?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-auth Move libcli/security/session.c to the top level
[Samba.git] / source3 / winbindd / winbindd_msrpc.c
blob98c5e3ad0f0877065cb2f429cc167af8b49973f8
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind rpc backend functions
5
6 Copyright (C) Tim Potter 2000-2001,2003
7 Copyright (C) Andrew Tridgell 2001
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2008 (pidl conversion)
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27 #include "winbindd_rpc.h"
28
29 #include "../librpc/gen_ndr/ndr_samr_c.h"
30 #include "rpc_client/cli_samr.h"
31 #include "rpc_client/cli_lsarpc.h"
32 #include "../libcli/security/security.h"
33
34 #undef DBGC_CLASS
35 #define DBGC_CLASS DBGC_WINBIND
36
37
38 /* Query display info for a domain. This returns enough information plus a
39 bit extra to give an overview of domain users for the User Manager
40 application. */
41 static NTSTATUS msrpc_query_user_list(struct winbindd_domain *domain,
42 TALLOC_CTX *mem_ctx,
43 uint32_t *pnum_info,
44 struct wbint_userinfo **pinfo)
45 {
46 struct rpc_pipe_client *samr_pipe = NULL;
47 struct policy_handle dom_pol;
48 struct wbint_userinfo *info = NULL;
49 uint32_t num_info = 0;
50 TALLOC_CTX *tmp_ctx;
51 NTSTATUS status;
52
53 DEBUG(3, ("msrpc_query_user_list\n"));
54
55 if (pnum_info) {
56 *pnum_info = 0;
57 }
58
59 tmp_ctx = talloc_stackframe();
60 if (tmp_ctx == NULL) {
61 return NT_STATUS_NO_MEMORY;
62 }
63
64 if ( !winbindd_can_contact_domain( domain ) ) {
65 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
66 domain->name));
67 status = NT_STATUS_OK;
68 goto done;
69 }
70
71 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
72 if (!NT_STATUS_IS_OK(status)) {
73 goto done;
74 }
75
76 status = rpc_query_user_list(tmp_ctx,
77 samr_pipe,
78 &dom_pol,
79 &domain->sid,
80 &num_info,
81 &info);
82 if (!NT_STATUS_IS_OK(status)) {
83 goto done;
84 }
85
86 if (pnum_info) {
87 *pnum_info = num_info;
88 }
89
90 if (pinfo) {
91 *pinfo = talloc_move(mem_ctx, &info);
92 }
93
94 done:
95 TALLOC_FREE(tmp_ctx);
96 return status;
97 }
98
99 /* list all domain groups */
100 static NTSTATUS msrpc_enum_dom_groups(struct winbindd_domain *domain,
101 TALLOC_CTX *mem_ctx,
102 uint32_t *pnum_info,
103 struct acct_info **pinfo)
104 {
105 struct rpc_pipe_client *samr_pipe;
106 struct policy_handle dom_pol;
107 struct acct_info *info = NULL;
108 uint32_t num_info = 0;
109 TALLOC_CTX *tmp_ctx;
110 NTSTATUS status;
111
112 DEBUG(3,("msrpc_enum_dom_groups\n"));
113
114 if (pnum_info) {
115 *pnum_info = 0;
116 }
117
118 tmp_ctx = talloc_stackframe();
119 if (tmp_ctx == NULL) {
120 return NT_STATUS_NO_MEMORY;
121 }
122
123 if ( !winbindd_can_contact_domain( domain ) ) {
124 DEBUG(10,("enum_domain_groups: No incoming trust for domain %s\n",
125 domain->name));
126 status = NT_STATUS_OK;
127 goto done;
128 }
129
130 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
131 if (!NT_STATUS_IS_OK(status)) {
132 goto done;
133 }
134
135 status = rpc_enum_dom_groups(tmp_ctx,
136 samr_pipe,
137 &dom_pol,
138 &num_info,
139 &info);
140 if (!NT_STATUS_IS_OK(status)) {
141 goto done;
142 }
143
144 if (pnum_info) {
145 *pnum_info = num_info;
146 }
147
148 if (pinfo) {
149 *pinfo = talloc_move(mem_ctx, &info);
150 }
151
152 done:
153 TALLOC_FREE(tmp_ctx);
154 return status;
155 }
156
157 /* List all domain groups */
158
159 static NTSTATUS msrpc_enum_local_groups(struct winbindd_domain *domain,
160 TALLOC_CTX *mem_ctx,
161 uint32_t *pnum_info,
162 struct acct_info **pinfo)
163 {
164 struct rpc_pipe_client *samr_pipe;
165 struct policy_handle dom_pol;
166 struct acct_info *info = NULL;
167 uint32_t num_info = 0;
168 TALLOC_CTX *tmp_ctx;
169 NTSTATUS status;
170
171 DEBUG(3,("msrpc_enum_local_groups\n"));
172
173 if (pnum_info) {
174 *pnum_info = 0;
175 }
176
177 tmp_ctx = talloc_stackframe();
178 if (tmp_ctx == NULL) {
179 return NT_STATUS_NO_MEMORY;
180 }
181
182 if ( !winbindd_can_contact_domain( domain ) ) {
