source3/winbindd/winbindd_cm.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon connection manager
   5
   6    Copyright (C) Tim Potter                2001
   7    Copyright (C) Andrew Bartlett           2002
   8    Copyright (C) Gerald (Jerry) Carter     2003-2005.
   9    Copyright (C) Volker Lendecke           2004-2005
  10    Copyright (C) Jeremy Allison            2006
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 /*
  27    We need to manage connections to domain controllers without having to
  28    mess up the main winbindd code with other issues.  The aim of the
  29    connection manager is to:
  30
  31        - make connections to domain controllers and cache them
  32        - re-establish connections when networks or servers go down
  33        - centralise the policy on connection timeouts, domain controller
  34          selection etc
  35        - manage re-entrancy for when winbindd becomes able to handle
  36          multiple outstanding rpc requests
  37
  38    Why not have connection management as part of the rpc layer like tng?
  39    Good question.  This code may morph into libsmb/rpc_cache.c or something
  40    like that but at the moment it's simply staying as part of winbind.  I
  41    think the TNG architecture of forcing every user of the rpc layer to use
  42    the connection caching system is a bad idea.  It should be an optional
  43    method of using the routines.
  44
  45    The TNG design is quite good but I disagree with some aspects of the
  46    implementation. -tpot
  47
  48  */
  49
  50 /*
  51    TODO:
  52
  53      - I'm pretty annoyed by all the make_nmb_name() stuff.  It should be
  54        moved down into another function.
  55
  56      - Take care when destroying cli_structs as they can be shared between
  57        various sam handles.
  58
  59  */
  60
  61 #include "includes.h"
  62 #include "winbindd.h"
  63 #include "../libcli/auth/libcli_auth.h"
  64 #include "../librpc/gen_ndr/cli_netlogon.h"
  65 #include "../librpc/gen_ndr/cli_samr.h"
  66 #include "../librpc/gen_ndr/cli_lsa.h"
  67 #include "../librpc/gen_ndr/cli_dssetup.h"
  68
  69 #undef DBGC_CLASS
  70 #define DBGC_CLASS DBGC_WINBIND
  71
  72 struct dc_name_ip {
  73         fstring name;
  74         struct sockaddr_storage ss;
  75 };
  76
  77 extern struct winbindd_methods reconnect_methods;
  78 extern bool override_logfile;
  79
  80 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
  81 static void set_dc_type_and_flags( struct winbindd_domain *domain );
  82 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
  83                     struct dc_name_ip **dcs, int *num_dcs);
  84
  85 /****************************************************************
  86  Child failed to find DC's. Reschedule check.
  87 ****************************************************************/
  88
  89 static void msg_failed_to_go_online(struct messaging_context *msg,
  90                                     void *private_data,
  91                                     uint32_t msg_type,
  92                                     struct server_id server_id,
  93                                     DATA_BLOB *data)
  94 {
  95         struct winbindd_domain *domain;
  96         const char *domainname = (const char *)data->data;
  97
  98         if (data->data == NULL || data->length == 0) {
  99                 return;
 100         }
 101
 102         DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
 103
 104         for (domain = domain_list(); domain; domain = domain->next) {
 105                 if (domain->internal) {
 106                         continue;
 107                 }
 108
 109                 if (strequal(domain->name, domainname)) {
 110                         if (domain->online) {
 111                                 /* We're already online, ignore. */
 112                                 DEBUG(5,("msg_fail_to_go_online: domain %s "
 113                                         "already online.\n", domainname));
 114                                 continue;
 115                         }
 116
 117                         /* Reschedule the online check. */
 118                         set_domain_offline(domain);
 119                         break;
 120                 }
 121         }
 122 }
 123
 124 /****************************************************************
 125  Actually cause a reconnect from a message.
 126 ****************************************************************/
 127
 128 static void msg_try_to_go_online(struct messaging_context *msg,
 129                                  void *private_data,
 130                                  uint32_t msg_type,
 131                                  struct server_id server_id,
 132                                  DATA_BLOB *data)
 133 {
 134         struct winbindd_domain *domain;
 135         const char *domainname = (const char *)data->data;
 136
 137         if (data->data == NULL || data->length == 0) {
 138                 return;
 139         }
 140
 141         DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
 142
 143         for (domain = domain_list(); domain; domain = domain->next) {
 144                 if (domain->internal) {
 145                         continue;
 146                 }
 147
 148                 if (strequal(domain->name, domainname)) {
 149
 150                         if (domain->online) {
 151                                 /* We're already online, ignore. */
 152                                 DEBUG(5,("msg_try_to_go_online: domain %s "
 153                                         "already online.\n", domainname));
 154                                 continue;
 155                         }
 156
 157                         /* This call takes care of setting the online
 158                            flag to true if we connected, or re-adding
 159                            the offline handler if false. Bypasses online
 160                            check so always does network calls. */
 161
 162                         init_dc_connection_network(domain);
 163                         break;
 164                 }
 165         }
 166 }
 167
 168 /****************************************************************
 169  Fork a child to try and contact a DC. Do this as contacting a
 170  DC requires blocking lookups and we don't want to block our
 171  parent.
 172 ****************************************************************/
 173
 174 static bool fork_child_dc_connect(struct winbindd_domain *domain)
 175 {
 176         struct dc_name_ip *dcs = NULL;
 177         int num_dcs = 0;
 178         TALLOC_CTX *mem_ctx = NULL;
 179         pid_t parent_pid = sys_getpid();
 180         char *lfile = NULL;
 181
 182         if (domain->dc_probe_pid != (pid_t)-1) {
 183                 /*
 184                  * We might already have a DC probe
 185                  * child working, check.
 186                  */
 187                 if (process_exists_by_pid(domain->dc_probe_pid)) {
 188                         DEBUG(10,("fork_child_dc_connect: pid %u already "
 189                                 "checking for DC's.\n",
 190                                 (unsigned int)domain->dc_probe_pid));
 191                         return true;
 192                 }
 193                 domain->dc_probe_pid = (pid_t)-1;
 194         }
 195
 196         domain->dc_probe_pid = sys_fork();
 197
 198         if (domain->dc_probe_pid == (pid_t)-1) {
 199                 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
 200                 return False;
 201         }
 202
 203         if (domain->dc_probe_pid != (pid_t)0) {
 204                 /* Parent */
 205                 messaging_register(winbind_messaging_context(), NULL,
 206                                    MSG_WINBIND_TRY_TO_GO_ONLINE,
 207                                    msg_try_to_go_online);
 208                 messaging_register(winbind_messaging_context(), NULL,
 209                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 210                                    msg_failed_to_go_online);
 211                 return True;
 212         }
 213
 214         /* Child. */
 215
 216         /* Leave messages blocked - we will never process one. */
 217
 218         if (!override_logfile) {
 219                 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
 220                         DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
 221                         _exit(1);
 222                 }
 223         }
 224
 225         if (!winbindd_reinit_after_fork(lfile)) {
 226                 messaging_send_buf(winbind_messaging_context(),
 227                                    pid_to_procid(parent_pid),
 228                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 229                                    (uint8 *)domain->name,
 230                                    strlen(domain->name)+1);
 231                 _exit(1);
 232         }
 233         SAFE_FREE(lfile);
 234
 235         mem_ctx = talloc_init("fork_child_dc_connect");
 236         if (!mem_ctx) {
 237                 DEBUG(0,("talloc_init failed.\n"));
 238                 messaging_send_buf(winbind_messaging_context(),
 239                                    pid_to_procid(parent_pid),
 240                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 241                                    (uint8 *)domain->name,
 242                                    strlen(domain->name)+1);
 243                 _exit(1);
 244         }
 245
 246         if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
 247                 /* Still offline ? Can't find DC's. */
 248                 messaging_send_buf(winbind_messaging_context(),
 249                                    pid_to_procid(parent_pid),
 250                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 251                                    (uint8 *)domain->name,
 252                                    strlen(domain->name)+1);
 253                 _exit(0);
 254         }
 255
 256         /* We got a DC. Send a message to our parent to get it to
 257            try and do the same. */
 258
 259         messaging_send_buf(winbind_messaging_context(),
 260                            pid_to_procid(parent_pid),
 261                            MSG_WINBIND_TRY_TO_GO_ONLINE,
 262                            (uint8 *)domain->name,
 263                            strlen(domain->name)+1);
 264         _exit(0);
 265 }
 266
 267 /****************************************************************
 268  Handler triggered if we're offline to try and detect a DC.
 269 ****************************************************************/
 270
 271 static void check_domain_online_handler(struct event_context *ctx,
 272                                         struct timed_event *te,
 273                                         struct timeval now,
 274                                         void *private_data)
 275 {
 276         struct winbindd_domain *domain =
 277                 (struct winbindd_domain *)private_data;
 278
 279         DEBUG(10,("check_domain_online_handler: called for domain "
 280                   "%s (online = %s)\n", domain->name,
 281                   domain->online ? "True" : "False" ));
 282
 283         TALLOC_FREE(domain->check_online_event);
 284
 285         /* Are we still in "startup" mode ? */
 286
 287         if (domain->startup && (now.tv_sec > domain->startup_time + 30)) {
 288                 /* No longer in "startup" mode. */
 289                 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
 290                         domain->name ));
 291                 domain->startup = False;
 292         }
 293
 294         /* We've been told to stay offline, so stay
 295            that way. */
 296
 297         if (get_global_winbindd_state_offline()) {
 298                 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
 299                         domain->name ));
 300                 return;
 301         }
 302
 303         /* Fork a child to test if it can contact a DC.
 304            If it can then send ourselves a message to
 305            cause a reconnect. */
 306
 307         fork_child_dc_connect(domain);
 308 }
 309
 310 /****************************************************************
 311  If we're still offline setup the timeout check.
 312 ****************************************************************/
 313
 314 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
 315 {
 316         int wbr = lp_winbind_reconnect_delay();
 317
 318         if (domain->startup) {
 319                 domain->check_online_timeout = 10;
 320         } else if (domain->check_online_timeout < wbr) {
 321                 domain->check_online_timeout = wbr;
 322         }
 323 }
 324
 325 /****************************************************************
 326  Set domain offline and also add handler to put us back online
 327  if we detect a DC.
