?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-net: Check return value of string_to_sid().
[Samba/bb.git] / source3 / utils / net_rpc.c
blob2ccc92876bc2a43c1102d991d6cf71ad2b401ac0
1 /*
2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
22
23 #include "includes.h"
24 #include "utils/net.h"
25 #include "rpc_client/cli_pipe.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_samr_c.h"
28 #include "rpc_client/cli_samr.h"
29 #include "rpc_client/init_samr.h"
30 #include "../librpc/gen_ndr/ndr_lsa_c.h"
31 #include "rpc_client/cli_lsarpc.h"
32 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
34 #include "../librpc/gen_ndr/ndr_spoolss.h"
35 #include "../librpc/gen_ndr/ndr_initshutdown_c.h"
36 #include "../librpc/gen_ndr/ndr_winreg_c.h"
37 #include "secrets.h"
38 #include "lib/netapi/netapi.h"
39 #include "lib/netapi/netapi_net.h"
40 #include "rpc_client/init_lsa.h"
41 #include "../libcli/security/security.h"
42 #include "libsmb/libsmb.h"
43 #include "libsmb/clirap.h"
44 #include "nsswitch/libwbclient/wbclient.h"
45 #include "passdb.h"
46 #include "../libcli/smb/smbXcli_base.h"
47
48 static int net_mode_share;
49 static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask);
50
51 /**
52 * @file net_rpc.c
53 *
54 * @brief RPC based subcommands for the 'net' utility.
55 *
56 * This file should contain much of the functionality that used to
57 * be found in rpcclient, execpt that the commands should change
58 * less often, and the fucntionality should be sane (the user is not
59 * expected to know a rid/sid before they conduct an operation etc.)
60 *
61 * @todo Perhaps eventually these should be split out into a number
62 * of files, as this could get quite big.
63 **/
64
65
66 /**
67 * Many of the RPC functions need the domain sid. This function gets
68 * it at the start of every run
69 *
70 * @param cli A cli_state already connected to the remote machine
71 *
72 * @return The Domain SID of the remote machine.
73 **/
74
75 NTSTATUS net_get_remote_domain_sid(struct cli_state *cli, TALLOC_CTX *mem_ctx,
76 struct dom_sid **domain_sid,
77 const char **domain_name)
78 {
79 struct rpc_pipe_client *lsa_pipe = NULL;
80 struct policy_handle pol;
81 NTSTATUS status, result;
82 union lsa_PolicyInformation *info = NULL;
83 struct dcerpc_binding_handle *b;
84
85 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
86 &lsa_pipe);
87 if (!NT_STATUS_IS_OK(status)) {
88 d_fprintf(stderr, _("Could not initialise lsa pipe\n"));
89 return status;
90 }
91
92 b = lsa_pipe->binding_handle;
93
94 status = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, false,
95 SEC_FLAG_MAXIMUM_ALLOWED,
96 &pol);
97 if (!NT_STATUS_IS_OK(status)) {
98 d_fprintf(stderr, "open_policy %s: %s\n",
99 _("failed"),
100 nt_errstr(status));
101 return status;
102 }
103
104 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
105 &pol,
106 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
107 &info,
108 &result);
109 if (!NT_STATUS_IS_OK(status)) {
110 d_fprintf(stderr, "lsaquery %s: %s\n",
111 _("failed"),
112 nt_errstr(status));
113 return status;
114 }
115 if (!NT_STATUS_IS_OK(result)) {
116 d_fprintf(stderr, "lsaquery %s: %s\n",
117 _("failed"),
118 nt_errstr(result));
119 return result;
120 }
121
122 *domain_name = info->account_domain.name.string;
123 *domain_sid = info->account_domain.sid;
124
125 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
126 TALLOC_FREE(lsa_pipe);
127
128 return NT_STATUS_OK;
129 }
130
131 /**
132 * Run a single RPC command, from start to finish.
133 *
134 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
135 * @param conn_flag a NET_FLAG_ combination. Passed to
136 * net_make_ipc_connection.
137 * @param argc Standard main() style argc.
138 * @param argv Standard main() style argv. Initial components are already
139 * stripped.
140 * @return A shell status integer (0 for success).