183 DEBUG(10,("enum_local_groups: No incoming trust for domain %s\n",
184 domain->name));
185 status = NT_STATUS_OK;
186 goto done;
187 }
188
189 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
190 if (!NT_STATUS_IS_OK(status)) {
191 goto done;
192 }
193
194 status = rpc_enum_local_groups(mem_ctx,
195 samr_pipe,
196 &dom_pol,
197 &num_info,
198 &info);
199 if (!NT_STATUS_IS_OK(status)) {
200 goto done;
201 }
202
203 if (pnum_info) {
204 *pnum_info = num_info;
205 }
206
207 if (pinfo) {
208 *pinfo = talloc_move(mem_ctx, &info);
209 }
210
211 done:
212 TALLOC_FREE(tmp_ctx);
213 return status;
214 }
215
216 /* convert a single name to a sid in a domain */
217 static NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
218 TALLOC_CTX *mem_ctx,
219 const char *domain_name,
220 const char *name,
221 uint32_t flags,
222 struct dom_sid *sid,
223 enum lsa_SidType *type)
224 {
225 NTSTATUS result;
226 struct dom_sid *sids = NULL;
227 enum lsa_SidType *types = NULL;
228 char *full_name = NULL;
229 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
230 char *mapped_name = NULL;
231
232 if (name == NULL || *name=='\0') {
233 full_name = talloc_asprintf(mem_ctx, "%s", domain_name);
234 } else if (domain_name == NULL || *domain_name == '\0') {
235 full_name = talloc_asprintf(mem_ctx, "%s", name);
236 } else {
237 full_name = talloc_asprintf(mem_ctx, "%s\\%s", domain_name, name);
238 }
239 if (!full_name) {
240 DEBUG(0, ("talloc_asprintf failed!\n"));
241 return NT_STATUS_NO_MEMORY;
242 }
243
244 DEBUG(3, ("msrpc_name_to_sid: name=%s\n", full_name));
245
246 name_map_status = normalize_name_unmap(mem_ctx, full_name,
247 &mapped_name);
248
249 /* Reset the full_name pointer if we mapped anytthing */
250
251 if (NT_STATUS_IS_OK(name_map_status) ||
252 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
253 {
254 full_name = mapped_name;
255 }
256
257 DEBUG(3,("name_to_sid [rpc] %s for domain %s\n",
258 full_name?full_name:"", domain_name ));
259
260 result = winbindd_lookup_names(mem_ctx, domain, 1,
261 (const char **)&full_name, NULL,
262 &sids, &types);
263 if (!NT_STATUS_IS_OK(result))
264 return result;
265
266 /* Return rid and type if lookup successful */
267
268 sid_copy(sid, &sids[0]);
269 *type = types[0];
270
271 return NT_STATUS_OK;
272 }
273
274 /*
275 convert a domain SID to a user or group name
276 */
277 static NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
278 TALLOC_CTX *mem_ctx,
279 const struct dom_sid *sid,
280 char **domain_name,
281 char **name,
282 enum lsa_SidType *type)
283 {
284 char **domains;
285 char **names;
286 enum lsa_SidType *types = NULL;
287 NTSTATUS result;
288 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
289 char *mapped_name = NULL;
290
291 DEBUG(3, ("msrpc_sid_to_name: %s for domain %s\n", sid_string_dbg(sid),
292 domain->name ));
293
294 result = winbindd_lookup_sids(mem_ctx,
295 domain,
296 1,
297 sid,
298 &domains,
299 &names,
300 &types);
301 if (!NT_STATUS_IS_OK(result)) {
302 DEBUG(2,("msrpc_sid_to_name: failed to lookup sids: %s\n",
303 nt_errstr(result)));
304 return result;
305 }
306
307
308 *type = (enum lsa_SidType)types[0];
309 *domain_name = domains[0];
310 *name = names[0];
311
312 DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name));
313
314 name_map_status = normalize_name_map(mem_ctx, domain, *name,
315 &mapped_name);
316 if (NT_STATUS_IS_OK(name_map_status) ||
317 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
318 {
319 *name = mapped_name;
320 DEBUG(5,("returning mapped name -- %s\n", *name));
321 }
322
323 return NT_STATUS_OK;
324 }
325
326 static NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
327 TALLOC_CTX *mem_ctx,
328 const struct dom_sid *sid,
329 uint32 *rids,
330 size_t num_rids,
331 char **domain_name,
332 char ***names,
333 enum lsa_SidType **types)
334 {
335 char **domains;
336 NTSTATUS result;
337 struct dom_sid *sids;
338 size_t i;
339 char **ret_names;
340
341 DEBUG(3, ("msrpc_rids_to_names: domain %s\n", domain->name ));