 328 ****************************************************************/
 329
 330 void set_domain_offline(struct winbindd_domain *domain)
 331 {
 332         DEBUG(10,("set_domain_offline: called for domain %s\n",
 333                 domain->name ));
 334
 335         TALLOC_FREE(domain->check_online_event);
 336
 337         if (domain->internal) {
 338                 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
 339                         domain->name ));
 340                 return;
 341         }
 342
 343         domain->online = False;
 344
 345         /* Offline domains are always initialized. They're
 346            re-initialized when they go back online. */
 347
 348         domain->initialized = True;
 349
 350         /* We only add the timeout handler that checks and
 351            allows us to go back online when we've not
 352            been told to remain offline. */
 353
 354         if (get_global_winbindd_state_offline()) {
 355                 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
 356                         domain->name ));
 357                 return;
 358         }
 359
 360         /* If we're in startup mode, check again in 10 seconds, not in
 361            lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
 362
 363         calc_new_online_timeout_check(domain);
 364
 365         domain->check_online_event = event_add_timed(winbind_event_context(),
 366                                                 NULL,
 367                                                 timeval_current_ofs(domain->check_online_timeout,0),
 368                                                 check_domain_online_handler,
 369                                                 domain);
 370
 371         /* The above *has* to succeed for winbindd to work. */
 372         if (!domain->check_online_event) {
 373                 smb_panic("set_domain_offline: failed to add online handler");
 374         }
 375
 376         DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
 377                 domain->name ));
 378
 379         /* Send an offline message to the idmap child when our
 380            primary domain goes offline */
 381
 382         if ( domain->primary ) {
 383                 struct winbindd_child *idmap = idmap_child();
 384
 385                 if ( idmap->pid != 0 ) {
 386                         messaging_send_buf(winbind_messaging_context(),
 387                                            pid_to_procid(idmap->pid),
 388                                            MSG_WINBIND_OFFLINE,
 389                                            (uint8 *)domain->name,
 390                                            strlen(domain->name)+1);
 391                 }
 392         }
 393
 394         return;
 395 }
 396
 397 /****************************************************************
 398  Set domain online - if allowed.
 399 ****************************************************************/
 400
 401 static void set_domain_online(struct winbindd_domain *domain)
 402 {
 403         DEBUG(10,("set_domain_online: called for domain %s\n",
 404                 domain->name ));
 405
 406         if (domain->internal) {
 407                 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
 408                         domain->name ));
 409                 return;
 410         }
 411
 412         if (get_global_winbindd_state_offline()) {
 413                 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
 414                         domain->name ));
 415                 return;
 416         }
 417
 418         winbindd_set_locator_kdc_envs(domain);
 419
 420         /* If we are waiting to get a krb5 ticket, trigger immediately. */
 421         ccache_regain_all_now();
 422
 423         /* Ok, we're out of any startup mode now... */
 424         domain->startup = False;
 425
 426         if (domain->online == False) {
 427                 /* We were offline - now we're online. We default to
 428                    using the MS-RPC backend if we started offline,
 429                    and if we're going online for the first time we
 430                    should really re-initialize the backends and the
 431                    checks to see if we're talking to an AD or NT domain.
 432                 */
 433
 434                 domain->initialized = False;
 435
 436                 /* 'reconnect_methods' is the MS-RPC backend. */
 437                 if (domain->backend == &reconnect_methods) {
 438                         domain->backend = NULL;
 439                 }
 440         }
 441
 442         /* Ensure we have no online timeout checks. */
 443         domain->check_online_timeout = 0;
 444         TALLOC_FREE(domain->check_online_event);
 445
 446         /* Ensure we ignore any pending child messages. */
 447         messaging_deregister(winbind_messaging_context(),
 448                              MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
 449         messaging_deregister(winbind_messaging_context(),
 450                              MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
 451
 452         domain->online = True;
 453
 454         /* Send an online message to the idmap child when our
 455            primary domain comes online */
 456
 457         if ( domain->primary ) {
 458                 struct winbindd_child *idmap = idmap_child();
 459
 460                 if ( idmap->pid != 0 ) {
 461                         messaging_send_buf(winbind_messaging_context(),
 462                                            pid_to_procid(idmap->pid),
 463                                            MSG_WINBIND_ONLINE,
 464                                            (uint8 *)domain->name,
 465                                            strlen(domain->name)+1);
 466                 }
 467         }
 468
 469         return;
 470 }
 471
 472 /****************************************************************
 473  Requested to set a domain online.
 474 ****************************************************************/
 475
 476 void set_domain_online_request(struct winbindd_domain *domain)
 477 {
 478         struct timeval tev;
 479
 480         DEBUG(10,("set_domain_online_request: called for domain %s\n",
 481                 domain->name ));
 482
 483         if (get_global_winbindd_state_offline()) {
 484                 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
 485                         domain->name ));
 486                 return;
 487         }
 488
 489         if (domain->internal) {
 490                 DEBUG(10, ("set_domain_online_request: Internal domains are "
 491                            "always online\n"));
 492                 return;
 493         }
 494
 495         /* We've been told it's safe to go online and
 496            try and connect to a DC. But I don't believe it
 497            because network manager seems to lie.
 498            Wait at least 5 seconds. Heuristics suck... */
 499
 500
 501         GetTimeOfDay(&tev);
 502
 503         /* Go into "startup" mode again. */
 504         domain->startup_time = tev.tv_sec;
 505         domain->startup = True;
 506
 507         tev.tv_sec += 5;
 508
 509         if (!domain->check_online_event) {
 510                 /* If we've come from being globally offline we
 511                    don't have a check online event handler set.
 512                    We need to add one now we're trying to go
 513                    back online. */
 514
 515                 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
 516                         domain->name ));
 517         }
 518
 519         TALLOC_FREE(domain->check_online_event);
 520
 521         domain->check_online_event = event_add_timed(winbind_event_context(),
 522                                                      NULL,
 523                                                      tev,
 524                                                      check_domain_online_handler,
 525                                                      domain);
 526
 527         /* The above *has* to succeed for winbindd to work. */
 528         if (!domain->check_online_event) {
 529                 smb_panic("set_domain_online_request: failed to add online handler");
 530         }
 531 }
 532
 533 /****************************************************************
 534  Add -ve connection cache entries for domain and realm.
 535 ****************************************************************/
 536
 537 void winbind_add_failed_connection_entry(const struct winbindd_domain *domain,
 538                                         const char *server,
 539                                         NTSTATUS result)
 540 {
 541         add_failed_connection_entry(domain->name, server, result);
 542         /* If this was the saf name for the last thing we talked to,
 543            remove it. */
 544         saf_delete(domain->name);
 545         if (*domain->alt_name) {
 546                 add_failed_connection_entry(domain->alt_name, server, result);
 547                 saf_delete(domain->alt_name);
 548         }
 549         winbindd_unset_locator_kdc_env(domain);
 550 }
 551
 552 /* Choose between anonymous or authenticated connections.  We need to use
 553    an authenticated connection if DCs have the RestrictAnonymous registry
 554    entry set > 0, or the "Additional restrictions for anonymous
 555    connections" set in the win2k Local Security Policy.
 556
 557    Caller to free() result in domain, username, password
 558 */
 559
 560 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
 561 {
 562         *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
 563         *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 564         *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
 565
 566         if (*username && **username) {
 567
 568                 if (!*domain || !**domain)
 569                         *domain = smb_xstrdup(lp_workgroup());
 570
 571                 if (!*password || !**password)
 572                         *password = smb_xstrdup("");
 573
 574                 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
 575                           *domain, *username));
 576
 577         } else {
 578                 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
 579                 *username = smb_xstrdup("");
 580                 *domain = smb_xstrdup("");
 581                 *password = smb_xstrdup("");
 582         }
 583 }
 584
 585 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
 586                                      fstring dcname,
 587                                      struct sockaddr_storage *dc_ss)
 588 {
 589         struct winbindd_domain *our_domain = NULL;
 590         struct rpc_pipe_client *netlogon_pipe = NULL;
 591         NTSTATUS result;
 592         WERROR werr;
 593         TALLOC_CTX *mem_ctx;
 594         unsigned int orig_timeout;
 595         const char *tmp = NULL;
 596         const char *p;
 597
 598         /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
 599          * moment.... */
 600
 601         if (IS_DC) {
 602                 return False;
 603         }
 604
 605         if (domain->primary) {
 606                 return False;
 607         }
 608
 609         our_domain = find_our_domain();
 610
 611         if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
 612                 return False;
 613         }
 614
 615         result = cm_connect_netlogon(our_domain, &netlogon_pipe);
 616         if (!NT_STATUS_IS_OK(result)) {
 617                 talloc_destroy(mem_ctx);
 618                 return False;
 619         }
 620
 621         /* This call can take a long time - allow the server to time out.
