source3/winbindd/winbindd_cm.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon connection manager
   5
   6    Copyright (C) Tim Potter                2001
   7    Copyright (C) Andrew Bartlett           2002
   8    Copyright (C) Gerald (Jerry) Carter     2003-2005.
   9    Copyright (C) Volker Lendecke           2004-2005
  10    Copyright (C) Jeremy Allison            2006
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 /*
  27    We need to manage connections to domain controllers without having to
  28    mess up the main winbindd code with other issues.  The aim of the
  29    connection manager is to:
  30
  31        - make connections to domain controllers and cache them
  32        - re-establish connections when networks or servers go down
  33        - centralise the policy on connection timeouts, domain controller
  34          selection etc
  35        - manage re-entrancy for when winbindd becomes able to handle
  36          multiple outstanding rpc requests
  37
  38    Why not have connection management as part of the rpc layer like tng?
  39    Good question.  This code may morph into libsmb/rpc_cache.c or something
  40    like that but at the moment it's simply staying as part of winbind.  I
  41    think the TNG architecture of forcing every user of the rpc layer to use
  42    the connection caching system is a bad idea.  It should be an optional
  43    method of using the routines.
  44
  45    The TNG design is quite good but I disagree with some aspects of the
  46    implementation. -tpot
  47
  48  */
  49
  50 /*
  51    TODO:
  52
  53      - I'm pretty annoyed by all the make_nmb_name() stuff.  It should be
  54        moved down into another function.
  55
  56      - Take care when destroying cli_structs as they can be shared between
  57        various sam handles.
  58
  59  */
  60
  61 #include "includes.h"
  62 #include "winbindd.h"
  63
  64 #undef DBGC_CLASS
  65 #define DBGC_CLASS DBGC_WINBIND
  66
  67 struct dc_name_ip {
  68         fstring name;
  69         struct sockaddr_storage ss;
  70 };
  71
  72 extern struct winbindd_methods reconnect_methods;
  73 extern bool override_logfile;
  74
  75 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
  76 static void set_dc_type_and_flags( struct winbindd_domain *domain );
  77 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
  78                     struct dc_name_ip **dcs, int *num_dcs);
  79
  80 /****************************************************************
  81  Child failed to find DC's. Reschedule check.
  82 ****************************************************************/
  83
  84 static void msg_failed_to_go_online(struct messaging_context *msg,
  85                                     void *private_data,
  86                                     uint32_t msg_type,
  87                                     struct server_id server_id,
  88                                     DATA_BLOB *data)
  89 {
  90         struct winbindd_domain *domain;
  91         const char *domainname = (const char *)data->data;
  92
  93         if (data->data == NULL || data->length == 0) {
  94                 return;
  95         }
  96
  97         DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
  98
  99         for (domain = domain_list(); domain; domain = domain->next) {
 100                 if (domain->internal) {
 101                         continue;
 102                 }
 103
 104                 if (strequal(domain->name, domainname)) {
 105                         if (domain->online) {
 106                                 /* We're already online, ignore. */
 107                                 DEBUG(5,("msg_fail_to_go_online: domain %s "
 108                                         "already online.\n", domainname));
 109                                 continue;
 110                         }
 111
 112                         /* Reschedule the online check. */
 113                         set_domain_offline(domain);
 114                         break;
 115                 }
 116         }
 117 }
 118
 119 /****************************************************************
 120  Actually cause a reconnect from a message.
 121 ****************************************************************/
 122
 123 static void msg_try_to_go_online(struct messaging_context *msg,
 124                                  void *private_data,
 125                                  uint32_t msg_type,
 126                                  struct server_id server_id,
 127                                  DATA_BLOB *data)
 128 {
 129         struct winbindd_domain *domain;
 130         const char *domainname = (const char *)data->data;
 131
 132         if (data->data == NULL || data->length == 0) {
 133                 return;
 134         }
 135
 136         DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
 137
 138         for (domain = domain_list(); domain; domain = domain->next) {
 139                 if (domain->internal) {
 140                         continue;
 141                 }
 142
 143                 if (strequal(domain->name, domainname)) {
 144
 145                         if (domain->online) {
 146                                 /* We're already online, ignore. */
 147                                 DEBUG(5,("msg_try_to_go_online: domain %s "
 148                                         "already online.\n", domainname));
 149                                 continue;
 150                         }
 151
 152                         /* This call takes care of setting the online
 153                            flag to true if we connected, or re-adding
 154                            the offline handler if false. Bypasses online
 155                            check so always does network calls. */
 156
 157                         init_dc_connection_network(domain);
 158                         break;
 159                 }
 160         }
 161 }
 162
 163 /****************************************************************
 164  Fork a child to try and contact a DC. Do this as contacting a
 165  DC requires blocking lookups and we don't want to block our
 166  parent.
 167 ****************************************************************/
 168
 169 static bool fork_child_dc_connect(struct winbindd_domain *domain)
 170 {
 171         struct dc_name_ip *dcs = NULL;
 172         int num_dcs = 0;
 173         TALLOC_CTX *mem_ctx = NULL;
 174         pid_t parent_pid = sys_getpid();
 175         char *lfile = NULL;
 176
 177         if (domain->dc_probe_pid != (pid_t)-1) {
 178                 /*
 179                  * We might already have a DC probe
 180                  * child working, check.
 181                  */
 182                 if (process_exists_by_pid(domain->dc_probe_pid)) {
 183                         DEBUG(10,("fork_child_dc_connect: pid %u already "
 184                                 "checking for DC's.\n",
 185                                 (unsigned int)domain->dc_probe_pid));
 186                         return true;
 187                 }
 188                 domain->dc_probe_pid = (pid_t)-1;
 189         }
 190
 191         domain->dc_probe_pid = sys_fork();
 192
 193         if (domain->dc_probe_pid == (pid_t)-1) {
 194                 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
 195                 return False;
 196         }
 197
 198         if (domain->dc_probe_pid != (pid_t)0) {
 199                 /* Parent */
 200                 messaging_register(winbind_messaging_context(), NULL,
 201                                    MSG_WINBIND_TRY_TO_GO_ONLINE,
 202                                    msg_try_to_go_online);
 203                 messaging_register(winbind_messaging_context(), NULL,
 204                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 205                                    msg_failed_to_go_online);
 206                 return True;
 207         }
 208
 209         /* Child. */
 210
 211         /* Leave messages blocked - we will never process one. */
 212
 213         if (!override_logfile) {
 214                 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
 215                         DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
 216                         _exit(1);
 217                 }
 218         }
 219
 220         if (!winbindd_reinit_after_fork(lfile)) {
 221                 messaging_send_buf(winbind_messaging_context(),
 222                                    pid_to_procid(parent_pid),
 223                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 224                                    (uint8 *)domain->name,
 225                                    strlen(domain->name)+1);
 226                 _exit(1);
 227         }
 228         SAFE_FREE(lfile);
 229
 230         mem_ctx = talloc_init("fork_child_dc_connect");
 231         if (!mem_ctx) {
 232                 DEBUG(0,("talloc_init failed.\n"));
 233                 messaging_send_buf(winbind_messaging_context(),
 234                                    pid_to_procid(parent_pid),
 235                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 236                                    (uint8 *)domain->name,
 237                                    strlen(domain->name)+1);
 238                 _exit(1);
 239         }
 240
 241         if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
 242                 /* Still offline ? Can't find DC's. */
 243                 messaging_send_buf(winbind_messaging_context(),
 244                                    pid_to_procid(parent_pid),
 245                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 246                                    (uint8 *)domain->name,
 247                                    strlen(domain->name)+1);
 248                 _exit(0);
 249         }
 250
 251         /* We got a DC. Send a message to our parent to get it to
 252            try and do the same. */
 253
 254         messaging_send_buf(winbind_messaging_context(),
 255                            pid_to_procid(parent_pid),
 256                            MSG_WINBIND_TRY_TO_GO_ONLINE,
 257                            (uint8 *)domain->name,
 258                            strlen(domain->name)+1);
 259         _exit(0);
 260 }
 261
 262 /****************************************************************
 263  Handler triggered if we're offline to try and detect a DC.
 264 ****************************************************************/
 265
 266 static void check_domain_online_handler(struct event_context *ctx,
 267                                         struct timed_event *te,
 268                                         struct timeval now,
 269                                         void *private_data)
 270 {
 271         struct winbindd_domain *domain =
 272                 (struct winbindd_domain *)private_data;
 273
 274         DEBUG(10,("check_domain_online_handler: called for domain "
 275                   "%s (online = %s)\n", domain->name,
 276                   domain->online ? "True" : "False" ));
 277
 278         TALLOC_FREE(domain->check_online_event);
 279
 280         /* Are we still in "startup" mode ? */
 281
 282         if (domain->startup && (now.tv_sec > domain->startup_time + 30)) {
 283                 /* No longer in "startup" mode. */
 284                 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
 285                         domain->name ));
 286                 domain->startup = False;
 287         }
 288
 289         /* We've been told to stay offline, so stay
 290            that way. */
 291
 292         if (get_global_winbindd_state_offline()) {
 293                 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
 294                         domain->name ));
 295                 return;
 296         }
 297
 298         /* Fork a child to test if it can contact a DC.
 299            If it can then send ourselves a message to
 300            cause a reconnect. */
 301
 302         fork_child_dc_connect(domain);
 303 }
 304
 305 /****************************************************************
 306  If we're still offline setup the timeout check.
 307 ****************************************************************/
 308
 309 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
 310 {
 311         int wbr = lp_winbind_reconnect_delay();
 312
 313         if (domain->startup) {
 314                 domain->check_online_timeout = 10;
 315         } else if (domain->check_online_timeout < wbr) {
 316                 domain->check_online_timeout = wbr;
 317         }
 318 }
 319
 320 /****************************************************************
 321  Set domain offline and also add handler to put us back online
 322  if we detect a DC.