342
343 if (num_rids) {
344 sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, num_rids);
345 if (sids == NULL) {
346 return NT_STATUS_NO_MEMORY;
347 }
348 } else {
349 sids = NULL;
350 }
351
352 for (i=0; i<num_rids; i++) {
353 if (!sid_compose(&sids[i], sid, rids[i])) {
354 return NT_STATUS_INTERNAL_ERROR;
355 }
356 }
357
358 result = winbindd_lookup_sids(mem_ctx,
359 domain,
360 num_rids,
361 sids,
362 &domains,
363 names,
364 types);
365
366 if (!NT_STATUS_IS_OK(result) &&
367 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
368 return result;
369 }
370
371 ret_names = *names;
372 for (i=0; i<num_rids; i++) {
373 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
374 char *mapped_name = NULL;
375
376 if ((*types)[i] != SID_NAME_UNKNOWN) {
377 name_map_status = normalize_name_map(mem_ctx,
378 domain,
379 ret_names[i],
380 &mapped_name);
381 if (NT_STATUS_IS_OK(name_map_status) ||
382 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
383 {
384 ret_names[i] = mapped_name;
385 }
386
387 *domain_name = domains[i];
388 }
389 }
390
391 return result;
392 }
393
394 /* Lookup user information from a rid or username. */
395 static NTSTATUS msrpc_query_user(struct winbindd_domain *domain,
396 TALLOC_CTX *mem_ctx,
397 const struct dom_sid *user_sid,
398 struct wbint_userinfo *user_info)
399 {
400 struct rpc_pipe_client *samr_pipe;
401 struct policy_handle dom_pol;
402 struct netr_SamInfo3 *user;
403 TALLOC_CTX *tmp_ctx;
404 NTSTATUS status;
405
406 DEBUG(3,("msrpc_query_user sid=%s\n", sid_string_dbg(user_sid)));
407
408 tmp_ctx = talloc_stackframe();
409 if (tmp_ctx == NULL) {
410 return NT_STATUS_NO_MEMORY;
411 }
412
413 if (user_info) {
414 user_info->homedir = NULL;
415 user_info->shell = NULL;
416 user_info->primary_gid = (gid_t)-1;
417 }
418
419 /* try netsamlogon cache first */
420 user = netsamlogon_cache_get(tmp_ctx, user_sid);
421 if (user != NULL) {
422 DEBUG(5,("msrpc_query_user: Cache lookup succeeded for %s\n",
423 sid_string_dbg(user_sid)));
424
425 sid_compose(&user_info->user_sid, &domain->sid, user->base.rid);
426 sid_compose(&user_info->group_sid, &domain->sid,
427 user->base.primary_gid);
428
429 user_info->acct_name = talloc_strdup(user_info,
430 user->base.account_name.string);
431 user_info->full_name = talloc_strdup(user_info,
432 user->base.full_name.string);
433
434 status = NT_STATUS_OK;
435 goto done;
436 }
437
438 if ( !winbindd_can_contact_domain( domain ) ) {
439 DEBUG(10,("query_user: No incoming trust for domain %s\n",
440 domain->name));
441 /* Tell the cache manager not to remember this one */
442 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
443 goto done;
444 }
445
446 /* no cache; hit the wire */
447 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
448 if (!NT_STATUS_IS_OK(status)) {
449 goto done;
450 }
451
452 status = rpc_query_user(tmp_ctx,
453 samr_pipe,
454 &dom_pol,
455 &domain->sid,
456 user_sid,
457 user_info);
458
459 done:
460 TALLOC_FREE(tmp_ctx);
461 return status;
462 }
463
464 /* Lookup groups a user is a member of. I wish Unix had a call like this! */
465 static NTSTATUS msrpc_lookup_usergroups(struct winbindd_domain *domain,
466 TALLOC_CTX *mem_ctx,
467 const struct dom_sid *user_sid,
468 uint32_t *pnum_groups,
469 struct dom_sid **puser_grpsids)
470 {
471 struct rpc_pipe_client *samr_pipe;
472 struct policy_handle dom_pol;
473 struct dom_sid *user_grpsids = NULL;
474 uint32_t num_groups = 0;
475 TALLOC_CTX *tmp_ctx;
476 NTSTATUS status;
477
478 DEBUG(3,("msrpc_lookup_usergroups sid=%s\n", sid_string_dbg(user_sid)));
479
480 *pnum_groups = 0;
481
482 tmp_ctx = talloc_stackframe();
483 if (tmp_ctx == NULL) {
484 return NT_STATUS_NO_MEMORY;
485 }
486
487 /* Check if we have a cached user_info_3 */
488 status = lookup_usergroups_cached(domain,
489 tmp_ctx,
490 user_sid,
491 &num_groups,
492 &user_grpsids);
493 if (NT_STATUS_IS_OK(status)) {
494 goto cached;
495 }
496
497 if ( !winbindd_can_contact_domain( domain ) ) {
