;
4158 uint32_t i;
4159 uint32_t level = 502;
4160 struct copy_clistate cp_clistate;
4161 bool got_src_share = false;
4162 bool got_dst_share = false;
4163 const char *mask = "\\*";
4164 char *dst = NULL;
4165
4166 dst = SMB_STRDUP(c->opt_destination?c->opt_destination:"127.0.0.1");
4167 if (dst == NULL) {
4168 nt_status = NT_STATUS_NO_MEMORY;
4169 goto done;
4170 }
4171
4172 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
4173 &ctr_src);
4174
4175 if (!W_ERROR_IS_OK(result))
4176 goto done;
4177
4178 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
4179
4180 struct srvsvc_NetShareInfo502 info502 =
4181 ctr_src.ctr.ctr502->array[i];
4182
4183 if (!check_share_sanity(c, cli, info502.name, info502.type))
4184 continue;
4185
4186 /* one might not want to mirror whole discs :) */
4187 if (strequal(info502.name, "print$") || info502.name[1] == '$') {
4188 d_printf(_("skipping [%s]: builtin/hidden share\n"),
4189 info502.name);
4190 continue;
4191 }
4192
4193 switch (net_mode_share)
4194 {
4195 case NET_MODE_SHARE_MIGRATE:
4196 printf("syncing");
4197 break;
4198 default:
4199 d_fprintf(stderr, _("Unsupported mode %d\n"),
4200 net_mode_share);
4201 break;
4202 }
4203 printf(_(" [%s] files and directories %s ACLs, %s DOS "
4204 "Attributes %s\n"),
4205 info502.name,
4206 c->opt_acls ? _("including") : _("without"),
4207 c->opt_attrs ? _("including") : _("without"),
4208 c->opt_timestamps ? _("(preserving timestamps)") : "");
4209
4210 cp_clistate.mem_ctx = mem_ctx;
4211 cp_clistate.cli_share_src = NULL;
4212 cp_clistate.cli_share_dst = NULL;
4213 cp_clistate.cwd = NULL;
4214 cp_clistate.attribute = FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
4215 cp_clistate.c = c;
4216
4217 /* open share source */
4218 nt_status = connect_to_service(c, &cp_clistate.cli_share_src,
4219 smbXcli_conn_remote_sockaddr(cli->conn),
4220 smbXcli_conn_remote_name(cli->conn),
4221 info502.name, "A:");
4222 if (!NT_STATUS_IS_OK(nt_status))
4223 goto done;
4224
4225 got_src_share = true;
4226
4227 if (net_mode_share == NET_MODE_SHARE_MIGRATE) {
4228 /* open share destination */
4229 nt_status = connect_to_service(c, &cp_clistate.cli_share_dst,
4230 NULL, dst, info502.name, "A:");
4231 if (!NT_STATUS_IS_OK(nt_status))
4232 goto done;
4233
4234 got_dst_share = true;
4235 }
4236
4237 if (!copy_top_level_perms(c, &cp_clistate, info502.name)) {
4238 d_fprintf(stderr, _("Could not handle the top level "
4239 "directory permissions for the "
4240 "share: %s\n"), info502.name);
4241 nt_status = NT_STATUS_UNSUCCESSFUL;
4242 goto done;
4243 }
4244
4245 nt_status = sync_files(&cp_clistate, mask);
4246 if (!NT_STATUS_IS_OK(nt_status)) {
4247 d_fprintf(stderr, _("could not handle files for share: "
4248 "%s\n"), info502.name);
4249 goto done;
4250 }
4251 }
4252
4253 nt_status = NT_STATUS_OK;
4254
4255done:
4256
4257 if (got_src_share)
4258 cli_shutdown(cp_clistate.cli_share_src);
4259
4260 if (got_dst_share)
4261 cli_shutdown(cp_clistate.cli_share_dst);
4262
4263 SAFE_FREE(dst);
4264 return nt_status;
4265
4266}
4267
4268static int rpc_share_migrate_files(struct net_context *c, int argc, const char **argv)
4269{
4270 if (c->display_usage) {
4271 d_printf( "%s\n"
4272 "net share migrate files\n"
4273 " %s\n",
4274 _("Usage:"),
4275 _("Migrate files to local server"));
4276 return 0;
4277 }
4278
4279 if (!c->opt_host) {
4280 d_printf(_("no server to migrate\n"));
4281 return -1;
4282 }
4283
4284 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4285 rpc_share_migrate_files_internals,
4286 argc, argv);
4287}
4288
4289/**
4290 * Migrate share-ACLs from a remote RPC server to the local RPC server.
4291 *
4292 * All parameters are provided by the run_rpc_command function, except for
4293 * argc, argv which are passed through.
4294 *
4295 * @param domain_sid The domain sid acquired from the remote server.
4296 * @param cli A cli_state connected to the server.
4297 * @param mem_ctx Talloc context, destroyed on completion of the function.
4298 * @param argc Standard main() style argc.
4299 * @param argv Standard main() style argv. Initial components are already
4300 * stripped.
4301 *
4302 * @return Normal NTSTATUS return.
4303 **/
4304
4305static NTSTATUS rpc_share_migrate_security_internals(struct net_context *c,
4306 const struct dom_sid *domain_sid,
4307 const char *domain_name,
4308 struct cli_state *cli,
4309 struct rpc_pipe_client *pipe_hnd,
4310 TALLOC_CTX *mem_ctx,
4311 int argc,
4312 const char **argv)
4313{
4314 WERROR result;
4315 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
4316 struct srvsvc_NetShareInfoCtr ctr_src;
4317 union srvsvc_NetShareInfo info;
4318 uint32_t i;
4319 struct rpc_pipe_client *srvsvc_pipe = NULL;
4320 struct cli_state *cli_dst = NULL;
4321 uint32_t level = 502; /* includes secdesc */
4322 uint32_t parm_error = 0;
4323 struct dcerpc_binding_handle *b;
4324
4325 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
4326 &ctr_src);
4327
4328 if (!W_ERROR_IS_OK(result))
4329 goto done;
4330
4331 /* connect destination PI_SRVSVC */
4332 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
4333 &ndr_table_srvsvc);
4334 if (!NT_STATUS_IS_OK(nt_status))
4335 return nt_status;
4336
4337 b = srvsvc_pipe->binding_handle;
4338
4339 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
4340
4341 struct srvsvc_NetShareInfo502 info502 =
4342 ctr_src.ctr.ctr502->array[i];
4343
4344 /* reset error-code */
4345 nt_status = NT_STATUS_UNSUCCESSFUL;
4346
4347 if (!check_share_sanity(c, cli, info502.name, info502.type))
4348 continue;
4349
4350 printf(_("migrating: [%s], path: %s, comment: %s, including "
4351 "share-ACLs\n"),
4352 info502.name, info502.path, info502.comment);
4353
4354 if (c->opt_verbose)
4355 display_sec_desc(info502.sd_buf.sd);
4356
4357 /* FIXME: shouldn't we be able to just set the security descriptor ? */
4358 info.info502 = &info502;
4359
4360 /* finally modify the share on the dst server */
4361 nt_status = dcerpc_srvsvc_NetShareSetInfo(b, mem_ctx,
4362 srvsvc_pipe->desthost,
4363 info502.name,
4364 level,
4365 &info,
4366 &parm_error,
4367 &result);
4368 if (!NT_STATUS_IS_OK(nt_status)) {
4369 printf(_("cannot set share-acl: %s\n"),
4370 nt_errstr(nt_status));
4371 goto done;
4372 }
4373 if (!W_ERROR_IS_OK(result)) {
4374 nt_status = werror_to_ntstatus(result);
4375 printf(_("cannot set share-acl: %s\n"),
4376 win_errstr(result));
4377 goto done;
4378 }
4379
4380 }
4381
4382 nt_status = NT_STATUS_OK;
4383
4384done:
4385 if (cli_dst) {
4386 cli_shutdown(cli_dst);
4387 }
4388
4389 return nt_status;
4390
4391}
4392
4393/**
4394 * Migrate share-acls from a RPC server to another.
4395 *
4396 * @param argc Standard main() style argc.
4397 * @param argv Standard main() style argv. Initial components are already
4398 * stripped.
4399 *
4400 * @return A shell status integer (0 for success).
4401 **/
4402static int rpc_share_migrate_security(struct net_context *c, int argc,
4403 const char **argv)
4404{
4405 if (c->display_usage) {
4406 d_printf( "%s\n"
4407 "net rpc share migrate security\n"
4408 " %s\n",
4409 _("Usage:"),
4410 _("Migrate share-acls to local server"));
4411 return 0;
4412 }
4413
4414 if (!c->opt_host) {
4415 d_printf(_("no server to migrate\n"));
4416 return -1;
4417 }
4418
4419 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4420 rpc_share_migrate_security_internals,
4421 argc, argv);
4422}
4423
4424/**
4425 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
4426 * from one server to another.
4427 *
4428 * @param argc Standard main() style argc.
4429 * @param argv Standard main() style argv. Initial components are already
4430 * stripped.
4431 *
4432 * @return A shell status integer (0 for success).
4433 *
4434 **/
4435static int rpc_share_migrate_all(struct net_context *c, int argc,
4436 const char **argv)
4437{
4438 int ret;
4439
4440 if (c->display_usage) {
4441 d_printf( "%s\n"
4442 "net rpc share migrate all\n"
4443 " %s\n",
4444 _("Usage:"),
4445 _("Migrates shares including all share settings"));
4446 return 0;
4447 }
4448
4449 if (!c->opt_host) {
4450 d_printf(_("no server to migrate\n"));
4451 return -1;
4452 }
4453
4454 /* order is important. we don't want to be locked out by the share-acl
4455 * before copying files - gd */
4456
4457 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4458 rpc_share_migrate_shares_internals, argc, argv);
4459 if (ret)
4460 return ret;
4461
4462 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4463 rpc_share_migrate_files_internals, argc, argv);
4464 if (ret)
4465 return ret;
4466
4467 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4468 rpc_share_migrate_security_internals, argc,
4469 argv);
4470}
4471
4472
4473/**
4474 * 'net rpc share migrate' entrypoint.
4475 * @param argc Standard main() style argc.
4476 * @param argv Standard main() style argv. Initial components are already
4477 * stripped.
4478 **/
4479static int rpc_share_migrate(struct net_context *c, int argc, const char **argv)
4480{
4481
4482 struct functable func[] = {
4483 {
4484 "all",
4485 rpc_share_migrate_all,
4486 NET_TRANSPORT_RPC,
4487 N_("Migrate shares from remote to local server"),
4488 N_("net rpc share migrate all\n"
4489 " Migrate shares from remote to local server")
4490 },
4491 {
4492 "files",
4493 rpc_share_migrate_files,
4494 NET_TRANSPORT_RPC,
4495 N_("Migrate files from remote to local server"),
4496 N_("net rpc share migrate files\n"
4497 " Migrate files from remote to local server")
4498 },
4499 {
4500 "security",
4501 rpc_share_migrate_security,
4502 NET_TRANSPORT_RPC,
4503 N_("Migrate share-ACLs from remote to local server"),
4504 N_("net rpc share migrate security\n"
4505 " Migrate share-ACLs from remote to local server")
4506 },
4507 {
4508 "shares",
4509 rpc_share_migrate_shares,
4510 NET_TRANSPORT_RPC,
4511 N_("Migrate shares from remote to local server"),
4512 N_("net rpc share migrate shares\n"
4513 " Migrate shares from remote to local server")
4514 },
4515 {NULL, NULL, 0, NULL, NULL}
4516 };
4517
4518 net_mode_share = NET_MODE_SHARE_MIGRATE;
4519
4520 return net_run_function(c, argc, argv, "net rpc share migrate", func);
4521}
4522
4523struct full_alias {
4524 struct dom_sid sid;
4525 uint32_t num_members;
4526 struct dom_sid *members;
4527};
4528
4529static int num_server_aliases;
4530static struct full_alias *server_aliases;
4531
4532/*
4533 * Add an alias to the static list.
4534 */
4535static void push_alias(struct full_alias *alias)
4536{
4537 size_t array_size;
4538
4539 if (server_aliases == NULL) {
4540 server_aliases = talloc_array(NULL, struct full_alias, 100);
4541 if (server_aliases == NULL) {
4542 smb_panic("talloc_array failed");
4543 }
4544 }
4545
4546 array_size = talloc_array_length(server_aliases);
4547 if (array_size == num_server_aliases) {
4548 server_aliases = talloc_realloc(NULL, server_aliases,
4549 struct full_alias, array_size + 100);
4550 if (server_aliases == NULL) {
4551 smb_panic("talloc_realloc failed");
4552 }
4553 }
4554
4555 server_aliases[num_server_aliases] = *alias;
4556 num_server_aliases += 1;
4557}
4558
4559/*
4560 * For a specific domain on the server, fetch all the aliases
4561 * and their members. Add all of them to the server_aliases.
4562 */
4563
4564static NTSTATUS rpc_fetch_domain_aliases(struct rpc_pipe_client *pipe_hnd,
4565 TALLOC_CTX *mem_ctx,
4566 struct policy_handle *connect_pol,
4567 const struct dom_sid *domain_sid)
4568{
4569 uint32_t start_idx, max_entries, num_entries, i;
4570 struct samr_SamArray *groups = NULL;
4571 NTSTATUS result, status;
4572 struct policy_handle domain_pol;
4573 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4574
4575 /* Get domain policy handle */
4576
4577 status = dcerpc_samr_OpenDomain(b, mem_ctx,
4578 connect_pol,
4579 MAXIMUM_ALLOWED_ACCESS,
4580 discard_const_p(struct dom_sid2, domain_sid),
4581 &domain_pol,
4582 &result);
4583 if (!NT_STATUS_IS_OK(status)) {
4584 return status;
4585 }
4586 if (!NT_STATUS_IS_OK(result)) {
4587 return result;
4588 }
4589
4590 start_idx = 0;
4591 max_entries = 250;
4592
4593 do {
4594 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
4595 &domain_pol,
4596 &start_idx,
4597 &groups,
4598 max_entries,
4599 &num_entries,
4600 &result);
4601 if (!NT_STATUS_IS_OK(status)) {
4602 goto done;
4603 }
4604 for (i = 0; i < num_entries; i++) {
4605
4606 struct policy_handle alias_pol;
4607 struct full_alias alias;
4608 struct lsa_SidArray sid_array;
4609 int j;
4610 NTSTATUS _result;
4611
4612 status = dcerpc_samr_OpenAlias(b, mem_ctx,
4613 &domain_pol,
4614 MAXIMUM_ALLOWED_ACCESS,
4615 groups->entries[i].idx,
4616 &alias_pol,
4617 &_result);
4618 if (!NT_STATUS_IS_OK(status)) {
4619 goto done;
4620 }
4621 if (!NT_STATUS_IS_OK(_result)) {
4622 status = _result;
4623 goto done;
4624 }
4625
4626 status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
4627 &alias_pol,
4628 &sid_array,
4629 &_result);
4630 if (!NT_STATUS_IS_OK(status)) {
4631 goto done;
4632 }
4633 if (!NT_STATUS_IS_OK(_result)) {
4634 status = _result;
4635 goto done;
4636 }
4637
4638 alias.num_members = sid_array.num_sids;
4639
4640 status = dcerpc_samr_Close(b, mem_ctx, &alias_pol, &_result);
4641 if (!NT_STATUS_IS_OK(status)) {
4642 goto done;
4643 }
4644 if (!NT_STATUS_IS_OK(_result)) {
4645 status = _result;
4646 goto done;
4647 }
4648
4649 alias.members = NULL;
4650
4651 if (alias.num_members > 0) {
4652 alias.members = SMB_MALLOC_ARRAY(struct dom_sid, alias.num_members);
4653
4654 for (j = 0; j < alias.num_members; j++)
4655 sid_copy(&alias.members[j],
4656 sid_array.sids[j].sid);
4657 }
4658
4659 sid_compose(&alias.sid, domain_sid,
4660 groups->entries[i].idx);
4661
4662 push_alias(&alias);
4663 }
4664 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
4665
4666 status = NT_STATUS_OK;
4667
4668 done:
4669 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
4670
4671 return status;
4672}
4673
4674/*
4675 * Dump server_aliases as names for debugging purposes.