 323 ****************************************************************/
 324
 325 void set_domain_offline(struct winbindd_domain *domain)
 326 {
 327         DEBUG(10,("set_domain_offline: called for domain %s\n",
 328                 domain->name ));
 329
 330         TALLOC_FREE(domain->check_online_event);
 331
 332         if (domain->internal) {
 333                 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
 334                         domain->name ));
 335                 return;
 336         }
 337
 338         domain->online = False;
 339
 340         /* Offline domains are always initialized. They're
 341            re-initialized when they go back online. */
 342
 343         domain->initialized = True;
 344
 345         /* We only add the timeout handler that checks and
 346            allows us to go back online when we've not
 347            been told to remain offline. */
 348
 349         if (get_global_winbindd_state_offline()) {
 350                 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
 351                         domain->name ));
 352                 return;
 353         }
 354
 355         /* If we're in statup mode, check again in 10 seconds, not in
 356            lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
 357
 358         calc_new_online_timeout_check(domain);
 359
 360         domain->check_online_event = event_add_timed(winbind_event_context(),
 361                                                 NULL,
 362                                                 timeval_current_ofs(domain->check_online_timeout,0),
 363                                                 check_domain_online_handler,
 364                                                 domain);
 365
 366         /* The above *has* to succeed for winbindd to work. */
 367         if (!domain->check_online_event) {
 368                 smb_panic("set_domain_offline: failed to add online handler");
 369         }
 370
 371         DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
 372                 domain->name ));
 373
 374         /* Send an offline message to the idmap child when our
 375            primary domain goes offline */
 376
 377         if ( domain->primary ) {
 378                 struct winbindd_child *idmap = idmap_child();
 379
 380                 if ( idmap->pid != 0 ) {
 381                         messaging_send_buf(winbind_messaging_context(),
 382                                            pid_to_procid(idmap->pid),
 383                                            MSG_WINBIND_OFFLINE,
 384                                            (uint8 *)domain->name,
 385                                            strlen(domain->name)+1);
 386                 }
 387         }
 388
 389         return;
 390 }
 391
 392 /****************************************************************
 393  Set domain online - if allowed.
 394 ****************************************************************/
 395
 396 static void set_domain_online(struct winbindd_domain *domain)
 397 {
 398         DEBUG(10,("set_domain_online: called for domain %s\n",
 399                 domain->name ));
 400
 401         if (domain->internal) {
 402                 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
 403                         domain->name ));
 404                 return;
 405         }
 406
 407         if (get_global_winbindd_state_offline()) {
 408                 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
 409                         domain->name ));
 410                 return;
 411         }
 412
 413         winbindd_set_locator_kdc_envs(domain);
 414
 415         /* If we are waiting to get a krb5 ticket, trigger immediately. */
 416         ccache_regain_all_now();
 417
 418         /* Ok, we're out of any startup mode now... */
 419         domain->startup = False;
 420
 421         if (domain->online == False) {
 422                 /* We were offline - now we're online. We default to
 423                    using the MS-RPC backend if we started offline,
 424                    and if we're going online for the first time we
 425                    should really re-initialize the backends and the
 426                    checks to see if we're talking to an AD or NT domain.
 427                 */
 428
 429                 domain->initialized = False;
 430
 431                 /* 'reconnect_methods' is the MS-RPC backend. */
 432                 if (domain->backend == &reconnect_methods) {
 433                         domain->backend = NULL;
 434                 }
 435         }
 436
 437         /* Ensure we have no online timeout checks. */
 438         domain->check_online_timeout = 0;
 439         TALLOC_FREE(domain->check_online_event);
 440
 441         /* Ensure we ignore any pending child messages. */
 442         messaging_deregister(winbind_messaging_context(),
 443                              MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
 444         messaging_deregister(winbind_messaging_context(),
 445                              MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
 446
 447         domain->online = True;
 448
 449         /* Send an online message to the idmap child when our
 450            primary domain comes online */
 451
 452         if ( domain->primary ) {
 453                 struct winbindd_child *idmap = idmap_child();
 454
 455                 if ( idmap->pid != 0 ) {
 456                         messaging_send_buf(winbind_messaging_context(),
 457                                            pid_to_procid(idmap->pid),
 458                                            MSG_WINBIND_ONLINE,
 459                                            (uint8 *)domain->name,
 460                                            strlen(domain->name)+1);
 461                 }
 462         }
 463
 464         return;
 465 }
 466
 467 /****************************************************************
 468  Requested to set a domain online.
 469 ****************************************************************/
 470
 471 void set_domain_online_request(struct winbindd_domain *domain)
 472 {
 473         struct timeval tev;
 474
 475         DEBUG(10,("set_domain_online_request: called for domain %s\n",
 476                 domain->name ));
 477
 478         if (get_global_winbindd_state_offline()) {
 479                 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
 480                         domain->name ));
 481                 return;
 482         }
 483
 484         /* We've been told it's safe to go online and
 485            try and connect to a DC. But I don't believe it
 486            because network manager seems to lie.
 487            Wait at least 5 seconds. Heuristics suck... */
 488
 489
 490         GetTimeOfDay(&tev);
 491
 492         /* Go into "startup" mode again. */
 493         domain->startup_time = tev.tv_sec;
 494         domain->startup = True;
 495
 496         tev.tv_sec += 5;
 497
 498         if (!domain->check_online_event) {
 499                 /* If we've come from being globally offline we
 500                    don't have a check online event handler set.
 501                    We need to add one now we're trying to go
 502                    back online. */
 503
 504                 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
 505                         domain->name ));
 506         }
 507
 508         TALLOC_FREE(domain->check_online_event);
 509
 510         domain->check_online_event = event_add_timed(winbind_event_context(),
 511                                                      NULL,
 512                                                      tev,
 513                                                      check_domain_online_handler,
 514                                                      domain);
 515
 516         /* The above *has* to succeed for winbindd to work. */
 517         if (!domain->check_online_event) {
 518                 smb_panic("set_domain_online_request: failed to add online handler");
 519         }
 520 }
 521
 522 /****************************************************************
 523  Add -ve connection cache entries for domain and realm.
 524 ****************************************************************/
 525
 526 void winbind_add_failed_connection_entry(const struct winbindd_domain *domain,
 527                                         const char *server,
 528                                         NTSTATUS result)
 529 {
 530         add_failed_connection_entry(domain->name, server, result);
 531         /* If this was the saf name for the last thing we talked to,
 532            remove it. */
 533         saf_delete(domain->name);
 534         if (*domain->alt_name) {
 535                 add_failed_connection_entry(domain->alt_name, server, result);
 536                 saf_delete(domain->alt_name);
 537         }
 538         winbindd_unset_locator_kdc_env(domain);
 539 }
 540
 541 /* Choose between anonymous or authenticated connections.  We need to use
 542    an authenticated connection if DCs have the RestrictAnonymous registry
 543    entry set > 0, or the "Additional restrictions for anonymous
 544    connections" set in the win2k Local Security Policy.
 545
 546    Caller to free() result in domain, username, password
 547 */
 548
 549 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
 550 {
 551         *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
 552         *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 553         *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
 554
 555         if (*username && **username) {
 556
 557                 if (!*domain || !**domain)
 558                         *domain = smb_xstrdup(lp_workgroup());
 559
 560                 if (!*password || !**password)
 561                         *password = smb_xstrdup("");
 562
 563                 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
 564                           *domain, *username));
 565
 566         } else {
 567                 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
 568                 *username = smb_xstrdup("");
 569                 *domain = smb_xstrdup("");
 570                 *password = smb_xstrdup("");
 571         }
 572 }
 573
 574 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
 575                                      fstring dcname,
 576                                      struct sockaddr_storage *dc_ss)
 577 {
 578         struct winbindd_domain *our_domain = NULL;
 579         struct rpc_pipe_client *netlogon_pipe = NULL;
 580         NTSTATUS result;
 581         WERROR werr;
 582         TALLOC_CTX *mem_ctx;
 583         unsigned int orig_timeout;
 584         const char *tmp = NULL;
 585         const char *p;
 586
 587         /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
 588          * moment.... */
 589
 590         if (IS_DC) {
 591                 return False;
 592         }
 593
 594         if (domain->primary) {
 595                 return False;
 596         }
 597
 598         our_domain = find_our_domain();
 599
 600         if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
 601                 return False;
 602         }
 603
 604         result = cm_connect_netlogon(our_domain, &netlogon_pipe);
 605         if (!NT_STATUS_IS_OK(result)) {
 606                 talloc_destroy(mem_ctx);
 607                 return False;
 608         }
 609
 610         /* This call can take a long time - allow the server to time out.