498 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
499 domain->name));
500
501 /* Tell the cache manager not to remember this one */
502 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
503 goto done;
504 }
505
506 /* no cache; hit the wire */
507 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
508 if (!NT_STATUS_IS_OK(status)) {
509 goto done;
510 }
511
512 status = rpc_lookup_usergroups(tmp_ctx,
513 samr_pipe,
514 &dom_pol,
515 &domain->sid,
516 user_sid,
517 &num_groups,
518 &user_grpsids);
519 if (!NT_STATUS_IS_OK(status)) {
520 goto done;
521 }
522
523 cached:
524 if (pnum_groups) {
525 *pnum_groups = num_groups;
526 }
527
528 if (puser_grpsids) {
529 *puser_grpsids = talloc_move(mem_ctx, &user_grpsids);
530 }
531
532 done:
533 TALLOC_FREE(tmp_ctx);
534 return status;
535 return NT_STATUS_OK;
536 }
537
538 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
539
540 static NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
541 TALLOC_CTX *mem_ctx,
542 uint32 num_sids, const struct dom_sid *sids,
543 uint32 *pnum_aliases,
544 uint32 **palias_rids)
545 {
546 struct rpc_pipe_client *samr_pipe;
547 struct policy_handle dom_pol;
548 uint32_t num_aliases = 0;
549 uint32_t *alias_rids = NULL;
550 TALLOC_CTX *tmp_ctx;
551 NTSTATUS status;
552
553 DEBUG(3,("msrpc_lookup_useraliases\n"));
554
555 if (pnum_aliases) {
556 *pnum_aliases = 0;
557 }
558
559 tmp_ctx = talloc_stackframe();
560 if (tmp_ctx == NULL) {
561 return NT_STATUS_NO_MEMORY;
562 }
563
564 if (!winbindd_can_contact_domain(domain)) {
565 DEBUG(10,("msrpc_lookup_useraliases: No incoming trust for domain %s\n",
566 domain->name));
567 /* Tell the cache manager not to remember this one */
568 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
569 goto done;
570 }
571
572 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
573 if (!NT_STATUS_IS_OK(status)) {
574 goto done;
575 }
576
577 status = rpc_lookup_useraliases(tmp_ctx,
578 samr_pipe,
579 &dom_pol,
580 num_sids,
581 sids,
582 &num_aliases,
583 &alias_rids);
584 if (!NT_STATUS_IS_OK(status)) {
585 goto done;
586 }
587
588 if (pnum_aliases) {
589 *pnum_aliases = num_aliases;
590 }
591
592 if (palias_rids) {
593 *palias_rids = talloc_move(mem_ctx, &alias_rids);
594 }
595
596 done:
597 TALLOC_FREE(tmp_ctx);
598 return status;
599 }
600
601
602 /* Lookup group membership given a rid. */
603 static NTSTATUS msrpc_lookup_groupmem(struct winbindd_domain *domain,
604 TALLOC_CTX *mem_ctx,
605 const struct dom_sid *group_sid,
606 enum lsa_SidType type,
607 uint32_t *num_names,
608 struct dom_sid **sid_mem,
609 char ***names,
610 uint32_t **name_types)
611 {
612 NTSTATUS status, result;
613 uint32 i, total_names = 0;
614 struct policy_handle dom_pol, group_pol;
615 uint32 des_access = SEC_FLAG_MAXIMUM_ALLOWED;
616 uint32 *rid_mem = NULL;
617 uint32 group_rid;
618 unsigned int j, r;
619 struct rpc_pipe_client *cli;
620 unsigned int orig_timeout;
621 struct samr_RidAttrArray *rids = NULL;
622 struct dcerpc_binding_handle *b;
623
624 DEBUG(3,("msrpc_lookup_groupmem: %s sid=%s\n", domain->name,
625 sid_string_dbg(group_sid)));
626
627 if ( !winbindd_can_contact_domain( domain ) ) {
628 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
629 domain->name));
630 return NT_STATUS_OK;
631 }
632
633 if (!sid_peek_check_rid(&domain->sid, group_sid, &group_rid))
634 return NT_STATUS_UNSUCCESSFUL;
635
636 *num_names = 0;
637
638 result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
639 if (!NT_STATUS_IS_OK(result))
640 return result;
641
642 b = cli->binding_handle;
643
644 status = dcerpc_samr_OpenGroup(b, mem_ctx,
645 &dom_pol,
646 des_access,
647 group_rid,
648 &group_pol,
649 &result);
650 if (!NT_STATUS_IS_OK(status)) {
651 return status;
652 }
653 if (!NT_STATUS_IS_OK(result)) {
654 return result;
655 }
656
657 /* Step #1: Get a list of user rids that are the members of the
658 group. */
659
660 /* This call can take a long time - allow the server to time out.