141 */
142
143 int run_rpc_command(struct net_context *c,
144 struct cli_state *cli_arg,
145 const struct ndr_interface_table *table,
146 int conn_flags,
147 rpc_command_fn fn,
148 int argc,
149 const char **argv)
150 {
151 struct cli_state *cli = NULL;
152 struct rpc_pipe_client *pipe_hnd = NULL;
153 TALLOC_CTX *mem_ctx;
154 NTSTATUS nt_status;
155 struct dom_sid *domain_sid;
156 const char *domain_name;
157 int ret = -1;
158
159 /* make use of cli_state handed over as an argument, if possible */
160 if (!cli_arg) {
161 nt_status = net_make_ipc_connection(c, conn_flags, &cli);
162 if (!NT_STATUS_IS_OK(nt_status)) {
163 DEBUG(1, ("failed to make ipc connection: %s\n",
164 nt_errstr(nt_status)));
165 return -1;
166 }
167 } else {
168 cli = cli_arg;
169 }
170
171 if (!cli) {
172 return -1;
173 }
174
175 /* Create mem_ctx */
176
177 if (!(mem_ctx = talloc_init("run_rpc_command"))) {
178 DEBUG(0, ("talloc_init() failed\n"));
179 goto fail;
180 }
181
182 nt_status = net_get_remote_domain_sid(cli, mem_ctx, &domain_sid,
183 &domain_name);
184 if (!NT_STATUS_IS_OK(nt_status)) {
185 goto fail;
186 }
187
188 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
189 if (lp_client_schannel()
190 && (ndr_syntax_id_equal(&table->syntax_id,
191 &ndr_table_netlogon.syntax_id))) {
192 /* Always try and create an schannel netlogon pipe. */
193 nt_status = cli_rpc_pipe_open_schannel(
194 cli, &table->syntax_id, NCACN_NP,
195 DCERPC_AUTH_LEVEL_PRIVACY, domain_name,
196 &pipe_hnd);
197 if (!NT_STATUS_IS_OK(nt_status)) {
198 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
199 nt_errstr(nt_status) ));
200 goto fail;
201 }
202 } else {
203 if (conn_flags & NET_FLAGS_SEAL) {
204 nt_status = cli_rpc_pipe_open_generic_auth(
205 cli, table,
206 (conn_flags & NET_FLAGS_TCP) ?
207 NCACN_IP_TCP : NCACN_NP,
208 DCERPC_AUTH_TYPE_NTLMSSP,
209 DCERPC_AUTH_LEVEL_PRIVACY,
210 smbXcli_conn_remote_name(cli->conn),
211 lp_workgroup(), c->opt_user_name,
212 c->opt_password, &pipe_hnd);
213 } else {
214 nt_status = cli_rpc_pipe_open_noauth(
215 cli, &table->syntax_id,
216 &pipe_hnd);
217 }
218 if (!NT_STATUS_IS_OK(nt_status)) {
219 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
220 table->name,
221 nt_errstr(nt_status) ));
222 goto fail;
223 }
224 }
225 }
226
227 nt_status = fn(c, domain_sid, domain_name, cli, pipe_hnd, mem_ctx, argc, argv);
228
229 if (!NT_STATUS_IS_OK(nt_status)) {
230 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status)));
231 } else {
232 ret = 0;
233 DEBUG(5, ("rpc command function succedded\n"));
234 }
235
236 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
237 if (pipe_hnd) {
238 TALLOC_FREE(pipe_hnd);
239 }
240 }
241
242 fail:
243 /* close the connection only if it was opened here */
244 if (!cli_arg) {
245 cli_shutdown(cli);
246 }
247
248 talloc_destroy(mem_ctx);
249 return ret;
250 }
251
252 /**
253 * Force a change of the trust acccount password.
254 *
255 * All parameters are provided by the run_rpc_command function, except for
256 * argc, argv which are passed through.
257 *
258 * @param domain_sid The domain sid acquired from the remote server.
259 * @param cli A cli_state connected to the server.
260 * @param mem_ctx Talloc context, destroyed on completion of the function.
261 * @param argc Standard main() style argc.
262 * @param argv Standard main() style argv. Initial components are already
263 * stripped.
264 *
265 * @return Normal NTSTATUS return.
266 **/
267
268 static NTSTATUS rpc_changetrustpw_internals(struct net_context *c,
269 const struct dom_sid *domain_sid,
270 const char *domain_name,
271 struct cli_state *cli,
272 struct rpc_pipe_client *pipe_hnd,
273 TALLOC_CTX *mem_ctx,
274 int argc,
275 const char **argv)
276 {
277 NTSTATUS status;
278
279 status = trust_pw_find_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup);
280 if (!NT_STATUS_IS_OK(status)) {
281 d_fprintf(stderr, _("Failed to change machine account password: %s\n"),
282 nt_errstr(status));
283 return status;
284 }
285
286 return NT_STATUS_OK;
287 }
288
289 /**
290 * Force a change of the trust acccount password.
