?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
vfs_io_uring: move error handling out of vfs_io_uring_pread_recv()
[Samba.git] / source3 / winbindd / winbindd_msrpc.c
blob342f22cfde31bd120b34d8873a98785bc99b4287
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind rpc backend functions
5
6 Copyright (C) Tim Potter 2000-2001,2003
7 Copyright (C) Andrew Tridgell 2001
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2008 (pidl conversion)
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27 #include "winbindd_rpc.h"
28
29 #include "../librpc/gen_ndr/ndr_samr_c.h"
30 #include "rpc_client/cli_pipe.h"
31 #include "rpc_client/cli_samr.h"
32 #include "rpc_client/cli_lsarpc.h"
33 #include "../libcli/security/security.h"
34 #include "libsmb/samlogon_cache.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_WINBIND
38
39 static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
40 struct winbindd_domain *domain,
41 uint32_t num_names,
42 const char **names,
43 const char ***domains,
44 struct dom_sid **sids,
45 enum lsa_SidType **types);
46
47 /* Query display info for a domain. This returns enough information plus a
48 bit extra to give an overview of domain users for the User Manager
49 application. */
50 static NTSTATUS msrpc_query_user_list(struct winbindd_domain *domain,
51 TALLOC_CTX *mem_ctx,
52 uint32_t **prids)
53 {
54 struct rpc_pipe_client *samr_pipe = NULL;
55 struct policy_handle dom_pol;
56 uint32_t *rids = NULL;
57 TALLOC_CTX *tmp_ctx;
58 NTSTATUS status;
59
60 DEBUG(3, ("msrpc_query_user_list\n"));
61
62 tmp_ctx = talloc_stackframe();
63 if (tmp_ctx == NULL) {
64 return NT_STATUS_NO_MEMORY;
65 }
66
67 if ( !winbindd_can_contact_domain( domain ) ) {
68 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
69 domain->name));
70 status = NT_STATUS_OK;
71 goto done;
72 }
73
74 status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
75 if (!NT_STATUS_IS_OK(status)) {
76 goto done;
77 }
78
79 status = rpc_query_user_list(tmp_ctx,
80 samr_pipe,
81 &dom_pol,
82 &domain->sid,
83 &rids);
84 if (!NT_STATUS_IS_OK(status)) {
85 goto done;
86 }
87
88 if (prids) {
89 *prids = talloc_move(mem_ctx, &rids);
90 }
91
92 done:
93 TALLOC_FREE(rids);
94 TALLOC_FREE(tmp_ctx);
95 return status;
96 }
97
98 /* list all domain groups */
99 static NTSTATUS msrpc_enum_dom_groups(struct winbindd_domain *domain,
100 TALLOC_CTX *mem_ctx,
101 uint32_t *pnum_info,
102 struct wb_acct_info **pinfo)
103 {
104 struct rpc_pipe_client *samr_pipe;
105 struct policy_handle dom_pol;
106 struct wb_acct_info *info = NULL;
107 uint32_t num_info = 0;
108 TALLOC_CTX *tmp_ctx;
109 NTSTATUS status;
110
111 DEBUG(3,("msrpc_enum_dom_groups\n"));
112
113 if (pnum_info) {
114 *pnum_info = 0;
115 }
116
117 tmp_ctx = talloc_stackframe();
118 if (tmp_ctx == NULL) {
119 return NT_STATUS_NO_MEMORY;
120 }
121
122 if ( !winbindd_can_contact_domain( domain ) ) {
123 DEBUG(10,("enum_domain_groups: No incoming trust for domain %s\n",
124 domain->name));
125 status = NT_STATUS_OK;
126 goto done;
127 }
128
129 status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
130 if (!NT_STATUS_IS_OK(status)) {
131 goto done;
132 }
133
134 status = rpc_enum_dom_groups(tmp_ctx,
135 samr_pipe,
136 &dom_pol,
137 &num_info,
138 &info);
139 if (!NT_STATUS_IS_OK(status)) {
140 goto done;
141 }
142
143 if (pnum_info) {
144 *pnum_info = num_info;
145 }
146
147 if (pinfo) {
148 *pinfo = talloc_move(mem_ctx, &info);
149 }
150
151 done:
152 TALLOC_FREE(tmp_ctx);
153 return status;
154 }
155
156 /* List all domain groups */
157
158 static NTSTATUS msrpc_enum_local_groups(struct winbindd_domain *domain,
159 TALLOC_CTX *mem_ctx,
