?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Fix bug #9085.
[Samba.git] / source3 / utils / net_rpc.c
blob749b0c2f2a41133832be4fb08c6e4d658c441b46
1 /*
2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
22
23 #include "includes.h"
24 #include "utils/net.h"
25 #include "../libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/cli_samr.h"
27 #include "../librpc/gen_ndr/cli_lsa.h"
28 #include "../librpc/gen_ndr/cli_netlogon.h"
29 #include "../librpc/gen_ndr/cli_srvsvc.h"
30 #include "../librpc/gen_ndr/cli_spoolss.h"
31 #include "../librpc/gen_ndr/cli_initshutdown.h"
32 #include "../librpc/gen_ndr/cli_winreg.h"
33
34 static int net_mode_share;
35 static bool sync_files(struct copy_clistate *cp_clistate, const char *mask);
36
37 /**
38 * @file net_rpc.c
39 *
40 * @brief RPC based subcommands for the 'net' utility.
41 *
42 * This file should contain much of the functionality that used to
43 * be found in rpcclient, execpt that the commands should change
44 * less often, and the fucntionality should be sane (the user is not
45 * expected to know a rid/sid before they conduct an operation etc.)
46 *
47 * @todo Perhaps eventually these should be split out into a number
48 * of files, as this could get quite big.
49 **/
50
51
52 /**
53 * Many of the RPC functions need the domain sid. This function gets
54 * it at the start of every run
55 *
56 * @param cli A cli_state already connected to the remote machine
57 *
58 * @return The Domain SID of the remote machine.
59 **/
60
61 NTSTATUS net_get_remote_domain_sid(struct cli_state *cli, TALLOC_CTX *mem_ctx,
62 DOM_SID **domain_sid,
63 const char **domain_name)
64 {
65 struct rpc_pipe_client *lsa_pipe = NULL;
66 struct policy_handle pol;
67 NTSTATUS result = NT_STATUS_OK;
68 union lsa_PolicyInformation *info = NULL;
69
70 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
71 &lsa_pipe);
72 if (!NT_STATUS_IS_OK(result)) {
73 d_fprintf(stderr, _("Could not initialise lsa pipe\n"));
74 return result;
75 }
76
77 result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, false,
78 SEC_FLAG_MAXIMUM_ALLOWED,
79 &pol);
80 if (!NT_STATUS_IS_OK(result)) {
81 d_fprintf(stderr, "open_policy %s: %s\n",
82 _("failed"),
83 nt_errstr(result));
84 return result;
85 }
86
87 result = rpccli_lsa_QueryInfoPolicy(lsa_pipe, mem_ctx,
88 &pol,
89 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
90 &info);
91 if (!NT_STATUS_IS_OK(result)) {
92 d_fprintf(stderr, "lsaquery %s: %s\n",
93 _("failed"),
94 nt_errstr(result));
95 return result;
96 }
97
98 *domain_name = info->account_domain.name.string;
99 *domain_sid = info->account_domain.sid;
100
101 rpccli_lsa_Close(lsa_pipe, mem_ctx, &pol);
102 TALLOC_FREE(lsa_pipe);
103
104 return NT_STATUS_OK;
105 }
106
107 /**
108 * Run a single RPC command, from start to finish.
109 *
110 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
111 * @param conn_flag a NET_FLAG_ combination. Passed to
112 * net_make_ipc_connection.
113 * @param argc Standard main() style argc.
114 * @param argv Standard main() style argv. Initial components are already
115 * stripped.
116 * @return A shell status integer (0 for success).
117 */
118
119 int run_rpc_command(struct net_context *c,
120 struct cli_state *cli_arg,
121 const struct ndr_syntax_id *interface,
122 int conn_flags,
123 rpc_command_fn fn,
124 int argc,
125 const char **argv)
126 {
127 struct cli_state *cli = NULL;
128 struct rpc_pipe_client *pipe_hnd = NULL;
129 TALLOC_CTX *mem_ctx;
130 NTSTATUS nt_status;
131 DOM_SID *domain_sid;
132 const char *domain_name;
133 int ret = -1;
134
135 /* make use of cli_state handed over as an argument, if possible */
136 if (!cli_arg) {
137 nt_status = net_make_ipc_connection(c, conn_flags, &cli);
138 if (!NT_STATUS_IS_OK(nt_status)) {
139 DEBUG(1, ("failed to make ipc connection: %s\n",
140 nt_errstr(nt_status)));
141 return -1;
142 }
143 } else {
144 cli = cli_arg;
145 }
146
147 if (!cli) {
148 return -1;
149 }
150
151 /* Create mem_ctx */
152
153 if (!(mem_ctx = talloc_init("run_rpc_command"))) {
154 DEBUG(0, ("talloc_init() failed\n"));
155 goto fail;
156 }
157
158 nt_status = net_get_remote_domain_sid(cli, mem_ctx, &domain_sid,
159 &domain_name);
160 if (!NT_STATUS_IS_OK(nt_status)) {
161 goto fail;
162 }
163
164 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
165 if (lp_client_schannel()
166 && (ndr_syntax_id_equal(interface,
167 &ndr_table_netlogon.syntax_id))) {
168 /* Always try and create an schannel netlogon pipe. */
169 nt_status = cli_rpc_pipe_open_schannel(
170 cli, interface, NCACN_NP,
171 DCERPC_AUTH_LEVEL_PRIVACY, domain_name,
172 &pipe_hnd);
173 if (!NT_STATUS_IS_OK(nt_status)) {
174 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
175 nt_errstr(nt_status) ));
176 goto fail;
177 }
178 } else {
179 if (conn_flags & NET_FLAGS_SEAL) {
180 nt_status = cli_rpc_pipe_open_ntlmssp(
181 cli, interface,
182 (conn_flags & NET_FLAGS_TCP) ?
183 NCACN_IP_TCP : NCACN_NP,
184 DCERPC_AUTH_LEVEL_PRIVACY,
185 lp_workgroup(), c->opt_user_name,
186 c->opt_password, &pipe_hnd);
187 } else {
188 nt_status = cli_rpc_pipe_open_noauth(
189 cli, interface,
190 &pipe_hnd);
191 }
192 if (!NT_STATUS_IS_OK(nt_status)) {
193 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
194 get_pipe_name_from_syntax(
195 talloc_tos(), interface),
196 nt_errstr(nt_status) ));
197 goto fail;
198 }
199 }
200 }
201
202 nt_status = fn(c, domain_sid, domain_name, cli, pipe_hnd, mem_ctx, argc, argv);
203
204 if (!NT_STATUS_IS_OK(nt_status)) {
205 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status)));
206 } else {
207 ret = 0;
208 DEBUG(5, ("rpc command function succedded\n"));
209 }
210
211 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
212 if (pipe_hnd) {
213 TALLOC_FREE(pipe_hnd);
214 }
215 }
216
217 fail:
218 /* close the connection only if it was opened here */
219 if (!cli_arg) {
220 cli_shutdown(cli);
221 }
222
223 talloc_destroy(mem_ctx);
224 return ret;
225 }
226
227 /**
228 * Force a change of the trust acccount password.
229 *
230 * All parameters are provided by the run_rpc_command function, except for
231 * argc, argv which are passed through.
232 *
233 * @param domain_sid The domain sid acquired from the remote server.
234 * @param cli A cli_state connected to the server.
235 * @param mem_ctx Talloc context, destroyed on completion of the function.
236 * @param argc Standard main() style argc.
237 * @param argv Standard main() style argv. Initial components are already
238 * stripped.
239 *
240 * @return Normal NTSTATUS return.
241 **/
242
243 static NTSTATUS rpc_changetrustpw_internals(struct net_context *c,
244 const DOM_SID *domain_sid,
245 const char *domain_name,
246 struct cli_state *cli,
247 struct rpc_pipe_client *pipe_hnd,
248 TALLOC_CTX *mem_ctx,
249 int argc,
250 const char **argv)
251 {
252 NTSTATUS status;
253
254 status = trust_pw_find_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup);
255 if (!NT_STATUS_IS_OK(status)) {
256 d_fprintf(stderr, _("Failed to change machine account password: %s\n"),
257 nt_errstr(status));
258 return status;
259 }
260
261 return NT_STATUS_OK;
262 }
263
264 /**
265 * Force a change of the trust acccount password.
266 *
267 * @param argc Standard main() style argc.
268 * @param argv Standard main() style argv. Initial components are already
269 * stripped.
270 *
271 * @return A shell status integer (0 for success).
272 **/
273
274 int net_rpc_changetrustpw(struct net_context *c, int argc, const char **argv)
275 {
276 if (c->display_usage) {
277 d_printf( "%s\n"
278 "net rpc changetrustpw\n"
279 " %s\n",
280 _("Usage:"),
281 _("Change the machine trust password"));
282 return 0;
283 }
284
285 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
286 NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
287 rpc_changetrustpw_internals,
288 argc, argv);
289 }
290
291 /**
292 * Join a domain, the old way.
293 *
294 * This uses 'machinename' as the inital password, and changes it.
295 *
296 * The password should be created with 'server manager' or equiv first.
297 *
298 * All parameters are provided by the run_rpc_command function, except for
299 * argc, argv which are passed through.
300 *
301 * @param domain_sid The domain sid acquired from the remote server.
302 * @param cli A cli_state connected to the server.
303 * @param mem_ctx Talloc context, destroyed on completion of the function.
304 * @param argc Standard main() style argc.
305 * @param argv Standard main() style argv. Initial components are already
306 * stripped.
307 *
308 * @return Normal NTSTATUS return.
309 **/
310
311 static NTSTATUS rpc_oldjoin_internals(struct net_context *c,
312 const DOM_SID *domain_sid,
313 const char *domain_name,
314 struct cli_state *cli,
315 struct rpc_pipe_client *pipe_hnd,
316 TALLOC_CTX *mem_ctx,
317 int argc,
318 const char **argv)
319 {
320
321 fstring trust_passwd;
322 unsigned char orig_trust_passwd_hash[16];
323 NTSTATUS result;
324 enum netr_SchannelType sec_channel_type;
325
326 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
327 &pipe_hnd);
328 if (!NT_STATUS_IS_OK(result)) {
329 DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
330 "error was %s\n",
331 cli->desthost,
332 nt_errstr(result) ));
333 return result;
334 }
335
336 /*
337 check what type of join - if the user want's to join as
338 a BDC, the server must agree that we are a BDC.
339 */
340 if (argc >= 0) {
341 sec_channel_type = get_sec_channel_type(argv[0]);
342 } else {
343 sec_channel_type = get_sec_channel_type(NULL);
344 }
345
346 fstrcpy(trust_passwd, global_myname());
347 strlower_m(trust_passwd);
348
349 /*
350 * Machine names can be 15 characters, but the max length on
351 * a password is 14. --jerry
352 */
353
354 trust_passwd[14] = '\0';
355
356 E_md4hash(trust_passwd, orig_trust_passwd_hash);
357
358 result = trust_pw_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup,
359 global_myname(),
360 orig_trust_passwd_hash,
361 sec_channel_type);
362
363 if (NT_STATUS_IS_OK(result))
364 printf(_("Joined domain %s.\n"), c->opt_target_workgroup);
365
366
367 if (!secrets_store_domain_sid(c->opt_target_workgroup, domain_sid)) {
368 DEBUG(0, ("error storing domain sid for %s\n", c->opt_target_workgroup));
369 result = NT_STATUS_UNSUCCESSFUL;
370 }
371
372 return result;
373 }
374
375 /**
376 * Join a domain, the old way.
377 *
378 * @param argc Standard main() style argc.
379 * @param argv Standard main() style argv. Initial components are already
380 * stripped.
381 *
382 * @return A shell status integer (0 for success).
383 **/
384
385 static int net_rpc_perform_oldjoin(struct net_context *c, int argc, const char **argv)
386 {
387 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
388 NET_FLAGS_NO_PIPE | NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
389 rpc_oldjoin_internals,
390 argc, argv);
391 }
392
393 /**
394 * Join a domain, the old way. This function exists to allow
395 * the message to be displayed when oldjoin was explicitly
396 * requested, but not when it was implied by "net rpc join".
397 *
398 * @param argc Standard main() style argc.
399 * @param argv Standard main() style argv. Initial components are already
400 * stripped.
401 *
402 * @return A shell status integer (0 for success).
403 **/
404
405 static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)
406 {
407 int rc = -1;
408
409 if (c->display_usage) {
410 d_printf( "%s\n"
411 "net rpc oldjoin\n"
412 " %s\n",
413 _("Usage:"),
414 _("Join a domain the old way"));
415 return 0;
416 }
417
418 rc = net_rpc_perform_oldjoin(c, argc, argv);
419
420 if (rc) {
421 d_fprintf(stderr, _("Failed to join domain\n"));
422 }
423
424 return rc;
425 }
426
427 /**
428 * 'net rpc join' entrypoint.
429 * @param argc Standard main() style argc.
430 * @param argv Standard main() style argv. Initial components are already
431 * stripped
432 *
433 * Main 'net_rpc_join()' (where the admin username/password is used) is
434 * in net_rpc_join.c.
435 * Try to just change the password, but if that doesn't work, use/prompt
436 * for a username/password.
437 **/
438
439 int net_rpc_join(struct net_context *c, int argc, const char **argv)
440 {
441 if (c->display_usage) {
442 d_printf("%s\n%s",
443 _("Usage:"),
444 _("net rpc join -U <username>[%%password] <type>\n"
445 " Join a domain\n"
446 " username\tName of the admin user"
447 " password\tPassword of the admin user, will "
448 "prompt if not specified\n"
449 " type\tCan be one of the following:\n"
450 "\t\tMEMBER\tJoin as member server (default)\n"
451 "\t\tBDC\tJoin as BDC\n"
452 "\t\tPDC\tJoin as PDC\n"));
453 return 0;
454 }
455
456 if (lp_server_role() == ROLE_STANDALONE) {
457 d_printf(_("cannot join as standalone machine\n"));
458 return -1;
459 }
460
461 if (strlen(global_myname()) > 15) {
462 d_printf(_("Our netbios name can be at most 15 chars long, "
463 "\"%s\" is %u chars long\n"),
464 global_myname(), (unsigned int)strlen(global_myname()));
465 return -1;
466 }
467
468 if ((net_rpc_perform_oldjoin(c, argc, argv) == 0))
469 return 0;
470
471 return net_rpc_join_newstyle(c, argc, argv);
472 }
473
474 /**
475 * display info about a rpc domain
476 *
477 * All parameters are provided by the run_rpc_command function, except for
478 * argc, argv which are passed through.
479 *
480 * @param domain_sid The domain sid acquired from the remote server
481 * @param cli A cli_state connected to the server.
482 * @param mem_ctx Talloc context, destroyed on completion of the function.
483 * @param argc Standard main() style argc.
484 * @param argv Standard main() style argv. Initial components are already
485 * stripped.
486 *
487 * @return Normal NTSTATUS return.
488 **/
489
490 NTSTATUS rpc_info_internals(struct net_context *c,
491 const DOM_SID *domain_sid,
492 const char *domain_name,
493 struct cli_state *cli,
494 struct rpc_pipe_client *pipe_hnd,
495 TALLOC_CTX *mem_ctx,
496 int argc,
497 const char **argv)
498 {
499 struct policy_handle connect_pol, domain_pol;
500 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
501 union samr_DomainInfo *info = NULL;
502 fstring sid_str;
503
504 sid_to_fstring(sid_str, domain_sid);
505
506 /* Get sam policy handle */
507 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
508 pipe_hnd->desthost,
509 MAXIMUM_ALLOWED_ACCESS,
510 &connect_pol);
511 if (!NT_STATUS_IS_OK(result)) {
512 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
513 nt_errstr(result));
514 goto done;
515 }
516
517 /* Get domain policy handle */
518 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
519 &connect_pol,
520 MAXIMUM_ALLOWED_ACCESS,
521 CONST_DISCARD(struct dom_sid2 *, domain_sid),
522 &domain_pol);
523 if (!NT_STATUS_IS_OK(result)) {
524 d_fprintf(stderr, _("Could not open domain: %s\n"),
525 nt_errstr(result));
526 goto done;
527 }
528
529 result = rpccli_samr_QueryDomainInfo(pipe_hnd, mem_ctx,
530 &domain_pol,
531 2,
532 &info);
533 if (NT_STATUS_IS_OK(result)) {
534 d_printf(_("Domain Name: %s\n"),
535 info->general.domain_name.string);
536 d_printf(_("Domain SID: %s\n"), sid_str);
537 d_printf(_("Sequence number: %llu\n"),
538 (unsigned long long)info->general.sequence_num);
539 d_printf(_("Num users: %u\n"), info->general.num_users);
540 d_printf(_("Num domain groups: %u\n"),info->general.num_groups);
541 d_printf(_("Num local groups: %u\n"),info->general.num_aliases);
542 }
543
544 done:
545 return result;
546 }
547
548 /**
549 * 'net rpc info' entrypoint.
550 * @param argc Standard main() style argc.
551 * @param argv Standard main() style argv. Initial components are already
552 * stripped.
553 **/
554
555 int net_rpc_info(struct net_context *c, int argc, const char **argv)
556 {
557 if (c->display_usage) {
558 d_printf( "%s\n"
559 "net rpc info\n"
560 " %s\n",
561 _("Usage:"),
562 _("Display information about the domain"));
563 return 0;
564 }
565
566 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id,
567 NET_FLAGS_PDC, rpc_info_internals,
568 argc, argv);
569 }
570
571 /**
572 * Fetch domain SID into the local secrets.tdb.
573 *
574 * All parameters are provided by the run_rpc_command function, except for
575 * argc, argv which are passed through.
576 *
577 * @param domain_sid The domain sid acquired from the remote server.
578 * @param cli A cli_state connected to the server.
579 * @param mem_ctx Talloc context, destroyed on completion of the function.
580 * @param argc Standard main() style argc.
581 * @param argv Standard main() style argv. Initial components are already
582 * stripped.
583 *
584 * @return Normal NTSTATUS return.
585 **/
586
587 static NTSTATUS rpc_getsid_internals(struct net_context *c,
588 const DOM_SID *domain_sid,
589 const char *domain_name,
590 struct cli_state *cli,
591 struct rpc_pipe_client *pipe_hnd,
592 TALLOC_CTX *mem_ctx,
593 int argc,
594 const char **argv)
595 {
596 fstring sid_str;
597
598 sid_to_fstring(sid_str, domain_sid);
599 d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
600 sid_str, domain_name);
601
602 if (!secrets_store_domain_sid(domain_name, domain_sid)) {
603 DEBUG(0,("Can't store domain SID\n"));
604 return NT_STATUS_UNSUCCESSFUL;
605 }
606
607 return NT_STATUS_OK;
608 }
609
610 /**
611 * 'net rpc getsid' entrypoint.
612 * @param argc Standard main() style argc.
613 * @param argv Standard main() style argv. Initial components are already
614 * stripped.
615 **/
616
617 int net_rpc_getsid(struct net_context *c, int argc, const char **argv)
618 {
619 int conn_flags = NET_FLAGS_PDC;
620
621 if (!c->opt_user_specified) {
622 conn_flags |= NET_FLAGS_ANONYMOUS;
623 }
624
625 if (c->display_usage) {
626 d_printf( "%s\n"
627 "net rpc getsid\n"
628 " %s\n",
629 _("Usage:"),
630 _("Fetch domain SID into local secrets.tdb"));
631 return 0;
632 }
633
634 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id,
635 conn_flags,
636 rpc_getsid_internals,
637 argc, argv);
638 }
639
640 /****************************************************************************/
641
642 /**
643 * Basic usage function for 'net rpc user'.
644 * @param argc Standard main() style argc.
645 * @param argv Standard main() style argv. Initial components are already
646 * stripped.
647 **/
648
649 static int rpc_user_usage(struct net_context *c, int argc, const char **argv)
650 {
651 return net_user_usage(c, argc, argv);
652 }
653
654 /**
655 * Add a new user to a remote RPC server.
656 *
657 * @param argc Standard main() style argc.
658 * @param argv Standard main() style argv. Initial components are already
659 * stripped.
660 *
661 * @return A shell status integer (0 for success).
662 **/
663
664 static int rpc_user_add(struct net_context *c, int argc, const char **argv)
665 {
666 NET_API_STATUS status;
667 struct USER_INFO_1 info1;
668 uint32_t parm_error = 0;
669
670 if (argc < 1 || c->display_usage) {
671 rpc_user_usage(c, argc, argv);
672 return 0;
673 }
674
675 ZERO_STRUCT(info1);
676
677 info1.usri1_name = argv[0];
678 if (argc == 2) {
679 info1.usri1_password = argv[1];
680 }
681
682 status = NetUserAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
683
684 if (status != 0) {
685 d_fprintf(stderr,_("Failed to add user '%s' with error: %s.\n"),
686 argv[0], libnetapi_get_error_string(c->netapi_ctx,
687 status));
688 return -1;
689 } else {
690 d_printf(_("Added user '%s'.\n"), argv[0]);
691 }
692
693 return 0;
694 }
695
696 /**
697 * Rename a user on a remote RPC server.
698 *
699 * @param argc Standard main() style argc.
700 * @param argv Standard main() style argv. Initial components are already
701 * stripped.
702 *
703 * @return A shell status integer (0 for success).
704 **/
705
706 static int rpc_user_rename(struct net_context *c, int argc, const char **argv)
707 {
708 NET_API_STATUS status;
709 struct USER_INFO_0 u0;
710 uint32_t parm_err = 0;
711
712 if (argc != 2 || c->display_usage) {
713 rpc_user_usage(c, argc, argv);
714 return 0;
715 }
716
717 u0.usri0_name = argv[1];
718
719 status = NetUserSetInfo(c->opt_host, argv[0],
720 0, (uint8_t *)&u0, &parm_err);
721 if (status) {
722 d_fprintf(stderr,
723 _("Failed to rename user from %s to %s - %s\n"),
724 argv[0], argv[1],
725 libnetapi_get_error_string(c->netapi_ctx, status));
726 } else {
727 d_printf(_("Renamed user from %s to %s\n"), argv[0], argv[1]);
728 }
729
730 return status;
731 }
732
733 /**
734 * Delete a user from a remote RPC server.
735 *
736 * @param argc Standard main() style argc.
737 * @param argv Standard main() style argv. Initial components are already
738 * stripped.
739 *
740 * @return A shell status integer (0 for success).
741 **/
742
743 static int rpc_user_delete(struct net_context *c, int argc, const char **argv)
744 {
745 NET_API_STATUS status;
746
747 if (argc < 1 || c->display_usage) {
748 rpc_user_usage(c, argc, argv);
749 return 0;
750 }
751
752 status = NetUserDel(c->opt_host, argv[0]);
753
754 if (status != 0) {
755 d_fprintf(stderr, _("Failed to delete user '%s' with: %s.\n"),
756 argv[0],
757 libnetapi_get_error_string(c->netapi_ctx, status));
758 return -1;
759 } else {
760 d_printf(_("Deleted user '%s'.\n"), argv[0]);
761 }
762
763 return 0;
764 }
765
766 /**
767 * Set a user's password on a remote RPC server.
768 *
769 * @param argc Standard main() style argc.
770 * @param argv Standard main() style argv. Initial components are already
771 * stripped.
772 *
773 * @return A shell status integer (0 for success).
774 **/
775
776 static int rpc_user_password(struct net_context *c, int argc, const char **argv)
777 {
778 NET_API_STATUS status;
779 char *prompt = NULL;
780 struct USER_INFO_1003 u1003;
781 uint32_t parm_err = 0;
782 int ret;
783
784 if (argc < 1 || c->display_usage) {
785 rpc_user_usage(c, argc, argv);
786 return 0;
787 }
788
789 if (argv[1]) {
790 u1003.usri1003_password = argv[1];
791 } else {
792 ret = asprintf(&prompt, _("Enter new password for %s:"),
793 argv[0]);
794 if (ret == -1) {
795 return -1;
796 }
797 u1003.usri1003_password = talloc_strdup(c, getpass(prompt));
798 SAFE_FREE(prompt);
799 if (u1003.usri1003_password == NULL) {
800 return -1;
801 }
802 }
803
804 status = NetUserSetInfo(c->opt_host, argv[0], 1003, (uint8_t *)&u1003, &parm_err);
805
806 /* Display results */
807 if (status != 0) {
808 d_fprintf(stderr,
809 _("Failed to set password for '%s' with error: %s.\n"),
810 argv[0], libnetapi_get_error_string(c->netapi_ctx,
811 status));
812 return -1;
813 }
814
815 return 0;
816 }
817
818 /**
819 * List a user's groups from a remote RPC server.
820 *
821 * @param argc Standard main() style argc.
822 * @param argv Standard main() style argv. Initial components are already
823 * stripped.
824 *
825 * @return A shell status integer (0 for success)
826 **/
827
828 static int rpc_user_info(struct net_context *c, int argc, const char **argv)
829
830 {
831 NET_API_STATUS status;
832 struct GROUP_USERS_INFO_0 *u0 = NULL;
833 uint32_t entries_read = 0;
834 uint32_t total_entries = 0;
835 int i;
836
837
838 if (argc < 1 || c->display_usage) {
839 rpc_user_usage(c, argc, argv);
840 return 0;
841 }
842
843 status = NetUserGetGroups(c->opt_host,
844 argv[0],
845 0,
846 (uint8_t **)(void *)&u0,
847 (uint32_t)-1,
848 &entries_read,
849 &total_entries);
850 if (status != 0) {
851 d_fprintf(stderr,
852 _("Failed to get groups for '%s' with error: %s.\n"),
853 argv[0], libnetapi_get_error_string(c->netapi_ctx,
854 status));
855 return -1;
856 }
857
858 for (i=0; i < entries_read; i++) {
859 printf("%s\n", u0->grui0_name);
860 u0++;
861 }
862
863 return 0;
864 }
865
866 /**
867 * List users on a remote RPC server.
868 *
869 * All parameters are provided by the run_rpc_command function, except for
870 * argc, argv which are passed through.
871 *
872 * @param domain_sid The domain sid acquired from the remote server.
873 * @param cli A cli_state connected to the server.
874 * @param mem_ctx Talloc context, destroyed on completion of the function.
875 * @param argc Standard main() style argc.
876 * @param argv Standard main() style argv. Initial components are already
877 * stripped.
878 *
879 * @return Normal NTSTATUS return.
880 **/
881
882 static int rpc_user_list(struct net_context *c, int argc, const char **argv)
883 {
884 NET_API_STATUS status;
885 uint32_t start_idx=0, num_entries, i, loop_count = 0;
886 struct NET_DISPLAY_USER *info = NULL;
887 void *buffer = NULL;
888
889 /* Query domain users */
890 if (c->opt_long_list_entries)
891 d_printf(_("\nUser name Comment"
892 "\n-----------------------------\n"));
893 do {
894 uint32_t max_entries, max_size;
895
896 get_query_dispinfo_params(
897 loop_count, &max_entries, &max_size);
898
899 status = NetQueryDisplayInformation(c->opt_host,
900 1,
901 start_idx,
902 max_entries,
903 max_size,
904 &num_entries,
905 &buffer);
906 if (status != 0 && status != ERROR_MORE_DATA) {
907 return status;
908 }
909
910 info = (struct NET_DISPLAY_USER *)buffer;
911
912 for (i = 0; i < num_entries; i++) {
913
914 if (c->opt_long_list_entries)
915 printf("%-21.21s %s\n", info->usri1_name,
916 info->usri1_comment);
917 else
918 printf("%s\n", info->usri1_name);
919 info++;
920 }
921
922 NetApiBufferFree(buffer);
923
924 loop_count++;
925 start_idx += num_entries;
926
927 } while (status == ERROR_MORE_DATA);
928
929 return status;
930 }
931
932 /**
933 * 'net rpc user' entrypoint.
934 * @param argc Standard main() style argc.
935 * @param argv Standard main() style argv. Initial components are already
936 * stripped.
