2 Unix SMB/CIFS implementation.
4 Winbind daemon connection manager
6 Copyright (C) Tim Potter 2001
7 Copyright (C) Andrew Bartlett 2002
8 Copyright (C) Gerald (Jerry) Carter 2003-2005.
9 Copyright (C) Volker Lendecke 2004-2005
10 Copyright (C) Jeremy Allison 2006
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 2 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program; if not, write to the Free Software
24 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 We need to manage connections to domain controllers without having to
29 mess up the main winbindd code with other issues. The aim of the
30 connection manager is to:
32 - make connections to domain controllers and cache them
33 - re-establish connections when networks or servers go down
34 - centralise the policy on connection timeouts, domain controller
36 - manage re-entrancy for when winbindd becomes able to handle
37 multiple outstanding rpc requests
39 Why not have connection management as part of the rpc layer like tng?
40 Good question. This code may morph into libsmb/rpc_cache.c or something
41 like that but at the moment it's simply staying as part of winbind. I
42 think the TNG architecture of forcing every user of the rpc layer to use
43 the connection caching system is a bad idea. It should be an optional
44 method of using the routines.
46 The TNG design is quite good but I disagree with some aspects of the
54 - I'm pretty annoyed by all the make_nmb_name() stuff. It should be
55 moved down into another function.
57 - Take care when destroying cli_structs as they can be shared between
66 #define DBGC_CLASS DBGC_WINBIND
73 extern struct winbindd_methods reconnect_methods
;
74 extern BOOL override_logfile
;
76 static NTSTATUS
init_dc_connection_network(struct winbindd_domain
*domain
);
77 static void set_dc_type_and_flags( struct winbindd_domain
*domain
);
78 static BOOL
get_dcs(TALLOC_CTX
*mem_ctx
, const struct winbindd_domain
*domain
,
79 struct dc_name_ip
**dcs
, int *num_dcs
);
81 /****************************************************************
82 Child failed to find DC's. Reschedule check.
83 ****************************************************************/
85 static void msg_failed_to_go_online(int msg_type
, struct process_id src
,
86 void *buf
, size_t len
, void *private_data
)
88 struct winbindd_domain
*domain
;
89 const char *domainname
= (const char *)buf
;
91 if (buf
== NULL
|| len
== 0) {
95 DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname
));
97 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
98 if (domain
->internal
) {
102 if (strequal(domain
->name
, domainname
)) {
103 if (domain
->online
) {
104 /* We're already online, ignore. */
105 DEBUG(5,("msg_fail_to_go_online: domain %s "
106 "already online.\n", domainname
));
110 /* Reschedule the online check. */
111 set_domain_offline(domain
);
117 /****************************************************************
118 Actually cause a reconnect from a message.
119 ****************************************************************/
121 static void msg_try_to_go_online(int msg_type
, struct process_id src
,
122 void *buf
, size_t len
, void *private_data
)
124 struct winbindd_domain
*domain
;
125 const char *domainname
= (const char *)buf
;
127 if (buf
== NULL
|| len
== 0) {
131 DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname
));
133 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
134 if (domain
->internal
) {
138 if (strequal(domain
->name
, domainname
)) {
140 if (domain
->online
) {
141 /* We're already online, ignore. */
142 DEBUG(5,("msg_try_to_go_online: domain %s "
143 "already online.\n", domainname
));
147 /* This call takes care of setting the online
148 flag to true if we connected, or re-adding
149 the offline handler if false. Bypasses online
150 check so always does network calls. */
152 init_dc_connection_network(domain
);
158 /****************************************************************
159 Fork a child to try and contact a DC. Do this as contacting a
160 DC requires blocking lookups and we don't want to block our
162 ****************************************************************/
164 static BOOL
fork_child_dc_connect(struct winbindd_domain
*domain
)
166 struct dc_name_ip
*dcs
= NULL
;
168 TALLOC_CTX
*mem_ctx
= NULL
;
170 pid_t parent_pid
= sys_getpid();
177 child_pid
= sys_fork();
179 if (child_pid
== -1) {
180 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno
)));
185 if (child_pid
!= 0) {
187 message_register(MSG_WINBIND_TRY_TO_GO_ONLINE
,
188 msg_try_to_go_online
, NULL
);
189 message_register(MSG_WINBIND_FAILED_TO_GO_ONLINE
,
190 msg_failed_to_go_online
, NULL
);
197 /* Leave messages blocked - we will never process one. */
199 /* tdb needs special fork handling */
200 if (tdb_reopen_all(1) == -1) {
201 DEBUG(0,("tdb_reopen_all failed.\n"));
205 close_conns_after_fork();
207 if (!override_logfile
) {
209 pstr_sprintf(logfile
, "%s/log.winbindd-dc-connect", dyn_LOGFILEBASE
);
210 lp_set_logfile(logfile
);
214 mem_ctx
= talloc_init("fork_child_dc_connect");
216 DEBUG(0,("talloc_init failed.\n"));
220 if ((!get_dcs(mem_ctx
, domain
, &dcs
, &num_dcs
)) || (num_dcs
== 0)) {
221 /* Still offline ? Can't find DC's. */
222 message_send_pid(pid_to_procid(parent_pid
), MSG_WINBIND_FAILED_TO_GO_ONLINE
,
224 strlen(domain
->name
)+1, False
);
228 /* We got a DC. Send a message to our parent to get it to
229 try and do the same. */
231 message_send_pid(pid_to_procid(parent_pid
), MSG_WINBIND_TRY_TO_GO_ONLINE
,
233 strlen(domain
->name
)+1, False
);
237 /****************************************************************
238 Handler triggered if we're offline to try and detect a DC.
239 ****************************************************************/
241 static void check_domain_online_handler(struct event_context
*ctx
,
242 struct timed_event
*te
,
243 const struct timeval
*now
,
246 struct winbindd_domain
*domain
=
247 (struct winbindd_domain
*)private_data
;
249 DEBUG(10,("check_domain_online_handler: called for domain %s\n",
252 TALLOC_FREE(domain
->check_online_event
);
254 /* Are we still in "startup" mode ? */
256 if (domain
->startup
&& (now
->tv_sec
> domain
->startup_time
+ 30)) {
257 /* No longer in "startup" mode. */
258 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
260 domain
->startup
= False
;
263 /* We've been told to stay offline, so stay
266 if (get_global_winbindd_state_offline()) {
267 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
272 /* Fork a child to test if it can contact a DC.