291 *
292 * @param argc Standard main() style argc.
293 * @param argv Standard main() style argv. Initial components are already
294 * stripped.
295 *
296 * @return A shell status integer (0 for success).
297 **/
298
299 int net_rpc_changetrustpw(struct net_context *c, int argc, const char **argv)
300 {
301 if (c->display_usage) {
302 d_printf( "%s\n"
303 "net rpc changetrustpw\n"
304 " %s\n",
305 _("Usage:"),
306 _("Change the machine trust password"));
307 return 0;
308 }
309
310 return run_rpc_command(c, NULL, &ndr_table_netlogon,
311 NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
312 rpc_changetrustpw_internals,
313 argc, argv);
314 }
315
316 /**
317 * Join a domain, the old way.
318 *
319 * This uses 'machinename' as the inital password, and changes it.
320 *
321 * The password should be created with 'server manager' or equiv first.
322 *
323 * All parameters are provided by the run_rpc_command function, except for
324 * argc, argv which are passed through.
325 *
326 * @param domain_sid The domain sid acquired from the remote server.
327 * @param cli A cli_state connected to the server.
328 * @param mem_ctx Talloc context, destroyed on completion of the function.
329 * @param argc Standard main() style argc.
330 * @param argv Standard main() style argv. Initial components are already
331 * stripped.
332 *
333 * @return Normal NTSTATUS return.
334 **/
335
336 static NTSTATUS rpc_oldjoin_internals(struct net_context *c,
337 const struct dom_sid *domain_sid,
338 const char *domain_name,
339 struct cli_state *cli,
340 struct rpc_pipe_client *pipe_hnd,
341 TALLOC_CTX *mem_ctx,
342 int argc,
343 const char **argv)
344 {
345
346 fstring trust_passwd;
347 unsigned char orig_trust_passwd_hash[16];
348 NTSTATUS result;
349 enum netr_SchannelType sec_channel_type;
350
351 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
352 &pipe_hnd);
353 if (!NT_STATUS_IS_OK(result)) {
354 DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
355 "error was %s\n",
356 smbXcli_conn_remote_name(cli->conn),
357 nt_errstr(result) ));
358 return result;
359 }
360
361 /*
362 check what type of join - if the user want's to join as
363 a BDC, the server must agree that we are a BDC.
364 */
365 if (argc >= 0) {
366 sec_channel_type = get_sec_channel_type(argv[0]);
367 } else {
368 sec_channel_type = get_sec_channel_type(NULL);
369 }
370
371 fstrcpy(trust_passwd, lp_netbios_name());
372 strlower_m(trust_passwd);
373
374 /*
375 * Machine names can be 15 characters, but the max length on
376 * a password is 14. --jerry
377 */
378
379 trust_passwd[14] = '\0';
380
381 E_md4hash(trust_passwd, orig_trust_passwd_hash);
382
383 result = trust_pw_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup,
384 lp_netbios_name(),
385 orig_trust_passwd_hash,
386 sec_channel_type);
387
388 if (NT_STATUS_IS_OK(result))
389 printf(_("Joined domain %s.\n"), c->opt_target_workgroup);
390
391
392 if (!secrets_store_domain_sid(c->opt_target_workgroup, domain_sid)) {
393 DEBUG(0, ("error storing domain sid for %s\n", c->opt_target_workgroup));
394 result = NT_STATUS_UNSUCCESSFUL;
395 }
396
397 return result;
398 }
399
400 /**
401 * Join a domain, the old way.
402 *
403 * @param argc Standard main() style argc.
404 * @param argv Standard main() style argv. Initial components are already
405 * stripped.
406 *
407 * @return A shell status integer (0 for success).
408 **/
409
410 static int net_rpc_perform_oldjoin(struct net_context *c, int argc, const char **argv)
411 {
412 return run_rpc_command(c, NULL, &ndr_table_netlogon,
413 NET_FLAGS_NO_PIPE | NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
414 rpc_oldjoin_internals,
415 argc, argv);
416 }
417
418 /**
419 * Join a domain, the old way. This function exists to allow
420 * the message to be displayed when oldjoin was explicitly
421 * requested, but not when it was implied by "net rpc join".
422 *
423 * @param argc Standard main() style argc.