937 **/
938
939 int net_rpc_user(struct net_context *c, int argc, const char **argv)
940 {
941 NET_API_STATUS status;
942
943 struct functable func[] = {
944 {
945 "add",
946 rpc_user_add,
947 NET_TRANSPORT_RPC,
948 N_("Add specified user"),
949 N_("net rpc user add\n"
950 " Add specified user")
951 },
952 {
953 "info",
954 rpc_user_info,
955 NET_TRANSPORT_RPC,
956 N_("List domain groups of user"),
957 N_("net rpc user info\n"
958 " Lis domain groups of user")
959 },
960 {
961 "delete",
962 rpc_user_delete,
963 NET_TRANSPORT_RPC,
964 N_("Remove specified user"),
965 N_("net rpc user delete\n"
966 " Remove specified user")
967 },
968 {
969 "password",
970 rpc_user_password,
971 NET_TRANSPORT_RPC,
972 N_("Change user password"),
973 N_("net rpc user password\n"
974 " Change user password")
975 },
976 {
977 "rename",
978 rpc_user_rename,
979 NET_TRANSPORT_RPC,
980 N_("Rename specified user"),
981 N_("net rpc user rename\n"
982 " Rename specified user")
983 },
984 {NULL, NULL, 0, NULL, NULL}
985 };
986
987 status = libnetapi_init(&c->netapi_ctx);
988 if (status != 0) {
989 return -1;
990 }
991 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
992 libnetapi_set_password(c->netapi_ctx, c->opt_password);
993 if (c->opt_kerberos) {
994 libnetapi_set_use_kerberos(c->netapi_ctx);
995 }
996
997 if (argc == 0) {
998 if (c->display_usage) {
999 d_printf( "%s\n"
1000 "net rpc user\n"
1001 " %s\n",
1002 _("Usage:"),
1003 _("List all users"));
1004 net_display_usage_from_functable(func);
1005 return 0;
1006 }
1007
1008 return rpc_user_list(c, argc, argv);
1009 }
1010
1011 return net_run_function(c, argc, argv, "net rpc user", func);
1012 }
1013
1014 static NTSTATUS rpc_sh_user_list(struct net_context *c,
1015 TALLOC_CTX *mem_ctx,
1016 struct rpc_sh_ctx *ctx,
1017 struct rpc_pipe_client *pipe_hnd,
1018 int argc, const char **argv)
1019 {
1020 return werror_to_ntstatus(W_ERROR(rpc_user_list(c, argc, argv)));
1021 }
1022
1023 static NTSTATUS rpc_sh_user_info(struct net_context *c,
1024 TALLOC_CTX *mem_ctx,
1025 struct rpc_sh_ctx *ctx,
1026 struct rpc_pipe_client *pipe_hnd,
1027 int argc, const char **argv)
1028 {
1029 return werror_to_ntstatus(W_ERROR(rpc_user_info(c, argc, argv)));
1030 }
1031
1032 static NTSTATUS rpc_sh_handle_user(struct net_context *c,
1033 TALLOC_CTX *mem_ctx,
1034 struct rpc_sh_ctx *ctx,
1035 struct rpc_pipe_client *pipe_hnd,
1036 int argc, const char **argv,
1037 NTSTATUS (*fn)(
1038 struct net_context *c,
1039 TALLOC_CTX *mem_ctx,
1040 struct rpc_sh_ctx *ctx,
1041 struct rpc_pipe_client *pipe_hnd,
1042 struct policy_handle *user_hnd,
1043 int argc, const char **argv))
1044 {
1045 struct policy_handle connect_pol, domain_pol, user_pol;
1046 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1047 DOM_SID sid;
1048 uint32 rid;
1049 enum lsa_SidType type;
1050
1051 if (argc == 0) {
1052 d_fprintf(stderr, "%s %s <username>\n", _("Usage:"),
1053 ctx->whoami);
1054 return NT_STATUS_INVALID_PARAMETER;
1055 }
1056
1057 ZERO_STRUCT(connect_pol);
1058 ZERO_STRUCT(domain_pol);
1059 ZERO_STRUCT(user_pol);
1060
1061 result = net_rpc_lookup_name(c, mem_ctx, rpc_pipe_np_smb_conn(pipe_hnd),
1062 argv[0], NULL, NULL, &sid, &type);
1063 if (!NT_STATUS_IS_OK(result)) {
1064 d_fprintf(stderr, _("Could not lookup %s: %s\n"), argv[0],
1065 nt_errstr(result));
1066 goto done;
1067 }
1068
1069 if (type != SID_NAME_USER) {
1070 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
1071 sid_type_lookup(type));
1072 result = NT_STATUS_NO_SUCH_USER;
1073 goto done;
1074 }
1075
1076 if (!sid_peek_check_rid(ctx->domain_sid, &sid, &rid)) {
1077 d_fprintf(stderr, _("%s is not in our domain\n"), argv[0]);
1078 result = NT_STATUS_NO_SUCH_USER;
1079 goto done;
1080 }
1081
1082 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1083 pipe_hnd->desthost,
1084 MAXIMUM_ALLOWED_ACCESS,
1085 &connect_pol);
1086 if (!NT_STATUS_IS_OK(result)) {
1087 goto done;
1088 }
1089
1090 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1091 &connect_pol,
1092 MAXIMUM_ALLOWED_ACCESS,
1093 ctx->domain_sid,
1094 &domain_pol);
1095 if (!NT_STATUS_IS_OK(result)) {
1096 goto done;
1097 }
1098
1099 result = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1100 &domain_pol,
1101 MAXIMUM_ALLOWED_ACCESS,
1102 rid,
1103 &user_pol);
1104 if (!NT_STATUS_IS_OK(result)) {
1105 goto done;
1106 }
1107
1108 result = fn(c, mem_ctx, ctx, pipe_hnd, &user_pol, argc-1, argv+1);
1109
1110 done:
1111 if (is_valid_policy_hnd(&user_pol)) {
1112 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1113 }
1114 if (is_valid_policy_hnd(&domain_pol)) {
1115 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1116 }
1117 if (is_valid_policy_hnd(&connect_pol)) {
1118 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
1119 }
1120 return result;
1121 }
1122
1123 static NTSTATUS rpc_sh_user_show_internals(struct net_context *c,
1124 TALLOC_CTX *mem_ctx,
1125 struct rpc_sh_ctx *ctx,
1126 struct rpc_pipe_client *pipe_hnd,
1127 struct policy_handle *user_hnd,
1128 int argc, const char **argv)
1129 {
1130 NTSTATUS result;
1131 union samr_UserInfo *info = NULL;
1132
1133 if (argc != 0) {
1134 d_fprintf(stderr, "%s %s show <username>\n", _("Usage:"),
1135 ctx->whoami);
1136 return NT_STATUS_INVALID_PARAMETER;
1137 }
1138
1139 result = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1140 user_hnd,
1141 21,
1142 &info);
1143 if (!NT_STATUS_IS_OK(result)) {
1144 return result;
1145 }
1146
1147 d_printf(_("user rid: %d, group rid: %d\n"),
1148 info->info21.rid,
1149 info->info21.primary_gid);
1150
1151 return result;
1152 }
1153
1154 static NTSTATUS rpc_sh_user_show(struct net_context *c,
1155 TALLOC_CTX *mem_ctx,
1156 struct rpc_sh_ctx *ctx,
1157 struct rpc_pipe_client *pipe_hnd,
1158 int argc, const char **argv)
1159 {
1160 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1161 rpc_sh_user_show_internals);
1162 }
1163
1164 #define FETCHSTR(name, rec) \
1165 do { if (strequal(ctx->thiscmd, name)) { \
1166 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1167 } while (0);
1168
1169 #define SETSTR(name, rec, flag) \
1170 do { if (strequal(ctx->thiscmd, name)) { \
1171 init_lsa_String(&(info->info21.rec), argv[0]); \
1172 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1173 } while (0);
1174
1175 static NTSTATUS rpc_sh_user_str_edit_internals(struct net_context *c,
1176 TALLOC_CTX *mem_ctx,
1177 struct rpc_sh_ctx *ctx,
1178 struct rpc_pipe_client *pipe_hnd,
1179 struct policy_handle *user_hnd,
1180 int argc, const char **argv)
1181 {
1182 NTSTATUS result;
1183 const char *username;
1184 const char *oldval = "";
1185 union samr_UserInfo *info = NULL;
1186
1187 if (argc > 1) {
1188 d_fprintf(stderr, "%s %s <username> [new value|NULL]\n",
1189 _("Usage:"), ctx->whoami);
1190 return NT_STATUS_INVALID_PARAMETER;
1191 }
1192
1193 result = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1194 user_hnd,
1195 21,
1196 &info);
1197 if (!NT_STATUS_IS_OK(result)) {
1198 return result;
1199 }
1200
1201 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1202
1203 FETCHSTR("fullname", full_name);
1204 FETCHSTR("homedir", home_directory);
1205 FETCHSTR("homedrive", home_drive);
1206 FETCHSTR("logonscript", logon_script);
1207 FETCHSTR("profilepath", profile_path);
1208 FETCHSTR("description", description);
1209
1210 if (argc == 0) {
1211 d_printf(_("%s's %s: [%s]\n"), username, ctx->thiscmd, oldval);
1212 goto done;
1213 }
1214
1215 if (strcmp(argv[0], "NULL") == 0) {
1216 argv[0] = "";
1217 }
1218
1219 ZERO_STRUCT(info->info21);
1220
1221 SETSTR("fullname", full_name, FULL_NAME);
1222 SETSTR("homedir", home_directory, HOME_DIRECTORY);
1223 SETSTR("homedrive", home_drive, HOME_DRIVE);
1224 SETSTR("logonscript", logon_script, LOGON_SCRIPT);
1225 SETSTR("profilepath", profile_path, PROFILE_PATH);
1226 SETSTR("description", description, DESCRIPTION);
1227
1228 result = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1229 user_hnd,
1230 21,
1231 info);
1232
1233 d_printf(_("Set %s's %s from [%s] to [%s]\n"), username,
1234 ctx->thiscmd, oldval, argv[0]);
1235
1236 done:
1237
1238 return result;
1239 }
1240
1241 #define HANDLEFLG(name, rec) \
1242 do { if (strequal(ctx->thiscmd, name)) { \
1243 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1244 if (newval) { \
1245 newflags = oldflags | ACB_##rec; \
1246 } else { \
1247 newflags = oldflags & ~ACB_##rec; \
1248 } } } while (0);
1249
1250 static NTSTATUS rpc_sh_user_str_edit(struct net_context *c,
1251 TALLOC_CTX *mem_ctx,
1252 struct rpc_sh_ctx *ctx,
1253 struct rpc_pipe_client *pipe_hnd,
1254 int argc, const char **argv)
1255 {
1256 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1257 rpc_sh_user_str_edit_internals);
1258 }
1259
1260 static NTSTATUS rpc_sh_user_flag_edit_internals(struct net_context *c,
1261 TALLOC_CTX *mem_ctx,
1262 struct rpc_sh_ctx *ctx,
1263 struct rpc_pipe_client *pipe_hnd,
1264 struct policy_handle *user_hnd,
1265 int argc, const char **argv)
1266 {
1267 NTSTATUS result;
1268 const char *username;
1269 const char *oldval = "unknown";
1270 uint32 oldflags, newflags;
1271 bool newval;
1272 union samr_UserInfo *info = NULL;
1273
1274 if ((argc > 1) ||
1275 ((argc == 1) && !strequal(argv[0], "yes") &&
1276 !strequal(argv[0], "no"))) {
1277 /* TRANSATORS: The yes|no here are program keywords. Please do
1278 not translate. */
1279 d_fprintf(stderr, _("Usage: %s <username> [yes|no]\n"),
1280 ctx->whoami);
1281 return NT_STATUS_INVALID_PARAMETER;
1282 }
1283
1284 newval = strequal(argv[0], "yes");
1285
1286 result = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1287 user_hnd,
1288 21,
1289 &info);
1290 if (!NT_STATUS_IS_OK(result)) {
1291 return result;
1292 }
1293
1294 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1295 oldflags = info->info21.acct_flags;
1296 newflags = info->info21.acct_flags;
1297
1298 HANDLEFLG("disabled", DISABLED);
1299 HANDLEFLG("pwnotreq", PWNOTREQ);
1300 HANDLEFLG("autolock", AUTOLOCK);
1301 HANDLEFLG("pwnoexp", PWNOEXP);
1302
1303 if (argc == 0) {
1304 d_printf(_("%s's %s flag: %s\n"), username, ctx->thiscmd,
1305 oldval);
1306 goto done;
1307 }
1308
1309 ZERO_STRUCT(info->info21);
1310
1311 info->info21.acct_flags = newflags;
1312 info->info21.fields_present = SAMR_FIELD_ACCT_FLAGS;
1313
1314 result = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1315 user_hnd,
1316 21,
1317 info);
1318
1319 if (NT_STATUS_IS_OK(result)) {
1320 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username,
1321 ctx->thiscmd, oldval, argv[0]);
1322 }
1323
1324 done:
1325
1326 return result;
1327 }
1328
1329 static NTSTATUS rpc_sh_user_flag_edit(struct net_context *c,
1330 TALLOC_CTX *mem_ctx,
1331 struct rpc_sh_ctx *ctx,
1332 struct rpc_pipe_client *pipe_hnd,
1333 int argc, const char **argv)
1334 {
1335 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1336 rpc_sh_user_flag_edit_internals);
1337 }
1338
1339 struct rpc_sh_cmd *net_rpc_user_edit_cmds(struct net_context *c,
1340 TALLOC_CTX *mem_ctx,
1341 struct rpc_sh_ctx *ctx)
1342 {
1343 static struct rpc_sh_cmd cmds[] = {
1344
1345 { "fullname", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1346 N_("Show/Set a user's full name") },
1347
1348 { "homedir", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1349 N_("Show/Set a user's home directory") },
1350
1351 { "homedrive", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1352 N_("Show/Set a user's home drive") },
1353
1354 { "logonscript", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1355 N_("Show/Set a user's logon script") },
1356
1357 { "profilepath", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1358 N_("Show/Set a user's profile path") },
1359
1360 { "description", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_str_edit,
1361 N_("Show/Set a user's description") },
1362
1363 { "disabled", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
1364 N_("Show/Set whether a user is disabled") },
1365
1366 { "autolock", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
1367 N_("Show/Set whether a user locked out") },
1368
1369 { "pwnotreq", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
1370 N_("Show/Set whether a user does not need a password") },
1371
1372 { "pwnoexp", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_flag_edit,
1373 N_("Show/Set whether a user's password does not expire") },
1374
1375 { NULL, NULL, 0, NULL, NULL }
1376 };
1377
1378 return cmds;
1379 }
1380
1381 struct rpc_sh_cmd *net_rpc_user_cmds(struct net_context *c,
1382 TALLOC_CTX *mem_ctx,
1383 struct rpc_sh_ctx *ctx)
1384 {
1385 static struct rpc_sh_cmd cmds[] = {
1386
1387 { "list", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_list,
1388 N_("List available users") },
1389
1390 { "info", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_info,
1391 N_("List the domain groups a user is member of") },
1392
1393 { "show", NULL, &ndr_table_samr.syntax_id, rpc_sh_user_show,
1394 N_("Show info about a user") },
1395
1396 { "edit", net_rpc_user_edit_cmds, 0, NULL,
1397 N_("Show/Modify a user's fields") },
1398
1399 { NULL, NULL, 0, NULL, NULL }
1400 };
1401
1402 return cmds;
1403 }
1404
1405 /****************************************************************************/
1406
1407 /**
1408 * Basic usage function for 'net rpc group'.
1409 * @param argc Standard main() style argc.
1410 * @param argv Standard main() style argv. Initial components are already
1411 * stripped.
1412 **/
1413
1414 static int rpc_group_usage(struct net_context *c, int argc, const char **argv)
1415 {
1416 return net_group_usage(c, argc, argv);
1417 }
1418
1419 /**
1420 * Delete group on a remote RPC server.
1421 *
1422 * All parameters are provided by the run_rpc_command function, except for
1423 * argc, argv which are passed through.
1424 *
1425 * @param domain_sid The domain sid acquired from the remote server.
1426 * @param cli A cli_state connected to the server.
1427 * @param mem_ctx Talloc context, destroyed on completion of the function.
1428 * @param argc Standard main() style argc.
1429 * @param argv Standard main() style argv. Initial components are already
1430 * stripped.
1431 *
1432 * @return Normal NTSTATUS return.
1433 **/
1434
1435 static NTSTATUS rpc_group_delete_internals(struct net_context *c,
1436 const DOM_SID *domain_sid,
1437 const char *domain_name,
1438 struct cli_state *cli,
1439 struct rpc_pipe_client *pipe_hnd,
1440 TALLOC_CTX *mem_ctx,
1441 int argc,
1442 const char **argv)
1443 {
1444 struct policy_handle connect_pol, domain_pol, group_pol, user_pol;
1445 bool group_is_primary = false;
1446 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1447 uint32_t group_rid;
1448 struct samr_RidTypeArray *rids = NULL;
1449 /* char **names; */
1450 int i;
1451 /* struct samr_RidWithAttribute *user_gids; */
1452
1453 struct samr_Ids group_rids, name_types;
1454 struct lsa_String lsa_acct_name;
1455 union samr_UserInfo *info = NULL;
1456
1457 if (argc < 1 || c->display_usage) {
1458 rpc_group_usage(c, argc,argv);
1459 return NT_STATUS_OK; /* ok? */
1460 }
1461
1462 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1463 pipe_hnd->desthost,
1464 MAXIMUM_ALLOWED_ACCESS,
1465 &connect_pol);
1466
1467 if (!NT_STATUS_IS_OK(result)) {
1468 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1469 goto done;
1470 }
1471
1472 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1473 &connect_pol,
1474 MAXIMUM_ALLOWED_ACCESS,
1475 CONST_DISCARD(struct dom_sid2 *, domain_sid),
1476 &domain_pol);
1477
1478 if (!NT_STATUS_IS_OK(result)) {
1479 d_fprintf(stderr, _("Request open_domain failed\n"));
1480 goto done;
1481 }
1482
1483 init_lsa_String(&lsa_acct_name, argv[0]);
1484
1485 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1486 &domain_pol,
1487 1,
1488 &lsa_acct_name,
1489 &group_rids,
1490 &name_types);
1491 if (!NT_STATUS_IS_OK(result)) {
1492 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1493 goto done;
1494 }
1495
1496 switch (name_types.ids[0])
1497 {
1498 case SID_NAME_DOM_GRP:
1499 result = rpccli_samr_OpenGroup(pipe_hnd, mem_ctx,
1500 &domain_pol,
1501 MAXIMUM_ALLOWED_ACCESS,
1502 group_rids.ids[0],
1503 &group_pol);
1504 if (!NT_STATUS_IS_OK(result)) {
1505 d_fprintf(stderr, _("Request open_group failed"));
1506 goto done;
1507 }
1508
1509 group_rid = group_rids.ids[0];
1510
1511 result = rpccli_samr_QueryGroupMember(pipe_hnd, mem_ctx,
1512 &group_pol,
1513 &rids);
1514
1515 if (!NT_STATUS_IS_OK(result)) {
1516 d_fprintf(stderr,
1517 _("Unable to query group members of %s"),
1518 argv[0]);
1519 goto done;
1520 }
1521
1522 if (c->opt_verbose) {
1523 d_printf(
1524 _("Domain Group %s (rid: %d) has %d members\n"),
1525 argv[0],group_rid, rids->count);
1526 }
1527
1528 /* Check if group is anyone's primary group */
1529 for (i = 0; i < rids->count; i++)
1530 {
1531 result = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1532 &domain_pol,
1533 MAXIMUM_ALLOWED_ACCESS,
1534 rids->rids[i],
1535 &user_pol);
1536
1537 if (!NT_STATUS_IS_OK(result)) {
1538 d_fprintf(stderr,
1539 _("Unable to open group member %d\n"),
1540 rids->rids[i]);
1541 goto done;
1542 }
1543
1544 result = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1545 &user_pol,
1546 21,
1547 &info);
1548
1549 if (!NT_STATUS_IS_OK(result)) {
1550 d_fprintf(stderr,
1551 _("Unable to lookup userinfo for group "
1552 "member %d\n"),
1553 rids->rids[i]);
1554 goto done;
1555 }
1556
1557 if (info->info21.primary_gid == group_rid) {
1558 if (c->opt_verbose) {
1559 d_printf(_("Group is primary group "
1560 "of %s\n"),
1561 info->info21.account_name.string);
1562 }
1563 group_is_primary = true;
1564 }
1565
1566 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1567 }
1568
1569 if (group_is_primary) {
1570 d_fprintf(stderr, _("Unable to delete group because "
1571 "some of it's members have it as primary "
1572 "group\n"));
1573 result = NT_STATUS_MEMBERS_PRIMARY_GROUP;
1574 goto done;
1575 }
1576
1577 /* remove all group members */
1578 for (i = 0; i < rids->count; i++)
1579 {
1580 if (c->opt_verbose)
1581 d_printf(_("Remove group member %d..."),
1582 rids->rids[i]);
1583 result = rpccli_samr_DeleteGroupMember(pipe_hnd, mem_ctx,
1584 &group_pol,
1585 rids->rids[i]);
1586
1587 if (NT_STATUS_IS_OK(result)) {
1588 if (c->opt_verbose)
1589 d_printf(_("ok\n"));
1590 } else {
1591 if (c->opt_verbose)
1592 d_printf("%s\n", _("failed"));
1593 goto done;
1594 }
1595 }
1596
1597 result = rpccli_samr_DeleteDomainGroup(pipe_hnd, mem_ctx,
1598 &group_pol);
1599
1600 break;
1601 /* removing a local group is easier... */
1602 case SID_NAME_ALIAS:
1603 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
1604 &domain_pol,
1605 MAXIMUM_ALLOWED_ACCESS,
1606 group_rids.ids[0],
1607 &group_pol);
1608
1609 if (!NT_STATUS_IS_OK(result)) {
1610 d_fprintf(stderr, _("Request open_alias failed\n"));
1611 goto done;
1612 }
1613
1614 result = rpccli_samr_DeleteDomAlias(pipe_hnd, mem_ctx,
1615 &group_pol);
1616 break;
1617 default:
1618 d_fprintf(stderr, _("%s is of type %s. This command is only "
1619 "for deleting local or global groups\n"),
1620 argv[0],sid_type_lookup(name_types.ids[0]));
1621 result = NT_STATUS_UNSUCCESSFUL;
1622 goto done;
1623 }
1624
1625 if (NT_STATUS_IS_OK(result)) {
1626 if (c->opt_verbose)
1627 d_printf(_("Deleted %s '%s'\n"),
1628 sid_type_lookup(name_types.ids[0]), argv[0]);
1629 } else {
1630 d_fprintf(stderr, _("Deleting of %s failed: %s\n"), argv[0],
1631 get_friendly_nt_error_msg(result));
1632 }
1633
1634 done:
1635 return result;
1636
1637 }
1638
1639 static int rpc_group_delete(struct net_context *c, int argc, const char **argv)
1640 {
1641 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
1642 rpc_group_delete_internals, argc,argv);
1643 }
1644
1645 static int rpc_group_add_internals(struct net_context *c, int argc, const char **argv)
1646 {
1647 NET_API_STATUS status;
1648 struct GROUP_INFO_1 info1;
1649 uint32_t parm_error = 0;
1650
1651 if (argc != 1 || c->display_usage) {
1652 rpc_group_usage(c, argc, argv);
1653 return 0;
1654 }
1655
1656 ZERO_STRUCT(info1);
1657
1658 info1.grpi1_name = argv[0];
1659 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1660 info1.grpi1_comment = c->opt_comment;
1661 }
1662
1663 status = NetGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1664
1665 if (status != 0) {
1666 d_fprintf(stderr,
1667 _("Failed to add group '%s' with error: %s.\n"),
1668 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1669 status));
1670 return -1;
1671 } else {
1672 d_printf(_("Added group '%s'.\n"), argv[0]);
1673 }
1674
1675 return 0;
1676 }
1677
1678 static int rpc_alias_add_internals(struct net_context *c, int argc, const char **argv)
1679 {
1680 NET_API_STATUS status;
1681 struct LOCALGROUP_INFO_1 info1;
1682 uint32_t parm_error = 0;
1683
1684 if (argc != 1 || c->display_usage) {
1685 rpc_group_usage(c, argc, argv);
1686 return 0;
1687 }
1688
1689 ZERO_STRUCT(info1);
1690
1691 info1.lgrpi1_name = argv[0];
1692 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1693 info1.lgrpi1_comment = c->opt_comment;
1694 }
1695
1696 status = NetLocalGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1697
1698 if (status != 0) {
1699 d_fprintf(stderr,
1700 _("Failed to add alias '%s' with error: %s.\n"),
1701 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1702 status));
1703 return -1;
1704 } else {
1705 d_printf(_("Added alias '%s'.\n"), argv[0]);
1706 }
1707
1708 return 0;
1709 }
1710
1711 static int rpc_group_add(struct net_context *c, int argc, const char **argv)
1712 {
1713 if (c->opt_localgroup)
1714 return rpc_alias_add_internals(c, argc, argv);
1715
1716 return rpc_group_add_internals(c, argc, argv);
1717 }
1718
1719 static NTSTATUS get_sid_from_name(struct cli_state *cli,
1720 TALLOC_CTX *mem_ctx,
1721 const char *name,
1722 DOM_SID *sid,
1723 enum lsa_SidType *type)
1724 {
1725 DOM_SID *sids = NULL;
1726 enum lsa_SidType *types = NULL;
1727 struct rpc_pipe_client *pipe_hnd = NULL;
1728 struct policy_handle lsa_pol;
1729 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1730
1731 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
1732 &pipe_hnd);
1733 if (!NT_STATUS_IS_OK(result)) {
1734 goto done;
1735 }
1736
1737 result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, false,
1738 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
1739
1740 if (!NT_STATUS_IS_OK(result)) {
1741 goto done;
1742 }
1743
1744 result = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &lsa_pol, 1,
1745 &name, NULL, 1, &sids, &types);
1746
1747 if (NT_STATUS_IS_OK(result)) {
1748 sid_copy(sid, &sids[0]);
1749 *type = types[0];
1750 }
1751
1752 rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
1753
1754 done:
1755 if (pipe_hnd) {
1756 TALLOC_FREE(pipe_hnd);
1757 }
1758
1759 if (!NT_STATUS_IS_OK(result) && (StrnCaseCmp(name, "S-", 2) == 0)) {
1760
1761 /* Try as S-1-5-whatever */
1762
1763 DOM_SID tmp_sid;
1764
1765 if (string_to_sid(&tmp_sid, name)) {
1766 sid_copy(sid, &tmp_sid);
1767 *type = SID_NAME_UNKNOWN;
1768 result = NT_STATUS_OK;
1769 }
1770 }
1771
1772 return result;
1773 }
1774
1775 static NTSTATUS rpc_add_groupmem(struct rpc_pipe_client *pipe_hnd,
1776 TALLOC_CTX *mem_ctx,
1777 const DOM_SID *group_sid,
1778 const char *member)
1779 {
1780 struct policy_handle connect_pol, domain_pol;
1781 NTSTATUS result;
1782 uint32 group_rid;
1783 struct policy_handle group_pol;
1784
1785 struct samr_Ids rids, rid_types;
1786 struct lsa_String lsa_acct_name;
1787
1788 DOM_SID sid;
1789
1790 sid_copy(&sid, group_sid);
1791
1792 if (!sid_split_rid(&sid, &group_rid)) {
1793 return NT_STATUS_UNSUCCESSFUL;
1794 }
1795
1796 /* Get sam policy handle */
1797 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1798 pipe_hnd->desthost,
1799 MAXIMUM_ALLOWED_ACCESS,
1800 &connect_pol);
1801 if (!NT_STATUS_IS_OK(result)) {
1802 return result;
1803 }
1804
1805 /* Get domain policy handle */
1806 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1807 &connect_pol,
1808 MAXIMUM_ALLOWED_ACCESS,
1809 &sid,
1810 &domain_pol);
1811 if (!NT_STATUS_IS_OK(result)) {
1812 return result;
1813 }
1814
1815 init_lsa_String(&lsa_acct_name, member);
1816
1817 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1818 &domain_pol,
1819 1,
1820 &lsa_acct_name,
1821 &rids,
1822 &rid_types);
1823
1824 if (!NT_STATUS_IS_OK(result)) {
1825 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
1826 member);
1827 goto done;
1828 }
1829
1830 result = rpccli_samr_OpenGroup(pipe_hnd, mem_ctx,
1831 &domain_pol,
