2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2011 Sumit Bose (sbose@redhat.com)
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>. */
21 #include "utils/net.h"
22 #include "rpc_client/cli_pipe.h"
23 #include "rpc_client/cli_lsarpc.h"
24 #include "librpc/gen_ndr/ndr_drsblobs.h"
25 #include "../librpc/gen_ndr/ndr_lsa_c.h"
26 #include "../lib/crypto/crypto.h"
27 #include "../libcli/security/dom_sid.h"
28 #include "libsmb/libsmb.h"
31 #define ARG_OTHERSERVER "otherserver="
32 #define ARG_OTHERUSER "otheruser="
33 #define ARG_OTHERDOMAINSID "otherdomainsid="
34 #define ARG_OTHERDOMAIN "otherdomain="
35 #define ARG_OTHERNETBIOSDOMAIN "other_netbios_domain="
36 #define ARG_TRUSTPW "trustpw="
43 struct other_dom_data
{
47 char *dns_domain_name
;
52 struct dom_sid
*domsid
;
53 char *dns_domain_name
;
57 static NTSTATUS
close_handle(TALLOC_CTX
*mem_ctx
,
58 struct dcerpc_binding_handle
*bind_hnd
,
59 struct policy_handle
*pol_hnd
)
64 status
= dcerpc_lsa_Close(bind_hnd
, mem_ctx
, pol_hnd
, &result
);
65 if (!NT_STATUS_IS_OK(status
)) {
66 DEBUG(0, ("dcerpc_lsa_Close failed with error [%s].\n",
70 if (!NT_STATUS_IS_OK(result
)) {
71 DEBUG(0, ("lsa close failed with error [%s].\n",
79 static NTSTATUS
delete_trust(TALLOC_CTX
*mem_ctx
,
80 struct dcerpc_binding_handle
*bind_hnd
,
81 struct policy_handle
*pol_hnd
,
82 struct dom_sid
*domsid
)
85 struct lsa_DeleteTrustedDomain dr
;
87 dr
.in
.handle
= pol_hnd
;
88 dr
.in
.dom_sid
= domsid
;
90 status
= dcerpc_lsa_DeleteTrustedDomain_r(bind_hnd
, mem_ctx
, &dr
);
91 if (!NT_STATUS_IS_OK(status
)) {
92 DEBUG(0, ("dcerpc_lsa_DeleteTrustedDomain_r failed with [%s]\n",
96 if (!NT_STATUS_IS_OK(dr
.out
.result
)) {
97 DEBUG(0, ("DeleteTrustedDomain returned [%s]\n",
98 nt_errstr(dr
.out
.result
)));
105 static NTSTATUS
create_trust(TALLOC_CTX
*mem_ctx
,
106 struct dcerpc_binding_handle
*bind_hnd
,
107 struct policy_handle
*pol_hnd
,
108 const char *trust_name
,
109 const char *trust_name_dns
,
110 struct dom_sid
*domsid
,
111 struct lsa_TrustDomainInfoAuthInfoInternal
*authinfo
)
114 struct lsa_CreateTrustedDomainEx2 r
;
115 struct lsa_TrustDomainInfoInfoEx trustinfo
;
116 struct policy_handle trustdom_handle
;
118 trustinfo
.sid
= domsid
;
119 trustinfo
.netbios_name
.string
= trust_name
;
120 trustinfo
.domain_name
.string
= trust_name_dns
;
122 trustinfo
.trust_direction
= LSA_TRUST_DIRECTION_INBOUND
|
123 LSA_TRUST_DIRECTION_OUTBOUND
;
125 trustinfo
.trust_type
= LSA_TRUST_TYPE_UPLEVEL
;
127 trustinfo
.trust_attributes
= LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
;
129 r
.in
.policy_handle
= pol_hnd
;
130 r
.in
.info
= &trustinfo
;
131 r
.in
.auth_info_internal
= authinfo
;
132 r
.in
.access_mask
= LSA_TRUSTED_SET_POSIX
| LSA_TRUSTED_SET_AUTH
|
133 LSA_TRUSTED_QUERY_DOMAIN_NAME
;
134 r
.out
.trustdom_handle
= &trustdom_handle
;
136 status
= dcerpc_lsa_CreateTrustedDomainEx2_r(bind_hnd
, mem_ctx
, &r
);
137 if (!NT_STATUS_IS_OK(status
)) {
138 DEBUG(0, ("dcerpc_lsa_CreateTrustedDomainEx2_r failed "
139 "with error [%s].\n", nt_errstr(status
)));