273 If it can then send ourselves a message to
274 cause a reconnect. */
276 fork_child_dc_connect(domain
);
279 /****************************************************************
280 If we're still offline setup the timeout check.
281 ****************************************************************/
283 static void calc_new_online_timeout_check(struct winbindd_domain
*domain
)
285 int wbc
= lp_winbind_cache_time();
287 if (domain
->startup
) {
288 domain
->check_online_timeout
= 10;
289 } else if (domain
->check_online_timeout
< wbc
) {
290 domain
->check_online_timeout
= wbc
;
294 /****************************************************************
295 Set domain offline and also add handler to put us back online
297 ****************************************************************/
299 void set_domain_offline(struct winbindd_domain
*domain
)
301 DEBUG(10,("set_domain_offline: called for domain %s\n",
304 TALLOC_FREE(domain
->check_online_event
);
306 if (domain
->internal
) {
307 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
312 domain
->online
= False
;
314 /* Offline domains are always initialized. They're
315 re-initialized when they go back online. */
317 domain
->initialized
= True
;
319 /* We only add the timeout handler that checks and
320 allows us to go back online when we've not
321 been told to remain offline. */
323 if (get_global_winbindd_state_offline()) {
324 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
329 /* If we're in statup mode, check again in 10 seconds, not in
330 lp_winbind_cache_time() seconds (which is 5 mins by default). */
332 calc_new_online_timeout_check(domain
);
334 domain
->check_online_event
= event_add_timed(winbind_event_context(),
336 timeval_current_ofs(domain
->check_online_timeout
,0),
337 "check_domain_online_handler",
338 check_domain_online_handler
,
341 /* The above *has* to succeed for winbindd to work. */
342 if (!domain
->check_online_event
) {
343 smb_panic("set_domain_offline: failed to add online handler.\n");
346 DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
350 /****************************************************************
351 Set domain online - if allowed.
352 ****************************************************************/
354 static void set_domain_online(struct winbindd_domain
*domain
)
358 DEBUG(10,("set_domain_online: called for domain %s\n",
361 if (domain
->internal
) {
362 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
367 if (get_global_winbindd_state_offline()) {
368 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
373 /* If we are waiting to get a krb5 ticket, trigger immediately. */
375 set_event_dispatch_time(winbind_event_context(),
376 "krb5_ticket_gain_handler", now
);
378 /* Ok, we're out of any startup mode now... */
379 domain
->startup
= False
;
381 if (domain
->online
== False
) {
382 /* We were offline - now we're online. We default to
383 using the MS-RPC backend if we started offline,
384 and if we're going online for the first time we
385 should really re-initialize the backends and the
386 checks to see if we're talking to an AD or NT domain.
389 domain
->initialized
= False
;
391 /* 'reconnect_methods' is the MS-RPC backend. */
392 if (domain
->backend
== &reconnect_methods
) {
393 domain
->backend
= NULL
;
397 /* Ensure we have no online timeout checks. */
398 domain
->check_online_timeout
= 0;
399 TALLOC_FREE(domain
->check_online_event
);
401 /* Ensure we ignore any pending child messages. */
402 message_deregister(MSG_WINBIND_TRY_TO_GO_ONLINE
);
403 message_deregister(MSG_WINBIND_FAILED_TO_GO_ONLINE
);
405 domain
->online
= True
;
408 /****************************************************************
409 Requested to set a domain online.
410 ****************************************************************/
412 void set_domain_online_request(struct winbindd_domain
*domain
)
416 DEBUG(10,("set_domain_online_request: called for domain %s\n",
419 if (get_global_winbindd_state_offline()) {
420 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
425 /* We've been told it's safe to go online and
426 try and connect to a DC. But I don't believe it
427 because network manager seems to lie.
428 Wait at least 5 seconds. Heuristics suck... */
430 if (!domain
->check_online_event
) {
431 /* If we've come from being globally offline we
432 don't have a check online event handler set.
433 We need to add one now we're trying to go
436 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
439 domain
->check_online_event
= event_add_timed(winbind_event_context(),
441 timeval_current_ofs(5, 0),
442 "check_domain_online_handler",
443 check_domain_online_handler
,
446 /* The above *has* to succeed for winbindd to work. */
447 if (!domain
->check_online_event
) {
448 smb_panic("set_domain_online_request: failed to add online handler.\n");
454 /* Go into "startup" mode again. */
455 domain
->startup_time
= tev
.tv_sec
;
456 domain
->startup
= True
;
460 set_event_dispatch_time(winbind_event_context(), "check_domain_online_handler", tev
);
463 /****************************************************************
464 Add -ve connection cache entries for domain and realm.
465 ****************************************************************/
467 void winbind_add_failed_connection_entry(const struct winbindd_domain
*domain
,
471 add_failed_connection_entry(domain
->name
, server
, result
);
472 /* If this was the saf name for the last thing we talked to,
474 saf_delete(domain
->name
);
475 if (*domain
->alt_name
) {
476 add_failed_connection_entry(domain
->alt_name
, server
, result
);
477 saf_delete(domain
->alt_name
);
481 /* Choose between anonymous or authenticated connections. We need to use
482 an authenticated connection if DCs have the RestrictAnonymous registry
483 entry set > 0, or the "Additional restrictions for anonymous
484 connections" set in the win2k Local Security Policy.
486 Caller to free() result in domain, username, password
489 static void cm_get_ipc_userpass(char **username
, char **domain
, char **password
)
491 *username
= (char *)secrets_fetch(SECRETS_AUTH_USER
, NULL
);
492 *domain
= (char *)secrets_fetch(SECRETS_AUTH_DOMAIN
, NULL
);
493 *password
= (char *)secrets_fetch(SECRETS_AUTH_PASSWORD
, NULL
);
495 if (*username
&& **username
) {
497 if (!*domain
|| !**domain
)
498 *domain
= smb_xstrdup(lp_workgroup());
500 if (!*password
|| !**password
)
501 *password
= smb_xstrdup("");
503 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
504 *domain
, *username
));
507 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
508 *username
= smb_xstrdup("");
509 *domain
= smb_xstrdup("");
510 *password
= smb_xstrdup("");
514 static BOOL
get_dc_name_via_netlogon(const struct winbindd_domain
*domain
,
515 fstring dcname
, struct in_addr
*dc_ip
)
517 struct winbindd_domain
*our_domain
= NULL
;
518 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
522 unsigned int orig_timeout
;
526 /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
533 if (domain
->primary
) {
537 our_domain
= find_our_domain();
539 if ((mem_ctx
= talloc_init("get_dc_name_via_netlogon")) == NULL
) {
543 result
= cm_connect_netlogon(our_domain
, &netlogon_pipe
);
544 if (!NT_STATUS_IS_OK(result
)) {
545 talloc_destroy(mem_ctx
);
549 /* This call can take a long time - allow the server to time out.