1832 MAXIMUM_ALLOWED_ACCESS,
1833 group_rid,
1834 &group_pol);
1835
1836 if (!NT_STATUS_IS_OK(result)) {
1837 goto done;
1838 }
1839
1840 result = rpccli_samr_AddGroupMember(pipe_hnd, mem_ctx,
1841 &group_pol,
1842 rids.ids[0],
1843 0x0005); /* unknown flags */
1844
1845 done:
1846 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
1847 return result;
1848 }
1849
1850 static NTSTATUS rpc_add_aliasmem(struct rpc_pipe_client *pipe_hnd,
1851 TALLOC_CTX *mem_ctx,
1852 const DOM_SID *alias_sid,
1853 const char *member)
1854 {
1855 struct policy_handle connect_pol, domain_pol;
1856 NTSTATUS result;
1857 uint32 alias_rid;
1858 struct policy_handle alias_pol;
1859
1860 DOM_SID member_sid;
1861 enum lsa_SidType member_type;
1862
1863 DOM_SID sid;
1864
1865 sid_copy(&sid, alias_sid);
1866
1867 if (!sid_split_rid(&sid, &alias_rid)) {
1868 return NT_STATUS_UNSUCCESSFUL;
1869 }
1870
1871 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
1872 member, &member_sid, &member_type);
1873
1874 if (!NT_STATUS_IS_OK(result)) {
1875 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
1876 member);
1877 return result;
1878 }
1879
1880 /* Get sam policy handle */
1881 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1882 pipe_hnd->desthost,
1883 MAXIMUM_ALLOWED_ACCESS,
1884 &connect_pol);
1885 if (!NT_STATUS_IS_OK(result)) {
1886 goto done;
1887 }
1888
1889 /* Get domain policy handle */
1890 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1891 &connect_pol,
1892 MAXIMUM_ALLOWED_ACCESS,
1893 &sid,
1894 &domain_pol);
1895 if (!NT_STATUS_IS_OK(result)) {
1896 goto done;
1897 }
1898
1899 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
1900 &domain_pol,
1901 MAXIMUM_ALLOWED_ACCESS,
1902 alias_rid,
1903 &alias_pol);
1904
1905 if (!NT_STATUS_IS_OK(result)) {
1906 return result;
1907 }
1908
1909 result = rpccli_samr_AddAliasMember(pipe_hnd, mem_ctx,
1910 &alias_pol,
1911 &member_sid);
1912
1913 if (!NT_STATUS_IS_OK(result)) {
1914 return result;
1915 }
1916
1917 done:
1918 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
1919 return result;
1920 }
1921
1922 static NTSTATUS rpc_group_addmem_internals(struct net_context *c,
1923 const DOM_SID *domain_sid,
1924 const char *domain_name,
1925 struct cli_state *cli,
1926 struct rpc_pipe_client *pipe_hnd,
1927 TALLOC_CTX *mem_ctx,
1928 int argc,
1929 const char **argv)
1930 {
1931 DOM_SID group_sid;
1932 enum lsa_SidType group_type;
1933
1934 if (argc != 2 || c->display_usage) {
1935 d_printf("%s\n%s",
1936 _("Usage:"),
1937 _("net rpc group addmem <group> <member>\n"
1938 " Add a member to a group\n"
1939 " group\tGroup to add member to\n"
1940 " member\tMember to add to group\n"));
1941 return NT_STATUS_UNSUCCESSFUL;
1942 }
1943
1944 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
1945 &group_sid, &group_type))) {
1946 d_fprintf(stderr, _("Could not lookup group name %s\n"),
1947 argv[0]);
1948 return NT_STATUS_UNSUCCESSFUL;
1949 }
1950
1951 if (group_type == SID_NAME_DOM_GRP) {
1952 NTSTATUS result = rpc_add_groupmem(pipe_hnd, mem_ctx,
1953 &group_sid, argv[1]);
1954
1955 if (!NT_STATUS_IS_OK(result)) {
1956 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
1957 argv[1], argv[0], nt_errstr(result));
1958 }
1959 return result;
1960 }
1961
1962 if (group_type == SID_NAME_ALIAS) {
1963 NTSTATUS result = rpc_add_aliasmem(pipe_hnd, mem_ctx,
1964 &group_sid, argv[1]);
1965
1966 if (!NT_STATUS_IS_OK(result)) {
1967 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
1968 argv[1], argv[0], nt_errstr(result));
1969 }
1970 return result;
1971 }
1972
1973 d_fprintf(stderr, _("Can only add members to global or local groups "
1974 "which %s is not\n"), argv[0]);
1975
1976 return NT_STATUS_UNSUCCESSFUL;
1977 }
1978
1979 static int rpc_group_addmem(struct net_context *c, int argc, const char **argv)
1980 {
1981 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
1982 rpc_group_addmem_internals,
1983 argc, argv);
1984 }
1985
1986 static NTSTATUS rpc_del_groupmem(struct net_context *c,
1987 struct rpc_pipe_client *pipe_hnd,
1988 TALLOC_CTX *mem_ctx,
1989 const DOM_SID *group_sid,
1990 const char *member)
1991 {
1992 struct policy_handle connect_pol, domain_pol;
1993 NTSTATUS result;
1994 uint32 group_rid;
1995 struct policy_handle group_pol;
1996
1997 struct samr_Ids rids, rid_types;
1998 struct lsa_String lsa_acct_name;
1999
2000 DOM_SID sid;
2001
2002 sid_copy(&sid, group_sid);
2003
2004 if (!sid_split_rid(&sid, &group_rid))
2005 return NT_STATUS_UNSUCCESSFUL;
2006
2007 /* Get sam policy handle */
2008 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
2009 pipe_hnd->desthost,
2010 MAXIMUM_ALLOWED_ACCESS,
2011 &connect_pol);
2012 if (!NT_STATUS_IS_OK(result))
2013 return result;
2014
2015 /* Get domain policy handle */
2016 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2017 &connect_pol,
2018 MAXIMUM_ALLOWED_ACCESS,
2019 &sid,
2020 &domain_pol);
2021 if (!NT_STATUS_IS_OK(result))
2022 return result;
2023
2024 init_lsa_String(&lsa_acct_name, member);
2025
2026 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
2027 &domain_pol,
2028 1,
2029 &lsa_acct_name,
2030 &rids,
2031 &rid_types);
2032 if (!NT_STATUS_IS_OK(result)) {
2033 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2034 member);
2035 goto done;
2036 }
2037
2038 result = rpccli_samr_OpenGroup(pipe_hnd, mem_ctx,
2039 &domain_pol,
2040 MAXIMUM_ALLOWED_ACCESS,
2041 group_rid,
2042 &group_pol);
2043
2044 if (!NT_STATUS_IS_OK(result))
2045 goto done;
2046
2047 result = rpccli_samr_DeleteGroupMember(pipe_hnd, mem_ctx,
2048 &group_pol,
2049 rids.ids[0]);
2050
2051 done:
2052 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
2053 return result;
2054 }
2055
2056 static NTSTATUS rpc_del_aliasmem(struct rpc_pipe_client *pipe_hnd,
2057 TALLOC_CTX *mem_ctx,
2058 const DOM_SID *alias_sid,
2059 const char *member)
2060 {
2061 struct policy_handle connect_pol, domain_pol;
2062 NTSTATUS result;
2063 uint32 alias_rid;
2064 struct policy_handle alias_pol;
2065
2066 DOM_SID member_sid;
2067 enum lsa_SidType member_type;
2068
2069 DOM_SID sid;
2070
2071 sid_copy(&sid, alias_sid);
2072
2073 if (!sid_split_rid(&sid, &alias_rid))
2074 return NT_STATUS_UNSUCCESSFUL;
2075
2076 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
2077 member, &member_sid, &member_type);
2078
2079 if (!NT_STATUS_IS_OK(result)) {
2080 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2081 member);
2082 return result;
2083 }
2084
2085 /* Get sam policy handle */
2086 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
2087 pipe_hnd->desthost,
2088 MAXIMUM_ALLOWED_ACCESS,
2089 &connect_pol);
2090 if (!NT_STATUS_IS_OK(result)) {
2091 goto done;
2092 }
2093
2094 /* Get domain policy handle */
2095 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2096 &connect_pol,
2097 MAXIMUM_ALLOWED_ACCESS,
2098 &sid,
2099 &domain_pol);
2100 if (!NT_STATUS_IS_OK(result)) {
2101 goto done;
2102 }
2103
2104 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
2105 &domain_pol,
2106 MAXIMUM_ALLOWED_ACCESS,
2107 alias_rid,
2108 &alias_pol);
2109
2110 if (!NT_STATUS_IS_OK(result))
2111 return result;
2112
2113 result = rpccli_samr_DeleteAliasMember(pipe_hnd, mem_ctx,
2114 &alias_pol,
2115 &member_sid);
2116
2117 if (!NT_STATUS_IS_OK(result))
2118 return result;
2119
2120 done:
2121 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
2122 return result;
2123 }
2124
2125 static NTSTATUS rpc_group_delmem_internals(struct net_context *c,
2126 const DOM_SID *domain_sid,
2127 const char *domain_name,
2128 struct cli_state *cli,
2129 struct rpc_pipe_client *pipe_hnd,
2130 TALLOC_CTX *mem_ctx,
2131 int argc,
2132 const char **argv)
2133 {
2134 DOM_SID group_sid;
2135 enum lsa_SidType group_type;
2136
2137 if (argc != 2 || c->display_usage) {
2138 d_printf("%s\n%s",
2139 _("Usage:"),
2140 _("net rpc group delmem <group> <member>\n"
2141 " Delete a member from a group\n"
2142 " group\tGroup to delete member from\n"
2143 " member\tMember to delete from group\n"));
2144 return NT_STATUS_UNSUCCESSFUL;
2145 }
2146
2147 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2148 &group_sid, &group_type))) {
2149 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2150 argv[0]);
2151 return NT_STATUS_UNSUCCESSFUL;
2152 }
2153
2154 if (group_type == SID_NAME_DOM_GRP) {
2155 NTSTATUS result = rpc_del_groupmem(c, pipe_hnd, mem_ctx,
2156 &group_sid, argv[1]);
2157
2158 if (!NT_STATUS_IS_OK(result)) {
2159 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2160 argv[1], argv[0], nt_errstr(result));
2161 }
2162 return result;
2163 }
2164
2165 if (group_type == SID_NAME_ALIAS) {
2166 NTSTATUS result = rpc_del_aliasmem(pipe_hnd, mem_ctx,
2167 &group_sid, argv[1]);
2168
2169 if (!NT_STATUS_IS_OK(result)) {
2170 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2171 argv[1], argv[0], nt_errstr(result));
2172 }
2173 return result;
2174 }
2175
2176 d_fprintf(stderr, _("Can only delete members from global or local "
2177 "groups which %s is not\n"), argv[0]);
2178
2179 return NT_STATUS_UNSUCCESSFUL;
2180 }
2181
2182 static int rpc_group_delmem(struct net_context *c, int argc, const char **argv)
2183 {
2184 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
2185 rpc_group_delmem_internals,
2186 argc, argv);
2187 }
2188
2189 /**
2190 * List groups on a remote RPC server.
2191 *
2192 * All parameters are provided by the run_rpc_command function, except for
2193 * argc, argv which are passes through.
2194 *
2195 * @param domain_sid The domain sid acquired from the remote server.
2196 * @param cli A cli_state connected to the server.
2197 * @param mem_ctx Talloc context, destroyed on completion of the function.
2198 * @param argc Standard main() style argc.
2199 * @param argv Standard main() style argv. Initial components are already
2200 * stripped.
2201 *
2202 * @return Normal NTSTATUS return.
2203 **/
2204
2205 static NTSTATUS rpc_group_list_internals(struct net_context *c,
2206 const DOM_SID *domain_sid,
2207 const char *domain_name,
2208 struct cli_state *cli,
2209 struct rpc_pipe_client *pipe_hnd,
2210 TALLOC_CTX *mem_ctx,
2211 int argc,
2212 const char **argv)
2213 {
2214 struct policy_handle connect_pol, domain_pol;
2215 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2216 uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
2217 struct samr_SamArray *groups = NULL;
2218 bool global = false;
2219 bool local = false;
2220 bool builtin = false;
2221
2222 if (c->display_usage) {
2223 d_printf("%s\n%s",
2224 _("Usage:"),
2225 _("net rpc group list [global] [local] [builtin]\n"
2226 " List groups on RPC server\n"
2227 " global\tList global groups\n"
2228 " local\tList local groups\n"
2229 " builtin\tList builtin groups\n"
2230 " If none of global, local or builtin is "
2231 "specified, all three options are considered "
2232 "set\n"));
2233 return NT_STATUS_OK;
2234 }
2235
2236 if (argc == 0) {
2237 global = true;
2238 local = true;
2239 builtin = true;
2240 }
2241
2242 for (i=0; i<argc; i++) {
2243 if (strequal(argv[i], "global"))
2244 global = true;
2245
2246 if (strequal(argv[i], "local"))
2247 local = true;
2248
2249 if (strequal(argv[i], "builtin"))
2250 builtin = true;
2251 }
2252
2253 /* Get sam policy handle */
2254
2255 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
2256 pipe_hnd->desthost,
2257 MAXIMUM_ALLOWED_ACCESS,
2258 &connect_pol);
2259 if (!NT_STATUS_IS_OK(result)) {
2260 goto done;
2261 }
2262
2263 /* Get domain policy handle */
2264
2265 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2266 &connect_pol,
2267 MAXIMUM_ALLOWED_ACCESS,
2268 CONST_DISCARD(struct dom_sid2 *, domain_sid),
2269 &domain_pol);
2270 if (!NT_STATUS_IS_OK(result)) {
2271 goto done;
2272 }
2273
2274 /* Query domain groups */
2275 if (c->opt_long_list_entries)
2276 d_printf(_("\nGroup name Comment"
2277 "\n-----------------------------\n"));
2278 do {
2279 uint32_t max_size, total_size, returned_size;
2280 union samr_DispInfo info;
2281
2282 if (!global) break;
2283
2284 get_query_dispinfo_params(
2285 loop_count, &max_entries, &max_size);
2286
2287 result = rpccli_samr_QueryDisplayInfo(pipe_hnd, mem_ctx,
2288 &domain_pol,
2289 3,
2290 start_idx,
2291 max_entries,
2292 max_size,
2293 &total_size,
2294 &returned_size,
2295 &info);
2296 num_entries = info.info3.count;
2297 start_idx += info.info3.count;
2298
2299 if (!NT_STATUS_IS_OK(result) &&
2300 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2301 break;
2302
2303 for (i = 0; i < num_entries; i++) {
2304
2305 const char *group = NULL;
2306 const char *desc = NULL;
2307
2308 group = info.info3.entries[i].account_name.string;
2309 desc = info.info3.entries[i].description.string;
2310
2311 if (c->opt_long_list_entries)
2312 printf("%-21.21s %-50.50s\n",
2313 group, desc);
2314 else
2315 printf("%s\n", group);
2316 }
2317 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2318 /* query domain aliases */
2319 start_idx = 0;
2320 do {
2321 if (!local) break;
2322
2323 result = rpccli_samr_EnumDomainAliases(pipe_hnd, mem_ctx,
2324 &domain_pol,
2325 &start_idx,
2326 &groups,
2327 0xffff,
2328 &num_entries);
2329 if (!NT_STATUS_IS_OK(result) &&
2330 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2331 break;
2332
2333 for (i = 0; i < num_entries; i++) {
2334
2335 const char *description = NULL;
2336
2337 if (c->opt_long_list_entries) {
2338
2339 struct policy_handle alias_pol;
2340 union samr_AliasInfo *info = NULL;
2341
2342 if ((NT_STATUS_IS_OK(rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
2343 &domain_pol,
2344 0x8,
2345 groups->entries[i].idx,
2346 &alias_pol))) &&
2347 (NT_STATUS_IS_OK(rpccli_samr_QueryAliasInfo(pipe_hnd, mem_ctx,
2348 &alias_pol,
2349 3,
2350 &info))) &&
2351 (NT_STATUS_IS_OK(rpccli_samr_Close(pipe_hnd, mem_ctx,
2352 &alias_pol)))) {
2353 description = info->description.string;
2354 }
2355 }
2356
2357 if (description != NULL) {
2358 printf("%-21.21s %-50.50s\n",
2359 groups->entries[i].name.string,
2360 description);
2361 } else {
2362 printf("%s\n", groups->entries[i].name.string);
2363 }
2364 }
2365 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2366 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
2367 /* Get builtin policy handle */
2368
2369 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2370 &connect_pol,
2371 MAXIMUM_ALLOWED_ACCESS,
2372 CONST_DISCARD(struct dom_sid2 *, &global_sid_Builtin),
2373 &domain_pol);
2374 if (!NT_STATUS_IS_OK(result)) {
2375 goto done;
2376 }
2377 /* query builtin aliases */
2378 start_idx = 0;
2379 do {
2380 if (!builtin) break;
2381
2382 result = rpccli_samr_EnumDomainAliases(pipe_hnd, mem_ctx,
2383 &domain_pol,
2384 &start_idx,
2385 &groups,
2386 max_entries,
2387 &num_entries);
2388 if (!NT_STATUS_IS_OK(result) &&
2389 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2390 break;
2391
2392 for (i = 0; i < num_entries; i++) {
2393
2394 const char *description = NULL;
2395
2396 if (c->opt_long_list_entries) {
2397
2398 struct policy_handle alias_pol;
2399 union samr_AliasInfo *info = NULL;
2400
2401 if ((NT_STATUS_IS_OK(rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
2402 &domain_pol,
2403 0x8,
2404 groups->entries[i].idx,
2405 &alias_pol))) &&
2406 (NT_STATUS_IS_OK(rpccli_samr_QueryAliasInfo(pipe_hnd, mem_ctx,
2407 &alias_pol,
2408 3,
2409 &info))) &&
2410 (NT_STATUS_IS_OK(rpccli_samr_Close(pipe_hnd, mem_ctx,
2411 &alias_pol)))) {
2412 description = info->description.string;
2413 }
2414 }
2415
2416 if (description != NULL) {
2417 printf("%-21.21s %-50.50s\n",
2418 groups->entries[i].name.string,
2419 description);
2420 } else {
2421 printf("%s\n", groups->entries[i].name.string);
2422 }
2423 }
2424 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2425
2426 done:
2427 return result;
2428 }
2429
2430 static int rpc_group_list(struct net_context *c, int argc, const char **argv)
2431 {
2432 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
2433 rpc_group_list_internals,
2434 argc, argv);
2435 }
2436
2437 static NTSTATUS rpc_list_group_members(struct net_context *c,
2438 struct rpc_pipe_client *pipe_hnd,
2439 TALLOC_CTX *mem_ctx,
2440 const char *domain_name,
2441 const DOM_SID *domain_sid,
2442 struct policy_handle *domain_pol,
2443 uint32 rid)
2444 {
2445 NTSTATUS result;
2446 struct policy_handle group_pol;
2447 uint32 num_members, *group_rids;
2448 int i;
2449 struct samr_RidTypeArray *rids = NULL;
2450 struct lsa_Strings names;
2451 struct samr_Ids types;
2452
2453 fstring sid_str;
2454 sid_to_fstring(sid_str, domain_sid);
2455
2456 result = rpccli_samr_OpenGroup(pipe_hnd, mem_ctx,
2457 domain_pol,
2458 MAXIMUM_ALLOWED_ACCESS,
2459 rid,
2460 &group_pol);
2461
2462 if (!NT_STATUS_IS_OK(result))
2463 return result;
2464
2465 result = rpccli_samr_QueryGroupMember(pipe_hnd, mem_ctx,
2466 &group_pol,
2467 &rids);
2468
2469 if (!NT_STATUS_IS_OK(result))
2470 return result;
2471
2472 num_members = rids->count;
2473 group_rids = rids->rids;
2474
2475 while (num_members > 0) {
2476 int this_time = 512;
2477
2478 if (num_members < this_time)
2479 this_time = num_members;
2480
2481 result = rpccli_samr_LookupRids(pipe_hnd, mem_ctx,
2482 domain_pol,
2483 this_time,
2484 group_rids,
2485 &names,
2486 &types);
2487
2488 if (!NT_STATUS_IS_OK(result))
2489 return result;
2490
2491 /* We only have users as members, but make the output
2492 the same as the output of alias members */
2493
2494 for (i = 0; i < this_time; i++) {
2495
2496 if (c->opt_long_list_entries) {
2497 printf("%s-%d %s\\%s %d\n", sid_str,
2498 group_rids[i], domain_name,
2499 names.names[i].string,
2500 SID_NAME_USER);
2501 } else {
2502 printf("%s\\%s\n", domain_name,
2503 names.names[i].string);
2504 }
2505 }
2506
2507 num_members -= this_time;
2508 group_rids += 512;
2509 }
2510
2511 return NT_STATUS_OK;
2512 }
2513
2514 static NTSTATUS rpc_list_alias_members(struct net_context *c,
2515 struct rpc_pipe_client *pipe_hnd,
2516 TALLOC_CTX *mem_ctx,
2517 struct policy_handle *domain_pol,
2518 uint32 rid)
2519 {
2520 NTSTATUS result;
2521 struct rpc_pipe_client *lsa_pipe;
2522 struct policy_handle alias_pol, lsa_pol;
2523 uint32 num_members;
2524 DOM_SID *alias_sids;
2525 char **domains;
2526 char **names;
2527 enum lsa_SidType *types;
2528 int i;
2529 struct lsa_SidArray sid_array;
2530
2531 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
2532 domain_pol,
2533 MAXIMUM_ALLOWED_ACCESS,
2534 rid,
2535 &alias_pol);
2536
2537 if (!NT_STATUS_IS_OK(result))
2538 return result;
2539
2540 result = rpccli_samr_GetMembersInAlias(pipe_hnd, mem_ctx,
2541 &alias_pol,
2542 &sid_array);
2543
2544 if (!NT_STATUS_IS_OK(result)) {
2545 d_fprintf(stderr, _("Couldn't list alias members\n"));
2546 return result;
2547 }
2548
2549 num_members = sid_array.num_sids;
2550
2551 if (num_members == 0) {
2552 return NT_STATUS_OK;
2553 }
2554
2555 result = cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd),
2556 &ndr_table_lsarpc.syntax_id,
2557 &lsa_pipe);
2558 if (!NT_STATUS_IS_OK(result)) {
2559 d_fprintf(stderr, _("Couldn't open LSA pipe. Error was %s\n"),
2560 nt_errstr(result) );
2561 return result;
2562 }
2563
2564 result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, true,
2565 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
2566
2567 if (!NT_STATUS_IS_OK(result)) {
2568 d_fprintf(stderr, _("Couldn't open LSA policy handle\n"));
2569 TALLOC_FREE(lsa_pipe);
2570 return result;
2571 }
2572
2573 alias_sids = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
2574 if (!alias_sids) {
2575 d_fprintf(stderr, _("Out of memory\n"));
2576 TALLOC_FREE(lsa_pipe);
2577 return NT_STATUS_NO_MEMORY;
2578 }
2579
2580 for (i=0; i<num_members; i++) {
2581 sid_copy(&alias_sids[i], sid_array.sids[i].sid);
2582 }
2583
2584 result = rpccli_lsa_lookup_sids(lsa_pipe, mem_ctx, &lsa_pol,
2585 num_members, alias_sids,
2586 &domains, &names, &types);
2587
2588 if (!NT_STATUS_IS_OK(result) &&
2589 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2590 d_fprintf(stderr, _("Couldn't lookup SIDs\n"));
2591 TALLOC_FREE(lsa_pipe);
2592 return result;
2593 }
2594
2595 for (i = 0; i < num_members; i++) {
2596 fstring sid_str;
2597 sid_to_fstring(sid_str, &alias_sids[i]);
2598
2599 if (c->opt_long_list_entries) {
2600 printf("%s %s\\%s %d\n", sid_str,
2601 domains[i] ? domains[i] : _("*unknown*"),
2602 names[i] ? names[i] : _("*unknown*"), types[i]);
2603 } else {
2604 if (domains[i])
2605 printf("%s\\%s\n", domains[i], names[i]);
2606 else
2607 printf("%s\n", sid_str);
2608 }
2609 }
2610
2611 TALLOC_FREE(lsa_pipe);
2612 return NT_STATUS_OK;
2613 }
2614
2615 static NTSTATUS rpc_group_members_internals(struct net_context *c,
2616 const DOM_SID *domain_sid,
2617 const char *domain_name,
2618 struct cli_state *cli,
2619 struct rpc_pipe_client *pipe_hnd,
2620 TALLOC_CTX *mem_ctx,
2621 int argc,
2622 const char **argv)
2623 {
2624 NTSTATUS result;
2625 struct policy_handle connect_pol, domain_pol;
2626 struct samr_Ids rids, rid_types;
2627 struct lsa_String lsa_acct_name;
2628
2629 /* Get sam policy handle */
2630
2631 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
2632 pipe_hnd->desthost,
2633 MAXIMUM_ALLOWED_ACCESS,
2634 &connect_pol);
2635
2636 if (!NT_STATUS_IS_OK(result))
2637 return result;
2638
2639 /* Get domain policy handle */
2640
2641 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2642 &connect_pol,
2643 MAXIMUM_ALLOWED_ACCESS,
2644 CONST_DISCARD(struct dom_sid2 *, domain_sid),
2645 &domain_pol);
2646
2647 if (!NT_STATUS_IS_OK(result))
2648 return result;
2649
2650 init_lsa_String(&lsa_acct_name, argv[0]); /* sure? */
2651
2652 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
2653 &domain_pol,
2654 1,
2655 &lsa_acct_name,
2656 &rids,
2657 &rid_types);
2658
2659 if (!NT_STATUS_IS_OK(result)) {
2660
2661 /* Ok, did not find it in the global sam, try with builtin */
2662
2663 DOM_SID sid_Builtin;
2664
2665 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
2666
2667 sid_copy(&sid_Builtin, &global_sid_Builtin);
2668
2669 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
2670 &connect_pol,
2671 MAXIMUM_ALLOWED_ACCESS,
2672 &sid_Builtin,
2673 &domain_pol);
2674
2675 if (!NT_STATUS_IS_OK(result)) {
2676 d_fprintf(stderr, _("Couldn't find group %s\n"),
2677 argv[0]);
2678 return result;
2679 }
2680
2681 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
2682 &domain_pol,
2683 1,
2684 &lsa_acct_name,
2685 &rids,
2686 &rid_types);
2687
2688 if (!NT_STATUS_IS_OK(result)) {
2689 d_fprintf(stderr, _("Couldn't find group %s\n"),
2690 argv[0]);
2691 return result;
2692 }
2693 }
2694
2695 if (rids.count != 1) {
2696 d_fprintf(stderr, _("Couldn't find group %s\n"),
2697 argv[0]);
2698 return result;
2699 }
2700
2701 if (rid_types.ids[0] == SID_NAME_DOM_GRP) {
2702 return rpc_list_group_members(c, pipe_hnd, mem_ctx, domain_name,
2703 domain_sid, &domain_pol,
2704 rids.ids[0]);
2705 }
2706
2707 if (rid_types.ids[0] == SID_NAME_ALIAS) {
2708 return rpc_list_alias_members(c, pipe_hnd, mem_ctx, &domain_pol,
2709 rids.ids[0]);
2710 }
2711
2712 return NT_STATUS_NO_SUCH_GROUP;
2713 }
2714
2715 static int rpc_group_members(struct net_context *c, int argc, const char **argv)
2716 {
2717 if (argc != 1 || c->display_usage) {
2718 return rpc_group_usage(c, argc, argv);
2719 }
2720
2721 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
2722 rpc_group_members_internals,
2723 argc, argv);
2724 }
2725
2726 static int rpc_group_rename_internals(struct net_context *c, int argc, const char **argv)
2727 {
2728 NET_API_STATUS status;
2729 struct GROUP_INFO_0 g0;
2730 uint32_t parm_err;
2731
2732 if (argc != 2) {
2733 d_printf(_("Usage:\n"));
2734 d_printf("net rpc group rename group newname\n");
2735 return -1;
2736 }
2737
2738 g0.grpi0_name = argv[1];
2739
2740 status = NetGroupSetInfo(c->opt_host,
2741 argv[0],
2742 0,
2743 (uint8_t *)&g0,
2744 &parm_err);
2745
2746 if (status != 0) {
2747 d_fprintf(stderr, _("Renaming group %s failed with: %s\n"),
2748 argv[0], libnetapi_get_error_string(c->netapi_ctx,
2749 status));
2750 return -1;
2751 }
2752
2753 return 0;
2754 }
2755
2756 static int rpc_group_rename(struct net_context *c, int argc, const char **argv)
2757 {
2758 if (argc != 2 || c->display_usage) {
2759 return rpc_group_usage(c, argc, argv);
2760 }
2761
2762 return rpc_group_rename_internals(c, argc, argv);
2763 }
2764
2765 /**
2766 * 'net rpc group' entrypoint.
2767 * @param argc Standard main() style argc.
2768 * @param argv Standard main() style argv. Initial components are already
2769 * stripped.