142 if (!NT_STATUS_IS_OK(r
.out
.result
)) {
143 DEBUG(0, ("CreateTrustedDomainEx2_r returned [%s].\n",
144 nt_errstr(r
.out
.result
)));
151 static NTSTATUS
get_domain_info(TALLOC_CTX
*mem_ctx
,
152 struct dcerpc_binding_handle
*bind_hdn
,
153 struct policy_handle
*pol_hnd
,
154 struct dom_data
*dom_data
)
157 struct lsa_QueryInfoPolicy2 qr
;
158 struct dom_sid_buf buf
;
160 qr
.in
.handle
= pol_hnd
;
161 qr
.in
.level
= LSA_POLICY_INFO_DNS
;
163 status
= dcerpc_lsa_QueryInfoPolicy2_r(bind_hdn
, mem_ctx
, &qr
);
164 if (!NT_STATUS_IS_OK(status
)) {
165 DEBUG(0, ("dcerpc_lsa_QueryInfoPolicy2_r failed "
166 "with error [%s].\n", nt_errstr(status
)));
170 if (!NT_STATUS_IS_OK(qr
.out
.result
)) {
171 DEBUG(0, ("QueryInfoPolicy2 returned [%s].\n",
172 nt_errstr(qr
.out
.result
)));
173 return qr
.out
.result
;
176 dom_data
->domain_name
= talloc_strdup(mem_ctx
,
177 (*qr
.out
.info
)->dns
.name
.string
);
178 dom_data
->dns_domain_name
= talloc_strdup(mem_ctx
,
179 (*qr
.out
.info
)->dns
.dns_domain
.string
);
180 dom_data
->domsid
= dom_sid_dup(mem_ctx
, (*qr
.out
.info
)->dns
.sid
);
181 if (dom_data
->domain_name
== NULL
||
182 dom_data
->dns_domain_name
== NULL
||
183 dom_data
->domsid
== NULL
) {
184 DEBUG(0, ("Copying domain data failed.\n"));
185 return NT_STATUS_NO_MEMORY
;
188 DEBUG(0, ("Got the following domain info [%s][%s][%s].\n",
189 dom_data
->domain_name
, dom_data
->dns_domain_name
,
190 dom_sid_str_buf(dom_data
->domsid
, &buf
)));
195 static NTSTATUS
connect_and_get_info(TALLOC_CTX
*mem_ctx
,
196 struct net_context
*net_ctx
,
197 struct cli_state
**cli
,
198 struct rpc_pipe_client
**pipe_hnd
,
199 struct policy_handle
*pol_hnd
,
200 struct dom_data
*dom_data
,
201 DATA_BLOB
*session_key
)
206 status
= net_make_ipc_connection_ex(net_ctx
, NULL
, NULL
, NULL
,
208 if (!NT_STATUS_IS_OK(status
)) {
209 DEBUG(0, ("Failed to connect to [%s] with error [%s]\n",
210 net_ctx
->opt_host
, nt_errstr(status
)));
214 status
= cli_rpc_pipe_open_noauth(*cli
, &ndr_table_lsarpc
, pipe_hnd
);
215 if (!NT_STATUS_IS_OK(status
)) {
216 DEBUG(0, ("Failed to initialise lsa pipe with error [%s]\n",
221 status
= dcerpc_lsa_open_policy2((*pipe_hnd
)->binding_handle
,
223 (*pipe_hnd
)->srv_name_slash
,
225 (LSA_POLICY_VIEW_LOCAL_INFORMATION
|
226 LSA_POLICY_TRUST_ADMIN
|
227 LSA_POLICY_CREATE_SECRET
),
230 if (!NT_STATUS_IS_OK(status
)) {
231 DEBUG(0, ("Failed to open policy handle with error [%s]\n",
235 if (!NT_STATUS_IS_OK(result
)) {
236 DEBUG(0, ("lsa_open_policy2 with error [%s]\n",
241 status
= get_domain_info(mem_ctx
, (*pipe_hnd
)->binding_handle
,
243 if (!NT_STATUS_IS_OK(status
)) {
244 DEBUG(0, ("get_domain_info failed with error [%s].\n",
249 status
= cli_get_session_key(mem_ctx
, *pipe_hnd
, session_key
);
250 if (!NT_STATUS_IS_OK(status
)) {
251 DEBUG(0,("Error getting session_key of LSA pipe. Error was %s\n",
259 static bool get_trust_domain_passwords_auth_blob(TALLOC_CTX
*mem_ctx
,
260 const char *password
,
261 DATA_BLOB
*auth_blob
)
263 struct trustDomainPasswords auth_struct
;