4676 */
4677
4678static NTSTATUS rpc_aliaslist_dump(struct net_context *c,
4679 const struct dom_sid *domain_sid,
4680 const char *domain_name,
4681 struct cli_state *cli,
4682 struct rpc_pipe_client *pipe_hnd,
4683 TALLOC_CTX *mem_ctx,
4684 int argc,
4685 const char **argv)
4686{
4687 int i;
4688 NTSTATUS result;
4689 struct policy_handle lsa_pol;
4690 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4691
4692 result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
4693 SEC_FLAG_MAXIMUM_ALLOWED,
4694 &lsa_pol);
4695 if (!NT_STATUS_IS_OK(result))
4696 return result;
4697
4698 for (i=0; i<num_server_aliases; i++) {
4699 char **names;
4700 char **domains;
4701 enum lsa_SidType *types;
4702 int j;
4703
4704 struct full_alias *alias = &server_aliases[i];
4705
4706 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol, 1,
4707 &alias->sid,
4708 &domains, &names, &types);
4709 if (!NT_STATUS_IS_OK(result))
4710 continue;
4711
4712 DEBUG(1, ("%s\\%s %d: ", domains[0], names[0], types[0]));
4713
4714 if (alias->num_members == 0) {
4715 DEBUG(1, ("\n"));
4716 continue;
4717 }
4718
4719 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol,
4720 alias->num_members,
4721 alias->members,
4722 &domains, &names, &types);
4723
4724 if (!NT_STATUS_IS_OK(result) &&
4725 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
4726 continue;
4727
4728 for (j=0; j<alias->num_members; j++)
4729 DEBUG(1, ("%s\\%s (%d); ",
4730 domains[j] ? domains[j] : "*unknown*",
4731 names[j] ? names[j] : "*unknown*",types[j]));
4732 DEBUG(1, ("\n"));
4733 }
4734
4735 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
4736
4737 return NT_STATUS_OK;
4738}
4739
4740/*
4741 * Fetch a list of all server aliases and their members into
4742 * server_aliases.
4743 */
4744
4745static NTSTATUS rpc_aliaslist_internals(struct net_context *c,
4746 const struct dom_sid *domain_sid,
4747 const char *domain_name,
4748 struct cli_state *cli,
4749 struct rpc_pipe_client *pipe_hnd,
4750 TALLOC_CTX *mem_ctx,
4751 int argc,
4752 const char **argv)
4753{
4754 NTSTATUS result, status;
4755 struct policy_handle connect_pol;
4756 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4757
4758 status = dcerpc_samr_Connect2(b, mem_ctx,
4759 pipe_hnd->desthost,
4760 MAXIMUM_ALLOWED_ACCESS,
4761 &connect_pol,
4762 &result);
4763 if (!NT_STATUS_IS_OK(status)) {
4764 goto done;
4765 }
4766 if (!NT_STATUS_IS_OK(result)) {
4767 status = result;
4768 goto done;
4769 }
4770
4771 status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4772 &global_sid_Builtin);
4773 if (!NT_STATUS_IS_OK(status)) {
4774 goto done;
4775 }
4776
4777 status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4778 domain_sid);
4779
4780 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
4781 done:
4782 return status;
4783}
4784
4785static void init_user_token(struct security_token *token, struct dom_sid *user_sid)
4786{
4787 token->num_sids = 4;
4788
4789 if (!(token->sids = SMB_MALLOC_ARRAY(struct dom_sid, 4))) {
4790 d_fprintf(stderr, "malloc %s\n",_("failed"));
4791 token->num_sids = 0;
4792 return;
4793 }
4794
4795 token->sids[0] = *user_sid;
4796 sid_copy(&token->sids[1], &global_sid_World);
4797 sid_copy(&token->sids[2], &global_sid_Network);
4798 sid_copy(&token->sids[3], &global_sid_Authenticated_Users);
4799}
4800
4801static void free_user_token(struct security_token *token)
4802{
4803 SAFE_FREE(token->sids);
4804}
4805
4806static void add_sid_to_token(struct security_token *token, struct dom_sid *sid)
4807{
4808 if (security_token_has_sid(token, sid))
4809 return;
4810
4811 token->sids = SMB_REALLOC_ARRAY(token->sids, struct dom_sid, token->num_sids+1);
4812 if (!token->sids) {
4813 return;
4814 }
4815
4816 sid_copy(&token->sids[token->num_sids], sid);
4817
4818 token->num_sids += 1;
4819}
4820
4821struct user_token {
4822 fstring name;
4823 struct security_token token;
4824};
4825
4826static void dump_user_token(struct user_token *token)
4827{
4828 int i;
4829
4830 d_printf("%s\n", token->name);
4831
4832 for (i=0; i<token->token.num_sids; i++) {
4833 d_printf(" %s\n", sid_string_tos(&token->token.sids[i]));
4834 }
4835}
4836
4837static bool is_alias_member(struct dom_sid *sid, struct full_alias *alias)
4838{
4839 int i;
4840
4841 for (i=0; i<alias->num_members; i++) {
4842 if (dom_sid_compare(sid, &alias->members[i]) == 0)
4843 return true;
4844 }
4845
4846 return false;
4847}
4848
4849static void collect_sid_memberships(struct security_token *token, struct dom_sid sid)
4850{
4851 int i;
4852
4853 for (i=0; i<num_server_aliases; i++) {
4854 if (is_alias_member(&sid, &server_aliases[i]))
4855 add_sid_to_token(token, &server_aliases[i].sid);
4856 }
4857}
4858
4859/*
4860 * We got a user token with all the SIDs we can know about without asking the
4861 * server directly. These are the user and domain group sids. All of these can
4862 * be members of aliases. So scan the list of aliases for each of the SIDs and
4863 * add them to the token.
4864 */
4865
4866static void collect_alias_memberships(struct security_token *token)
4867{
4868 int num_global_sids = token->num_sids;
4869 int i;
4870
4871 for (i=0; i<num_global_sids; i++) {
4872 collect_sid_memberships(token, token->sids[i]);
4873 }
4874}
4875
4876static bool get_user_sids(const char *domain, const char *user, struct security_token *token)
4877{
4878 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4879 enum wbcSidType type;
4880 fstring full_name;
4881 struct wbcDomainSid wsid;
4882 char sid_str[WBC_SID_STRING_BUFLEN];
4883 struct dom_sid user_sid;
4884 uint32_t num_groups;
4885 gid_t *groups = NULL;
4886 uint32_t i;
4887
4888 fstr_sprintf(full_name, "%s%c%s",
4889 domain, *lp_winbind_separator(), user);
4890
4891 /* First let's find out the user sid */
4892
4893 wbc_status = wbcLookupName(domain, user, &wsid, &type);
4894
4895 if (!WBC_ERROR_IS_OK(wbc_status)) {
4896 DEBUG(1, ("winbind could not find %s: %s\n",
4897 full_name, wbcErrorString(wbc_status)));
4898 return false;
4899 }
4900
4901 wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4902
4903 if (type != WBC_SID_NAME_USER) {
4904 DEBUG(1, ("%s is not a user\n", full_name));
4905 return false;
4906 }
4907
4908 if (!string_to_sid(&user_sid, sid_str)) {
4909 DEBUG(1,("Could not convert sid %s from string\n", sid_str));
4910 return false;
4911 }
4912
4913 init_user_token(token, &user_sid);
4914
4915 /* And now the groups winbind knows about */
4916
4917 wbc_status = wbcGetGroups(full_name, &num_groups, &groups);
4918 if (!WBC_ERROR_IS_OK(wbc_status)) {
4919 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4920 full_name, wbcErrorString(wbc_status)));
4921 return false;
4922 }
4923
4924 for (i = 0; i < num_groups; i++) {
4925 gid_t gid = groups[i];
4926 struct dom_sid sid;
4927 bool ok;
4928
4929 wbc_status = wbcGidToSid(gid, &wsid);
4930 if (!WBC_ERROR_IS_OK(wbc_status)) {
4931 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4932 (unsigned int)gid, wbcErrorString(wbc_status)));
4933 wbcFreeMemory(groups);
4934 return false;
4935 }
4936
4937 wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4938
4939 DEBUG(3, (" %s\n", sid_str));
4940
4941 ok = string_to_sid(&sid, sid_str);
4942 if (!ok) {
4943 DEBUG(1, ("Failed to convert string to SID\n"));
4944 wbcFreeMemory(groups);
4945 return false;
4946 }
4947 add_sid_to_token(token, &sid);
4948 }
4949 wbcFreeMemory(groups);
4950
4951 return true;
4952}
4953
4954/**
4955 * Get a list of all user tokens we want to look at
4956 **/
4957
4958static bool get_user_tokens(struct net_context *c, int *num_tokens,
4959 struct user_token **user_tokens)
4960{
4961 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4962 uint32_t i, num_users;
4963 const char **users;
4964 struct user_token *result;
4965 TALLOC_CTX *frame = NULL;
4966
4967 if (lp_winbind_use_default_domain() &&
4968 (c->opt_target_workgroup == NULL)) {
4969 d_fprintf(stderr, _("winbind use default domain = yes set, "
4970 "please specify a workgroup\n"));
4971 return false;
4972 }
4973
4974 /* Send request to winbind daemon */
4975
4976 wbc_status = wbcListUsers(NULL, &num_users, &users);
4977 if (!WBC_ERROR_IS_OK(wbc_status)) {
4978 DEBUG(1, (_("winbind could not list users: %s\n"),
4979 wbcErrorString(wbc_status)));
4980 return false;
4981 }
4982
4983 result = SMB_MALLOC_ARRAY(struct user_token, num_users);
4984
4985 if (result == NULL) {
4986 DEBUG(1, ("Could not malloc sid array\n"));
4987 wbcFreeMemory(users);
4988 return false;
4989 }
4990
4991 frame = talloc_stackframe();
4992 for (i=0; i < num_users; i++) {
4993 fstring domain, user;
4994 char *p;
4995
4996 fstrcpy(result[i].name, users[i]);
4997
4998 p = strchr(users[i], *lp_winbind_separator());
4999
5000 DEBUG(3, ("%s\n", users[i]));
5001
5002 if (p == NULL) {
5003 fstrcpy(domain, c->opt_target_workgroup);
5004 fstrcpy(user, users[i]);
5005 } else {
5006 *p++ = '\0';
5007 fstrcpy(domain, users[i]);
5008 if (!strupper_m(domain)) {
5009 DEBUG(1, ("strupper_m %s failed\n", domain));
5010 wbcFreeMemory(users);
5011 return false;
5012 }
5013 fstrcpy(user, p);
5014 }
5015
5016 get_user_sids(domain, user, &(result[i].token));
5017 }
5018 TALLOC_FREE(frame);
5019 wbcFreeMemory(users);
5020
5021 *num_tokens = num_users;
5022 *user_tokens = result;
5023
5024 return true;
5025}
5026
5027static bool get_user_tokens_from_file(FILE *f,
5028 int *num_tokens,
5029 struct user_token **tokens)
5030{
5031 struct user_token *token = NULL;
5032
5033 while (!feof(f)) {
5034 fstring line;
5035
5036 if (fgets(line, sizeof(line)-1, f) == NULL) {
5037 return true;
5038 }
5039
5040 if ((strlen(line) > 0) && (line[strlen(line)-1] == '\n')) {
5041 line[strlen(line)-1] = '\0';
5042 }
5043
5044 if (line[0] == ' ') {
5045 /* We have a SID */
5046
5047 struct dom_sid sid;
5048 if(!string_to_sid(&sid, &line[1])) {
5049 DEBUG(1,("get_user_tokens_from_file: Could "
5050 "not convert sid %s \n",&line[1]));
5051 return false;
5052 }
5053
5054 if (token == NULL) {
5055 DEBUG(0, ("File does not begin with username"));
5056 return false;
5057 }
5058
5059 add_sid_to_token(&token->token, &sid);
5060 continue;
5061 }
5062
5063 /* And a new user... */
5064
5065 *num_tokens += 1;
5066 *tokens = SMB_REALLOC_ARRAY(*tokens, struct user_token, *num_tokens);
5067 if (*tokens == NULL) {
5068 DEBUG(0, ("Could not realloc tokens\n"));
5069 return false;
5070 }
5071
5072 token = &((*tokens)[*num_tokens-1]);
5073
5074 if (strlcpy(token->name, line, sizeof(token->name)) >= sizeof(token->name)) {
5075 return false;
5076 }
5077 token->token.num_sids = 0;
5078 token->token.sids = NULL;
5079 continue;
5080 }
5081
5082 return false;
5083}
5084
5085
5086/*
5087 * Show the list of all users that have access to a share
5088 */
5089
5090static void show_userlist(struct rpc_pipe_client *pipe_hnd,
5091 struct cli_state *cli,
5092 TALLOC_CTX *mem_ctx,
5093 const char *netname,
5094 int num_tokens,
5095 struct user_token *tokens)
5096{
5097 uint16_t fnum;
5098 struct security_descriptor *share_sd = NULL;
5099 struct security_descriptor *root_sd = NULL;
5100 int i;
5101 union srvsvc_NetShareInfo info;
5102 WERROR result;
5103 NTSTATUS status;
5104 uint16_t cnum;
5105 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5106
5107 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
5108 pipe_hnd->desthost,
5109 netname,
5110 502,
5111 &info,
5112 &result);
5113
5114 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
5115 DEBUG(1, ("Coult not query secdesc for share %s\n",
5116 netname));
5117 return;
5118 }
5119
5120 share_sd = info.info502->sd_buf.sd;
5121 if (share_sd == NULL) {
5122 DEBUG(1, ("Got no secdesc for share %s\n",
5123 netname));
5124 }
5125
5126 cnum = cli_state_get_tid(cli);
5127
5128 if (!NT_STATUS_IS_OK(cli_tree_connect(cli, netname, "A:", "", 0))) {
5129 return;
5130 }
5131
5132 if (!NT_STATUS_IS_OK(cli_ntcreate(cli, "\\", 0, READ_CONTROL_ACCESS, 0,
5133 FILE_SHARE_READ|FILE_SHARE_WRITE,
5134 FILE_OPEN, 0x0, 0x0, &fnum, NULL))) {
5135 cli_query_secdesc(cli, fnum, mem_ctx, &root_sd);
5136 }
5137
5138 for (i=0; i<num_tokens; i++) {
5139 uint32_t acc_granted;
5140
5141 if (share_sd != NULL) {
5142 status = se_access_check(share_sd, &tokens[i].token,
5143 1, &acc_granted);
5144
5145 if (!NT_STATUS_IS_OK(status)) {
5146 DEBUG(1, ("Could not check share_sd for "
5147 "user %s\n",
5148 tokens[i].name));
5149 continue;
5150 }
5151 }
5152
5153 if (root_sd == NULL) {
5154 d_printf(" %s\n", tokens[i].name);
5155 continue;
5156 }
5157
5158 status = se_access_check(root_sd, &tokens[i].token,
5159 1, &acc_granted);
5160 if (!NT_STATUS_IS_OK(status)) {
5161 DEBUG(1, ("Could not check root_sd for user %s\n",
5162 tokens[i].name));
5163 continue;
5164 }
5165 d_printf(" %s\n", tokens[i].name);
5166 }
5167
5168 if (fnum != (uint16_t)-1)
5169 cli_close(cli, fnum);
5170 cli_tdis(cli);
5171 cli_state_set_tid(cli, cnum);
5172
5173 return;
5174}
5175
5176/**
5177 * List shares on a remote RPC server, including the security descriptors.
5178 *
5179 * All parameters are provided by the run_rpc_command function, except for
5180 * argc, argv which are passed through.
5181 *
5182 * @param domain_sid The domain sid acquired from the remote server.
5183 * @param cli A cli_state connected to the server.
5184 * @param mem_ctx Talloc context, destroyed on completion of the function.
5185 * @param argc Standard main() style argc.
5186 * @param argv Standard main() style argv. Initial components are already
5187 * stripped.
5188 *
5189 * @return Normal NTSTATUS return.