 622            35 seconds should do it. */
 623
 624         orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
 625
 626         if (our_domain->active_directory) {
 627                 struct netr_DsRGetDCNameInfo *domain_info = NULL;
 628
 629                 result = rpccli_netr_DsRGetDCName(netlogon_pipe,
 630                                                   mem_ctx,
 631                                                   our_domain->dcname,
 632                                                   domain->name,
 633                                                   NULL,
 634                                                   NULL,
 635                                                   DS_RETURN_DNS_NAME,
 636                                                   &domain_info,
 637                                                   &werr);
 638                 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
 639                         tmp = talloc_strdup(
 640                                 mem_ctx, domain_info->dc_unc);
 641                         if (tmp == NULL) {
 642                                 DEBUG(0, ("talloc_strdup failed\n"));
 643                                 talloc_destroy(mem_ctx);
 644                                 return false;
 645                         }
 646                         if (strlen(domain->alt_name) == 0) {
 647                                 fstrcpy(domain->alt_name,
 648                                         domain_info->domain_name);
 649                         }
 650                         if (strlen(domain->forest_name) == 0) {
 651                                 fstrcpy(domain->forest_name,
 652                                         domain_info->forest_name);
 653                         }
 654                 }
 655         } else {
 656                 result = rpccli_netr_GetAnyDCName(netlogon_pipe, mem_ctx,
 657                                                   our_domain->dcname,
 658                                                   domain->name,
 659                                                   &tmp,
 660                                                   &werr);
 661         }
 662
 663         /* And restore our original timeout. */
 664         rpccli_set_timeout(netlogon_pipe, orig_timeout);
 665
 666         if (!NT_STATUS_IS_OK(result)) {
 667                 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
 668                         nt_errstr(result)));
 669                 talloc_destroy(mem_ctx);
 670                 return false;
 671         }
 672
 673         if (!W_ERROR_IS_OK(werr)) {
 674                 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
 675                            win_errstr(werr)));
 676                 talloc_destroy(mem_ctx);
 677                 return false;
 678         }
 679
 680         /* rpccli_netr_GetAnyDCName gives us a name with \\ */
 681         p = strip_hostname(tmp);
 682
 683         fstrcpy(dcname, p);
 684
 685         talloc_destroy(mem_ctx);
 686
 687         DEBUG(10,("rpccli_netr_GetAnyDCName returned %s\n", dcname));
 688
 689         if (!resolve_name(dcname, dc_ss, 0x20, true)) {
 690                 return False;
 691         }
 692
 693         return True;
 694 }
 695
 696 /**
 697  * Helper function to assemble trust password and account name
 698  */
 699 static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
 700                                 char **machine_password,
 701                                 char **machine_account,
 702                                 char **machine_krb5_principal)
 703 {
 704         const char *account_name;
 705         const char *name = NULL;
 706
 707         /* If we are a DC and this is not our own domain */
 708
 709         if (IS_DC) {
 710                 name = domain->name;
 711         } else {
 712                 struct winbindd_domain *our_domain = find_our_domain();
 713
 714                 if (!our_domain)
 715                         return NT_STATUS_INVALID_SERVER_STATE;
 716
 717                 name = our_domain->name;
 718         }
 719
 720         if (!get_trust_pw_clear(name, machine_password,
 721                                 &account_name, NULL))
 722         {
 723                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 724         }
 725
 726         if ((machine_account != NULL) &&
 727             (asprintf(machine_account, "%s$", account_name) == -1))
 728         {
 729                 return NT_STATUS_NO_MEMORY;
 730         }
 731
 732         /* For now assume our machine account only exists in our domain */
 733
 734         if (machine_krb5_principal != NULL)
 735         {
 736                 struct winbindd_domain *our_domain = find_our_domain();
 737
 738                 if (!our_domain) {
 739                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 740                 }
 741
 742                 if (asprintf(machine_krb5_principal, "%s$@%s",
 743                              account_name, our_domain->alt_name) == -1)
 744                 {
 745                         return NT_STATUS_NO_MEMORY;
 746                 }
 747
 748                 strupper_m(*machine_krb5_principal);
 749         }
 750
 751         return NT_STATUS_OK;
 752 }
 753
 754 /************************************************************************
 755  Given a fd with a just-connected TCP connection to a DC, open a connection
 756  to the pipe.
 757 ************************************************************************/
 758
 759 static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 760                                       const int sockfd,
 761                                       const char *controller,
 762                                       struct cli_state **cli,
 763                                       bool *retry)
 764 {
 765         char *machine_password = NULL;
 766         char *machine_krb5_principal = NULL;
 767         char *machine_account = NULL;
 768         char *ipc_username = NULL;
 769         char *ipc_domain = NULL;
 770         char *ipc_password = NULL;
 771
 772         struct named_mutex *mutex;
 773
 774         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 775
 776         struct sockaddr peeraddr;
 777         socklen_t peeraddr_len;
 778
 779         struct sockaddr_in *peeraddr_in =
 780                 (struct sockaddr_in *)(void *)&peeraddr;
 781
 782         DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
 783                 controller, domain->name ));
 784
 785         *retry = True;
 786
 787         mutex = grab_named_mutex(talloc_tos(), controller,
 788                                  WINBIND_SERVER_MUTEX_WAIT_TIME);
 789         if (mutex == NULL) {
 790                 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
 791                          controller));
 792                 result = NT_STATUS_POSSIBLE_DEADLOCK;
 793                 goto done;
 794         }
 795
 796         if ((*cli = cli_initialise()) == NULL) {
 797                 DEBUG(1, ("Could not cli_initialize\n"));
 798                 result = NT_STATUS_NO_MEMORY;
 799                 goto done;
 800         }
 801
 802         (*cli)->timeout = 10000;        /* 10 seconds */
 803         (*cli)->fd = sockfd;
 804         fstrcpy((*cli)->desthost, controller);
 805         (*cli)->use_kerberos = True;
 806
 807         peeraddr_len = sizeof(peeraddr);
 808
 809         if ((getpeername((*cli)->fd, &peeraddr, &peeraddr_len) != 0)) {
 810                 DEBUG(0,("cm_prepare_connection: getpeername failed with: %s\n",
 811                         strerror(errno)));
 812                 result = NT_STATUS_UNSUCCESSFUL;
 813                 goto done;
 814         }
 815
 816         if ((peeraddr_len != sizeof(struct sockaddr_in))
 817 #ifdef HAVE_IPV6
 818             && (peeraddr_len != sizeof(struct sockaddr_in6))
 819 #endif
 820             ) {
 821                 DEBUG(0,("cm_prepare_connection: got unexpected peeraddr len %d\n",
 822                         peeraddr_len));
 823                 result = NT_STATUS_UNSUCCESSFUL;
 824                 goto done;
 825         }
 826
 827         if ((peeraddr_in->sin_family != PF_INET)
 828 #ifdef HAVE_IPV6
 829             && (peeraddr_in->sin_family != PF_INET6)
 830 #endif
 831             ) {
 832                 DEBUG(0,("cm_prepare_connection: got unexpected family %d\n",
 833                         peeraddr_in->sin_family));
 834                 result = NT_STATUS_UNSUCCESSFUL;
 835                 goto done;
 836         }
 837
 838         if (ntohs(peeraddr_in->sin_port) == 139) {
 839                 struct nmb_name calling;
 840                 struct nmb_name called;
 841
 842                 make_nmb_name(&calling, global_myname(), 0x0);
 843                 make_nmb_name(&called, "*SMBSERVER", 0x20);
 844
 845                 if (!cli_session_request(*cli, &calling, &called)) {
 846                         DEBUG(8, ("cli_session_request failed for %s\n",
 847                                   controller));
 848                         result = NT_STATUS_UNSUCCESSFUL;
 849                         goto done;
 850                 }
 851         }
 852
 853         result = cli_negprot(*cli);
 854
 855         if (!NT_STATUS_IS_OK(result)) {
 856                 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
 857                 goto done;
 858         }
 859
 860         if (!is_dc_trusted_domain_situation(domain->name) &&
 861             (*cli)->protocol >= PROTOCOL_NT1 &&
 862             (*cli)->capabilities & CAP_EXTENDED_SECURITY)
 863         {
 864                 ADS_STATUS ads_status;
 865
 866                 result = get_trust_creds(domain, &machine_password,
 867                                          &machine_account,
 868                                          &machine_krb5_principal);
 869                 if (!NT_STATUS_IS_OK(result)) {
 870                         goto anon_fallback;
 871                 }
 872
 873                 if (lp_security() == SEC_ADS) {
 874
 875                         /* Try a krb5 session */
 876
 877                         (*cli)->use_kerberos = True;
 878                         DEBUG(5, ("connecting to %s from %s with kerberos principal "
 879                                   "[%s] and realm [%s]\n", controller, global_myname(),
 880                                   machine_krb5_principal, domain->alt_name));
 881
 882                         winbindd_set_locator_kdc_envs(domain);
 883
 884                         ads_status = cli_session_setup_spnego(*cli,
 885                                                               machine_krb5_principal,
 886                                                               machine_password,
 887                                                               lp_workgroup(),
 888                                                               domain->alt_name);
 889
 890                         if (!ADS_ERR_OK(ads_status)) {
 891                                 DEBUG(4,("failed kerberos session setup with %s\n",
 892                                          ads_errstr(ads_status)));
 893                         }
 894
 895                         result = ads_ntstatus(ads_status);
 896                         if (NT_STATUS_IS_OK(result)) {
 897                                 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 898                                 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 899                                 if (!NT_STATUS_IS_OK(result)) {
 900                                         goto done;
 901                                 }
 902                                 goto session_setup_done;
 903                         }
 904                 }
 905
 906                 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
 907                 (*cli)->use_kerberos = False;
 908
 909                 DEBUG(5, ("connecting to %s from %s with username "
 910                           "[%s]\\[%s]\n",  controller, global_myname(),
 911                           lp_workgroup(), machine_account));
 912
 913                 ads_status = cli_session_setup_spnego(*cli,
 914                                                       machine_account,
 915                                                       machine_password,
 916                                                       lp_workgroup(),
 917                                                       NULL);
 918                 if (!ADS_ERR_OK(ads_status)) {
 919                         DEBUG(4, ("authenticated session setup failed with %s\n",
 920                                 ads_errstr(ads_status)));
 921                 }
 922
 923                 result = ads_ntstatus(ads_status);
 924                 if (NT_STATUS_IS_OK(result)) {
 925                         /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 926                         result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 927                         if (!NT_STATUS_IS_OK(result)) {
 928                                 goto done;
 929                         }
 930                         goto session_setup_done;
 931                 }
 932         }
 933
 934         /* Fall back to non-kerberos session setup with auth_user */
 935
 936         (*cli)->use_kerberos = False;
 937
 938         cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
 939
 940         if ((((*cli)->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) != 0) &&
 941             (strlen(ipc_username) > 0)) {
 942
 943                 /* Only try authenticated if we have a username */
 944
 945                 DEBUG(5, ("connecting to %s from %s with username "
 946                           "[%s]\\[%s]\n",  controller, global_myname(),
 947                           ipc_domain, ipc_username));
 948
 949                 if (NT_STATUS_IS_OK(cli_session_setup(
 950                                             *cli, ipc_username,
 951                                             ipc_password, strlen(ipc_password)+1,
 952                                             ipc_password, strlen(ipc_password)+1,
 953                                             ipc_domain))) {
 954                         /* Successful logon with given username. */
 955                         result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
 956                         if (!NT_STATUS_IS_OK(result)) {
 957                                 goto done;
 958                         }
 959                         goto session_setup_done;
 960                 } else {
 961                         DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
 962                                 ipc_domain, ipc_username ));
 963                 }
 964         }
 965
 966  anon_fallback:
 967
 968         /* Fall back to anonymous connection, this might fail later */
 969         DEBUG(10,("cm_prepare_connection: falling back to anonymous "
 970                 "connection for DC %s\n",
 971                 controller ));
 972
 973         if (NT_STATUS_IS_OK(cli_session_setup(*cli, "", NULL, 0,
 974                                               NULL, 0, ""))) {
 975                 DEBUG(5, ("Connected anonymously\n"));
 976                 result = cli_init_creds(*cli, "", "", "");
 977                 if (!NT_STATUS_IS_OK(result)) {
 978                         goto done;
 979                 }
 980                 goto session_setup_done;
 981         }
 982
 983         result = cli_nt_error(*cli);
 984
 985         if (NT_STATUS_IS_OK(result))
 986                 result = NT_STATUS_UNSUCCESSFUL;
 987
 988         /* We can't session setup */
 989
 990         goto done;
 991
 992  session_setup_done:
 993
 994         /* cache the server name for later connections */
 995
 996         saf_store( domain->name, (*cli)->desthost );
 997         if (domain->alt_name && (*cli)->use_kerberos) {
 998                 saf_store( domain->alt_name, (*cli)->desthost );
 999         }
1000
1001         winbindd_set_locator_kdc_envs(domain);
1002
1003         result = cli_tcon_andx(*cli, "IPC$", "IPC", "", 0);
1004
1005         if (!NT_STATUS_IS_OK(result)) {
1006                 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
1007                 goto done;
1008         }
1009
1010         TALLOC_FREE(mutex);
1011         *retry = False;
1012
1013         /* set the domain if empty; needed for schannel connections */
1014         if ( !(*cli)->domain[0] ) {
1015                 result = cli_set_domain((*cli), domain->name);
1016                 if (!NT_STATUS_IS_OK(result)) {
1017                         return result;
1018                 }
1019         }
1020
1021         result = NT_STATUS_OK;
1022
1023  done:
1024         TALLOC_FREE(mutex);
1025         SAFE_FREE(machine_account);
1026         SAFE_FREE(machine_password);
1027         SAFE_FREE(machine_krb5_principal);
1028         SAFE_FREE(ipc_username);
1029         SAFE_FREE(ipc_domain);
1030         SAFE_FREE(ipc_password);
1031
1032         if (!NT_STATUS_IS_OK(result)) {
1033                 winbind_add_failed_connection_entry(domain, controller, result);
1034                 if ((*cli) != NULL) {
1035                         cli_shutdown(*cli);
1036                         *cli = NULL;
1037                 }
1038         }
1039
1040         return result;
1041 }
1042
1043 /*******************************************************************
1044  Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1045  array.