 611            35 seconds should do it. */
 612
 613         orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
 614
 615         if (our_domain->active_directory) {
 616                 struct netr_DsRGetDCNameInfo *domain_info = NULL;
 617
 618                 result = rpccli_netr_DsRGetDCName(netlogon_pipe,
 619                                                   mem_ctx,
 620                                                   our_domain->dcname,
 621                                                   domain->name,
 622                                                   NULL,
 623                                                   NULL,
 624                                                   DS_RETURN_DNS_NAME,
 625                                                   &domain_info,
 626                                                   &werr);
 627                 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
 628                         tmp = talloc_strdup(
 629                                 mem_ctx, domain_info->dc_unc);
 630                         if (tmp == NULL) {
 631                                 DEBUG(0, ("talloc_strdup failed\n"));
 632                                 talloc_destroy(mem_ctx);
 633                                 return false;
 634                         }
 635                         if (strlen(domain->alt_name) == 0) {
 636                                 fstrcpy(domain->alt_name,
 637                                         domain_info->domain_name);
 638                         }
 639                         if (strlen(domain->forest_name) == 0) {
 640                                 fstrcpy(domain->forest_name,
 641                                         domain_info->forest_name);
 642                         }
 643                 }
 644         } else {
 645                 result = rpccli_netr_GetAnyDCName(netlogon_pipe, mem_ctx,
 646                                                   our_domain->dcname,
 647                                                   domain->name,
 648                                                   &tmp,
 649                                                   &werr);
 650         }
 651
 652         /* And restore our original timeout. */
 653         rpccli_set_timeout(netlogon_pipe, orig_timeout);
 654
 655         if (!NT_STATUS_IS_OK(result)) {
 656                 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
 657                         nt_errstr(result)));
 658                 talloc_destroy(mem_ctx);
 659                 return false;
 660         }
 661
 662         if (!W_ERROR_IS_OK(werr)) {
 663                 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
 664                            win_errstr(werr)));
 665                 talloc_destroy(mem_ctx);
 666                 return false;
 667         }
 668
 669         /* rpccli_netr_GetAnyDCName gives us a name with \\ */
 670         p = strip_hostname(tmp);
 671
 672         fstrcpy(dcname, p);
 673
 674         talloc_destroy(mem_ctx);
 675
 676         DEBUG(10,("rpccli_netr_GetAnyDCName returned %s\n", dcname));
 677
 678         if (!resolve_name(dcname, dc_ss, 0x20)) {
 679                 return False;
 680         }
 681
 682         return True;
 683 }
 684
 685 /**
 686  * Helper function to assemble trust password and account name
 687  */
 688 static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
 689                                 char **machine_password,
 690                                 char **machine_account,
 691                                 char **machine_krb5_principal)
 692 {
 693         const char *account_name;
 694         const char *name = NULL;
 695
 696         /* If we are a DC and this is not our own domain */
 697
 698         if (IS_DC) {
 699                 name = domain->name;
 700         } else {
 701                 struct winbindd_domain *our_domain = find_our_domain();
 702
 703                 if (!our_domain)
 704                         return NT_STATUS_INVALID_SERVER_STATE;
 705
 706                 name = our_domain->name;
 707         }
 708
 709         if (!get_trust_pw_clear(name, machine_password,
 710                                 &account_name, NULL))
 711         {
 712                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 713         }
 714
 715         if ((machine_account != NULL) &&
 716             (asprintf(machine_account, "%s$", account_name) == -1))
 717         {
 718                 return NT_STATUS_NO_MEMORY;
 719         }
 720
 721         /* For now assume our machine account only exists in our domain */
 722
 723         if (machine_krb5_principal != NULL)
 724         {
 725                 struct winbindd_domain *our_domain = find_our_domain();
 726
 727                 if (!our_domain) {
 728                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 729                 }
 730
 731                 if (asprintf(machine_krb5_principal, "%s$@%s",
 732                              account_name, our_domain->alt_name) == -1)
 733                 {
 734                         return NT_STATUS_NO_MEMORY;
 735                 }
 736
 737                 strupper_m(*machine_krb5_principal);
 738         }
 739
 740         return NT_STATUS_OK;
 741 }
 742
 743 /************************************************************************
 744  Given a fd with a just-connected TCP connection to a DC, open a connection
 745  to the pipe.
 746 ************************************************************************/
 747
 748 static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 749                                       const int sockfd,
 750                                       const char *controller,
 751                                       struct cli_state **cli,
 752                                       bool *retry)
 753 {
 754         char *machine_password = NULL;
 755         char *machine_krb5_principal = NULL;
 756         char *machine_account = NULL;
 757         char *ipc_username = NULL;
 758         char *ipc_domain = NULL;
 759         char *ipc_password = NULL;
 760
 761         struct named_mutex *mutex;
 762
 763         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 764
 765         struct sockaddr peeraddr;
 766         socklen_t peeraddr_len;
 767
 768         struct sockaddr_in *peeraddr_in = (struct sockaddr_in *)&peeraddr;
 769
 770         DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
 771                 controller, domain->name ));
 772
 773         *retry = True;
 774
 775         mutex = grab_named_mutex(talloc_tos(), controller,
 776                                  WINBIND_SERVER_MUTEX_WAIT_TIME);
 777         if (mutex == NULL) {
 778                 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
 779                          controller));
 780                 result = NT_STATUS_POSSIBLE_DEADLOCK;
 781                 goto done;
 782         }
 783
 784         if ((*cli = cli_initialise()) == NULL) {
 785                 DEBUG(1, ("Could not cli_initialize\n"));
 786                 result = NT_STATUS_NO_MEMORY;
 787                 goto done;
 788         }
 789
 790         (*cli)->timeout = 10000;        /* 10 seconds */
 791         (*cli)->fd = sockfd;
 792         fstrcpy((*cli)->desthost, controller);
 793         (*cli)->use_kerberos = True;
 794
 795         peeraddr_len = sizeof(peeraddr);
 796
 797         if ((getpeername((*cli)->fd, &peeraddr, &peeraddr_len) != 0)) {
 798                 DEBUG(0,("cm_prepare_connection: getpeername failed with: %s\n",
 799                         strerror(errno)));
 800                 result = NT_STATUS_UNSUCCESSFUL;
 801                 goto done;
 802         }
 803
 804         if ((peeraddr_len != sizeof(struct sockaddr_in))
 805 #ifdef HAVE_IPV6
 806             && (peeraddr_len != sizeof(struct sockaddr_in6))
 807 #endif
 808             ) {
 809                 DEBUG(0,("cm_prepare_connection: got unexpected peeraddr len %d\n",
 810                         peeraddr_len));
 811                 result = NT_STATUS_UNSUCCESSFUL;
 812                 goto done;
 813         }
 814
 815         if ((peeraddr_in->sin_family != PF_INET)
 816 #ifdef HAVE_IPV6
 817             && (peeraddr_in->sin_family != PF_INET6)
 818 #endif
 819             ) {
 820                 DEBUG(0,("cm_prepare_connection: got unexpected family %d\n",
 821                         peeraddr_in->sin_family));
 822                 result = NT_STATUS_UNSUCCESSFUL;
 823                 goto done;
 824         }
 825
 826         if (ntohs(peeraddr_in->sin_port) == 139) {
 827                 struct nmb_name calling;
 828                 struct nmb_name called;
 829
 830                 make_nmb_name(&calling, global_myname(), 0x0);
 831                 make_nmb_name(&called, "*SMBSERVER", 0x20);
 832
 833                 if (!cli_session_request(*cli, &calling, &called)) {
 834                         DEBUG(8, ("cli_session_request failed for %s\n",
 835                                   controller));
 836                         result = NT_STATUS_UNSUCCESSFUL;
 837                         goto done;
 838                 }
 839         }
 840
 841         result = cli_negprot(*cli);
 842
 843         if (!NT_STATUS_IS_OK(result)) {
 844                 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
 845                 goto done;
 846         }
 847
 848         if (!is_dc_trusted_domain_situation(domain->name) &&
 849             (*cli)->protocol >= PROTOCOL_NT1 &&
 850             (*cli)->capabilities & CAP_EXTENDED_SECURITY)
 851         {
 852                 ADS_STATUS ads_status;
 853
 854                 result = get_trust_creds(domain, &machine_password,
 855                                          &machine_account,
 856                                          &machine_krb5_principal);
 857                 if (!NT_STATUS_IS_OK(result)) {
 858                         goto anon_fallback;
 859                 }
 860
 861                 if (lp_security() == SEC_ADS) {
 862
 863                         /* Try a krb5 session */
 864
 865                         (*cli)->use_kerberos = True;
 866                         DEBUG(5, ("connecting to %s from %s with kerberos principal "
 867                                   "[%s] and realm [%s]\n", controller, global_myname(),
 868                                   machine_krb5_principal, domain->alt_name));
 869
 870                         winbindd_set_locator_kdc_envs(domain);
 871
 872                         ads_status = cli_session_setup_spnego(*cli,
 873                                                               machine_krb5_principal,
 874                                                               machine_password,
 875                                                               lp_workgroup(),
 876                                                               domain->alt_name);
 877
 878                         if (!ADS_ERR_OK(ads_status)) {
 879                                 DEBUG(4,("failed kerberos session setup with %s\n",
 880                                          ads_errstr(ads_status)));
 881                         }
 882
 883                         result = ads_ntstatus(ads_status);
 884                         if (NT_STATUS_IS_OK(result)) {
 885                                 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 886                                 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 887                                 if (!NT_STATUS_IS_OK(result)) {
 888                                         goto done;
 889                                 }
 890                                 goto session_setup_done;
 891                         }
 892                 }
 893
 894                 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
 895                 (*cli)->use_kerberos = False;
 896
 897                 DEBUG(5, ("connecting to %s from %s with username "
 898                           "[%s]\\[%s]\n",  controller, global_myname(),
 899                           lp_workgroup(), machine_account));
 900
 901                 ads_status = cli_session_setup_spnego(*cli,
 902                                                       machine_account,
 903                                                       machine_password,
 904                                                       lp_workgroup(),
 905                                                       NULL);
 906                 if (!ADS_ERR_OK(ads_status)) {
 907                         DEBUG(4, ("authenticated session setup failed with %s\n",
 908                                 ads_errstr(ads_status)));
 909                 }
 910
 911                 result = ads_ntstatus(ads_status);
 912                 if (NT_STATUS_IS_OK(result)) {
 913                         /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 914                         result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 915                         if (!NT_STATUS_IS_OK(result)) {
 916                                 goto done;
 917                         }
 918                         goto session_setup_done;
 919                 }
 920         }
 921
 922         /* Fall back to non-kerberos session setup with auth_user */
 923
 924         (*cli)->use_kerberos = False;
 925
 926         cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
 927
 928         if ((((*cli)->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) != 0) &&
 929             (strlen(ipc_username) > 0)) {
 930
 931                 /* Only try authenticated if we have a username */
 932
 933                 DEBUG(5, ("connecting to %s from %s with username "
 934                           "[%s]\\[%s]\n",  controller, global_myname(),
 935                           ipc_domain, ipc_username));
 936
 937                 if (NT_STATUS_IS_OK(cli_session_setup(
 938                                             *cli, ipc_username,
 939                                             ipc_password, strlen(ipc_password)+1,
 940                                             ipc_password, strlen(ipc_password)+1,
 941                                             ipc_domain))) {
 942                         /* Successful logon with given username. */
 943                         result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
 944                         if (!NT_STATUS_IS_OK(result)) {
 945                                 goto done;
 946                         }
 947                         goto session_setup_done;
 948                 } else {
 949                         DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
 950                                 ipc_domain, ipc_username ));
 951                 }
 952         }
 953
 954  anon_fallback:
 955
 956         /* Fall back to anonymous connection, this might fail later */
 957         DEBUG(10,("cm_prepare_connection: falling back to anonymous "
 958                 "connection for DC %s\n",
 959                 controller ));
 960
 961         if (NT_STATUS_IS_OK(cli_session_setup(*cli, "", NULL, 0,
 962                                               NULL, 0, ""))) {
 963                 DEBUG(5, ("Connected anonymously\n"));
 964                 result = cli_init_creds(*cli, "", "", "");
 965                 if (!NT_STATUS_IS_OK(result)) {
 966                         goto done;
 967                 }
 968                 goto session_setup_done;
 969         }
 970
 971         result = cli_nt_error(*cli);
 972
 973         if (NT_STATUS_IS_OK(result))
 974                 result = NT_STATUS_UNSUCCESSFUL;
 975
 976         /* We can't session setup */
 977
 978         goto done;
 979
 980  session_setup_done:
 981
 982         /* cache the server name for later connections */
 983
 984         saf_store( domain->name, (*cli)->desthost );
 985         if (domain->alt_name && (*cli)->use_kerberos) {
 986                 saf_store( domain->alt_name, (*cli)->desthost );
 987         }
 988
 989         winbindd_set_locator_kdc_envs(domain);
 990
 991         result = cli_tcon_andx(*cli, "IPC$", "IPC", "", 0);
 992
 993         if (!NT_STATUS_IS_OK(result)) {
 994                 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
 995                 goto done;
 996         }
 997
 998         TALLOC_FREE(mutex);
 999         *retry = False;
1000
1001         /* set the domain if empty; needed for schannel connections */
1002         if ( !(*cli)->domain[0] ) {
1003                 result = cli_set_domain((*cli), domain->name);
1004                 if (!NT_STATUS_IS_OK(result)) {
1005                         return result;
1006                 }
1007         }
1008
1009         result = NT_STATUS_OK;
1010
1011  done:
1012         TALLOC_FREE(mutex);
1013         SAFE_FREE(machine_account);
1014         SAFE_FREE(machine_password);
1015         SAFE_FREE(machine_krb5_principal);
1016         SAFE_FREE(ipc_username);
1017         SAFE_FREE(ipc_domain);
1018         SAFE_FREE(ipc_password);
1019
1020         if (!NT_STATUS_IS_OK(result)) {
1021                 winbind_add_failed_connection_entry(domain, controller, result);
1022                 if ((*cli) != NULL) {
1023                         cli_shutdown(*cli);
1024                         *cli = NULL;
1025                 }
1026         }
1027
1028         return result;
1029 }
1030
1031 /*******************************************************************
1032  Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1033  array.