424 * @param argv Standard main() style argv. Initial components are already
425 * stripped.
426 *
427 * @return A shell status integer (0 for success).
428 **/
429
430 static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)
431 {
432 int rc = -1;
433
434 if (c->display_usage) {
435 d_printf( "%s\n"
436 "net rpc oldjoin\n"
437 " %s\n",
438 _("Usage:"),
439 _("Join a domain the old way"));
440 return 0;
441 }
442
443 rc = net_rpc_perform_oldjoin(c, argc, argv);
444
445 if (rc) {
446 d_fprintf(stderr, _("Failed to join domain\n"));
447 }
448
449 return rc;
450 }
451
452 /**
453 * 'net rpc join' entrypoint.
454 * @param argc Standard main() style argc.
455 * @param argv Standard main() style argv. Initial components are already
456 * stripped
457 *
458 * Main 'net_rpc_join()' (where the admin username/password is used) is
459 * in net_rpc_join.c.
460 * Try to just change the password, but if that doesn't work, use/prompt
461 * for a username/password.
462 **/
463
464 int net_rpc_join(struct net_context *c, int argc, const char **argv)
465 {
466 if (c->display_usage) {
467 d_printf("%s\n%s",
468 _("Usage:"),
469 _("net rpc join -U <username>[%%password] <type>\n"
470 " Join a domain\n"
471 " username\tName of the admin user"
472 " password\tPassword of the admin user, will "
473 "prompt if not specified\n"
474 " type\tCan be one of the following:\n"
475 "\t\tMEMBER\tJoin as member server (default)\n"
476 "\t\tBDC\tJoin as BDC\n"
477 "\t\tPDC\tJoin as PDC\n"));
478 return 0;
479 }
480
481 if (lp_server_role() == ROLE_STANDALONE) {
482 d_printf(_("cannot join as standalone machine\n"));
483 return -1;
484 }
485
486 if (strlen(lp_netbios_name()) > 15) {
487 d_printf(_("Our netbios name can be at most 15 chars long, "
488 "\"%s\" is %u chars long\n"),
489 lp_netbios_name(), (unsigned int)strlen(lp_netbios_name()));
490 return -1;
491 }
492
493 if ((net_rpc_perform_oldjoin(c, argc, argv) == 0))
494 return 0;
495
496 return net_rpc_join_newstyle(c, argc, argv);
497 }
498
499 /**
500 * display info about a rpc domain
501 *
502 * All parameters are provided by the run_rpc_command function, except for
503 * argc, argv which are passed through.
504 *
505 * @param domain_sid The domain sid acquired from the remote server
506 * @param cli A cli_state connected to the server.
507 * @param mem_ctx Talloc context, destroyed on completion of the function.
508 * @param argc Standard main() style argc.
509 * @param argv Standard main() style argv. Initial components are already
510 * stripped.
511 *
512 * @return Normal NTSTATUS return.
513 **/
514
515 NTSTATUS rpc_info_internals(struct net_context *c,
516 const struct dom_sid *domain_sid,
517 const char *domain_name,
518 struct cli_state *cli,
519 struct rpc_pipe_client *pipe_hnd,
520 TALLOC_CTX *mem_ctx,
521 int argc,
522 const char **argv)
523 {
524 struct policy_handle connect_pol, domain_pol;
525 NTSTATUS status, result;
526 union samr_DomainInfo *info = NULL;
527 fstring sid_str;
528 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
529
530 sid_to_fstring(sid_str, domain_sid);
531
532 /* Get sam policy handle */
533 status = dcerpc_samr_Connect2(b, mem_ctx,
534 pipe_hnd->desthost,
535 MAXIMUM_ALLOWED_ACCESS,
536 &connect_pol,
537 &result);
538 if (!NT_STATUS_IS_OK(status)) {
539 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
540 nt_errstr(status));
541 goto done;
542 }
543
544 if (!NT_STATUS_IS_OK(result)) {
545 status = result;
546 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
547 nt_errstr(result));
548 goto done;
549 }
550
551 /* Get domain policy handle */
552 status = dcerpc_samr_OpenDomain(b, mem_ctx,
553 &connect_pol,
554 MAXIMUM_ALLOWED_ACCESS,
555 discard_const_p(struct dom_sid2, domain_sid),
556 &domain_pol,
557 &result);
558 if (!NT_STATUS_IS_OK(status)) {
559 d_fprintf(stderr, _("Could not open domain: %s\n"),
560 nt_errstr(status));
561 goto done;
562 }
563 if (!NT_STATUS_IS_OK(result)) {
564 status = result;
565 d_fprintf(stderr, _("Could not open domain: %s\n"),
566 nt_errstr(result));
567 goto done;
568 }
569
570 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
571 &domain_pol,
572 2,
573 &info,
574 &result);
575 if (!NT_STATUS_IS_OK(status)) {
576 goto done;
577 }
578 status = result;
579 if (NT_STATUS_IS_OK(result)) {
580 d_printf(_("Domain Name: %s\n"),
581 info->general.domain_name.string);
582 d_printf(_("Domain SID: %s\n"), sid_str);
583 d_printf(_("Sequence number: %llu\n"),
584 (unsigned long long)info->general.sequence_num);
585 d_printf(_("Num users: %u\n"), info->general.num_users);
586 d_printf(_("Num domain groups: %u\n"),info->general.num_groups);
587 d_printf(_("Num local groups: %u\n"),info->general.num_aliases);
588 }
589
590 done:
591 return status;
592 }
593
594 /**
595 * 'net rpc info' entrypoint.