1046
1047  Keeps the list unique by not adding duplicate entries.
1048
1049  @param[in] mem_ctx talloc memory context to allocate from
1050  @param[in] domain_name domain of the DC
1051  @param[in] dcname name of the DC to add to the list
1052  @param[in] pss Internet address and port pair to add to the list
1053  @param[in,out] dcs array of dc_name_ip structures to add to
1054  @param[in,out] num_dcs number of dcs returned in the dcs array
1055  @return true if the list was added to, false otherwise
1056 *******************************************************************/
1057
1058 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
1059                               const char *dcname, struct sockaddr_storage *pss,
1060                               struct dc_name_ip **dcs, int *num)
1061 {
1062         int i = 0;
1063
1064         if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1065                 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1066                 return False;
1067         }
1068
1069         /* Make sure there's no duplicates in the list */
1070         for (i=0; i<*num; i++)
1071                 if (sockaddr_equal(
1072                             (struct sockaddr *)(void *)&(*dcs)[i].ss,
1073                             (struct sockaddr *)(void *)pss))
1074                         return False;
1075
1076         *dcs = TALLOC_REALLOC_ARRAY(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1077
1078         if (*dcs == NULL)
1079                 return False;
1080
1081         fstrcpy((*dcs)[*num].name, dcname);
1082         (*dcs)[*num].ss = *pss;
1083         *num += 1;
1084         return True;
1085 }
1086
1087 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
1088                                   struct sockaddr_storage *pss, uint16 port,
1089                                   struct sockaddr_storage **addrs, int *num)
1090 {
1091         *addrs = TALLOC_REALLOC_ARRAY(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1092
1093         if (*addrs == NULL) {
1094                 *num = 0;
1095                 return False;
1096         }
1097
1098         (*addrs)[*num] = *pss;
1099         set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1100
1101         *num += 1;
1102         return True;
1103 }
1104
1105 /*******************************************************************
1106  convert an ip to a name
1107 *******************************************************************/
1108
1109 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
1110                 const struct winbindd_domain *domain,
1111                 struct sockaddr_storage *pss,
1112                 fstring name )
1113 {
1114         struct ip_service ip_list;
1115         uint32_t nt_version = NETLOGON_NT_VERSION_1;
1116
1117         ip_list.ss = *pss;
1118         ip_list.port = 0;
1119
1120 #ifdef WITH_ADS
1121         /* For active directory servers, try to get the ldap server name.
1122            None of these failures should be considered critical for now */
1123
1124         if (lp_security() == SEC_ADS) {
1125                 ADS_STRUCT *ads;
1126                 ADS_STATUS ads_status;
1127                 char addr[INET6_ADDRSTRLEN];
1128
1129                 print_sockaddr(addr, sizeof(addr), pss);
1130
1131                 ads = ads_init(domain->alt_name, domain->name, addr);
1132                 ads->auth.flags |= ADS_AUTH_NO_BIND;
1133
1134                 ads_status = ads_connect(ads);
1135                 if (ADS_ERR_OK(ads_status)) {
1136                         /* We got a cldap packet. */
1137                         fstrcpy(name, ads->config.ldap_server_name);
1138                         namecache_store(name, 0x20, 1, &ip_list);
1139
1140                         DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1141
1142                         if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1143                                 if (ads_closest_dc(ads)) {
1144                                         char *sitename = sitename_fetch(ads->config.realm);
1145
1146                                         /* We're going to use this KDC for this realm/domain.
1147                                            If we are using sites, then force the krb5 libs
1148                                            to use this KDC. */
1149
1150                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1151                                                                         domain->name,
1152                                                                         sitename,
1153                                                                         pss,
1154                                                                         name);
1155
1156                                         SAFE_FREE(sitename);
1157                                 } else {
1158                                         /* use an off site KDC */
1159                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1160                                                                         domain->name,
1161                                                                         NULL,
1162                                                                         pss,
1163                                                                         name);
1164                                 }
1165                                 winbindd_set_locator_kdc_envs(domain);
1166
1167                                 /* Ensure we contact this DC also. */
1168                                 saf_store( domain->name, name);
1169                                 saf_store( domain->alt_name, name);
1170                         }
1171
1172                         ads_destroy( &ads );
1173                         return True;
1174                 }
1175
1176                 ads_destroy( &ads );
1177         }
1178 #endif
1179
1180         /* try GETDC requests next */
1181
1182         if (send_getdc_request(mem_ctx, winbind_messaging_context(),
1183                                pss, domain->name, &domain->sid,
1184                                nt_version)) {
1185                 const char *dc_name = NULL;
1186                 int i;
1187                 smb_msleep(100);
1188                 for (i=0; i<5; i++) {
1189                         if (receive_getdc_response(mem_ctx, pss, domain->name,
1190                                                    &nt_version,
1191                                                    &dc_name, NULL)) {
1192                                 fstrcpy(name, dc_name);
1193                                 namecache_store(name, 0x20, 1, &ip_list);
1194                                 return True;
1195                         }
1196                         smb_msleep(500);
1197                 }
1198         }
1199
1200         /* try node status request */
1201
1202         if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
1203                 namecache_store(name, 0x20, 1, &ip_list);
1204                 return True;
1205         }
1206         return False;
1207 }
1208
1209 /*******************************************************************
1210  Retrieve a list of IP addresses for domain controllers.
1211
1212  The array is sorted in the preferred connection order.
1213
1214  @param[in] mem_ctx talloc memory context to allocate from
1215  @param[in] domain domain to retrieve DCs for
1216  @param[out] dcs array of dcs that will be returned
1217  @param[out] num_dcs number of dcs returned in the dcs array
1218  @return always true
1219 *******************************************************************/
1220
1221 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
1222                     struct dc_name_ip **dcs, int *num_dcs)
1223 {
1224         fstring dcname;
1225         struct  sockaddr_storage ss;
1226         struct  ip_service *ip_list = NULL;
1227         int     iplist_size = 0;
1228         int     i;
1229         bool    is_our_domain;
1230         enum security_types sec = (enum security_types)lp_security();
1231
1232         is_our_domain = strequal(domain->name, lp_workgroup());
1233
1234         /* If not our domain, get the preferred DC, by asking our primary DC */
1235         if ( !is_our_domain
1236                 && get_dc_name_via_netlogon(domain, dcname, &ss)
1237                 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1238                        num_dcs) )
1239         {
1240                 char addr[INET6_ADDRSTRLEN];
1241                 print_sockaddr(addr, sizeof(addr), &ss);
1242                 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1243                            dcname, addr));
1244                 return True;
1245         }
1246
1247         if (sec == SEC_ADS) {
1248                 char *sitename = NULL;
1249
1250                 /* We need to make sure we know the local site before
1251                    doing any DNS queries, as this will restrict the
1252                    get_sorted_dc_list() call below to only fetching
1253                    DNS records for the correct site. */
1254
1255                 /* Find any DC to get the site record.