1034
1035  Keeps the list unique by not adding duplicate entries.
1036
1037  @param[in] mem_ctx talloc memory context to allocate from
1038  @param[in] domain_name domain of the DC
1039  @param[in] dcname name of the DC to add to the list
1040  @param[in] pss Internet address and port pair to add to the list
1041  @param[in,out] dcs array of dc_name_ip structures to add to
1042  @param[in,out] num_dcs number of dcs returned in the dcs array
1043  @return true if the list was added to, false otherwise
1044 *******************************************************************/
1045
1046 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
1047                               const char *dcname, struct sockaddr_storage *pss,
1048                               struct dc_name_ip **dcs, int *num)
1049 {
1050         int i = 0;
1051
1052         if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1053                 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1054                 return False;
1055         }
1056
1057         /* Make sure there's no duplicates in the list */
1058         for (i=0; i<*num; i++)
1059                 if (sockaddr_equal((struct sockaddr *)&(*dcs)[i].ss, (struct sockaddr *)pss))
1060                         return False;
1061
1062         *dcs = TALLOC_REALLOC_ARRAY(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1063
1064         if (*dcs == NULL)
1065                 return False;
1066
1067         fstrcpy((*dcs)[*num].name, dcname);
1068         (*dcs)[*num].ss = *pss;
1069         *num += 1;
1070         return True;
1071 }
1072
1073 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
1074                                   struct sockaddr_storage *pss, uint16 port,
1075                                   struct sockaddr_storage **addrs, int *num)
1076 {
1077         *addrs = TALLOC_REALLOC_ARRAY(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1078
1079         if (*addrs == NULL) {
1080                 *num = 0;
1081                 return False;
1082         }
1083
1084         (*addrs)[*num] = *pss;
1085         set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1086
1087         *num += 1;
1088         return True;
1089 }
1090
1091 /*******************************************************************
1092  convert an ip to a name
1093 *******************************************************************/
1094
1095 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
1096                 const struct winbindd_domain *domain,
1097                 struct sockaddr_storage *pss,
1098                 fstring name )
1099 {
1100         struct ip_service ip_list;
1101         uint32_t nt_version = NETLOGON_NT_VERSION_1;
1102
1103         ip_list.ss = *pss;
1104         ip_list.port = 0;
1105
1106 #ifdef WITH_ADS
1107         /* For active directory servers, try to get the ldap server name.
1108            None of these failures should be considered critical for now */
1109
1110         if (lp_security() == SEC_ADS) {
1111                 ADS_STRUCT *ads;
1112                 ADS_STATUS ads_status;
1113                 char addr[INET6_ADDRSTRLEN];
1114
1115                 print_sockaddr(addr, sizeof(addr), pss);
1116
1117                 ads = ads_init(domain->alt_name, domain->name, addr);
1118                 ads->auth.flags |= ADS_AUTH_NO_BIND;
1119
1120                 ads_status = ads_connect(ads);
1121                 if (ADS_ERR_OK(ads_status)) {
1122                         /* We got a cldap packet. */
1123                         fstrcpy(name, ads->config.ldap_server_name);
1124                         namecache_store(name, 0x20, 1, &ip_list);
1125
1126                         DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1127
1128                         if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1129                                 if (ads_closest_dc(ads)) {
1130                                         char *sitename = sitename_fetch(ads->config.realm);
1131
1132                                         /* We're going to use this KDC for this realm/domain.
1133                                            If we are using sites, then force the krb5 libs
1134                                            to use this KDC. */
1135
1136                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1137                                                                         domain->name,
1138                                                                         sitename,
1139                                                                         pss);
1140
1141                                         SAFE_FREE(sitename);
1142                                 } else {
1143                                         /* use an off site KDC */
1144                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1145                                                                         domain->name,
1146                                                                         NULL,
1147                                                                         pss);
1148                                 }
1149                                 winbindd_set_locator_kdc_envs(domain);
1150
1151                                 /* Ensure we contact this DC also. */
1152                                 saf_store( domain->name, name);
1153                                 saf_store( domain->alt_name, name);
1154                         }
1155
1156                         ads_destroy( &ads );
1157                         return True;
1158                 }
1159
1160                 ads_destroy( &ads );
1161         }
1162 #endif
1163
1164         /* try GETDC requests next */
1165
1166         if (send_getdc_request(mem_ctx, winbind_messaging_context(),
1167                                pss, domain->name, &domain->sid,
1168                                nt_version)) {
1169                 const char *dc_name = NULL;
1170                 int i;
1171                 smb_msleep(100);
1172                 for (i=0; i<5; i++) {
1173                         if (receive_getdc_response(mem_ctx, pss, domain->name,
1174                                                    &nt_version,
1175                                                    &dc_name, NULL)) {
1176                                 fstrcpy(name, dc_name);
1177                                 namecache_store(name, 0x20, 1, &ip_list);
1178                                 return True;
1179                         }
1180                         smb_msleep(500);
1181                 }
1182         }
1183
1184         /* try node status request */
1185
1186         if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
1187                 namecache_store(name, 0x20, 1, &ip_list);
1188                 return True;
1189         }
1190         return False;
1191 }
1192
1193 /*******************************************************************
1194  Retrieve a list of IP addresses for domain controllers.
1195
1196  The array is sorted in the preferred connection order.
1197
1198  @param[in] mem_ctx talloc memory context to allocate from
1199  @param[in] domain domain to retrieve DCs for
1200  @param[out] dcs array of dcs that will be returned
1201  @param[out] num_dcs number of dcs returned in the dcs array
1202  @return always true
1203 *******************************************************************/
1204
1205 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
1206                     struct dc_name_ip **dcs, int *num_dcs)
1207 {
1208         fstring dcname;
1209         struct  sockaddr_storage ss;
1210         struct  ip_service *ip_list = NULL;
1211         int     iplist_size = 0;
1212         int     i;
1213         bool    is_our_domain;
1214         enum security_types sec = (enum security_types)lp_security();
1215
1216         is_our_domain = strequal(domain->name, lp_workgroup());
1217
1218         /* If not our domain, get the preferred DC, by asking our primary DC */
1219         if ( !is_our_domain
1220                 && get_dc_name_via_netlogon(domain, dcname, &ss)
1221                 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1222                        num_dcs) )
1223         {
1224                 char addr[INET6_ADDRSTRLEN];
1225                 print_sockaddr(addr, sizeof(addr), &ss);
1226                 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1227                            dcname, addr));
1228                 return True;
1229         }
1230
1231         if (sec == SEC_ADS) {
1232                 char *sitename = NULL;
1233
1234                 /* We need to make sure we know the local site before
1235                    doing any DNS queries, as this will restrict the
1236                    get_sorted_dc_list() call below to only fetching
1237                    DNS records for the correct site. */
1238
1239                 /* Find any DC to get the site record.
