2 Unix SMB/CIFS implementation.
4 A composite API for initializing a domain
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/composite/composite.h"
25 #include "winbind/wb_server.h"
26 #include "smbd/service_task.h"
27 #include "librpc/gen_ndr/ndr_netlogon.h"
28 #include "librpc/gen_ndr/ndr_lsa_c.h"
29 #include "librpc/gen_ndr/ndr_samr_c.h"
30 #include "libcli/libcli.h"
32 #include "libcli/security/security.h"
35 #include "auth/credentials/credentials.h"
36 #include "param/param.h"
39 * Initialize a domain:
41 * - With schannel credentials, try to open the SMB connection and
42 * NETLOGON pipe with the machine creds. This works against W2k3SP1
43 * with an NTLMSSP session setup. Fall back to anonymous (for the CIFS level).
45 * - If we have schannel creds, do the auth2 and open the schannel'ed netlogon
48 * - Open LSA. If we have machine creds, try to open with SPNEGO or NTLMSSP. Fall back
51 * - With queryinfopolicy, verify that we're talking to the right domain
53 * A bit complex, but with all the combinations I think it's the best we can
54 * get. NT4, W2k3 and W2k all have different combinations, but in the end we
55 * have a signed&sealed lsa connection on all of them.
57 * Not sure if it is overkill, but it seems to work.
60 struct init_domain_state
{
61 struct composite_context
*ctx
;
62 struct wbsrv_domain
*domain
;
63 struct wbsrv_service
*service
;
65 struct lsa_ObjectAttribute objectattr
;
66 struct lsa_OpenPolicy2 lsa_openpolicy
;
67 struct lsa_QueryInfoPolicy queryinfo
;
68 union lsa_PolicyInformation
*info
;
71 static void init_domain_recv_netlogonpipe(struct composite_context
*ctx
);
72 static void init_domain_recv_lsa_pipe(struct composite_context
*ctx
);
73 static void init_domain_recv_lsa_policy(struct tevent_req
*subreq
);
74 static void init_domain_recv_queryinfo(struct tevent_req
*subreq
);
75 static void init_domain_recv_samr(struct composite_context
*ctx
);
77 static struct dcerpc_binding
*init_domain_binding(struct init_domain_state
*state
,
78 const struct ndr_interface_table
*table
)
80 struct dcerpc_binding
*binding
;
84 /* Make a binding string */
85 if ((lpcfg_server_role(state
->service
->task
->lp_ctx
) != ROLE_DOMAIN_MEMBER
) &&
86 dom_sid_equal(state
->domain
->info
->sid
, state
->service
->primary_sid
) &&
87 state
->service
->sec_channel_type
!= SEC_CHAN_RODC
) {
88 s
= talloc_asprintf(state
, "ncalrpc:%s", state
->domain
->dc_name
);
89 if (s
== NULL
) return NULL
;
91 s
= talloc_asprintf(state
, "ncacn_np:%s", state
->domain
->dc_name
);
92 if (s
== NULL
) return NULL
;
95 status
= dcerpc_parse_binding(state
, s
, &binding
);
97 if (!NT_STATUS_IS_OK(status
)) {
101 /* Alter binding to contain hostname, but also address (so we don't look it up twice) */
102 binding
->target_hostname
= state
->domain
->dc_name
;
103 binding
->host
= state
->domain
->dc_address
;
105 if (binding
->transport
== NCALRPC
) {