550 35 seconds should do it. */
552 orig_timeout
= cli_set_timeout(netlogon_pipe
->cli
, 35000);
554 werr
= rpccli_netlogon_getanydcname(netlogon_pipe
, mem_ctx
, our_domain
->dcname
,
557 /* And restore our original timeout. */
558 cli_set_timeout(netlogon_pipe
->cli
, orig_timeout
);
560 talloc_destroy(mem_ctx
);
562 if (!W_ERROR_IS_OK(werr
)) {
563 DEBUG(10, ("rpccli_netlogon_getanydcname failed: %s\n",
568 /* cli_netlogon_getanydcname gives us a name with \\ */
579 DEBUG(10, ("rpccli_netlogon_getanydcname returned %s\n", dcname
));
581 if (!resolve_name(dcname
, dc_ip
, 0x20)) {
588 /************************************************************************
589 Given a fd with a just-connected TCP connection to a DC, open a connection
591 ************************************************************************/
593 static NTSTATUS
cm_prepare_connection(const struct winbindd_domain
*domain
,
595 const char *controller
,
596 struct cli_state
**cli
,
599 char *machine_password
, *machine_krb5_principal
, *machine_account
;
600 char *ipc_username
, *ipc_domain
, *ipc_password
;
604 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
606 struct sockaddr peeraddr
;
607 socklen_t peeraddr_len
;
609 struct sockaddr_in
*peeraddr_in
= (struct sockaddr_in
*)&peeraddr
;
611 DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
612 controller
, domain
->name
));
614 machine_password
= secrets_fetch_machine_password(lp_workgroup(), NULL
,
617 if (asprintf(&machine_account
, "%s$", global_myname()) == -1) {
618 SAFE_FREE(machine_password
);
619 return NT_STATUS_NO_MEMORY
;
622 if (asprintf(&machine_krb5_principal
, "%s$@%s", global_myname(),
624 SAFE_FREE(machine_account
);
625 SAFE_FREE(machine_password
);
626 return NT_STATUS_NO_MEMORY
;
629 cm_get_ipc_userpass(&ipc_username
, &ipc_domain
, &ipc_password
);
633 got_mutex
= secrets_named_mutex(controller
,
634 WINBIND_SERVER_MUTEX_WAIT_TIME
);
637 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
639 result
= NT_STATUS_POSSIBLE_DEADLOCK
;
643 if ((*cli
= cli_initialise()) == NULL
) {
644 DEBUG(1, ("Could not cli_initialize\n"));
645 result
= NT_STATUS_NO_MEMORY
;
649 (*cli
)->timeout
= 10000; /* 10 seconds */
651 fstrcpy((*cli
)->desthost
, controller
);
652 (*cli
)->use_kerberos
= True
;
654 peeraddr_len
= sizeof(peeraddr
);
656 if ((getpeername((*cli
)->fd
, &peeraddr
, &peeraddr_len
) != 0) ||
657 (peeraddr_len
!= sizeof(struct sockaddr_in
)) ||
658 (peeraddr_in
->sin_family
!= PF_INET
))
660 DEBUG(0,("cm_prepare_connection: %s\n", strerror(errno
)));
661 result
= NT_STATUS_UNSUCCESSFUL
;
665 if (ntohs(peeraddr_in
->sin_port
) == 139) {
666 struct nmb_name calling
;
667 struct nmb_name called
;
669 make_nmb_name(&calling
, global_myname(), 0x0);
670 make_nmb_name(&called
, "*SMBSERVER", 0x20);
672 if (!cli_session_request(*cli
, &calling
, &called
)) {
673 DEBUG(8, ("cli_session_request failed for %s\n",
675 result
= NT_STATUS_UNSUCCESSFUL
;
680 cli_setup_signing_state(*cli
, Undefined
);
682 if (!cli_negprot(*cli
)) {
683 DEBUG(1, ("cli_negprot failed\n"));
684 result
= NT_STATUS_UNSUCCESSFUL
;
688 if ((*cli
)->protocol
>= PROTOCOL_NT1
&& (*cli
)->capabilities
& CAP_EXTENDED_SECURITY
) {
689 ADS_STATUS ads_status
;
691 if (lp_security() == SEC_ADS
) {
693 /* Try a krb5 session */
695 (*cli
)->use_kerberos
= True
;
696 DEBUG(5, ("connecting to %s from %s with kerberos principal "
697 "[%s]\n", controller
, global_myname(),
698 machine_krb5_principal
));
700 ads_status
= cli_session_setup_spnego(*cli
,
701 machine_krb5_principal
,
705 if (!ADS_ERR_OK(ads_status
)) {
706 DEBUG(4,("failed kerberos session setup with %s\n",
707 ads_errstr(ads_status
)));
710 result
= ads_ntstatus(ads_status
);
711 if (NT_STATUS_IS_OK(result
)) {
712 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
713 cli_init_creds(*cli
, machine_account
, lp_workgroup(), machine_password
);
714 goto session_setup_done
;
718 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
719 (*cli
)->use_kerberos
= False
;
721 DEBUG(5, ("connecting to %s from %s with username "
722 "[%s]\\[%s]\n", controller
, global_myname(),
723 lp_workgroup(), machine_account
));
725 ads_status
= cli_session_setup_spnego(*cli
,
729 if (!ADS_ERR_OK(ads_status
)) {
730 DEBUG(4, ("authenticated session setup failed with %s\n",
731 ads_errstr(ads_status
)));
734 result
= ads_ntstatus(ads_status
);
735 if (NT_STATUS_IS_OK(result
)) {
736 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
737 cli_init_creds(*cli
, machine_account
, lp_workgroup(), machine_password
);
738 goto session_setup_done
;
742 /* Fall back to non-kerberos session setup */
744 (*cli
)->use_kerberos
= False
;
746 if ((((*cli
)->sec_mode
& NEGOTIATE_SECURITY_CHALLENGE_RESPONSE
) != 0) &&
747 (strlen(ipc_username
) > 0)) {
749 /* Only try authenticated if we have a username */
751 DEBUG(5, ("connecting to %s from %s with username "
752 "[%s]\\[%s]\n", controller
, global_myname(),
753 ipc_domain
, ipc_username
));
755 if (NT_STATUS_IS_OK(cli_session_setup(
757 ipc_password
, strlen(ipc_password
)+1,
758 ipc_password
, strlen(ipc_password
)+1,
760 /* Successful logon with given username. */
761 cli_init_creds(*cli
, ipc_username
, ipc_domain
, ipc_password
);
762 goto session_setup_done
;
764 DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
765 ipc_domain
, ipc_username
));
769 /* Fall back to anonymous connection, this might fail later */
771 if (NT_STATUS_IS_OK(cli_session_setup(*cli
, "", NULL
, 0,
773 DEBUG(5, ("Connected anonymously\n"));
774 cli_init_creds(*cli
, "", "", "");
775 goto session_setup_done
;
778 result
= cli_nt_error(*cli
);
780 if (NT_STATUS_IS_OK(result
))
781 result
= NT_STATUS_UNSUCCESSFUL
;
783 /* We can't session setup */
789 /* cache the server name for later connections */
791 saf_store( domain
->name
, (*cli
)->desthost
);
792 if (domain
->alt_name
&& (*cli
)->use_kerberos
) {
793 saf_store( domain
->alt_name
, (*cli
)->desthost
);
796 if (!cli_send_tconX(*cli
, "IPC$", "IPC", "", 0)) {
798 result
= cli_nt_error(*cli
);
800 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result
)));
802 if (NT_STATUS_IS_OK(result
))
803 result
= NT_STATUS_UNSUCCESSFUL
;
808 secrets_named_mutex_release(controller
);
812 /* set the domain if empty; needed for schannel connections */
813 if ( !*(*cli
)->domain
) {
814 fstrcpy( (*cli
)->domain
, domain
->name
);
817 result
= NT_STATUS_OK
;
821 secrets_named_mutex_release(controller
);
824 SAFE_FREE(machine_account
);
825 SAFE_FREE(machine_password
);
826 SAFE_FREE(machine_krb5_principal
);
827 SAFE_FREE(ipc_username
);
828 SAFE_FREE(ipc_domain
);
829 SAFE_FREE(ipc_password