5190 **/
5191
5192static NTSTATUS rpc_share_allowedusers_internals(struct net_context *c,
5193 const struct dom_sid *domain_sid,
5194 const char *domain_name,
5195 struct cli_state *cli,
5196 struct rpc_pipe_client *pipe_hnd,
5197 TALLOC_CTX *mem_ctx,
5198 int argc,
5199 const char **argv)
5200{
5201 bool r;
5202 FILE *f;
5203 NTSTATUS nt_status = NT_STATUS_OK;
5204 uint32_t total_entries = 0;
5205 uint32_t resume_handle = 0;
5206 uint32_t preferred_len = 0xffffffff;
5207 uint32_t i;
5208 struct dcerpc_binding_handle *b = NULL;
5209 struct srvsvc_NetShareInfoCtr info_ctr;
5210 struct srvsvc_NetShareCtr1 ctr1;
5211 WERROR result;
5212
5213 struct user_token *tokens = NULL;
5214 int num_tokens = 0;
5215
5216 if (argc == 0) {
5217 f = stdin;
5218 } else {
5219 f = fopen(argv[0], "r");
5220 }
5221
5222 if (f == NULL) {
5223 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno)));
5224 return NT_STATUS_UNSUCCESSFUL;
5225 }
5226
5227 r = get_user_tokens_from_file(f, &num_tokens, &tokens);
5228
5229 if (f != stdin)
5230 fclose(f);
5231
5232 if (!r) {
5233 DEBUG(0, ("Could not read users from file\n"));
5234 return NT_STATUS_UNSUCCESSFUL;
5235 }
5236
5237 for (i=0; i<num_tokens; i++)
5238 collect_alias_memberships(&tokens[i].token);
5239
5240 ZERO_STRUCT(info_ctr);
5241 ZERO_STRUCT(ctr1);
5242
5243 info_ctr.level = 1;
5244 info_ctr.ctr.ctr1 = &ctr1;
5245
5246 b = pipe_hnd->binding_handle;
5247
5248 /* Issue the NetShareEnum RPC call and retrieve the response */
5249 nt_status = dcerpc_srvsvc_NetShareEnumAll(b,
5250 talloc_tos(),
5251 pipe_hnd->desthost,
5252 &info_ctr,
5253 preferred_len,
5254 &total_entries,
5255 &resume_handle,
5256 &result);
5257
5258 /* Was it successful? */
5259 if (!NT_STATUS_IS_OK(nt_status)) {
5260 /* Nope. Go clean up. */
5261 goto done;
5262 }
5263
5264 if (!W_ERROR_IS_OK(result)) {
5265 /* Nope. Go clean up. */
5266 nt_status = werror_to_ntstatus(result);
5267 goto done;
5268 }
5269
5270 if (total_entries == 0) {
5271 goto done;
5272 }
5273
5274 /* For each returned entry... */
5275 for (i = 0; i < info_ctr.ctr.ctr1->count; i++) {
5276 const char *netname = info_ctr.ctr.ctr1->array[i].name;
5277
5278 if (info_ctr.ctr.ctr1->array[i].type != STYPE_DISKTREE) {
5279 continue;
5280 }
5281
5282 d_printf("%s\n", netname);
5283
5284 show_userlist(pipe_hnd, cli, mem_ctx, netname,
5285 num_tokens, tokens);
5286 }
5287 done:
5288 for (i=0; i<num_tokens; i++) {
5289 free_user_token(&tokens[i].token);
5290 }
5291 SAFE_FREE(tokens);
5292 TALLOC_FREE(server_aliases);
5293
5294 return nt_status;
5295}
5296
5297static int rpc_share_allowedusers(struct net_context *c, int argc,
5298 const char **argv)
5299{
5300 int result;
5301
5302 if (c->display_usage) {
5303 d_printf( "%s\n"
5304 "net rpc share allowedusers\n"
5305 " %s\n",
5306 _("Usage:"),
5307 _("List allowed users"));
5308 return 0;
5309 }
5310
5311 result = run_rpc_command(c, NULL, &ndr_table_samr, 0,
5312 rpc_aliaslist_internals,
5313 argc, argv);
5314 if (result != 0)
5315 return result;
5316
5317 result = run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
5318 rpc_aliaslist_dump,
5319 argc, argv);
5320 if (result != 0)
5321 return result;
5322
5323 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
5324 rpc_share_allowedusers_internals,
5325 argc, argv);
5326}
5327
5328int net_usersidlist(struct net_context *c, int argc, const char **argv)
5329{
5330 int num_tokens = 0;
5331 struct user_token *tokens = NULL;
5332 int i;
5333
5334 if (argc != 0) {
5335 net_usersidlist_usage(c, argc, argv);
5336 return 0;
5337 }
5338
5339 if (!get_user_tokens(c, &num_tokens, &tokens)) {
5340 DEBUG(0, ("Could not get the user/sid list\n"));
5341 return -1;
5342 }
5343
5344 for (i=0; i<num_tokens; i++) {
5345 dump_user_token(&tokens[i]);
5346 free_user_token(&tokens[i].token);
5347 }
5348
5349 SAFE_FREE(tokens);
5350 return 0;
5351}
5352
5353int net_usersidlist_usage(struct net_context *c, int argc, const char **argv)
5354{
5355 d_printf(_("net usersidlist\n"
5356 "\tprints out a list of all users the running winbind knows\n"
5357 "\tabout, together with all their SIDs. This is used as\n"
5358 "\tinput to the 'net rpc share allowedusers' command.\n\n"));
5359
5360 net_common_flags_usage(c, argc, argv);
5361 return -1;
5362}
5363
5364/**
5365 * 'net rpc share' entrypoint.
5366 * @param argc Standard main() style argc.
5367 * @param argv Standard main() style argv. Initial components are already
5368 * stripped.
5369 **/
5370
5371int net_rpc_share(struct net_context *c, int argc, const char **argv)
5372{
5373 NET_API_STATUS status;
5374
5375 struct functable func[] = {
5376 {
5377 "add",
5378 rpc_share_add,
5379 NET_TRANSPORT_RPC,
5380 N_("Add share"),
5381 N_("net rpc share add\n"
5382 " Add share")
5383 },
5384 {
5385 "delete",
5386 rpc_share_delete,
5387 NET_TRANSPORT_RPC,
5388 N_("Remove share"),
5389 N_("net rpc share delete\n"
5390 " Remove share")
5391 },
5392 {
5393 "allowedusers",
5394 rpc_share_allowedusers,
5395 NET_TRANSPORT_RPC,
5396 N_("Modify allowed users"),
5397 N_("net rpc share allowedusers\n"
5398 " Modify allowed users")
5399 },
5400 {
5401 "migrate",
5402 rpc_share_migrate,
5403 NET_TRANSPORT_RPC,
5404 N_("Migrate share to local server"),
5405 N_("net rpc share migrate\n"
5406 " Migrate share to local server")
5407 },
5408 {
5409 "list",
5410 rpc_share_list,
5411 NET_TRANSPORT_RPC,
5412 N_("List shares"),
5413 N_("net rpc share list\n"
5414 " List shares")
5415 },
5416 {NULL, NULL, 0, NULL, NULL}
5417 };
5418
5419 status = libnetapi_net_init(&c->netapi_ctx);
5420 if (status != 0) {
5421 return -1;
5422 }
5423 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5424 libnetapi_set_password(c->netapi_ctx, c->opt_password);
5425 if (c->opt_kerberos) {
5426 libnetapi_set_use_kerberos(c->netapi_ctx);
5427 }
5428
5429 if (argc == 0) {
5430 if (c->display_usage) {
5431 d_printf("%s\n%s",
5432 _("Usage:"),
5433 _("net rpc share\n"
5434 " List shares\n"
5435 " Alias for net rpc share list\n"));
5436 net_display_usage_from_functable(func);
5437 return 0;
5438 }
5439
5440 return rpc_share_list(c, argc, argv);
5441 }
5442
5443 return net_run_function(c, argc, argv, "net rpc share", func);
5444}
5445
5446static NTSTATUS rpc_sh_share_list(struct net_context *c,
5447 TALLOC_CTX *mem_ctx,
5448 struct rpc_sh_ctx *ctx,
5449 struct rpc_pipe_client *pipe_hnd,
5450 int argc, const char **argv)
5451{
5452
5453 return werror_to_ntstatus(W_ERROR(rpc_share_list(c, argc, argv)));
5454}
5455
5456static NTSTATUS rpc_sh_share_add(struct net_context *c,
5457 TALLOC_CTX *mem_ctx,
5458 struct rpc_sh_ctx *ctx,
5459 struct rpc_pipe_client *pipe_hnd,
5460 int argc, const char **argv)
5461{
5462 NET_API_STATUS status;
5463 uint32_t parm_err = 0;
5464 struct SHARE_INFO_2 i2;
5465
5466 if ((argc < 2) || (argc > 3)) {
5467 d_fprintf(stderr, _("Usage: %s <share> <path> [comment]\n"),
5468 ctx->whoami);
5469 return NT_STATUS_INVALID_PARAMETER;
5470 }
5471
5472 i2.shi2_netname = argv[0];
5473 i2.shi2_type = STYPE_DISKTREE;
5474 i2.shi2_remark = (argc == 3) ? argv[2] : "";
5475 i2.shi2_permissions = 0;
5476 i2.shi2_max_uses = 0;
5477 i2.shi2_current_uses = 0;
5478 i2.shi2_path = argv[1];
5479 i2.shi2_passwd = NULL;
5480
5481 status = NetShareAdd(pipe_hnd->desthost,
5482 2,
5483 (uint8_t *)&i2,
5484 &parm_err);
5485
5486 return werror_to_ntstatus(W_ERROR(status));
5487}
5488
5489static NTSTATUS rpc_sh_share_delete(struct net_context *c,
5490 TALLOC_CTX *mem_ctx,
5491 struct rpc_sh_ctx *ctx,
5492 struct rpc_pipe_client *pipe_hnd,
5493 int argc, const char **argv)
5494{
5495 if (argc != 1) {
5496 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5497 return NT_STATUS_INVALID_PARAMETER;
5498 }
5499
5500 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd->desthost, argv[0], 0)));
5501}
5502
5503static NTSTATUS rpc_sh_share_info(struct net_context *c,
5504 TALLOC_CTX *mem_ctx,
5505 struct rpc_sh_ctx *ctx,
5506 struct rpc_pipe_client *pipe_hnd,
5507 int argc, const char **argv)
5508{
5509 union srvsvc_NetShareInfo info;
5510 WERROR result;
5511 NTSTATUS status;
5512 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5513
5514 if (argc != 1) {
5515 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5516 return NT_STATUS_INVALID_PARAMETER;
5517 }
5518
5519 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
5520 pipe_hnd->desthost,
5521 argv[0],
5522 2,
5523 &info,
5524 &result);
5525 if (!NT_STATUS_IS_OK(status)) {
5526 result = ntstatus_to_werror(status);
5527 goto done;
5528 }
5529 if (!W_ERROR_IS_OK(result)) {
5530 goto done;
5531 }
5532
5533 d_printf(_("Name: %s\n"), info.info2->name);
5534 d_printf(_("Comment: %s\n"), info.info2->comment);
5535 d_printf(_("Path: %s\n"), info.info2->path);
5536 d_printf(_("Password: %s\n"), info.info2->password);
5537
5538 done:
5539 return werror_to_ntstatus(result);
5540}
5541
5542struct rpc_sh_cmd *net_rpc_share_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
5543 struct rpc_sh_ctx *ctx)
5544{
5545 static struct rpc_sh_cmd cmds[] = {
5546
5547 { "list", NULL, &ndr_table_srvsvc, rpc_sh_share_list,
5548 N_("List available shares") },
5549
5550 { "add", NULL, &ndr_table_srvsvc, rpc_sh_share_add,
5551 N_("Add a share") },
5552
5553 { "delete", NULL, &ndr_table_srvsvc, rpc_sh_share_delete,
5554 N_("Delete a share") },
5555
5556 { "info", NULL, &ndr_table_srvsvc, rpc_sh_share_info,
5557 N_("Get information about a share") },
5558
5559 { NULL, NULL, 0, NULL, NULL }
5560 };
5561
5562 return cmds;
5563}
5564
5565/****************************************************************************/
5566
5567static int rpc_file_usage(struct net_context *c, int argc, const char **argv)
5568{
5569 return net_file_usage(c, argc, argv);
5570}
5571
5572/**
5573 * Close a file on a remote RPC server.
5574 *
5575 * @param argc Standard main() style argc.
5576 * @param argv Standard main() style argv. Initial components are already
5577 * stripped.
5578 *
5579 * @return A shell status integer (0 for success).
5580 **/
5581static int rpc_file_close(struct net_context *c, int argc, const char **argv)
5582{
5583 if (argc < 1 || c->display_usage) {
5584 return rpc_file_usage(c, argc, argv);
5585 }
5586
5587 return NetFileClose(c->opt_host, atoi(argv[0]));
5588}
5589
5590/**
5591 * Formatted print of open file info
5592 *
5593 * @param r struct FILE_INFO_3 contents
5594 **/
5595
5596static void display_file_info_3(struct FILE_INFO_3 *r)
5597{
5598 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
5599 r->fi3_id, r->fi3_username, r->fi3_permissions,
5600 r->fi3_num_locks, r->fi3_pathname);
5601}
5602
5603/**
5604 * List files for a user on a remote RPC server.
5605 *
5606 * @param argc Standard main() style argc.
5607 * @param argv Standard main() style argv. Initial components are already
5608 * stripped.
5609 *
5610 * @return A shell status integer (0 for success)..
5611 **/
5612
5613static int rpc_file_user(struct net_context *c, int argc, const char **argv)
5614{
5615 NET_API_STATUS status;
5616 uint32_t preferred_len = 0xffffffff, i;
5617 char *username=NULL;
5618 uint32_t total_entries = 0;
5619 uint32_t entries_read = 0;
5620 uint32_t resume_handle = 0;
5621 struct FILE_INFO_3 *i3 = NULL;
5622
5623 if (c->display_usage) {
5624 return rpc_file_usage(c, argc, argv);
5625 }
5626
5627 /* if argc > 0, must be user command */
5628 if (argc > 0) {
5629 username = smb_xstrdup(argv[0]);
5630 }
5631
5632 status = NetFileEnum(c->opt_host,
5633 NULL,
5634 username,
5635 3,
5636 (uint8_t **)(void *)&i3,
5637 preferred_len,
5638 &entries_read,
5639 &total_entries,
5640 &resume_handle);
5641
5642 if (status != 0) {
5643 goto done;
5644 }
5645
5646 /* Display results */
5647
5648 d_printf(_(
5649 "\nEnumerating open files on remote server:\n\n"
5650 "\nFileId Opened by Perms Locks Path"
5651 "\n------ --------- ----- ----- ---- \n"));
5652 for (i = 0; i < entries_read; i++) {
5653 display_file_info_3(&i3[i]);
5654 }
5655 done:
5656 SAFE_FREE(username);
5657 return status;
5658}
5659
5660/**
5661 * 'net rpc file' entrypoint.
5662 * @param argc Standard main() style argc.
5663 * @param argv Standard main() style argv. Initial components are already
5664 * stripped.
5665 **/
5666
5667int net_rpc_file(struct net_context *c, int argc, const char **argv)
5668{
5669 NET_API_STATUS status;
5670
5671 struct functable func[] = {
5672 {
5673 "close",
5674 rpc_file_close,
5675 NET_TRANSPORT_RPC,
5676 N_("Close opened file"),
5677 N_("net rpc file close\n"
5678 " Close opened file")
5679 },
5680 {
5681 "user",
5682 rpc_file_user,
5683 NET_TRANSPORT_RPC,
5684 N_("List files opened by user"),
5685 N_("net rpc file user\n"
5686 " List files opened by user")
5687 },
5688#if 0
5689 {
5690 "info",
5691 rpc_file_info,
5692 NET_TRANSPORT_RPC,
5693 N_("Display information about opened file"),
5694 N_("net rpc file info\n"
5695 " Display information about opened file")
5696 },
5697#endif
5698 {NULL, NULL, 0, NULL, NULL}
5699 };
5700
5701 status = libnetapi_net_init(&c->netapi_ctx);
5702 if (status != 0) {
5703 return -1;
5704 }
5705 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5706 libnetapi_set_password(c->netapi_ctx, c->opt_password);
5707 if (c->opt_kerberos) {
5708 libnetapi_set_use_kerberos(c->netapi_ctx);
5709 }
5710
5711 if (argc == 0) {
5712 if (c->display_usage) {
5713 d_printf(_("Usage:\n"));
5714 d_printf(_("net rpc file\n"
5715 " List opened files\n"));
5716 net_display_usage_from_functable(func);
5717 return 0;
5718 }
5719
5720 return rpc_file_user(c, argc, argv);
5721 }
5722
5723 return net_run_function(c, argc, argv, "net rpc file", func);
5724}
5725
5726/**
5727 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
5728 *
5729 * All parameters are provided by the run_rpc_command function, except for
5730 * argc, argv which are passed through.