2770 **/
2771
2772 int net_rpc_group(struct net_context *c, int argc, const char **argv)
2773 {
2774 NET_API_STATUS status;
2775
2776 struct functable func[] = {
2777 {
2778 "add",
2779 rpc_group_add,
2780 NET_TRANSPORT_RPC,
2781 N_("Create specified group"),
2782 N_("net rpc group add\n"
2783 " Create specified group")
2784 },
2785 {
2786 "delete",
2787 rpc_group_delete,
2788 NET_TRANSPORT_RPC,
2789 N_("Delete specified group"),
2790 N_("net rpc group delete\n"
2791 " Delete specified group")
2792 },
2793 {
2794 "addmem",
2795 rpc_group_addmem,
2796 NET_TRANSPORT_RPC,
2797 N_("Add member to group"),
2798 N_("net rpc group addmem\n"
2799 " Add member to group")
2800 },
2801 {
2802 "delmem",
2803 rpc_group_delmem,
2804 NET_TRANSPORT_RPC,
2805 N_("Remove member from group"),
2806 N_("net rpc group delmem\n"
2807 " Remove member from group")
2808 },
2809 {
2810 "list",
2811 rpc_group_list,
2812 NET_TRANSPORT_RPC,
2813 N_("List groups"),
2814 N_("net rpc group list\n"
2815 " List groups")
2816 },
2817 {
2818 "members",
2819 rpc_group_members,
2820 NET_TRANSPORT_RPC,
2821 N_("List group members"),
2822 N_("net rpc group members\n"
2823 " List group members")
2824 },
2825 {
2826 "rename",
2827 rpc_group_rename,
2828 NET_TRANSPORT_RPC,
2829 N_("Rename group"),
2830 N_("net rpc group rename\n"
2831 " Rename group")
2832 },
2833 {NULL, NULL, 0, NULL, NULL}
2834 };
2835
2836 status = libnetapi_init(&c->netapi_ctx);
2837 if (status != 0) {
2838 return -1;
2839 }
2840 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
2841 libnetapi_set_password(c->netapi_ctx, c->opt_password);
2842 if (c->opt_kerberos) {
2843 libnetapi_set_use_kerberos(c->netapi_ctx);
2844 }
2845
2846 if (argc == 0) {
2847 if (c->display_usage) {
2848 d_printf(_("Usage:\n"));
2849 d_printf(_("net rpc group\n"
2850 " Alias for net rpc group list global "
2851 "local builtin\n"));
2852 net_display_usage_from_functable(func);
2853 return 0;
2854 }
2855
2856 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
2857 rpc_group_list_internals,
2858 argc, argv);
2859 }
2860
2861 return net_run_function(c, argc, argv, "net rpc group", func);
2862 }
2863
2864 /****************************************************************************/
2865
2866 static int rpc_share_usage(struct net_context *c, int argc, const char **argv)
2867 {
2868 return net_share_usage(c, argc, argv);
2869 }
2870
2871 /**
2872 * Add a share on a remote RPC server.
2873 *
2874 * @param argc Standard main() style argc.
2875 * @param argv Standard main() style argv. Initial components are already
2876 * stripped.
2877 *
2878 * @return A shell status integer (0 for success).
2879 **/
2880
2881 static int rpc_share_add(struct net_context *c, int argc, const char **argv)
2882 {
2883 NET_API_STATUS status;
2884 char *sharename;
2885 char *path;
2886 uint32 type = STYPE_DISKTREE; /* only allow disk shares to be added */
2887 uint32 num_users=0, perms=0;
2888 char *password=NULL; /* don't allow a share password */
2889 struct SHARE_INFO_2 i2;
2890 uint32_t parm_error = 0;
2891
2892 if ((argc < 1) || !strchr(argv[0], '=') || c->display_usage) {
2893 return rpc_share_usage(c, argc, argv);
2894 }
2895
2896 if ((sharename = talloc_strdup(c, argv[0])) == NULL) {
2897 return -1;
2898 }
2899
2900 path = strchr(sharename, '=');
2901 if (!path) {
2902 return -1;
2903 }
2904
2905 *path++ = '\0';
2906
2907 i2.shi2_netname = sharename;
2908 i2.shi2_type = type;
2909 i2.shi2_remark = c->opt_comment;
2910 i2.shi2_permissions = perms;
2911 i2.shi2_max_uses = c->opt_maxusers;
2912 i2.shi2_current_uses = num_users;
2913 i2.shi2_path = path;
2914 i2.shi2_passwd = password;
2915
2916 status = NetShareAdd(c->opt_host,
2917 2,
2918 (uint8_t *)&i2,
2919 &parm_error);
2920 if (status != 0) {
2921 printf(_("NetShareAdd failed with: %s\n"),
2922 libnetapi_get_error_string(c->netapi_ctx, status));
2923 }
2924
2925 return status;
2926 }
2927
2928 /**
2929 * Delete a share on a remote RPC server.
2930 *
2931 * @param domain_sid The domain sid acquired from the remote server.
2932 * @param argc Standard main() style argc.
2933 * @param argv Standard main() style argv. Initial components are already
2934 * stripped.
2935 *
2936 * @return A shell status integer (0 for success).
2937 **/
2938 static int rpc_share_delete(struct net_context *c, int argc, const char **argv)
2939 {
2940 if (argc < 1 || c->display_usage) {
2941 return rpc_share_usage(c, argc, argv);
2942 }
2943
2944 return NetShareDel(c->opt_host, argv[0], 0);
2945 }
2946
2947 /**
2948 * Formatted print of share info
2949 *
2950 * @param r pointer to SHARE_INFO_1 to format
2951 **/
2952
2953 static void display_share_info_1(struct net_context *c,
2954 struct SHARE_INFO_1 *r)
2955 {
2956 if (c->opt_long_list_entries) {
2957 d_printf("%-12s %-8.8s %-50s\n",
2958 r->shi1_netname,
2959 net_share_type_str(r->shi1_type & ~(STYPE_TEMPORARY|STYPE_HIDDEN)),
2960 r->shi1_remark);
2961 } else {
2962 d_printf("%s\n", r->shi1_netname);
2963 }
2964 }
2965
2966 static WERROR get_share_info(struct net_context *c,
2967 struct rpc_pipe_client *pipe_hnd,
2968 TALLOC_CTX *mem_ctx,
2969 uint32 level,
2970 int argc,
2971 const char **argv,
2972 struct srvsvc_NetShareInfoCtr *info_ctr)
2973 {
2974 WERROR result;
2975 NTSTATUS status;
2976 union srvsvc_NetShareInfo info;
2977
2978 /* no specific share requested, enumerate all */
2979 if (argc == 0) {
2980
2981 uint32_t preferred_len = 0xffffffff;
2982 uint32_t total_entries = 0;
2983 uint32_t resume_handle = 0;
2984
2985 info_ctr->level = level;
2986
2987 status = rpccli_srvsvc_NetShareEnumAll(pipe_hnd, mem_ctx,
2988 pipe_hnd->desthost,
2989 info_ctr,
2990 preferred_len,
2991 &total_entries,
2992 &resume_handle,
2993 &result);
2994 return result;
2995 }
2996
2997 /* request just one share */
2998 status = rpccli_srvsvc_NetShareGetInfo(pipe_hnd, mem_ctx,
2999 pipe_hnd->desthost,
3000 argv[0],
3001 level,
3002 &info,
3003 &result);
3004
3005 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
3006 goto done;
3007 }
3008
3009 /* construct ctr */
3010 ZERO_STRUCTP(info_ctr);
3011
3012 info_ctr->level = level;
3013
3014 switch (level) {
3015 case 1:
3016 {
3017 struct srvsvc_NetShareCtr1 *ctr1;
3018
3019 ctr1 = TALLOC_ZERO_P(mem_ctx, struct srvsvc_NetShareCtr1);
3020 W_ERROR_HAVE_NO_MEMORY(ctr1);
3021
3022 ctr1->count = 1;
3023 ctr1->array = info.info1;
3024
3025 info_ctr->ctr.ctr1 = ctr1;
3026 }
3027 case 2:
3028 {
3029 struct srvsvc_NetShareCtr2 *ctr2;
3030
3031 ctr2 = TALLOC_ZERO_P(mem_ctx, struct srvsvc_NetShareCtr2);
3032 W_ERROR_HAVE_NO_MEMORY(ctr2);
3033
3034 ctr2->count = 1;
3035 ctr2->array = info.info2;
3036
3037 info_ctr->ctr.ctr2 = ctr2;
3038 }
3039 case 502:
3040 {
3041 struct srvsvc_NetShareCtr502 *ctr502;
3042
3043 ctr502 = TALLOC_ZERO_P(mem_ctx, struct srvsvc_NetShareCtr502);
3044 W_ERROR_HAVE_NO_MEMORY(ctr502);
3045
3046 ctr502->count = 1;
3047 ctr502->array = info.info502;
3048
3049 info_ctr->ctr.ctr502 = ctr502;
3050 }
3051 } /* switch */
3052 done:
3053 return result;
3054 }
3055
3056 /***
3057 * 'net rpc share list' entrypoint.
3058 * @param argc Standard main() style argc.
3059 * @param argv Standard main() style argv. Initial components are already
3060 * stripped.
3061 **/
3062 static int rpc_share_list(struct net_context *c, int argc, const char **argv)
3063 {
3064 NET_API_STATUS status;
3065 struct SHARE_INFO_1 *i1 = NULL;
3066 uint32_t entries_read = 0;
3067 uint32_t total_entries = 0;
3068 uint32_t resume_handle = 0;
3069 uint32_t i, level = 1;
3070
3071 if (c->display_usage) {
3072 d_printf( "%s\n"
3073 "net rpc share list\n"
3074 " %s\n",
3075 _("Usage:"),
3076 _("List shares on remote server"));
3077 return 0;
3078 }
3079
3080 status = NetShareEnum(c->opt_host,
3081 level,
3082 (uint8_t **)(void *)&i1,
3083 (uint32_t)-1,
3084 &entries_read,
3085 &total_entries,
3086 &resume_handle);
3087 if (status != 0) {
3088 goto done;
3089 }
3090
3091 /* Display results */
3092
3093 if (c->opt_long_list_entries) {
3094 d_printf(_(
3095 "\nEnumerating shared resources (exports) on remote server:\n\n"
3096 "\nShare name Type Description\n"
3097 "---------- ---- -----------\n"));
3098 }
3099 for (i = 0; i < entries_read; i++)
3100 display_share_info_1(c, &i1[i]);
3101 done:
3102 return status;
3103 }
3104
3105 static bool check_share_availability(struct cli_state *cli, const char *netname)
3106 {
3107 if (!NT_STATUS_IS_OK(cli_tcon_andx(cli, netname, "A:", "", 0))) {
3108 d_printf(_("skipping [%s]: not a file share.\n"), netname);
3109 return false;
3110 }
3111
3112 if (!cli_tdis(cli))
3113 return false;
3114
3115 return true;
3116 }
3117
3118 static bool check_share_sanity(struct net_context *c, struct cli_state *cli,
3119 const char *netname, uint32 type)
3120 {
3121 /* only support disk shares */
3122 if (! ( type == STYPE_DISKTREE || type == (STYPE_DISKTREE | STYPE_HIDDEN)) ) {
3123 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname,
3124 type);
3125 return false;
3126 }
3127
3128 /* skip builtin shares */
3129 /* FIXME: should print$ be added too ? */
3130 if (strequal(netname,"IPC$") || strequal(netname,"ADMIN$") ||
3131 strequal(netname,"global"))
3132 return false;
3133
3134 if (c->opt_exclude && in_list(netname, c->opt_exclude, false)) {
3135 printf(_("excluding [%s]\n"), netname);
3136 return false;
3137 }
3138
3139 return check_share_availability(cli, netname);
3140 }
3141
3142 /**
3143 * Migrate shares from a remote RPC server to the local RPC server.
3144 *
3145 * All parameters are provided by the run_rpc_command function, except for
3146 * argc, argv which are passed through.
3147 *
3148 * @param domain_sid The domain sid acquired from the remote server.
3149 * @param cli A cli_state connected to the server.
3150 * @param mem_ctx Talloc context, destroyed on completion of the function.
3151 * @param argc Standard main() style argc.
3152 * @param argv Standard main() style argv. Initial components are already
3153 * stripped.
3154 *
3155 * @return Normal NTSTATUS return.
3156 **/
3157
3158 static NTSTATUS rpc_share_migrate_shares_internals(struct net_context *c,
3159 const DOM_SID *domain_sid,
3160 const char *domain_name,
3161 struct cli_state *cli,
3162 struct rpc_pipe_client *pipe_hnd,
3163 TALLOC_CTX *mem_ctx,
3164 int argc,
3165 const char **argv)
3166 {
3167 WERROR result;
3168 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3169 struct srvsvc_NetShareInfoCtr ctr_src;
3170 uint32 i;
3171 struct rpc_pipe_client *srvsvc_pipe = NULL;
3172 struct cli_state *cli_dst = NULL;
3173 uint32 level = 502; /* includes secdesc */
3174 uint32_t parm_error = 0;
3175
3176 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3177 &ctr_src);
3178 if (!W_ERROR_IS_OK(result))
3179 goto done;
3180
3181 /* connect destination PI_SRVSVC */
3182 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
3183 &ndr_table_srvsvc.syntax_id);
3184 if (!NT_STATUS_IS_OK(nt_status))
3185 return nt_status;
3186
3187
3188 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3189
3190 union srvsvc_NetShareInfo info;
3191 struct srvsvc_NetShareInfo502 info502 =
3192 ctr_src.ctr.ctr502->array[i];
3193
3194 /* reset error-code */
3195 nt_status = NT_STATUS_UNSUCCESSFUL;
3196
3197 if (!check_share_sanity(c, cli, info502.name, info502.type))
3198 continue;
3199
3200 /* finally add the share on the dst server */
3201
3202 printf(_("migrating: [%s], path: %s, comment: %s, without "
3203 "share-ACLs\n"),
3204 info502.name, info502.path, info502.comment);
3205
3206 info.info502 = &info502;
3207
3208 nt_status = rpccli_srvsvc_NetShareAdd(srvsvc_pipe, mem_ctx,
3209 srvsvc_pipe->desthost,
3210 502,
3211 &info,
3212 &parm_error,
3213 &result);
3214
3215 if (W_ERROR_V(result) == W_ERROR_V(WERR_FILE_EXISTS)) {
3216 printf(_(" [%s] does already exist\n"),
3217 info502.name);
3218 continue;
3219 }
3220
3221 if (!NT_STATUS_IS_OK(nt_status) || !W_ERROR_IS_OK(result)) {
3222 printf(_("cannot add share: %s\n"), win_errstr(result));
3223 goto done;
3224 }
3225
3226 }
3227
3228 nt_status = NT_STATUS_OK;
3229
3230 done:
3231 if (cli_dst) {
3232 cli_shutdown(cli_dst);
3233 }
3234
3235 return nt_status;
3236
3237 }
3238
3239 /**
3240 * Migrate shares from a RPC server to another.
3241 *
3242 * @param argc Standard main() style argc.
3243 * @param argv Standard main() style argv. Initial components are already
3244 * stripped.
3245 *
3246 * @return A shell status integer (0 for success).
3247 **/
3248 static int rpc_share_migrate_shares(struct net_context *c, int argc,
3249 const char **argv)
3250 {
3251 if (c->display_usage) {
3252 d_printf( "%s\n"
3253 "net rpc share migrate shares\n"
3254 " %s\n",
3255 _("Usage:"),
3256 _("Migrate shares to local server"));
3257 return 0;
3258 }
3259
3260 if (!c->opt_host) {
3261 printf(_("no server to migrate\n"));
3262 return -1;
3263 }
3264
3265 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3266 rpc_share_migrate_shares_internals,
3267 argc, argv);
3268 }
3269
3270 /**
3271 * Copy a file/dir
3272 *
3273 * @param f file_info
3274 * @param mask current search mask
3275 * @param state arg-pointer
3276 *
3277 **/
3278 static void copy_fn(const char *mnt, file_info *f,
3279 const char *mask, void *state)
3280 {
3281 static NTSTATUS nt_status;
3282 static struct copy_clistate *local_state;
3283 static fstring filename, new_mask;
3284 fstring dir;
3285 char *old_dir;
3286 struct net_context *c;
3287
3288 local_state = (struct copy_clistate *)state;
3289 nt_status = NT_STATUS_UNSUCCESSFUL;
3290
3291 c = local_state->c;
3292
3293 if (strequal(f->name, ".") || strequal(f->name, ".."))
3294 return;
3295
3296 DEBUG(3,("got mask: %s, name: %s\n", mask, f->name));
3297
3298 /* DIRECTORY */
3299 if (f->mode & aDIR) {
3300
3301 DEBUG(3,("got dir: %s\n", f->name));
3302
3303 fstrcpy(dir, local_state->cwd);
3304 fstrcat(dir, "\\");
3305 fstrcat(dir, f->name);
3306
3307 switch (net_mode_share)
3308 {
3309 case NET_MODE_SHARE_MIGRATE:
3310 /* create that directory */
3311 nt_status = net_copy_file(c, local_state->mem_ctx,
3312 local_state->cli_share_src,
3313 local_state->cli_share_dst,
3314 dir, dir,
3315 c->opt_acls? true : false,
3316 c->opt_attrs? true : false,
3317 c->opt_timestamps? true:false,
3318 false);
3319 break;
3320 default:
3321 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3322 return;
3323 }
3324
3325 if (!NT_STATUS_IS_OK(nt_status))
3326 printf(_("could not handle dir %s: %s\n"),
3327 dir, nt_errstr(nt_status));
3328
3329 /* search below that directory */
3330 fstrcpy(new_mask, dir);
3331 fstrcat(new_mask, "\\*");
3332
3333 old_dir = local_state->cwd;
3334 local_state->cwd = dir;
3335 if (!sync_files(local_state, new_mask))
3336 printf(_("could not handle files\n"));
3337 local_state->cwd = old_dir;
3338
3339 return;
3340 }
3341
3342
3343 /* FILE */
3344 fstrcpy(filename, local_state->cwd);
3345 fstrcat(filename, "\\");
3346 fstrcat(filename, f->name);
3347
3348 DEBUG(3,("got file: %s\n", filename));
3349
3350 switch (net_mode_share)
3351 {
3352 case NET_MODE_SHARE_MIGRATE:
3353 nt_status = net_copy_file(c, local_state->mem_ctx,
3354 local_state->cli_share_src,
3355 local_state->cli_share_dst,
3356 filename, filename,
3357 c->opt_acls? true : false,
3358 c->opt_attrs? true : false,
3359 c->opt_timestamps? true: false,
3360 true);
3361 break;
3362 default:
3363 d_fprintf(stderr, _("Unsupported file mode %d\n"),
3364 net_mode_share);
3365 return;
3366 }
3367
3368 if (!NT_STATUS_IS_OK(nt_status))
3369 printf(_("could not handle file %s: %s\n"),
3370 filename, nt_errstr(nt_status));
3371
3372 }
3373
3374 /**
3375 * sync files, can be called recursivly to list files
3376 * and then call copy_fn for each file
3377 *
3378 * @param cp_clistate pointer to the copy_clistate we work with
3379 * @param mask the current search mask
3380 *
3381 * @return Boolean result
3382 **/
3383 static bool sync_files(struct copy_clistate *cp_clistate, const char *mask)
3384 {
3385 struct cli_state *targetcli;
3386 char *targetpath = NULL;
3387
3388 DEBUG(3,("calling cli_list with mask: %s\n", mask));
3389
3390 if ( !cli_resolve_path(talloc_tos(), "", NULL, cp_clistate->cli_share_src,
3391 mask, &targetcli, &targetpath ) ) {
3392 d_fprintf(stderr, _("cli_resolve_path %s failed with error: "
3393 "%s\n"),
3394 mask, cli_errstr(cp_clistate->cli_share_src));
3395 return false;
3396 }
3397
3398 if (cli_list(targetcli, targetpath, cp_clistate->attribute, copy_fn, cp_clistate) == -1) {
3399 d_fprintf(stderr, _("listing %s failed with error: %s\n"),
3400 mask, cli_errstr(targetcli));
3401 return false;
3402 }
3403
3404 return true;
3405 }
3406
3407
3408 /**
3409 * Set the top level directory permissions before we do any further copies.
3410 * Should set up ACL inheritance.
3411 **/
3412
3413 bool copy_top_level_perms(struct net_context *c,
3414 struct copy_clistate *cp_clistate,
3415 const char *sharename)
3416 {
3417 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3418
3419 switch (net_mode_share) {
3420 case NET_MODE_SHARE_MIGRATE:
3421 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename));
3422 nt_status = net_copy_fileattr(c,
3423 cp_clistate->mem_ctx,
3424 cp_clistate->cli_share_src,
3425 cp_clistate->cli_share_dst,
3426 "\\", "\\",
3427 c->opt_acls? true : false,
3428 c->opt_attrs? true : false,
3429 c->opt_timestamps? true: false,
3430 false);
3431 break;
3432 default:
3433 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3434 break;
3435 }
3436
3437 if (!NT_STATUS_IS_OK(nt_status)) {
3438 printf(_("Could handle directory attributes for top level "
3439 "directory of share %s. Error %s\n"),
3440 sharename, nt_errstr(nt_status));
3441 return false;
3442 }
3443
3444 return true;
3445 }
3446
3447 /**
3448 * Sync all files inside a remote share to another share (over smb).
3449 *
3450 * All parameters are provided by the run_rpc_command function, except for
3451 * argc, argv which are passed through.
3452 *
3453 * @param domain_sid The domain sid acquired from the remote server.
3454 * @param cli A cli_state connected to the server.
3455 * @param mem_ctx Talloc context, destroyed on completion of the function.
3456 * @param argc Standard main() style argc.
3457 * @param argv Standard main() style argv. Initial components are already
3458 * stripped.
3459 *
3460 * @return Normal NTSTATUS return.
3461 **/
3462
3463 static NTSTATUS rpc_share_migrate_files_internals(struct net_context *c,
3464 const DOM_SID *domain_sid,
3465 const char *domain_name,
3466 struct cli_state *cli,
3467 struct rpc_pipe_client *pipe_hnd,
3468 TALLOC_CTX *mem_ctx,
3469 int argc,
3470 const char **argv)
3471 {
3472 WERROR result;
3473 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3474 struct srvsvc_NetShareInfoCtr ctr_src;
3475 uint32 i;
3476 uint32 level = 502;
3477 struct copy_clistate cp_clistate;
3478 bool got_src_share = false;
3479 bool got_dst_share = false;
3480 const char *mask = "\\*";
3481 char *dst = NULL;
3482
3483 dst = SMB_STRDUP(c->opt_destination?c->opt_destination:"127.0.0.1");
3484 if (dst == NULL) {
3485 nt_status = NT_STATUS_NO_MEMORY;
3486 goto done;
3487 }
3488
3489 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3490 &ctr_src);
3491
3492 if (!W_ERROR_IS_OK(result))
3493 goto done;
3494
3495 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3496
3497 struct srvsvc_NetShareInfo502 info502 =
3498 ctr_src.ctr.ctr502->array[i];
3499
3500 if (!check_share_sanity(c, cli, info502.name, info502.type))
3501 continue;
3502
3503 /* one might not want to mirror whole discs :) */
3504 if (strequal(info502.name, "print$") || info502.name[1] == '$') {
3505 d_printf(_("skipping [%s]: builtin/hidden share\n"),
3506 info502.name);
3507 continue;
3508 }
3509
3510 switch (net_mode_share)
3511 {
3512 case NET_MODE_SHARE_MIGRATE:
3513 printf("syncing");
3514 break;
3515 default:
3516 d_fprintf(stderr, _("Unsupported mode %d\n"),
3517 net_mode_share);
3518 break;
3519 }
3520 printf(_(" [%s] files and directories %s ACLs, %s DOS "
3521 "Attributes %s\n"),
3522 info502.name,
3523 c->opt_acls ? _("including") : _("without"),
3524 c->opt_attrs ? _("including") : _("without"),
3525 c->opt_timestamps ? _("(preserving timestamps)") : "");
3526
3527 cp_clistate.mem_ctx = mem_ctx;
3528 cp_clistate.cli_share_src = NULL;
3529 cp_clistate.cli_share_dst = NULL;
3530 cp_clistate.cwd = NULL;
3531 cp_clistate.attribute = aSYSTEM | aHIDDEN | aDIR;
3532 cp_clistate.c = c;
3533
3534 /* open share source */
3535 nt_status = connect_to_service(c, &cp_clistate.cli_share_src,
3536 &cli->dest_ss, cli->desthost,
3537 info502.name, "A:");
3538 if (!NT_STATUS_IS_OK(nt_status))
3539 goto done;
3540
3541 got_src_share = true;
3542
3543 if (net_mode_share == NET_MODE_SHARE_MIGRATE) {
3544 /* open share destination */
3545 nt_status = connect_to_service(c, &cp_clistate.cli_share_dst,
3546 NULL, dst, info502.name, "A:");
3547 if (!NT_STATUS_IS_OK(nt_status))
3548 goto done;
3549
3550 got_dst_share = true;
3551 }
3552
3553 if (!copy_top_level_perms(c, &cp_clistate, info502.name)) {
3554 d_fprintf(stderr, _("Could not handle the top level "
3555 "directory permissions for the "
3556 "share: %s\n"), info502.name);
3557 nt_status = NT_STATUS_UNSUCCESSFUL;
3558 goto done;
3559 }
3560
3561 if (!sync_files(&cp_clistate, mask)) {
3562 d_fprintf(stderr, _("could not handle files for share: "
3563 "%s\n"), info502.name);
3564 nt_status = NT_STATUS_UNSUCCESSFUL;
3565 goto done;
3566 }
3567 }
3568
3569 nt_status = NT_STATUS_OK;
3570
3571 done:
3572
3573 if (got_src_share)
3574 cli_shutdown(cp_clistate.cli_share_src);
3575
3576 if (got_dst_share)
3577 cli_shutdown(cp_clistate.cli_share_dst);
3578
3579 SAFE_FREE(dst);
3580 return nt_status;
3581
3582 }
3583
3584 static int rpc_share_migrate_files(struct net_context *c, int argc, const char **argv)
3585 {
3586 if (c->display_usage) {
3587 d_printf( "%s\n"
3588 "net share migrate files\n"
3589 " %s\n",
3590 _("Usage:"),
3591 _("Migrate files to local server"));
3592 return 0;
3593 }
3594
3595 if (!c->opt_host) {
3596 d_printf(_("no server to migrate\n"));
3597 return -1;
3598 }
3599
3600 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3601 rpc_share_migrate_files_internals,
3602 argc, argv);
3603 }
3604
3605 /**
3606 * Migrate share-ACLs from a remote RPC server to the local RPC server.
3607 *
3608 * All parameters are provided by the run_rpc_command function, except for
3609 * argc, argv which are passed through.
3610 *
3611 * @param domain_sid The domain sid acquired from the remote server.
3612 * @param cli A cli_state connected to the server.
3613 * @param mem_ctx Talloc context, destroyed on completion of the function.
3614 * @param argc Standard main() style argc.
3615 * @param argv Standard main() style argv. Initial components are already
3616 * stripped.
3617 *
3618 * @return Normal NTSTATUS return.
3619 **/
3620
3621 static NTSTATUS rpc_share_migrate_security_internals(struct net_context *c,
3622 const DOM_SID *domain_sid,
3623 const char *domain_name,
3624 struct cli_state *cli,
3625 struct rpc_pipe_client *pipe_hnd,
3626 TALLOC_CTX *mem_ctx,
3627 int argc,
3628 const char **argv)
3629 {
3630 WERROR result;
3631 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3632 struct srvsvc_NetShareInfoCtr ctr_src;
3633 union srvsvc_NetShareInfo info;
3634 uint32 i;
3635 struct rpc_pipe_client *srvsvc_pipe = NULL;
3636 struct cli_state *cli_dst = NULL;
3637 uint32 level = 502; /* includes secdesc */
3638 uint32_t parm_error = 0;
3639
3640 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3641 &ctr_src);
3642
3643 if (!W_ERROR_IS_OK(result))
3644 goto done;
3645
3646 /* connect destination PI_SRVSVC */
3647 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
3648 &ndr_table_srvsvc.syntax_id);
3649 if (!NT_STATUS_IS_OK(nt_status))
3650 return nt_status;
3651
3652
3653 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3654
3655 struct srvsvc_NetShareInfo502 info502 =
3656 ctr_src.ctr.ctr502->array[i];
3657
3658 /* reset error-code */
3659 nt_status = NT_STATUS_UNSUCCESSFUL;
3660
3661 if (!check_share_sanity(c, cli, info502.name, info502.type))
3662 continue;
3663
3664 printf(_("migrating: [%s], path: %s, comment: %s, including "
3665 "share-ACLs\n"),
3666 info502.name, info502.path, info502.comment);
3667
3668 if (c->opt_verbose)
3669 display_sec_desc(info502.sd_buf.sd);
3670
3671 /* FIXME: shouldn't we be able to just set the security descriptor ? */
3672 info.info502 = &info502;
3673
3674 /* finally modify the share on the dst server */
3675 nt_status = rpccli_srvsvc_NetShareSetInfo(srvsvc_pipe, mem_ctx,
3676 srvsvc_pipe->desthost,
3677 info502.name,
3678 level,
3679 &info,
3680 &parm_error,
3681 &result);
3682 if (!NT_STATUS_IS_OK(nt_status) || !W_ERROR_IS_OK(result)) {
3683 printf(_("cannot set share-acl: %s\n"),
3684 win_errstr(result));
3685 goto done;
3686 }
3687
3688 }
3689
3690 nt_status = NT_STATUS_OK;
3691
3692 done:
3693 if (cli_dst) {
3694 cli_shutdown(cli_dst);
3695 }
3696
3697 return nt_status;
3698
3699 }
3700
3701 /**
3702 * Migrate share-acls from a RPC server to another.