661 35 seconds should do it. */
662
663 orig_timeout = rpccli_set_timeout(cli, 35000);
664
665 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
666 &group_pol,
667 &rids,
668 &result);
669
670 /* And restore our original timeout. */
671 rpccli_set_timeout(cli, orig_timeout);
672
673 {
674 NTSTATUS _result;
675 dcerpc_samr_Close(b, mem_ctx, &group_pol, &_result);
676 }
677
678 if (!NT_STATUS_IS_OK(status)) {
679 return status;
680 }
681
682 if (!NT_STATUS_IS_OK(result)) {
683 return result;
684 }
685
686 if (!rids || !rids->count) {
687 names = NULL;
688 name_types = NULL;
689 sid_mem = NULL;
690 return NT_STATUS_OK;
691 }
692
693 *num_names = rids->count;
694 rid_mem = rids->rids;
695
696 /* Step #2: Convert list of rids into list of usernames. Do this
697 in bunches of ~1000 to avoid crashing NT4. It looks like there
698 is a buffer overflow or something like that lurking around
699 somewhere. */
700
701 #define MAX_LOOKUP_RIDS 900
702
703 *names = TALLOC_ZERO_ARRAY(mem_ctx, char *, *num_names);
704 *name_types = TALLOC_ZERO_ARRAY(mem_ctx, uint32, *num_names);
705 *sid_mem = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, *num_names);
706
707 for (j=0;j<(*num_names);j++)
708 sid_compose(&(*sid_mem)[j], &domain->sid, rid_mem[j]);
709
710 if (*num_names>0 && (!*names || !*name_types))
711 return NT_STATUS_NO_MEMORY;
712
713 for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
714 int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
715 struct lsa_Strings tmp_names;
716 struct samr_Ids tmp_types;
717
718 /* Lookup a chunk of rids */
719
720 status = dcerpc_samr_LookupRids(b, mem_ctx,
721 &dom_pol,
722 num_lookup_rids,
723 &rid_mem[i],
724 &tmp_names,
725 &tmp_types,
726 &result);
727 if (!NT_STATUS_IS_OK(status)) {
728 return status;
729 }
730
731 /* see if we have a real error (and yes the
732 STATUS_SOME_UNMAPPED is the one returned from 2k) */
733
734 if (!NT_STATUS_IS_OK(result) &&
735 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
736 return result;
737
738 /* Copy result into array. The talloc system will take
739 care of freeing the temporary arrays later on. */
740
741 if (tmp_names.count != tmp_types.count) {
742 return NT_STATUS_UNSUCCESSFUL;
743 }
744
745 for (r=0; r<tmp_names.count; r++) {
746 if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
747 continue;
748 }
749 (*names)[total_names] = fill_domain_username_talloc(
750 mem_ctx, domain->name,
751 tmp_names.names[r].string, true);
752 (*name_types)[total_names] = tmp_types.ids[r];
753 total_names += 1;
754 }
755 }
756
757 *num_names = total_names;
758
759 return NT_STATUS_OK;
760 }
761
762 #ifdef HAVE_LDAP
763
764 #include <ldap.h>
765
766 static int get_ldap_seq(const char *server, int port, uint32 *seq)
767 {
768 int ret = -1;
769 struct timeval to;
770 const char *attrs[] = {"highestCommittedUSN", NULL};
771 LDAPMessage *res = NULL;
772 char **values = NULL;
773 LDAP *ldp = NULL;
774
775 *seq = DOM_SEQUENCE_NONE;
776
777 /*
778 * Parameterised (5) second timeout on open. This is needed as the
779 * search timeout doesn't seem to apply to doing an open as well. JRA.