1256                    We deliberately don't care about the
1257                    return here. */
1258
1259                 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1260
1261                 sitename = sitename_fetch(domain->alt_name);
1262                 if (sitename) {
1263
1264                         /* Do the site-specific AD dns lookup first. */
1265                         get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1266                                &iplist_size, True);
1267
1268                         /* Add ips to the DC array.  We don't look up the name
1269                            of the DC in this function, but we fill in the char*
1270                            of the ip now to make the failed connection cache
1271                            work */
1272                         for ( i=0; i<iplist_size; i++ ) {
1273                                 char addr[INET6_ADDRSTRLEN];
1274                                 print_sockaddr(addr, sizeof(addr),
1275                                                 &ip_list[i].ss);
1276                                 add_one_dc_unique(mem_ctx,
1277                                                 domain->name,
1278                                                 addr,
1279                                                 &ip_list[i].ss,
1280                                                 dcs,
1281                                                 num_dcs);
1282                         }
1283
1284                         SAFE_FREE(ip_list);
1285                         SAFE_FREE(sitename);
1286                         iplist_size = 0;
1287                 }
1288
1289                 /* Now we add DCs from the main AD DNS lookup. */
1290                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1291                         &iplist_size, True);
1292
1293                 for ( i=0; i<iplist_size; i++ ) {
1294                         char addr[INET6_ADDRSTRLEN];
1295                         print_sockaddr(addr, sizeof(addr),
1296                                         &ip_list[i].ss);
1297                         add_one_dc_unique(mem_ctx,
1298                                         domain->name,
1299                                         addr,
1300                                         &ip_list[i].ss,
1301                                         dcs,
1302                                         num_dcs);
1303                 }
1304
1305                 SAFE_FREE(ip_list);
1306                 iplist_size = 0;
1307         }
1308
1309         /* Try standard netbios queries if no ADS */
1310         if (*num_dcs == 0) {
1311                 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1312                        False);
1313
1314                 for ( i=0; i<iplist_size; i++ ) {
1315                         char addr[INET6_ADDRSTRLEN];
1316                         print_sockaddr(addr, sizeof(addr),
1317                                         &ip_list[i].ss);
1318                         add_one_dc_unique(mem_ctx,
1319                                         domain->name,
1320                                         addr,
1321                                         &ip_list[i].ss,
1322                                         dcs,
1323                                         num_dcs);
1324                 }
1325
1326                 SAFE_FREE(ip_list);
1327                 iplist_size = 0;
1328         }
1329
1330         return True;
1331 }
1332
1333 /*******************************************************************
1334  Find and make a connection to a DC in the given domain.
1335
1336  @param[in] mem_ctx talloc memory context to allocate from
1337  @param[in] domain domain to find a dc in
1338  @param[out] dcname NetBIOS or FQDN of DC that's connected to
1339  @param[out] pss DC Internet address and port
1340  @param[out] fd fd of the open socket connected to the newly found dc
1341  @return true when a DC connection is made, false otherwise
1342 *******************************************************************/
1343
1344 static bool find_new_dc(TALLOC_CTX *mem_ctx,
1345                         struct winbindd_domain *domain,
1346                         fstring dcname, struct sockaddr_storage *pss, int *fd)
1347 {
1348         struct dc_name_ip *dcs = NULL;
1349         int num_dcs = 0;
1350
1351         const char **dcnames = NULL;
1352         int num_dcnames = 0;
1353
1354         struct sockaddr_storage *addrs = NULL;
1355         int num_addrs = 0;
1356
1357         int i, fd_index;
1358
1359         *fd = -1;
1360
1361  again:
1362         if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1363                 return False;
1364
1365         for (i=0; i<num_dcs; i++) {
1366
1367                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1368                                     &dcnames, &num_dcnames)) {
1369                         return False;
1370                 }
1371                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 445,
1372                                       &addrs, &num_addrs)) {
1373                         return False;
1374                 }
1375
1376                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1377                                     &dcnames, &num_dcnames)) {
1378                         return False;
1379                 }
1380                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 139,
1381                                       &addrs, &num_addrs)) {
1382                         return False;
1383                 }
1384         }
1385
1386         if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1387                 return False;
1388
1389         if ((addrs == NULL) || (dcnames == NULL))
1390                 return False;
1391
1392         /* 5 second timeout. */
1393         if (!open_any_socket_out(addrs, num_addrs, 5000, &fd_index, fd) ) {
1394                 for (i=0; i<num_dcs; i++) {
1395                         char ab[INET6_ADDRSTRLEN];
1396                         print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1397                         DEBUG(10, ("find_new_dc: open_any_socket_out failed for "
1398                                 "domain %s address %s. Error was %s\n",
1399                                 domain->name, ab, strerror(errno) ));
1400                         winbind_add_failed_connection_entry(domain,
1401                                 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1402                 }
1403                 return False;
1404         }
1405
1406         *pss = addrs[fd_index];
1407
1408         if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1409                 /* Ok, we've got a name for the DC */
1410                 fstrcpy(dcname, dcnames[fd_index]);
1411                 return True;
1412         }
1413
1414         /* Try to figure out the name */
1415         if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1416                 return True;
1417         }
1418
1419         /* We can not continue without the DC's name */
1420         winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1421                                     NT_STATUS_UNSUCCESSFUL);
1422
1423         /* Throw away all arrays as we're doing this again. */
1424         TALLOC_FREE(dcs);
1425         num_dcs = 0;
1426
1427         TALLOC_FREE(dcnames);
1428         num_dcnames = 0;
1429
1430         TALLOC_FREE(addrs);
1431         num_addrs = 0;
1432
1433         close(*fd);
1434         *fd = -1;
1435
1436         goto again;
1437 }
1438
1439 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
1440                                    struct winbindd_cm_conn *new_conn)
1441 {
1442         TALLOC_CTX *mem_ctx;
1443         NTSTATUS result;
1444         char *saf_servername = saf_fetch( domain->name );
1445         int retries;
1446
1447         if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1448                 SAFE_FREE(saf_servername);
1449                 set_domain_offline(domain);
1450                 return NT_STATUS_NO_MEMORY;
1451         }
1452
1453         /* we have to check the server affinity cache here since
1454            later we selecte a DC based on response time and not preference */
1455
1456         /* Check the negative connection cache
1457            before talking to it. It going down may have
1458            triggered the reconnection. */
1459
1460         if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1461
1462                 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1463                         saf_servername, domain->name ));
1464
1465                 /* convert an ip address to a name */
1466                 if (is_ipaddress( saf_servername ) ) {
1467                         fstring saf_name;
1468                         struct sockaddr_storage ss;
1469
1470                         if (!interpret_string_addr(&ss, saf_servername,
1471                                                 AI_NUMERICHOST)) {
1472                                 return NT_STATUS_UNSUCCESSFUL;
1473                         }
1474                         if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
1475                                 fstrcpy( domain->dcname, saf_name );
1476                         } else {
1477                                 winbind_add_failed_connection_entry(
1478                                         domain, saf_servername,
1479                                         NT_STATUS_UNSUCCESSFUL);
1480                         }
1481                 } else {
1482                         fstrcpy( domain->dcname, saf_servername );
1483                 }
1484
1485                 SAFE_FREE( saf_servername );
1486         }
1487
1488         for (retries = 0; retries < 3; retries++) {
1489                 int fd = -1;
1490                 bool retry = False;
1491
1492                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1493
1494                 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1495                         domain->dcname, domain->name ));
1496
1497                 if (*domain->dcname
1498                         && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1499                         && (resolve_name(domain->dcname, &domain->dcaddr, 0x20, true)))
1500                 {
1501                         struct sockaddr_storage *addrs = NULL;
1502                         int num_addrs = 0;
1503                         int dummy = 0;
1504
1505                         if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 445, &addrs, &num_addrs)) {
1506                                 set_domain_offline(domain);
1507                                 talloc_destroy(mem_ctx);
1508                                 return NT_STATUS_NO_MEMORY;
1509                         }
1510                         if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 139, &addrs, &num_addrs)) {
1511                                 set_domain_offline(domain);
1512                                 talloc_destroy(mem_ctx);
1513                                 return NT_STATUS_NO_MEMORY;
1514                         }
1515
1516                         /* 5 second timeout. */
1517                         if (!open_any_socket_out(addrs, num_addrs, 5000, &dummy, &fd)) {
1518                                 fd = -1;
1519                         }
1520                 }
1521
1522                 if ((fd == -1)
1523                         && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
1524                 {
1525                         /* This is the one place where we will
1526                            set the global winbindd offline state
1527                            to true, if a "WINBINDD_OFFLINE" entry
1528                            is found in the winbindd cache. */
1529                         set_global_winbindd_state_offline();
1530                         break;
1531                 }
1532
1533                 new_conn->cli = NULL;
1534
1535                 result = cm_prepare_connection(domain, fd, domain->dcname,
1536                         &new_conn->cli, &retry);
1537
1538                 if (!retry)
1539                         break;
1540         }
1541
1542         if (NT_STATUS_IS_OK(result)) {
1543
1544                 winbindd_set_locator_kdc_envs(domain);
1545
1546                 if (domain->online == False) {
1547                         /* We're changing state from offline to online. */
1548                         set_global_winbindd_state_online();
1549                 }
1550                 set_domain_online(domain);
1551         } else {
1552                 /* Ensure we setup the retry handler. */
1553                 set_domain_offline(domain);
1554         }
1555
1556         talloc_destroy(mem_ctx);
1557         return result;
1558 }
1559
1560 /* Close down all open pipes on a connection. */
1561
1562 void invalidate_cm_connection(struct winbindd_cm_conn *conn)
1563 {
1564         /* We're closing down a possibly dead
1565            connection. Don't have impossibly long (10s) timeouts. */
1566
1567         if (conn->cli) {
1568                 cli_set_timeout(conn->cli, 1000); /* 1 second. */
1569         }
1570
1571         if (conn->samr_pipe != NULL) {
1572                 TALLOC_FREE(conn->samr_pipe);
1573                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1574                 if (conn->cli) {
1575                         cli_set_timeout(conn->cli, 500);
1576                 }
1577         }
1578
1579         if (conn->lsa_pipe != NULL) {
1580                 TALLOC_FREE(conn->lsa_pipe);
1581                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1582                 if (conn->cli) {
1583                         cli_set_timeout(conn->cli, 500);
1584                 }
1585         }
1586
1587         if (conn->lsa_pipe_tcp != NULL) {
1588                 TALLOC_FREE(conn->lsa_pipe_tcp);
1589                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1590                 if (conn->cli) {
1591                         cli_set_timeout(conn->cli, 500);
1592                 }
1593         }
1594
1595         if (conn->netlogon_pipe != NULL) {
1596                 TALLOC_FREE(conn->netlogon_pipe);
1597                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1598                 if (conn->cli) {
1599                         cli_set_timeout(conn->cli, 500);
1600                 }
1601         }
1602
1603         if (conn->cli) {
1604                 cli_shutdown(conn->cli);
1605         }
1606
1607         conn->cli = NULL;
1608 }
1609
1610 void close_conns_after_fork(void)
1611 {
1612         struct winbindd_domain *domain;
1613
1614         for (domain = domain_list(); domain; domain = domain->next) {
1615                 if (domain->conn.cli == NULL)
1616                         continue;
1617
1618                 if (domain->conn.cli->fd == -1)
1619                         continue;
1620
1621                 close(domain->conn.cli->fd);
1622                 domain->conn.cli->fd = -1;
1623         }
1624 }
1625
1626 static bool connection_ok(struct winbindd_domain *domain)
1627 {
1628         bool ok;
1629
1630         ok = cli_state_is_connected(domain->conn.cli);
1631         if (!ok) {
1632                 DEBUG(3, ("connection_ok: Connection to %s for domain %s is not connected\n",
1633                           domain->dcname, domain->name));
1634                 return False;
1635         }
1636
1637         if (domain->online == False) {
1638                 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
1639                 return False;
1640         }
1641
1642         return True;
1643 }
1644
1645 /* Initialize a new connection up to the RPC BIND.