160 uint32_t *pnum_info,
161 struct wb_acct_info **pinfo)
162 {
163 struct rpc_pipe_client *samr_pipe;
164 struct policy_handle dom_pol;
165 struct wb_acct_info *info = NULL;
166 uint32_t num_info = 0;
167 TALLOC_CTX *tmp_ctx;
168 NTSTATUS status;
169
170 DEBUG(3,("msrpc_enum_local_groups\n"));
171
172 if (pnum_info) {
173 *pnum_info = 0;
174 }
175
176 tmp_ctx = talloc_stackframe();
177 if (tmp_ctx == NULL) {
178 return NT_STATUS_NO_MEMORY;
179 }
180
181 if ( !winbindd_can_contact_domain( domain ) ) {
182 DEBUG(10,("enum_local_groups: No incoming trust for domain %s\n",
183 domain->name));
184 status = NT_STATUS_OK;
185 goto done;
186 }
187
188 status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
189 if (!NT_STATUS_IS_OK(status)) {
190 goto done;
191 }
192
193 status = rpc_enum_local_groups(mem_ctx,
194 samr_pipe,
195 &dom_pol,
196 &num_info,
197 &info);
198 if (!NT_STATUS_IS_OK(status)) {
199 goto done;
200 }
201
202 if (pnum_info) {
203 *pnum_info = num_info;
204 }
205
206 if (pinfo) {
207 *pinfo = talloc_move(mem_ctx, &info);
208 }
209
210 done:
211 TALLOC_FREE(tmp_ctx);
212 return status;
213 }
214
215 /* convert a single name to a sid in a domain */
216 static NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
217 TALLOC_CTX *mem_ctx,
218 const char *domain_name,
219 const char *name,
220 uint32_t flags,
221 const char **pdom_name,
222 struct dom_sid *sid,
223 enum lsa_SidType *type)
224 {
225 NTSTATUS result;
226 struct dom_sid *sids = NULL;
227 enum lsa_SidType *types = NULL;
228 char *full_name = NULL;
229 const char *names[1];
230 const char **domains;
231 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
232 char *mapped_name = NULL;
233
234 if (name == NULL || *name=='\0') {
235 full_name = talloc_asprintf(mem_ctx, "%s", domain_name);
236 } else if (domain_name == NULL || *domain_name == '\0') {
237 full_name = talloc_asprintf(mem_ctx, "%s", name);
238 } else {
239 full_name = talloc_asprintf(mem_ctx, "%s\\%s", domain_name, name);
240 }
241 if (!full_name) {
242 DEBUG(0, ("talloc_asprintf failed!\n"));
243 return NT_STATUS_NO_MEMORY;
244 }
245
246 DEBUG(3, ("msrpc_name_to_sid: name=%s\n", full_name));
247
248 name_map_status = normalize_name_unmap(mem_ctx, full_name,
249 &mapped_name);
250
251 /* Reset the full_name pointer if we mapped anything */
252
253 if (NT_STATUS_IS_OK(name_map_status) ||
254 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
255 {
256 full_name = mapped_name;
257 }
258
259 DEBUG(3,("name_to_sid [rpc] %s for domain %s\n",
260 full_name?full_name:"", domain_name ));
261
262 names[0] = full_name;
263
264 result = winbindd_lookup_names(mem_ctx, domain, 1,
265 names, &domains,
266 &sids, &types);
267 if (!NT_STATUS_IS_OK(result))
268 return result;
269
270 /* Return rid and type if lookup successful */
271
272 if (pdom_name != NULL) {
273 const char *dom_name;
274
275 dom_name = talloc_strdup(mem_ctx, domains[0]);
276 if (dom_name == NULL) {
277 return NT_STATUS_NO_MEMORY;
278 }
279
280 *pdom_name = dom_name;
281 }
282
283 sid_copy(sid, &sids[0]);
284 *type = types[0];
285
286 return NT_STATUS_OK;
287 }
288
289 /*
290 convert a domain SID to a user or group name
291 */
292 static NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
293 TALLOC_CTX *mem_ctx,
294 const struct dom_sid *sid,
295 char **domain_name,
296 char **name,
297 enum lsa_SidType *type)
298 {
299 char **domains;
300 char **names;
301 enum lsa_SidType *types = NULL;
302 NTSTATUS result;
303 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
304 char *mapped_name = NULL;
305 struct dom_sid_buf buf;
306
307 DEBUG(3, ("msrpc_sid_to_name: %s for domain %s\n",