780 */
781
782 ldp = ldap_open_with_timeout(server, port, lp_ldap_timeout());
783 if (ldp == NULL)
784 return -1;
785
786 /* Timeout if no response within 20 seconds. */
787 to.tv_sec = 10;
788 to.tv_usec = 0;
789
790 if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)",
791 CONST_DISCARD(char **, attrs), 0, &to, &res))
792 goto done;
793
794 if (ldap_count_entries(ldp, res) != 1)
795 goto done;
796
797 values = ldap_get_values(ldp, res, "highestCommittedUSN");
798 if (!values || !values[0])
799 goto done;
800
801 *seq = atoi(values[0]);
802 ret = 0;
803
804 done:
805
806 if (values)
807 ldap_value_free(values);
808 if (res)
809 ldap_msgfree(res);
810 if (ldp)
811 ldap_unbind(ldp);
812 return ret;
813 }
814
815 /**********************************************************************
816 Get the sequence number for a Windows AD native mode domain using
817 LDAP queries.
818 **********************************************************************/
819
820 static int get_ldap_sequence_number(struct winbindd_domain *domain, uint32 *seq)
821 {
822 int ret = -1;
823 char addr[INET6_ADDRSTRLEN];
824
825 print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
826 if ((ret = get_ldap_seq(addr, LDAP_PORT, seq)) == 0) {
827 DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence "
828 "number for Domain (%s) from DC (%s)\n",
829 domain->name, addr));
830 }
831 return ret;
832 }
833
834 #endif /* HAVE_LDAP */
835
836 /* find the sequence number for a domain */
837 static NTSTATUS msrpc_sequence_number(struct winbindd_domain *domain,
838 uint32_t *pseq)
839 {
840 struct rpc_pipe_client *samr_pipe;
841 struct policy_handle dom_pol;
842 uint32_t seq;
843 TALLOC_CTX *tmp_ctx;
844 NTSTATUS status;
845
846 DEBUG(3, ("msrpc_sequence_number: fetch sequence_number for %s\n", domain->name));
847
848 if (pseq) {
849 *pseq = DOM_SEQUENCE_NONE;
850 }
851
852 tmp_ctx = talloc_stackframe();
853 if (tmp_ctx == NULL) {
854 return NT_STATUS_NO_MEMORY;
855 }
856
857 if ( !winbindd_can_contact_domain( domain ) ) {
858 DEBUG(10,("sequence_number: No incoming trust for domain %s\n",
859 domain->name));
860 if (pseq) {
861 *pseq = time(NULL);
862 }
863 status = NT_STATUS_OK;
864 goto done;
865 }
866
867 #ifdef HAVE_LDAP
868 if (domain->active_directory) {
869 int rc;
870
871 DEBUG(8,("using get_ldap_seq() to retrieve the "
872 "sequence number\n"));
873
874 rc = get_ldap_sequence_number(domain, &seq);
875 if (rc == 0) {
876 DEBUG(10,("domain_sequence_number: LDAP for "
877 "domain %s is %u\n",
878 domain->name, seq));
879
880 if (pseq) {
881 *pseq = seq;
882 }
883
884 status = NT_STATUS_OK;
885 goto done;
886 }
887
888 DEBUG(10,("domain_sequence_number: failed to get LDAP "
889 "sequence number for domain %s\n",
890 domain->name ));
891 }
892 #endif /* HAVE_LDAP */
893
894 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
895 if (!NT_STATUS_IS_OK(status)) {
896 goto done;
897 }
898
899 status = rpc_sequence_number(tmp_ctx,
900 samr_pipe,
901 &dom_pol,
902 domain->name,
903 &seq);
904 if (!NT_STATUS_IS_OK(status)) {
905 goto done;
906 }
907
908 if (pseq) {
909 *pseq = seq;
910 }
911
912 done:
913 TALLOC_FREE(tmp_ctx);
914 return status;
915 }
916
917 /* get a list of trusted domains */
918 static NTSTATUS msrpc_trusted_domains(struct winbindd_domain *domain,
919 TALLOC_CTX *mem_ctx,
920 struct netr_DomainTrustList *ptrust_list)
921 {
922 struct rpc_pipe_client *lsa_pipe;
923 struct policy_handle lsa_policy;
924 struct netr_DomainTrust *trusts = NULL;
925 uint32_t num_trusts = 0;
926 TALLOC_CTX *tmp_ctx;
927 NTSTATUS status;
928
929 DEBUG(3,("msrpc_trusted_domains\n"));
930
931 if (ptrust_list) {
932 ZERO_STRUCTP(ptrust_list);
933 }
934
935 tmp_ctx = talloc_stackframe();
936 if (tmp_ctx == NULL) {
937 return NT_STATUS_NO_MEMORY;
938 }
939
940 status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
941 if (!NT_STATUS_IS_OK(status))
942 return status;
943
944 status = rpc_trusted_domains(tmp_ctx,
945 lsa_pipe,
946 &lsa_policy,