264 struct AuthenticationInformation
*auth_info_array
;
265 enum ndr_err_code ndr_err
;
266 size_t converted_size
;
268 generate_random_buffer(auth_struct
.confounder
,
269 sizeof(auth_struct
.confounder
));
271 auth_info_array
= talloc_array(mem_ctx
,
272 struct AuthenticationInformation
, 1);
273 if (auth_info_array
== NULL
) {
277 auth_info_array
[0].AuthType
= TRUST_AUTH_TYPE_CLEAR
;
278 if (!convert_string_talloc(mem_ctx
, CH_UNIX
, CH_UTF16
, password
,
280 &auth_info_array
[0].AuthInfo
.clear
.password
,
285 auth_info_array
[0].AuthInfo
.clear
.size
= converted_size
;
287 auth_struct
.outgoing
.count
= 1;
288 auth_struct
.outgoing
.current
.count
= 1;
289 auth_struct
.outgoing
.current
.array
= auth_info_array
;
290 auth_struct
.outgoing
.previous
.count
= 0;
291 auth_struct
.outgoing
.previous
.array
= NULL
;
293 auth_struct
.incoming
.count
= 1;
294 auth_struct
.incoming
.current
.count
= 1;
295 auth_struct
.incoming
.current
.array
= auth_info_array
;
296 auth_struct
.incoming
.previous
.count
= 0;
297 auth_struct
.incoming
.previous
.array
= NULL
;
299 ndr_err
= ndr_push_struct_blob(auth_blob
, mem_ctx
, &auth_struct
,
300 (ndr_push_flags_fn_t
)ndr_push_trustDomainPasswords
);
301 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
308 static int parse_trust_args(TALLOC_CTX
*mem_ctx
, int argc
, const char **argv
, struct other_dom_data
**_o
, char **_trustpw
)
311 struct other_dom_data
*o
= NULL
;
312 char *trustpw
= NULL
;
319 o
= talloc_zero(mem_ctx
, struct other_dom_data
);
321 DEBUG(0, ("talloc_zero failed.\n"));
325 for (c
= 0; c
< argc
; c
++) {
326 if (strnequal(argv
[c
], ARG_OTHERSERVER
, sizeof(ARG_OTHERSERVER
)-1)) {
327 o
->host
= talloc_strdup(o
, argv
[c
] + sizeof(ARG_OTHERSERVER
)-1);
328 if (o
->host
== NULL
) {
332 } else if (strnequal(argv
[c
], ARG_OTHERUSER
, sizeof(ARG_OTHERUSER
)-1)) {
333 o
->user_name
= talloc_strdup(o
, argv
[c
] + sizeof(ARG_OTHERUSER
)-1);
334 if (o
->user_name
== NULL
) {
338 } else if (strnequal(argv
[c
], ARG_OTHERDOMAINSID
, sizeof(ARG_OTHERDOMAINSID
)-1)) {
339 o
->domain_sid_str
= talloc_strdup(o
, argv
[c
] + sizeof(ARG_OTHERDOMAINSID
)-1);
340 if (o
->domain_sid_str
== NULL
) {
344 } else if (strnequal(argv
[c
], ARG_OTHERDOMAIN
, sizeof(ARG_OTHERDOMAIN
)-1)) {
345 o
->dns_domain_name
= talloc_strdup(o
, argv
[c
] + sizeof(ARG_OTHERDOMAIN
)-1);
346 if (o
->dns_domain_name
== NULL
) {
350 } else if (strnequal(argv
[c
], ARG_OTHERNETBIOSDOMAIN
, sizeof(ARG_OTHERNETBIOSDOMAIN
)-1)) {
351 o
->domain_name
= talloc_strdup(o
, argv
[c
] + sizeof(ARG_OTHERNETBIOSDOMAIN
)-1);
352 if (o
->domain_name
== NULL
) {
356 } else if (strnequal(argv
[c
], ARG_TRUSTPW
, sizeof(ARG_TRUSTPW
)-1)) {
357 trustpw
= talloc_strdup(mem_ctx
, argv
[c
] + sizeof(ARG_TRUSTPW
)-1);
358 if (trustpw
== NULL
) {
363 DEBUG(0, ("Unsupported option [%s].\n", argv
[c
]));
376 talloc_free(trustpw
);
380 static void print_trust_delete_usage(void)
383 "net rpc trust delete [options]\n"
385 "\totherserver=DC in other domain\n"
386 "\totheruser=Admin user in other domain\n"