);
831 if (!NT_STATUS_IS_OK(result
)) {
832 winbind_add_failed_connection_entry(domain
, controller
, result
);
833 if ((*cli
) != NULL
) {
842 static BOOL
add_one_dc_unique(TALLOC_CTX
*mem_ctx
, const char *domain_name
,
843 const char *dcname
, struct in_addr ip
,
844 struct dc_name_ip
**dcs
, int *num
)
846 if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name
, dcname
))) {
847 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname
));
851 *dcs
= TALLOC_REALLOC_ARRAY(mem_ctx
, *dcs
, struct dc_name_ip
, (*num
)+1);
856 fstrcpy((*dcs
)[*num
].name
, dcname
);
857 (*dcs
)[*num
].ip
= ip
;
862 static BOOL
add_sockaddr_to_array(TALLOC_CTX
*mem_ctx
,
863 struct in_addr ip
, uint16 port
,
864 struct sockaddr_in
**addrs
, int *num
)
866 *addrs
= TALLOC_REALLOC_ARRAY(mem_ctx
, *addrs
, struct sockaddr_in
, (*num
)+1);
868 if (*addrs
== NULL
) {
873 (*addrs
)[*num
].sin_family
= PF_INET
;
874 putip((char *)&((*addrs
)[*num
].sin_addr
), (char *)&ip
);
875 (*addrs
)[*num
].sin_port
= htons(port
);
881 static void mailslot_name(struct in_addr dc_ip
, fstring name
)
883 fstr_sprintf(name
, "\\MAILSLOT\\NET\\GETDC%X", dc_ip
.s_addr
);
886 static BOOL
send_getdc_request(struct in_addr dc_ip
,
887 const char *domain_name
,
892 fstring my_acct_name
;
895 mailslot_name(dc_ip
, my_mailslot
);
897 memset(outbuf
, '\0', sizeof(outbuf
));
901 SCVAL(p
, 0, SAMLOGON
);
904 SCVAL(p
, 0, 0); /* Count pointer ... */
907 SIVAL(p
, 0, 0); /* The sender's token ... */
910 p
+= dos_PutUniCode(p
, global_myname(), sizeof(pstring
), True
);
911 fstr_sprintf(my_acct_name
, "%s$", global_myname());
912 p
+= dos_PutUniCode(p
, my_acct_name
, sizeof(pstring
), True
);
914 memcpy(p
, my_mailslot
, strlen(my_mailslot
)+1);
915 p
+= strlen(my_mailslot
)+1;
920 SIVAL(p
, 0, sid_size(sid
));
923 p
= ALIGN4(p
, outbuf
);
925 sid_linearize(p
, sid_size(sid
), sid
);
933 return cli_send_mailslot(False
, "\\MAILSLOT\\NET\\NTLOGON", 0,
934 outbuf
, PTR_DIFF(p
, outbuf
),
935 global_myname(), 0, domain_name
, 0x1c,
939 static BOOL
receive_getdc_response(struct in_addr dc_ip
,
940 const char *domain_name
,
943 struct packet_struct
*packet
;
946 fstring dcname
, user
, domain
;
949 mailslot_name(dc_ip
, my_mailslot
);
951 packet
= receive_unexpected(DGRAM_PACKET
, 0, my_mailslot
);
953 if (packet
== NULL
) {
954 DEBUG(5, ("Did not receive packet for %s\n", my_mailslot
));
958 DEBUG(5, ("Received packet for %s\n", my_mailslot
));
960 buf
= packet
->packet
.dgram
.data
;
961 len
= packet
->packet
.dgram
.datasize
;
964 /* 70 is a completely arbitrary value to make sure
965 the SVAL below does not read uninitialized memory */
966 DEBUG(3, ("GetDC got short response\n"));
970 /* This should be (buf-4)+SVAL(buf-4, smb_vwv12)... */
971 p
= buf
+SVAL(buf
, smb_vwv10
);
973 if (CVAL(p
,0) != SAMLOGON_R
) {
974 DEBUG(8, ("GetDC got invalid response type %d\n", CVAL(p
, 0)));
979 pull_ucs2(buf
, dcname
, p
, sizeof(dcname
), PTR_DIFF(buf
+len
, p
),
980 STR_TERMINATE
|STR_NOALIGN
);
981 p
= skip_unibuf(p
, PTR_DIFF(buf
+len
, p
));
982 pull_ucs2(buf
, user
, p
, sizeof(dcname
), PTR_DIFF(buf
+len
, p
),
983 STR_TERMINATE
|STR_NOALIGN
);
984 p
= skip_unibuf(p
, PTR_DIFF(buf
+len
, p
));
985 pull_ucs2(buf
, domain
, p
, sizeof(dcname
), PTR_DIFF(buf
+len
, p
),
986 STR_TERMINATE
|STR_NOALIGN
);
987 p
= skip_unibuf(p
, PTR_DIFF(buf
+len
, p
));
989 if (!strequal(domain
, domain_name
)) {
990 DEBUG(3, ("GetDC: Expected domain %s, got %s\n",
991 domain_name
, domain
));
996 if (*p
== '\\') p
+= 1;
997 if (*p
== '\\') p
+= 1;
1001 DEBUG(10, ("GetDC gave name %s for domain %s\n",
1007 /*******************************************************************
1008 convert an ip to a name
1009 *******************************************************************/
1011 static BOOL
dcip_to_name(const struct winbindd_domain
*domain
, struct in_addr ip
, fstring name
)
1013 struct ip_service ip_list
;
1019 /* For active directory servers, try to get the ldap server name.
1020 None of these failures should be considered critical for now */
1022 if (lp_security() == SEC_ADS
) {
1025 ads
= ads_init(domain
->alt_name
, domain
->name
, NULL
);
1026 ads
->auth
.flags
|= ADS_AUTH_NO_BIND
;
1028 if (ads_try_connect( ads
, inet_ntoa(ip
) ) ) {
1029 /* We got a cldap packet. */
1030 fstrcpy(name
, ads
->config
.ldap_server_name
);
1031 namecache_store(name
, 0x20, 1, &ip_list
);
1033 DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads
->config
.flags
));
1035 if (domain
->primary
&& (ads
->config
.flags
& ADS_KDC
)) {
1036 if (ads_closest_dc(ads
)) {
1037 char *sitename
= sitename_fetch(ads
->config
.realm
);
1039 /* We're going to use this KDC for this realm/domain.
1040 If we are using sites, then force the krb5 libs
1043 create_local_private_krb5_conf_for_domain(domain
->alt_name
,
1048 SAFE_FREE(sitename
);
1050 /* use an off site KDC */
1051 create_local_private_krb5_conf_for_domain(domain
->alt_name
,
1056 /* Ensure we contact this DC also. */
1057 saf_store( domain
->name
, name
);
1058 saf_store( domain
->alt_name
, name
);
1061 ads_destroy( &ads
);
1065 ads_destroy( &ads
);
1069 /* try GETDC requests next */
1071 if (send_getdc_request(ip
, domain
->name
, &domain
->sid
)) {
1074 for (i
=0; i
<5; i
++) {
1075 if (receive_getdc_response(ip
, domain
->name
, name
)) {
1076 namecache_store(name
, 0x20, 1, &ip_list
);
1083 /* try node status request */
1085 if ( name_status_find(domain
->name
, 0x1c, 0x20, ip
, name
) ) {
1086 namecache_store(name
, 0x20, 1, &ip_list
);
1092 /*******************************************************************
1093 Retreive a list of IP address for domain controllers. Fill in
1094 the dcs[] with results.
1095 *******************************************************************/
1097 static BOOL
get_dcs(TALLOC_CTX
*mem_ctx
, const struct winbindd_domain
*domain
,
1098 struct dc_name_ip
**dcs
, int *num_dcs
)
1102 struct ip_service
*ip_list
= NULL
;
1103 int iplist_size
= 0;
1106 enum security_types sec
= (enum security_types
)lp_security();
1108 is_our_domain
= strequal(domain
->name
, lp_workgroup());
1111 && get_dc_name_via_netlogon(domain
, dcname
, &ip
)
1112 && add_one_dc_unique(mem_ctx
, domain
->name
, dcname
, ip
, dcs
, num_dcs
) )
1114 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1115 dcname
, inet_ntoa(ip
)));
1119 if (sec
== SEC_ADS
) {
1120 char *sitename
= NULL
;
1122 /* We need to make sure we know the local site before
1123 doing any DNS queries, as this will restrict the
1124 get_sorted_dc_list() call below to only fetching
1125 DNS records for the correct site. */
1127 /* Find any DC to get the site record.