109 /* This shouldn't make a network call, as the mappings for named pipes are well known */
110 status
= dcerpc_epm_map_binding(binding
, binding
, table
, state
->service
->task
->event_ctx
,
111 state
->service
->task
->lp_ctx
);
112 if (!NT_STATUS_IS_OK(status
)) {
119 struct composite_context
*wb_init_domain_send(TALLOC_CTX
*mem_ctx
,
120 struct wbsrv_service
*service
,
121 struct wb_dom_info
*dom_info
)
123 struct composite_context
*result
, *ctx
;
124 struct init_domain_state
*state
;
126 result
= composite_create(mem_ctx
, service
->task
->event_ctx
);
127 if (result
== NULL
) goto failed
;
129 state
= talloc_zero(result
, struct init_domain_state
);
130 if (state
== NULL
) goto failed
;
132 result
->private_data
= state
;
134 state
->service
= service
;
136 state
->domain
= talloc(state
, struct wbsrv_domain
);
137 if (state
->domain
== NULL
) goto failed
;
139 state
->domain
->service
= service
;
141 state
->domain
->info
= talloc_reference(state
->domain
, dom_info
);
142 if (state
->domain
->info
== NULL
) goto failed
;
144 state
->domain
->dc_name
= dom_info
->dc
->name
;
145 state
->domain
->dc_address
= dom_info
->dc
->address
;
147 state
->domain
->libnet_ctx
= libnet_context_init(service
->task
->event_ctx
,
148 service
->task
->lp_ctx
);
149 if (state
->domain
->libnet_ctx
== NULL
) goto failed
;
150 talloc_steal(state
->domain
, state
->domain
->libnet_ctx
);
152 /* Create a credentials structure */
153 state
->domain
->libnet_ctx
->cred
= cli_credentials_init(state
->domain
);
154 if (state
->domain
->libnet_ctx
->cred
== NULL
) goto failed
;
156 cli_credentials_set_conf(state
->domain
->libnet_ctx
->cred
, service
->task
->lp_ctx
);
158 /* Connect the machine account to the credentials */
160 cli_credentials_set_machine_account(state
->domain
->libnet_ctx
->cred
, state
->domain
->libnet_ctx
->lp_ctx
);
161 if (!NT_STATUS_IS_OK(state
->ctx
->status
)) goto failed
;
163 state
->domain
->netlogon_binding
= init_domain_binding(state
, &ndr_table_netlogon
);
165 state
->domain
->netlogon_pipe
= NULL
;
167 state
->domain
->netlogon_queue
= tevent_queue_create(state
->domain
,
169 if (state
->domain
->netlogon_queue
== NULL
) goto failed
;
171 /* We start the queue when the connection is usable */
172 tevent_queue_stop(state
->domain
->netlogon_queue
);
174 if ((!cli_credentials_is_anonymous(state
->domain
->libnet_ctx
->cred
)) &&
175 ((lpcfg_server_role(service
->task
->lp_ctx
) == ROLE_DOMAIN_MEMBER
) ||
176 (lpcfg_server_role(service
->task
->lp_ctx
) == ROLE_ACTIVE_DIRECTORY_DC
)) &&
177 (dom_sid_equal(state
->domain
->info
->sid
,
178 state
->service
->primary_sid
))) {
179 state
->domain
->netlogon_binding
->flags
|= DCERPC_SCHANNEL
| DCERPC_SCHANNEL_AUTO
;
181 /* For debugging, it can be a real pain if all the traffic is encrypted */
182 if (lpcfg_winbind_sealed_pipes(service
->task
->lp_ctx
)) {
183 state
->domain
->netlogon_binding
->flags
|= (DCERPC_SIGN
| DCERPC_SEAL
);
185 state
->domain
->netlogon_binding
