source3/libads/cldap.c

   1 /*
   2    Samba Unix/Linux SMB client library
   3    net ads cldap functions
   4    Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
   5    Copyright (C) 2003 Jim McDonough (jmcd@us.ibm.com)
   6    Copyright (C) 2008 Guenther Deschner (gd@samba.org)
   7    Copyright (C) 2009 Stefan Metzmacher (metze@samba.org)
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "../libcli/cldap/cldap.h"
  25 #include "../lib/tsocket/tsocket.h"
  26 #include "../lib/util/tevent_ntstatus.h"
  27 #include "libads/cldap.h"
  28
  29 struct cldap_multi_netlogon_state {
  30         struct tevent_context *ev;
  31         const struct tsocket_address * const *servers;
  32         int num_servers;
  33         const char *domain;
  34         const char *hostname;
  35         unsigned ntversion;
  36         int min_servers;
  37
  38         struct cldap_socket **cldap;
  39         struct tevent_req **subreqs;
  40         int num_sent;
  41         int num_received;
  42         int num_good_received;
  43         struct cldap_netlogon *ios;
  44         struct netlogon_samlogon_response **responses;
  45 };
  46
  47 static void cldap_multi_netlogon_done(struct tevent_req *subreq);
  48 static void cldap_multi_netlogon_next(struct tevent_req *subreq);
  49
  50 /*
  51  * Do a parallel cldap ping to the servers. The first "min_servers"
  52  * are fired directly, the remaining ones in 100msec intervals. If
  53  * "min_servers" responses came in successfully, we immediately reply,
  54  * not waiting for the remaining ones.
  55  */
  56
  57 struct tevent_req *cldap_multi_netlogon_send(
  58         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
  59         const struct tsocket_address * const *servers, int num_servers,
  60         const char *domain, const char *hostname, unsigned ntversion,
  61         int min_servers)
  62 {
  63         struct tevent_req *req, *subreq;
  64         struct cldap_multi_netlogon_state *state;
  65         int i;
  66
  67         req = tevent_req_create(mem_ctx, &state,
  68                                 struct cldap_multi_netlogon_state);
  69         if (req == NULL) {
  70                 return NULL;
  71         }
  72         state->ev = ev;
  73         state->servers = servers;
  74         state->num_servers = num_servers;
  75         state->domain = domain;
  76         state->hostname = hostname;
  77         state->ntversion = ntversion;
  78         state->min_servers = min_servers;
  79
  80         if (min_servers > num_servers) {
  81                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
  82                 return tevent_req_post(req, ev);
  83         }
  84
  85         state->subreqs = talloc_zero_array(state,
  86                                            struct tevent_req *,
  87                                            num_servers);
  88         if (tevent_req_nomem(state->subreqs, req)) {
  89                 return tevent_req_post(req, ev);
  90         }
  91
  92         state->cldap = talloc_zero_array(state,
  93                                          struct cldap_socket *,
  94                                          num_servers);
  95         if (tevent_req_nomem(state->cldap, req)) {
  96                 return tevent_req_post(req, ev);
  97         }
  98
  99         state->responses = talloc_zero_array(state,
 100                                 struct netlogon_samlogon_response *,
 101                                 num_servers);
 102         if (tevent_req_nomem(state->responses, req)) {
 103                 return tevent_req_post(req, ev);
 104         }
 105
 106         state->ios = talloc_zero_array(state->responses,
 107                                        struct cldap_netlogon,
 108                                        num_servers);
 109         if (tevent_req_nomem(state->ios, req)) {
 110                 return tevent_req_post(req, ev);
 111         }
 112
 113         for (i=0; i<num_servers; i++) {
 114                 NTSTATUS status;
 115
 116                 status = cldap_socket_init(state->cldap,
 117                                            NULL, /* local_addr */
 118                                            state->servers[i],
 119                                            &state->cldap[i]);
 120                 if (!NT_STATUS_IS_OK(status)) {
 121                         /*
 122                          * Don't error out all sends just
 123                          * because one cldap_socket_init() failed.
 124                          * Log it here, and the cldap_netlogon_send()
 125                          * will catch it (with in.dest_address == NULL)
 126                          * and correctly error out in
 127                          * cldap_multi_netlogon_done(). This still allows
 128                          * the other requests to be concurrently sent.