596 * @param argc Standard main() style argc.
597 * @param argv Standard main() style argv. Initial components are already
598 * stripped.
599 **/
600
601 int net_rpc_info(struct net_context *c, int argc, const char **argv)
602 {
603 if (c->display_usage) {
604 d_printf( "%s\n"
605 "net rpc info\n"
606 " %s\n",
607 _("Usage:"),
608 _("Display information about the domain"));
609 return 0;
610 }
611
612 return run_rpc_command(c, NULL, &ndr_table_samr,
613 NET_FLAGS_PDC, rpc_info_internals,
614 argc, argv);
615 }
616
617 /**
618 * Fetch domain SID into the local secrets.tdb.
619 *
620 * All parameters are provided by the run_rpc_command function, except for
621 * argc, argv which are passed through.
622 *
623 * @param domain_sid The domain sid acquired from the remote server.
624 * @param cli A cli_state connected to the server.
625 * @param mem_ctx Talloc context, destroyed on completion of the function.
626 * @param argc Standard main() style argc.
627 * @param argv Standard main() style argv. Initial components are already
628 * stripped.
629 *
630 * @return Normal NTSTATUS return.
631 **/
632
633 static NTSTATUS rpc_getsid_internals(struct net_context *c,
634 const struct dom_sid *domain_sid,
635 const char *domain_name,
636 struct cli_state *cli,
637 struct rpc_pipe_client *pipe_hnd,
638 TALLOC_CTX *mem_ctx,
639 int argc,
640 const char **argv)
641 {
642 fstring sid_str;
643
644 sid_to_fstring(sid_str, domain_sid);
645 d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
646 sid_str, domain_name);
647
648 if (!secrets_store_domain_sid(domain_name, domain_sid)) {
649 DEBUG(0,("Can't store domain SID\n"));
650 return NT_STATUS_UNSUCCESSFUL;
651 }
652
653 return NT_STATUS_OK;
654 }
655
656 /**
657 * 'net rpc getsid' entrypoint.
658 * @param argc Standard main() style argc.
659 * @param argv Standard main() style argv. Initial components are already
660 * stripped.
661 **/
662
663 int net_rpc_getsid(struct net_context *c, int argc, const char **argv)
664 {
665 int conn_flags = NET_FLAGS_PDC;
666
667 if (!c->opt_user_specified) {
668 conn_flags |= NET_FLAGS_ANONYMOUS;
669 }
670
671 if (c->display_usage) {
672 d_printf( "%s\n"
673 "net rpc getsid\n"
674 " %s\n",
675 _("Usage:"),
676 _("Fetch domain SID into local secrets.tdb"));
677 return 0;
678 }
679
680 return run_rpc_command(c, NULL, &ndr_table_samr,
681 conn_flags,
682 rpc_getsid_internals,
683 argc, argv);
684 }
685
686 /****************************************************************************/
687
688 /**
689 * Basic usage function for 'net rpc user'.
690 * @param argc Standard main() style argc.
691 * @param argv Standard main() style argv. Initial components are already
692 * stripped.
693 **/
694
695 static int rpc_user_usage(struct net_context *c, int argc, const char **argv)
696 {
697 return net_user_usage(c, argc, argv);
698 }
699
700 /**
701 * Add a new user to a remote RPC server.
702 *
703 * @param argc Standard main() style argc.
704 * @param argv Standard main() style argv. Initial components are already
705 * stripped.