->flags
|= (DCERPC_SIGN
);
189 /* No encryption on anonymous pipes */
191 ctx
= dcerpc_pipe_connect_b_send(state
, state
->domain
->netlogon_binding
,
193 state
->domain
->libnet_ctx
->cred
,
194 service
->task
->event_ctx
,
195 service
->task
->lp_ctx
);
197 if (composite_nomem(ctx
, state
->ctx
)) {
201 composite_continue(state
->ctx
, ctx
, init_domain_recv_netlogonpipe
,
209 /* Having make a netlogon connection (possibly secured with schannel),
210 * make an LSA connection to the same DC, on the same IPC$ share */
211 static void init_domain_recv_netlogonpipe(struct composite_context
*ctx
)
213 struct init_domain_state
*state
=
214 talloc_get_type(ctx
->async
.private_data
,
215 struct init_domain_state
);
217 state
->ctx
->status
= dcerpc_pipe_connect_b_recv(ctx
, state
->domain
,
218 &state
->domain
->netlogon_pipe
);
220 if (!composite_is_ok(state
->ctx
)) {
223 talloc_reparent(state
, state
->domain
->netlogon_pipe
, state
->domain
->netlogon_binding
);
225 /* the netlogon connection is ready */
226 tevent_queue_start(state
->domain
->netlogon_queue
);
228 state
->domain
->lsa_binding
= init_domain_binding(state
, &ndr_table_lsarpc
);
230 /* For debugging, it can be a real pain if all the traffic is encrypted */
231 if (lpcfg_winbind_sealed_pipes(state
->service
->task
->lp_ctx
)) {
232 state
->domain
->lsa_binding
->flags
|= (DCERPC_SIGN
| DCERPC_SEAL
);
234 state
->domain
->lsa_binding
->flags
|= (DCERPC_SIGN
);
237 state
->domain
->libnet_ctx
->lsa
.pipe
= NULL
;
238 state
->domain
->libnet_ctx
->lsa
.lsa_handle
= NULL
;
240 /* this will make the secondary connection on the same IPC$ share,
241 secured with SPNEGO or NTLMSSP */
242 ctx
= dcerpc_secondary_auth_connection_send(state
->domain
->netlogon_pipe
,
243 state
->domain
->lsa_binding
,
245 state
->domain
->libnet_ctx
->cred
,
246 state
->domain
->libnet_ctx
->lp_ctx
248 composite_continue(state
->ctx
, ctx
, init_domain_recv_lsa_pipe
, state
);
251 static bool retry_with_schannel(struct init_domain_state
*state
,
252 struct dcerpc_binding
*binding
,
253 const struct ndr_interface_table
*table
,
254 void (*continuation
)(struct composite_context
*))
256 struct composite_context
*ctx
;
257 state
->ctx
->status
= NT_STATUS_OK
;
258 if (state
->domain
->netlogon_binding
->flags
& DCERPC_SCHANNEL
259 && !(binding
->flags
& DCERPC_SCHANNEL
)) {
260 /* Opening a policy handle failed, perhaps it was
261 * because we don't get a 'wrong password' error on
264 /* Try again with schannel */
265 binding
->flags
|= DCERPC_SCHANNEL
| DCERPC_SCHANNEL_AUTO
;
267 /* Try again, likewise on the same IPC$ share,
268 secured with SCHANNEL */
269 ctx
= dcerpc_secondary_auth_connection_send(state
->domain
->netlogon_pipe
,
272 state
->domain
->libnet_ctx
->cred
,
273 state
->domain
->libnet_ctx
->lp_ctx
);
274 composite_continue(state
->ctx
, ctx
, continuation
, state
);
280 /* We should now have either an authenticated LSA pipe, or an error.