947 &num_trusts,
948 &trusts);
949 if (!NT_STATUS_IS_OK(status)) {
950 goto done;
951 }
952
953 if (ptrust_list) {
954 ptrust_list->count = num_trusts;
955 ptrust_list->array = talloc_move(mem_ctx, &trusts);
956 }
957
958 done:
959 TALLOC_FREE(tmp_ctx);
960 return status;
961 }
962
963 /* find the lockout policy for a domain */
964 static NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
965 TALLOC_CTX *mem_ctx,
966 struct samr_DomInfo12 *lockout_policy)
967 {
968 NTSTATUS status, result;
969 struct rpc_pipe_client *cli;
970 struct policy_handle dom_pol;
971 union samr_DomainInfo *info = NULL;
972 struct dcerpc_binding_handle *b;
973
974 DEBUG(3, ("msrpc_lockout_policy: fetch lockout policy for %s\n", domain->name));
975
976 if ( !winbindd_can_contact_domain( domain ) ) {
977 DEBUG(10,("msrpc_lockout_policy: No incoming trust for domain %s\n",
978 domain->name));
979 return NT_STATUS_NOT_SUPPORTED;
980 }
981
982 status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
983 if (!NT_STATUS_IS_OK(status)) {
984 goto done;
985 }
986
987 b = cli->binding_handle;
988
989 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
990 &dom_pol,
991 12,
992 &info,
993 &result);
994 if (!NT_STATUS_IS_OK(status)) {
995 goto done;
996 }
997 if (!NT_STATUS_IS_OK(result)) {
998 status = result;
999 goto done;
1000 }
1001
1002 *lockout_policy = info->info12;
1003
1004 DEBUG(10,("msrpc_lockout_policy: lockout_threshold %d\n",
1005 info->info12.lockout_threshold));
1006
1007 done:
1008
1009 return status;
1010 }
1011
1012 /* find the password policy for a domain */
1013 static NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
1014 TALLOC_CTX *mem_ctx,
1015 struct samr_DomInfo1 *password_policy)
1016 {
1017 NTSTATUS status, result;
1018 struct rpc_pipe_client *cli;
1019 struct policy_handle dom_pol;
1020 union samr_DomainInfo *info = NULL;
1021 struct dcerpc_binding_handle *b;
1022
1023 DEBUG(3, ("msrpc_password_policy: fetch password policy for %s\n",
1024 domain->name));
1025
1026 if ( !winbindd_can_contact_domain( domain ) ) {
1027 DEBUG(10,("msrpc_password_policy: No incoming trust for domain %s\n",
1028 domain->name));
1029 return NT_STATUS_NOT_SUPPORTED;
1030 }
1031
1032 status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
1033 if (!NT_STATUS_IS_OK(status)) {
1034 goto done;
1035 }
1036
1037 b = cli->binding_handle;
1038
1039 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
1040 &dom_pol,
1041 1,
1042 &info,
1043 &result);
1044 if (!NT_STATUS_IS_OK(status)) {
1045 goto done;
1046 }
1047 if (!NT_STATUS_IS_OK(result)) {
1048 goto done;
1049 }
1050
1051 *password_policy = info->info1;
1052
1053 DEBUG(10,("msrpc_password_policy: min_length_password %d\n",
1054 info->info1.min_password_length));
1055
1056 done:
1057
1058 return status;
1059 }
1060
1061 typedef NTSTATUS (*lookup_sids_fn_t)(struct rpc_pipe_client *cli,
1062 TALLOC_CTX *mem_ctx,
1063 struct policy_handle *pol,
1064 int num_sids,
1065 const struct dom_sid *sids,
1066 char ***pdomains,
1067 char ***pnames,
1068 enum lsa_SidType **ptypes);
1069
1070 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
1071 struct winbindd_domain *domain,
1072 uint32_t num_sids,
1073 const struct dom_sid *sids,
1074 char ***domains,
1075 char ***names,
1076 enum lsa_SidType **types)
1077 {
1078 NTSTATUS status;
1079 struct rpc_pipe_client *cli = NULL;
1080 struct policy_handle lsa_policy;
1081 unsigned int orig_timeout;
1082 lookup_sids_fn_t lookup_sids_fn = rpccli_lsa_lookup_sids;
1083
1084 if (domain->can_do_ncacn_ip_tcp) {
1085 status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
1086 if (NT_STATUS_IS_OK(status)) {
1087 lookup_sids_fn = rpccli_lsa_lookup_sids3;
1088 goto lookup;
1089 }
1090 domain->can_do_ncacn_ip_tcp = false;
1091 }
1092 status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
1093
1094 if (!NT_STATUS_IS_OK(status)) {
1095 return status;
1096 }
1097
1098 lookup:
1099 /*
1100 * This call can take a long time
1101 * allow the server to time out.