3703 *
3704 * @param argc Standard main() style argc.
3705 * @param argv Standard main() style argv. Initial components are already
3706 * stripped.
3707 *
3708 * @return A shell status integer (0 for success).
3709 **/
3710 static int rpc_share_migrate_security(struct net_context *c, int argc,
3711 const char **argv)
3712 {
3713 if (c->display_usage) {
3714 d_printf( "%s\n"
3715 "net rpc share migrate security\n"
3716 " %s\n",
3717 _("Usage:"),
3718 _("Migrate share-acls to local server"));
3719 return 0;
3720 }
3721
3722 if (!c->opt_host) {
3723 d_printf(_("no server to migrate\n"));
3724 return -1;
3725 }
3726
3727 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3728 rpc_share_migrate_security_internals,
3729 argc, argv);
3730 }
3731
3732 /**
3733 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
3734 * from one server to another.
3735 *
3736 * @param argc Standard main() style argc.
3737 * @param argv Standard main() style argv. Initial components are already
3738 * stripped.
3739 *
3740 * @return A shell status integer (0 for success).
3741 *
3742 **/
3743 static int rpc_share_migrate_all(struct net_context *c, int argc,
3744 const char **argv)
3745 {
3746 int ret;
3747
3748 if (c->display_usage) {
3749 d_printf( "%s\n"
3750 "net rpc share migrate all\n"
3751 " %s\n",
3752 _("Usage:"),
3753 _("Migrates shares including all share settings"));
3754 return 0;
3755 }
3756
3757 if (!c->opt_host) {
3758 d_printf(_("no server to migrate\n"));
3759 return -1;
3760 }
3761
3762 /* order is important. we don't want to be locked out by the share-acl
3763 * before copying files - gd */
3764
3765 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3766 rpc_share_migrate_shares_internals, argc, argv);
3767 if (ret)
3768 return ret;
3769
3770 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3771 rpc_share_migrate_files_internals, argc, argv);
3772 if (ret)
3773 return ret;
3774
3775 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
3776 rpc_share_migrate_security_internals, argc,
3777 argv);
3778 }
3779
3780
3781 /**
3782 * 'net rpc share migrate' entrypoint.
3783 * @param argc Standard main() style argc.
3784 * @param argv Standard main() style argv. Initial components are already
3785 * stripped.
3786 **/
3787 static int rpc_share_migrate(struct net_context *c, int argc, const char **argv)
3788 {
3789
3790 struct functable func[] = {
3791 {
3792 "all",
3793 rpc_share_migrate_all,
3794 NET_TRANSPORT_RPC,
3795 N_("Migrate shares from remote to local server"),
3796 N_("net rpc share migrate all\n"
3797 " Migrate shares from remote to local server")
3798 },
3799 {
3800 "files",
3801 rpc_share_migrate_files,
3802 NET_TRANSPORT_RPC,
3803 N_("Migrate files from remote to local server"),
3804 N_("net rpc share migrate files\n"
3805 " Migrate files from remote to local server")
3806 },
3807 {
3808 "security",
3809 rpc_share_migrate_security,
3810 NET_TRANSPORT_RPC,
3811 N_("Migrate share-ACLs from remote to local server"),
3812 N_("net rpc share migrate security\n"
3813 " Migrate share-ACLs from remote to local server")
3814 },
3815 {
3816 "shares",
3817 rpc_share_migrate_shares,
3818 NET_TRANSPORT_RPC,
3819 N_("Migrate shares from remote to local server"),
3820 N_("net rpc share migrate shares\n"
3821 " Migrate shares from remote to local server")
3822 },
3823 {NULL, NULL, 0, NULL, NULL}
3824 };
3825
3826 net_mode_share = NET_MODE_SHARE_MIGRATE;
3827
3828 return net_run_function(c, argc, argv, "net rpc share migrate", func);
3829 }
3830
3831 struct full_alias {
3832 DOM_SID sid;
3833 uint32 num_members;
3834 DOM_SID *members;
3835 };
3836
3837 static int num_server_aliases;
3838 static struct full_alias *server_aliases;
3839
3840 /*
3841 * Add an alias to the static list.
3842 */
3843 static void push_alias(TALLOC_CTX *mem_ctx, struct full_alias *alias)
3844 {
3845 if (server_aliases == NULL)
3846 server_aliases = SMB_MALLOC_ARRAY(struct full_alias, 100);
3847
3848 server_aliases[num_server_aliases] = *alias;
3849 num_server_aliases += 1;
3850 }
3851
3852 /*
3853 * For a specific domain on the server, fetch all the aliases
3854 * and their members. Add all of them to the server_aliases.
3855 */
3856
3857 static NTSTATUS rpc_fetch_domain_aliases(struct rpc_pipe_client *pipe_hnd,
3858 TALLOC_CTX *mem_ctx,
3859 struct policy_handle *connect_pol,
3860 const DOM_SID *domain_sid)
3861 {
3862 uint32 start_idx, max_entries, num_entries, i;
3863 struct samr_SamArray *groups = NULL;
3864 NTSTATUS result;
3865 struct policy_handle domain_pol;
3866
3867 /* Get domain policy handle */
3868
3869 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
3870 connect_pol,
3871 MAXIMUM_ALLOWED_ACCESS,
3872 CONST_DISCARD(struct dom_sid2 *, domain_sid),
3873 &domain_pol);
3874 if (!NT_STATUS_IS_OK(result))
3875 return result;
3876
3877 start_idx = 0;
3878 max_entries = 250;
3879
3880 do {
3881 result = rpccli_samr_EnumDomainAliases(pipe_hnd, mem_ctx,
3882 &domain_pol,
3883 &start_idx,
3884 &groups,
3885 max_entries,
3886 &num_entries);
3887 for (i = 0; i < num_entries; i++) {
3888
3889 struct policy_handle alias_pol;
3890 struct full_alias alias;
3891 struct lsa_SidArray sid_array;
3892 int j;
3893
3894 result = rpccli_samr_OpenAlias(pipe_hnd, mem_ctx,
3895 &domain_pol,
3896 MAXIMUM_ALLOWED_ACCESS,
3897 groups->entries[i].idx,
3898 &alias_pol);
3899 if (!NT_STATUS_IS_OK(result))
3900 goto done;
3901
3902 result = rpccli_samr_GetMembersInAlias(pipe_hnd, mem_ctx,
3903 &alias_pol,
3904 &sid_array);
3905 if (!NT_STATUS_IS_OK(result))
3906 goto done;
3907
3908 alias.num_members = sid_array.num_sids;
3909
3910 result = rpccli_samr_Close(pipe_hnd, mem_ctx, &alias_pol);
3911 if (!NT_STATUS_IS_OK(result))
3912 goto done;
3913
3914 alias.members = NULL;
3915
3916 if (alias.num_members > 0) {
3917 alias.members = SMB_MALLOC_ARRAY(DOM_SID, alias.num_members);
3918
3919 for (j = 0; j < alias.num_members; j++)
3920 sid_copy(&alias.members[j],
3921 sid_array.sids[j].sid);
3922 }
3923
3924 sid_copy(&alias.sid, domain_sid);
3925 sid_append_rid(&alias.sid, groups->entries[i].idx);
3926
3927 push_alias(mem_ctx, &alias);
3928 }
3929 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
3930
3931 result = NT_STATUS_OK;
3932
3933 done:
3934 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
3935
3936 return result;
3937 }
3938
3939 /*
3940 * Dump server_aliases as names for debugging purposes.
3941 */
3942
3943 static NTSTATUS rpc_aliaslist_dump(struct net_context *c,
3944 const DOM_SID *domain_sid,
3945 const char *domain_name,
3946 struct cli_state *cli,
3947 struct rpc_pipe_client *pipe_hnd,
3948 TALLOC_CTX *mem_ctx,
3949 int argc,
3950 const char **argv)
3951 {
3952 int i;
3953 NTSTATUS result;
3954 struct policy_handle lsa_pol;
3955
3956 result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
3957 SEC_FLAG_MAXIMUM_ALLOWED,
3958 &lsa_pol);
3959 if (!NT_STATUS_IS_OK(result))
3960 return result;
3961
3962 for (i=0; i<num_server_aliases; i++) {
3963 char **names;
3964 char **domains;
3965 enum lsa_SidType *types;
3966 int j;
3967
3968 struct full_alias *alias = &server_aliases[i];
3969
3970 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol, 1,
3971 &alias->sid,
3972 &domains, &names, &types);
3973 if (!NT_STATUS_IS_OK(result))
3974 continue;
3975
3976 DEBUG(1, ("%s\\%s %d: ", domains[0], names[0], types[0]));
3977
3978 if (alias->num_members == 0) {
3979 DEBUG(1, ("\n"));
3980 continue;
3981 }
3982
3983 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol,
3984 alias->num_members,
3985 alias->members,
3986 &domains, &names, &types);
3987
3988 if (!NT_STATUS_IS_OK(result) &&
3989 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
3990 continue;
3991
3992 for (j=0; j<alias->num_members; j++)
3993 DEBUG(1, ("%s\\%s (%d); ",
3994 domains[j] ? domains[j] : "*unknown*",
3995 names[j] ? names[j] : "*unknown*",types[j]));
3996 DEBUG(1, ("\n"));
3997 }
3998
3999 rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
4000
4001 return NT_STATUS_OK;
4002 }
4003
4004 /*
4005 * Fetch a list of all server aliases and their members into
4006 * server_aliases.
4007 */
4008
4009 static NTSTATUS rpc_aliaslist_internals(struct net_context *c,
4010 const DOM_SID *domain_sid,
4011 const char *domain_name,
4012 struct cli_state *cli,
4013 struct rpc_pipe_client *pipe_hnd,
4014 TALLOC_CTX *mem_ctx,
4015 int argc,
4016 const char **argv)
4017 {
4018 NTSTATUS result;
4019 struct policy_handle connect_pol;
4020
4021 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
4022 pipe_hnd->desthost,
4023 MAXIMUM_ALLOWED_ACCESS,
4024 &connect_pol);
4025
4026 if (!NT_STATUS_IS_OK(result))
4027 goto done;
4028
4029 result = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4030 &global_sid_Builtin);
4031
4032 if (!NT_STATUS_IS_OK(result))
4033 goto done;
4034
4035 result = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4036 domain_sid);
4037
4038 rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_pol);
4039 done:
4040 return result;
4041 }
4042
4043 static void init_user_token(NT_USER_TOKEN *token, DOM_SID *user_sid)
4044 {
4045 token->num_sids = 4;
4046
4047 if (!(token->user_sids = SMB_MALLOC_ARRAY(DOM_SID, 4))) {
4048 d_fprintf(stderr, "malloc %s\n",_("failed"));
4049 token->num_sids = 0;
4050 return;
4051 }
4052
4053 token->user_sids[0] = *user_sid;
4054 sid_copy(&token->user_sids[1], &global_sid_World);
4055 sid_copy(&token->user_sids[2], &global_sid_Network);
4056 sid_copy(&token->user_sids[3], &global_sid_Authenticated_Users);
4057 }
4058
4059 static void free_user_token(NT_USER_TOKEN *token)
4060 {
4061 SAFE_FREE(token->user_sids);
4062 }
4063
4064 static void add_sid_to_token(NT_USER_TOKEN *token, DOM_SID *sid)
4065 {
4066 if (is_sid_in_token(token, sid))
4067 return;
4068
4069 token->user_sids = SMB_REALLOC_ARRAY(token->user_sids, DOM_SID, token->num_sids+1);
4070 if (!token->user_sids) {
4071 return;
4072 }
4073
4074 sid_copy(&token->user_sids[token->num_sids], sid);
4075
4076 token->num_sids += 1;
4077 }
4078
4079 struct user_token {
4080 fstring name;
4081 NT_USER_TOKEN token;
4082 };
4083
4084 static void dump_user_token(struct user_token *token)
4085 {
4086 int i;
4087
4088 d_printf("%s\n", token->name);
4089
4090 for (i=0; i<token->token.num_sids; i++) {
4091 d_printf(" %s\n", sid_string_tos(&token->token.user_sids[i]));
4092 }
4093 }
4094
4095 static bool is_alias_member(DOM_SID *sid, struct full_alias *alias)
4096 {
4097 int i;
4098
4099 for (i=0; i<alias->num_members; i++) {
4100 if (sid_compare(sid, &alias->members[i]) == 0)
4101 return true;
4102 }
4103
4104 return false;
4105 }
4106
4107 static void collect_sid_memberships(NT_USER_TOKEN *token, DOM_SID sid)
4108 {
4109 int i;
4110
4111 for (i=0; i<num_server_aliases; i++) {
4112 if (is_alias_member(&sid, &server_aliases[i]))
4113 add_sid_to_token(token, &server_aliases[i].sid);
4114 }
4115 }
4116
4117 /*
4118 * We got a user token with all the SIDs we can know about without asking the
4119 * server directly. These are the user and domain group sids. All of these can
4120 * be members of aliases. So scan the list of aliases for each of the SIDs and
4121 * add them to the token.
4122 */
4123
4124 static void collect_alias_memberships(NT_USER_TOKEN *token)
4125 {
4126 int num_global_sids = token->num_sids;
4127 int i;
4128
4129 for (i=0; i<num_global_sids; i++) {
4130 collect_sid_memberships(token, token->user_sids[i]);
4131 }
4132 }
4133
4134 static bool get_user_sids(const char *domain, const char *user, NT_USER_TOKEN *token)
4135 {
4136 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4137 enum wbcSidType type;
4138 fstring full_name;
4139 struct wbcDomainSid wsid;
4140 char *sid_str = NULL;
4141 DOM_SID user_sid;
4142 uint32_t num_groups;
4143 gid_t *groups = NULL;
4144 uint32_t i;
4145
4146 fstr_sprintf(full_name, "%s%c%s",
4147 domain, *lp_winbind_separator(), user);
4148
4149 /* First let's find out the user sid */
4150
4151 wbc_status = wbcLookupName(domain, user, &wsid, &type);
4152
4153 if (!WBC_ERROR_IS_OK(wbc_status)) {
4154 DEBUG(1, ("winbind could not find %s: %s\n",
4155 full_name, wbcErrorString(wbc_status)));
4156 return false;
4157 }
4158
4159 wbc_status = wbcSidToString(&wsid, &sid_str);
4160 if (!WBC_ERROR_IS_OK(wbc_status)) {
4161 return false;
4162 }
4163
4164 if (type != SID_NAME_USER) {
4165 wbcFreeMemory(sid_str);
4166 DEBUG(1, ("%s is not a user\n", full_name));
4167 return false;
4168 }
4169
4170 if (!string_to_sid(&user_sid, sid_str)) {
4171 DEBUG(1,("Could not convert sid %s from string\n", sid_str));
4172 return false;
4173 }
4174
4175 wbcFreeMemory(sid_str);
4176 sid_str = NULL;
4177
4178 init_user_token(token, &user_sid);
4179
4180 /* And now the groups winbind knows about */
4181
4182 wbc_status = wbcGetGroups(full_name, &num_groups, &groups);
4183 if (!WBC_ERROR_IS_OK(wbc_status)) {
4184 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4185 full_name, wbcErrorString(wbc_status)));
4186 return false;
4187 }
4188
4189 for (i = 0; i < num_groups; i++) {
4190 gid_t gid = groups[i];
4191 DOM_SID sid;
4192
4193 wbc_status = wbcGidToSid(gid, &wsid);
4194 if (!WBC_ERROR_IS_OK(wbc_status)) {
4195 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4196 (unsigned int)gid, wbcErrorString(wbc_status)));
4197 wbcFreeMemory(groups);
4198 return false;
4199 }
4200
4201 wbc_status = wbcSidToString(&wsid, &sid_str);
4202 if (!WBC_ERROR_IS_OK(wbc_status)) {
4203 wbcFreeMemory(groups);
4204 return false;
4205 }
4206
4207 DEBUG(3, (" %s\n", sid_str));
4208
4209 string_to_sid(&sid, sid_str);
4210 wbcFreeMemory(sid_str);
4211 sid_str = NULL;
4212
4213 add_sid_to_token(token, &sid);
4214 }
4215 wbcFreeMemory(groups);
4216
4217 return true;
4218 }
4219
4220 /**
4221 * Get a list of all user tokens we want to look at
4222 **/
4223
4224 static bool get_user_tokens(struct net_context *c, int *num_tokens,
4225 struct user_token **user_tokens)
4226 {
4227 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4228 uint32_t i, num_users;
4229 const char **users;
4230 struct user_token *result;
4231 TALLOC_CTX *frame = NULL;
4232
4233 if (lp_winbind_use_default_domain() &&
4234 (c->opt_target_workgroup == NULL)) {
4235 d_fprintf(stderr, _("winbind use default domain = yes set, "
4236 "please specify a workgroup\n"));
4237 return false;
4238 }
4239
4240 /* Send request to winbind daemon */
4241
4242 wbc_status = wbcListUsers(NULL, &num_users, &users);
4243 if (!WBC_ERROR_IS_OK(wbc_status)) {
4244 DEBUG(1, (_("winbind could not list users: %s\n"),
4245 wbcErrorString(wbc_status)));
4246 return false;
4247 }
4248
4249 result = SMB_MALLOC_ARRAY(struct user_token, num_users);
4250
4251 if (result == NULL) {
4252 DEBUG(1, ("Could not malloc sid array\n"));
4253 wbcFreeMemory(users);
4254 return false;
4255 }
4256
4257 frame = talloc_stackframe();
4258 for (i=0; i < num_users; i++) {
4259 fstring domain, user;
4260 char *p;
4261
4262 fstrcpy(result[i].name, users[i]);
4263
4264 p = strchr(users[i], *lp_winbind_separator());
4265
4266 DEBUG(3, ("%s\n", users[i]));
4267
4268 if (p == NULL) {
4269 fstrcpy(domain, c->opt_target_workgroup);
4270 fstrcpy(user, users[i]);
4271 } else {
4272 *p++ = '\0';
4273 fstrcpy(domain, users[i]);
4274 strupper_m(domain);
4275 fstrcpy(user, p);
4276 }
4277
4278 get_user_sids(domain, user, &(result[i].token));
4279 i+=1;
4280 }
4281 TALLOC_FREE(frame);
4282 wbcFreeMemory(users);
4283
4284 *num_tokens = num_users;
4285 *user_tokens = result;
4286
4287 return true;
4288 }
4289
4290 static bool get_user_tokens_from_file(FILE *f,
4291 int *num_tokens,
4292 struct user_token **tokens)
4293 {
4294 struct user_token *token = NULL;
4295
4296 while (!feof(f)) {
4297 fstring line;
4298
4299 if (fgets(line, sizeof(line)-1, f) == NULL) {
4300 return true;
4301 }
4302
4303 if ((strlen(line) > 0) && (line[strlen(line)-1] == '\n')) {
4304 line[strlen(line)-1] = '\0';
4305 }
4306
4307 if (line[0] == ' ') {
4308 /* We have a SID */
4309
4310 DOM_SID sid;
4311 if(!string_to_sid(&sid, &line[1])) {
4312 DEBUG(1,("get_user_tokens_from_file: Could "
4313 "not convert sid %s \n",&line[1]));
4314 return false;
4315 }
4316
4317 if (token == NULL) {
4318 DEBUG(0, ("File does not begin with username"));
4319 return false;
4320 }
4321
4322 add_sid_to_token(&token->token, &sid);
4323 continue;
4324 }
4325
4326 /* And a new user... */
4327
4328 *num_tokens += 1;
4329 *tokens = SMB_REALLOC_ARRAY(*tokens, struct user_token, *num_tokens);
4330 if (*tokens == NULL) {
4331 DEBUG(0, ("Could not realloc tokens\n"));
4332 return false;
4333 }
4334
4335 token = &((*tokens)[*num_tokens-1]);
4336
4337 fstrcpy(token->name, line);
4338 token->token.num_sids = 0;
4339 token->token.user_sids = NULL;
4340 continue;
4341 }
4342
4343 return false;
4344 }
4345
4346
4347 /*
4348 * Show the list of all users that have access to a share
4349 */
4350
4351 static void show_userlist(struct rpc_pipe_client *pipe_hnd,
4352 TALLOC_CTX *mem_ctx,
4353 const char *netname,
4354 int num_tokens,
4355 struct user_token *tokens)
4356 {
4357 uint16_t fnum;
4358 SEC_DESC *share_sd = NULL;
4359 SEC_DESC *root_sd = NULL;
4360 struct cli_state *cli = rpc_pipe_np_smb_conn(pipe_hnd);
4361 int i;
4362 union srvsvc_NetShareInfo info;
4363 WERROR result;
4364 NTSTATUS status;
4365 uint16 cnum;
4366
4367 status = rpccli_srvsvc_NetShareGetInfo(pipe_hnd, mem_ctx,
4368 pipe_hnd->desthost,
4369 netname,
4370 502,
4371 &info,
4372 &result);
4373
4374 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
4375 DEBUG(1, ("Coult not query secdesc for share %s\n",
4376 netname));
4377 return;
4378 }
4379
4380 share_sd = info.info502->sd_buf.sd;
4381 if (share_sd == NULL) {
4382 DEBUG(1, ("Got no secdesc for share %s\n",
4383 netname));
4384 }
4385
4386 cnum = cli->cnum;
4387
4388 if (!NT_STATUS_IS_OK(cli_tcon_andx(cli, netname, "A:", "", 0))) {
4389 return;
4390 }
4391
4392 if (!NT_STATUS_IS_OK(cli_ntcreate(cli, "\\", 0, READ_CONTROL_ACCESS, 0,
4393 FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
4394 root_sd = cli_query_secdesc(cli, fnum, mem_ctx);
4395 }
4396
4397 for (i=0; i<num_tokens; i++) {
4398 uint32 acc_granted;
4399
4400 if (share_sd != NULL) {
4401 status = se_access_check(share_sd, &tokens[i].token,
4402 1, &acc_granted);
4403
4404 if (!NT_STATUS_IS_OK(status)) {
4405 DEBUG(1, ("Could not check share_sd for "
4406 "user %s\n",
4407 tokens[i].name));
4408 continue;
4409 }
4410 }
4411
4412 if (root_sd == NULL) {
4413 d_printf(" %s\n", tokens[i].name);
4414 continue;
4415 }
4416
4417 status = se_access_check(root_sd, &tokens[i].token,
4418 1, &acc_granted);
4419 if (!NT_STATUS_IS_OK(status)) {
4420 DEBUG(1, ("Could not check root_sd for user %s\n",
4421 tokens[i].name));
4422 continue;
4423 }
4424 d_printf(" %s\n", tokens[i].name);
4425 }
4426
4427 if (fnum != (uint16_t)-1)
4428 cli_close(cli, fnum);
4429 cli_tdis(cli);
4430 cli->cnum = cnum;
4431
4432 return;
4433 }
4434
4435 struct share_list {
4436 int num_shares;
4437 char **shares;
4438 };
4439
4440 static void collect_share(const char *name, uint32 m,
4441 const char *comment, void *state)
4442 {
4443 struct share_list *share_list = (struct share_list *)state;
4444
4445 if (m != STYPE_DISKTREE)
4446 return;
4447
4448 share_list->num_shares += 1;
4449 share_list->shares = SMB_REALLOC_ARRAY(share_list->shares, char *, share_list->num_shares);
4450 if (!share_list->shares) {
4451 share_list->num_shares = 0;
4452 return;
4453 }
4454 share_list->shares[share_list->num_shares-1] = SMB_STRDUP(name);
4455 }
4456
4457 /**
4458 * List shares on a remote RPC server, including the security descriptors.
4459 *
4460 * All parameters are provided by the run_rpc_command function, except for
4461 * argc, argv which are passed through.
4462 *
4463 * @param domain_sid The domain sid acquired from the remote server.
4464 * @param cli A cli_state connected to the server.
4465 * @param mem_ctx Talloc context, destroyed on completion of the function.
4466 * @param argc Standard main() style argc.
4467 * @param argv Standard main() style argv. Initial components are already
4468 * stripped.
4469 *
4470 * @return Normal NTSTATUS return.
4471 **/
4472
4473 static NTSTATUS rpc_share_allowedusers_internals(struct net_context *c,
4474 const DOM_SID *domain_sid,
4475 const char *domain_name,
4476 struct cli_state *cli,
4477 struct rpc_pipe_client *pipe_hnd,
4478 TALLOC_CTX *mem_ctx,
4479 int argc,
4480 const char **argv)
4481 {
4482 int ret;
4483 bool r;
4484 uint32 i;
4485 FILE *f;
4486
4487 struct user_token *tokens = NULL;
4488 int num_tokens = 0;
4489
4490 struct share_list share_list;
4491
4492 if (argc == 0) {
4493 f = stdin;
4494 } else {
4495 f = fopen(argv[0], "r");
4496 }
4497
4498 if (f == NULL) {
4499 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno)));
4500 return NT_STATUS_UNSUCCESSFUL;
4501 }
4502
4503 r = get_user_tokens_from_file(f, &num_tokens, &tokens);
4504
4505 if (f != stdin)
4506 fclose(f);
4507
4508 if (!r) {
4509 DEBUG(0, ("Could not read users from file\n"));
4510 return NT_STATUS_UNSUCCESSFUL;
4511 }
4512
4513 for (i=0; i<num_tokens; i++)
4514 collect_alias_memberships(&tokens[i].token);
4515
4516 share_list.num_shares = 0;
4517 share_list.shares = NULL;
4518
4519 ret = cli_RNetShareEnum(cli, collect_share, &share_list);
4520
4521 if (ret == -1) {
4522 DEBUG(0, ("Error returning browse list: %s\n",
4523 cli_errstr(cli)));
4524 goto done;
4525 }
4526
4527 for (i = 0; i < share_list.num_shares; i++) {
4528 char *netname = share_list.shares[i];
4529
4530 if (netname[strlen(netname)-1] == '$')
4531 continue;
4532
4533 d_printf("%s\n", netname);
4534
4535 show_userlist(pipe_hnd, mem_ctx, netname,
4536 num_tokens, tokens);
4537 }
4538 done:
4539 for (i=0; i<num_tokens; i++) {
4540 free_user_token(&tokens[i].token);
4541 }
4542 SAFE_FREE(tokens);
4543 SAFE_FREE(share_list.shares);
4544
4545 return NT_STATUS_OK;
4546 }
4547
4548 static int rpc_share_allowedusers(struct net_context *c, int argc,
4549 const char **argv)
4550 {
4551 int result;
4552
4553 if (c->display_usage) {
4554 d_printf( "%s\n"
4555 "net rpc share allowedusers\n"
4556 " %s\n",
4557 _("Usage:"),
4558 _("List allowed users"));
4559 return 0;
4560 }
4561
4562 result = run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
4563 rpc_aliaslist_internals,
4564 argc, argv);
4565 if (result != 0)
4566 return result;
4567
4568 result = run_rpc_command(c, NULL, &ndr_table_lsarpc.syntax_id, 0,
4569 rpc_aliaslist_dump,
4570 argc, argv);
4571 if (result != 0)
4572 return result;
4573
4574 return run_rpc_command(c, NULL, &ndr_table_srvsvc.syntax_id, 0,
4575 rpc_share_allowedusers_internals,
4576 argc, argv);
4577 }
4578
4579 int net_usersidlist(struct net_context *c, int argc, const char **argv)
4580 {
4581 int num_tokens = 0;
4582 struct user_token *tokens = NULL;
4583 int i;
4584
4585 if (argc != 0) {
4586 net_usersidlist_usage(c, argc, argv);
4587 return 0;
4588 }
4589
4590 if (!get_user_tokens(c, &num_tokens, &tokens)) {
4591 DEBUG(0, ("Could not get the user/sid list\n"));
4592 return 0;
4593 }
4594
4595 for (i=0; i<num_tokens; i++) {
4596 dump_user_token(&tokens[i]);
4597 free_user_token(&tokens[i].token);
4598 }
4599
4600 SAFE_FREE(tokens);
4601 return 1;
4602 }
4603
4604 int net_usersidlist_usage(struct net_context *c, int argc, const char **argv)
4605 {
4606 d_printf(_("net usersidlist\n"
4607 "\tprints out a list of all users the running winbind knows\n"
4608 "\tabout, together with all their SIDs. This is used as\n"
4609 "\tinput to the 'net rpc share allowedusers' command.\n\n"));
4610
4611 net_common_flags_usage(c, argc, argv);
4612 return -1;
4613 }
4614
4615 /**
4616 * 'net rpc share' entrypoint.