1646    Bypass online status check so always does network calls. */
1647
1648 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
1649 {
1650         NTSTATUS result;
1651
1652         /* Internal connections never use the network. */
1653         if (domain->internal) {
1654                 domain->initialized = True;
1655                 return NT_STATUS_OK;
1656         }
1657
1658         if (!winbindd_can_contact_domain(domain)) {
1659                 invalidate_cm_connection(&domain->conn);
1660                 domain->initialized = True;
1661                 return NT_STATUS_OK;
1662         }
1663
1664         if (connection_ok(domain)) {
1665                 if (!domain->initialized) {
1666                         set_dc_type_and_flags(domain);
1667                 }
1668                 return NT_STATUS_OK;
1669         }
1670
1671         invalidate_cm_connection(&domain->conn);
1672
1673         result = cm_open_connection(domain, &domain->conn);
1674
1675         if (NT_STATUS_IS_OK(result) && !domain->initialized) {
1676                 set_dc_type_and_flags(domain);
1677         }
1678
1679         return result;
1680 }
1681
1682 NTSTATUS init_dc_connection(struct winbindd_domain *domain)
1683 {
1684         if (domain->initialized && !domain->online) {
1685                 /* We check for online status elsewhere. */
1686                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1687         }
1688
1689         return init_dc_connection_network(domain);
1690 }
1691
1692 static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain)
1693 {
1694         NTSTATUS status;
1695
1696         status = init_dc_connection(domain);
1697         if (!NT_STATUS_IS_OK(status)) {
1698                 return status;
1699         }
1700
1701         if (!domain->internal && domain->conn.cli == NULL) {
1702                 /* happens for trusted domains without inbound trust */
1703                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
1704         }
1705
1706         return NT_STATUS_OK;
1707 }
1708
1709 /******************************************************************************
1710  Set the trust flags (direction and forest location) for a domain
1711 ******************************************************************************/
1712
1713 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
1714 {
1715         struct winbindd_domain *our_domain;
1716         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1717         struct netr_DomainTrustList trusts;
1718         int i;
1719         uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
1720                         NETR_TRUST_FLAG_OUTBOUND |
1721                         NETR_TRUST_FLAG_INBOUND);
1722         struct rpc_pipe_client *cli;
1723         TALLOC_CTX *mem_ctx = NULL;
1724
1725         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
1726
1727         /* Our primary domain doesn't need to worry about trust flags.
1728            Force it to go through the network setup */
1729         if ( domain->primary ) {
1730                 return False;
1731         }
1732
1733         our_domain = find_our_domain();
1734
1735         if ( !connection_ok(our_domain) ) {
1736                 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1737                 return False;
1738         }
1739
1740         /* This won't work unless our domain is AD */
1741
1742         if ( !our_domain->active_directory ) {
1743                 return False;
1744         }
1745
1746         /* Use DsEnumerateDomainTrusts to get us the trust direction
1747            and type */
1748
1749         result = cm_connect_netlogon(our_domain, &cli);
1750
1751         if (!NT_STATUS_IS_OK(result)) {
1752                 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1753                           "a connection to %s for PIPE_NETLOGON (%s)\n",
1754                           domain->name, nt_errstr(result)));
1755                 return False;
1756         }
1757
1758         if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
1759                 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1760                 return False;
1761         }
1762
1763         result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1764                                                       cli->desthost,
1765                                                       flags,
1766                                                       &trusts,
1767                                                       NULL);
1768         if (!NT_STATUS_IS_OK(result)) {
1769                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1770                         "failed to query trusted domain list: %s\n",
1771                         nt_errstr(result)));
1772                 talloc_destroy(mem_ctx);
1773                 return false;
1774         }
1775
1776         /* Now find the domain name and get the flags */
1777
1778         for ( i=0; i<trusts.count; i++ ) {
1779                 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
1780                         domain->domain_flags          = trusts.array[i].trust_flags;
1781                         domain->domain_type           = trusts.array[i].trust_type;
1782                         domain->domain_trust_attribs  = trusts.array[i].trust_attributes;
1783
1784                         if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
1785                                 domain->active_directory = True;
1786
1787                         /* This flag is only set if the domain is *our*
1788                            primary domain and the primary domain is in
1789                            native mode */
1790
1791                         domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
1792
1793                         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1794                                   "native mode.\n", domain->name,
1795                                   domain->native_mode ? "" : "NOT "));
1796
1797                         DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1798                                  "running active directory.\n", domain->name,
1799                                  domain->active_directory ? "" : "NOT "));
1800
1801
1802                         domain->initialized = True;
1803
1804                         break;
1805                 }
1806         }
1807
1808         talloc_destroy( mem_ctx );
1809
1810         return domain->initialized;
1811 }
1812
1813 /******************************************************************************
1814  We can 'sense' certain things about the DC by it's replies to certain
1815  questions.
1816
1817  This tells us if this particular remote server is Active Directory, and if it
1818  is native mode.
1819 ******************************************************************************/
1820
1821 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
1822 {
1823         NTSTATUS                result;
1824         WERROR werr;
1825         TALLOC_CTX              *mem_ctx = NULL;
1826         struct rpc_pipe_client  *cli = NULL;
1827         struct policy_handle pol;
1828         union dssetup_DsRoleInfo info;
1829         union lsa_PolicyInformation *lsa_info = NULL;
1830
1831         if (!connection_ok(domain)) {
1832                 return;
1833         }
1834
1835         mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
1836                               domain->name);
1837         if (!mem_ctx) {
1838                 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1839                 return;
1840         }
1841
1842         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
1843
1844         result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1845                                           &ndr_table_dssetup.syntax_id,
1846                                           &cli);
1847
1848         if (!NT_STATUS_IS_OK(result)) {
1849                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1850                           "PI_DSSETUP on domain %s: (%s)\n",
1851                           domain->name, nt_errstr(result)));
1852
1853                 /* if this is just a non-AD domain we need to continue
1854                  * identifying so that we can in the end return with
1855                  * domain->initialized = True - gd */
1856
1857                 goto no_dssetup;
1858         }
1859
1860         result = rpccli_dssetup_DsRoleGetPrimaryDomainInformation(cli, mem_ctx,
1861                                                                   DS_ROLE_BASIC_INFORMATION,
1862                                                                   &info,
1863                                                                   &werr);
1864         TALLOC_FREE(cli);
1865
1866         if (!NT_STATUS_IS_OK(result)) {
1867                 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1868                           "on domain %s failed: (%s)\n",
1869                           domain->name, nt_errstr(result)));
1870
1871                 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1872                  * every opcode on the DSSETUP pipe, continue with
1873                  * no_dssetup mode here as well to get domain->initialized
1874                  * set - gd */
1875
1876                 if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
1877                         goto no_dssetup;
1878                 }
1879
1880                 TALLOC_FREE(mem_ctx);
1881                 return;
1882         }
1883
1884         if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
1885             !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
1886                 domain->native_mode = True;
1887         } else {
1888                 domain->native_mode = False;
1889         }
1890
1891 no_dssetup:
1892         result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1893                                           &ndr_table_lsarpc.syntax_id, &cli);
1894
1895         if (!NT_STATUS_IS_OK(result)) {
1896                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1897                           "PI_LSARPC on domain %s: (%s)\n",
1898                           domain->name, nt_errstr(result)));
1899                 TALLOC_FREE(cli);
1900                 TALLOC_FREE(mem_ctx);
1901                 return;
1902         }
1903
1904         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1905                                          SEC_FLAG_MAXIMUM_ALLOWED, &pol);
1906
1907         if (NT_STATUS_IS_OK(result)) {
1908                 /* This particular query is exactly what Win2k clients use
1909                    to determine that the DC is active directory */
1910                 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
1911                                                      &pol,
1912                                                      LSA_POLICY_INFO_DNS,
1913                                                      &lsa_info);
1914         }
1915
1916         if (NT_STATUS_IS_OK(result)) {
1917                 domain->active_directory = True;
1918
1919                 if (lsa_info->dns.name.string) {
1920                         fstrcpy(domain->name, lsa_info->dns.name.string);
1921                 }
1922
1923                 if (lsa_info->dns.dns_domain.string) {
1924                         fstrcpy(domain->alt_name,
1925                                 lsa_info->dns.dns_domain.string);
1926                 }
1927
1928                 /* See if we can set some domain trust flags about
1929                    ourself */
1930
1931                 if (lsa_info->dns.dns_forest.string) {
1932                         fstrcpy(domain->forest_name,
1933                                 lsa_info->dns.dns_forest.string);
1934
1935                         if (strequal(domain->forest_name, domain->alt_name)) {
1936                                 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
1937                         }
1938                 }
1939
1940                 if (lsa_info->dns.sid) {
1941                         sid_copy(&domain->sid, lsa_info->dns.sid);
1942                 }
1943         } else {
1944                 domain->active_directory = False;
1945
1946                 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
1947                                                 SEC_FLAG_MAXIMUM_ALLOWED,
1948                                                 &pol);
1949
1950                 if (!NT_STATUS_IS_OK(result)) {
1951                         goto done;
1952                 }
1953
1954                 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
1955                                                     &pol,
1956                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1957                                                     &lsa_info);
1958
1959                 if (NT_STATUS_IS_OK(result)) {
1960
1961                         if (lsa_info->account_domain.name.string) {
1962                                 fstrcpy(domain->name,
1963                                         lsa_info->account_domain.name.string);
1964                         }
1965
1966                         if (lsa_info->account_domain.sid) {
1967                                 sid_copy(&domain->sid, lsa_info->account_domain.sid);
1968                         }
1969                 }
1970         }
1971 done:
1972
1973         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
1974                   domain->name, domain->native_mode ? "" : "NOT "));
1975
1976         DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
1977                   domain->name, domain->active_directory ? "" : "NOT "));
1978
1979         domain->can_do_ncacn_ip_tcp = domain->active_directory;
1980
1981         TALLOC_FREE(cli);
1982
1983         TALLOC_FREE(mem_ctx);
1984
1985         domain->initialized = True;