5731 *
5732 * @param c A net_context structure.
5733 * @param domain_sid The domain sid acquired from the remote server.
5734 * @param cli A cli_state connected to the server.
5735 * @param mem_ctx Talloc context, destroyed on completion of the function.
5736 * @param argc Standard main() style argc.
5737 * @param argv Standard main() style argv. Initial components are already
5738 * stripped.
5739 *
5740 * @return Normal NTSTATUS return.
5741 **/
5742
5743static NTSTATUS rpc_shutdown_abort_internals(struct net_context *c,
5744 const struct dom_sid *domain_sid,
5745 const char *domain_name,
5746 struct cli_state *cli,
5747 struct rpc_pipe_client *pipe_hnd,
5748 TALLOC_CTX *mem_ctx,
5749 int argc,
5750 const char **argv)
5751{
5752 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5753 WERROR result;
5754 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5755
5756 status = dcerpc_initshutdown_Abort(b, mem_ctx, NULL, &result);
5757 if (!NT_STATUS_IS_OK(status)) {
5758 return status;
5759 }
5760 if (W_ERROR_IS_OK(result)) {
5761 d_printf(_("\nShutdown successfully aborted\n"));
5762 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
5763 } else
5764 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
5765
5766 return werror_to_ntstatus(result);
5767}
5768
5769/**
5770 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
5771 *
5772 * All parameters are provided by the run_rpc_command function, except for
5773 * argc, argv which are passed through.
5774 *
5775 * @param c A net_context structure.
5776 * @param domain_sid The domain sid acquired from the remote server.
5777 * @param cli A cli_state connected to the server.
5778 * @param mem_ctx Talloc context, destroyed on completion of the function.
5779 * @param argc Standard main() style argc.
5780 * @param argv Standard main() style argv. Initial components are already
5781 * stripped.
5782 *
5783 * @return Normal NTSTATUS return.
5784 **/
5785
5786static NTSTATUS rpc_reg_shutdown_abort_internals(struct net_context *c,
5787 const struct dom_sid *domain_sid,
5788 const char *domain_name,
5789 struct cli_state *cli,
5790 struct rpc_pipe_client *pipe_hnd,
5791 TALLOC_CTX *mem_ctx,
5792 int argc,
5793 const char **argv)
5794{
5795 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5796 WERROR werr;
5797 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5798
5799 result = dcerpc_winreg_AbortSystemShutdown(b, mem_ctx, NULL, &werr);
5800
5801 if (!NT_STATUS_IS_OK(result)) {
5802 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5803 return result;
5804 }
5805 if (W_ERROR_IS_OK(werr)) {
5806 d_printf(_("\nShutdown successfully aborted\n"));
5807 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
5808 } else
5809 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5810
5811 return werror_to_ntstatus(werr);
5812}
5813
5814/**
5815 * ABORT the shutdown of a remote RPC server.
5816 *
5817 * @param argc Standard main() style argc.
5818 * @param argv Standard main() style argv. Initial components are already
5819 * stripped.
5820 *
5821 * @return A shell status integer (0 for success).
5822 **/
5823
5824static int rpc_shutdown_abort(struct net_context *c, int argc,
5825 const char **argv)
5826{
5827 int rc = -1;
5828
5829 if (c->display_usage) {
5830 d_printf( "%s\n"
5831 "net rpc abortshutdown\n"
5832 " %s\n",
5833 _("Usage:"),
5834 _("Abort a scheduled shutdown"));
5835 return 0;
5836 }
5837
5838 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5839 rpc_shutdown_abort_internals, argc, argv);
5840
5841 if (rc == 0)
5842 return rc;
5843
5844 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5845
5846 return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
5847 rpc_reg_shutdown_abort_internals,
5848 argc, argv);
5849}
5850
5851/**
5852 * Shut down a remote RPC Server via initshutdown pipe.
5853 *
5854 * All parameters are provided by the run_rpc_command function, except for
5855 * argc, argv which are passed through.
5856 *
5857 * @param c A net_context structure.
5858 * @param domain_sid The domain sid acquired from the remote server.
5859 * @param cli A cli_state connected to the server.
5860 * @param mem_ctx Talloc context, destroyed on completion of the function.
5861 * @param argc Standard main() style argc.
5862 * @param argv Standard main() style argv. Initial components are already
5863 * stripped.
5864 *
5865 * @return Normal NTSTATUS return.
5866 **/
5867
5868NTSTATUS rpc_init_shutdown_internals(struct net_context *c,
5869 const struct dom_sid *domain_sid,
5870 const char *domain_name,
5871 struct cli_state *cli,
5872 struct rpc_pipe_client *pipe_hnd,
5873 TALLOC_CTX *mem_ctx,
5874 int argc,
5875 const char **argv)
5876{
5877 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5878 WERROR result;
5879 const char *msg = N_("This machine will be shutdown shortly");
5880 uint32_t timeout = 20;
5881 struct lsa_StringLarge msg_string;
5882 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5883
5884 if (c->opt_comment) {
5885 msg = c->opt_comment;
5886 }
5887 if (c->opt_timeout) {
5888 timeout = c->opt_timeout;
5889 }
5890
5891 msg_string.string = msg;
5892
5893 /* create an entry */
5894 status = dcerpc_initshutdown_Init(b, mem_ctx, NULL,
5895 &msg_string, timeout, c->opt_force, c->opt_reboot,
5896 &result);
5897 if (!NT_STATUS_IS_OK(status)) {
5898 return status;
5899 }
5900 if (W_ERROR_IS_OK(result)) {
5901 d_printf(_("\nShutdown of remote machine succeeded\n"));
5902 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5903 } else {
5904 DEBUG(1,("Shutdown of remote machine failed!\n"));
5905 }
5906 return werror_to_ntstatus(result);
5907}
5908
5909/**
5910 * Shut down a remote RPC Server via winreg pipe.
5911 *
5912 * All parameters are provided by the run_rpc_command function, except for
5913 * argc, argv which are passed through.
5914 *
5915 * @param c A net_context structure.
5916 * @param domain_sid The domain sid acquired from the remote server.
5917 * @param cli A cli_state connected to the server.
5918 * @param mem_ctx Talloc context, destroyed on completion of the function.
5919 * @param argc Standard main() style argc.
5920 * @param argv Standard main() style argv. Initial components are already
5921 * stripped.
5922 *
5923 * @return Normal NTSTATUS return.
5924 **/
5925
5926NTSTATUS rpc_reg_shutdown_internals(struct net_context *c,
5927 const struct dom_sid *domain_sid,
5928 const char *domain_name,
5929 struct cli_state *cli,
5930 struct rpc_pipe_client *pipe_hnd,
5931 TALLOC_CTX *mem_ctx,
5932 int argc,
5933 const char **argv)
5934{
5935 const char *msg = N_("This machine will be shutdown shortly");
5936 uint32_t timeout = 20;
5937 struct lsa_StringLarge msg_string;
5938 NTSTATUS result;
5939 WERROR werr;
5940 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5941
5942 if (c->opt_comment) {
5943 msg = c->opt_comment;
5944 }
5945 msg_string.string = msg;
5946
5947 if (c->opt_timeout) {
5948 timeout = c->opt_timeout;
5949 }
5950
5951 /* create an entry */
5952 result = dcerpc_winreg_InitiateSystemShutdown(b, mem_ctx, NULL,
5953 &msg_string, timeout, c->opt_force, c->opt_reboot,
5954 &werr);
5955 if (!NT_STATUS_IS_OK(result)) {
5956 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5957 return result;
5958 }
5959
5960 if (W_ERROR_IS_OK(werr)) {
5961 d_printf(_("\nShutdown of remote machine succeeded\n"));
5962 } else {
5963 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5964 if ( W_ERROR_EQUAL(werr, WERR_MACHINE_LOCKED) )
5965 d_fprintf(stderr, "\nMachine locked, use -f switch to force\n");
5966 else
5967 d_fprintf(stderr, "\nresult was: %s\n", win_errstr(werr));
5968 }
5969
5970 return werror_to_ntstatus(werr);
5971}
5972
5973/**
5974 * Shut down a remote RPC server.
5975 *
5976 * @param argc Standard main() style argc.
5977 * @param argv Standard main() style argv. Initial components are already
5978 * stripped.
5979 *
5980 * @return A shell status integer (0 for success).
5981 **/
5982
5983static int rpc_shutdown(struct net_context *c, int argc, const char **argv)
5984{
5985 int rc = -1;
5986
5987 if (c->display_usage) {
5988 d_printf( "%s\n"
5989 "net rpc shutdown\n"
5990 " %s\n",
5991 _("Usage:"),
5992 _("Shut down a remote RPC server"));
5993 return 0;
5994 }
5995
5996 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5997 rpc_init_shutdown_internals, argc, argv);
5998
5999 if (rc) {
6000 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
6001 rc = run_rpc_command(c, NULL, &ndr_table_winreg, 0,
6002 rpc_reg_shutdown_internals, argc, argv);
6003 }
6004
6005 return rc;
6006}
6007
6008/***************************************************************************
6009 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
6010 ***************************************************************************/
6011
6012/**
6013 * Add interdomain trust account to the RPC server.
6014 * All parameters (except for argc and argv) are passed by run_rpc_command
6015 * function.
6016 *
6017 * @param c A net_context structure.
6018 * @param domain_sid The domain sid acquired from the server.
6019 * @param cli A cli_state connected to the server.
6020 * @param mem_ctx Talloc context, destroyed on completion of the function.
6021 * @param argc Standard main() style argc.
6022 * @param argv Standard main() style argv. Initial components are already
6023 * stripped.
6024 *
6025 * @return normal NTSTATUS return code.
6026 */
6027
6028static NTSTATUS rpc_trustdom_add_internals(struct net_context *c,
6029 const struct dom_sid *domain_sid,
6030 const char *domain_name,
6031 struct cli_state *cli,
6032 struct rpc_pipe_client *pipe_hnd,
6033 TALLOC_CTX *mem_ctx,
6034 int argc,
6035 const char **argv)
6036{
6037 struct policy_handle connect_pol, domain_pol, user_pol;
6038 NTSTATUS status, result;
6039 char *acct_name;
6040 struct lsa_String lsa_acct_name;
6041 uint32_t acb_info;
6042 uint32_t acct_flags=0;
6043 uint32_t user_rid;
6044 uint32_t access_granted = 0;
6045 union samr_UserInfo info;
6046 unsigned int orig_timeout;
6047 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
6048 DATA_BLOB session_key = data_blob_null;
6049
6050 if (argc != 2) {
6051 d_printf("%s\n%s",
6052 _("Usage:"),
6053 _(" net rpc trustdom add <domain_name> "
6054 "<trust password>\n"));
6055 return NT_STATUS_INVALID_PARAMETER;
6056 }
6057
6058 /*
6059 * Make valid trusting domain account (ie. uppercased and with '$' appended)
6060 */
6061
6062 if (asprintf(&acct_name, "%s$", argv[0]) < 0) {
6063 return NT_STATUS_NO_MEMORY;
6064 }
6065
6066 if (!strupper_m(acct_name)) {
6067 SAFE_FREE(acct_name);
6068 return NT_STATUS_INVALID_PARAMETER;
6069 }
6070
6071 init_lsa_String(&lsa_acct_name, acct_name);
6072
6073 status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
6074 if (!NT_STATUS_IS_OK(status)) {
6075 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
6076 nt_errstr(status)));
6077 goto done;
6078 }
6079
6080 /* Get samr policy handle */
6081 status = dcerpc_samr_Connect2(b, mem_ctx,
6082 pipe_hnd->desthost,
6083 MAXIMUM_ALLOWED_ACCESS,
6084 &connect_pol,
6085 &result);
6086 if (!NT_STATUS_IS_OK(status)) {
6087 goto done;
6088 }
6089 if (!NT_STATUS_IS_OK(result)) {
6090 status = result;
6091 goto done;
6092 }
6093
6094 /* Get domain policy handle */
6095 status = dcerpc_samr_OpenDomain(b, mem_ctx,
6096 &connect_pol,
6097 MAXIMUM_ALLOWED_ACCESS,
6098 discard_const_p(struct dom_sid2, domain_sid),
6099 &domain_pol,
6100 &result);
6101 if (!NT_STATUS_IS_OK(status)) {
6102 goto done;
6103 }
6104 if (!NT_STATUS_IS_OK(result)) {
6105 status = result;
6106 goto done;
6107 }
6108
6109 /* This call can take a long time - allow the server to time out.
6110 * 35 seconds should do it. */
6111
6112 orig_timeout = rpccli_set_timeout(pipe_hnd, 35000);
6113
6114 /* Create trusting domain's account */
6115 acb_info = ACB_NORMAL;
6116 acct_flags = SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
6117 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
6118 SAMR_USER_ACCESS_SET_PASSWORD |
6119 SAMR_USER_ACCESS_GET_ATTRIBUTES |
6120 SAMR_USER_ACCESS_SET_ATTRIBUTES;
6121
6122 status = dcerpc_samr_CreateUser2(b, mem_ctx,
6123 &domain_pol,
6124 &lsa_acct_name,
6125 acb_info,
6126 acct_flags,
6127 &user_pol,
6128 &access_granted,
6129 &user_rid,
6130 &result);
6131 if (!NT_STATUS_IS_OK(status)) {
6132 goto done;
6133 }
6134 /* And restore our original timeout. */
6135 rpccli_set_timeout(pipe_hnd, orig_timeout);
6136
6137 if (!NT_STATUS_IS_OK(result)) {
6138 status = result;
6139 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
6140 acct_name, nt_errstr(result));
6141 goto done;
6142 }
6143
6144 {
6145 struct samr_CryptPassword crypt_pwd;
6146
6147 ZERO_STRUCT(info.info23);
6148
6149 init_samr_CryptPassword(argv[1],
6150 &session_key,
6151 &crypt_pwd);
6152
6153 info.info23.info.fields_present = SAMR_FIELD_ACCT_FLAGS |
6154 SAMR_FIELD_NT_PASSWORD_PRESENT;
6155 info.info23.info.acct_flags = ACB_DOMTRUST;
6156 info.info23.password = crypt_pwd;
6157
6158 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
6159 &user_pol,
6160 23,
6161 &info,
6162 &result);
6163 if (!NT_STATUS_IS_OK(status)) {
6164 goto done;
6165 }
6166
6167 if (!NT_STATUS_IS_OK(result)) {
6168 status = result;
6169 DEBUG(0,("Could not set trust account password: %s\n",
6170 nt_errstr(result)));
6171 goto done;
6172 }
6173 }
6174
6175 done:
6176 SAFE_FREE(acct_name);
6177 data_blob_clear_free(&session_key);
6178 return status;
6179}
6180
6181/**
6182 * Create interdomain trust account for a remote domain.
6183 *
6184 * @param argc Standard argc.
6185 * @param argv Standard argv without initial components.
6186 *
6187 * @return Integer status (0 means success).
6188 **/
6189
6190static int rpc_trustdom_add(struct net_context *c, int argc, const char **argv)
6191{
6192 if (argc > 0 && !c->display_usage) {
6193 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
6194 rpc_trustdom_add_internals, argc, argv);
6195 } else {
6196 d_printf("%s\n%s",
6197 _("Usage:"),
6198 _("net rpc trustdom add <domain_name> <trust "
6199 "password>\n"));
6200 return -1;
6201 }
6202}
6203
6204
6205/**
6206 * Remove interdomain trust account from the RPC server.
6207 * All parameters (except for argc and argv) are passed by run_rpc_command
6208 * function.
6209 *
6210 * @param c A net_context structure.
6211 * @param domain_sid The domain sid acquired from the server.
6212 * @param cli A cli_state connected to the server.
6213 * @param mem_ctx Talloc context, destroyed on completion of the function.
6214 * @param argc Standard main() style argc.
6215 * @param argv Standard main() style argv. Initial components are already
6216 * stripped.
6217 *
6218 * @return normal NTSTATUS return code.