4617 * @param argc Standard main() style argc.
4618 * @param argv Standard main() style argv. Initial components are already
4619 * stripped.
4620 **/
4621
4622 int net_rpc_share(struct net_context *c, int argc, const char **argv)
4623 {
4624 NET_API_STATUS status;
4625
4626 struct functable func[] = {
4627 {
4628 "add",
4629 rpc_share_add,
4630 NET_TRANSPORT_RPC,
4631 N_("Add share"),
4632 N_("net rpc share add\n"
4633 " Add share")
4634 },
4635 {
4636 "delete",
4637 rpc_share_delete,
4638 NET_TRANSPORT_RPC,
4639 N_("Remove share"),
4640 N_("net rpc share delete\n"
4641 " Remove share")
4642 },
4643 {
4644 "allowedusers",
4645 rpc_share_allowedusers,
4646 NET_TRANSPORT_RPC,
4647 N_("Modify allowed users"),
4648 N_("net rpc share allowedusers\n"
4649 " Modify allowed users")
4650 },
4651 {
4652 "migrate",
4653 rpc_share_migrate,
4654 NET_TRANSPORT_RPC,
4655 N_("Migrate share to local server"),
4656 N_("net rpc share migrate\n"
4657 " Migrate share to local server")
4658 },
4659 {
4660 "list",
4661 rpc_share_list,
4662 NET_TRANSPORT_RPC,
4663 N_("List shares"),
4664 N_("net rpc share list\n"
4665 " List shares")
4666 },
4667 {NULL, NULL, 0, NULL, NULL}
4668 };
4669
4670 status = libnetapi_init(&c->netapi_ctx);
4671 if (status != 0) {
4672 return -1;
4673 }
4674 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
4675 libnetapi_set_password(c->netapi_ctx, c->opt_password);
4676 if (c->opt_kerberos) {
4677 libnetapi_set_use_kerberos(c->netapi_ctx);
4678 }
4679
4680 if (argc == 0) {
4681 if (c->display_usage) {
4682 d_printf("%s\n%s",
4683 _("Usage:"),
4684 _("net rpc share\n"
4685 " List shares\n"
4686 " Alias for net rpc share list\n"));
4687 net_display_usage_from_functable(func);
4688 return 0;
4689 }
4690
4691 return rpc_share_list(c, argc, argv);
4692 }
4693
4694 return net_run_function(c, argc, argv, "net rpc share", func);
4695 }
4696
4697 static NTSTATUS rpc_sh_share_list(struct net_context *c,
4698 TALLOC_CTX *mem_ctx,
4699 struct rpc_sh_ctx *ctx,
4700 struct rpc_pipe_client *pipe_hnd,
4701 int argc, const char **argv)
4702 {
4703
4704 return werror_to_ntstatus(W_ERROR(rpc_share_list(c, argc, argv)));
4705 }
4706
4707 static NTSTATUS rpc_sh_share_add(struct net_context *c,
4708 TALLOC_CTX *mem_ctx,
4709 struct rpc_sh_ctx *ctx,
4710 struct rpc_pipe_client *pipe_hnd,
4711 int argc, const char **argv)
4712 {
4713 NET_API_STATUS status;
4714 uint32_t parm_err = 0;
4715 struct SHARE_INFO_2 i2;
4716
4717 if ((argc < 2) || (argc > 3)) {
4718 d_fprintf(stderr, _("Usage: %s <share> <path> [comment]\n"),
4719 ctx->whoami);
4720 return NT_STATUS_INVALID_PARAMETER;
4721 }
4722
4723 i2.shi2_netname = argv[0];
4724 i2.shi2_type = STYPE_DISKTREE;
4725 i2.shi2_remark = (argc == 3) ? argv[2] : "";
4726 i2.shi2_permissions = 0;
4727 i2.shi2_max_uses = 0;
4728 i2.shi2_current_uses = 0;
4729 i2.shi2_path = argv[1];
4730 i2.shi2_passwd = NULL;
4731
4732 status = NetShareAdd(pipe_hnd->desthost,
4733 2,
4734 (uint8_t *)&i2,
4735 &parm_err);
4736
4737 return werror_to_ntstatus(W_ERROR(status));
4738 }
4739
4740 static NTSTATUS rpc_sh_share_delete(struct net_context *c,
4741 TALLOC_CTX *mem_ctx,
4742 struct rpc_sh_ctx *ctx,
4743 struct rpc_pipe_client *pipe_hnd,
4744 int argc, const char **argv)
4745 {
4746 if (argc != 1) {
4747 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
4748 return NT_STATUS_INVALID_PARAMETER;
4749 }
4750
4751 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd->desthost, argv[0], 0)));
4752 }
4753
4754 static NTSTATUS rpc_sh_share_info(struct net_context *c,
4755 TALLOC_CTX *mem_ctx,
4756 struct rpc_sh_ctx *ctx,
4757 struct rpc_pipe_client *pipe_hnd,
4758 int argc, const char **argv)
4759 {
4760 union srvsvc_NetShareInfo info;
4761 WERROR result;
4762 NTSTATUS status;
4763
4764 if (argc != 1) {
4765 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
4766 return NT_STATUS_INVALID_PARAMETER;
4767 }
4768
4769 status = rpccli_srvsvc_NetShareGetInfo(pipe_hnd, mem_ctx,
4770 pipe_hnd->desthost,
4771 argv[0],
4772 2,
4773 &info,
4774 &result);
4775 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
4776 goto done;
4777 }
4778
4779 d_printf(_("Name: %s\n"), info.info2->name);
4780 d_printf(_("Comment: %s\n"), info.info2->comment);
4781 d_printf(_("Path: %s\n"), info.info2->path);
4782 d_printf(_("Password: %s\n"), info.info2->password);
4783
4784 done:
4785 return werror_to_ntstatus(result);
4786 }
4787
4788 struct rpc_sh_cmd *net_rpc_share_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
4789 struct rpc_sh_ctx *ctx)
4790 {
4791 static struct rpc_sh_cmd cmds[] = {
4792
4793 { "list", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_list,
4794 N_("List available shares") },
4795
4796 { "add", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_add,
4797 N_("Add a share") },
4798
4799 { "delete", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_delete,
4800 N_("Delete a share") },
4801
4802 { "info", NULL, &ndr_table_srvsvc.syntax_id, rpc_sh_share_info,
4803 N_("Get information about a share") },
4804
4805 { NULL, NULL, 0, NULL, NULL }
4806 };
4807
4808 return cmds;
4809 }
4810
4811 /****************************************************************************/
4812
4813 static int rpc_file_usage(struct net_context *c, int argc, const char **argv)
4814 {
4815 return net_file_usage(c, argc, argv);
4816 }
4817
4818 /**
4819 * Close a file on a remote RPC server.
4820 *
4821 * @param argc Standard main() style argc.
4822 * @param argv Standard main() style argv. Initial components are already
4823 * stripped.
4824 *
4825 * @return A shell status integer (0 for success).
4826 **/
4827 static int rpc_file_close(struct net_context *c, int argc, const char **argv)
4828 {
4829 if (argc < 1 || c->display_usage) {
4830 return rpc_file_usage(c, argc, argv);
4831 }
4832
4833 return NetFileClose(c->opt_host, atoi(argv[0]));
4834 }
4835
4836 /**
4837 * Formatted print of open file info
4838 *
4839 * @param r struct FILE_INFO_3 contents
4840 **/
4841
4842 static void display_file_info_3(struct FILE_INFO_3 *r)
4843 {
4844 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
4845 r->fi3_id, r->fi3_username, r->fi3_permissions,
4846 r->fi3_num_locks, r->fi3_pathname);
4847 }
4848
4849 /**
4850 * List files for a user on a remote RPC server.
4851 *
4852 * @param argc Standard main() style argc.
4853 * @param argv Standard main() style argv. Initial components are already
4854 * stripped.
4855 *
4856 * @return A shell status integer (0 for success)..
4857 **/
4858
4859 static int rpc_file_user(struct net_context *c, int argc, const char **argv)
4860 {
4861 NET_API_STATUS status;
4862 uint32 preferred_len = 0xffffffff, i;
4863 const char *username=NULL;
4864 uint32_t total_entries = 0;
4865 uint32_t entries_read = 0;
4866 uint32_t resume_handle = 0;
4867 struct FILE_INFO_3 *i3 = NULL;
4868
4869 if (c->display_usage) {
4870 return rpc_file_usage(c, argc, argv);
4871 }
4872
4873 /* if argc > 0, must be user command */
4874 if (argc > 0) {
4875 username = smb_xstrdup(argv[0]);
4876 }
4877
4878 status = NetFileEnum(c->opt_host,
4879 NULL,
4880 username,
4881 3,
4882 (uint8_t **)(void *)&i3,
4883 preferred_len,
4884 &entries_read,
4885 &total_entries,
4886 &resume_handle);
4887
4888 if (status != 0) {
4889 goto done;
4890 }
4891
4892 /* Display results */
4893
4894 d_printf(_(
4895 "\nEnumerating open files on remote server:\n\n"
4896 "\nFileId Opened by Perms Locks Path"
4897 "\n------ --------- ----- ----- ---- \n"));
4898 for (i = 0; i < entries_read; i++) {
4899 display_file_info_3(&i3[i]);
4900 }
4901 done:
4902 return status;
4903 }
4904
4905 /**
4906 * 'net rpc file' entrypoint.
4907 * @param argc Standard main() style argc.
4908 * @param argv Standard main() style argv. Initial components are already
4909 * stripped.
4910 **/
4911
4912 int net_rpc_file(struct net_context *c, int argc, const char **argv)
4913 {
4914 NET_API_STATUS status;
4915
4916 struct functable func[] = {
4917 {
4918 "close",
4919 rpc_file_close,
4920 NET_TRANSPORT_RPC,
4921 N_("Close opened file"),
4922 N_("net rpc file close\n"
4923 " Close opened file")
4924 },
4925 {
4926 "user",
4927 rpc_file_user,
4928 NET_TRANSPORT_RPC,
4929 N_("List files opened by user"),
4930 N_("net rpc file user\n"
4931 " List files opened by user")
4932 },
4933 #if 0
4934 {
4935 "info",
4936 rpc_file_info,
4937 NET_TRANSPORT_RPC,
4938 N_("Display information about opened file"),
4939 N_("net rpc file info\n"
4940 " Display information about opened file")
4941 },
4942 #endif
4943 {NULL, NULL, 0, NULL, NULL}
4944 };
4945
4946 status = libnetapi_init(&c->netapi_ctx);
4947 if (status != 0) {
4948 return -1;
4949 }
4950 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
4951 libnetapi_set_password(c->netapi_ctx, c->opt_password);
4952 if (c->opt_kerberos) {
4953 libnetapi_set_use_kerberos(c->netapi_ctx);
4954 }
4955
4956 if (argc == 0) {
4957 if (c->display_usage) {
4958 d_printf(_("Usage:\n"));
4959 d_printf(_("net rpc file\n"
4960 " List opened files\n"));
4961 net_display_usage_from_functable(func);
4962 return 0;
4963 }
4964
4965 return rpc_file_user(c, argc, argv);
4966 }
4967
4968 return net_run_function(c, argc, argv, "net rpc file", func);
4969 }
4970
4971 /**
4972 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
4973 *
4974 * All parameters are provided by the run_rpc_command function, except for
4975 * argc, argv which are passed through.
4976 *
4977 * @param c A net_context structure.
4978 * @param domain_sid The domain sid acquired from the remote server.
4979 * @param cli A cli_state connected to the server.
4980 * @param mem_ctx Talloc context, destroyed on completion of the function.
4981 * @param argc Standard main() style argc.
4982 * @param argv Standard main() style argv. Initial components are already
4983 * stripped.
4984 *
4985 * @return Normal NTSTATUS return.
4986 **/
4987
4988 static NTSTATUS rpc_shutdown_abort_internals(struct net_context *c,
4989 const DOM_SID *domain_sid,
4990 const char *domain_name,
4991 struct cli_state *cli,
4992 struct rpc_pipe_client *pipe_hnd,
4993 TALLOC_CTX *mem_ctx,
4994 int argc,
4995 const char **argv)
4996 {
4997 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
4998
4999 result = rpccli_initshutdown_Abort(pipe_hnd, mem_ctx, NULL, NULL);
5000
5001 if (NT_STATUS_IS_OK(result)) {
5002 d_printf(_("\nShutdown successfully aborted\n"));
5003 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
5004 } else
5005 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
5006
5007 return result;
5008 }
5009
5010 /**
5011 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
5012 *
5013 * All parameters are provided by the run_rpc_command function, except for
5014 * argc, argv which are passed through.
5015 *
5016 * @param c A net_context structure.
5017 * @param domain_sid The domain sid acquired from the remote server.
5018 * @param cli A cli_state connected to the server.
5019 * @param mem_ctx Talloc context, destroyed on completion of the function.
5020 * @param argc Standard main() style argc.
5021 * @param argv Standard main() style argv. Initial components are already
5022 * stripped.
5023 *
5024 * @return Normal NTSTATUS return.
5025 **/
5026
5027 static NTSTATUS rpc_reg_shutdown_abort_internals(struct net_context *c,
5028 const DOM_SID *domain_sid,
5029 const char *domain_name,
5030 struct cli_state *cli,
5031 struct rpc_pipe_client *pipe_hnd,
5032 TALLOC_CTX *mem_ctx,
5033 int argc,
5034 const char **argv)
5035 {
5036 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5037
5038 result = rpccli_winreg_AbortSystemShutdown(pipe_hnd, mem_ctx, NULL, NULL);
5039
5040 if (NT_STATUS_IS_OK(result)) {
5041 d_printf(_("\nShutdown successfully aborted\n"));
5042 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
5043 } else
5044 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5045
5046 return result;
5047 }
5048
5049 /**
5050 * ABORT the shutdown of a remote RPC server.
5051 *
5052 * @param argc Standard main() style argc.
5053 * @param argv Standard main() style argv. Initial components are already
5054 * stripped.
5055 *
5056 * @return A shell status integer (0 for success).
5057 **/
5058
5059 static int rpc_shutdown_abort(struct net_context *c, int argc,
5060 const char **argv)
5061 {
5062 int rc = -1;
5063
5064 if (c->display_usage) {
5065 d_printf( "%s\n"
5066 "net rpc abortshutdown\n"
5067 " %s\n",
5068 _("Usage:"),
5069 _("Abort a scheduled shutdown"));
5070 return 0;
5071 }
5072
5073 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown.syntax_id, 0,
5074 rpc_shutdown_abort_internals, argc, argv);
5075
5076 if (rc == 0)
5077 return rc;
5078
5079 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5080
5081 return run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
5082 rpc_reg_shutdown_abort_internals,
5083 argc, argv);
5084 }
5085
5086 /**
5087 * Shut down a remote RPC Server via initshutdown pipe.
5088 *
5089 * All parameters are provided by the run_rpc_command function, except for
5090 * argc, argv which are passed through.
5091 *
5092 * @param c A net_context structure.
5093 * @param domain_sid The domain sid acquired from the remote server.
5094 * @param cli A cli_state connected to the server.
5095 * @param mem_ctx Talloc context, destroyed on completion of the function.
5096 * @param argc Standard main() style argc.
5097 * @param argv Standard main() style argv. Initial components are already
5098 * stripped.
5099 *
5100 * @return Normal NTSTATUS return.
5101 **/
5102
5103 NTSTATUS rpc_init_shutdown_internals(struct net_context *c,
5104 const DOM_SID *domain_sid,
5105 const char *domain_name,
5106 struct cli_state *cli,
5107 struct rpc_pipe_client *pipe_hnd,
5108 TALLOC_CTX *mem_ctx,
5109 int argc,
5110 const char **argv)
5111 {
5112 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5113 const char *msg = N_("This machine will be shutdown shortly");
5114 uint32 timeout = 20;
5115 struct lsa_StringLarge msg_string;
5116
5117 if (c->opt_comment) {
5118 msg = c->opt_comment;
5119 }
5120 if (c->opt_timeout) {
5121 timeout = c->opt_timeout;
5122 }
5123
5124 msg_string.string = msg;
5125
5126 /* create an entry */
5127 result = rpccli_initshutdown_Init(pipe_hnd, mem_ctx, NULL,
5128 &msg_string, timeout, c->opt_force, c->opt_reboot,
5129 NULL);
5130
5131 if (NT_STATUS_IS_OK(result)) {
5132 d_printf(_("\nShutdown of remote machine succeeded\n"));
5133 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5134 } else {
5135 DEBUG(1,("Shutdown of remote machine failed!\n"));
5136 }
5137 return result;
5138 }
5139
5140 /**
5141 * Shut down a remote RPC Server via winreg pipe.
5142 *
5143 * All parameters are provided by the run_rpc_command function, except for
5144 * argc, argv which are passed through.
5145 *
5146 * @param c A net_context structure.
5147 * @param domain_sid The domain sid acquired from the remote server.
5148 * @param cli A cli_state connected to the server.
5149 * @param mem_ctx Talloc context, destroyed on completion of the function.
5150 * @param argc Standard main() style argc.
5151 * @param argv Standard main() style argv. Initial components are already
5152 * stripped.
5153 *
5154 * @return Normal NTSTATUS return.
5155 **/
5156
5157 NTSTATUS rpc_reg_shutdown_internals(struct net_context *c,
5158 const DOM_SID *domain_sid,
5159 const char *domain_name,
5160 struct cli_state *cli,
5161 struct rpc_pipe_client *pipe_hnd,
5162 TALLOC_CTX *mem_ctx,
5163 int argc,
5164 const char **argv)
5165 {
5166 const char *msg = N_("This machine will be shutdown shortly");
5167 uint32 timeout = 20;
5168 struct lsa_StringLarge msg_string;
5169 NTSTATUS result;
5170 WERROR werr;
5171
5172 if (c->opt_comment) {
5173 msg = c->opt_comment;
5174 }
5175 msg_string.string = msg;
5176
5177 if (c->opt_timeout) {
5178 timeout = c->opt_timeout;
5179 }
5180
5181 /* create an entry */
5182 result = rpccli_winreg_InitiateSystemShutdown(pipe_hnd, mem_ctx, NULL,
5183 &msg_string, timeout, c->opt_force, c->opt_reboot,
5184 &werr);
5185
5186 if (NT_STATUS_IS_OK(result)) {
5187 d_printf(_("\nShutdown of remote machine succeeded\n"));
5188 } else {
5189 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5190 if ( W_ERROR_EQUAL(werr, WERR_MACHINE_LOCKED) )
5191 d_fprintf(stderr, "\nMachine locked, use -f switch to force\n");
5192 else
5193 d_fprintf(stderr, "\nresult was: %s\n", win_errstr(werr));
5194 }
5195
5196 return result;
5197 }
5198
5199 /**
5200 * Shut down a remote RPC server.
5201 *
5202 * @param argc Standard main() style argc.
5203 * @param argv Standard main() style argv. Initial components are already
5204 * stripped.
5205 *
5206 * @return A shell status integer (0 for success).
5207 **/
5208
5209 static int rpc_shutdown(struct net_context *c, int argc, const char **argv)
5210 {
5211 int rc = -1;
5212
5213 if (c->display_usage) {
5214 d_printf( "%s\n"
5215 "net rpc shutdown\n"
5216 " %s\n",
5217 _("Usage:"),
5218 _("Shut down a remote RPC server"));
5219 return 0;
5220 }
5221
5222 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown.syntax_id, 0,
5223 rpc_init_shutdown_internals, argc, argv);
5224
5225 if (rc) {
5226 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5227 rc = run_rpc_command(c, NULL, &ndr_table_winreg.syntax_id, 0,
5228 rpc_reg_shutdown_internals, argc, argv);
5229 }
5230
5231 return rc;
5232 }
5233
5234 /***************************************************************************
5235 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5236 ***************************************************************************/
5237
5238 /**
5239 * Add interdomain trust account to the RPC server.
5240 * All parameters (except for argc and argv) are passed by run_rpc_command
5241 * function.
5242 *
5243 * @param c A net_context structure.
5244 * @param domain_sid The domain sid acquired from the server.
5245 * @param cli A cli_state connected to the server.
5246 * @param mem_ctx Talloc context, destroyed on completion of the function.
5247 * @param argc Standard main() style argc.
5248 * @param argv Standard main() style argv. Initial components are already
5249 * stripped.
5250 *
5251 * @return normal NTSTATUS return code.
5252 */
5253
5254 static NTSTATUS rpc_trustdom_add_internals(struct net_context *c,
5255 const DOM_SID *domain_sid,
5256 const char *domain_name,
5257 struct cli_state *cli,
5258 struct rpc_pipe_client *pipe_hnd,
5259 TALLOC_CTX *mem_ctx,
5260 int argc,
5261 const char **argv)
5262 {
5263 struct policy_handle connect_pol, domain_pol, user_pol;
5264 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5265 char *acct_name;
5266 struct lsa_String lsa_acct_name;
5267 uint32 acb_info;
5268 uint32 acct_flags=0;
5269 uint32 user_rid;
5270 uint32_t access_granted = 0;
5271 union samr_UserInfo info;
5272 unsigned int orig_timeout;
5273
5274 if (argc != 2) {
5275 d_printf("%s\n%s",
5276 _("Usage:"),
5277 _(" net rpc trustdom add <domain_name> "
5278 "<trust password>\n"));
5279 return NT_STATUS_INVALID_PARAMETER;
5280 }
5281
5282 /*
5283 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5284 */
5285
5286 if (asprintf(&acct_name, "%s$", argv[0]) < 0) {
5287 return NT_STATUS_NO_MEMORY;
5288 }
5289
5290 strupper_m(acct_name);
5291
5292 init_lsa_String(&lsa_acct_name, acct_name);
5293
5294 /* Get samr policy handle */
5295 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
5296 pipe_hnd->desthost,
5297 MAXIMUM_ALLOWED_ACCESS,
5298 &connect_pol);
5299 if (!NT_STATUS_IS_OK(result)) {
5300 goto done;
5301 }
5302
5303 /* Get domain policy handle */
5304 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
5305 &connect_pol,
5306 MAXIMUM_ALLOWED_ACCESS,
5307 CONST_DISCARD(struct dom_sid2 *, domain_sid),
5308 &domain_pol);
5309 if (!NT_STATUS_IS_OK(result)) {
5310 goto done;
5311 }
5312
5313 /* This call can take a long time - allow the server to time out.
5314 * 35 seconds should do it. */
5315
5316 orig_timeout = rpccli_set_timeout(pipe_hnd, 35000);
5317
5318 /* Create trusting domain's account */
5319 acb_info = ACB_NORMAL;
5320 acct_flags = SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
5321 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
5322 SAMR_USER_ACCESS_SET_PASSWORD |
5323 SAMR_USER_ACCESS_GET_ATTRIBUTES |
5324 SAMR_USER_ACCESS_SET_ATTRIBUTES;
5325
5326 result = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
5327 &domain_pol,
5328 &lsa_acct_name,
5329 acb_info,
5330 acct_flags,
5331 &user_pol,
5332 &access_granted,
5333 &user_rid);
5334
5335 /* And restore our original timeout. */
5336 rpccli_set_timeout(pipe_hnd, orig_timeout);
5337
5338 if (!NT_STATUS_IS_OK(result)) {
5339 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
5340 acct_name, nt_errstr(result));
5341 goto done;
5342 }
5343
5344 {
5345 struct samr_CryptPassword crypt_pwd;
5346
5347 ZERO_STRUCT(info.info23);
5348
5349 init_samr_CryptPassword(argv[1],
5350 &cli->user_session_key,
5351 &crypt_pwd);
5352
5353 info.info23.info.fields_present = SAMR_FIELD_ACCT_FLAGS |
5354 SAMR_FIELD_NT_PASSWORD_PRESENT;
5355 info.info23.info.acct_flags = ACB_DOMTRUST;
5356 info.info23.password = crypt_pwd;
5357
5358 result = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
5359 &user_pol,
5360 23,
5361 &info);
5362
5363 if (!NT_STATUS_IS_OK(result)) {
5364 DEBUG(0,("Could not set trust account password: %s\n",
5365 nt_errstr(result)));
5366 goto done;
5367 }
5368 }
5369
5370 done:
5371 SAFE_FREE(acct_name);
5372 return result;
5373 }
5374
5375 /**
5376 * Create interdomain trust account for a remote domain.
5377 *
5378 * @param argc Standard argc.
5379 * @param argv Standard argv without initial components.
5380 *
5381 * @return Integer status (0 means success).
5382 **/
5383
5384 static int rpc_trustdom_add(struct net_context *c, int argc, const char **argv)
5385 {
5386 if (argc > 0 && !c->display_usage) {
5387 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
5388 rpc_trustdom_add_internals, argc, argv);
5389 } else {
5390 d_printf("%s\n%s",
5391 _("Usage:"),
5392 _("net rpc trustdom add <domain_name> <trust "
5393 "password>\n"));
5394 return -1;
5395 }
5396 }
5397
5398
5399 /**
5400 * Remove interdomain trust account from the RPC server.
5401 * All parameters (except for argc and argv) are passed by run_rpc_command
5402 * function.
5403 *
5404 * @param c A net_context structure.
5405 * @param domain_sid The domain sid acquired from the server.
5406 * @param cli A cli_state connected to the server.
5407 * @param mem_ctx Talloc context, destroyed on completion of the function.
5408 * @param argc Standard main() style argc.
5409 * @param argv Standard main() style argv. Initial components are already
5410 * stripped.
5411 *
5412 * @return normal NTSTATUS return code.
5413 */
5414
5415 static NTSTATUS rpc_trustdom_del_internals(struct net_context *c,
5416 const DOM_SID *domain_sid,
5417 const char *domain_name,
5418 struct cli_state *cli,
5419 struct rpc_pipe_client *pipe_hnd,
5420 TALLOC_CTX *mem_ctx,
5421 int argc,
5422 const char **argv)
5423 {
5424 struct policy_handle connect_pol, domain_pol, user_pol;
5425 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5426 char *acct_name;
5427 DOM_SID trust_acct_sid;
5428 struct samr_Ids user_rids, name_types;
5429 struct lsa_String lsa_acct_name;
5430
5431 if (argc != 1) {
5432 d_printf("%s\n%s",
5433 _("Usage:"),
5434 _(" net rpc trustdom del <domain_name>\n"));
5435 return NT_STATUS_INVALID_PARAMETER;
5436 }
5437
5438 /*
5439 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5440 */
5441 acct_name = talloc_asprintf(mem_ctx, "%s$", argv[0]);
5442
5443 if (acct_name == NULL)
5444 return NT_STATUS_NO_MEMORY;
5445
5446 strupper_m(acct_name);
5447
5448 /* Get samr policy handle */
5449 result = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
5450 pipe_hnd->desthost,
5451 MAXIMUM_ALLOWED_ACCESS,
5452 &connect_pol);
5453 if (!NT_STATUS_IS_OK(result)) {
5454 goto done;
5455 }
5456
5457 /* Get domain policy handle */
5458 result = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
5459 &connect_pol,
5460 MAXIMUM_ALLOWED_ACCESS,
5461 CONST_DISCARD(struct dom_sid2 *, domain_sid),
5462 &domain_pol);
5463 if (!NT_STATUS_IS_OK(result)) {
5464 goto done;
5465 }
5466
5467 init_lsa_String(&lsa_acct_name, acct_name);
5468
5469 result = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
5470 &domain_pol,
5471 1,
5472 &lsa_acct_name,
5473 &user_rids,
5474 &name_types);
5475
5476 if (!NT_STATUS_IS_OK(result)) {
5477 d_printf(_("net rpc trustdom del: LookupNames on user %s "
5478 "failed %s\n"),
5479 acct_name, nt_errstr(result) );
5480 goto done;
5481 }
5482
5483 result = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
5484 &domain_pol,
5485 MAXIMUM_ALLOWED_ACCESS,
5486 user_rids.ids[0],
5487 &user_pol);
5488
5489 if (!NT_STATUS_IS_OK(result)) {
5490 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
5491 "%s\n"),
5492 acct_name, nt_errstr(result) );
5493 goto done;
5494 }
5495
5496 /* append the rid to the domain sid */
5497 sid_copy(&trust_acct_sid, domain_sid);
5498 if (!sid_append_rid(&trust_acct_sid, user_rids.ids[0])) {
5499 goto done;
5500 }
5501
5502 /* remove the sid */
5503
5504 result = rpccli_samr_RemoveMemberFromForeignDomain(pipe_hnd, mem_ctx,
5505 &user_pol,
5506 &trust_acct_sid);
5507 if (!NT_STATUS_IS_OK(result)) {
5508 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
5509 " on user %s failed %s\n"),
5510 acct_name, nt_errstr(result) );
5511 goto done;
5512 }
5513
5514 /* Delete user */
5515
5516 result = rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
5517 &user_pol);
5518
5519 if (!NT_STATUS_IS_OK(result)) {
5520 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
5521 "%s\n"),
5522 acct_name, nt_errstr(result) );
5523 goto done;
5524 }
5525
5526 if (!NT_STATUS_IS_OK(result)) {
5527 d_printf(_("Could not set trust account password: %s\n"),
5528 nt_errstr(result));
5529 goto done;
5530 }
5531
5532 done:
5533 return result;
5534 }
5535
5536 /**
5537 * Delete interdomain trust account for a remote domain.