281 * On success, open a policy handle
283 static void init_domain_recv_lsa_pipe(struct composite_context
*ctx
)
285 struct init_domain_state
*state
=
286 talloc_get_type(ctx
->async
.private_data
,
287 struct init_domain_state
);
288 struct tevent_req
*subreq
;
290 state
->ctx
->status
= dcerpc_secondary_auth_connection_recv(ctx
, state
->domain
,
291 &state
->domain
->libnet_ctx
->lsa
.pipe
);
292 if (NT_STATUS_EQUAL(state
->ctx
->status
, NT_STATUS_LOGON_FAILURE
)) {
293 if (retry_with_schannel(state
, state
->domain
->lsa_binding
,
295 init_domain_recv_lsa_pipe
)) {
299 if (!composite_is_ok(state
->ctx
)) return;
301 talloc_steal(state
->domain
->libnet_ctx
, state
->domain
->libnet_ctx
->lsa
.pipe
);
302 talloc_reparent(state
, state
->domain
->libnet_ctx
->lsa
.pipe
, state
->domain
->lsa_binding
);
303 state
->domain
->libnet_ctx
->lsa
.lsa_handle
=
304 state
->domain
->libnet_ctx
->lsa
.pipe
->binding_handle
;
305 state
->domain
->libnet_ctx
->lsa
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
306 state
->domain
->libnet_ctx
->lsa
.name
= state
->domain
->info
->name
;
308 ZERO_STRUCT(state
->domain
->libnet_ctx
->lsa
.handle
);
309 state
->lsa_openpolicy
.in
.system_name
=
310 talloc_asprintf(state
, "\\\\%s",
311 dcerpc_server_name(state
->domain
->libnet_ctx
->lsa
.pipe
));
312 ZERO_STRUCT(state
->objectattr
);
313 state
->lsa_openpolicy
.in
.attr
= &state
->objectattr
;
314 state
->lsa_openpolicy
.in
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
315 state
->lsa_openpolicy
.out
.handle
= &state
->domain
->libnet_ctx
->lsa
.handle
;
317 subreq
= dcerpc_lsa_OpenPolicy2_r_send(state
,
318 state
->ctx
->event_ctx
,
319 state
->domain
->libnet_ctx
->lsa
.pipe
->binding_handle
,
320 &state
->lsa_openpolicy
);
321 if (composite_nomem(subreq
, state
->ctx
)) return;
322 tevent_req_set_callback(subreq
, init_domain_recv_lsa_policy
, state
);
325 /* Receive a policy handle (or not, and retry the authentication) and
326 * obtain some basic information about the domain */
328 static void init_domain_recv_lsa_policy(struct tevent_req
*subreq
)
330 struct init_domain_state
*state
=
331 tevent_req_callback_data(subreq
,
332 struct init_domain_state
);
334 state
->ctx
->status
= dcerpc_lsa_OpenPolicy2_r_recv(subreq
, state
);
336 if ((!NT_STATUS_IS_OK(state
->ctx
->status
)
337 || !NT_STATUS_IS_OK(state
->lsa_openpolicy
.out
.result
))) {
338 if (retry_with_schannel(state
, state
->domain
->lsa_binding
,
340 init_domain_recv_lsa_pipe
)) {
344 if (!composite_is_ok(state
->ctx
)) return;
345 state
->ctx
->status
= state
->lsa_openpolicy
.out
.result
;
346 if (!composite_is_ok(state
->ctx
)) return;
348 state
->info
= talloc_zero(state
->ctx
, union lsa_PolicyInformation
);
349 if (composite_nomem(state
->info
, state
->ctx
)) return;
351 state
->queryinfo
.in
.handle
= &state
->domain
->libnet_ctx
->lsa
.handle
;
352 state
->queryinfo
.in
.level
= LSA_POLICY_INFO_ACCOUNT_DOMAIN
;
353 state
->queryinfo
.out
.info
= &state
->info
;
355 subreq
= dcerpc_lsa_QueryInfoPolicy_r_send(state
,
356 state
->ctx
->event_ctx
,
357 state
->domain
->libnet_ctx
->lsa
.pipe
->binding_handle
,
359 if (composite_nomem(subreq
, state
->ctx
)) return;
360 tevent_req_set_callback(subreq
, init_domain_recv_queryinfo
, state
);
363 static void init_domain_recv_queryinfo(struct tevent_req
*subreq
)
365 struct init_domain_state
*state
=
366 tevent_req_callback_data(subreq
,
367 struct init_domain_state