387 "\totherdomainsid=SID of other domain\n"
389 "\tnet rpc trust delete otherserver=oname otheruser=ouser -S lname -U luser\n"
390 "\tnet rpc trust delete otherdomainsid=S-... -S lname -U luser\n"
393 _("Remove trust between two domains"));
396 static void print_trust_usage(void)
399 "net rpc trust create [options]\n"
401 "\totherserver=DC in other domain\n"
402 "\totheruser=Admin user in other domain\n"
403 "\totherdomainsid=SID of other domain\n"
404 "\tother_netbios_domain=NetBIOS/short name of other domain\n"
405 "\totherdomain=Full/DNS name of other domain\n"
406 "\ttrustpw=Trust password\n"
408 "\tnet rpc trust create otherserver=oname otheruser=ouser -S lname -U luser\n"
409 "\tnet rpc trust create otherdomainsid=S-... other_netbios_domain=odom otherdomain=odom.org trustpw=secret -S lname -U luser\n"
412 _("Create trust between two domains"));
415 static int rpc_trust_common(struct net_context
*net_ctx
, int argc
,
416 const char **argv
, enum trust_op op
)
422 struct cli_state
*cli
[2] = {NULL
, NULL
};
423 struct rpc_pipe_client
*pipe_hnd
[2] = {NULL
, NULL
};
424 DATA_BLOB session_key
[2];
425 struct policy_handle pol_hnd
[2];
426 struct lsa_TrustDomainInfoAuthInfoInternal authinfo
;
428 char *trust_pw
= NULL
;
429 struct other_dom_data
*other_dom_data
;
430 struct net_context
*other_net_ctx
= NULL
;
431 struct dom_data dom_data
[2];
434 ZERO_STRUCT(session_key
);
438 usage
= print_trust_usage
;
441 usage
= print_trust_delete_usage
;
444 DEBUG(0, ("Unsupported trust operation.\n"));
448 if (net_ctx
->display_usage
) {
453 mem_ctx
= talloc_init("trust op");
454 if (mem_ctx
== NULL
) {
455 DEBUG(0, ("talloc_init failed.\n"));
459 ret
= parse_trust_args(mem_ctx
, argc
, argv
, &other_dom_data
, &trust_pw
);
464 DEBUG(0, ("Failed to parse arguments.\n"));
469 if (other_dom_data
->host
!= 0) {
470 other_net_ctx
= talloc_zero(other_dom_data
, struct net_context
);
471 if (other_net_ctx
== NULL
) {
472 DEBUG(0, ("talloc_zero failed.\n"));
476 other_net_ctx
->opt_host
= other_dom_data
->host
;
477 other_net_ctx
->opt_user_name
= other_dom_data
->user_name
;
479 dom_data
[1].domsid
= dom_sid_parse_talloc(mem_ctx
,
480 other_dom_data
->domain_sid_str
);
481 dom_data
[1].domain_name
= other_dom_data
->domain_name
;
482 dom_data
[1].dns_domain_name
= other_dom_data
->dns_domain_name
;
484 if (dom_data
[1].domsid
== NULL
||
485 (op
== TRUST_CREATE
&&
486 (dom_data
[1].domain_name
== NULL
||
487 dom_data
[1].dns_domain_name
== NULL
))) {
488 DEBUG(0, ("Missing required argument.\n"));
494 status
= connect_and_get_info(mem_ctx
, net_ctx
, &cli
[0], &pipe_hnd
[0],
495 &pol_hnd
[0], &dom_data
[0], &session_key
[0]);
496 if (!NT_STATUS_IS_OK(status
)) {
497 DEBUG(0, ("connect_and_get_info failed with error [%s]\n",
502 if (other_net_ctx
!= NULL
) {
503 status
= connect_and_get_info(mem_ctx
, other_net_ctx
,
504 &cli
[1], &pipe_hnd
[1],
505 &pol_hnd
[1], &dom_data
[1],
507 if (!NT_STATUS_IS_OK(status
)) {
508 DEBUG(0, ("connect_and_get_info failed with error [%s]\n",
514 if (op
== TRUST_CREATE
) {
515 if (trust_pw
== NULL
) {