1240                    We deliberately don't care about the
1241                    return here. */
1242
1243                 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1244
1245                 sitename = sitename_fetch(domain->alt_name);
1246                 if (sitename) {
1247
1248                         /* Do the site-specific AD dns lookup first. */
1249                         get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1250                                &iplist_size, True);
1251
1252                         /* Add ips to the DC array.  We don't look up the name
1253                            of the DC in this function, but we fill in the char*
1254                            of the ip now to make the failed connection cache
1255                            work */
1256                         for ( i=0; i<iplist_size; i++ ) {
1257                                 char addr[INET6_ADDRSTRLEN];
1258                                 print_sockaddr(addr, sizeof(addr),
1259                                                 &ip_list[i].ss);
1260                                 add_one_dc_unique(mem_ctx,
1261                                                 domain->name,
1262                                                 addr,
1263                                                 &ip_list[i].ss,
1264                                                 dcs,
1265                                                 num_dcs);
1266                         }
1267
1268                         SAFE_FREE(ip_list);
1269                         SAFE_FREE(sitename);
1270                         iplist_size = 0;
1271                 }
1272
1273                 /* Now we add DCs from the main AD DNS lookup. */
1274                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1275                         &iplist_size, True);
1276
1277                 for ( i=0; i<iplist_size; i++ ) {
1278                         char addr[INET6_ADDRSTRLEN];
1279                         print_sockaddr(addr, sizeof(addr),
1280                                         &ip_list[i].ss);
1281                         add_one_dc_unique(mem_ctx,
1282                                         domain->name,
1283                                         addr,
1284                                         &ip_list[i].ss,
1285                                         dcs,
1286                                         num_dcs);
1287                 }
1288
1289                 SAFE_FREE(ip_list);
1290                 iplist_size = 0;
1291         }
1292
1293         /* Try standard netbios queries if no ADS */
1294         if (*num_dcs == 0) {
1295                 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1296                        False);
1297
1298                 for ( i=0; i<iplist_size; i++ ) {
1299                         char addr[INET6_ADDRSTRLEN];
1300                         print_sockaddr(addr, sizeof(addr),
1301                                         &ip_list[i].ss);
1302                         add_one_dc_unique(mem_ctx,
1303                                         domain->name,
1304                                         addr,
1305                                         &ip_list[i].ss,
1306                                         dcs,
1307                                         num_dcs);
1308                 }
1309
1310                 SAFE_FREE(ip_list);
1311                 iplist_size = 0;
1312         }
1313
1314         return True;
1315 }
1316
1317 /*******************************************************************
1318  Find and make a connection to a DC in the given domain.
1319
1320  @param[in] mem_ctx talloc memory context to allocate from
1321  @param[in] domain domain to find a dc in
1322  @param[out] dcname NetBIOS or FQDN of DC that's connected to
1323  @param[out] pss DC Internet address and port
1324  @param[out] fd fd of the open socket connected to the newly found dc
1325  @return true when a DC connection is made, false otherwise
1326 *******************************************************************/
1327
1328 static bool find_new_dc(TALLOC_CTX *mem_ctx,
1329                         struct winbindd_domain *domain,
1330                         fstring dcname, struct sockaddr_storage *pss, int *fd)
1331 {
1332         struct dc_name_ip *dcs = NULL;
1333         int num_dcs = 0;
1334
1335         const char **dcnames = NULL;
1336         int num_dcnames = 0;
1337
1338         struct sockaddr_storage *addrs = NULL;
1339         int num_addrs = 0;
1340
1341         int i, fd_index;
1342
1343         *fd = -1;
1344
1345  again:
1346         if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1347                 return False;
1348
1349         for (i=0; i<num_dcs; i++) {
1350
1351                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1352                                     &dcnames, &num_dcnames)) {
1353                         return False;
1354                 }
1355                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 445,
1356                                       &addrs, &num_addrs)) {
1357                         return False;
1358                 }
1359
1360                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1361                                     &dcnames, &num_dcnames)) {
1362                         return False;
1363                 }
1364                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 139,
1365                                       &addrs, &num_addrs)) {
1366                         return False;
1367                 }
1368         }
1369
1370         if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1371                 return False;
1372
1373         if ((addrs == NULL) || (dcnames == NULL))
1374                 return False;
1375
1376         /* 5 second timeout. */
1377         if (!open_any_socket_out(addrs, num_addrs, 5000, &fd_index, fd) ) {
1378                 for (i=0; i<num_dcs; i++) {
1379                         char ab[INET6_ADDRSTRLEN];
1380                         print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1381                         DEBUG(10, ("find_new_dc: open_any_socket_out failed for "
1382                                 "domain %s address %s. Error was %s\n",
1383                                 domain->name, ab, strerror(errno) ));
1384                         winbind_add_failed_connection_entry(domain,
1385                                 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1386                 }
1387                 return False;
1388         }
1389
1390         *pss = addrs[fd_index];
1391
1392         if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1393                 /* Ok, we've got a name for the DC */
1394                 fstrcpy(dcname, dcnames[fd_index]);
1395                 return True;
1396         }
1397
1398         /* Try to figure out the name */
1399         if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1400                 return True;
1401         }
1402
1403         /* We can not continue without the DC's name */
1404         winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1405                                     NT_STATUS_UNSUCCESSFUL);
1406
1407         /* Throw away all arrays as we're doing this again. */
1408         TALLOC_FREE(dcs);
1409         num_dcs = 0;
1410
1411         TALLOC_FREE(dcnames);
1412         num_dcnames = 0;
1413
1414         TALLOC_FREE(addrs);
1415         num_addrs = 0;
1416
1417         close(*fd);
1418         *fd = -1;
1419
1420         goto again;
1421 }
1422
1423 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
1424                                    struct winbindd_cm_conn *new_conn)
1425 {
1426         TALLOC_CTX *mem_ctx;
1427         NTSTATUS result;
1428         char *saf_servername = saf_fetch( domain->name );
1429         int retries;
1430
1431         if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1432                 SAFE_FREE(saf_servername);
1433                 set_domain_offline(domain);
1434                 return NT_STATUS_NO_MEMORY;
1435         }
1436
1437         /* we have to check the server affinity cache here since
1438            later we selecte a DC based on response time and not preference */
1439
1440         /* Check the negative connection cache
1441            before talking to it. It going down may have
1442            triggered the reconnection. */
1443
1444         if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1445
1446                 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1447                         saf_servername, domain->name ));
1448
1449                 /* convert an ip address to a name */
1450                 if (is_ipaddress( saf_servername ) ) {
1451                         fstring saf_name;
1452                         struct sockaddr_storage ss;
1453
1454                         if (!interpret_string_addr(&ss, saf_servername,
1455                                                 AI_NUMERICHOST)) {
1456                                 return NT_STATUS_UNSUCCESSFUL;
1457                         }
1458                         if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
1459                                 fstrcpy( domain->dcname, saf_name );
1460                         } else {
1461                                 winbind_add_failed_connection_entry(
1462                                         domain, saf_servername,
1463                                         NT_STATUS_UNSUCCESSFUL);
1464                         }
1465                 } else {
1466                         fstrcpy( domain->dcname, saf_servername );
1467                 }
1468
1469                 SAFE_FREE( saf_servername );
1470         }
1471
1472         for (retries = 0; retries < 3; retries++) {
1473                 int fd = -1;
1474                 bool retry = False;
1475
1476                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1477
1478                 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1479                         domain->dcname, domain->name ));
1480
1481                 if (*domain->dcname
1482                         && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1483                         && (resolve_name(domain->dcname, &domain->dcaddr, 0x20)))
1484                 {
1485                         struct sockaddr_storage *addrs = NULL;
1486                         int num_addrs = 0;
1487                         int dummy = 0;
1488
1489                         if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 445, &addrs, &num_addrs)) {
1490                                 set_domain_offline(domain);
1491                                 talloc_destroy(mem_ctx);
1492                                 return NT_STATUS_NO_MEMORY;
1493                         }
1494                         if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 139, &addrs, &num_addrs)) {
1495                                 set_domain_offline(domain);
1496                                 talloc_destroy(mem_ctx);
1497                                 return NT_STATUS_NO_MEMORY;
1498                         }
1499
1500                         /* 5 second timeout. */
1501                         if (!open_any_socket_out(addrs, num_addrs, 5000, &dummy, &fd)) {
1502                                 fd = -1;
1503                         }
1504                 }
1505
1506                 if ((fd == -1)
1507                         && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
1508                 {
1509                         /* This is the one place where we will
1510                            set the global winbindd offline state
1511                            to true, if a "WINBINDD_OFFLINE" entry
1512                            is found in the winbindd cache. */
1513                         set_global_winbindd_state_offline();
1514                         break;
1515                 }
1516
1517                 new_conn->cli = NULL;
1518
1519                 result = cm_prepare_connection(domain, fd, domain->dcname,
1520                         &new_conn->cli, &retry);
1521
1522                 if (!retry)
1523                         break;
1524         }
1525
1526         if (NT_STATUS_IS_OK(result)) {
1527
1528                 winbindd_set_locator_kdc_envs(domain);
1529
1530                 if (domain->online == False) {
1531                         /* We're changing state from offline to online. */
1532                         set_global_winbindd_state_online();
1533                 }
1534                 set_domain_online(domain);
1535         } else {
1536                 /* Ensure we setup the retry handler. */
1537                 set_domain_offline(domain);
1538         }
1539
1540         talloc_destroy(mem_ctx);
1541         return result;
1542 }
1543
1544 /* Close down all open pipes on a connection. */
1545
1546 void invalidate_cm_connection(struct winbindd_cm_conn *conn)
1547 {
1548         /* We're closing down a possibly dead
1549            connection. Don't have impossibly long (10s) timeouts. */
1550
1551         if (conn->cli) {
1552                 cli_set_timeout(conn->cli, 1000); /* 1 second. */
1553         }
1554
1555         if (conn->samr_pipe != NULL) {
1556                 TALLOC_FREE(conn->samr_pipe);
1557                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1558                 if (conn->cli) {
1559                         cli_set_timeout(conn->cli, 500);
1560                 }
1561         }
1562
1563         if (conn->lsa_pipe != NULL) {
1564                 TALLOC_FREE(conn->lsa_pipe);
1565                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1566                 if (conn->cli) {
1567                         cli_set_timeout(conn->cli, 500);
1568                 }
1569         }
1570
1571         if (conn->lsa_pipe_tcp != NULL) {
1572                 TALLOC_FREE(conn->lsa_pipe_tcp);
1573                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1574                 if (conn->cli) {
1575                         cli_set_timeout(conn->cli, 500);
1576                 }
1577         }
1578
1579         if (conn->netlogon_pipe != NULL) {
1580                 TALLOC_FREE(conn->netlogon_pipe);
1581                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1582                 if (conn->cli) {
1583                         cli_set_timeout(conn->cli, 500);
1584                 }
1585         }
1586
1587         if (conn->cli) {
1588                 cli_shutdown(conn->cli);
1589         }
1590
1591         conn->cli = NULL;
1592 }
1593
1594 void close_conns_after_fork(void)
1595 {
1596         struct winbindd_domain *domain;
1597
1598         for (domain = domain_list(); domain; domain = domain->next) {
1599                 if (domain->conn.cli == NULL)
1600                         continue;
1601
1602                 if (domain->conn.cli->fd == -1)
1603                         continue;
1604
1605                 close(domain->conn.cli->fd);
1606                 domain->conn.cli->fd = -1;
1607         }
1608 }
1609
1610 static bool connection_ok(struct winbindd_domain *domain)
1611 {
1612         bool ok;
1613
1614         ok = cli_state_is_connected(domain->conn.cli);
1615         if (!ok) {
1616                 DEBUG(3, ("connection_ok: Connection to %s for domain %s is not connected\n",
1617                           domain->dcname, domain->name));
1618                 return False;
1619         }
1620
1621         if (domain->online == False) {
1622                 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
1623                 return False;
1624         }
1625
1626         return True;
1627 }
1628
1629 /* Initialize a new connection up to the RPC BIND.