308 dom_sid_str_buf(sid, &buf),
309 domain->name));
310
311 result = winbindd_lookup_sids(mem_ctx,
312 domain,
313 1,
314 sid,
315 &domains,
316 &names,
317 &types);
318 if (!NT_STATUS_IS_OK(result)) {
319 DEBUG(2,("msrpc_sid_to_name: failed to lookup sids: %s\n",
320 nt_errstr(result)));
321 return result;
322 }
323
324
325 *type = (enum lsa_SidType)types[0];
326 *domain_name = domains[0];
327 *name = names[0];
328
329 DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name));
330
331 name_map_status = normalize_name_map(mem_ctx, domain->name, *name,
332 &mapped_name);
333 if (NT_STATUS_IS_OK(name_map_status) ||
334 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
335 {
336 *name = mapped_name;
337 DEBUG(5,("returning mapped name -- %s\n", *name));
338 }
339
340 return NT_STATUS_OK;
341 }
342
343 static NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
344 TALLOC_CTX *mem_ctx,
345 const struct dom_sid *sid,
346 uint32_t *rids,
347 size_t num_rids,
348 char **domain_name,
349 char ***names,
350 enum lsa_SidType **types)
351 {
352 char **domains;
353 NTSTATUS result;
354 struct dom_sid *sids;
355 size_t i;
356 char **ret_names;
357
358 DEBUG(3, ("msrpc_rids_to_names: domain %s\n", domain->name ));
359
360 if (num_rids) {
361 sids = talloc_array(mem_ctx, struct dom_sid, num_rids);
362 if (sids == NULL) {
363 return NT_STATUS_NO_MEMORY;
364 }
365 } else {
366 sids = NULL;
367 }
368
369 for (i=0; i<num_rids; i++) {
370 if (!sid_compose(&sids[i], sid, rids[i])) {
371 return NT_STATUS_INTERNAL_ERROR;
372 }
373 }
374
375 result = winbindd_lookup_sids(mem_ctx,
376 domain,
377 num_rids,
378 sids,
379 &domains,
380 names,
381 types);
382
383 if (!NT_STATUS_IS_OK(result) &&
384 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
385 return result;
386 }
387
388 ret_names = *names;
389 for (i=0; i<num_rids; i++) {
390 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
391 char *mapped_name = NULL;
392
393 if ((*types)[i] != SID_NAME_UNKNOWN) {
394 name_map_status = normalize_name_map(mem_ctx,
395 domain->name,
396 ret_names[i],
397 &mapped_name);
398 if (NT_STATUS_IS_OK(name_map_status) ||
399 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
400 {
401 ret_names[i] = mapped_name;
402 }
403
404 *domain_name = domains[i];
405 }
406 }
407
408 return result;
409 }
410
411 /* Lookup groups a user is a member of. I wish Unix had a call like this! */
412 static NTSTATUS msrpc_lookup_usergroups(struct winbindd_domain *domain,
413 TALLOC_CTX *mem_ctx,
414 const struct dom_sid *user_sid,
415 uint32_t *pnum_groups,
416 struct dom_sid **puser_grpsids)
417 {
418 struct rpc_pipe_client *samr_pipe;
419 struct policy_handle dom_pol;
420 struct dom_sid *user_grpsids = NULL;
421 struct dom_sid_buf buf;
422 uint32_t num_groups = 0;
423 TALLOC_CTX *tmp_ctx;
424 NTSTATUS status;
425
426 DEBUG(3,("msrpc_lookup_usergroups sid=%s\n",
427 dom_sid_str_buf(user_sid, &buf)));
428
429 *pnum_groups = 0;
430
431 tmp_ctx = talloc_stackframe();
432 if (tmp_ctx == NULL) {
433 return NT_STATUS_NO_MEMORY;
434 }
435
436 /* Check if we have a cached user_info_3 */
437 status = lookup_usergroups_cached(tmp_ctx,
438 user_sid,
439 &num_groups,
440 &user_grpsids);
441 if (NT_STATUS_IS_OK(status)) {
442 goto cached;
443 }
444
445 if ( !winbindd_can_contact_domain( domain ) ) {
446 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
447 domain->name));
448
449 /* Tell the cache manager not to remember this one */
450 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
451 goto done;
452 }
453
454 /* no cache; hit the wire */
455 status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