5538 *
5539 * @param argc Standard argc.
5540 * @param argv Standard argv without initial components.
5541 *
5542 * @return Integer status (0 means success).
5543 **/
5544
5545 static int rpc_trustdom_del(struct net_context *c, int argc, const char **argv)
5546 {
5547 if (argc > 0 && !c->display_usage) {
5548 return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id, 0,
5549 rpc_trustdom_del_internals, argc, argv);
5550 } else {
5551 d_printf("%s\n%s",
5552 _("Usage:"),
5553 _("net rpc trustdom del <domain>\n"));
5554 return -1;
5555 }
5556 }
5557
5558 static NTSTATUS rpc_trustdom_get_pdc(struct net_context *c,
5559 struct cli_state *cli,
5560 TALLOC_CTX *mem_ctx,
5561 const char *domain_name)
5562 {
5563 char *dc_name = NULL;
5564 const char *buffer = NULL;
5565 struct rpc_pipe_client *netr;
5566 NTSTATUS status;
5567
5568 /* Use NetServerEnum2 */
5569
5570 if (cli_get_pdc_name(cli, domain_name, &dc_name)) {
5571 SAFE_FREE(dc_name);
5572 return NT_STATUS_OK;
5573 }
5574
5575 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
5576 for domain %s\n", domain_name));
5577
5578 /* Try netr_GetDcName */
5579
5580 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
5581 &netr);
5582 if (!NT_STATUS_IS_OK(status)) {
5583 return status;
5584 }
5585
5586 status = rpccli_netr_GetDcName(netr, mem_ctx,
5587 cli->desthost,
5588 domain_name,
5589 &buffer,
5590 NULL);
5591 TALLOC_FREE(netr);
5592
5593 if (NT_STATUS_IS_OK(status)) {
5594 return status;
5595 }
5596
5597 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
5598 for domain %s\n", domain_name));
5599
5600 return status;
5601 }
5602
5603 /**
5604 * Establish trust relationship to a trusting domain.
5605 * Interdomain account must already be created on remote PDC.
5606 *
5607 * @param c A net_context structure.
5608 * @param argc Standard argc.
5609 * @param argv Standard argv without initial components.
5610 *
5611 * @return Integer status (0 means success).
5612 **/
5613
5614 static int rpc_trustdom_establish(struct net_context *c, int argc,
5615 const char **argv)
5616 {
5617 struct cli_state *cli = NULL;
5618 struct sockaddr_storage server_ss;
5619 struct rpc_pipe_client *pipe_hnd = NULL;
5620 struct policy_handle connect_hnd;
5621 TALLOC_CTX *mem_ctx;
5622 NTSTATUS nt_status;
5623 DOM_SID *domain_sid;
5624
5625 char* domain_name;
5626 char* acct_name;
5627 fstring pdc_name;
5628 union lsa_PolicyInformation *info = NULL;
5629
5630 /*
5631 * Connect to \\server\ipc$ as 'our domain' account with password
5632 */
5633
5634 if (argc != 1 || c->display_usage) {
5635 d_printf("%s\n%s",
5636 _("Usage:"),
5637 _("net rpc trustdom establish <domain_name>\n"));
5638 return -1;
5639 }
5640
5641 domain_name = smb_xstrdup(argv[0]);
5642 strupper_m(domain_name);
5643
5644 /* account name used at first is our domain's name with '$' */
5645 if (asprintf(&acct_name, "%s$", lp_workgroup()) == -1) {
5646 return -1;
5647 }
5648 strupper_m(acct_name);
5649
5650 /*
5651 * opt_workgroup will be used by connection functions further,
5652 * hence it should be set to remote domain name instead of ours
5653 */
5654 if (c->opt_workgroup) {
5655 c->opt_workgroup = smb_xstrdup(domain_name);
5656 };
5657
5658 c->opt_user_name = acct_name;
5659
5660 /* find the domain controller */
5661 if (!net_find_pdc(&server_ss, pdc_name, domain_name)) {
5662 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name));
5663 return -1;
5664 }
5665
5666 /* connect to ipc$ as username/password */
5667 nt_status = connect_to_ipc(c, &cli, &server_ss, pdc_name);
5668 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
5669
5670 /* Is it trusting domain account for sure ? */
5671 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
5672 nt_errstr(nt_status)));
5673 return -1;
5674 }
5675
5676 /* store who we connected to */
5677
5678 saf_store( domain_name, pdc_name );
5679
5680 /*
5681 * Connect to \\server\ipc$ again (this time anonymously)
5682 */
5683
5684 nt_status = connect_to_ipc_anonymous(c, &cli, &server_ss,
5685 (char*)pdc_name);
5686
5687 if (NT_STATUS_IS_ERR(nt_status)) {
5688 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
5689 domain_name, nt_errstr(nt_status)));
5690 return -1;
5691 }
5692
5693 if (!(mem_ctx = talloc_init("establishing trust relationship to "
5694 "domain %s", domain_name))) {
5695 DEBUG(0, ("talloc_init() failed\n"));
5696 cli_shutdown(cli);
5697 return -1;
5698 }
5699
5700 /* Make sure we're talking to a proper server */
5701
5702 nt_status = rpc_trustdom_get_pdc(c, cli, mem_ctx, domain_name);
5703 if (!NT_STATUS_IS_OK(nt_status)) {
5704 cli_shutdown(cli);
5705 talloc_destroy(mem_ctx);
5706 return -1;
5707 }
5708
5709 /*
5710 * Call LsaOpenPolicy and LsaQueryInfo
5711 */
5712
5713 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
5714 &pipe_hnd);
5715 if (!NT_STATUS_IS_OK(nt_status)) {
5716 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status) ));
5717 cli_shutdown(cli);
5718 talloc_destroy(mem_ctx);
5719 return -1;
5720 }
5721
5722 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true, KEY_QUERY_VALUE,
5723 &connect_hnd);
5724 if (NT_STATUS_IS_ERR(nt_status)) {
5725 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
5726 nt_errstr(nt_status)));
5727 cli_shutdown(cli);
5728 talloc_destroy(mem_ctx);
5729 return -1;
5730 }
5731
5732 /* Querying info level 5 */
5733
5734 nt_status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
5735 &connect_hnd,
5736 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
5737 &info);
5738 if (NT_STATUS_IS_ERR(nt_status)) {
5739 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
5740 nt_errstr(nt_status)));
5741 cli_shutdown(cli);
5742 talloc_destroy(mem_ctx);
5743 return -1;
5744 }
5745
5746 domain_sid = info->account_domain.sid;
5747
5748 /* There should be actually query info level 3 (following nt serv behaviour),
5749 but I still don't know if it's _really_ necessary */
5750
5751 /*
5752 * Store the password in secrets db
5753 */
5754
5755 if (!pdb_set_trusteddom_pw(domain_name, c->opt_password, domain_sid)) {
5756 DEBUG(0, ("Storing password for trusted domain failed.\n"));
5757 cli_shutdown(cli);
5758 talloc_destroy(mem_ctx);
5759 return -1;
5760 }
5761
5762 /*
5763 * Close the pipes and clean up
5764 */
5765
5766 nt_status = rpccli_lsa_Close(pipe_hnd, mem_ctx, &connect_hnd);
5767 if (NT_STATUS_IS_ERR(nt_status)) {
5768 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
5769 nt_errstr(nt_status)));
5770 cli_shutdown(cli);
5771 talloc_destroy(mem_ctx);
5772 return -1;
5773 }
5774
5775 cli_shutdown(cli);
5776
5777 talloc_destroy(mem_ctx);
5778
5779 d_printf(_("Trust to domain %s established\n"), domain_name);
5780 return 0;
5781 }
5782
5783 /**
5784 * Revoke trust relationship to the remote domain.
5785 *
5786 * @param c A net_context structure.
5787 * @param argc Standard argc.
5788 * @param argv Standard argv without initial components.
5789 *
5790 * @return Integer status (0 means success).
5791 **/
5792
5793 static int rpc_trustdom_revoke(struct net_context *c, int argc,
5794 const char **argv)
5795 {
5796 char* domain_name;
5797 int rc = -1;
5798
5799 if (argc < 1 || c->display_usage) {
5800 d_printf("%s\n%s",
5801 _("Usage:"),
5802 _("net rpc trustdom revoke <domain_name>\n"
5803 " Revoke trust relationship\n"
5804 " domain_name\tName of domain to revoke trust\n"));
5805 return -1;
5806 }
5807
5808 /* generate upper cased domain name */
5809 domain_name = smb_xstrdup(argv[0]);
5810 strupper_m(domain_name);
5811
5812 /* delete password of the trust */
5813 if (!pdb_del_trusteddom_pw(domain_name)) {
5814 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
5815 domain_name));
5816 goto done;
5817 };
5818
5819 rc = 0;
5820 done:
5821 SAFE_FREE(domain_name);
5822 return rc;
5823 }
5824
5825 static NTSTATUS rpc_query_domain_sid(struct net_context *c,
5826 const DOM_SID *domain_sid,
5827 const char *domain_name,
5828 struct cli_state *cli,
5829 struct rpc_pipe_client *pipe_hnd,
5830 TALLOC_CTX *mem_ctx,
5831 int argc,
5832 const char **argv)
5833 {
5834 fstring str_sid;
5835 if (!sid_to_fstring(str_sid, domain_sid)) {
5836 return NT_STATUS_UNSUCCESSFUL;
5837 }
5838 d_printf("%s\n", str_sid);
5839 return NT_STATUS_OK;
5840 }
5841
5842 static void print_trusted_domain(DOM_SID *dom_sid, const char *trusted_dom_name)
5843 {
5844 fstring ascii_sid;
5845
5846 /* convert sid into ascii string */
5847 sid_to_fstring(ascii_sid, dom_sid);
5848
5849 d_printf("%-20s%s\n", trusted_dom_name, ascii_sid);
5850 }
5851
5852 static NTSTATUS vampire_trusted_domain(struct rpc_pipe_client *pipe_hnd,
5853 TALLOC_CTX *mem_ctx,
5854 struct policy_handle *pol,
5855 DOM_SID dom_sid,
5856 const char *trusted_dom_name)
5857 {
5858 NTSTATUS nt_status;
5859 union lsa_TrustedDomainInfo *info = NULL;
5860 char *cleartextpwd = NULL;
5861 uint8_t session_key[16];
5862 DATA_BLOB session_key_blob;
5863 DATA_BLOB data = data_blob_null;
5864
5865 nt_status = rpccli_lsa_QueryTrustedDomainInfoBySid(pipe_hnd, mem_ctx,
5866 pol,
5867 &dom_sid,
5868 LSA_TRUSTED_DOMAIN_INFO_PASSWORD,
5869 &info);
5870 if (NT_STATUS_IS_ERR(nt_status)) {
5871 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
5872 nt_errstr(nt_status)));
5873 goto done;
5874 }
5875
5876 data = data_blob(info->password.password->data,
5877 info->password.password->length);
5878
5879 if (!rpccli_get_pwd_hash(pipe_hnd, session_key)) {
5880 DEBUG(0, ("Could not retrieve password hash\n"));
5881 goto done;
5882 }
5883
5884 session_key_blob = data_blob_const(session_key, sizeof(session_key));
5885 cleartextpwd = sess_decrypt_string(mem_ctx, &data, &session_key_blob);
5886
5887 if (cleartextpwd == NULL) {
5888 DEBUG(0,("retrieved NULL password\n"));
5889 nt_status = NT_STATUS_UNSUCCESSFUL;
5890 goto done;
5891 }
5892
5893 if (!pdb_set_trusteddom_pw(trusted_dom_name, cleartextpwd, &dom_sid)) {
5894 DEBUG(0, ("Storing password for trusted domain failed.\n"));
5895 nt_status = NT_STATUS_UNSUCCESSFUL;
5896 goto done;
5897 }
5898
5899 #ifdef DEBUG_PASSWORD
5900 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
5901 "password: [%s]\n", trusted_dom_name,
5902 sid_string_dbg(&dom_sid), cleartextpwd));
5903 #endif
5904
5905 done:
5906 SAFE_FREE(cleartextpwd);
5907 data_blob_free(&data);
5908
5909 return nt_status;
5910 }
5911
5912 static int rpc_trustdom_vampire(struct net_context *c, int argc,
5913 const char **argv)
5914 {
5915 /* common variables */
5916 TALLOC_CTX* mem_ctx;
5917 struct cli_state *cli = NULL;
5918 struct rpc_pipe_client *pipe_hnd = NULL;
5919 NTSTATUS nt_status;
5920 const char *domain_name = NULL;
5921 DOM_SID *queried_dom_sid;
5922 struct policy_handle connect_hnd;
5923 union lsa_PolicyInformation *info = NULL;
5924
5925 /* trusted domains listing variables */
5926 unsigned int enum_ctx = 0;
5927 int i;
5928 struct lsa_DomainList dom_list;
5929 fstring pdc_name;
5930
5931 if (c->display_usage) {
5932 d_printf( "%s\n"
5933 "net rpc trustdom vampire\n"
5934 " %s\n",
5935 _("Usage:"),
5936 _("Vampire trust relationship from remote server"));
5937 return 0;
5938 }
5939
5940 /*
5941 * Listing trusted domains (stored in secrets.tdb, if local)
5942 */
5943
5944 mem_ctx = talloc_init("trust relationships vampire");
5945
5946 /*
5947 * set domain and pdc name to local samba server (default)
5948 * or to remote one given in command line
5949 */
5950
5951 if (StrCaseCmp(c->opt_workgroup, lp_workgroup())) {
5952 domain_name = c->opt_workgroup;
5953 c->opt_target_workgroup = c->opt_workgroup;
5954 } else {
5955 fstrcpy(pdc_name, global_myname());
5956 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
5957 c->opt_target_workgroup = domain_name;
5958 };
5959
5960 /* open \PIPE\lsarpc and open policy handle */
5961 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
5962 if (!NT_STATUS_IS_OK(nt_status)) {
5963 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
5964 nt_errstr(nt_status)));
5965 talloc_destroy(mem_ctx);
5966 return -1;
5967 };
5968
5969 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
5970 &pipe_hnd);
5971 if (!NT_STATUS_IS_OK(nt_status)) {
5972 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
5973 nt_errstr(nt_status) ));
5974 cli_shutdown(cli);
5975 talloc_destroy(mem_ctx);
5976 return -1;
5977 };
5978
5979 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
5980 &connect_hnd);
5981 if (NT_STATUS_IS_ERR(nt_status)) {
5982 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
5983 nt_errstr(nt_status)));
5984 cli_shutdown(cli);
5985 talloc_destroy(mem_ctx);
5986 return -1;
5987 };
5988
5989 /* query info level 5 to obtain sid of a domain being queried */
5990 nt_status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
5991 &connect_hnd,
5992 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
5993 &info);
5994
5995 if (NT_STATUS_IS_ERR(nt_status)) {
5996 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
5997 nt_errstr(nt_status)));
5998 cli_shutdown(cli);
5999 talloc_destroy(mem_ctx);
6000 return -1;
6001 }
6002
6003 queried_dom_sid = info->account_domain.sid;
6004
6005 /*
6006 * Keep calling LsaEnumTrustdom over opened pipe until
6007 * the end of enumeration is reached
6008 */
6009
6010 d_printf(_("Vampire trusted domains:\n\n"));
6011
6012 do {
6013 nt_status = rpccli_lsa_EnumTrustDom(pipe_hnd, mem_ctx,
6014 &connect_hnd,
6015 &enum_ctx,
6016 &dom_list,
6017 (uint32_t)-1);
6018 if (NT_STATUS_IS_ERR(nt_status)) {
6019 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6020 nt_errstr(nt_status)));
6021 cli_shutdown(cli);
6022 talloc_destroy(mem_ctx);
6023 return -1;
6024 };
6025
6026 for (i = 0; i < dom_list.count; i++) {
6027
6028 print_trusted_domain(dom_list.domains[i].sid,
6029 dom_list.domains[i].name.string);
6030
6031 nt_status = vampire_trusted_domain(pipe_hnd, mem_ctx, &connect_hnd,
6032 *dom_list.domains[i].sid,
6033 dom_list.domains[i].name.string);
6034 if (!NT_STATUS_IS_OK(nt_status)) {
6035 cli_shutdown(cli);
6036 talloc_destroy(mem_ctx);
6037 return -1;
6038 }
6039 };
6040
6041 /*
6042 * in case of no trusted domains say something rather
6043 * than just display blank line
6044 */
6045 if (!dom_list.count) d_printf(_("none\n"));
6046
6047 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6048
6049 /* close this connection before doing next one */
6050 nt_status = rpccli_lsa_Close(pipe_hnd, mem_ctx, &connect_hnd);
6051 if (NT_STATUS_IS_ERR(nt_status)) {
6052 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6053 nt_errstr(nt_status)));
6054 cli_shutdown(cli);
6055 talloc_destroy(mem_ctx);
6056 return -1;
6057 };
6058
6059 /* close lsarpc pipe and connection to IPC$ */
6060 cli_shutdown(cli);
6061
6062 talloc_destroy(mem_ctx);
6063 return 0;
6064 }
6065
6066 static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
6067 {
6068 /* common variables */
6069 TALLOC_CTX* mem_ctx;
6070 struct cli_state *cli = NULL, *remote_cli = NULL;
6071 struct rpc_pipe_client *pipe_hnd = NULL;
6072 NTSTATUS nt_status;
6073 const char *domain_name = NULL;
6074 DOM_SID *queried_dom_sid;
6075 int ascii_dom_name_len;
6076 struct policy_handle connect_hnd;
6077 union lsa_PolicyInformation *info = NULL;
6078
6079 /* trusted domains listing variables */
6080 unsigned int num_domains, enum_ctx = 0;
6081 int i;
6082 struct lsa_DomainList dom_list;
6083 fstring pdc_name;
6084 bool found_domain;
6085
6086 /* trusting domains listing variables */
6087 struct policy_handle domain_hnd;
6088 struct samr_SamArray *trusts = NULL;
6089
6090 if (c->display_usage) {
6091 d_printf( "%s\n"
6092 "net rpc trustdom list\n"
6093 " %s\n",
6094 _("Usage:"),
6095 _("List incoming and outgoing trust relationships"));
6096 return 0;
6097 }
6098
6099 /*
6100 * Listing trusted domains (stored in secrets.tdb, if local)
6101 */
6102
6103 mem_ctx = talloc_init("trust relationships listing");
6104
6105 /*
6106 * set domain and pdc name to local samba server (default)
6107 * or to remote one given in command line
6108 */
6109
6110 if (StrCaseCmp(c->opt_workgroup, lp_workgroup())) {
6111 domain_name = c->opt_workgroup;
6112 c->opt_target_workgroup = c->opt_workgroup;
6113 } else {
6114 fstrcpy(pdc_name, global_myname());
6115 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6116 c->opt_target_workgroup = domain_name;
6117 };
6118
6119 /* open \PIPE\lsarpc and open policy handle */
6120 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6121 if (!NT_STATUS_IS_OK(nt_status)) {
6122 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6123 nt_errstr(nt_status)));
6124 talloc_destroy(mem_ctx);
6125 return -1;
6126 };
6127
6128 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6129 &pipe_hnd);
6130 if (!NT_STATUS_IS_OK(nt_status)) {
6131 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6132 nt_errstr(nt_status) ));
6133 cli_shutdown(cli);
6134 talloc_destroy(mem_ctx);
6135 return -1;
6136 };
6137
6138 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6139 &connect_hnd);
6140 if (NT_STATUS_IS_ERR(nt_status)) {
6141 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6142 nt_errstr(nt_status)));
6143 cli_shutdown(cli);
6144 talloc_destroy(mem_ctx);
6145 return -1;
6146 };
6147
6148 /* query info level 5 to obtain sid of a domain being queried */
6149 nt_status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
6150 &connect_hnd,
6151 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6152 &info);
6153
6154 if (NT_STATUS_IS_ERR(nt_status)) {
6155 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6156 nt_errstr(nt_status)));
6157 cli_shutdown(cli);
6158 talloc_destroy(mem_ctx);
6159 return -1;
6160 }
6161
6162 queried_dom_sid = info->account_domain.sid;
6163
6164 /*
6165 * Keep calling LsaEnumTrustdom over opened pipe until
6166 * the end of enumeration is reached
6167 */
6168
6169 d_printf(_("Trusted domains list:\n\n"));
6170
6171 found_domain = false;
6172
6173 do {
6174 nt_status = rpccli_lsa_EnumTrustDom(pipe_hnd, mem_ctx,
6175 &connect_hnd,
6176 &enum_ctx,
6177 &dom_list,
6178 (uint32_t)-1);
6179 if (NT_STATUS_IS_ERR(nt_status)) {
6180 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6181 nt_errstr(nt_status)));
6182 cli_shutdown(cli);
6183 talloc_destroy(mem_ctx);
6184 return -1;
6185 };
6186
6187 for (i = 0; i < dom_list.count; i++) {
6188 print_trusted_domain(dom_list.domains[i].sid,
6189 dom_list.domains[i].name.string);
6190 found_domain = true;
6191 };
6192
6193
6194 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6195
6196 /*
6197 * in case of no trusted domains say something rather
6198 * than just display blank line
6199 */
6200 if (!found_domain) {
6201 d_printf(_("none\n"));
6202 }
6203
6204 /* close this connection before doing next one */
6205 nt_status = rpccli_lsa_Close(pipe_hnd, mem_ctx, &connect_hnd);
6206 if (NT_STATUS_IS_ERR(nt_status)) {
6207 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6208 nt_errstr(nt_status)));
6209 cli_shutdown(cli);
6210 talloc_destroy(mem_ctx);
6211 return -1;
6212 };
6213
6214 TALLOC_FREE(pipe_hnd);
6215
6216 /*
6217 * Listing trusting domains (stored in passdb backend, if local)
6218 */
6219
6220 d_printf(_("\nTrusting domains list:\n\n"));
6221
6222 /*
6223 * Open \PIPE\samr and get needed policy handles
6224 */
6225 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
6226 &pipe_hnd);
6227 if (!NT_STATUS_IS_OK(nt_status)) {
6228 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status)));
6229 cli_shutdown(cli);
6230 talloc_destroy(mem_ctx);
6231 return -1;
6232 };
6233
6234 /* SamrConnect2 */
6235 nt_status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
6236 pipe_hnd->desthost,
6237 SAMR_ACCESS_LOOKUP_DOMAIN,
6238 &connect_hnd);
6239 if (!NT_STATUS_IS_OK(nt_status)) {
6240 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6241 nt_errstr(nt_status)));
6242 cli_shutdown(cli);
6243 talloc_destroy(mem_ctx);
6244 return -1;
6245 };
6246
6247 /* SamrOpenDomain - we have to open domain policy handle in order to be
6248 able to enumerate accounts*/
6249 nt_status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
6250 &connect_hnd,
6251 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
6252 queried_dom_sid,
6253 &domain_hnd);
6254 if (!NT_STATUS_IS_OK(nt_status)) {
6255 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6256 nt_errstr(nt_status)));
6257 cli_shutdown(cli);
6258 talloc_destroy(mem_ctx);
6259 return -1;
6260 };
6261
6262 /*
6263 * perform actual enumeration
6264 */
6265
6266 found_domain = false;
6267
6268 enum_ctx = 0; /* reset enumeration context from last enumeration */
6269 do {
6270
6271 nt_status = rpccli_samr_EnumDomainUsers(pipe_hnd, mem_ctx,
6272 &domain_hnd,
6273 &enum_ctx,
6274 ACB_DOMTRUST,
6275 &trusts,
6276 0xffff,
6277 &num_domains);
6278 if (NT_STATUS_IS_ERR(nt_status)) {
6279 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6280 nt_errstr(nt_status)));
6281 cli_shutdown(cli);
6282 talloc_destroy(mem_ctx);
6283 return -1;
6284 };
6285
6286 for (i = 0; i < num_domains; i++) {
6287
6288 char *str = CONST_DISCARD(char *, trusts->entries[i].name.string);
6289
6290 found_domain = true;
6291
6292 /*
6293 * get each single domain's sid (do we _really_ need this ?):
6294 * 1) connect to domain's pdc
6295 * 2) query the pdc for domain's sid
6296 */
6297
6298 /* get rid of '$' tail */
6299 ascii_dom_name_len = strlen(str);
6300 if (ascii_dom_name_len && ascii_dom_name_len < FSTRING_LEN)
6301 str[ascii_dom_name_len - 1] = '\0';
6302
6303 /* set opt_* variables to remote domain */
6304 strupper_m(str);
6305 c->opt_workgroup = talloc_strdup(mem_ctx, str);
6306 c->opt_target_workgroup = c->opt_workgroup;
6307
6308 d_printf("%-20s", str);
6309
6310 /* connect to remote domain controller */
6311 nt_status = net_make_ipc_connection(c,
6312 NET_FLAGS_PDC | NET_FLAGS_ANONYMOUS,
6313 &remote_cli);
6314 if (NT_STATUS_IS_OK(nt_status)) {
6315 /* query for domain's sid */
6316 if (run_rpc_command(
6317 c, remote_cli,
6318 &ndr_table_lsarpc.syntax_id, 0,
6319 rpc_query_domain_sid, argc,
6320 argv))
6321 d_printf(_("strange - couldn't get domain's sid\n"));
6322
6323 cli_shutdown(remote_cli);
6324
6325 } else {
6326 d_fprintf(stderr, _("domain controller is not "
6327 "responding: %s\n"),
6328 nt_errstr(nt_status));
6329 d_printf(_("couldn't get domain's sid\n"));
6330 }
6331 }
6332
6333 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6334
6335 if (!found_domain) {
6336 d_printf("none\n");
6337 }
6338
6339 /* close opened samr and domain policy handles */
6340 nt_status = rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_hnd);
6341 if (!NT_STATUS_IS_OK(nt_status)) {
6342 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name));
6343 };
6344
6345 nt_status = rpccli_samr_Close(pipe_hnd, mem_ctx, &connect_hnd);
6346 if (!NT_STATUS_IS_OK(nt_status)) {
6347 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name));
6348 };
6349
6350 /* close samr pipe and connection to IPC$ */
6351 cli_shutdown(cli);
6352
6353 talloc_destroy(mem_ctx);
6354 return 0;
6355 }
6356
6357 /**
6358 * Entrypoint for 'net rpc trustdom' code.
6359 *
6360 * @param argc Standard argc.
6361 * @param argv Standard argv without initial components.
6362 *
6363 * @return Integer status (0 means success).