1630    Bypass online status check so always does network calls. */
1631
1632 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
1633 {
1634         NTSTATUS result;
1635
1636         /* Internal connections never use the network. */
1637         if (domain->internal) {
1638                 domain->initialized = True;
1639                 return NT_STATUS_OK;
1640         }
1641
1642         if (!winbindd_can_contact_domain(domain)) {
1643                 invalidate_cm_connection(&domain->conn);
1644                 domain->initialized = True;
1645                 return NT_STATUS_OK;
1646         }
1647
1648         if (connection_ok(domain)) {
1649                 if (!domain->initialized) {
1650                         set_dc_type_and_flags(domain);
1651                 }
1652                 return NT_STATUS_OK;
1653         }
1654
1655         invalidate_cm_connection(&domain->conn);
1656
1657         result = cm_open_connection(domain, &domain->conn);
1658
1659         if (NT_STATUS_IS_OK(result) && !domain->initialized) {
1660                 set_dc_type_and_flags(domain);
1661         }
1662
1663         return result;
1664 }
1665
1666 NTSTATUS init_dc_connection(struct winbindd_domain *domain)
1667 {
1668         if (domain->initialized && !domain->online) {
1669                 /* We check for online status elsewhere. */
1670                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1671         }
1672
1673         return init_dc_connection_network(domain);
1674 }
1675
1676 static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain)
1677 {
1678         NTSTATUS status;
1679
1680         status = init_dc_connection(domain);
1681         if (!NT_STATUS_IS_OK(status)) {
1682                 return status;
1683         }
1684
1685         if (!domain->internal && domain->conn.cli == NULL) {
1686                 /* happens for trusted domains without inbound trust */
1687                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
1688         }
1689
1690         return NT_STATUS_OK;
1691 }
1692
1693 /******************************************************************************
1694  Set the trust flags (direction and forest location) for a domain
1695 ******************************************************************************/
1696
1697 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
1698 {
1699         struct winbindd_domain *our_domain;
1700         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1701         struct netr_DomainTrustList trusts;
1702         int i;
1703         uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
1704                         NETR_TRUST_FLAG_OUTBOUND |
1705                         NETR_TRUST_FLAG_INBOUND);
1706         struct rpc_pipe_client *cli;
1707         TALLOC_CTX *mem_ctx = NULL;
1708
1709         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
1710
1711         /* Our primary domain doesn't need to worry about trust flags.
1712            Force it to go through the network setup */
1713         if ( domain->primary ) {
1714                 return False;
1715         }
1716
1717         our_domain = find_our_domain();
1718
1719         if ( !connection_ok(our_domain) ) {
1720                 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1721                 return False;
1722         }
1723
1724         /* This won't work unless our domain is AD */
1725
1726         if ( !our_domain->active_directory ) {
1727                 return False;
1728         }
1729
1730         /* Use DsEnumerateDomainTrusts to get us the trust direction
1731            and type */
1732
1733         result = cm_connect_netlogon(our_domain, &cli);
1734
1735         if (!NT_STATUS_IS_OK(result)) {
1736                 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1737                           "a connection to %s for PIPE_NETLOGON (%s)\n",
1738                           domain->name, nt_errstr(result)));
1739                 return False;
1740         }
1741
1742         if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
1743                 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1744                 return False;
1745         }
1746
1747         result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1748                                                       cli->desthost,
1749                                                       flags,
1750                                                       &trusts,
1751                                                       NULL);
1752         if (!NT_STATUS_IS_OK(result)) {
1753                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1754                         "failed to query trusted domain list: %s\n",
1755                         nt_errstr(result)));
1756                 talloc_destroy(mem_ctx);
1757                 return false;
1758         }
1759
1760         /* Now find the domain name and get the flags */
1761
1762         for ( i=0; i<trusts.count; i++ ) {
1763                 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
1764                         domain->domain_flags          = trusts.array[i].trust_flags;
1765                         domain->domain_type           = trusts.array[i].trust_type;
1766                         domain->domain_trust_attribs  = trusts.array[i].trust_attributes;
1767
1768                         if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
1769                                 domain->active_directory = True;
1770
1771                         /* This flag is only set if the domain is *our*
1772                            primary domain and the primary domain is in
1773                            native mode */
1774
1775                         domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
1776
1777                         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1778                                   "native mode.\n", domain->name,
1779                                   domain->native_mode ? "" : "NOT "));
1780
1781                         DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1782                                  "running active directory.\n", domain->name,
1783                                  domain->active_directory ? "" : "NOT "));
1784
1785
1786                         domain->initialized = True;
1787
1788                         break;
1789                 }
1790         }
1791
1792         talloc_destroy( mem_ctx );
1793
1794         return domain->initialized;
1795 }
1796
1797 /******************************************************************************
1798  We can 'sense' certain things about the DC by it's replies to certain
1799  questions.
1800
1801  This tells us if this particular remote server is Active Directory, and if it
1802  is native mode.
1803 ******************************************************************************/
1804
1805 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
1806 {
1807         NTSTATUS                result;
1808         WERROR werr;
1809         TALLOC_CTX              *mem_ctx = NULL;
1810         struct rpc_pipe_client  *cli = NULL;
1811         struct policy_handle pol;
1812         union dssetup_DsRoleInfo info;
1813         union lsa_PolicyInformation *lsa_info = NULL;
1814
1815         if (!connection_ok(domain)) {
1816                 return;
1817         }
1818
1819         mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
1820                               domain->name);
1821         if (!mem_ctx) {
1822                 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1823                 return;
1824         }
1825
1826         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
1827
1828         result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1829                                           &ndr_table_dssetup.syntax_id,
1830                                           &cli);
1831
1832         if (!NT_STATUS_IS_OK(result)) {
1833                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1834                           "PI_DSSETUP on domain %s: (%s)\n",
1835                           domain->name, nt_errstr(result)));
1836
1837                 /* if this is just a non-AD domain we need to continue
1838                  * identifying so that we can in the end return with
1839                  * domain->initialized = True - gd */
1840
1841                 goto no_dssetup;
1842         }
1843
1844         result = rpccli_dssetup_DsRoleGetPrimaryDomainInformation(cli, mem_ctx,
1845                                                                   DS_ROLE_BASIC_INFORMATION,
1846                                                                   &info,
1847                                                                   &werr);
1848         TALLOC_FREE(cli);
1849
1850         if (!NT_STATUS_IS_OK(result)) {
1851                 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1852                           "on domain %s failed: (%s)\n",
1853                           domain->name, nt_errstr(result)));
1854
1855                 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1856                  * every opcode on the DSSETUP pipe, continue with
1857                  * no_dssetup mode here as well to get domain->initialized
1858                  * set - gd */
1859
1860                 if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
1861                         goto no_dssetup;
1862                 }
1863
1864                 TALLOC_FREE(mem_ctx);
1865                 return;
1866         }
1867
1868         if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
1869             !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
1870                 domain->native_mode = True;
1871         } else {
1872                 domain->native_mode = False;
1873         }
1874
1875 no_dssetup:
1876         result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1877                                           &ndr_table_lsarpc.syntax_id, &cli);
1878
1879         if (!NT_STATUS_IS_OK(result)) {
1880                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1881                           "PI_LSARPC on domain %s: (%s)\n",
1882                           domain->name, nt_errstr(result)));
1883                 TALLOC_FREE(cli);
1884                 TALLOC_FREE(mem_ctx);
1885                 return;
1886         }
1887
1888         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1889                                          SEC_FLAG_MAXIMUM_ALLOWED, &pol);
1890
1891         if (NT_STATUS_IS_OK(result)) {
1892                 /* This particular query is exactly what Win2k clients use
1893                    to determine that the DC is active directory */
1894                 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
1895                                                      &pol,
1896                                                      LSA_POLICY_INFO_DNS,
1897                                                      &lsa_info);
1898         }
1899
1900         if (NT_STATUS_IS_OK(result)) {
1901                 domain->active_directory = True;
1902
1903                 if (lsa_info->dns.name.string) {
1904                         fstrcpy(domain->name, lsa_info->dns.name.string);
1905                 }
1906
1907                 if (lsa_info->dns.dns_domain.string) {
1908                         fstrcpy(domain->alt_name,
1909                                 lsa_info->dns.dns_domain.string);
1910                 }
1911
1912                 /* See if we can set some domain trust flags about
1913                    ourself */
1914
1915                 if (lsa_info->dns.dns_forest.string) {
1916                         fstrcpy(domain->forest_name,
1917                                 lsa_info->dns.dns_forest.string);
1918
1919                         if (strequal(domain->forest_name, domain->alt_name)) {
1920                                 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
1921                         }
1922                 }
1923
1924                 if (lsa_info->dns.sid) {
1925                         sid_copy(&domain->sid, lsa_info->dns.sid);
1926                 }
1927         } else {
1928                 domain->active_directory = False;
1929
1930                 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
1931                                                 SEC_FLAG_MAXIMUM_ALLOWED,
1932                                                 &pol);
1933
1934                 if (!NT_STATUS_IS_OK(result)) {
1935                         goto done;
1936                 }
1937
1938                 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
1939                                                     &pol,
1940                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1941                                                     &lsa_info);
1942
1943                 if (NT_STATUS_IS_OK(result)) {
1944
1945                         if (lsa_info->account_domain.name.string) {
1946                                 fstrcpy(domain->name,
1947                                         lsa_info->account_domain.name.string);
1948                         }
1949
1950                         if (lsa_info->account_domain.sid) {
1951                                 sid_copy(&domain->sid, lsa_info->account_domain.sid);
1952                         }
1953                 }
1954         }
1955 done:
1956
1957         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
1958                   domain->name, domain->native_mode ? "" : "NOT "));
1959
1960         DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
1961                   domain->name, domain->active_directory ? "" : "NOT "));
1962
1963         domain->can_do_ncacn_ip_tcp = domain->active_directory;
1964
1965         TALLOC_FREE(cli);
1966
1967         TALLOC_FREE(mem_ctx);
1968
1969         domain->initialized = True;