456 if (!NT_STATUS_IS_OK(status)) {
457 goto done;
458 }
459
460 status = rpc_lookup_usergroups(tmp_ctx,
461 samr_pipe,
462 &dom_pol,
463 &domain->sid,
464 user_sid,
465 &num_groups,
466 &user_grpsids);
467 if (!NT_STATUS_IS_OK(status)) {
468 goto done;
469 }
470
471 cached:
472 *pnum_groups = num_groups;
473
474 if (puser_grpsids) {
475 *puser_grpsids = talloc_move(mem_ctx, &user_grpsids);
476 }
477
478 done:
479 TALLOC_FREE(tmp_ctx);
480 return status;
481 return NT_STATUS_OK;
482 }
483
484 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
485
486 static NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
487 TALLOC_CTX *mem_ctx,
488 uint32_t num_sids, const struct dom_sid *sids,
489 uint32_t *pnum_aliases,
490 uint32_t **palias_rids)
491 {
492 struct rpc_pipe_client *samr_pipe;
493 struct policy_handle dom_pol;
494 uint32_t num_aliases = 0;
495 uint32_t *alias_rids = NULL;
496 TALLOC_CTX *tmp_ctx;
497 NTSTATUS status;
498
499 DEBUG(3,("msrpc_lookup_useraliases\n"));
500
501 if (pnum_aliases) {
502 *pnum_aliases = 0;
503 }
504
505 tmp_ctx = talloc_stackframe();
506 if (tmp_ctx == NULL) {
507 return NT_STATUS_NO_MEMORY;
508 }
509
510 if (!winbindd_can_contact_domain(domain)) {
511 DEBUG(10,("msrpc_lookup_useraliases: No incoming trust for domain %s\n",
512 domain->name));
513 /* Tell the cache manager not to remember this one */
514 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
515 goto done;
516 }
517
518 status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
519 if (!NT_STATUS_IS_OK(status)) {
520 goto done;
521 }
522
523 status = rpc_lookup_useraliases(tmp_ctx,
524 samr_pipe,
525 &dom_pol,
526 num_sids,
527 sids,
528 &num_aliases,
529 &alias_rids);
530 if (!NT_STATUS_IS_OK(status)) {
531 goto done;
532 }
533
534 if (pnum_aliases) {
535 *pnum_aliases = num_aliases;
536 }
537
538 if (palias_rids) {
539 *palias_rids = talloc_move(mem_ctx, &alias_rids);
540 }
541
542 done:
543 TALLOC_FREE(tmp_ctx);
544 return status;
545 }
546
547
548 /* Lookup group membership given a rid. */
549 static NTSTATUS msrpc_lookup_groupmem(struct winbindd_domain *domain,
550 TALLOC_CTX *mem_ctx,
551 const struct dom_sid *group_sid,
552 enum lsa_SidType type,
553 uint32_t *num_names,
554 struct dom_sid **sid_mem,
555 char ***names,
556 uint32_t **name_types)
557 {
558 NTSTATUS status, result;
559 uint32_t i, total_names = 0;
560 struct policy_handle dom_pol, group_pol;
561 uint32_t des_access = SEC_FLAG_MAXIMUM_ALLOWED;
562 uint32_t *rid_mem = NULL;
563 uint32_t group_rid;
564 unsigned int j, r;
565 struct rpc_pipe_client *cli;
566 unsigned int orig_timeout;
567 struct samr_RidAttrArray *rids = NULL;
568 struct dcerpc_binding_handle *b;
569 struct dom_sid_buf buf;
570
571 DEBUG(3,("msrpc_lookup_groupmem: %s sid=%s\n", domain->name,
572 dom_sid_str_buf(group_sid, &buf)));
573
574 if ( !winbindd_can_contact_domain( domain ) ) {
575 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
576 domain->name));
577 return NT_STATUS_OK;
578 }
579
580 if (!sid_peek_check_rid(&domain->sid, group_sid, &group_rid))
581 return NT_STATUS_UNSUCCESSFUL;
582
583 *num_names = 0;
584
585 result = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
586 if (!NT_STATUS_IS_OK(result))
587 return result;
588
589 b = cli->binding_handle;
590
591 status = dcerpc_samr_OpenGroup(b, mem_ctx,
592 &dom_pol,
593 des_access,
594 group_rid,
595 &group_pol,
596 &result);
597 if (any_nt_status_not_ok(status, result, &status)) {
598 return status;
599 }
600
601 /* Step #1: Get a list of user rids that are the members of the
602 group. */
603
604 /* This call can take a long time - allow the server to time out.