706 *
707 * @return A shell status integer (0 for success).
708 **/
709
710 static int rpc_user_add(struct net_context *c, int argc, const char **argv)
711 {
712 NET_API_STATUS status;
713 struct USER_INFO_1 info1;
714 uint32_t parm_error = 0;
715
716 if (argc < 1 || c->display_usage) {
717 rpc_user_usage(c, argc, argv);
718 return 0;
719 }
720
721 ZERO_STRUCT(info1);
722
723 info1.usri1_name = argv[0];
724 if (argc == 2) {
725 info1.usri1_password = argv[1];
726 }
727
728 status = NetUserAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
729
730 if (status != 0) {
731 d_fprintf(stderr,_("Failed to add user '%s' with error: %s.\n"),
732 argv[0], libnetapi_get_error_string(c->netapi_ctx,
733 status));
734 return -1;
735 } else {
736 d_printf(_("Added user '%s'.\n"), argv[0]);
737 }
738
739 return 0;
740 }
741
742 /**
743 * Rename a user on a remote RPC server.
744 *
745 * @param argc Standard main() style argc.
746 * @param argv Standard main() style argv. Initial components are already
747 * stripped.
748 *
749 * @return A shell status integer (0 for success).
750 **/
751
752 static int rpc_user_rename(struct net_context *c, int argc, const char **argv)
753 {
754 NET_API_STATUS status;
755 struct USER_INFO_0 u0;
756 uint32_t parm_err = 0;
757
758 if (argc != 2 || c->display_usage) {
759 rpc_user_usage(c, argc, argv);
760 return 0;
761 }
762
763 u0.usri0_name = argv[1];
764
765 status = NetUserSetInfo(c->opt_host, argv[0],
766 0, (uint8_t *)&u0, &parm_err);
767 if (status) {
768 d_fprintf(stderr,
769 _("Failed to rename user from %s to %s - %s\n"),
770 argv[0], argv[1],
771 libnetapi_get_error_string(c->netapi_ctx, status));
772 } else {
773 d_printf(_("Renamed user from %s to %s\n"), argv[0], argv[1]);
774 }
775
776 return status;
777 }
778
779 /**
780 * Set a user's primary group
781 *
782 * @param argc Standard main() style argc.
783 * @param argv Standard main() style argv. Initial components are already
784 * stripped.
785 *
786 * @return A shell status integer (0 for success).
787 **/
788
789 static int rpc_user_setprimarygroup(struct net_context *c, int argc,
790 const char **argv)
791 {
792 NET_API_STATUS status;
793 uint8_t *buffer;
794 struct GROUP_INFO_2 *g2;
795 struct USER_INFO_1051 u1051;
796 uint32_t parm_err = 0;
797
798 if (argc != 2 || c->display_usage) {
799 rpc_user_usage(c, argc, argv);
800 return 0;
801 }
802
803 status = NetGroupGetInfo(c->opt_host, argv[1], 2, &buffer);
804 if (status) {
805 d_fprintf(stderr, _("Failed to find group name %s -- %s\n"),
806 argv[1],
807 libnetapi_get_error_string(c->netapi_ctx, status));
808 return status;
809 }
810 g2 = (struct GROUP_INFO_2 *)buffer;
811
812 u1051.usri1051_primary_group_id = g2->grpi2_group_id;
813
814 NetApiBufferFree(buffer);
815
816 status = NetUserSetInfo(c->opt_host, argv[0], 1051,
817 (uint8_t *)&u1051, &parm_err);
818 if (status) {
819 d_fprintf(stderr,
820 _("Failed to set user's primary group %s to %s - "
821 "%s\n"), argv[0], argv[1],
822 libnetapi_get_error_string(c->netapi_ctx, status));
823 } else {
824 d_printf(_("Set primary group of user %s to %s\n"), argv[0],
825 argv[1]);
826 }
827 return status;
828 }
829
830 /**
831 * Delete a user from a remote RPC server.
832 *
833 * @param argc Standard main() style argc.
834 * @param argv Standard main() style argv. Initial components are already
835 * stripped.
836 *
837 * @return A shell status integer (0 for success).