1128 We deliberately don't care about the
1131 get_dc_name(domain
->name
, domain
->alt_name
, dcname
, &ip
);
1133 sitename
= sitename_fetch(domain
->alt_name
);
1136 /* Do the site-specific AD dns lookup first. */
1137 get_sorted_dc_list(domain
->alt_name
, sitename
, &ip_list
, &iplist_size
, True
);
1139 for ( i
=0; i
<iplist_size
; i
++ ) {
1140 add_one_dc_unique(mem_ctx
, domain
->name
, inet_ntoa(ip_list
[i
].ip
),
1141 ip_list
[i
].ip
, dcs
, num_dcs
);
1145 SAFE_FREE(sitename
);
1149 /* Now we add DCs from the main AD dns lookup. */
1150 get_sorted_dc_list(domain
->alt_name
, NULL
, &ip_list
, &iplist_size
, True
);
1152 for ( i
=0; i
<iplist_size
; i
++ ) {
1153 add_one_dc_unique(mem_ctx
, domain
->name
, inet_ntoa(ip_list
[i
].ip
),
1154 ip_list
[i
].ip
, dcs
, num_dcs
);
1158 /* try standard netbios queries if no ADS */
1160 if (iplist_size
==0) {
1161 get_sorted_dc_list(domain
->name
, NULL
, &ip_list
, &iplist_size
, False
);
1164 /* FIXME!! this is where we should re-insert the GETDC requests --jerry */
1166 /* now add to the dc array. We'll wait until the last minute
1167 to look up the name of the DC. But we fill in the char* for
1168 the ip now in to make the failed connection cache work */
1170 for ( i
=0; i
<iplist_size
; i
++ ) {
1171 add_one_dc_unique(mem_ctx
, domain
->name
, inet_ntoa(ip_list
[i
].ip
),
1172 ip_list
[i
].ip
, dcs
, num_dcs
);
1175 SAFE_FREE( ip_list
);
1180 static BOOL
find_new_dc(TALLOC_CTX
*mem_ctx
,
1181 const struct winbindd_domain
*domain
,
1182 fstring dcname
, struct sockaddr_in
*addr
, int *fd
)
1184 struct dc_name_ip
*dcs
= NULL
;
1187 const char **dcnames
= NULL
;
1188 int num_dcnames
= 0;
1190 struct sockaddr_in
*addrs
= NULL
;
1196 if (!get_dcs(mem_ctx
, domain
, &dcs
, &num_dcs
) || (num_dcs
== 0))
1199 for (i
=0; i
<num_dcs
; i
++) {
1201 if (!add_string_to_array(mem_ctx
, dcs
[i
].name
,
1202 &dcnames
, &num_dcnames
)) {
1205 if (!add_sockaddr_to_array(mem_ctx
, dcs
[i
].ip
, 445,
1206 &addrs
, &num_addrs
)) {
1210 if (!add_string_to_array(mem_ctx
, dcs
[i
].name
,
1211 &dcnames
, &num_dcnames
)) {
1214 if (!add_sockaddr_to_array(mem_ctx
, dcs
[i
].ip
, 139,
1215 &addrs
, &num_addrs
)) {
1220 if ((num_dcnames
== 0) || (num_dcnames
!= num_addrs
))
1223 if ((addrs
== NULL
) || (dcnames
== NULL
))
1226 /* 5 second timeout. */
1227 if ( !open_any_socket_out(addrs
, num_addrs
, 5000, &fd_index
, fd
) )
1229 for (i
=0; i
<num_dcs
; i
++) {
1230 DEBUG(10, ("find_new_dc: open_any_socket_out failed for "
1231 "domain %s address %s. Error was %s\n",
1232 domain
->name
, inet_ntoa(dcs
[i
].ip
), strerror(errno
) ));
1233 winbind_add_failed_connection_entry(domain
,
1234 dcs
[i
].name
, NT_STATUS_UNSUCCESSFUL
);
1239 *addr
= addrs
[fd_index
];
1241 if (*dcnames
[fd_index
] != '\0' && !is_ipaddress(dcnames
[fd_index
])) {
1242 /* Ok, we've got a name for the DC */
1243 fstrcpy(dcname
, dcnames
[fd_index
]);
1247 /* Try to figure out the name */
1248 if (dcip_to_name( domain
, addr
->sin_addr
, dcname
)) {
1252 /* We can not continue without the DC's name */
1253 winbind_add_failed_connection_entry(domain
, dcs
[fd_index
].name
,
1254 NT_STATUS_UNSUCCESSFUL
);
1258 static NTSTATUS
cm_open_connection(struct winbindd_domain
*domain
,
1259 struct winbindd_cm_conn
*new_conn
)
1261 TALLOC_CTX
*mem_ctx
;
1263 char *saf_servername
= saf_fetch( domain
->name
);
1266 if ((mem_ctx
= talloc_init("cm_open_connection")) == NULL
) {
1267 SAFE_FREE(saf_servername
);
1268 set_domain_offline(domain
);
1269 return NT_STATUS_NO_MEMORY
;
1272 /* we have to check the server affinity cache here since
1273 later we selecte a DC based on response time and not preference */
1275 /* Check the negative connection cache
1276 before talking to it. It going down may have
1277 triggered the reconnection. */
1279 if ( saf_servername
&& NT_STATUS_IS_OK(check_negative_conn_cache( domain
->name
, saf_servername
))) {
1281 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1282 saf_servername
, domain
->name
));
1284 /* convert an ip address to a name */
1285 if ( is_ipaddress( saf_servername
) ) {
1289 ip
= *interpret_addr2( saf_servername
);
1290 if (dcip_to_name( domain
, ip
, saf_name
)) {
1291 fstrcpy( domain
->dcname
, saf_name
);
1293 winbind_add_failed_connection_entry(
1294 domain
, saf_servername
,
1295 NT_STATUS_UNSUCCESSFUL
);
1298 fstrcpy( domain
->dcname
, saf_servername
);
1301 SAFE_FREE( saf_servername
);
1304 for (retries
= 0; retries
< 3; retries
++) {
1309 result
= NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1311 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1312 domain
->dcname
, domain
->name
));
1315 && NT_STATUS_IS_OK(check_negative_conn_cache( domain
->name
, domain
->dcname
))
1316 && (resolve_name(domain
->dcname
, &domain
->dcaddr
.sin_addr
, 0x20)))
1318 struct sockaddr_in
*addrs
= NULL
;
1322 if (!add_sockaddr_to_array(mem_ctx
, domain
->dcaddr
.sin_addr
, 445, &addrs
, &num_addrs
)) {
1323 set_domain_offline(domain
);
1324 talloc_destroy(mem_ctx
);
1325 return NT_STATUS_NO_MEMORY
;
1327 if (!add_sockaddr_to_array(mem_ctx
, domain
->dcaddr
.sin_addr
, 139, &addrs
, &num_addrs
)) {
1328 set_domain_offline(domain
);
1329 talloc_destroy(mem_ctx
);
1330 return NT_STATUS_NO_MEMORY
;
1333 /* 5 second timeout. */
1334 if (!open_any_socket_out(addrs
, num_addrs
, 5000, &dummy
, &fd
)) {
1340 && !find_new_dc(mem_ctx
, domain
, domain
->dcname
, &domain
->dcaddr
, &fd
))
1342 /* This is the one place where we will
1343 set the global winbindd offline state
1344 to true, if a "WINBINDD_OFFLINE" entry
1345 is found in the winbindd cache. */
1346 set_global_winbindd_state_offline();
1350 new_conn
->cli
= NULL
;
1352 result
= cm_prepare_connection(domain
, fd
, domain
->dcname
,
1353 &new_conn
->cli
, &retry
);
1359 if (NT_STATUS_IS_OK(result
)) {
1360 if (domain
->online
== False