605 35 seconds should do it. */
606
607 orig_timeout = rpccli_set_timeout(cli, 35000);
608
609 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
610 &group_pol,
611 &rids,
612 &result);
613
614 /* And restore our original timeout. */
615 rpccli_set_timeout(cli, orig_timeout);
616
617 {
618 NTSTATUS _result;
619 dcerpc_samr_Close(b, mem_ctx, &group_pol, &_result);
620 }
621
622 if (any_nt_status_not_ok(status, result, &status)) {
623 return status;
624 }
625
626 if (!rids || !rids->count) {
627 names = NULL;
628 name_types = NULL;
629 sid_mem = NULL;
630 return NT_STATUS_OK;
631 }
632
633 *num_names = rids->count;
634 rid_mem = rids->rids;
635
636 /* Step #2: Convert list of rids into list of usernames. Do this
637 in bunches of ~1000 to avoid crashing NT4. It looks like there
638 is a buffer overflow or something like that lurking around
639 somewhere. */
640
641 #define MAX_LOOKUP_RIDS 900
642
643 *names = talloc_zero_array(mem_ctx, char *, *num_names);
644 *name_types = talloc_zero_array(mem_ctx, uint32_t, *num_names);
645 *sid_mem = talloc_zero_array(mem_ctx, struct dom_sid, *num_names);
646
647 for (j=0;j<(*num_names);j++)
648 sid_compose(&(*sid_mem)[j], &domain->sid, rid_mem[j]);
649
650 if (*num_names>0 && (!*names || !*name_types))
651 return NT_STATUS_NO_MEMORY;
652
653 for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
654 int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
655 struct lsa_Strings tmp_names;
656 struct samr_Ids tmp_types;
657
658 /* Lookup a chunk of rids */
659
660 status = dcerpc_samr_LookupRids(b, mem_ctx,
661 &dom_pol,
662 num_lookup_rids,
663 &rid_mem[i],
664 &tmp_names,
665 &tmp_types,
666 &result);
667 if (!NT_STATUS_IS_OK(status)) {
668 return status;
669 }
670
671 /* see if we have a real error (and yes the
672 STATUS_SOME_UNMAPPED is the one returned from 2k) */
673
674 if (!NT_STATUS_IS_OK(result) &&
675 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
676 return result;
677
678 /* Copy result into array. The talloc system will take
679 care of freeing the temporary arrays later on. */
680
681 if (tmp_names.count != num_lookup_rids) {
682 return NT_STATUS_INVALID_NETWORK_RESPONSE;
683 }
684 if (tmp_types.count != num_lookup_rids) {
685 return NT_STATUS_INVALID_NETWORK_RESPONSE;
686 }
687
688 for (r=0; r<tmp_names.count; r++) {
689 if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
690 continue;
691 }
692 if (total_names >= *num_names) {
693 break;
694 }
695 (*names)[total_names] = fill_domain_username_talloc(
696 mem_ctx, domain->name,
697 tmp_names.names[r].string, true);
698 (*name_types)[total_names] = tmp_types.ids[r];
699 total_names += 1;
700 }
701 }
702
703 *num_names = total_names;
704
705 return NT_STATUS_OK;
706 }
707
708 #ifdef HAVE_LDAP
709
710 #include "ads.h"
711
712 static int get_ldap_seq(const char *server, struct sockaddr_storage *ss, int port, uint32_t *seq)
713 {
714 int ret = -1;
715 struct timeval to;
716 const char *attrs[] = {"highestCommittedUSN", NULL};
717 LDAPMessage *res = NULL;
718 char **values = NULL;
719 LDAP *ldp = NULL;
720
721 *seq = DOM_SEQUENCE_NONE;
722
723 /*
724 * Parameterised (5) second timeout on open. This is needed as the
725 * search timeout doesn't seem to apply to doing an open as well. JRA.
726 */
727
728 ldp = ldap_open_with_timeout(server, ss, port, lp_ldap_timeout());
729 if (ldp == NULL)
730 return -1;
731
732 /* Timeout if no response within 20 seconds. */
733 to.tv_sec = 10;
734 to.tv_usec = 0;
735
736 if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)",
737 discard_const_p(char *, attrs), 0, &to, &res))
738 goto done;
739
740 if (ldap_count_entries(ldp, res) != 1)
741 goto done;
742
743 values = ldap_get_values(ldp, res, "highestCommittedUSN");
744 if (!values || !values[0])
745 goto done;
746
747 *seq = atoi(values[0]);
748 ret = 0;
749
750 done:
751
752 if (values)
753 ldap_value_free(values);
754 if (res)
755 ldap_msgfree(res);
756 if (ldp)
757 ldap_unbind(ldp);
758 return ret;