1986 }
1987
1988 /**********************************************************************
1989  Set the domain_flags (trust attributes, domain operating modes, etc...
1990 ***********************************************************************/
1991
1992 static void set_dc_type_and_flags( struct winbindd_domain *domain )
1993 {
1994         /* we always have to contact our primary domain */
1995
1996         if ( domain->primary ) {
1997                 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
1998                           "primary domain\n"));
1999                 set_dc_type_and_flags_connect( domain );
2000                 return;
2001         }
2002
2003         /* Use our DC to get the information if possible */
2004
2005         if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
2006                 /* Otherwise, fallback to contacting the
2007                    domain directly */
2008                 set_dc_type_and_flags_connect( domain );
2009         }
2010
2011         return;
2012 }
2013
2014
2015
2016 /**********************************************************************
2017 ***********************************************************************/
2018
2019 static bool cm_get_schannel_creds(struct winbindd_domain *domain,
2020                                    struct netlogon_creds_CredentialState **ppdc)
2021 {
2022         NTSTATUS result;
2023         struct rpc_pipe_client *netlogon_pipe;
2024
2025         if (lp_client_schannel() == False) {
2026                 return False;
2027         }
2028
2029         result = cm_connect_netlogon(domain, &netlogon_pipe);
2030         if (!NT_STATUS_IS_OK(result)) {
2031                 return False;
2032         }
2033
2034         /* Return a pointer to the struct netlogon_creds_CredentialState from the
2035            netlogon pipe. */
2036
2037         if (!domain->conn.netlogon_pipe->dc) {
2038                 return false;
2039         }
2040
2041         *ppdc = domain->conn.netlogon_pipe->dc;
2042         return True;
2043 }
2044
2045 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2046                         struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2047 {
2048         struct winbindd_cm_conn *conn;
2049         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2050         struct netlogon_creds_CredentialState *p_creds;
2051         char *machine_password = NULL;
2052         char *machine_account = NULL;
2053         char *domain_name = NULL;
2054
2055         result = init_dc_connection_rpc(domain);
2056         if (!NT_STATUS_IS_OK(result)) {
2057                 return result;
2058         }
2059
2060         conn = &domain->conn;
2061
2062         if (rpccli_is_connected(conn->samr_pipe)) {
2063                 goto done;
2064         }
2065
2066         TALLOC_FREE(conn->samr_pipe);
2067
2068         /*
2069          * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2070          * sign and sealed pipe using the machine account password by
2071          * preference. If we can't - try schannel, if that fails, try
2072          * anonymous.
2073          */
2074
2075         if ((conn->cli->user_name[0] == '\0') ||
2076             (conn->cli->domain[0] == '\0') ||
2077             (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
2078         {
2079                 result = get_trust_creds(domain, &machine_password,
2080                                          &machine_account, NULL);
2081                 if (!NT_STATUS_IS_OK(result)) {
2082                         DEBUG(10, ("cm_connect_sam: No no user available for "
2083                                    "domain %s, trying schannel\n", conn->cli->domain));
2084                         goto schannel;
2085                 }
2086                 domain_name = domain->name;
2087         } else {
2088                 machine_password = SMB_STRDUP(conn->cli->password);
2089                 machine_account = SMB_STRDUP(conn->cli->user_name);
2090                 domain_name = conn->cli->domain;
2091         }
2092
2093         if (!machine_password || !machine_account) {
2094                 result = NT_STATUS_NO_MEMORY;
2095                 goto done;
2096         }
2097
2098         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2099            authenticated SAMR pipe with sign & seal. */
2100         result = cli_rpc_pipe_open_spnego_ntlmssp(conn->cli,
2101                                                   &ndr_table_samr.syntax_id,
2102                                                   NCACN_NP,
2103                                                   DCERPC_AUTH_LEVEL_PRIVACY,
2104                                                   domain_name,
2105                                                   machine_account,
2106                                                   machine_password,
2107                                                   &conn->samr_pipe);
2108
2109         if (!NT_STATUS_IS_OK(result)) {
2110                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2111                           "pipe for domain %s using NTLMSSP "
2112                           "authenticated pipe: user %s\\%s. Error was "
2113                           "%s\n", domain->name, domain_name,
2114                           machine_account, nt_errstr(result)));
2115                 goto schannel;
2116         }
2117
2118         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2119                   "domain %s using NTLMSSP authenticated "
2120                   "pipe: user %s\\%s\n", domain->name,
2121                   domain_name, machine_account));
2122
2123         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2124                                       conn->samr_pipe->desthost,
2125                                       SEC_FLAG_MAXIMUM_ALLOWED,
2126                                       &conn->sam_connect_handle);
2127         if (NT_STATUS_IS_OK(result)) {
2128                 goto open_domain;
2129         }
2130         DEBUG(10,("cm_connect_sam: ntlmssp-sealed rpccli_samr_Connect2 "
2131                   "failed for domain %s, error was %s. Trying schannel\n",
2132                   domain->name, nt_errstr(result) ));
2133         TALLOC_FREE(conn->samr_pipe);
2134
2135  schannel:
2136
2137         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2138
2139         if (!cm_get_schannel_creds(domain, &p_creds)) {
2140                 /* If this call fails - conn->cli can now be NULL ! */
2141                 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2142                            "for domain %s, trying anon\n", domain->name));
2143                 goto anonymous;
2144         }
2145         result = cli_rpc_pipe_open_schannel_with_key
2146                 (conn->cli, &ndr_table_samr.syntax_id, NCACN_NP,
2147                  DCERPC_AUTH_LEVEL_PRIVACY,
2148                  domain->name, &p_creds, &conn->samr_pipe);
2149
2150         if (!NT_STATUS_IS_OK(result)) {
2151                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2152                           "domain %s using schannel. Error was %s\n",
2153                           domain->name, nt_errstr(result) ));
2154                 goto anonymous;
2155         }
2156         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2157                   "schannel.\n", domain->name ));
2158
2159         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2160                                       conn->samr_pipe->desthost,
2161                                       SEC_FLAG_MAXIMUM_ALLOWED,
2162                                       &conn->sam_connect_handle);
2163         if (NT_STATUS_IS_OK(result)) {
2164                 goto open_domain;
2165         }
2166         DEBUG(10,("cm_connect_sam: schannel-sealed rpccli_samr_Connect2 failed "
2167                   "for domain %s, error was %s. Trying anonymous\n",
2168                   domain->name, nt_errstr(result) ));
2169         TALLOC_FREE(conn->samr_pipe);
2170
2171  anonymous:
2172
2173         /* Finally fall back to anonymous. */
2174         result = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
2175                                           &conn->samr_pipe);
2176
2177         if (!NT_STATUS_IS_OK(result)) {
2178                 goto done;
2179         }
2180
2181         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2182                                       conn->samr_pipe->desthost,
2183                                       SEC_FLAG_MAXIMUM_ALLOWED,
2184                                       &conn->sam_connect_handle);
2185         if (!NT_STATUS_IS_OK(result)) {
2186                 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2187                           "for domain %s Error was %s\n",
2188                           domain->name, nt_errstr(result) ));
2189                 goto done;
2190         }
2191
2192  open_domain:
2193         result = rpccli_samr_OpenDomain(conn->samr_pipe,
2194                                         mem_ctx,
2195                                         &conn->sam_connect_handle,
2196                                         SEC_FLAG_MAXIMUM_ALLOWED,
2197                                         &domain->sid,
2198                                         &conn->sam_domain_handle);
2199
2200  done:
2201
2202         if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
2203                 /*
2204                  * if we got access denied, we might just have no access rights
2205                  * to talk to the remote samr server server (e.g. when we are a
2206                  * PDC and we are connecting a w2k8 pdc via an interdomain
2207                  * trust). In that case do not invalidate the whole connection
2208                  * stack
2209                  */
2210                 TALLOC_FREE(conn->samr_pipe);
2211                 ZERO_STRUCT(conn->sam_domain_handle);
2212                 return result;
2213         } else if (!NT_STATUS_IS_OK(result)) {
2214                 invalidate_cm_connection(conn);
2215                 return result;
2216         }
2217
2218         *cli = conn->samr_pipe;
2219         *sam_handle = conn->sam_domain_handle;
2220         SAFE_FREE(machine_password);
2221         SAFE_FREE(machine_account);
2222         return result;
2223 }
2224
2225 /**********************************************************************
2226  open an schanneld ncacn_ip_tcp connection to LSA
2227 ***********************************************************************/
2228
2229 NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
2230                             TALLOC_CTX *mem_ctx,
2231                             struct rpc_pipe_client **cli)
2232 {
2233         struct winbindd_cm_conn *conn;
2234         struct netlogon_creds_CredentialState *creds;
2235         NTSTATUS status;
2236
2237         DEBUG(10,("cm_connect_lsa_tcp\n"));
2238
2239         status = init_dc_connection_rpc(domain);
2240         if (!NT_STATUS_IS_OK(status)) {
2241                 return status;
2242         }
2243
2244         conn = &domain->conn;
2245
2246         if (conn->lsa_pipe_tcp &&
2247             conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2248             conn->lsa_pipe_tcp->auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY &&
2249             rpccli_is_connected(conn->lsa_pipe_tcp)) {