838 **/
839
840 static int rpc_user_delete(struct net_context *c, int argc, const char **argv)
841 {
842 NET_API_STATUS status;
843
844 if (argc < 1 || c->display_usage) {
845 rpc_user_usage(c, argc, argv);
846 return 0;
847 }
848
849 status = NetUserDel(c->opt_host, argv[0]);
850
851 if (status != 0) {
852 d_fprintf(stderr, _("Failed to delete user '%s' with: %s.\n"),
853 argv[0],
854 libnetapi_get_error_string(c->netapi_ctx, status));
855 return -1;
856 } else {
857 d_printf(_("Deleted user '%s'.\n"), argv[0]);
858 }
859
860 return 0;
861 }
862
863 /**
864 * Set a user's password on a remote RPC server.
865 *
866 * @param argc Standard main() style argc.
867 * @param argv Standard main() style argv. Initial components are already
868 * stripped.
869 *
870 * @return A shell status integer (0 for success).
871 **/
872
873 static int rpc_user_password(struct net_context *c, int argc, const char **argv)
874 {
875 NET_API_STATUS status;
876 char *prompt = NULL;
877 struct USER_INFO_1003 u1003;
878 uint32_t parm_err = 0;
879 int ret;
880
881 if (argc < 1 || c->display_usage) {
882 rpc_user_usage(c, argc, argv);
883 return 0;
884 }
885
886 if (argv[1]) {
887 u1003.usri1003_password = argv[1];
888 } else {
889 char pwd[256] = {0};
890 ret = asprintf(&prompt, _("Enter new password for %s:"),
891 argv[0]);
892 if (ret == -1) {
893 return -1;
894 }
895
896 ret = samba_getpass(prompt, pwd, sizeof(pwd), false, false);
897 SAFE_FREE(prompt);
898 if (ret < 0) {
899 return -1;
900 }
901
902 u1003.usri1003_password = talloc_strdup(c, pwd);
903 if (u1003.usri1003_password == NULL) {
904 return -1;
905 }
906 }
907
908 status = NetUserSetInfo(c->opt_host, argv[0], 1003, (uint8_t *)&u1003, &parm_err);
909
910 /* Display results */
911 if (status != 0) {
912 d_fprintf(stderr,
913 _("Failed to set password for '%s' with error: %s.\n"),
914 argv[0], libnetapi_get_error_string(c->netapi_ctx,
915 status));
916 return -1;
917 }
918
919 return 0;
920 }
921
922 /**
923 * List a user's groups from a remote RPC server.
924 *
925 * @param argc Standard main() style argc.
926 * @param argv Standard main() style argv. Initial components are already
927 * stripped.
928 *
929 * @return A shell status integer (0 for success)
930 **/
931
932 static int rpc_user_info(struct net_context *c, int argc, const char **argv)
933
934 {
935 NET_API_STATUS status;
936 struct GROUP_USERS_INFO_0 *u0 = NULL;
937 uint32_t entries_read = 0;
938 uint32_t total_entries = 0;
939 int i;
940
941
942 if (argc < 1 || c->display_usage) {
943 rpc_user_usage(c, argc, argv);
944 return 0;
945 }
946
947 status = NetUserGetGroups(c->opt_host,
948 argv[0],
949 0,
950 (uint8_t **)(void *)&u0,
951 (uint32_t)-1,
952 &entries_read,
953 &total_entries);
954 if (status != 0) {
955 d_fprintf(stderr,
956 _("Failed to get groups for '%s' with error: %s.\n"),
957 argv[0], libnetapi_get_error_string(c->netapi_ctx,
958 status));
959 return -1;
960 }
961
962 for (i=0; i < entries_read; i++) {
963 printf("%s\n", u0->grui0_name);
964 u0++;
965 }
966
967 return 0;
968 }
969
970 /**
971 * List users on a remote RPC server.
972 *
973 * All parameters are provided by the run_rpc_command function, except for
974 * argc, argv which are passed through.
975 *
976 * @param domain_sid The domain sid acquired from the remote server.
977 * @param cli A cli_state connected to the server.
978 * @param mem_ctx Talloc context, destroyed on completion of the function.
979 * @param argc Standard main() style argc.
980 * @param argv Standard main() style argv. Initial components are already
981 * stripped.
982 *
983 * @return Normal NTSTATUS return.