1970 }
1971
1972 /**********************************************************************
1973  Set the domain_flags (trust attributes, domain operating modes, etc...
1974 ***********************************************************************/
1975
1976 static void set_dc_type_and_flags( struct winbindd_domain *domain )
1977 {
1978         /* we always have to contact our primary domain */
1979
1980         if ( domain->primary ) {
1981                 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
1982                           "primary domain\n"));
1983                 set_dc_type_and_flags_connect( domain );
1984                 return;
1985         }
1986
1987         /* Use our DC to get the information if possible */
1988
1989         if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
1990                 /* Otherwise, fallback to contacting the
1991                    domain directly */
1992                 set_dc_type_and_flags_connect( domain );
1993         }
1994
1995         return;
1996 }
1997
1998
1999
2000 /**********************************************************************
2001 ***********************************************************************/
2002
2003 static bool cm_get_schannel_dcinfo(struct winbindd_domain *domain,
2004                                    struct dcinfo **ppdc)
2005 {
2006         NTSTATUS result;
2007         struct rpc_pipe_client *netlogon_pipe;
2008
2009         if (lp_client_schannel() == False) {
2010                 return False;
2011         }
2012
2013         result = cm_connect_netlogon(domain, &netlogon_pipe);
2014         if (!NT_STATUS_IS_OK(result)) {
2015                 return False;
2016         }
2017
2018         /* Return a pointer to the struct dcinfo from the
2019            netlogon pipe. */
2020
2021         if (!domain->conn.netlogon_pipe->dc) {
2022                 return false;
2023         }
2024
2025         *ppdc = domain->conn.netlogon_pipe->dc;
2026         return True;
2027 }
2028
2029 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2030                         struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2031 {
2032         struct winbindd_cm_conn *conn;
2033         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2034         struct dcinfo *p_dcinfo;
2035         char *machine_password = NULL;
2036         char *machine_account = NULL;
2037         char *domain_name = NULL;
2038
2039         result = init_dc_connection_rpc(domain);
2040         if (!NT_STATUS_IS_OK(result)) {
2041                 return result;
2042         }
2043
2044         conn = &domain->conn;
2045
2046         if (rpccli_is_connected(conn->samr_pipe)) {
2047                 goto done;
2048         }
2049
2050         TALLOC_FREE(conn->samr_pipe);
2051
2052         /*
2053          * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2054          * sign and sealed pipe using the machine account password by
2055          * preference. If we can't - try schannel, if that fails, try
2056          * anonymous.
2057          */
2058
2059         if ((conn->cli->user_name[0] == '\0') ||
2060             (conn->cli->domain[0] == '\0') ||
2061             (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
2062         {
2063                 result = get_trust_creds(domain, &machine_password,
2064                                          &machine_account, NULL);
2065                 if (!NT_STATUS_IS_OK(result)) {
2066                         DEBUG(10, ("cm_connect_sam: No no user available for "
2067                                    "domain %s, trying schannel\n", conn->cli->domain));
2068                         goto schannel;
2069                 }
2070                 domain_name = domain->name;
2071         } else {
2072                 machine_password = SMB_STRDUP(conn->cli->password);
2073                 machine_account = SMB_STRDUP(conn->cli->user_name);
2074                 domain_name = conn->cli->domain;
2075         }
2076
2077         if (!machine_password || !machine_account) {
2078                 result = NT_STATUS_NO_MEMORY;
2079                 goto done;
2080         }
2081
2082         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2083            authenticated SAMR pipe with sign & seal. */
2084         result = cli_rpc_pipe_open_spnego_ntlmssp(conn->cli,
2085                                                   &ndr_table_samr.syntax_id,
2086                                                   NCACN_NP,
2087                                                   PIPE_AUTH_LEVEL_PRIVACY,
2088                                                   domain_name,
2089                                                   machine_account,
2090                                                   machine_password,
2091                                                   &conn->samr_pipe);
2092
2093         if (!NT_STATUS_IS_OK(result)) {
2094                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2095                           "pipe for domain %s using NTLMSSP "
2096                           "authenticated pipe: user %s\\%s. Error was "
2097                           "%s\n", domain->name, domain_name,
2098                           machine_account, nt_errstr(result)));
2099                 goto schannel;
2100         }
2101
2102         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2103                   "domain %s using NTLMSSP authenticated "
2104                   "pipe: user %s\\%s\n", domain->name,
2105                   domain_name, machine_account));
2106
2107         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2108                                       conn->samr_pipe->desthost,
2109                                       SEC_FLAG_MAXIMUM_ALLOWED,
2110                                       &conn->sam_connect_handle);
2111         if (NT_STATUS_IS_OK(result)) {
2112                 goto open_domain;
2113         }
2114         DEBUG(10,("cm_connect_sam: ntlmssp-sealed rpccli_samr_Connect2 "
2115                   "failed for domain %s, error was %s. Trying schannel\n",
2116                   domain->name, nt_errstr(result) ));
2117         TALLOC_FREE(conn->samr_pipe);
2118
2119  schannel:
2120
2121         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2122
2123         if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
2124                 /* If this call fails - conn->cli can now be NULL ! */
2125                 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2126                            "for domain %s, trying anon\n", domain->name));
2127                 goto anonymous;
2128         }
2129         result = cli_rpc_pipe_open_schannel_with_key
2130                 (conn->cli, &ndr_table_samr.syntax_id, NCACN_NP,
2131                 PIPE_AUTH_LEVEL_PRIVACY,
2132                  domain->name, p_dcinfo, &conn->samr_pipe);
2133
2134         if (!NT_STATUS_IS_OK(result)) {
2135                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2136                           "domain %s using schannel. Error was %s\n",
2137                           domain->name, nt_errstr(result) ));
2138                 goto anonymous;
2139         }
2140         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2141                   "schannel.\n", domain->name ));
2142
2143         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2144                                       conn->samr_pipe->desthost,
2145                                       SEC_FLAG_MAXIMUM_ALLOWED,
2146                                       &conn->sam_connect_handle);
2147         if (NT_STATUS_IS_OK(result)) {
2148                 goto open_domain;
2149         }
2150         DEBUG(10,("cm_connect_sam: schannel-sealed rpccli_samr_Connect2 failed "
2151                   "for domain %s, error was %s. Trying anonymous\n",
2152                   domain->name, nt_errstr(result) ));
2153         TALLOC_FREE(conn->samr_pipe);
2154
2155  anonymous:
2156
2157         /* Finally fall back to anonymous. */
2158         result = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
2159                                           &conn->samr_pipe);
2160
2161         if (!NT_STATUS_IS_OK(result)) {
2162                 goto done;
2163         }
2164
2165         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2166                                       conn->samr_pipe->desthost,
2167                                       SEC_FLAG_MAXIMUM_ALLOWED,
2168                                       &conn->sam_connect_handle);
2169         if (!NT_STATUS_IS_OK(result)) {
2170                 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2171                           "for domain %s Error was %s\n",
2172                           domain->name, nt_errstr(result) ));
2173                 goto done;
2174         }
2175
2176  open_domain:
2177         result = rpccli_samr_OpenDomain(conn->samr_pipe,
2178                                         mem_ctx,
2179                                         &conn->sam_connect_handle,
2180                                         SEC_FLAG_MAXIMUM_ALLOWED,
2181                                         &domain->sid,
2182                                         &conn->sam_domain_handle);
2183
2184  done:
2185
2186         if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
2187                 /*
2188                  * if we got access denied, we might just have no access rights
2189                  * to talk to the remote samr server server (e.g. when we are a
2190                  * PDC and we are connecting a w2k8 pdc via an interdomain
2191                  * trust). In that case do not invalidate the whole connection
2192                  * stack
2193                  */
2194                 TALLOC_FREE(conn->samr_pipe);
2195                 ZERO_STRUCT(conn->sam_domain_handle);
2196                 return result;
2197         } else if (!NT_STATUS_IS_OK(result)) {
2198                 invalidate_cm_connection(conn);
2199                 return result;
2200         }
2201
2202         *cli = conn->samr_pipe;
2203         *sam_handle = conn->sam_domain_handle;
2204         SAFE_FREE(machine_password);
2205         SAFE_FREE(machine_account);
2206         return result;
2207 }
2208
2209 /**********************************************************************
2210  open an schanneld ncacn_ip_tcp connection to LSA
2211 ***********************************************************************/
2212
2213 NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
2214                             TALLOC_CTX *mem_ctx,
2215                             struct rpc_pipe_client **cli)
2216 {
2217         struct winbindd_cm_conn *conn;
2218         NTSTATUS status;
2219
2220         DEBUG(10,("cm_connect_lsa_tcp\n"));
2221
2222         status = init_dc_connection_rpc(domain);
2223         if (!NT_STATUS_IS_OK(status)) {
2224                 return status;
2225         }
2226
2227         conn = &domain->conn;
2228
2229         if (conn->lsa_pipe_tcp &&