6219 */
6220
6221static NTSTATUS rpc_trustdom_del_internals(struct net_context *c,
6222 const struct dom_sid *domain_sid,
6223 const char *domain_name,
6224 struct cli_state *cli,
6225 struct rpc_pipe_client *pipe_hnd,
6226 TALLOC_CTX *mem_ctx,
6227 int argc,
6228 const char **argv)
6229{
6230 struct policy_handle connect_pol, domain_pol, user_pol;
6231 NTSTATUS status, result;
6232 char *acct_name;
6233 struct dom_sid trust_acct_sid;
6234 struct samr_Ids user_rids, name_types;
6235 struct lsa_String lsa_acct_name;
6236 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
6237
6238 if (argc != 1) {
6239 d_printf("%s\n%s",
6240 _("Usage:"),
6241 _(" net rpc trustdom del <domain_name>\n"));
6242 return NT_STATUS_INVALID_PARAMETER;
6243 }
6244
6245 /*
6246 * Make valid trusting domain account (ie. uppercased and with '$' appended)
6247 */
6248 acct_name = talloc_asprintf(mem_ctx, "%s$", argv[0]);
6249
6250 if (acct_name == NULL)
6251 return NT_STATUS_NO_MEMORY;
6252
6253 if (!strupper_m(acct_name)) {
6254 TALLOC_FREE(acct_name);
6255 return NT_STATUS_INVALID_PARAMETER;
6256 }
6257
6258 /* Get samr policy handle */
6259 status = dcerpc_samr_Connect2(b, mem_ctx,
6260 pipe_hnd->desthost,
6261 MAXIMUM_ALLOWED_ACCESS,
6262 &connect_pol,
6263 &result);
6264 if (!NT_STATUS_IS_OK(status)) {
6265 goto done;
6266 }
6267 if (!NT_STATUS_IS_OK(result)) {
6268 status = result;
6269 goto done;
6270 }
6271
6272 /* Get domain policy handle */
6273 status = dcerpc_samr_OpenDomain(b, mem_ctx,
6274 &connect_pol,
6275 MAXIMUM_ALLOWED_ACCESS,
6276 discard_const_p(struct dom_sid2, domain_sid),
6277 &domain_pol,
6278 &result);
6279 if (!NT_STATUS_IS_OK(status)) {
6280 goto done;
6281 }
6282 if (!NT_STATUS_IS_OK(result)) {
6283 status = result;
6284 goto done;
6285 }
6286
6287 init_lsa_String(&lsa_acct_name, acct_name);
6288
6289 status = dcerpc_samr_LookupNames(b, mem_ctx,
6290 &domain_pol,
6291 1,
6292 &lsa_acct_name,
6293 &user_rids,
6294 &name_types,
6295 &result);
6296 if (!NT_STATUS_IS_OK(status)) {
6297 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6298 "failed %s\n"),
6299 acct_name, nt_errstr(status));
6300 goto done;
6301 }
6302 if (!NT_STATUS_IS_OK(result)) {
6303 status = result;
6304 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6305 "failed %s\n"),
6306 acct_name, nt_errstr(result) );
6307 goto done;
6308 }
6309 if (user_rids.count != 1) {
6310 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
6311 goto done;
6312 }
6313 if (name_types.count != 1) {
6314 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
6315 goto done;
6316 }
6317
6318 status = dcerpc_samr_OpenUser(b, mem_ctx,
6319 &domain_pol,
6320 MAXIMUM_ALLOWED_ACCESS,
6321 user_rids.ids[0],
6322 &user_pol,
6323 &result);
6324 if (!NT_STATUS_IS_OK(status)) {
6325 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6326 "%s\n"),
6327 acct_name, nt_errstr(status) );
6328 goto done;
6329 }
6330
6331 if (!NT_STATUS_IS_OK(result)) {
6332 status = result;
6333 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6334 "%s\n"),
6335 acct_name, nt_errstr(result) );
6336 goto done;
6337 }
6338
6339 /* append the rid to the domain sid */
6340 if (!sid_compose(&trust_acct_sid, domain_sid, user_rids.ids[0])) {
6341 goto done;
6342 }
6343
6344 /* remove the sid */
6345
6346 status = dcerpc_samr_RemoveMemberFromForeignDomain(b, mem_ctx,
6347 &user_pol,
6348 &trust_acct_sid,
6349 &result);
6350 if (!NT_STATUS_IS_OK(status)) {
6351 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6352 " on user %s failed %s\n"),
6353 acct_name, nt_errstr(status));
6354 goto done;
6355 }
6356 if (!NT_STATUS_IS_OK(result)) {
6357 status = result;
6358 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6359 " on user %s failed %s\n"),
6360 acct_name, nt_errstr(result) );
6361 goto done;
6362 }
6363
6364
6365 /* Delete user */
6366
6367 status = dcerpc_samr_DeleteUser(b, mem_ctx,
6368 &user_pol,
6369 &result);
6370 if (!NT_STATUS_IS_OK(status)) {
6371 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6372 "%s\n"),
6373 acct_name, nt_errstr(status));
6374 goto done;
6375 }
6376
6377 if (!NT_STATUS_IS_OK(result)) {
6378 result = status;
6379 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6380 "%s\n"),
6381 acct_name, nt_errstr(result) );
6382 goto done;
6383 }
6384
6385 if (!NT_STATUS_IS_OK(result)) {
6386 d_printf(_("Could not set trust account password: %s\n"),
6387 nt_errstr(result));
6388 goto done;
6389 }
6390
6391 done:
6392 return status;
6393}
6394
6395/**
6396 * Delete interdomain trust account for a remote domain.
6397 *
6398 * @param argc Standard argc.
6399 * @param argv Standard argv without initial components.
6400 *
6401 * @return Integer status (0 means success).
6402 **/
6403
6404static int rpc_trustdom_del(struct net_context *c, int argc, const char **argv)
6405{
6406 if (argc > 0 && !c->display_usage) {
6407 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
6408 rpc_trustdom_del_internals, argc, argv);
6409 } else {
6410 d_printf("%s\n%s",
6411 _("Usage:"),
6412 _("net rpc trustdom del <domain>\n"));
6413 return -1;
6414 }
6415}
6416
6417static NTSTATUS rpc_trustdom_get_pdc(struct net_context *c,
6418 struct cli_state *cli,
6419 TALLOC_CTX *mem_ctx,
6420 const char *domain_name)
6421{
6422 char *dc_name = NULL;
6423 const char *buffer = NULL;
6424 struct rpc_pipe_client *netr;
6425 NTSTATUS status;
6426 WERROR result;
6427 struct dcerpc_binding_handle *b;
6428
6429 /* Use NetServerEnum2 */
6430
6431 if (cli_get_pdc_name(cli, domain_name, &dc_name)) {
6432 SAFE_FREE(dc_name);
6433 return NT_STATUS_OK;
6434 }
6435
6436 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
6437 for domain %s\n", domain_name));
6438
6439 /* Try netr_GetDcName */
6440
6441 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon,
6442 &netr);
6443 if (!NT_STATUS_IS_OK(status)) {
6444 return status;
6445 }
6446
6447 b = netr->binding_handle;
6448
6449 status = dcerpc_netr_GetDcName(b, mem_ctx,
6450 netr->desthost,
6451 domain_name,
6452 &buffer,
6453 &result);
6454 TALLOC_FREE(netr);
6455
6456 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(result)) {
6457 return status;
6458 }
6459
6460 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
6461 for domain %s\n", domain_name));
6462
6463 if (!NT_STATUS_IS_OK(status)) {
6464 return status;
6465 }
6466
6467 return werror_to_ntstatus(result);
6468}
6469
6470/**
6471 * Establish trust relationship to a trusting domain.
6472 * Interdomain account must already be created on remote PDC.
6473 *
6474 * @param c A net_context structure.
6475 * @param argc Standard argc.
6476 * @param argv Standard argv without initial components.
6477 *
6478 * @return Integer status (0 means success).
6479 **/
6480
6481static int rpc_trustdom_establish(struct net_context *c, int argc,
6482 const char **argv)
6483{
6484 struct cli_state *cli = NULL;
6485 struct sockaddr_storage server_ss;
6486 struct rpc_pipe_client *pipe_hnd = NULL;
6487 struct policy_handle connect_hnd;
6488 TALLOC_CTX *mem_ctx;
6489 NTSTATUS nt_status, result;
6490 struct dom_sid *domain_sid;
6491
6492 char* domain_name;
6493 char* acct_name;
6494 fstring pdc_name;
6495 union lsa_PolicyInformation *info = NULL;
6496 struct dcerpc_binding_handle *b;
6497
6498 /*
6499 * Connect to \\server\ipc$ as 'our domain' account with password
6500 */
6501
6502 if (argc != 1 || c->display_usage) {
6503 d_printf("%s\n%s",
6504 _("Usage:"),
6505 _("net rpc trustdom establish <domain_name>\n"));
6506 return -1;
6507 }
6508
6509 domain_name = smb_xstrdup(argv[0]);
6510 if (!strupper_m(domain_name)) {
6511 SAFE_FREE(domain_name);
6512 return -1;
6513 }
6514
6515 /* account name used at first is our domain's name with '$' */
6516 if (asprintf(&acct_name, "%s$", lp_workgroup()) == -1) {
6517 return -1;
6518 }
6519 if (!strupper_m(acct_name)) {
6520 SAFE_FREE(domain_name);
6521 SAFE_FREE(acct_name);
6522 return -1;
6523 }
6524
6525 /*
6526 * opt_workgroup will be used by connection functions further,
6527 * hence it should be set to remote domain name instead of ours
6528 */
6529 if (c->opt_workgroup) {
6530 c->opt_workgroup = smb_xstrdup(domain_name);
6531 };
6532
6533 c->opt_user_name = acct_name;
6534
6535 /* find the domain controller */
6536 if (!net_find_pdc(&server_ss, pdc_name, domain_name)) {
6537 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name));
6538 return -1;
6539 }
6540
6541 /* connect to ipc$ as username/password */
6542 nt_status = connect_to_ipc(c, &cli, &server_ss, pdc_name);
6543 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
6544
6545 /* Is it trusting domain account for sure ? */
6546 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
6547 nt_errstr(nt_status)));
6548 return -1;
6549 }
6550
6551 /* store who we connected to */
6552
6553 saf_store( domain_name, pdc_name );
6554
6555 /*
6556 * Connect to \\server\ipc$ again (this time anonymously)
6557 */
6558
6559 nt_status = connect_to_ipc_anonymous(c, &cli, &server_ss,
6560 (char*)pdc_name);
6561
6562 if (NT_STATUS_IS_ERR(nt_status)) {
6563 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
6564 domain_name, nt_errstr(nt_status)));
6565 return -1;
6566 }
6567
6568 if (!(mem_ctx = talloc_init("establishing trust relationship to "
6569 "domain %s", domain_name))) {
6570 DEBUG(0, ("talloc_init() failed\n"));
6571 cli_shutdown(cli);
6572 return -1;
6573 }
6574
6575 /* Make sure we're talking to a proper server */
6576
6577 nt_status = rpc_trustdom_get_pdc(c, cli, mem_ctx, domain_name);
6578 if (!NT_STATUS_IS_OK(nt_status)) {
6579 cli_shutdown(cli);
6580 talloc_destroy(mem_ctx);
6581 return -1;
6582 }
6583
6584 /*
6585 * Call LsaOpenPolicy and LsaQueryInfo
6586 */
6587
6588 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
6589 &pipe_hnd);
6590 if (!NT_STATUS_IS_OK(nt_status)) {
6591 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status) ));
6592 cli_shutdown(cli);
6593 talloc_destroy(mem_ctx);
6594 return -1;
6595 }
6596
6597 b = pipe_hnd->binding_handle;
6598
6599 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true, KEY_QUERY_VALUE,
6600 &connect_hnd);
6601 if (NT_STATUS_IS_ERR(nt_status)) {
6602 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6603 nt_errstr(nt_status)));
6604 cli_shutdown(cli);
6605 talloc_destroy(mem_ctx);
6606 return -1;
6607 }
6608
6609 /* Querying info level 5 */
6610
6611 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6612 &connect_hnd,
6613 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6614 &info,
6615 &result);
6616 if (NT_STATUS_IS_ERR(nt_status)) {
6617 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6618 nt_errstr(nt_status)));
6619 cli_shutdown(cli);
6620 talloc_destroy(mem_ctx);
6621 return -1;
6622 }
6623 if (NT_STATUS_IS_ERR(result)) {
6624 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6625 nt_errstr(result)));
6626 cli_shutdown(cli);
6627 talloc_destroy(mem_ctx);
6628 return -1;
6629 }
6630
6631 domain_sid = info->account_domain.sid;
6632
6633 /* There should be actually query info level 3 (following nt serv behaviour),
6634 but I still don't know if it's _really_ necessary */
6635
6636 /*
6637 * Store the password in secrets db
6638 */
6639
6640 if (!pdb_set_trusteddom_pw(domain_name, c->opt_password, domain_sid)) {
6641 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6642 cli_shutdown(cli);
6643 talloc_destroy(mem_ctx);
6644 return -1;
6645 }
6646
6647 /*
6648 * Close the pipes and clean up
6649 */
6650
6651 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6652 if (NT_STATUS_IS_ERR(nt_status)) {
6653 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
6654 nt_errstr(nt_status)));
6655 cli_shutdown(cli);
6656 talloc_destroy(mem_ctx);
6657 return -1;
6658 }
6659
6660 cli_shutdown(cli);
6661
6662 talloc_destroy(mem_ctx);
6663
6664 d_printf(_("Trust to domain %s established\n"), domain_name);
6665 return 0;
6666}
6667
6668/**
6669 * Revoke trust relationship to the remote domain.
6670 *
6671 * @param c A net_context structure.
6672 * @param argc Standard argc.
6673 * @param argv Standard argv without initial components.
6674 *
6675 * @return Integer status (0 means success).