1102 * 35 seconds should do it.
1103 */
1104 orig_timeout = rpccli_set_timeout(cli, 35000);
1105
1106 status = lookup_sids_fn(cli,
1107 mem_ctx,
1108 &lsa_policy,
1109 num_sids,
1110 sids,
1111 domains,
1112 names,
1113 types);
1114
1115 /* And restore our original timeout. */
1116 rpccli_set_timeout(cli, orig_timeout);
1117
1118 if (NT_STATUS_V(status) == DCERPC_FAULT_ACCESS_DENIED ||
1119 NT_STATUS_V(status) == DCERPC_FAULT_SEC_PKG_ERROR) {
1120 /*
1121 * This can happen if the schannel key is not
1122 * valid anymore, we need to invalidate the
1123 * all connections to the dc and reestablish
1124 * a netlogon connection first.
1125 */
1126 invalidate_cm_connection(&domain->conn);
1127 status = NT_STATUS_ACCESS_DENIED;
1128 }
1129
1130 if (!NT_STATUS_IS_OK(status)) {
1131 return status;
1132 }
1133
1134 return status;
1135 }
1136
1137 typedef NTSTATUS (*lookup_names_fn_t)(struct rpc_pipe_client *cli,
1138 TALLOC_CTX *mem_ctx,
1139 struct policy_handle *pol,
1140 int num_names,
1141 const char **names,
1142 const char ***dom_names,
1143 int level,
1144 struct dom_sid **sids,
1145 enum lsa_SidType **types);
1146
1147 NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
1148 struct winbindd_domain *domain,
1149 uint32_t num_names,
1150 const char **names,
1151 const char ***domains,
1152 struct dom_sid **sids,
1153 enum lsa_SidType **types)
1154 {
1155 NTSTATUS status;
1156 struct rpc_pipe_client *cli = NULL;
1157 struct policy_handle lsa_policy;
1158 unsigned int orig_timeout = 0;
1159 lookup_names_fn_t lookup_names_fn = rpccli_lsa_lookup_names;
1160
1161 if (domain->can_do_ncacn_ip_tcp) {
1162 status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
1163 if (NT_STATUS_IS_OK(status)) {
1164 lookup_names_fn = rpccli_lsa_lookup_names4;
1165 goto lookup;
1166 }
1167 domain->can_do_ncacn_ip_tcp = false;
1168 }
1169 status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
1170
1171 if (!NT_STATUS_IS_OK(status)) {
1172 return status;
1173 }
1174
1175 lookup:
1176
1177 /*
1178 * This call can take a long time
1179 * allow the server to time out.
1180 * 35 seconds should do it.
1181 */
1182 orig_timeout = rpccli_set_timeout(cli, 35000);
1183
1184 status = lookup_names_fn(cli,
1185 mem_ctx,
1186 &lsa_policy,
1187 num_names,
1188 (const char **) names,
1189 domains,
1190 1,
1191 sids,
1192 types);
1193
1194 /* And restore our original timeout. */
1195 rpccli_set_timeout(cli, orig_timeout);
1196
1197 if (NT_STATUS_V(status) == DCERPC_FAULT_ACCESS_DENIED ||
1198 NT_STATUS_V(status) == DCERPC_FAULT_SEC_PKG_ERROR) {
1199 /*
1200 * This can happen if the schannel key is not
1201 * valid anymore, we need to invalidate the
1202 * all connections to the dc and reestablish
1203 * a netlogon connection first.
1204 */
1205 invalidate_cm_connection(&domain->conn);
1206 status = NT_STATUS_ACCESS_DENIED;
1207 }
1208
1209 if (!NT_STATUS_IS_OK(status)) {
1210 return status;
1211 }
1212
1213 return status;
1214 }
1215
1216 /* the rpc backend methods are exposed via this structure */
1217 struct winbindd_methods msrpc_methods = {
1218 False,
1219 msrpc_query_user_list,
1220 msrpc_enum_dom_groups,
1221 msrpc_enum_local_groups,
1222 msrpc_name_to_sid,
1223 msrpc_sid_to_name,
1224 msrpc_rids_to_names,
1225 msrpc_query_user,
1226 msrpc_lookup_usergroups,
1227 msrpc_lookup_useraliases,
1228 msrpc_lookup_groupmem,
1229 msrpc_sequence_number,
1230 msrpc_lockout_policy,
1231 msrpc_password_policy,
1232 msrpc_trusted_domains,
1233 };
Samba GIT mirror