) {
1361 /* We're changing state from offline to online. */
1362 set_global_winbindd_state_online();
1364 set_domain_online(domain
);
1366 /* Ensure we setup the retry handler. */
1367 set_domain_offline(domain
);
1370 talloc_destroy(mem_ctx
);
1374 /* Close down all open pipes on a connection. */
1376 void invalidate_cm_connection(struct winbindd_cm_conn
*conn
)
1378 /* We're closing down a possibly dead
1379 connection. Don't have impossibly long (10s) timeouts. */
1382 cli_set_timeout(conn
->cli
, 1000); /* 1 second. */
1385 if (conn
->samr_pipe
!= NULL
) {
1386 if (!cli_rpc_pipe_close(conn
->samr_pipe
)) {
1387 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1389 cli_set_timeout(conn
->cli
, 500);
1392 conn
->samr_pipe
= NULL
;
1395 if (conn
->lsa_pipe
!= NULL
) {
1396 if (!cli_rpc_pipe_close(conn
->lsa_pipe
)) {
1397 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1399 cli_set_timeout(conn
->cli
, 500);
1402 conn
->lsa_pipe
= NULL
;
1405 if (conn
->netlogon_pipe
!= NULL
) {
1406 if (!cli_rpc_pipe_close(conn
->netlogon_pipe
)) {
1407 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1409 cli_set_timeout(conn
->cli
, 500);
1412 conn
->netlogon_pipe
= NULL
;
1416 cli_shutdown(conn
->cli
);
1422 void close_conns_after_fork(void)
1424 struct winbindd_domain
*domain
;
1426 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1427 if (domain
->conn
.cli
== NULL
)
1430 if (domain
->conn
.cli
->fd
== -1)
1433 close(domain
->conn
.cli
->fd
);
1434 domain
->conn
.cli
->fd
= -1;
1438 static BOOL
connection_ok(struct winbindd_domain
*domain
)
1440 if (domain
->conn
.cli
== NULL
) {
1441 DEBUG(8, ("connection_ok: Connection to %s for domain %s has NULL "
1442 "cli!\n", domain
->dcname
, domain
->name
));
1446 if (!domain
->conn
.cli
->initialised
) {
1447 DEBUG(3, ("connection_ok: Connection to %s for domain %s was never "
1448 "initialised!\n", domain
->dcname
, domain
->name
));
1452 if (domain
->conn
.cli
->fd
== -1) {
1453 DEBUG(3, ("connection_ok: Connection to %s for domain %s has died or was "
1454 "never started (fd == -1)\n",
1455 domain
->dcname
, domain
->name
));
1459 if (domain
->online
== False
) {
1460 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain
->name
));
1467 /* Initialize a new connection up to the RPC BIND.
1468 Bypass online status check so always does network calls. */
1470 static NTSTATUS
init_dc_connection_network(struct winbindd_domain
*domain
)
1474 /* Internal connections never use the network. */
1475 if (domain
->internal
) {
1476 domain
->initialized
= True
;
1477 return NT_STATUS_OK
;
1480 if (connection_ok(domain
)) {
1481 if (!domain
->initialized
) {
1482 set_dc_type_and_flags(domain
);
1484 return NT_STATUS_OK
;
1487 invalidate_cm_connection(&domain
->conn
);
1489 result
= cm_open_connection(domain
, &domain
->conn
);
1491 if (NT_STATUS_IS_OK(result
) && !domain
->initialized
) {
1492 set_dc_type_and_flags(domain
);
1498 NTSTATUS
init_dc_connection(struct winbindd_domain
*domain
)
1500 if (domain
->initialized
&& !domain
->online
) {
1501 /* We check for online status elsewhere. */
1502 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1505 return init_dc_connection_network(domain
);
1508 /******************************************************************************
1509 We can 'sense' certain things about the DC by it's replies to certain
1512 This tells us if this particular remote server is Active Directory, and if it
1514 ******************************************************************************/
1516 static void set_dc_type_and_flags( struct winbindd_domain
*domain
)
1520 TALLOC_CTX
*mem_ctx
= NULL
;
1521 struct rpc_pipe_client
*cli
;
1524 char *domain_name
= NULL
;
1525 char *dns_name
= NULL
;
1526 char *forest_name
= NULL
;
1527 DOM_SID
*dom_sid
= NULL
;
1531 if (!connection_ok(domain
)) {
1535 DEBUG(5, ("set_dc_type_and_flags: domain %s\n", domain
->name
));
1537 cli
= cli_rpc_pipe_open_noauth(domain
->conn
.cli
, PI_LSARPC_DS
,
1541 DEBUG(5, ("set_dc_type_and_flags: Could not bind to "
1542 "PI_LSARPC_DS on domain %s: (%s)\n",
1543 domain
->name
, nt_errstr(result
)));
1545 /* if this is just a non-AD domain we need to continue
1546 * identifying so that we can in the end return with
1547 * domain->initialized = True - gd */
1552 result
= rpccli_ds_getprimarydominfo(cli
, cli
->cli
->mem_ctx
,
1553 DsRolePrimaryDomainInfoBasic
,
1555 cli_rpc_pipe_close(cli
);
1557 if (!NT_STATUS_IS_OK(result
)) {
1558 DEBUG(5, ("set_dc_type_and_flags: rpccli_ds_getprimarydominfo "
1559 "on domain %s failed: (%s)\n",
1560 domain
->name
, nt_errstr(result
)));
1562 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1563 * every opcode on the LSARPC_DS pipe, continue with
1564 * no_lsarpc_ds mode here as well to get domain->initialized
1567 if (NT_STATUS_V(result
) == DCERPC_FAULT_OP_RNG_ERROR
) {
1574 if ((ctr
.basic
->flags
& DSROLE_PRIMARY_DS_RUNNING
) &&
1575 !(ctr
.basic
->flags
& DSROLE_PRIMARY_DS_MIXED_MODE
)) {
1576 domain
->native_mode
= True
;
1578 domain
->native_mode
= False
;
1582 cli
= cli_rpc_pipe_open_noauth(domain
->conn
.cli
, PI_LSARPC
, &result
);
1585 DEBUG(5, ("set_dc_type_and_flags: Could not bind to "
1586 "PI_LSARPC on domain %s: (%s)\n",
1587 domain
->name
, nt_errstr(result
)));
1588 cli_rpc_pipe_close(cli
);
1592 mem_ctx
= talloc_init("set_dc_type_and_flags on domain %s\n",
1595 DEBUG(1, ("set_dc_type_and_flags: talloc_init() failed\n"));
1596 cli_rpc_pipe_close(cli
);
1600 result
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
1601 SEC_RIGHTS_MAXIMUM_ALLOWED
, &pol
);
1603 if (NT_STATUS_IS_OK(result
)) {
1604 /* This particular query is exactly what Win2k clients use
1605 to determine that the DC is active directory */
1606 result
= rpccli_lsa_query_info_policy2(cli
, mem_ctx
, &pol
,
1608 &dns_name
, &forest_name
,
1612 if (NT_STATUS_IS_OK(result