759 }
760
761 /**********************************************************************
762 Get the sequence number for a Windows AD native mode domain using
763 LDAP queries.
764 **********************************************************************/
765
766 static int get_ldap_sequence_number(struct winbindd_domain *domain, uint32_t *seq)
767 {
768 int ret = -1;
769 char addr[INET6_ADDRSTRLEN];
770
771 print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
772 if ((ret = get_ldap_seq(addr, &domain->dcaddr, LDAP_PORT, seq)) == 0) {
773 DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence "
774 "number for Domain (%s) from DC (%s)\n",
775 domain->name, addr));
776 }
777 return ret;
778 }
779
780 #endif /* HAVE_LDAP */
781
782 /* find the sequence number for a domain */
783 static NTSTATUS msrpc_sequence_number(struct winbindd_domain *domain,
784 uint32_t *pseq)
785 {
786 struct rpc_pipe_client *samr_pipe;
787 struct policy_handle dom_pol;
788 uint32_t seq = DOM_SEQUENCE_NONE;
789 TALLOC_CTX *tmp_ctx;
790 NTSTATUS status;
791
792 DEBUG(3, ("msrpc_sequence_number: fetch sequence_number for %s\n", domain->name));
793
794 if (pseq) {
795 *pseq = DOM_SEQUENCE_NONE;
796 }
797
798 tmp_ctx = talloc_stackframe();
799 if (tmp_ctx == NULL) {
800 return NT_STATUS_NO_MEMORY;
801 }
802
803 if ( !winbindd_can_contact_domain( domain ) ) {
804 DEBUG(10,("sequence_number: No incoming trust for domain %s\n",
805 domain->name));
806 if (pseq) {
807 *pseq = time(NULL);
808 }
809 status = NT_STATUS_OK;
810 goto done;
811 }
812
813 #ifdef HAVE_LDAP
814 if (domain->active_directory) {
815 int rc;
816
817 DEBUG(8,("using get_ldap_seq() to retrieve the "
818 "sequence number\n"));
819
820 rc = get_ldap_sequence_number(domain, &seq);
821 if (rc == 0) {
822 DEBUG(10,("domain_sequence_number: LDAP for "
823 "domain %s is %u\n",
824 domain->name, seq));
825
826 if (pseq) {
827 *pseq = seq;
828 }
829
830 status = NT_STATUS_OK;
831 goto done;
832 }
833
834 DEBUG(10,("domain_sequence_number: failed to get LDAP "
835 "sequence number for domain %s\n",
836 domain->name ));
837 }
838 #endif /* HAVE_LDAP */
839
840 status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
841 if (!NT_STATUS_IS_OK(status)) {
842 goto done;
843 }
844
845 status = rpc_sequence_number(tmp_ctx,
846 samr_pipe,
847 &dom_pol,
848 domain->name,
849 &seq);
850 if (!NT_STATUS_IS_OK(status)) {
851 goto done;
852 }
853
854 if (pseq) {
855 *pseq = seq;
856 }
857
858 done:
859 TALLOC_FREE(tmp_ctx);
860 return status;
861 }
862
863 /* get a list of trusted domains */
864 static NTSTATUS msrpc_trusted_domains(struct winbindd_domain *domain,
865 TALLOC_CTX *mem_ctx,
866 struct netr_DomainTrustList *ptrust_list)
867 {
868 struct rpc_pipe_client *lsa_pipe;
869 struct policy_handle lsa_policy;
870 struct netr_DomainTrust *trusts = NULL;
871 uint32_t num_trusts = 0;
872 TALLOC_CTX *tmp_ctx;
873 NTSTATUS status;
874
875 DEBUG(3,("msrpc_trusted_domains\n"));
876
877 if (ptrust_list) {
878 ZERO_STRUCTP(ptrust_list);
879 }
880
881 tmp_ctx = talloc_stackframe();
882 if (tmp_ctx == NULL) {
883 return NT_STATUS_NO_MEMORY;
884 }
885
886 status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
887 if (!NT_STATUS_IS_OK(status)) {
888 goto done;
889 }
890
891 status = rpc_trusted_domains(tmp_ctx,
892 lsa_pipe,
893 &lsa_policy,
894 &num_trusts,
895 &trusts);
896 if (!NT_STATUS_IS_OK(status)) {
897 goto done;
898 }
899
900 if (ptrust_list) {
901 ptrust_list->count = num_trusts;
902 ptrust_list->array = talloc_move(mem_ctx, &trusts);
903 }
904
905 done:
906 TALLOC_FREE(tmp_ctx);
907 return status;
908 }
909
910 /* find the lockout policy for a domain */
911 static NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
912 TALLOC_CTX *mem_ctx,
913 struct samr_DomInfo12 *lockout_policy)
914 {
915 NTSTATUS status, result;
916 struct rpc_pipe_client *cli;
917 struct policy_handle dom_pol;
918 union samr_DomainInfo *info = NULL;
919 struct dcerpc_binding_handle *b;
920
921 DEBUG(3, ("msrpc_lockout_policy: fetch lockout policy for %s\n", domain->name));
922
923 if ( !winbindd_can_contact_domain( domain ) ) {
924 DEBUG(10,("msrpc_lockout_policy: No incoming trust for domain %s\n",
925 domain->name));
926 return NT_STATUS_NOT_SUPPORTED;
927 }
928
929 status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
930 if (!NT_STATUS_IS_OK(status)) {
931 goto done;
932 }
933
934 b = cli->binding_handle;
935
936 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
937 &dom_pol,
938 DomainLockoutInformation,
939 &info,
940 &result);