6676 **/
6677
6678static int rpc_trustdom_revoke(struct net_context *c, int argc,
6679 const char **argv)
6680{
6681 char* domain_name;
6682 int rc = -1;
6683
6684 if (argc < 1 || c->display_usage) {
6685 d_printf("%s\n%s",
6686 _("Usage:"),
6687 _("net rpc trustdom revoke <domain_name>\n"
6688 " Revoke trust relationship\n"
6689 " domain_name\tName of domain to revoke trust\n"));
6690 return -1;
6691 }
6692
6693 /* generate upper cased domain name */
6694 domain_name = smb_xstrdup(argv[0]);
6695 if (!strupper_m(domain_name)) {
6696 SAFE_FREE(domain_name);
6697 return -1;
6698 }
6699
6700 /* delete password of the trust */
6701 if (!pdb_del_trusteddom_pw(domain_name)) {
6702 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
6703 domain_name));
6704 goto done;
6705 };
6706
6707 rc = 0;
6708done:
6709 SAFE_FREE(domain_name);
6710 return rc;
6711}
6712
6713static NTSTATUS rpc_query_domain_sid(struct net_context *c,
6714 const struct dom_sid *domain_sid,
6715 const char *domain_name,
6716 struct cli_state *cli,
6717 struct rpc_pipe_client *pipe_hnd,
6718 TALLOC_CTX *mem_ctx,
6719 int argc,
6720 const char **argv)
6721{
6722 fstring str_sid;
6723 if (!sid_to_fstring(str_sid, domain_sid)) {
6724 return NT_STATUS_UNSUCCESSFUL;
6725 }
6726 d_printf("%s\n", str_sid);
6727 return NT_STATUS_OK;
6728}
6729
6730static void print_trusted_domain(struct dom_sid *dom_sid, const char *trusted_dom_name)
6731{
6732 fstring ascii_sid;
6733
6734 /* convert sid into ascii string */
6735 sid_to_fstring(ascii_sid, dom_sid);
6736
6737 d_printf("%-20s%s\n", trusted_dom_name, ascii_sid);
6738}
6739
6740static NTSTATUS vampire_trusted_domain(struct rpc_pipe_client *pipe_hnd,
6741 TALLOC_CTX *mem_ctx,
6742 struct policy_handle *pol,
6743 struct dom_sid dom_sid,
6744 const char *trusted_dom_name)
6745{
6746 NTSTATUS nt_status, result;
6747 union lsa_TrustedDomainInfo *info = NULL;
6748 char *cleartextpwd = NULL;
6749 DATA_BLOB session_key;
6750 DATA_BLOB data = data_blob_null;
6751 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
6752
6753 nt_status = dcerpc_lsa_QueryTrustedDomainInfoBySid(b, mem_ctx,
6754 pol,
6755 &dom_sid,
6756 LSA_TRUSTED_DOMAIN_INFO_PASSWORD,
6757 &info,
6758 &result);
6759 if (NT_STATUS_IS_ERR(nt_status)) {
6760 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6761 nt_errstr(nt_status)));
6762 goto done;
6763 }
6764 if (NT_STATUS_IS_ERR(result)) {
6765 nt_status = result;
6766 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6767 nt_errstr(result)));
6768 goto done;
6769 }
6770
6771 data = data_blob(info->password.password->data,
6772 info->password.password->length);
6773
6774 nt_status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
6775 if (!NT_STATUS_IS_OK(nt_status)) {
6776 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(nt_status)));
6777 goto done;
6778 }
6779
6780 cleartextpwd = sess_decrypt_string(mem_ctx, &data, &session_key);
6781 data_blob_free(&session_key);
6782
6783 if (cleartextpwd == NULL) {
6784 DEBUG(0,("retrieved NULL password\n"));
6785 nt_status = NT_STATUS_UNSUCCESSFUL;
6786 goto done;
6787 }
6788
6789 if (!pdb_set_trusteddom_pw(trusted_dom_name, cleartextpwd, &dom_sid)) {
6790 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6791 nt_status = NT_STATUS_UNSUCCESSFUL;
6792 goto done;
6793 }
6794
6795#ifdef DEBUG_PASSWORD
6796 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
6797 "password: [%s]\n", trusted_dom_name,
6798 sid_string_dbg(&dom_sid), cleartextpwd));
6799#endif
6800
6801done:
6802 SAFE_FREE(cleartextpwd);
6803 data_blob_free(&data);
6804
6805 return nt_status;
6806}
6807
6808static int rpc_trustdom_vampire(struct net_context *c, int argc,
6809 const char **argv)
6810{
6811 /* common variables */
6812 TALLOC_CTX* mem_ctx;
6813 struct cli_state *cli = NULL;
6814 struct rpc_pipe_client *pipe_hnd = NULL;
6815 NTSTATUS nt_status, result;
6816 const char *domain_name = NULL;
6817 struct policy_handle connect_hnd;
6818 union lsa_PolicyInformation *info = NULL;
6819
6820 /* trusted domains listing variables */
6821 unsigned int enum_ctx = 0;
6822 int i;
6823 struct lsa_DomainList dom_list;
6824 fstring pdc_name;
6825 struct dcerpc_binding_handle *b;
6826
6827 if (c->display_usage) {
6828 d_printf( "%s\n"
6829 "net rpc trustdom vampire\n"
6830 " %s\n",
6831 _("Usage:"),
6832 _("Vampire trust relationship from remote server"));
6833 return 0;
6834 }
6835
6836 /*
6837 * Listing trusted domains (stored in secrets.tdb, if local)
6838 */
6839
6840 mem_ctx = talloc_init("trust relationships vampire");
6841
6842 /*
6843 * set domain and pdc name to local samba server (default)
6844 * or to remote one given in command line
6845 */
6846
6847 if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
6848 domain_name = c->opt_workgroup;
6849 c->opt_target_workgroup = c->opt_workgroup;
6850 } else {
6851 fstrcpy(pdc_name, lp_netbios_name());
6852 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6853 c->opt_target_workgroup = domain_name;
6854 };
6855
6856 /* open \PIPE\lsarpc and open policy handle */
6857 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6858 if (!NT_STATUS_IS_OK(nt_status)) {
6859 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6860 nt_errstr(nt_status)));
6861 talloc_destroy(mem_ctx);
6862 return -1;
6863 };
6864
6865 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
6866 &pipe_hnd);
6867 if (!NT_STATUS_IS_OK(nt_status)) {
6868 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6869 nt_errstr(nt_status) ));
6870 cli_shutdown(cli);
6871 talloc_destroy(mem_ctx);
6872 return -1;
6873 };
6874
6875 b = pipe_hnd->binding_handle;
6876
6877 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6878 &connect_hnd);
6879 if (NT_STATUS_IS_ERR(nt_status)) {
6880 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6881 nt_errstr(nt_status)));
6882 cli_shutdown(cli);
6883 talloc_destroy(mem_ctx);
6884 return -1;
6885 };
6886
6887 /* query info level 5 to obtain sid of a domain being queried */
6888 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6889 &connect_hnd,
6890 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6891 &info,
6892 &result);
6893
6894 if (NT_STATUS_IS_ERR(nt_status)) {
6895 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6896 nt_errstr(nt_status)));
6897 cli_shutdown(cli);
6898 talloc_destroy(mem_ctx);
6899 return -1;
6900 }
6901 if (NT_STATUS_IS_ERR(result)) {
6902 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6903 nt_errstr(result)));
6904 cli_shutdown(cli);
6905 talloc_destroy(mem_ctx);
6906 return -1;
6907 }
6908
6909 /*
6910 * Keep calling LsaEnumTrustdom over opened pipe until
6911 * the end of enumeration is reached
6912 */
6913
6914 d_printf(_("Vampire trusted domains:\n\n"));
6915
6916 do {
6917 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
6918 &connect_hnd,
6919 &enum_ctx,
6920 &dom_list,
6921 (uint32_t)-1,
6922 &result);
6923 if (NT_STATUS_IS_ERR(nt_status)) {
6924 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6925 nt_errstr(nt_status)));
6926 cli_shutdown(cli);
6927 talloc_destroy(mem_ctx);
6928 return -1;
6929 };
6930 if (NT_STATUS_IS_ERR(result)) {
6931 nt_status = result;
6932 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6933 nt_errstr(result)));
6934 cli_shutdown(cli);
6935 talloc_destroy(mem_ctx);
6936 return -1;
6937 };
6938
6939
6940 for (i = 0; i < dom_list.count; i++) {
6941
6942 print_trusted_domain(dom_list.domains[i].sid,
6943 dom_list.domains[i].name.string);
6944
6945 nt_status = vampire_trusted_domain(pipe_hnd, mem_ctx, &connect_hnd,
6946 *dom_list.domains[i].sid,
6947 dom_list.domains[i].name.string);
6948 if (!NT_STATUS_IS_OK(nt_status)) {
6949 cli_shutdown(cli);
6950 talloc_destroy(mem_ctx);
6951 return -1;
6952 }
6953 };
6954
6955 /*
6956 * in case of no trusted domains say something rather
6957 * than just display blank line
6958 */
6959 if (!dom_list.count) d_printf(_("none\n"));
6960
6961 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6962
6963 /* close this connection before doing next one */
6964 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6965 if (NT_STATUS_IS_ERR(nt_status)) {
6966 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6967 nt_errstr(nt_status)));
6968 cli_shutdown(cli);
6969 talloc_destroy(mem_ctx);
6970 return -1;
6971 };
6972
6973 /* close lsarpc pipe and connection to IPC$ */
6974 cli_shutdown(cli);
6975
6976 talloc_destroy(mem_ctx);
6977 return 0;
6978}
6979
6980static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
6981{
6982 /* common variables */
6983 TALLOC_CTX* mem_ctx;
6984 struct cli_state *cli = NULL, *remote_cli = NULL;
6985 struct rpc_pipe_client *pipe_hnd = NULL;
6986 NTSTATUS nt_status, result;
6987 const char *domain_name = NULL;
6988 struct dom_sid *queried_dom_sid;
6989 int ascii_dom_name_len;
6990 struct policy_handle connect_hnd;
6991 union lsa_PolicyInformation *info = NULL;
6992 struct dcerpc_binding_handle *b = NULL;
6993
6994 /* trusted domains listing variables */
6995 unsigned int num_domains, enum_ctx = 0;
6996 int i;
6997 struct lsa_DomainList dom_list;
6998 fstring pdc_name;
6999 bool found_domain;
7000
7001 /* trusting domains listing variables */
7002 struct policy_handle domain_hnd;
7003 struct samr_SamArray *trusts = NULL;
7004
7005 if (c->display_usage) {
7006 d_printf( "%s\n"
7007 "net rpc trustdom list\n"
7008 " %s\n",
7009 _("Usage:"),
7010 _("List incoming and outgoing trust relationships"));
7011 return 0;
7012 }
7013
7014 /*
7015 * Listing trusted domains (stored in secrets.tdb, if local)
7016 */
7017
7018 mem_ctx = talloc_init("trust relationships listing");
7019
7020 /*
7021 * set domain and pdc name to local samba server (default)
7022 * or to remote one given in command line
7023 */
7024
7025 if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
7026 domain_name = c->opt_workgroup;
7027 c->opt_target_workgroup = c->opt_workgroup;
7028 } else {
7029 fstrcpy(pdc_name, lp_netbios_name());
7030 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
7031 c->opt_target_workgroup = domain_name;
7032 };
7033
7034 /* open \PIPE\lsarpc and open policy handle */
7035 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
7036 if (!NT_STATUS_IS_OK(nt_status)) {
7037 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
7038 nt_errstr(nt_status)));
7039 talloc_destroy(mem_ctx);
7040 return -1;
7041 };
7042
7043 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc,
7044 &pipe_hnd);
7045 if (!NT_STATUS_IS_OK(nt_status)) {
7046 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
7047 nt_errstr(nt_status) ));
7048 cli_shutdown(cli);
7049 talloc_destroy(mem_ctx);
7050 return -1;
7051 };
7052
7053 b = pipe_hnd->binding_handle;
7054
7055 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
7056 &connect_hnd);
7057 if (NT_STATUS_IS_ERR(nt_status)) {
7058 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
7059 nt_errstr(nt_status)));
7060 cli_shutdown(cli);
7061 talloc_destroy(mem_ctx);
7062 return -1;
7063 };
7064
7065 /* query info level 5 to obtain sid of a domain being queried */
7066 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
7067 &connect_hnd,
7068 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
7069 &info,
7070 &result);
7071
7072 if (NT_STATUS_IS_ERR(nt_status)) {
7073 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
7074 nt_errstr(nt_status)));
7075 cli_shutdown(cli);
7076 talloc_destroy(mem_ctx);
7077 return -1;
7078 }
7079 if (NT_STATUS_IS_ERR(result)) {
7080 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
7081 nt_errstr(result)));
7082 cli_shutdown(cli);
7083 talloc_destroy(mem_ctx);
7084 return -1;
7085 }
7086
7087 queried_dom_sid = info->account_domain.sid;
7088
7089 /*
7090 * Keep calling LsaEnumTrustdom over opened pipe until
7091 * the end of enumeration is reached
7092 */
7093
7094 d_printf(_("Trusted domains list:\n\n"));
7095
7096 found_domain = false;
7097
7098 do {
7099 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
7100 &connect_hnd,
7101 &enum_ctx,
7102 &dom_list,
7103 (uint32_t)-1,
7104 &result);
7105 if (NT_STATUS_IS_ERR(nt_status)) {
7106 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
7107 nt_errstr(nt_status)));
7108 cli_shutdown(cli);
7109 talloc_destroy(mem_ctx);
7110 return -1;
7111 };
7112 if (NT_STATUS_IS_ERR(result)) {
7113 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
7114 nt_errstr(result)));
7115 cli_shutdown(cli);
7116 talloc_destroy(mem_ctx);
7117 return -1;
7118 };
7119
7120
7121 for (i = 0; i < dom_list.count; i++) {
7122 print_trusted_domain(dom_list.domains[i].sid,
7123 dom_list.domains[i].name.string);
7124 found_domain = true;
7125 };
7126
7127
7128 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
7129
7130 /*
7131 * in case of no trusted domains say something rather
7132 * than just display blank line
7133 */
7134 if (!found_domain) {
7135 d_printf(_("none\n"));
7136 }
7137
7138 /* close this connection before doing next one */
7139 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
7140 if (NT_STATUS_IS_ERR(nt_status)) {
7141 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
7142 nt_errstr(nt_status)));
7143 cli_shutdown(cli);
7144 talloc_destroy(mem_ctx);
7145 return -1;
7146 };
7147
7148 TALLOC_FREE(pipe_hnd);
7149
7150 /*
7151 * Listing trusting domains (stored in passdb backend, if local)
7152 */
7153
7154 d_printf(_("\nTrusting domains list:\n\n"));
7155
7156 /*
7157 * Open \PIPE\samr and get needed policy handles
7158 */
7159 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
7160 &pipe_hnd);
7161 if (!NT_STATUS_IS_OK(nt_status)) {
7162 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status)));
7163 cli_shutdown(cli);
7164 talloc_destroy(mem_ctx);
7165 return -1;
7166 };
7167
7168 b = pipe_hnd->binding_handle;
7169
7170 /* SamrConnect2 */
7171 nt_status = dcerpc_samr_Connect2(b, mem_ctx,
7172 pipe_hnd->desthost,
7173 SAMR_ACCESS_LOOKUP_DOMAIN,
7174 &connect_hnd,
7175 &result);
7176 if (!NT_STATUS_IS_OK(nt_status)) {
7177 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
7178 nt_errstr(nt_status)));
7179 cli_shutdown(cli);
7180 talloc_destroy(mem_ctx);
7181 return -1;
7182 };
7183 if (!NT_STATUS_IS_OK(result)) {
7184 nt_status = result;
7185 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
7186 nt_errstr(result)));
7187 cli_shutdown(cli);
7188 talloc_destroy(mem_ctx);
7189 return -1;
7190 };
7191
7192 /* SamrOpenDomain - we have to open domain policy handle in order to be
7193 able to enumerate accounts*/
7194 nt_status = dcerpc_samr_OpenDomain(b, mem_ctx,
7195 &connect_hnd,
7196 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
7197 queried_dom_sid,
7198 &domain_hnd,
7199 &result);
7200 if (!NT_STATUS_IS_OK(nt_status)) {
7201 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
7202 nt_errstr(nt_status)));
7203 cli_shutdown(cli);
7204 talloc_destroy(mem_ctx);
7205 return -1;
7206 };
7207 if (!NT_STATUS_IS_OK(result)) {
7208 nt_status = result;
7209 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
7210 nt_errstr(result)));
7211 cli_shutdown(cli);
7212 talloc_destroy(mem_ctx);
7213 return -1;
7214 };
7215
7216 /*
7217 * perform actual enumeration
7218 */
7219
7220 found_domain = false;
7221
7222 enum_ctx = 0; /* reset enumeration context from last enumeration */
7223 do {
7224
7225 nt_status = dcerpc_samr_EnumDomainUsers(b, mem_ctx,
7226 &domain_hnd,
7227 &enum_ctx,
7228 ACB_DOMTRUST,
7229 &trusts,
7230 0xffff,
7231 &num_domains,
7232 &result);
7233 if (NT_STATUS_IS_ERR(nt_status)) {
7234 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
7235 nt_errstr(nt_status)));
7236 cli_shutdown(cli);
7237 talloc_destroy(mem_ctx);
7238 return -1;
7239 };
7240 if (NT_STATUS_IS_ERR(result)) {
7241 nt_status = result;
7242 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
7243 nt_errstr(result)));
7244 cli_shutdown(cli);
7245 talloc_destroy(mem_ctx);
7246 return -1;
7247 };
7248
7249 for (i = 0; i < num_domains; i++) {
7250
7251 char *str = discard_const_p(char, trusts->entries[i].name.string);
7252
7253 found_domain = true;
7254
7255 /*
7256 * get each single domain's sid (do we _really_ need this ?):
7257 * 1) connect to domain's pdc
7258 * 2) query the pdc for domain's sid
7259 */
7260
7261 /* get rid of '$' tail */
7262 ascii_dom_name_len = strlen(str);
7263 if (ascii_dom_name_len && ascii_dom_name_len < FSTRING_LEN)
7264 str[ascii_dom_name_len - 1] = '\0';
7265
7266 /* set opt_* variables to remote domain */
7267 if (!strupper_m(str)) {
7268 cli_shutdown(cli);
7269 talloc_destroy(mem_ctx);
7270 return -1;
7271 }
7272 c->opt_workgroup = talloc_strdup(mem_ctx, str);
7273 c->opt_target_workgroup = c->opt_workgroup;
7274
7275 d_printf("%-20s", str);
7276
7277 /* connect to remote domain controller */
7278 nt_status = net_make_ipc_connection(c,
7279 NET_FLAGS_PDC | NET_FLAGS_ANONYMOUS,
7280 &remote_cli);
7281 if (NT_STATUS_IS_OK(nt_status)) {
7282 /* query for domain's sid */
7283 if (run_rpc_command(
7284 c, remote_cli,
7285 &ndr_table_lsarpc, 0,
7286 rpc_query_domain_sid, argc,
7287 argv))
7288 d_printf(_("strange - couldn't get domain's sid\n"));
7289
7290 cli_shutdown(remote_cli);
7291
7292 } else {
7293 d_fprintf(stderr, _("domain controller is not "
7294 "responding: %s\n"),
7295 nt_errstr(nt_status));
7296 d_printf(_("couldn't get domain's sid\n"));
7297 }
7298 }
7299
7300 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
7301
7302 if (!found_domain) {
7303 d_printf("none\n");
7304 }
7305
7306 /* close opened samr and domain policy handles */
7307 nt_status = dcerpc_samr_Close(b, mem_ctx, &domain_hnd, &result);
7308 if (!NT_STATUS_IS_OK(nt_status)) {
7309 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name));
7310 };
7311
7312 nt_status = dcerpc_samr_Close(b, mem_ctx, &connect_hnd, &result);
7313 if (!NT_STATUS_IS_OK(nt_status)) {
7314 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name));
7315 };
7316
7317 /* close samr pipe and connection to IPC$ */
7318 cli_shutdown(cli);
7319
7320 talloc_destroy(mem_ctx);
7321 return 0;
7322}
7323
7324/**
7325 * Entrypoint for 'net rpc trustdom' code.