 129                          */
 130                         DBG_NOTICE("cldap_socket_init failed for %s "
 131                                 " error %s\n",
 132                                 tsocket_address_string(state->servers[i],
 133                                         req),
 134                                 nt_errstr(status));
 135                 }
 136
 137                 state->ios[i].in.dest_address   = NULL;
 138                 state->ios[i].in.dest_port      = 0;
 139                 state->ios[i].in.realm          = domain;
 140                 state->ios[i].in.host           = NULL;
 141                 state->ios[i].in.user           = NULL;
 142                 state->ios[i].in.domain_guid    = NULL;
 143                 state->ios[i].in.domain_sid     = NULL;
 144                 state->ios[i].in.acct_control   = 0;
 145                 state->ios[i].in.version        = ntversion;
 146                 state->ios[i].in.map_response   = false;
 147         }
 148
 149         for (i=0; i<min_servers; i++) {
 150                 state->subreqs[i] = cldap_netlogon_send(state->subreqs,
 151                                                         state->ev,
 152                                                         state->cldap[i],
 153                                                         &state->ios[i]);
 154                 if (tevent_req_nomem(state->subreqs[i], req)) {
 155                         return tevent_req_post(req, ev);
 156                 }
 157                 tevent_req_set_callback(
 158                         state->subreqs[i], cldap_multi_netlogon_done, req);
 159         }
 160         state->num_sent = min_servers;
 161
 162         if (state->num_sent < state->num_servers) {
 163                 /*
 164                  * After 100 milliseconds fire the next one
 165                  */
 166                 subreq = tevent_wakeup_send(state, state->ev,
 167                                             timeval_current_ofs(0, 100000));
 168                 if (tevent_req_nomem(subreq, req)) {
 169                         return tevent_req_post(req, ev);
 170                 }
 171                 tevent_req_set_callback(subreq, cldap_multi_netlogon_next,
 172                                         req);
 173         }
 174
 175         return req;
 176 }
 177
 178 static void cldap_multi_netlogon_done(struct tevent_req *subreq)
 179 {
 180         struct tevent_req *req = tevent_req_callback_data(
 181                 subreq, struct tevent_req);
 182         struct cldap_multi_netlogon_state *state = tevent_req_data(
 183                 req, struct cldap_multi_netlogon_state);
 184         NTSTATUS status;
 185         struct netlogon_samlogon_response *response;
 186         int i;
 187
 188         for (i=0; i<state->num_sent; i++) {
 189                 if (state->subreqs[i] == subreq) {
 190                         break;
 191                 }
 192         }
 193         if (i == state->num_sent) {
 194                 /*
 195                  * Got a response we did not fire...
 196                  */
 197                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 198                 return;
 199         }
 200         state->subreqs[i] = NULL;
 201
 202         response = talloc_zero(state, struct netlogon_samlogon_response);
 203         if (tevent_req_nomem(response, req)) {
 204                 return;
 205         }
 206
 207         status = cldap_netlogon_recv(subreq, response,
 208                                      &state->ios[i]);
 209         TALLOC_FREE(subreq);
 210         state->num_received += 1;
 211
 212         if (NT_STATUS_IS_OK(status)) {
 213                 *response = state->ios[i].out.netlogon;
 214                 state->responses[i] = talloc_move(state->responses,
 215                                                   &response);
 216                 state->num_good_received += 1;
 217         }
 218
 219         if ((state->num_received == state->num_servers) ||
 220             (state->num_good_received >= state->min_servers)) {
 221                 tevent_req_done(req);
 222                 return;
 223         }
 224 }
 225
 226 static void cldap_multi_netlogon_next(struct tevent_req *subreq)
 227 {
 228         struct tevent_req *req = tevent_req_callback_data(
 229                 subreq, struct tevent_req);
 230         struct cldap_multi_netlogon_state *state = tevent_req_data(
 231                 req, struct cldap_multi_netlogon_state);
 232         bool ret;
 233
 234         ret = tevent_wakeup_recv(subreq);
 235         TALLOC_FREE(subreq);
 236         if (!ret) {
 237                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 238                 return;
 239         }
 240
 241         subreq = cldap_netlogon_send(state->subreqs,
 242                                      state->ev,
 243                                      state->cldap[state->num_sent],
 244                                      &state->ios[state->num_sent]);
 245         if (tevent_req_nomem(subreq, req)) {
 246                 return;
 247         }
 248         tevent_req_set_callback(subreq, cldap_multi_netlogon_done, req);
 249         state->subreqs[state->num_sent] = subreq;
 250         state->num_sent += 1;
 251
 252         if (state->num_sent < state->num_servers) {
 253                 /*
 254                  * After 100 milliseconds fire the next one
 255                  */
 256                 subreq = tevent_wakeup_send(state, state->ev,
 257                                             timeval_current_ofs(0, 100000));
 258                 if (tevent_req_nomem(subreq, req)) {