)) {
1613 domain
->active_directory
= True
;
1616 fstrcpy(domain
->name
, domain_name
);
1619 fstrcpy(domain
->alt_name
, dns_name
);
1622 fstrcpy(domain
->forest_name
, forest_name
);
1625 sid_copy(&domain
->sid
, dom_sid
);
1627 domain
->active_directory
= False
;
1629 result
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
1630 SEC_RIGHTS_MAXIMUM_ALLOWED
,
1633 if (!NT_STATUS_IS_OK(result
))
1636 result
= rpccli_lsa_query_info_policy(cli
, mem_ctx
,
1637 &pol
, 5, &domain_name
,
1640 if (NT_STATUS_IS_OK(result
)) {
1642 fstrcpy(domain
->name
, domain_name
);
1645 sid_copy(&domain
->sid
, dom_sid
);
1650 DEBUG(5, ("set_dc_type_and_flags: domain %s is %sin native mode.\n",
1651 domain
->name
, domain
->native_mode
? "" : "NOT "));
1653 DEBUG(5,("set_dc_type_and_flags: domain %s is %srunning active directory.\n",
1654 domain
->name
, domain
->active_directory
? "" : "NOT "));
1656 cli_rpc_pipe_close(cli
);
1658 talloc_destroy(mem_ctx
);
1660 domain
->initialized
= True
;
1663 static BOOL
cm_get_schannel_dcinfo(struct winbindd_domain
*domain
,
1664 struct dcinfo
**ppdc
)
1667 struct rpc_pipe_client
*netlogon_pipe
;
1669 if (lp_client_schannel() == False
) {
1673 result
= cm_connect_netlogon(domain
, &netlogon_pipe
);
1674 if (!NT_STATUS_IS_OK(result
)) {
1678 /* Return a pointer to the struct dcinfo from the
1681 *ppdc
= domain
->conn
.netlogon_pipe
->dc
;
1685 NTSTATUS
cm_connect_sam(struct winbindd_domain
*domain
, TALLOC_CTX
*mem_ctx
,
1686 struct rpc_pipe_client
**cli
, POLICY_HND
*sam_handle
)
1688 struct winbindd_cm_conn
*conn
;
1689 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1691 struct dcinfo
*p_dcinfo
;
1693 result
= init_dc_connection(domain
);
1694 if (!NT_STATUS_IS_OK(result
)) {
1698 conn
= &domain
->conn
;
1700 if (conn
->samr_pipe
!= NULL
) {
1705 * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
1706 * sign and sealed pipe using the machine account password by
1707 * preference. If we can't - try schannel, if that fails, try
1711 pwd_get_cleartext(&conn
->cli
->pwd
, conn_pwd
);
1712 if ((conn
->cli
->user_name
[0] == '\0') ||
1713 (conn
->cli
->domain
[0] == '\0') ||
1714 (conn_pwd
[0] == '\0')) {
1715 DEBUG(10, ("cm_connect_sam: No no user available for "
1716 "domain %s, trying schannel\n", conn
->cli
->domain
));
1720 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
1721 authenticated SAMR pipe with sign & seal. */
1723 cli_rpc_pipe_open_spnego_ntlmssp(conn
->cli
, PI_SAMR
,
1724 PIPE_AUTH_LEVEL_PRIVACY
,
1726 conn
->cli
->user_name
,
1729 if (conn
->samr_pipe
== NULL
) {
1730 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
1731 "pipe for domain %s using NTLMSSP "
1732 "authenticated pipe: user %s\\%s. Error was "
1733 "%s\n", domain
->name
, conn
->cli
->domain
,
1734 conn
->cli
->user_name
, nt_errstr(result
)));
1738 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
1739 "domain %s using NTLMSSP authenticated "
1740 "pipe: user %s\\%s\n", domain
->name
,
1741 conn
->cli
->domain
, conn
->cli
->user_name
));
1743 result
= rpccli_samr_connect(conn
->samr_pipe
, mem_ctx
,
1744 SEC_RIGHTS_MAXIMUM_ALLOWED
,
1745 &conn
->sam_connect_handle
);
1746 if (NT_STATUS_IS_OK(result
)) {
1749 DEBUG(10,("cm_connect_sam: ntlmssp-sealed rpccli_samr_connect "
1750 "failed for domain %s, error was %s. Trying schannel\n",
1751 domain
->name
, nt_errstr(result
) ));
1752 cli_rpc_pipe_close(conn
->samr_pipe
);
1756 /* Fall back to schannel if it's a W2K pre-SP1 box. */
1758 if (!cm_get_schannel_dcinfo(domain
, &p_dcinfo
)) {
1759 /* If this call fails - conn->cli can now be NULL ! */
1760 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
1761 "for domain %s, trying anon\n", domain
->name
));
1764 conn
->samr_pipe
= cli_rpc_pipe_open_schannel_with_key
1765 (conn
->cli
, PI_SAMR
, PIPE_AUTH_LEVEL_PRIVACY
,
1766 domain
->name
, p_dcinfo
, &result
);
1768 if (conn
->samr_pipe
== NULL
) {
1769 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
1770 "domain %s using schannel. Error was %s\n",
1771 domain
->name
, nt_errstr(result
) ));
1774 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
1775 "schannel.\n", domain
->name
));
1777 result
= rpccli_samr_connect(conn
->samr_pipe
, mem_ctx
,
1778 SEC_RIGHTS_MAXIMUM_ALLOWED
,
1779 &conn
->sam_connect_handle
);
1780 if (NT_STATUS_IS_OK(result
)) {
1783 DEBUG(10,("cm_connect_sam: schannel-sealed rpccli_samr_connect failed "
1784 "for domain %s, error was %s. Trying anonymous\n",
1785 domain
->name
, nt_errstr(result
) ));
1786 cli_rpc_pipe_close(conn
->samr_pipe
);
1790 /* Finally fall back to anonymous. */
1791 conn
->samr_pipe
= cli_rpc_pipe_open_noauth(conn
->cli
, PI_SAMR
,
1794 if (conn
->samr_pipe
== NULL
) {
1795 result
= NT_STATUS_PIPE_NOT_AVAILABLE
;
1799 result
= rpccli_samr_connect(conn
->samr_pipe
, mem_ctx
,
1800 SEC_RIGHTS_MAXIMUM_ALLOWED
,
1801 &conn
->sam_connect_handle
);
1802 if (!NT_STATUS_IS_OK(result
)) {
1803 DEBUG(10,("cm_connect_sam: rpccli_samr_connect failed "
1804 "for domain %s Error was %s\n",
1805 domain
->name
, nt_errstr(result
) ));
1810 result
= rpccli_samr_open_domain(conn
->samr_pipe
,
1812 &conn
->sam_connect_handle
,
1813 SEC_RIGHTS_MAXIMUM_ALLOWED
,
1815 &conn
->sam_domain_handle
);
1819 if (!NT_STATUS_IS_OK(result
)) {
1820 invalidate_cm_connection(conn
);
1824 *cli
= conn
->samr_pipe
;
1825 *sam_handle
= conn
->sam_domain_handle
;
1829 NTSTATUS
cm_connect_lsa(struct winbindd_domain
*domain
, TALLOC_CTX
*mem_ctx
,
1830 struct rpc_pipe_client
**cli
, POLICY_HND
*lsa_policy
)
1832 struct winbindd_cm_conn
*conn
;
1833 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1835 struct dcinfo
*p_dcinfo
;
1837 result
= init_dc_connection(domain
);
1838 if (!NT_STATUS_IS_OK(result
))
1841 conn
= &domain
->conn
;
1843 if (conn
->lsa_pipe
!= NULL
) {
1847 pwd_get_cleartext(&conn
->cli
->pwd
, conn_pwd
);