);
368 struct lsa_DomainInfo
*dominfo
;
369 struct composite_context
*ctx
;
371 state
->ctx
->status
= dcerpc_lsa_QueryInfoPolicy_r_recv(subreq
, state
);
373 if (!composite_is_ok(state
->ctx
)) return;
374 state
->ctx
->status
= state
->queryinfo
.out
.result
;
375 if (!composite_is_ok(state
->ctx
)) return;
377 if (!dom_sid_equal(state
->domain
->info
->sid
, &global_sid_Builtin
)) {
378 dominfo
= &(*state
->queryinfo
.out
.info
)->account_domain
;
380 if (strcasecmp(state
->domain
->info
->name
, dominfo
->name
.string
) != 0) {
381 DEBUG(2, ("Expected domain name %s, DC %s said %s\n",
382 state
->domain
->info
->name
,
383 dcerpc_server_name(state
->domain
->libnet_ctx
->lsa
.pipe
),
384 dominfo
->name
.string
));
385 composite_error(state
->ctx
, NT_STATUS_INVALID_DOMAIN_STATE
);
389 if (!dom_sid_equal(state
->domain
->info
->sid
, dominfo
->sid
)) {
390 DEBUG(2, ("Expected domain sid %s, DC %s said %s\n",
391 dom_sid_string(state
, state
->domain
->info
->sid
),
392 dcerpc_server_name(state
->domain
->libnet_ctx
->lsa
.pipe
),
393 dom_sid_string(state
, dominfo
->sid
)));
394 composite_error(state
->ctx
, NT_STATUS_INVALID_DOMAIN_STATE
);
399 state
->domain
->samr_binding
= init_domain_binding(state
, &ndr_table_samr
);
401 /* We want to use the same flags as the LSA pipe did (so, if
402 * it needed schannel, then we need that here too) */
403 state
->domain
->samr_binding
->flags
= state
->domain
->lsa_binding
->flags
;
405 state
->domain
->libnet_ctx
->samr
.pipe
= NULL
;
406 state
->domain
->libnet_ctx
->samr
.samr_handle
= NULL
;
408 ctx
= wb_connect_samr_send(state
, state
->domain
);
409 composite_continue(state
->ctx
, ctx
, init_domain_recv_samr
, state
);
412 /* Recv the SAMR details (SamrConnect and SamrOpenDomain handle) and
413 * open an LDAP connection */
414 static void init_domain_recv_samr(struct composite_context
*ctx
)
416 struct init_domain_state
*state
=
417 talloc_get_type(ctx
->async
.private_data
,
418 struct init_domain_state
);
420 state
->ctx
->status
= wb_connect_samr_recv(
422 &state
->domain
->libnet_ctx
->samr
.pipe
,
423 &state
->domain
->libnet_ctx
->samr
.connect_handle
,
424 &state
->domain
->libnet_ctx
->samr
.handle
);
425 if (!composite_is_ok(state
->ctx
)) return;
427 talloc_reparent(state
, state
->domain
->libnet_ctx
->samr
.pipe
, state
->domain
->samr_binding
);
428 state
->domain
->libnet_ctx
->samr
.samr_handle
=
429 state
->domain
->libnet_ctx
->samr
.pipe
->binding_handle
;
430 state
->domain
->libnet_ctx
->samr
.access_mask
= SEC_FLAG_MAXIMUM_ALLOWED
;
431 state
->domain
->libnet_ctx
->samr
.name
= state
->domain
->info
->name
;
432 state
->domain
->libnet_ctx
->samr
.sid
= dom_sid_dup(
433 state
->domain
->libnet_ctx
,
434 state
->domain
->info
->sid
);
436 composite_done(state
->ctx
);
439 NTSTATUS
wb_init_domain_recv(struct composite_context
*c
,
441 struct wbsrv_domain
**result
)
443 NTSTATUS status
= composite_wait(c
);
444 if (NT_STATUS_IS_OK(status
)) {
445 struct init_domain_state
*state
=
446 talloc_get_type(c
->private_data
,
447 struct init_domain_state
);
448 *result
= talloc_steal(mem_ctx
, state
->domain
);
454 NTSTATUS
wb_init_domain(TALLOC_CTX
*mem_ctx
, struct wbsrv_service
*service
,
455 struct wb_dom_info
*dom_info
,
456 struct wbsrv_domain
**result
)
458 struct composite_context
*c
=
459 wb_init_domain_send(mem_ctx
, service
, dom_info
);
460 return wb_init_domain_recv(c
, mem_ctx
, result
);