6364 */
6365
6366 static int rpc_trustdom(struct net_context *c, int argc, const char **argv)
6367 {
6368 struct functable func[] = {
6369 {
6370 "add",
6371 rpc_trustdom_add,
6372 NET_TRANSPORT_RPC,
6373 N_("Add trusting domain's account"),
6374 N_("net rpc trustdom add\n"
6375 " Add trusting domain's account")
6376 },
6377 {
6378 "del",
6379 rpc_trustdom_del,
6380 NET_TRANSPORT_RPC,
6381 N_("Remove trusting domain's account"),
6382 N_("net rpc trustdom del\n"
6383 " Remove trusting domain's account")
6384 },
6385 {
6386 "establish",
6387 rpc_trustdom_establish,
6388 NET_TRANSPORT_RPC,
6389 N_("Establish outgoing trust relationship"),
6390 N_("net rpc trustdom establish\n"
6391 " Establish outgoing trust relationship")
6392 },
6393 {
6394 "revoke",
6395 rpc_trustdom_revoke,
6396 NET_TRANSPORT_RPC,
6397 N_("Revoke outgoing trust relationship"),
6398 N_("net rpc trustdom revoke\n"
6399 " Revoke outgoing trust relationship")
6400 },
6401 {
6402 "list",
6403 rpc_trustdom_list,
6404 NET_TRANSPORT_RPC,
6405 N_("List in- and outgoing domain trusts"),
6406 N_("net rpc trustdom list\n"
6407 " List in- and outgoing domain trusts")
6408 },
6409 {
6410 "vampire",
6411 rpc_trustdom_vampire,
6412 NET_TRANSPORT_RPC,
6413 N_("Vampire trusts from remote server"),
6414 N_("net rpc trustdom vampire\n"
6415 " Vampire trusts from remote server")
6416 },
6417 {NULL, NULL, 0, NULL, NULL}
6418 };
6419
6420 return net_run_function(c, argc, argv, "net rpc trustdom", func);
6421 }
6422
6423 /**
6424 * Check if a server will take rpc commands
6425 * @param flags Type of server to connect to (PDC, DMB, localhost)
6426 * if the host is not explicitly specified
6427 * @return bool (true means rpc supported)
6428 */
6429 bool net_rpc_check(struct net_context *c, unsigned flags)
6430 {
6431 struct cli_state *cli;
6432 bool ret = false;
6433 struct sockaddr_storage server_ss;
6434 char *server_name = NULL;
6435 NTSTATUS status;
6436
6437 /* flags (i.e. server type) may depend on command */
6438 if (!net_find_server(c, NULL, flags, &server_ss, &server_name))
6439 return false;
6440
6441 if ((cli = cli_initialise()) == NULL) {
6442 return false;
6443 }
6444
6445 status = cli_connect(cli, server_name, &server_ss);
6446 if (!NT_STATUS_IS_OK(status))
6447 goto done;
6448 if (!attempt_netbios_session_request(&cli, global_myname(),
6449 server_name, &server_ss))
6450 goto done;
6451 status = cli_negprot(cli);
6452 if (!NT_STATUS_IS_OK(status))
6453 goto done;
6454 if (cli->protocol < PROTOCOL_NT1)
6455 goto done;
6456
6457 ret = true;
6458 done:
6459 cli_shutdown(cli);
6460 return ret;
6461 }
6462
6463 /* dump sam database via samsync rpc calls */
6464 static int rpc_samdump(struct net_context *c, int argc, const char **argv) {
6465 if (c->display_usage) {
6466 d_printf( "%s\n"
6467 "net rpc samdump\n"
6468 " %s\n",
6469 _("Usage:"),
6470 _("Dump remote SAM database"));
6471 return 0;
6472 }
6473
6474 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
6475 NET_FLAGS_ANONYMOUS,
6476 rpc_samdump_internals, argc, argv);
6477 }
6478
6479 /* syncronise sam database via samsync rpc calls */
6480 static int rpc_vampire(struct net_context *c, int argc, const char **argv)
6481 {
6482 struct functable func[] = {
6483 {
6484 "ldif",
6485 rpc_vampire_ldif,
6486 NET_TRANSPORT_RPC,
6487 N_("Dump remote SAM database to ldif"),
6488 N_("net rpc vampire ldif\n"
6489 " Dump remote SAM database to LDIF file or "
6490 "stdout")
6491 },
6492 {
6493 "keytab",
6494 rpc_vampire_keytab,
6495 NET_TRANSPORT_RPC,
6496 N_("Dump remote SAM database to Kerberos Keytab"),
6497 N_("net rpc vampire keytab\n"
6498 " Dump remote SAM database to Kerberos keytab "
6499 "file")
6500 },
6501 {
6502 "passdb",
6503 rpc_vampire_passdb,
6504 NET_TRANSPORT_RPC,
6505 N_("Dump remote SAM database to passdb"),
6506 N_("net rpc vampire passdb\n"
6507 " Dump remote SAM database to passdb")
6508 },
6509
6510 {NULL, NULL, 0, NULL, NULL}
6511 };
6512
6513 if (argc == 0) {
6514 if (c->display_usage) {
6515 d_printf( "%s\n"
6516 "net rpc vampire\n"
6517 " %s\n",
6518 _("Usage:"),
6519 _("Vampire remote SAM database"));
6520 return 0;
6521 }
6522
6523 return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id,
6524 NET_FLAGS_ANONYMOUS,
6525 rpc_vampire_internals,
6526 argc, argv);
6527 }
6528
6529 return net_run_function(c, argc, argv, "net rpc vampire", func);
6530 }
6531
6532 /**
6533 * Migrate everything from a print server.
6534 *
6535 * @param c A net_context structure.
6536 * @param argc Standard main() style argc.
6537 * @param argv Standard main() style argv. Initial components are already
6538 * stripped.
6539 *
6540 * @return A shell status integer (0 for success).
6541 *
6542 * The order is important !
6543 * To successfully add drivers the print queues have to exist !
6544 * Applying ACLs should be the last step, because you're easily locked out.
6545 *
6546 **/
6547 static int rpc_printer_migrate_all(struct net_context *c, int argc,
6548 const char **argv)
6549 {
6550 int ret;
6551
6552 if (c->display_usage) {
6553 d_printf( "%s\n"
6554 "net rpc printer migrate all\n"
6555 " %s\n",
6556 _("Usage:"),
6557 _("Migrate everything from a print server"));
6558 return 0;
6559 }
6560
6561 if (!c->opt_host) {
6562 d_printf(_("no server to migrate\n"));
6563 return -1;
6564 }
6565
6566 ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6567 rpc_printer_migrate_printers_internals, argc,
6568 argv);
6569 if (ret)
6570 return ret;
6571
6572 ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6573 rpc_printer_migrate_drivers_internals, argc,
6574 argv);
6575 if (ret)
6576 return ret;
6577
6578 ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6579 rpc_printer_migrate_forms_internals, argc, argv);
6580 if (ret)
6581 return ret;
6582
6583 ret = run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6584 rpc_printer_migrate_settings_internals, argc,
6585 argv);
6586 if (ret)
6587 return ret;
6588
6589 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6590 rpc_printer_migrate_security_internals, argc,
6591 argv);
6592
6593 }
6594
6595 /**
6596 * Migrate print drivers from a print server.
6597 *
6598 * @param c A net_context structure.
6599 * @param argc Standard main() style argc.
6600 * @param argv Standard main() style argv. Initial components are already
6601 * stripped.
6602 *
6603 * @return A shell status integer (0 for success).
6604 **/
6605 static int rpc_printer_migrate_drivers(struct net_context *c, int argc,
6606 const char **argv)
6607 {
6608 if (c->display_usage) {
6609 d_printf( "%s\n"
6610 "net rpc printer migrate drivers\n"
6611 " %s\n",
6612 _("Usage:"),
6613 _("Migrate print-drivers from a print-server"));
6614 return 0;
6615 }
6616
6617 if (!c->opt_host) {
6618 d_printf(_("no server to migrate\n"));
6619 return -1;
6620 }
6621
6622 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6623 rpc_printer_migrate_drivers_internals,
6624 argc, argv);
6625 }
6626
6627 /**
6628 * Migrate print-forms from a print-server.
6629 *
6630 * @param c A net_context structure.
6631 * @param argc Standard main() style argc.
6632 * @param argv Standard main() style argv. Initial components are already
6633 * stripped.
6634 *
6635 * @return A shell status integer (0 for success).
6636 **/
6637 static int rpc_printer_migrate_forms(struct net_context *c, int argc,
6638 const char **argv)
6639 {
6640 if (c->display_usage) {
6641 d_printf( "%s\n"
6642 "net rpc printer migrate forms\n"
6643 " %s\n",
6644 _("Usage:"),
6645 _("Migrate print-forms from a print-server"));
6646 return 0;
6647 }
6648
6649 if (!c->opt_host) {
6650 d_printf(_("no server to migrate\n"));
6651 return -1;
6652 }
6653
6654 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6655 rpc_printer_migrate_forms_internals,
6656 argc, argv);
6657 }
6658
6659 /**
6660 * Migrate printers from a print-server.
6661 *
6662 * @param c A net_context structure.
6663 * @param argc Standard main() style argc.
6664 * @param argv Standard main() style argv. Initial components are already
6665 * stripped.
6666 *
6667 * @return A shell status integer (0 for success).
6668 **/
6669 static int rpc_printer_migrate_printers(struct net_context *c, int argc,
6670 const char **argv)
6671 {
6672 if (c->display_usage) {
6673 d_printf( "%s\n"
6674 "net rpc printer migrate printers\n"
6675 " %s\n",
6676 _("Usage:"),
6677 _("Migrate printers from a print-server"));
6678 return 0;
6679 }
6680
6681 if (!c->opt_host) {
6682 d_printf(_("no server to migrate\n"));
6683 return -1;
6684 }
6685
6686 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6687 rpc_printer_migrate_printers_internals,
6688 argc, argv);
6689 }
6690
6691 /**
6692 * Migrate printer-ACLs from a print-server
6693 *
6694 * @param c A net_context structure.
6695 * @param argc Standard main() style argc.
6696 * @param argv Standard main() style argv. Initial components are already
6697 * stripped.
6698 *
6699 * @return A shell status integer (0 for success).
6700 **/
6701 static int rpc_printer_migrate_security(struct net_context *c, int argc,
6702 const char **argv)
6703 {
6704 if (c->display_usage) {
6705 d_printf( "%s\n"
6706 "net rpc printer migrate security\n"
6707 " %s\n",
6708 _("Usage:"),
6709 _("Migrate printer-ACLs from a print-server"));
6710 return 0;
6711 }
6712
6713 if (!c->opt_host) {
6714 d_printf(_("no server to migrate\n"));
6715 return -1;
6716 }
6717
6718 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6719 rpc_printer_migrate_security_internals,
6720 argc, argv);
6721 }
6722
6723 /**
6724 * Migrate printer-settings from a print-server.
6725 *
6726 * @param c A net_context structure.
6727 * @param argc Standard main() style argc.
6728 * @param argv Standard main() style argv. Initial components are already
6729 * stripped.
6730 *
6731 * @return A shell status integer (0 for success).
6732 **/
6733 static int rpc_printer_migrate_settings(struct net_context *c, int argc,
6734 const char **argv)
6735 {
6736 if (c->display_usage) {
6737 d_printf( "%s\n"
6738 "net rpc printer migrate settings\n"
6739 " %s\n",
6740 _("Usage:"),
6741 _("Migrate printer-settings from a "
6742 "print-server"));
6743 return 0;
6744 }
6745
6746 if (!c->opt_host) {
6747 d_printf(_("no server to migrate\n"));
6748 return -1;
6749 }
6750
6751 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6752 rpc_printer_migrate_settings_internals,
6753 argc, argv);
6754 }
6755
6756 /**
6757 * 'net rpc printer' entrypoint.
6758 *
6759 * @param c A net_context structure.
6760 * @param argc Standard main() style argc.
6761 * @param argv Standard main() style argv. Initial components are already
6762 * stripped.
6763 **/
6764
6765 int rpc_printer_migrate(struct net_context *c, int argc, const char **argv)
6766 {
6767
6768 /* ouch: when addriver and setdriver are called from within
6769 rpc_printer_migrate_drivers_internals, the printer-queue already
6770 *has* to exist */
6771
6772 struct functable func[] = {
6773 {
6774 "all",
6775 rpc_printer_migrate_all,
6776 NET_TRANSPORT_RPC,
6777 N_("Migrate all from remote to local print server"),
6778 N_("net rpc printer migrate all\n"
6779 " Migrate all from remote to local print server")
6780 },
6781 {
6782 "drivers",
6783 rpc_printer_migrate_drivers,
6784 NET_TRANSPORT_RPC,
6785 N_("Migrate drivers to local server"),
6786 N_("net rpc printer migrate drivers\n"
6787 " Migrate drivers to local server")
6788 },
6789 {
6790 "forms",
6791 rpc_printer_migrate_forms,
6792 NET_TRANSPORT_RPC,
6793 N_("Migrate froms to local server"),
6794 N_("net rpc printer migrate forms\n"
6795 " Migrate froms to local server")
6796 },
6797 {
6798 "printers",
6799 rpc_printer_migrate_printers,
6800 NET_TRANSPORT_RPC,
6801 N_("Migrate printers to local server"),
6802 N_("net rpc printer migrate printers\n"
6803 " Migrate printers to local server")
6804 },
6805 {
6806 "security",
6807 rpc_printer_migrate_security,
6808 NET_TRANSPORT_RPC,
6809 N_("Mirgate printer ACLs to local server"),
6810 N_("net rpc printer migrate security\n"
6811 " Mirgate printer ACLs to local server")
6812 },
6813 {
6814 "settings",
6815 rpc_printer_migrate_settings,
6816 NET_TRANSPORT_RPC,
6817 N_("Migrate printer settings to local server"),
6818 N_("net rpc printer migrate settings\n"
6819 " Migrate printer settings to local server")
6820 },
6821 {NULL, NULL, 0, NULL, NULL}
6822 };
6823
6824 return net_run_function(c, argc, argv, "net rpc printer migrate",func);
6825 }
6826
6827
6828 /**
6829 * List printers on a remote RPC server.
6830 *
6831 * @param c A net_context structure.
6832 * @param argc Standard main() style argc.
6833 * @param argv Standard main() style argv. Initial components are already
6834 * stripped.
6835 *
6836 * @return A shell status integer (0 for success).
6837 **/
6838 static int rpc_printer_list(struct net_context *c, int argc, const char **argv)
6839 {
6840 if (c->display_usage) {
6841 d_printf( "%s\n"
6842 "net rpc printer list\n"
6843 " %s\n",
6844 _("Usage:"),
6845 _("List printers on a remote RPC server"));
6846 return 0;
6847 }
6848
6849 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6850 rpc_printer_list_internals,
6851 argc, argv);
6852 }
6853
6854 /**
6855 * List printer-drivers on a remote RPC server.
6856 *
6857 * @param c A net_context structure.
6858 * @param argc Standard main() style argc.
6859 * @param argv Standard main() style argv. Initial components are already
6860 * stripped.
6861 *
6862 * @return A shell status integer (0 for success).
6863 **/
6864 static int rpc_printer_driver_list(struct net_context *c, int argc,
6865 const char **argv)
6866 {
6867 if (c->display_usage) {
6868 d_printf( "%s\n"
6869 "net rpc printer driver\n"
6870 " %s\n",
6871 _("Usage:"),
6872 _("List printer-drivers on a remote RPC server"));
6873 return 0;
6874 }
6875
6876 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6877 rpc_printer_driver_list_internals,
6878 argc, argv);
6879 }
6880
6881 /**
6882 * Publish printer in ADS via MSRPC.
6883 *
6884 * @param c A net_context structure.
6885 * @param argc Standard main() style argc.
6886 * @param argv Standard main() style argv. Initial components are already
6887 * stripped.
6888 *
6889 * @return A shell status integer (0 for success).
6890 **/
6891 static int rpc_printer_publish_publish(struct net_context *c, int argc,
6892 const char **argv)
6893 {
6894 if (c->display_usage) {
6895 d_printf( "%s\n"
6896 "net rpc printer publish publish\n"
6897 " %s\n",
6898 _("Usage:"),
6899 _("Publish printer in ADS via MSRPC"));
6900 return 0;
6901 }
6902
6903 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6904 rpc_printer_publish_publish_internals,
6905 argc, argv);
6906 }
6907
6908 /**
6909 * Update printer in ADS via MSRPC.
6910 *
6911 * @param c A net_context structure.
6912 * @param argc Standard main() style argc.
6913 * @param argv Standard main() style argv. Initial components are already
6914 * stripped.
6915 *
6916 * @return A shell status integer (0 for success).
6917 **/
6918 static int rpc_printer_publish_update(struct net_context *c, int argc, const char **argv)
6919 {
6920 if (c->display_usage) {
6921 d_printf( "%s\n"
6922 "net rpc printer publish update\n"
6923 " %s\n",
6924 _("Usage:"),
6925 _("Update printer in ADS via MSRPC"));
6926 return 0;
6927 }
6928
6929 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6930 rpc_printer_publish_update_internals,
6931 argc, argv);
6932 }
6933
6934 /**
6935 * UnPublish printer in ADS via MSRPC.
6936 *
6937 * @param c A net_context structure.
6938 * @param argc Standard main() style argc.
6939 * @param argv Standard main() style argv. Initial components are already
6940 * stripped.
6941 *
6942 * @return A shell status integer (0 for success).
6943 **/
6944 static int rpc_printer_publish_unpublish(struct net_context *c, int argc,
6945 const char **argv)
6946 {
6947 if (c->display_usage) {
6948 d_printf( "%s\n"
6949 "net rpc printer publish unpublish\n"
6950 " %s\n",
6951 _("Usage:\n"),
6952 _("UnPublish printer in ADS via MSRPC"));
6953 return 0;
6954 }
6955
6956 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6957 rpc_printer_publish_unpublish_internals,
6958 argc, argv);
6959 }
6960
6961 /**
6962 * List published printers via MSRPC.
6963 *
6964 * @param c A net_context structure.
6965 * @param argc Standard main() style argc.
6966 * @param argv Standard main() style argv. Initial components are already
6967 * stripped.
6968 *
6969 * @return A shell status integer (0 for success).
6970 **/
6971 static int rpc_printer_publish_list(struct net_context *c, int argc,
6972 const char **argv)
6973 {
6974 if (c->display_usage) {
6975 d_printf( "%s\n"
6976 "net rpc printer publish list\n"
6977 " %s\n",
6978 _("Usage:"),
6979 _("List published printers via MSRPC"));
6980 return 0;
6981 }
6982
6983 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
6984 rpc_printer_publish_list_internals,
6985 argc, argv);
6986 }
6987
6988
6989 /**
6990 * Publish printer in ADS.
6991 *
6992 * @param c A net_context structure.
6993 * @param argc Standard main() style argc.
6994 * @param argv Standard main() style argv. Initial components are already
6995 * stripped.
6996 *
6997 * @return A shell status integer (0 for success).
6998 **/
6999 static int rpc_printer_publish(struct net_context *c, int argc,
7000 const char **argv)
7001 {
7002
7003 struct functable func[] = {
7004 {
7005 "publish",
7006 rpc_printer_publish_publish,
7007 NET_TRANSPORT_RPC,
7008 N_("Publish printer in AD"),
7009 N_("net rpc printer publish publish\n"
7010 " Publish printer in AD")
7011 },
7012 {
7013 "update",
7014 rpc_printer_publish_update,
7015 NET_TRANSPORT_RPC,
7016 N_("Update printer in AD"),
7017 N_("net rpc printer publish update\n"
7018 " Update printer in AD")
7019 },
7020 {
7021 "unpublish",
7022 rpc_printer_publish_unpublish,
7023 NET_TRANSPORT_RPC,
7024 N_("Unpublish printer"),
7025 N_("net rpc printer publish unpublish\n"
7026 " Unpublish printer")
7027 },
7028 {
7029 "list",
7030 rpc_printer_publish_list,
7031 NET_TRANSPORT_RPC,
7032 N_("List published printers"),
7033 N_("net rpc printer publish list\n"
7034 " List published printers")
7035 },
7036 {NULL, NULL, 0, NULL, NULL}
7037 };
7038
7039 if (argc == 0) {
7040 if (c->display_usage) {
7041 d_printf(_("Usage:\n"));
7042 d_printf(_("net rpc printer publish\n"
7043 " List published printers\n"
7044 " Alias of net rpc printer publish "
7045 "list\n"));
7046 net_display_usage_from_functable(func);
7047 return 0;
7048 }
7049 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
7050 rpc_printer_publish_list_internals,
7051 argc, argv);
7052 }
7053
7054 return net_run_function(c, argc, argv, "net rpc printer publish",func);
7055
7056 }
7057
7058
7059 /**
7060 * Display rpc printer help page.
7061 *
7062 * @param c A net_context structure.
7063 * @param argc Standard main() style argc.
7064 * @param argv Standard main() style argv. Initial components are already
7065 * stripped.
7066 **/
7067 int rpc_printer_usage(struct net_context *c, int argc, const char **argv)
7068 {
7069 d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
7070 "\tlists all printers on print-server\n\n"));
7071 d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
7072 "\tlists all printer-drivers on print-server\n\n"));
7073 d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
7074 "\tpublishes printer settings in Active Directory\n"
7075 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
7076 d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
7077 "\n\tmigrates printers from remote to local server\n\n"));
7078 d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
7079 "\n\tmigrates printer-settings from remote to local server\n\n"));
7080 d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
7081 "\n\tmigrates printer-drivers from remote to local server\n\n"));
7082 d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
7083 "\n\tmigrates printer-forms from remote to local server\n\n"));
7084 d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
7085 "\n\tmigrates printer-ACLs from remote to local server\n\n"));
7086 d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
7087 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
7088 "\tremote to local print-server\n\n"));
7089 net_common_methods_usage(c, argc, argv);
7090 net_common_flags_usage(c, argc, argv);
7091 d_printf(_(
7092 "\t-v or --verbose\t\t\tgive verbose output\n"
7093 "\t --destination\t\tmigration target server (default: localhost)\n"));
7094
7095 return -1;
7096 }
7097
7098 /**
7099 * 'net rpc printer' entrypoint.
7100 *
7101 * @param c A net_context structure.
7102 * @param argc Standard main() style argc.
7103 * @param argv Standard main() style argv. Initial components are already
7104 * stripped.
7105 **/
7106 int net_rpc_printer(struct net_context *c, int argc, const char **argv)
7107 {
7108 struct functable func[] = {
7109 {
7110 "list",
7111 rpc_printer_list,
7112 NET_TRANSPORT_RPC,
7113 N_("List all printers on print server"),
7114 N_("net rpc printer list\n"
7115 " List all printers on print server")
7116 },
7117 {
7118 "migrate",
7119 rpc_printer_migrate,
7120 NET_TRANSPORT_RPC,
7121 N_("Migrate printer to local server"),
7122 N_("net rpc printer migrate\n"
7123 " Migrate printer to local server")
7124 },
7125 {
7126 "driver",
7127 rpc_printer_driver_list,
7128 NET_TRANSPORT_RPC,
7129 N_("List printer drivers"),
7130 N_("net rpc printer driver\n"
7131 " List printer drivers")
7132 },
7133 {
7134 "publish",
7135 rpc_printer_publish,
7136 NET_TRANSPORT_RPC,
7137 N_("Publish printer in AD"),
7138 N_("net rpc printer publish\n"
7139 " Publish printer in AD")
7140 },
7141 {NULL, NULL, 0, NULL, NULL}
7142 };
7143
7144 if (argc == 0) {
7145 if (c->display_usage) {
7146 d_printf(_("Usage:\n"));
7147 d_printf(_("net rpc printer\n"
7148 " List printers\n"));
7149 net_display_usage_from_functable(func);
7150 return 0;
7151 }
7152 return run_rpc_command(c, NULL, &ndr_table_spoolss.syntax_id, 0,
7153 rpc_printer_list_internals,
7154 argc, argv);
7155 }
7156
7157 return net_run_function(c, argc, argv, "net rpc printer", func);
7158 }
7159
7160 /**
7161 * 'net rpc' entrypoint.
7162 *
7163 * @param c A net_context structure.
7164 * @param argc Standard main() style argc.
7165 * @param argv Standard main() style argv. Initial components are already
7166 * stripped.
7167 **/
7168
7169 int net_rpc(struct net_context *c, int argc, const char **argv)
7170 {
7171 NET_API_STATUS status;
7172
7173 struct functable func[] = {
7174 {
7175 "audit",
7176 net_rpc_audit,
7177 NET_TRANSPORT_RPC,
7178 N_("Modify global audit settings"),
7179 N_("net rpc audit\n"
7180 " Modify global audit settings")
7181 },
7182 {
7183 "info",
7184 net_rpc_info,
7185 NET_TRANSPORT_RPC,
7186 N_("Show basic info about a domain"),
7187 N_("net rpc info\n"
7188 " Show basic info about a domain")
7189 },
7190 {
7191 "join",
7192 net_rpc_join,
7193 NET_TRANSPORT_RPC,
7194 N_("Join a domain"),
7195 N_("net rpc join\n"
7196 " Join a domain")
7197 },
7198 {
7199 "oldjoin",
7200 net_rpc_oldjoin,
7201 NET_TRANSPORT_RPC,
7202 N_("Join a domain created in server manager"),
7203 N_("net rpc oldjoin\n"
7204 " Join a domain created in server manager")
7205 },
7206 {
7207 "testjoin",
7208 net_rpc_testjoin,
7209 NET_TRANSPORT_RPC,
7210 N_("Test that a join is valid"),
7211 N_("net rpc testjoin\n"
7212 " Test that a join is valid")
7213 },
7214 {
7215 "user",
7216 net_rpc_user,
7217 NET_TRANSPORT_RPC,
7218 N_("List/modify users"),
7219 N_("net rpc user\n"
7220 " List/modify users")
7221 },
7222 {
7223 "password",
7224 rpc_user_password,
7225 NET_TRANSPORT_RPC,
7226 N_("Change a user password"),
7227 N_("net rpc password\n"
7228 " Change a user password\n"
7229 " Alias for net rpc user password")
7230 },
7231 {
7232 "group",
7233 net_rpc_group,
7234 NET_TRANSPORT_RPC,
7235 N_("List/modify groups"),
7236 N_("net rpc group\n"
7237 " List/modify groups")
7238 },
7239 {
7240 "share",
7241 net_rpc_share,
7242 NET_TRANSPORT_RPC,
7243 N_("List/modify shares"),
7244 N_("net rpc share\n"
7245 " List/modify shares")
7246 },
7247 {
7248 "file",
7249 net_rpc_file,
7250 NET_TRANSPORT_RPC,
7251 N_("List open files"),
7252 N_("net rpc file\n"
7253 " List open files")
7254 },
7255 {
7256 "printer",
7257 net_rpc_printer,
7258 NET_TRANSPORT_RPC,
7259 N_("List/modify printers"),
7260 N_("net rpc printer\n"
7261 " List/modify printers")
7262 },
7263 {
7264 "changetrustpw",
7265 net_rpc_changetrustpw,
7266 NET_TRANSPORT_RPC,
7267 N_("Change trust account password"),
7268 N_("net rpc changetrustpw\n"
7269 " Change trust account password")
7270 },
7271 {
7272 "trustdom",
7273 rpc_trustdom,
7274 NET_TRANSPORT_RPC,
7275 N_("Modify domain trusts"),
7276 N_("net rpc trustdom\n"
7277 " Modify domain trusts")
7278 },
7279 {
7280 "abortshutdown",
7281 rpc_shutdown_abort,
7282 NET_TRANSPORT_RPC,
7283 N_("Abort a remote shutdown"),
7284 N_("net rpc abortshutdown\n"
7285 " Abort a remote shutdown")
7286 },
7287 {
7288 "shutdown",
7289 rpc_shutdown,
7290 NET_TRANSPORT_RPC,
7291 N_("Shutdown a remote server"),
7292 N_("net rpc shutdown\n"
7293 " Shutdown a remote server")
7294 },
7295 {
7296 "samdump",
7297 rpc_samdump,
7298 NET_TRANSPORT_RPC,
7299 N_("Dump SAM data of remote NT PDC"),
7300 N_("net rpc samdump\n"
7301 " Dump SAM data of remote NT PDC")
7302 },
7303 {
7304 "vampire",
7305 rpc_vampire,
7306 NET_TRANSPORT_RPC,
7307 N_("Sync a remote NT PDC's data into local passdb"),
7308 N_("net rpc vampire\n"
7309 " Sync a remote NT PDC's data into local passdb")
7310 },
7311 {
7312 "getsid",
7313 net_rpc_getsid,
7314 NET_TRANSPORT_RPC,
7315 N_("Fetch the domain sid into local secrets.tdb"),
7316 N_("net rpc getsid\n"
7317 " Fetch the domain sid into local secrets.tdb")
7318 },
7319 {
7320 "rights",
7321 net_rpc_rights,
7322 NET_TRANSPORT_RPC,
7323 N_("Manage privileges assigned to SID"),
7324 N_("net rpc rights\n"
7325 " Manage privileges assigned to SID")
7326 },
7327 {
7328 "service",
7329 net_rpc_service,
7330 NET_TRANSPORT_RPC,
7331 N_("Start/stop/query remote services"),
7332 N_("net rpc service\n"
7333 " Start/stop/query remote services")
7334 },
7335 {
7336 "registry",
7337 net_rpc_registry,
7338 NET_TRANSPORT_RPC,
7339 N_("Manage registry hives"),
7340 N_("net rpc registry\n"
7341 " Manage registry hives")
7342 },
7343 {
7344 "shell",
7345 net_rpc_shell,
7346 NET_TRANSPORT_RPC,
7347 N_("Open interactive shell on remote server"),
7348 N_("net rpc shell\n"
7349 " Open interactive shell on remote server")
7350 },
7351 {NULL, NULL, 0, NULL, NULL}
7352 };
7353
7354 status = libnetapi_init(&c->netapi_ctx);
7355 if (status != 0) {
7356 return -1;
7357 }
7358 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
7359 libnetapi_set_password(c->netapi_ctx, c->opt_password);
7360 if (c->opt_kerberos) {
7361 libnetapi_set_use_kerberos(c->netapi_ctx);
7362 }
7363 if (c->opt_ccache) {
7364 libnetapi_set_use_ccache(c->netapi_ctx);
7365 }
7366
7367 return net_run_function(c, argc, argv, "net rpc", func);
7368 }
Samba GIT mirror