 259                         return;
 260                 }
 261                 tevent_req_set_callback(subreq, cldap_multi_netlogon_next,
 262                                         req);
 263         }
 264 }
 265
 266 NTSTATUS cldap_multi_netlogon_recv(
 267         struct tevent_req *req, TALLOC_CTX *mem_ctx,
 268         struct netlogon_samlogon_response ***responses)
 269 {
 270         struct cldap_multi_netlogon_state *state = tevent_req_data(
 271                 req, struct cldap_multi_netlogon_state);
 272         NTSTATUS status;
 273
 274         if (tevent_req_is_nterror(req, &status) &&
 275             !NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) {
 276                 return status;
 277         }
 278         /*
 279          * If we timeout, give back what we have so far
 280          */
 281         *responses = talloc_move(mem_ctx, &state->responses);
 282         return NT_STATUS_OK;
 283 }
 284
 285 NTSTATUS cldap_multi_netlogon(
 286         TALLOC_CTX *mem_ctx,
 287         const struct tsocket_address * const *servers,
 288         int num_servers,
 289         const char *domain, const char *hostname, unsigned ntversion,
 290         int min_servers, struct timeval timeout,
 291         struct netlogon_samlogon_response ***responses)
 292 {
 293         struct tevent_context *ev;
 294         struct tevent_req *req;
 295         NTSTATUS status = NT_STATUS_NO_MEMORY;
 296
 297         ev = samba_tevent_context_init(talloc_tos());
 298         if (ev == NULL) {
 299                 goto fail;
 300         }
 301         req = cldap_multi_netlogon_send(
 302                 ev, ev, servers, num_servers, domain, hostname, ntversion,
 303                 min_servers);
 304         if (req == NULL) {
 305                 goto fail;
 306         }
 307         if (!tevent_req_set_endtime(req, ev, timeout)) {
 308                 goto fail;
 309         }
 310         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 311                 goto fail;
 312         }
 313         status = cldap_multi_netlogon_recv(req, mem_ctx, responses);
 314 fail:
 315         TALLOC_FREE(ev);
 316         return status;
 317 }
 318
 319 /*******************************************************************
 320   do a cldap netlogon query.  Always 389/udp
 321 *******************************************************************/
 322
 323 bool ads_cldap_netlogon(TALLOC_CTX *mem_ctx,
 324                         struct sockaddr_storage *ss,
 325                         const char *realm,
 326                         uint32_t nt_version,
 327                         struct netlogon_samlogon_response **_reply)
 328 {
 329         NTSTATUS status;
 330         char addrstr[INET6_ADDRSTRLEN];
 331         const char *dest_str;
 332         struct tsocket_address *dest_addr;
 333         const struct tsocket_address * const *dest_addrs;
 334         struct netlogon_samlogon_response **responses = NULL;
 335         int ret;
 336
 337         dest_str = print_sockaddr(addrstr, sizeof(addrstr), ss);
 338
 339         ret = tsocket_address_inet_from_strings(mem_ctx, "ip",
 340                                                 dest_str, LDAP_PORT,
 341                                                 &dest_addr);
 342         if (ret != 0) {
 343                 status = map_nt_error_from_unix(errno);
 344                 DEBUG(2,("Failed to create cldap tsocket_address for %s - %s\n",
 345                          dest_str, nt_errstr(status)));
 346                 return false;
 347         }
 348
 349         dest_addrs = (const struct tsocket_address * const *)&dest_addr;
 350
 351         status = cldap_multi_netlogon(talloc_tos(),
 352                                 dest_addrs, 1,
 353                                 realm, NULL,
 354                                 nt_version, 1,
 355                                 timeval_current_ofs(MAX(3,lp_ldap_timeout()/2), 0),
 356                                 &responses);
 357         if (!NT_STATUS_IS_OK(status)) {
 358                 DEBUG(2, ("ads_cldap_netlogon: cldap_multi_netlogon "
 359                           "failed: %s\n", nt_errstr(status)));
 360                 return false;
 361         }
 362         if (responses[0] == NULL) {
 363                 DEBUG(2, ("ads_cldap_netlogon: did not get a reply\n"));
 364                 TALLOC_FREE(responses);
 365                 return false;
 366         }
 367         *_reply = talloc_move(mem_ctx, &responses[0]);
 368
 369         return true;
 370 }
 371
 372 /*******************************************************************
 373   do a cldap netlogon query.  Always 389/udp
 374 *******************************************************************/
 375
 376 bool ads_cldap_netlogon_5(TALLOC_CTX *mem_ctx,
 377                           struct sockaddr_storage *ss,
 378                           const char *realm,
 379                           struct NETLOGON_SAM_LOGON_RESPONSE_EX *reply5)
 380 {
 381         uint32_t nt_version = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX;
 382         struct netlogon_samlogon_response *reply = NULL;
 383         bool ret;
 384
 385         ret = ads_cldap_netlogon(mem_ctx, ss, realm, nt_version, &reply);
 386         if (!ret) {
 387                 return false;
 388         }
 389
 390         if (reply->ntver != NETLOGON_NT_VERSION_5EX) {
 391                 DEBUG(0,("ads_cldap_netlogon_5: nt_version mismatch: 0x%08x\n",
 392                         reply->ntver));
 393                 return false;
 394         }
 395
 396         *reply5 = reply->data.nt5_ex;
 397
 398         return true;
 399 }