7326 *
7327 * @param argc Standard argc.
7328 * @param argv Standard argv without initial components.
7329 *
7330 * @return Integer status (0 means success).
7331 */
7332
7333static int rpc_trustdom(struct net_context *c, int argc, const char **argv)
7334{
7335 struct functable func[] = {
7336 {
7337 "add",
7338 rpc_trustdom_add,
7339 NET_TRANSPORT_RPC,
7340 N_("Add trusting domain's account"),
7341 N_("net rpc trustdom add\n"
7342 " Add trusting domain's account")
7343 },
7344 {
7345 "del",
7346 rpc_trustdom_del,
7347 NET_TRANSPORT_RPC,
7348 N_("Remove trusting domain's account"),
7349 N_("net rpc trustdom del\n"
7350 " Remove trusting domain's account")
7351 },
7352 {
7353 "establish",
7354 rpc_trustdom_establish,
7355 NET_TRANSPORT_RPC,
7356 N_("Establish outgoing trust relationship"),
7357 N_("net rpc trustdom establish\n"
7358 " Establish outgoing trust relationship")
7359 },
7360 {
7361 "revoke",
7362 rpc_trustdom_revoke,
7363 NET_TRANSPORT_RPC,
7364 N_("Revoke outgoing trust relationship"),
7365 N_("net rpc trustdom revoke\n"
7366 " Revoke outgoing trust relationship")
7367 },
7368 {
7369 "list",
7370 rpc_trustdom_list,
7371 NET_TRANSPORT_RPC,
7372 N_("List in- and outgoing domain trusts"),
7373 N_("net rpc trustdom list\n"
7374 " List in- and outgoing domain trusts")
7375 },
7376 {
7377 "vampire",
7378 rpc_trustdom_vampire,
7379 NET_TRANSPORT_RPC,
7380 N_("Vampire trusts from remote server"),
7381 N_("net rpc trustdom vampire\n"
7382 " Vampire trusts from remote server")
7383 },
7384 {NULL, NULL, 0, NULL, NULL}
7385 };
7386
7387 return net_run_function(c, argc, argv, "net rpc trustdom", func);
7388}
7389
7390/**
7391 * Check if a server will take rpc commands
7392 * @param flags Type of server to connect to (PDC, DMB, localhost)
7393 * if the host is not explicitly specified
7394 * @return bool (true means rpc supported)
7395 */
7396bool net_rpc_check(struct net_context *c, unsigned flags)
7397{
7398 struct cli_state *cli;
7399 bool ret = false;
7400 struct sockaddr_storage server_ss;
7401 char *server_name = NULL;
7402 NTSTATUS status;
7403
7404 /* flags (i.e. server type) may depend on command */
7405 if (!net_find_server(c, NULL, flags, &server_ss, &server_name))
7406 return false;
7407
7408 status = cli_connect_nb(server_name, &server_ss, 0, 0x20,
7409 lp_netbios_name(), SMB_SIGNING_IPC_DEFAULT,
7410 0, &cli);
7411 if (!NT_STATUS_IS_OK(status)) {
7412 return false;
7413 }
7414 status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
7415 PROTOCOL_NT1);
7416 if (!NT_STATUS_IS_OK(status))
7417 goto done;
7418 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_NT1)
7419 goto done;
7420
7421 ret = true;
7422 done:
7423 cli_shutdown(cli);
7424 return ret;
7425}
7426
7427/* dump sam database via samsync rpc calls */
7428static int rpc_samdump(struct net_context *c, int argc, const char **argv) {
7429 if (c->display_usage) {
7430 d_printf( "%s\n"
7431 "net rpc samdump\n"
7432 " %s\n",
7433 _("Usage:"),
7434 _("Dump remote SAM database"));
7435 return 0;
7436 }
7437
7438 return run_rpc_command(c, NULL, &ndr_table_netlogon,
7439 NET_FLAGS_ANONYMOUS,
7440 rpc_samdump_internals, argc, argv);
7441}
7442
7443/* syncronise sam database via samsync rpc calls */
7444static int rpc_vampire(struct net_context *c, int argc, const char **argv)
7445{
7446 struct functable func[] = {
7447 {
7448 "ldif",
7449 rpc_vampire_ldif,
7450 NET_TRANSPORT_RPC,
7451 N_("Dump remote SAM database to ldif"),
7452 N_("net rpc vampire ldif\n"
7453 " Dump remote SAM database to LDIF file or "
7454 "stdout")
7455 },
7456 {
7457 "keytab",
7458 rpc_vampire_keytab,
7459 NET_TRANSPORT_RPC,
7460 N_("Dump remote SAM database to Kerberos Keytab"),
7461 N_("net rpc vampire keytab\n"
7462 " Dump remote SAM database to Kerberos keytab "
7463 "file")
7464 },
7465 {
7466 "passdb",
7467 rpc_vampire_passdb,
7468 NET_TRANSPORT_RPC,
7469 N_("Dump remote SAM database to passdb"),
7470 N_("net rpc vampire passdb\n"
7471 " Dump remote SAM database to passdb")
7472 },
7473
7474 {NULL, NULL, 0, NULL, NULL}
7475 };
7476
7477 if (argc == 0) {
7478 if (c->display_usage) {
7479 d_printf( "%s\n"
7480 "net rpc vampire\n"
7481 " %s\n",
7482 _("Usage:"),
7483 _("Vampire remote SAM database"));
7484 return 0;
7485 }
7486
7487 return rpc_vampire_passdb(c, argc, argv);
7488 }
7489
7490 return net_run_function(c, argc, argv, "net rpc vampire", func);
7491}
7492
7493/**
7494 * Migrate everything from a print server.
7495 *
7496 * @param c A net_context structure.
7497 * @param argc Standard main() style argc.
7498 * @param argv Standard main() style argv. Initial components are already
7499 * stripped.
7500 *
7501 * @return A shell status integer (0 for success).
7502 *
7503 * The order is important !
7504 * To successfully add drivers the print queues have to exist !
7505 * Applying ACLs should be the last step, because you're easily locked out.
7506 *
7507 **/
7508static int rpc_printer_migrate_all(struct net_context *c, int argc,
7509 const char **argv)
7510{
7511 int ret;
7512
7513 if (c->display_usage) {
7514 d_printf( "%s\n"
7515 "net rpc printer migrate all\n"
7516 " %s\n",
7517 _("Usage:"),
7518 _("Migrate everything from a print server"));
7519 return 0;
7520 }
7521
7522 if (!c->opt_host) {
7523 d_printf(_("no server to migrate\n"));
7524 return -1;
7525 }
7526
7527 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7528 rpc_printer_migrate_printers_internals, argc,
7529 argv);
7530 if (ret)
7531 return ret;
7532
7533 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7534 rpc_printer_migrate_drivers_internals, argc,
7535 argv);
7536 if (ret)
7537 return ret;
7538
7539 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7540 rpc_printer_migrate_forms_internals, argc, argv);
7541 if (ret)
7542 return ret;
7543
7544 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7545 rpc_printer_migrate_settings_internals, argc,
7546 argv);
7547 if (ret)
7548 return ret;
7549
7550 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7551 rpc_printer_migrate_security_internals, argc,
7552 argv);
7553
7554}
7555
7556/**
7557 * Migrate print drivers from a print server.
7558 *
7559 * @param c A net_context structure.
7560 * @param argc Standard main() style argc.
7561 * @param argv Standard main() style argv. Initial components are already
7562 * stripped.
7563 *
7564 * @return A shell status integer (0 for success).
7565 **/
7566static int rpc_printer_migrate_drivers(struct net_context *c, int argc,
7567 const char **argv)
7568{
7569 if (c->display_usage) {
7570 d_printf( "%s\n"
7571 "net rpc printer migrate drivers\n"
7572 " %s\n",
7573 _("Usage:"),
7574 _("Migrate print-drivers from a print-server"));
7575 return 0;
7576 }
7577
7578 if (!c->opt_host) {
7579 d_printf(_("no server to migrate\n"));
7580 return -1;
7581 }
7582
7583 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7584 rpc_printer_migrate_drivers_internals,
7585 argc, argv);
7586}
7587
7588/**
7589 * Migrate print-forms from a print-server.
7590 *
7591 * @param c A net_context structure.
7592 * @param argc Standard main() style argc.
7593 * @param argv Standard main() style argv. Initial components are already
7594 * stripped.
7595 *
7596 * @return A shell status integer (0 for success).
7597 **/
7598static int rpc_printer_migrate_forms(struct net_context *c, int argc,
7599 const char **argv)
7600{
7601 if (c->display_usage) {
7602 d_printf( "%s\n"
7603 "net rpc printer migrate forms\n"
7604 " %s\n",
7605 _("Usage:"),
7606 _("Migrate print-forms from a print-server"));
7607 return 0;
7608 }
7609
7610 if (!c->opt_host) {
7611 d_printf(_("no server to migrate\n"));
7612 return -1;
7613 }
7614
7615 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7616 rpc_printer_migrate_forms_internals,
7617 argc, argv);
7618}
7619
7620/**
7621 * Migrate printers from a print-server.
7622 *
7623 * @param c A net_context structure.
7624 * @param argc Standard main() style argc.
7625 * @param argv Standard main() style argv. Initial components are already
7626 * stripped.
7627 *
7628 * @return A shell status integer (0 for success).
7629 **/
7630static int rpc_printer_migrate_printers(struct net_context *c, int argc,
7631 const char **argv)
7632{
7633 if (c->display_usage) {
7634 d_printf( "%s\n"
7635 "net rpc printer migrate printers\n"
7636 " %s\n",
7637 _("Usage:"),
7638 _("Migrate printers from a print-server"));
7639 return 0;
7640 }
7641
7642 if (!c->opt_host) {
7643 d_printf(_("no server to migrate\n"));
7644 return -1;
7645 }
7646
7647 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7648 rpc_printer_migrate_printers_internals,
7649 argc, argv);
7650}
7651
7652/**
7653 * Migrate printer-ACLs from a print-server
7654 *
7655 * @param c A net_context structure.
7656 * @param argc Standard main() style argc.
7657 * @param argv Standard main() style argv. Initial components are already
7658 * stripped.
7659 *
7660 * @return A shell status integer (0 for success).
7661 **/
7662static int rpc_printer_migrate_security(struct net_context *c, int argc,
7663 const char **argv)
7664{
7665 if (c->display_usage) {
7666 d_printf( "%s\n"
7667 "net rpc printer migrate security\n"
7668 " %s\n",
7669 _("Usage:"),
7670 _("Migrate printer-ACLs from a print-server"));
7671 return 0;
7672 }
7673
7674 if (!c->opt_host) {
7675 d_printf(_("no server to migrate\n"));
7676 return -1;
7677 }
7678
7679 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7680 rpc_printer_migrate_security_internals,
7681 argc, argv);
7682}
7683
7684/**
7685 * Migrate printer-settings from a print-server.
7686 *
7687 * @param c A net_context structure.
7688 * @param argc Standard main() style argc.
7689 * @param argv Standard main() style argv. Initial components are already
7690 * stripped.
7691 *
7692 * @return A shell status integer (0 for success).
7693 **/
7694static int rpc_printer_migrate_settings(struct net_context *c, int argc,
7695 const char **argv)
7696{
7697 if (c->display_usage) {
7698 d_printf( "%s\n"
7699 "net rpc printer migrate settings\n"
7700 " %s\n",
7701 _("Usage:"),
7702 _("Migrate printer-settings from a "
7703 "print-server"));
7704 return 0;
7705 }
7706
7707 if (!c->opt_host) {
7708 d_printf(_("no server to migrate\n"));
7709 return -1;
7710 }
7711
7712 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7713 rpc_printer_migrate_settings_internals,
7714 argc, argv);
7715}
7716
7717/**
7718 * 'net rpc printer' entrypoint.
7719 *
7720 * @param c A net_context structure.
7721 * @param argc Standard main() style argc.
7722 * @param argv Standard main() style argv. Initial components are already
7723 * stripped.
7724 **/
7725
7726int rpc_printer_migrate(struct net_context *c, int argc, const char **argv)
7727{
7728
7729 /* ouch: when addriver and setdriver are called from within
7730 rpc_printer_migrate_drivers_internals, the printer-queue already
7731 *has* to exist */
7732
7733 struct functable func[] = {
7734 {
7735 "all",
7736 rpc_printer_migrate_all,
7737 NET_TRANSPORT_RPC,
7738 N_("Migrate all from remote to local print server"),
7739 N_("net rpc printer migrate all\n"
7740 " Migrate all from remote to local print server")
7741 },
7742 {
7743 "drivers",
7744 rpc_printer_migrate_drivers,
7745 NET_TRANSPORT_RPC,
7746 N_("Migrate drivers to local server"),
7747 N_("net rpc printer migrate drivers\n"
7748 " Migrate drivers to local server")
7749 },
7750 {
7751 "forms",
7752 rpc_printer_migrate_forms,
7753 NET_TRANSPORT_RPC,
7754 N_("Migrate froms to local server"),
7755 N_("net rpc printer migrate forms\n"
7756 " Migrate froms to local server")
7757 },
7758 {
7759 "printers",
7760 rpc_printer_migrate_printers,
7761 NET_TRANSPORT_RPC,
7762 N_("Migrate printers to local server"),
7763 N_("net rpc printer migrate printers\n"
7764 " Migrate printers to local server")
7765 },
7766 {
7767 "security",
7768 rpc_printer_migrate_security,
7769 NET_TRANSPORT_RPC,
7770 N_("Mirgate printer ACLs to local server"),
7771 N_("net rpc printer migrate security\n"
7772 " Mirgate printer ACLs to local server")
7773 },
7774 {
7775 "settings",
7776 rpc_printer_migrate_settings,
7777 NET_TRANSPORT_RPC,
7778 N_("Migrate printer settings to local server"),
7779 N_("net rpc printer migrate settings\n"
7780 " Migrate printer settings to local server")
7781 },
7782 {NULL, NULL, 0, NULL, NULL}
7783 };
7784
7785 return net_run_function(c, argc, argv, "net rpc printer migrate",func);
7786}
7787
7788
7789/**
7790 * List printers on a remote RPC server.
7791 *
7792 * @param c A net_context structure.
7793 * @param argc Standard main() style argc.
7794 * @param argv Standard main() style argv. Initial components are already
7795 * stripped.
7796 *
7797 * @return A shell status integer (0 for success).
7798 **/
7799static int rpc_printer_list(struct net_context *c, int argc, const char **argv)
7800{
7801 if (c->display_usage) {
7802 d_printf( "%s\n"
7803 "net rpc printer list\n"
7804 " %s\n",
7805 _("Usage:"),
7806 _("List printers on a remote RPC server"));
7807 return 0;
7808 }
7809
7810 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7811 rpc_printer_list_internals,
7812 argc, argv);
7813}
7814
7815/**
7816 * List printer-drivers on a remote RPC server.