1848 if ((conn
->cli
->user_name
[0] == '\0') ||
1849 (conn
->cli
->domain
[0] == '\0') ||
1850 (conn_pwd
[0] == '\0')) {
1851 DEBUG(10, ("cm_connect_lsa: No no user available for "
1852 "domain %s, trying schannel\n", conn
->cli
->domain
));
1856 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
1857 * authenticated LSA pipe with sign & seal. */
1858 conn
->lsa_pipe
= cli_rpc_pipe_open_spnego_ntlmssp
1859 (conn
->cli
, PI_LSARPC
, PIPE_AUTH_LEVEL_PRIVACY
,
1860 conn
->cli
->domain
, conn
->cli
->user_name
, conn_pwd
, &result
);
1862 if (conn
->lsa_pipe
== NULL
) {
1863 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
1864 "domain %s using NTLMSSP authenticated pipe: user "
1865 "%s\\%s. Error was %s. Trying schannel.\n",
1866 domain
->name
, conn
->cli
->domain
,
1867 conn
->cli
->user_name
, nt_errstr(result
)));
1871 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
1872 "NTLMSSP authenticated pipe: user %s\\%s\n",
1873 domain
->name
, conn
->cli
->domain
, conn
->cli
->user_name
));
1875 result
= rpccli_lsa_open_policy(conn
->lsa_pipe
, mem_ctx
, True
,
1876 SEC_RIGHTS_MAXIMUM_ALLOWED
,
1878 if (NT_STATUS_IS_OK(result
)) {
1882 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
1885 cli_rpc_pipe_close(conn
->lsa_pipe
);
1889 /* Fall back to schannel if it's a W2K pre-SP1 box. */
1891 if (!cm_get_schannel_dcinfo(domain
, &p_dcinfo
)) {
1892 /* If this call fails - conn->cli can now be NULL ! */
1893 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
1894 "for domain %s, trying anon\n", domain
->name
));
1897 conn
->lsa_pipe
= cli_rpc_pipe_open_schannel_with_key
1898 (conn
->cli
, PI_LSARPC
, PIPE_AUTH_LEVEL_PRIVACY
,
1899 domain
->name
, p_dcinfo
, &result
);
1901 if (conn
->lsa_pipe
== NULL
) {
1902 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
1903 "domain %s using schannel. Error was %s\n",
1904 domain
->name
, nt_errstr(result
) ));
1907 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
1908 "schannel.\n", domain
->name
));
1910 result
= rpccli_lsa_open_policy(conn
->lsa_pipe
, mem_ctx
, True
,
1911 SEC_RIGHTS_MAXIMUM_ALLOWED
,
1913 if (NT_STATUS_IS_OK(result
)) {
1917 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
1920 cli_rpc_pipe_close(conn
->lsa_pipe
);
1924 conn
->lsa_pipe
= cli_rpc_pipe_open_noauth(conn
->cli
, PI_LSARPC
,
1926 if (conn
->lsa_pipe
== NULL
) {
1927 result
= NT_STATUS_PIPE_NOT_AVAILABLE
;
1931 result
= rpccli_lsa_open_policy(conn
->lsa_pipe
, mem_ctx
, True
,
1932 SEC_RIGHTS_MAXIMUM_ALLOWED
,
1935 if (!NT_STATUS_IS_OK(result
)) {
1936 invalidate_cm_connection(conn
);
1940 *cli
= conn
->lsa_pipe
;
1941 *lsa_policy
= conn
->lsa_policy
;
1945 /****************************************************************************
1946 Open the netlogon pipe to this DC. Use schannel if specified in client conf.
1947 session key stored in conn->netlogon_pipe->dc->sess_key.
1948 ****************************************************************************/
1950 NTSTATUS
cm_connect_netlogon(struct winbindd_domain
*domain
,
1951 struct rpc_pipe_client
**cli
)
1953 struct winbindd_cm_conn
*conn
;
1956 uint32 neg_flags
= NETLOGON_NEG_AUTH2_FLAGS
;
1958 uint32 sec_chan_type
;
1959 const char *account_name
;
1960 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
1964 result
= init_dc_connection(domain
);
1965 if (!NT_STATUS_IS_OK(result
)) {
1969 conn
= &domain
->conn
;
1971 if (conn
->netlogon_pipe
!= NULL
) {
1972 *cli
= conn
->netlogon_pipe
;
1973 return NT_STATUS_OK
;
1976 if (!get_trust_pw(domain
->name
, mach_pwd
, &sec_chan_type
)) {
1977 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1980 netlogon_pipe
= cli_rpc_pipe_open_noauth(conn
->cli
, PI_NETLOGON
,
1982 if (netlogon_pipe
== NULL
) {
1986 if (lp_client_schannel() != False
) {
1987 neg_flags
|= NETLOGON_NEG_SCHANNEL
;
1990 /* if we are a DC and this is a trusted domain, then we need to use our
1991 domain name in the net_req_auth2() request */
1994 && !strequal(domain
->name
, lp_workgroup())
1995 && lp_allow_trusted_domains() )
1997 account_name
= lp_workgroup();
1999 account_name
= domain
->primary
?
2000 global_myname() : domain
->name
;
2003 if (account_name
== NULL
) {
2004 cli_rpc_pipe_close(netlogon_pipe
);
2005 return NT_STATUS_NO_MEMORY
;
2008 result
= rpccli_netlogon_setup_creds(
2010 domain
->dcname
, /* server name. */
2011 domain
->name
, /* domain name */
2012 global_myname(), /* client name */
2013 account_name
, /* machine account */
2014 mach_pwd
, /* machine password */
2015 sec_chan_type
, /* from get_trust_pw */
2018 if (!NT_STATUS_IS_OK(result
)) {
2019 cli_rpc_pipe_close(netlogon_pipe
);
2023 if ((lp_client_schannel() == True
) &&
2024 ((neg_flags
& NETLOGON_NEG_SCHANNEL
) == 0)) {
2025 DEBUG(3, ("Server did not offer schannel\n"));
2026 cli_rpc_pipe_close(netlogon_pipe
);
2027 return NT_STATUS_ACCESS_DENIED
;
2030 if ((lp_client_schannel() == False
) ||
2031 ((neg_flags
& NETLOGON_NEG_SCHANNEL
) == 0)) {
2032 /* We're done - just keep the existing connection to NETLOGON
2034 conn
->netlogon_pipe
= netlogon_pipe
;
2035 *cli
= conn
->netlogon_pipe
;
2036 return NT_STATUS_OK
;
2039 /* Using the credentials from the first pipe, open a signed and sealed
2040 second netlogon pipe. The session key is stored in the schannel
2041 part of the new pipe auth struct.
2044 conn
->netlogon_pipe
=
2045 cli_rpc_pipe_open_schannel_with_key(conn
->cli
,
2047 PIPE_AUTH_LEVEL_PRIVACY
,
2052 /* We can now close the initial netlogon pipe. */
2053 cli_rpc_pipe_close(netlogon_pipe
);
2055 if (conn
->netlogon_pipe
== NULL
) {
2056 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2057 "was %s\n", nt_errstr(result
)));
2059 /* make sure we return something besides OK */
2060 return !NT_STATUS_IS_OK(result
) ? result
: NT_STATUS_PIPE_NOT_AVAILABLE
;
2063 *cli
= conn
->netlogon_pipe
;
2064 return NT_STATUS_OK
;