516 if (other_net_ctx
== NULL
) {
517 DEBUG(0, ("Missing either trustpw or otherhost.\n"));
521 DEBUG(0, ("Using random trust password.\n"));
522 trust_pw
= trust_pw_new_value(mem_ctx
,
525 if (trust_pw
== NULL
) {
526 DEBUG(0, ("generate_random_password failed.\n"));
530 DEBUG(0, ("Using user provided password.\n"));
533 if (!get_trust_domain_passwords_auth_blob(mem_ctx
, trust_pw
,
535 DEBUG(0, ("get_trust_domain_passwords_auth_blob failed\n"));
539 authinfo
.auth_blob
.data
= (uint8_t *)talloc_memdup(
543 if (authinfo
.auth_blob
.data
== NULL
) {
546 authinfo
.auth_blob
.size
= auth_blob
.length
;
548 arcfour_crypt_blob(authinfo
.auth_blob
.data
,
549 authinfo
.auth_blob
.size
,
552 status
= create_trust(mem_ctx
, pipe_hnd
[0]->binding_handle
,
554 dom_data
[1].domain_name
,
555 dom_data
[1].dns_domain_name
,
558 if (!NT_STATUS_IS_OK(status
)) {
559 DEBUG(0, ("create_trust failed with error [%s].\n",
564 if (other_net_ctx
!= NULL
) {
565 talloc_free(authinfo
.auth_blob
.data
);
566 authinfo
.auth_blob
.data
= (uint8_t *)talloc_memdup(
570 if (authinfo
.auth_blob
.data
== NULL
) {
573 authinfo
.auth_blob
.size
= auth_blob
.length
;
575 arcfour_crypt_blob(authinfo
.auth_blob
.data
,
576 authinfo
.auth_blob
.size
,
579 status
= create_trust(mem_ctx
,
580 pipe_hnd
[1]->binding_handle
,
582 dom_data
[0].domain_name
,
583 dom_data
[0].dns_domain_name
,
584 dom_data
[0].domsid
, &authinfo
);
585 if (!NT_STATUS_IS_OK(status
)) {
586 DEBUG(0, ("create_trust failed with error [%s].\n",
591 } else if (op
== TRUST_DELETE
) {
592 status
= delete_trust(mem_ctx
, pipe_hnd
[0]->binding_handle
,
593 &pol_hnd
[0], dom_data
[1].domsid
);
594 if (!NT_STATUS_IS_OK(status
)) {
595 DEBUG(0, ("delete_trust failed with [%s].\n",
600 if (other_net_ctx
!= NULL
) {
601 status
= delete_trust(mem_ctx
,
602 pipe_hnd
[1]->binding_handle
,
603 &pol_hnd
[1], dom_data
[0].domsid
);
604 if (!NT_STATUS_IS_OK(status
)) {
605 DEBUG(0, ("delete_trust failed with [%s].\n",
612 status
= close_handle(mem_ctx
, pipe_hnd
[0]->binding_handle
,
614 if (!NT_STATUS_IS_OK(status
)) {
615 DEBUG(0, ("close_handle failed with error [%s].\n",
620 if (other_net_ctx
!= NULL
) {
621 status
= close_handle(mem_ctx
, pipe_hnd
[1]->binding_handle
,
623 if (!NT_STATUS_IS_OK(status
)) {
624 DEBUG(0, ("close_handle failed with error [%s].\n",
633 data_blob_clear_free(&session_key
[0]);
634 data_blob_clear_free(&session_key
[1]);
635 cli_shutdown(cli
[0]);
636 cli_shutdown(cli
[1]);
637 talloc_destroy(mem_ctx
);
641 static int rpc_trust_create(struct net_context
*net_ctx
, int argc
,
644 return rpc_trust_common(net_ctx
, argc
, argv
, TRUST_CREATE
);
647 static int rpc_trust_delete(struct net_context
*net_ctx
, int argc
,
650 return rpc_trust_common(net_ctx
, argc
, argv
, TRUST_DELETE
);
653 int net_rpc_trust(struct net_context
*c
, int argc
, const char **argv
)
655 struct functable func
[] = {
661 N_("net rpc trust create\n"
669 N_("net rpc trust delete\n"
672 {NULL
, NULL
, 0, NULL
, NULL
}
675 return net_run_function(c
, argc
, argv
, "net rpc trust", func
);