941 if (any_nt_status_not_ok(status, result, &status)) {
942 return status;
943 }
944
945 *lockout_policy = info->info12;
946
947 DEBUG(10,("msrpc_lockout_policy: lockout_threshold %d\n",
948 info->info12.lockout_threshold));
949
950 done:
951
952 return status;
953 }
954
955 /* find the password policy for a domain */
956 static NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
957 TALLOC_CTX *mem_ctx,
958 struct samr_DomInfo1 *password_policy)
959 {
960 NTSTATUS status, result;
961 struct rpc_pipe_client *cli;
962 struct policy_handle dom_pol;
963 union samr_DomainInfo *info = NULL;
964 struct dcerpc_binding_handle *b;
965
966 DEBUG(3, ("msrpc_password_policy: fetch password policy for %s\n",
967 domain->name));
968
969 if ( !winbindd_can_contact_domain( domain ) ) {
970 DEBUG(10,("msrpc_password_policy: No incoming trust for domain %s\n",
971 domain->name));
972 return NT_STATUS_NOT_SUPPORTED;
973 }
974
975 status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
976 if (!NT_STATUS_IS_OK(status)) {
977 goto done;
978 }
979
980 b = cli->binding_handle;
981
982 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
983 &dom_pol,
984 DomainPasswordInformation,
985 &info,
986 &result);
987 if (!NT_STATUS_IS_OK(status)) {
988 goto done;
989 }
990 if (!NT_STATUS_IS_OK(result)) {
991 goto done;
992 }
993
994 *password_policy = info->info1;
995
996 DEBUG(10,("msrpc_password_policy: min_length_password %d\n",
997 info->info1.min_password_length));
998
999 done:
1000
1001 return status;
1002 }
1003
1004 static enum lsa_LookupNamesLevel winbindd_lookup_level(
1005 struct winbindd_domain *domain)
1006 {
1007 enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_DOMAINS_ONLY;
1008
1009 if (domain->internal) {
1010 level = LSA_LOOKUP_NAMES_ALL;
1011 } else if (domain->secure_channel_type == SEC_CHAN_DNS_DOMAIN) {
1012 if (domain->domain_flags & NETR_TRUST_FLAG_IN_FOREST) {
1013 /*
1014 * TODO:
1015 *
1016 * Depending on what we want to resolve. We need to use:
1017 * 1. LsapLookupXForestReferral(5)/LSA_LOOKUP_NAMES_FOREST_TRUSTS_ONLY
1018 * if we want to pass the request into the direction of the forest
1019 * root domain. The forest root domain uses
1020 * LsapLookupXForestResolve(6)/LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2
1021 * when passing the request to trusted forests.
1022 * 2. LsapLookupGC(4)/LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY
1023 * if we're not a GC and want to resolve a name within our own forest.
1024 *
1025 * As we don't support more than one domain in our own forest
1026 * and always try to be a GC for now, we just set
1027 * LSA_LOOKUP_NAMES_FOREST_TRUSTS_ONLY.
1028 */
1029 level = LSA_LOOKUP_NAMES_FOREST_TRUSTS_ONLY;
1030 } else if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1031 /*
1032 * This is LsapLookupXForestResolve(6)/LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2
1033 */
1034 level = LSA_LOOKUP_NAMES_UPLEVEL_TRUSTS_ONLY2;
1035 } else {
1036 /*
1037 * This is LsapLookupTDL(3)/LSA_LOOKUP_NAMES_PRIMARY_DOMAIN_ONLY
1038 */
1039 level = LSA_LOOKUP_NAMES_PRIMARY_DOMAIN_ONLY;
1040 }
1041 } else if (domain->secure_channel_type == SEC_CHAN_DOMAIN) {
1042 /*
1043 * This is LsapLookupTDL(3)/LSA_LOOKUP_NAMES_PRIMARY_DOMAIN_ONLY
1044 */
1045 level = LSA_LOOKUP_NAMES_PRIMARY_DOMAIN_ONLY;
1046 } else if (domain->rodc) {
1047 level = LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC;
1048 } else {
1049 /*
1050 * This is LsapLookupPDC(2)/LSA_LOOKUP_NAMES_DOMAINS_ONLY
1051 */
1052 level = LSA_LOOKUP_NAMES_DOMAINS_ONLY;
1053 }
1054
1055 return level;
1056 }
1057
1058 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
1059 struct winbindd_domain *domain,
1060 uint32_t num_sids,
1061 const struct dom_sid *sids,
1062 char ***domains,
1063 char ***names,
1064 enum lsa_SidType **types)
1065 {
1066 NTSTATUS status;
1067 NTSTATUS result;
1068 struct rpc_pipe_client *cli = NULL;
1069 struct dcerpc_binding_handle *b = NULL;
1070 struct policy_handle lsa_policy;
1071 unsigned int orig_timeout;
1072 bool use_lookupsids3 = false;
1073 bool retried = false;
1074 enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_ALL;
1075
1076 connect:
1077 status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
1078 if (!NT_STATUS_IS_OK(status)) {
1079 return status;
1080 }
1081
1082 b = cli->binding_handle;
1083
1084 if (cli->transport->transport == NCACN_IP_TCP) {
1085 use_lookupsids3 = true;
1086 }
1087
1088 level = winbindd_lookup_level(domain);
1089
1090 /*
1091 * This call can take a long time
1092 * allow the server to time out.