2230             conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2231             conn->lsa_pipe_tcp->auth->auth_level == PIPE_AUTH_LEVEL_PRIVACY &&
2232             rpccli_is_connected(conn->lsa_pipe_tcp)) {
2233                 goto done;
2234         }
2235
2236         TALLOC_FREE(conn->lsa_pipe_tcp);
2237
2238         status = cli_rpc_pipe_open_schannel(conn->cli,
2239                                             &ndr_table_lsarpc.syntax_id,
2240                                             NCACN_IP_TCP,
2241                                             PIPE_AUTH_LEVEL_PRIVACY,
2242                                             domain->name,
2243                                             &conn->lsa_pipe_tcp);
2244         if (!NT_STATUS_IS_OK(status)) {
2245                 DEBUG(10,("cli_rpc_pipe_open_schannel failed: %s\n",
2246                         nt_errstr(status)));
2247                 goto done;
2248         }
2249
2250  done:
2251         if (!NT_STATUS_IS_OK(status)) {
2252                 TALLOC_FREE(conn->lsa_pipe_tcp);
2253                 return status;
2254         }
2255
2256         *cli = conn->lsa_pipe_tcp;
2257
2258         return status;
2259 }
2260
2261 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2262                         struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2263 {
2264         struct winbindd_cm_conn *conn;
2265         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2266         struct dcinfo *p_dcinfo;
2267
2268         result = init_dc_connection_rpc(domain);
2269         if (!NT_STATUS_IS_OK(result))
2270                 return result;
2271
2272         conn = &domain->conn;
2273
2274         if (rpccli_is_connected(conn->lsa_pipe)) {
2275                 goto done;
2276         }
2277
2278         TALLOC_FREE(conn->lsa_pipe);
2279
2280         if ((conn->cli->user_name[0] == '\0') ||
2281             (conn->cli->domain[0] == '\0') ||
2282             (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
2283                 DEBUG(10, ("cm_connect_lsa: No no user available for "
2284                            "domain %s, trying schannel\n", conn->cli->domain));
2285                 goto schannel;
2286         }
2287
2288         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2289          * authenticated LSA pipe with sign & seal. */
2290         result = cli_rpc_pipe_open_spnego_ntlmssp
2291                 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2292                  PIPE_AUTH_LEVEL_PRIVACY,
2293                  conn->cli->domain, conn->cli->user_name, conn->cli->password,
2294                  &conn->lsa_pipe);
2295
2296         if (!NT_STATUS_IS_OK(result)) {
2297                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2298                           "domain %s using NTLMSSP authenticated pipe: user "
2299                           "%s\\%s. Error was %s. Trying schannel.\n",
2300                           domain->name, conn->cli->domain,
2301                           conn->cli->user_name, nt_errstr(result)));
2302                 goto schannel;
2303         }
2304
2305         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2306                   "NTLMSSP authenticated pipe: user %s\\%s\n",
2307                   domain->name, conn->cli->domain, conn->cli->user_name ));
2308
2309         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2310                                         SEC_FLAG_MAXIMUM_ALLOWED,
2311                                         &conn->lsa_policy);
2312         if (NT_STATUS_IS_OK(result)) {
2313                 goto done;
2314         }
2315
2316         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2317                   "schannel\n"));
2318
2319         TALLOC_FREE(conn->lsa_pipe);
2320
2321  schannel:
2322
2323         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2324
2325         if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
2326                 /* If this call fails - conn->cli can now be NULL ! */
2327                 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2328                            "for domain %s, trying anon\n", domain->name));
2329                 goto anonymous;
2330         }
2331         result = cli_rpc_pipe_open_schannel_with_key
2332                 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2333                  PIPE_AUTH_LEVEL_PRIVACY,
2334                  domain->name, p_dcinfo, &conn->lsa_pipe);
2335
2336         if (!NT_STATUS_IS_OK(result)) {
2337                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2338                           "domain %s using schannel. Error was %s\n",
2339                           domain->name, nt_errstr(result) ));
2340                 goto anonymous;
2341         }
2342         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2343                   "schannel.\n", domain->name ));
2344
2345         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2346                                         SEC_FLAG_MAXIMUM_ALLOWED,
2347                                         &conn->lsa_policy);
2348         if (NT_STATUS_IS_OK(result)) {
2349                 goto done;
2350         }
2351
2352         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2353                   "anonymous\n"));
2354
2355         TALLOC_FREE(conn->lsa_pipe);
2356
2357  anonymous:
2358
2359         result = cli_rpc_pipe_open_noauth(conn->cli,
2360                                           &ndr_table_lsarpc.syntax_id,
2361                                           &conn->lsa_pipe);
2362         if (!NT_STATUS_IS_OK(result)) {
2363                 result = NT_STATUS_PIPE_NOT_AVAILABLE;
2364                 goto done;
2365         }
2366
2367         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2368                                         SEC_FLAG_MAXIMUM_ALLOWED,
2369                                         &conn->lsa_policy);
2370  done:
2371         if (!NT_STATUS_IS_OK(result)) {
2372                 invalidate_cm_connection(conn);
2373                 return result;
2374         }
2375
2376         *cli = conn->lsa_pipe;
2377         *lsa_policy = conn->lsa_policy;
2378         return result;
2379 }
2380
2381 /****************************************************************************
2382  Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2383  session key stored in conn->netlogon_pipe->dc->sess_key.
2384 ****************************************************************************/
2385
2386 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
2387                              struct rpc_pipe_client **cli)
2388 {
2389         struct winbindd_cm_conn *conn;
2390         NTSTATUS result;
2391
2392         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
2393         uint8  mach_pwd[16];
2394         uint32  sec_chan_type;
2395         const char *account_name;
2396         struct rpc_pipe_client *netlogon_pipe = NULL;
2397
2398         *cli = NULL;
2399
2400         result = init_dc_connection_rpc(domain);
2401         if (!NT_STATUS_IS_OK(result)) {
2402                 return result;
2403         }
2404
2405         conn = &domain->conn;
2406
2407         if (rpccli_is_connected(conn->netlogon_pipe)) {
2408                 *cli = conn->netlogon_pipe;
2409                 return NT_STATUS_OK;
2410         }
2411
2412         TALLOC_FREE(conn->netlogon_pipe);
2413
2414         result = cli_rpc_pipe_open_noauth(conn->cli,
2415                                           &ndr_table_netlogon.syntax_id,
2416                                           &netlogon_pipe);
2417         if (!NT_STATUS_IS_OK(result)) {
2418                 return result;
2419         }
2420
2421         if ((!IS_DC) && (!domain->primary)) {
2422                 /* Clear the schannel request bit and drop down */
2423                 neg_flags &= ~NETLOGON_NEG_SCHANNEL;
2424                 goto no_schannel;
2425         }
2426
2427         if (lp_client_schannel() != False) {
2428                 neg_flags |= NETLOGON_NEG_SCHANNEL;
2429         }
2430
2431         if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
2432                                &sec_chan_type))
2433         {
2434                 TALLOC_FREE(netlogon_pipe);
2435                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2436         }
2437
2438         result = rpccli_netlogon_setup_creds(
2439                  netlogon_pipe,
2440                  domain->dcname, /* server name. */
2441                  domain->name,   /* domain name */
2442                  global_myname(), /* client name */
2443                  account_name,   /* machine account */
2444                  mach_pwd,       /* machine password */
2445                  sec_chan_type,  /* from get_trust_pw */
2446                  &neg_flags);
2447
2448         if (!NT_STATUS_IS_OK(result)) {
2449                 TALLOC_FREE(netlogon_pipe);
2450                 return result;
2451         }
2452
2453         if ((lp_client_schannel() == True) &&
2454                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2455                 DEBUG(3, ("Server did not offer schannel\n"));
2456                 TALLOC_FREE(netlogon_pipe);
2457                 return NT_STATUS_ACCESS_DENIED;
2458         }
2459
2460  no_schannel:
2461         if ((lp_client_schannel() == False) ||
2462                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2463                 /*
2464                  * NetSamLogonEx only works for schannel
2465                  */
2466                 domain->can_do_samlogon_ex = False;
2467
2468                 /* We're done - just keep the existing connection to NETLOGON
2469                  * open */
2470                 conn->netlogon_pipe = netlogon_pipe;
2471                 *cli = conn->netlogon_pipe;
2472                 return NT_STATUS_OK;
2473         }
2474
2475         /* Using the credentials from the first pipe, open a signed and sealed
2476            second netlogon pipe. The session key is stored in the schannel
2477            part of the new pipe auth struct.
2478         */
2479
2480         result = cli_rpc_pipe_open_schannel_with_key(
2481                 conn->cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
2482                 PIPE_AUTH_LEVEL_PRIVACY, domain->name, netlogon_pipe->dc,
2483                 &conn->netlogon_pipe);
2484
2485         /* We can now close the initial netlogon pipe. */
2486         TALLOC_FREE(netlogon_pipe);
2487
2488         if (!NT_STATUS_IS_OK(result)) {
2489                 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2490                           "was %s\n", nt_errstr(result)));
2491
2492                 invalidate_cm_connection(conn);
2493                 return result;
2494         }
2495
2496         /*
2497          * Try NetSamLogonEx for AD domains
2498          */
2499         domain->can_do_samlogon_ex = domain->active_directory;
2500
2501         *cli = conn->netlogon_pipe;
2502         return NT_STATUS_OK;
2503 }