7817 *
7818 * @param c A net_context structure.
7819 * @param argc Standard main() style argc.
7820 * @param argv Standard main() style argv. Initial components are already
7821 * stripped.
7822 *
7823 * @return A shell status integer (0 for success).
7824 **/
7825static int rpc_printer_driver_list(struct net_context *c, int argc,
7826 const char **argv)
7827{
7828 if (c->display_usage) {
7829 d_printf( "%s\n"
7830 "net rpc printer driver\n"
7831 " %s\n",
7832 _("Usage:"),
7833 _("List printer-drivers on a remote RPC server"));
7834 return 0;
7835 }
7836
7837 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7838 rpc_printer_driver_list_internals,
7839 argc, argv);
7840}
7841
7842/**
7843 * Publish printer in ADS via MSRPC.
7844 *
7845 * @param c A net_context structure.
7846 * @param argc Standard main() style argc.
7847 * @param argv Standard main() style argv. Initial components are already
7848 * stripped.
7849 *
7850 * @return A shell status integer (0 for success).
7851 **/
7852static int rpc_printer_publish_publish(struct net_context *c, int argc,
7853 const char **argv)
7854{
7855 if (c->display_usage) {
7856 d_printf( "%s\n"
7857 "net rpc printer publish publish\n"
7858 " %s\n",
7859 _("Usage:"),
7860 _("Publish printer in ADS via MSRPC"));
7861 return 0;
7862 }
7863
7864 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7865 rpc_printer_publish_publish_internals,
7866 argc, argv);
7867}
7868
7869/**
7870 * Update printer in ADS via MSRPC.
7871 *
7872 * @param c A net_context structure.
7873 * @param argc Standard main() style argc.
7874 * @param argv Standard main() style argv. Initial components are already
7875 * stripped.
7876 *
7877 * @return A shell status integer (0 for success).
7878 **/
7879static int rpc_printer_publish_update(struct net_context *c, int argc, const char **argv)
7880{
7881 if (c->display_usage) {
7882 d_printf( "%s\n"
7883 "net rpc printer publish update\n"
7884 " %s\n",
7885 _("Usage:"),
7886 _("Update printer in ADS via MSRPC"));
7887 return 0;
7888 }
7889
7890 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7891 rpc_printer_publish_update_internals,
7892 argc, argv);
7893}
7894
7895/**
7896 * UnPublish printer in ADS via MSRPC.
7897 *
7898 * @param c A net_context structure.
7899 * @param argc Standard main() style argc.
7900 * @param argv Standard main() style argv. Initial components are already
7901 * stripped.
7902 *
7903 * @return A shell status integer (0 for success).
7904 **/
7905static int rpc_printer_publish_unpublish(struct net_context *c, int argc,
7906 const char **argv)
7907{
7908 if (c->display_usage) {
7909 d_printf( "%s\n"
7910 "net rpc printer publish unpublish\n"
7911 " %s\n",
7912 _("Usage:\n"),
7913 _("UnPublish printer in ADS via MSRPC"));
7914 return 0;
7915 }
7916
7917 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7918 rpc_printer_publish_unpublish_internals,
7919 argc, argv);
7920}
7921
7922/**
7923 * List published printers via MSRPC.
7924 *
7925 * @param c A net_context structure.
7926 * @param argc Standard main() style argc.
7927 * @param argv Standard main() style argv. Initial components are already
7928 * stripped.
7929 *
7930 * @return A shell status integer (0 for success).
7931 **/
7932static int rpc_printer_publish_list(struct net_context *c, int argc,
7933 const char **argv)
7934{
7935 if (c->display_usage) {
7936 d_printf( "%s\n"
7937 "net rpc printer publish list\n"
7938 " %s\n",
7939 _("Usage:"),
7940 _("List published printers via MSRPC"));
7941 return 0;
7942 }
7943
7944 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7945 rpc_printer_publish_list_internals,
7946 argc, argv);
7947}
7948
7949
7950/**
7951 * Publish printer in ADS.
7952 *
7953 * @param c A net_context structure.
7954 * @param argc Standard main() style argc.
7955 * @param argv Standard main() style argv. Initial components are already
7956 * stripped.
7957 *
7958 * @return A shell status integer (0 for success).
7959 **/
7960static int rpc_printer_publish(struct net_context *c, int argc,
7961 const char **argv)
7962{
7963
7964 struct functable func[] = {
7965 {
7966 "publish",
7967 rpc_printer_publish_publish,
7968 NET_TRANSPORT_RPC,
7969 N_("Publish printer in AD"),
7970 N_("net rpc printer publish publish\n"
7971 " Publish printer in AD")
7972 },
7973 {
7974 "update",
7975 rpc_printer_publish_update,
7976 NET_TRANSPORT_RPC,
7977 N_("Update printer in AD"),
7978 N_("net rpc printer publish update\n"
7979 " Update printer in AD")
7980 },
7981 {
7982 "unpublish",
7983 rpc_printer_publish_unpublish,
7984 NET_TRANSPORT_RPC,
7985 N_("Unpublish printer"),
7986 N_("net rpc printer publish unpublish\n"
7987 " Unpublish printer")
7988 },
7989 {
7990 "list",
7991 rpc_printer_publish_list,
7992 NET_TRANSPORT_RPC,
7993 N_("List published printers"),
7994 N_("net rpc printer publish list\n"
7995 " List published printers")
7996 },
7997 {NULL, NULL, 0, NULL, NULL}
7998 };
7999
8000 if (argc == 0) {
8001 if (c->display_usage) {
8002 d_printf(_("Usage:\n"));
8003 d_printf(_("net rpc printer publish\n"
8004 " List published printers\n"
8005 " Alias of net rpc printer publish "
8006 "list\n"));
8007 net_display_usage_from_functable(func);
8008 return 0;
8009 }
8010 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
8011 rpc_printer_publish_list_internals,
8012 argc, argv);
8013 }
8014
8015 return net_run_function(c, argc, argv, "net rpc printer publish",func);
8016
8017}
8018
8019
8020/**
8021 * Display rpc printer help page.
8022 *
8023 * @param c A net_context structure.
8024 * @param argc Standard main() style argc.
8025 * @param argv Standard main() style argv. Initial components are already
8026 * stripped.
8027 **/
8028int rpc_printer_usage(struct net_context *c, int argc, const char **argv)
8029{
8030 d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
8031 "\tlists all printers on print-server\n\n"));
8032 d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
8033 "\tlists all printer-drivers on print-server\n\n"));
8034 d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
8035 "\tpublishes printer settings in Active Directory\n"
8036 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
8037 d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
8038 "\n\tmigrates printers from remote to local server\n\n"));
8039 d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
8040 "\n\tmigrates printer-settings from remote to local server\n\n"));
8041 d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
8042 "\n\tmigrates printer-drivers from remote to local server\n\n"));
8043 d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
8044 "\n\tmigrates printer-forms from remote to local server\n\n"));
8045 d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
8046 "\n\tmigrates printer-ACLs from remote to local server\n\n"));
8047 d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
8048 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
8049 "\tremote to local print-server\n\n"));
8050 net_common_methods_usage(c, argc, argv);
8051 net_common_flags_usage(c, argc, argv);
8052 d_printf(_(
8053 "\t-v or --verbose\t\t\tgive verbose output\n"
8054 "\t --destination\t\tmigration target server (default: localhost)\n"));
8055
8056 return -1;
8057}
8058
8059/**
8060 * 'net rpc printer' entrypoint.
8061 *
8062 * @param c A net_context structure.
8063 * @param argc Standard main() style argc.
8064 * @param argv Standard main() style argv. Initial components are already
8065 * stripped.
8066 **/
8067int net_rpc_printer(struct net_context *c, int argc, const char **argv)
8068{
8069 struct functable func[] = {
8070 {
8071 "list",
8072 rpc_printer_list,
8073 NET_TRANSPORT_RPC,
8074 N_("List all printers on print server"),
8075 N_("net rpc printer list\n"
8076 " List all printers on print server")
8077 },
8078 {
8079 "migrate",
8080 rpc_printer_migrate,
8081 NET_TRANSPORT_RPC,
8082 N_("Migrate printer to local server"),
8083 N_("net rpc printer migrate\n"
8084 " Migrate printer to local server")
8085 },
8086 {
8087 "driver",
8088 rpc_printer_driver_list,
8089 NET_TRANSPORT_RPC,
8090 N_("List printer drivers"),
8091 N_("net rpc printer driver\n"
8092 " List printer drivers")
8093 },
8094 {
8095 "publish",
8096 rpc_printer_publish,
8097 NET_TRANSPORT_RPC,
8098 N_("Publish printer in AD"),
8099 N_("net rpc printer publish\n"
8100 " Publish printer in AD")
8101 },
8102 {NULL, NULL, 0, NULL, NULL}
8103 };
8104
8105 if (argc == 0) {
8106 if (c->display_usage) {
8107 d_printf(_("Usage:\n"));
8108 d_printf(_("net rpc printer\n"
8109 " List printers\n"));
8110 net_display_usage_from_functable(func);
8111 return 0;
8112 }
8113 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
8114 rpc_printer_list_internals,
8115 argc, argv);
8116 }
8117
8118 return net_run_function(c, argc, argv, "net rpc printer", func);
8119}
8120
8121/**
8122 * 'net rpc' entrypoint.
8123 *
8124 * @param c A net_context structure.
8125 * @param argc Standard main() style argc.
8126 * @param argv Standard main() style argv. Initial components are already
8127 * stripped.
8128 **/
8129
8130int net_rpc(struct net_context *c, int argc, const char **argv)
8131{
8132 NET_API_STATUS status;
8133
8134 struct functable func[] = {
8135 {
8136 "audit",
8137 net_rpc_audit,
8138 NET_TRANSPORT_RPC,
8139 N_("Modify global audit settings"),
8140 N_("net rpc audit\n"
8141 " Modify global audit settings")
8142 },
8143 {
8144 "info",
8145 net_rpc_info,
8146 NET_TRANSPORT_RPC,
8147 N_("Show basic info about a domain"),
8148 N_("net rpc info\n"
8149 " Show basic info about a domain")
8150 },
8151 {
8152 "join",
8153 net_rpc_join,
8154 NET_TRANSPORT_RPC,
8155 N_("Join a domain"),
8156 N_("net rpc join\n"
8157 " Join a domain")
8158 },
8159 {
8160 "oldjoin",
8161 net_rpc_oldjoin,
8162 NET_TRANSPORT_RPC,
8163 N_("Join a domain created in server manager"),
8164 N_("net rpc oldjoin\n"
8165 " Join a domain created in server manager")
8166 },
8167 {
8168 "testjoin",
8169 net_rpc_testjoin,
8170 NET_TRANSPORT_RPC,
8171 N_("Test that a join is valid"),
8172 N_("net rpc testjoin\n"
8173 " Test that a join is valid")
8174 },
8175 {
8176 "user",
8177 net_rpc_user,
8178 NET_TRANSPORT_RPC,
8179 N_("List/modify users"),
8180 N_("net rpc user\n"
8181 " List/modify users")
8182 },
8183 {
8184 "password",
8185 rpc_user_password,
8186 NET_TRANSPORT_RPC,
8187 N_("Change a user password"),
8188 N_("net rpc password\n"
8189 " Change a user password\n"
8190 " Alias for net rpc user password")
8191 },
8192 {
8193 "group",
8194 net_rpc_group,
8195 NET_TRANSPORT_RPC,
8196 N_("List/modify groups"),
8197 N_("net rpc group\n"
8198 " List/modify groups")
8199 },
8200 {
8201 "share",
8202 net_rpc_share,
8203 NET_TRANSPORT_RPC,
8204 N_("List/modify shares"),
8205 N_("net rpc share\n"
8206 " List/modify shares")
8207 },
8208 {
8209 "file",
8210 net_rpc_file,
8211 NET_TRANSPORT_RPC,
8212 N_("List open files"),
8213 N_("net rpc file\n"
8214 " List open files")
8215 },
8216 {
8217 "printer",
8218 net_rpc_printer,
8219 NET_TRANSPORT_RPC,
8220 N_("List/modify printers"),
8221 N_("net rpc printer\n"
8222 " List/modify printers")
8223 },
8224 {
8225 "changetrustpw",
8226 net_rpc_changetrustpw,
8227 NET_TRANSPORT_RPC,
8228 N_("Change trust account password"),
8229 N_("net rpc changetrustpw\n"
8230 " Change trust account password")
8231 },
8232 {
8233 "trustdom",
8234 rpc_trustdom,
8235 NET_TRANSPORT_RPC,
8236 N_("Modify domain trusts"),
8237 N_("net rpc trustdom\n"
8238 " Modify domain trusts")
8239 },
8240 {
8241 "abortshutdown",
8242 rpc_shutdown_abort,
8243 NET_TRANSPORT_RPC,
8244 N_("Abort a remote shutdown"),
8245 N_("net rpc abortshutdown\n"
8246 " Abort a remote shutdown")
8247 },
8248 {
8249 "shutdown",
8250 rpc_shutdown,
8251 NET_TRANSPORT_RPC,
8252 N_("Shutdown a remote server"),
8253 N_("net rpc shutdown\n"
8254 " Shutdown a remote server")
8255 },
8256 {
8257 "samdump",
8258 rpc_samdump,
8259 NET_TRANSPORT_RPC,
8260 N_("Dump SAM data of remote NT PDC"),
8261 N_("net rpc samdump\n"
8262 " Dump SAM data of remote NT PDC")
8263 },
8264 {
8265 "vampire",
8266 rpc_vampire,
8267 NET_TRANSPORT_RPC,
8268 N_("Sync a remote NT PDC's data into local passdb"),
8269 N_("net rpc vampire\n"
8270 " Sync a remote NT PDC's data into local passdb")
8271 },
8272 {
8273 "getsid",
8274 net_rpc_getsid,
8275 NET_TRANSPORT_RPC,
8276 N_("Fetch the domain sid into local secrets.tdb"),
8277 N_("net rpc getsid\n"
8278 " Fetch the domain sid into local secrets.tdb")
8279 },
8280 {
8281 "rights",
8282 net_rpc_rights,
8283 NET_TRANSPORT_RPC,
8284 N_("Manage privileges assigned to SID"),
8285 N_("net rpc rights\n"
8286 " Manage privileges assigned to SID")
8287 },
8288 {
8289 "service",
8290 net_rpc_service,
8291 NET_TRANSPORT_RPC,
8292 N_("Start/stop/query remote services"),
8293 N_("net rpc service\n"
8294 " Start/stop/query remote services")
8295 },
8296 {
8297 "registry",
8298 net_rpc_registry,
8299 NET_TRANSPORT_RPC,
8300 N_("Manage registry hives"),
8301 N_("net rpc registry\n"
8302 " Manage registry hives")
8303 },
8304 {
8305 "shell",
8306 net_rpc_shell,
8307 NET_TRANSPORT_RPC,
8308 N_("Open interactive shell on remote server"),
8309 N_("net rpc shell\n"
8310 " Open interactive shell on remote server")
8311 },
8312 {
8313 "trust",
8314 net_rpc_trust,
8315 NET_TRANSPORT_RPC,
8316 N_("Manage trusts"),
8317 N_("net rpc trust\n"
8318 " Manage trusts")
8319 },
8320 {
8321 "conf",
8322 net_rpc_conf,
8323 NET_TRANSPORT_RPC,
8324 N_("Configure a remote samba server"),
8325 N_("net rpc conf\n"
8326 " Configure a remote samba server")
8327 },
8328 {NULL, NULL, 0, NULL, NULL}
8329 };
8330
8331 status = libnetapi_net_init(&c->netapi_ctx);
8332 if (status != 0) {
8333 return -1;
8334 }
8335 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
8336 libnetapi_set_password(c->netapi_ctx, c->opt_password);
8337 if (c->opt_kerberos) {
8338 libnetapi_set_use_kerberos(c->netapi_ctx);
8339 }
8340 if (c->opt_ccache) {
8341 libnetapi_set_use_ccache(c->netapi_ctx);
8342 }
8343
8344 return net_run_function(c, argc, argv, "net rpc", func);
8345}
Note: See TracBrowser for help on using the repository browser.