2250                 goto done;
2251         }
2252
2253         TALLOC_FREE(conn->lsa_pipe_tcp);
2254
2255         if (!cm_get_schannel_creds(domain, &creds)) {
2256                 goto done;
2257         }
2258
2259         status = cli_rpc_pipe_open_schannel_with_key(conn->cli,
2260                                                      &ndr_table_lsarpc.syntax_id,
2261                                                      NCACN_IP_TCP,
2262                                                      DCERPC_AUTH_LEVEL_PRIVACY,
2263                                                      domain->name,
2264                                                      &creds,
2265                                                      &conn->lsa_pipe_tcp);
2266         if (!NT_STATUS_IS_OK(status)) {
2267                 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
2268                         nt_errstr(status)));
2269                 goto done;
2270         }
2271
2272  done:
2273         if (!NT_STATUS_IS_OK(status)) {
2274                 TALLOC_FREE(conn->lsa_pipe_tcp);
2275                 return status;
2276         }
2277
2278         *cli = conn->lsa_pipe_tcp;
2279
2280         return status;
2281 }
2282
2283 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2284                         struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2285 {
2286         struct winbindd_cm_conn *conn;
2287         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2288         struct netlogon_creds_CredentialState *p_creds;
2289
2290         result = init_dc_connection_rpc(domain);
2291         if (!NT_STATUS_IS_OK(result))
2292                 return result;
2293
2294         conn = &domain->conn;
2295
2296         if (rpccli_is_connected(conn->lsa_pipe)) {
2297                 goto done;
2298         }
2299
2300         TALLOC_FREE(conn->lsa_pipe);
2301
2302         if ((conn->cli->user_name[0] == '\0') ||
2303             (conn->cli->domain[0] == '\0') ||
2304             (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
2305                 DEBUG(10, ("cm_connect_lsa: No no user available for "
2306                            "domain %s, trying schannel\n", conn->cli->domain));
2307                 goto schannel;
2308         }
2309
2310         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2311          * authenticated LSA pipe with sign & seal. */
2312         result = cli_rpc_pipe_open_spnego_ntlmssp
2313                 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2314                  DCERPC_AUTH_LEVEL_PRIVACY,
2315                  conn->cli->domain, conn->cli->user_name, conn->cli->password,
2316                  &conn->lsa_pipe);
2317
2318         if (!NT_STATUS_IS_OK(result)) {
2319                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2320                           "domain %s using NTLMSSP authenticated pipe: user "
2321                           "%s\\%s. Error was %s. Trying schannel.\n",
2322                           domain->name, conn->cli->domain,
2323                           conn->cli->user_name, nt_errstr(result)));
2324                 goto schannel;
2325         }
2326
2327         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2328                   "NTLMSSP authenticated pipe: user %s\\%s\n",
2329                   domain->name, conn->cli->domain, conn->cli->user_name ));
2330
2331         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2332                                         SEC_FLAG_MAXIMUM_ALLOWED,
2333                                         &conn->lsa_policy);
2334         if (NT_STATUS_IS_OK(result)) {
2335                 goto done;
2336         }
2337
2338         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2339                   "schannel\n"));
2340
2341         TALLOC_FREE(conn->lsa_pipe);
2342
2343  schannel:
2344
2345         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2346
2347         if (!cm_get_schannel_creds(domain, &p_creds)) {
2348                 /* If this call fails - conn->cli can now be NULL ! */
2349                 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2350                            "for domain %s, trying anon\n", domain->name));
2351                 goto anonymous;
2352         }
2353         result = cli_rpc_pipe_open_schannel_with_key
2354                 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2355                  DCERPC_AUTH_LEVEL_PRIVACY,
2356                  domain->name, &p_creds, &conn->lsa_pipe);
2357
2358         if (!NT_STATUS_IS_OK(result)) {
2359                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2360                           "domain %s using schannel. Error was %s\n",
2361                           domain->name, nt_errstr(result) ));
2362                 goto anonymous;
2363         }
2364         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2365                   "schannel.\n", domain->name ));
2366
2367         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2368                                         SEC_FLAG_MAXIMUM_ALLOWED,
2369                                         &conn->lsa_policy);
2370         if (NT_STATUS_IS_OK(result)) {
2371                 goto done;
2372         }
2373
2374         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2375                   "anonymous\n"));
2376
2377         TALLOC_FREE(conn->lsa_pipe);
2378
2379  anonymous:
2380
2381         result = cli_rpc_pipe_open_noauth(conn->cli,
2382                                           &ndr_table_lsarpc.syntax_id,
2383                                           &conn->lsa_pipe);
2384         if (!NT_STATUS_IS_OK(result)) {
2385                 result = NT_STATUS_PIPE_NOT_AVAILABLE;
2386                 goto done;
2387         }
2388
2389         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2390                                         SEC_FLAG_MAXIMUM_ALLOWED,
2391                                         &conn->lsa_policy);
2392  done:
2393         if (!NT_STATUS_IS_OK(result)) {
2394                 invalidate_cm_connection(conn);
2395                 return result;
2396         }
2397
2398         *cli = conn->lsa_pipe;
2399         *lsa_policy = conn->lsa_policy;
2400         return result;
2401 }
2402
2403 /****************************************************************************
2404  Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2405  session key stored in conn->netlogon_pipe->dc->sess_key.
2406 ****************************************************************************/
2407
2408 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
2409                              struct rpc_pipe_client **cli)
2410 {
2411         struct winbindd_cm_conn *conn;
2412         NTSTATUS result;
2413
2414         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
2415         uint8  mach_pwd[16];
2416         enum netr_SchannelType sec_chan_type;
2417         const char *account_name;
2418         struct rpc_pipe_client *netlogon_pipe = NULL;
2419
2420         *cli = NULL;
2421
2422         result = init_dc_connection_rpc(domain);
2423         if (!NT_STATUS_IS_OK(result)) {
2424                 return result;
2425         }
2426
2427         conn = &domain->conn;
2428
2429         if (rpccli_is_connected(conn->netlogon_pipe)) {
2430                 *cli = conn->netlogon_pipe;
2431                 return NT_STATUS_OK;
2432         }
2433
2434         TALLOC_FREE(conn->netlogon_pipe);
2435
2436         result = cli_rpc_pipe_open_noauth(conn->cli,
2437                                           &ndr_table_netlogon.syntax_id,
2438                                           &netlogon_pipe);
2439         if (!NT_STATUS_IS_OK(result)) {
2440                 return result;
2441         }
2442
2443         if ((!IS_DC) && (!domain->primary)) {
2444                 /* Clear the schannel request bit and drop down */
2445                 neg_flags &= ~NETLOGON_NEG_SCHANNEL;
2446                 goto no_schannel;
2447         }
2448
2449         if (lp_client_schannel() != False) {
2450                 neg_flags |= NETLOGON_NEG_SCHANNEL;
2451         }
2452
2453         if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
2454                                &sec_chan_type))
2455         {
2456                 TALLOC_FREE(netlogon_pipe);
2457                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2458         }
2459
2460         result = rpccli_netlogon_setup_creds(
2461                  netlogon_pipe,
2462                  domain->dcname, /* server name. */
2463                  domain->name,   /* domain name */
2464                  global_myname(), /* client name */
2465                  account_name,   /* machine account */
2466                  mach_pwd,       /* machine password */
2467                  sec_chan_type,  /* from get_trust_pw */
2468                  &neg_flags);
2469
2470         if (!NT_STATUS_IS_OK(result)) {
2471                 TALLOC_FREE(netlogon_pipe);
2472                 return result;
2473         }
2474
2475         if ((lp_client_schannel() == True) &&
2476                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2477                 DEBUG(3, ("Server did not offer schannel\n"));
2478                 TALLOC_FREE(netlogon_pipe);
2479                 return NT_STATUS_ACCESS_DENIED;
2480         }
2481
2482  no_schannel:
2483         if ((lp_client_schannel() == False) ||
2484                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2485                 /*
2486                  * NetSamLogonEx only works for schannel
2487                  */
2488                 domain->can_do_samlogon_ex = False;
2489
2490                 /* We're done - just keep the existing connection to NETLOGON
2491                  * open */
2492                 conn->netlogon_pipe = netlogon_pipe;
2493                 *cli = conn->netlogon_pipe;
2494                 return NT_STATUS_OK;
2495         }
2496
2497         /* Using the credentials from the first pipe, open a signed and sealed
2498            second netlogon pipe. The session key is stored in the schannel
2499            part of the new pipe auth struct.
2500         */
2501
2502         result = cli_rpc_pipe_open_schannel_with_key(
2503                 conn->cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
2504                 DCERPC_AUTH_LEVEL_PRIVACY, domain->name, &netlogon_pipe->dc,
2505                 &conn->netlogon_pipe);
2506
2507         /* We can now close the initial netlogon pipe. */
2508         TALLOC_FREE(netlogon_pipe);
2509
2510         if (!NT_STATUS_IS_OK(result)) {
2511                 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2512                           "was %s\n", nt_errstr(result)));
2513
2514                 invalidate_cm_connection(conn);
2515                 return result;
2516         }
2517
2518         /*
2519          * Always try netr_LogonSamLogonEx. We will fall back for NT4
2520          * which gives DCERPC_FAULT_OP_RNG_ERROR (function not
2521          * supported). We used to only try SamLogonEx for AD, but
2522          * Samba DCs can also do it. And because we don't distinguish
2523          * between Samba and NT4, always try it once.
2524          */
2525         domain->can_do_samlogon_ex = true;
2526
2527         *cli = conn->netlogon_pipe;
2528         return NT_STATUS_OK;
2529 }