1093 * 35 seconds should do it.
1094 */
1095 orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
1096
1097 status = dcerpc_lsa_lookup_sids_generic(b,
1098 mem_ctx,
1099 &lsa_policy,
1100 num_sids,
1101 sids,
1102 level,
1103 domains,
1104 names,
1105 types,
1106 use_lookupsids3,
1107 &result);
1108
1109 /* And restore our original timeout. */
1110 dcerpc_binding_handle_set_timeout(b, orig_timeout);
1111
1112 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
1113 NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
1114 NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
1115 /*
1116 * This can happen if the schannel key is not
1117 * valid anymore, we need to invalidate the
1118 * all connections to the dc and reestablish
1119 * a netlogon connection first.
1120 */
1121 invalidate_cm_connection(domain);
1122 domain->can_do_ncacn_ip_tcp = domain->active_directory;
1123 if (!retried) {
1124 retried = true;
1125 goto connect;
1126 }
1127 status = NT_STATUS_ACCESS_DENIED;
1128 }
1129
1130 if (any_nt_status_not_ok(status, result, &status)) {
1131 return status;
1132 }
1133
1134 return NT_STATUS_OK;
1135 }
1136
1137 static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
1138 struct winbindd_domain *domain,
1139 uint32_t num_names,
1140 const char **names,
1141 const char ***domains,
1142 struct dom_sid **sids,
1143 enum lsa_SidType **types)
1144 {
1145 NTSTATUS status;
1146 NTSTATUS result;
1147 struct rpc_pipe_client *cli = NULL;
1148 struct dcerpc_binding_handle *b = NULL;
1149 struct policy_handle lsa_policy;
1150 unsigned int orig_timeout = 0;
1151 bool use_lookupnames4 = false;
1152 bool retried = false;
1153 enum lsa_LookupNamesLevel level = LSA_LOOKUP_NAMES_ALL;
1154
1155 connect:
1156 status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
1157 if (!NT_STATUS_IS_OK(status)) {
1158 return status;
1159 }
1160
1161 b = cli->binding_handle;
1162
1163 if (cli->transport->transport == NCACN_IP_TCP) {
1164 use_lookupnames4 = true;
1165 }
1166
1167 level = winbindd_lookup_level(domain);
1168
1169 /*
1170 * This call can take a long time
1171 * allow the server to time out.
1172 * 35 seconds should do it.
1173 */
1174 orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
1175
1176 status = dcerpc_lsa_lookup_names_generic(b,
1177 mem_ctx,
1178 &lsa_policy,
1179 num_names,
1180 (const char **) names,
1181 domains,
1182 level,
1183 sids,
1184 types,
1185 use_lookupnames4,
1186 &result);
1187
1188 /* And restore our original timeout. */
1189 dcerpc_binding_handle_set_timeout(b, orig_timeout);
1190
1191 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
1192 NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
1193 NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
1194 /*
1195 * This can happen if the schannel key is not
1196 * valid anymore, we need to invalidate the
1197 * all connections to the dc and reestablish
1198 * a netlogon connection first.
1199 */
1200 invalidate_cm_connection(domain);
1201 if (!retried) {
1202 retried = true;
1203 goto connect;
1204 }
1205 status = NT_STATUS_ACCESS_DENIED;
1206 }
1207
1208 if (any_nt_status_not_ok(status, result, &status)) {
1209 return status;
1210 }
1211
1212 return NT_STATUS_OK;
1213 }
1214
1215 /* the rpc backend methods are exposed via this structure */
1216 struct winbindd_methods msrpc_methods = {
1217 False,
1218 msrpc_query_user_list,
1219 msrpc_enum_dom_groups,
1220 msrpc_enum_local_groups,
1221 msrpc_name_to_sid,
1222 msrpc_sid_to_name,
1223 msrpc_rids_to_names,
1224 msrpc_lookup_usergroups,
1225 msrpc_lookup_useraliases,
1226 msrpc_lookup_groupmem,
1227 msrpc_sequence_number,
1228 msrpc_lockout_policy,
1229 msrpc_password_policy,
1230 msrpc_trusted_domains,
1231 };
Samba GIT mirror