984 **/
985
986 static int rpc_user_list(struct net_context *c, int argc, const char **argv)
987 {
988 NET_API_STATUS status;
989 uint32_t start_idx=0, num_entries, i, loop_count = 0;
990 struct NET_DISPLAY_USER *info = NULL;
991 void *buffer = NULL;
992
993 /* Query domain users */
994 if (c->opt_long_list_entries)
995 d_printf(_("\nUser name Comment"
996 "\n-----------------------------\n"));
997 do {
998 uint32_t max_entries, max_size;
999
1000 dcerpc_get_query_dispinfo_params(
1001 loop_count, &max_entries, &max_size);
1002
1003 status = NetQueryDisplayInformation(c->opt_host,
1004 1,
1005 start_idx,
1006 max_entries,
1007 max_size,
1008 &num_entries,
1009 &buffer);
1010 if (status != 0 && status != ERROR_MORE_DATA) {
1011 return status;
1012 }
1013
1014 info = (struct NET_DISPLAY_USER *)buffer;
1015
1016 for (i = 0; i < num_entries; i++) {
1017
1018 if (c->opt_long_list_entries)
1019 printf("%-21.21s %s\n", info->usri1_name,
1020 info->usri1_comment);
1021 else
1022 printf("%s\n", info->usri1_name);
1023 info++;
1024 }
1025
1026 NetApiBufferFree(buffer);
1027
1028 loop_count++;
1029 start_idx += num_entries;
1030
1031 } while (status == ERROR_MORE_DATA);
1032
1033 return status;
1034 }
1035
1036 /**
1037 * 'net rpc user' entrypoint.
1038 * @param argc Standard main() style argc.
1039 * @param argv Standard main() style argv. Initial components are already
1040 * stripped.
1041 **/
1042
1043 int net_rpc_user(struct net_context *c, int argc, const char **argv)
1044 {
1045 NET_API_STATUS status;
1046
1047 struct functable func[] = {
1048 {
1049 "add",
1050 rpc_user_add,
1051 NET_TRANSPORT_RPC,
1052 N_("Add specified user"),
1053 N_("net rpc user add\n"
1054 " Add specified user")
1055 },
1056 {
1057 "info",
1058 rpc_user_info,
1059 NET_TRANSPORT_RPC,
1060 N_("List domain groups of user"),
1061 N_("net rpc user info\n"
1062 " List domain groups of user")
1063 },
1064 {
1065 "delete",
1066 rpc_user_delete,
1067 NET_TRANSPORT_RPC,
1068 N_("Remove specified user"),
1069 N_("net rpc user delete\n"
1070 " Remove specified user")
1071 },
1072 {
1073 "password",
1074 rpc_user_password,
1075 NET_TRANSPORT_RPC,
1076 N_("Change user password"),
1077 N_("net rpc user password\n"
1078 " Change user password")
1079 },
1080 {
1081 "rename",
1082 rpc_user_rename,
1083 NET_TRANSPORT_RPC,
1084 N_("Rename specified user"),
1085 N_("net rpc user rename\n"
1086 " Rename specified user")
1087 },
1088 {
1089 "setprimarygroup",
1090 rpc_user_setprimarygroup,
1091 NET_TRANSPORT_RPC,
1092 "Set a user's primary group",
1093 "net rpc user setprimarygroup\n"
1094 " Set a user's primary group"
1095 },
1096 {NULL, NULL, 0, NULL, NULL}
1097 };
1098
1099 status = libnetapi_net_init(&c->netapi_ctx);
1100 if (status != 0) {
1101 return -1;
1102 }
1103 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
1104 libnetapi_set_password(c->netapi_ctx, c->opt_password);
1105 if (c->opt_kerberos) {
1106 libnetapi_set_use_kerberos(c->netapi_ctx);
1107 }
1108
1109 if (argc == 0) {
1110 if (c->display_usage) {
1111 d_printf( "%s\n"
1112 "net rpc user\n"
1113 " %s\n",
1114 _("Usage:"),
1115 _("List all users"));
1116 net_display_usage_from_functable(func);
1117 return 0;
1118 }
1119
1120 return rpc_user_list(c, argc, argv);
1121 }
1122
1123 return net_run_function(c, argc, argv, "net rpc user", func);
1124 }
1125
1126 static NTSTATUS rpc_sh_user_list(struct net_context *c,
1127 TALLOC_CTX *mem_ctx,
1128 struct rpc_sh_ctx *ctx,
1129 struct rpc_pipe_client *pipe_hnd,
1130 int argc, const char **argv)
1131 {
1132 return werror_to_ntstatus(W_ERROR(rpc_user_list(c, argc, argv)));
1133 }
1134
1135 static NTSTATUS rpc_sh_user_info(struct net_context *c,
1136 TALLOC_CTX *mem_ctx,
1137 struct rpc_sh_ctx *ctx,
1138 struct rpc_pipe_client *pipe_hnd,
1139 int argc, const char **argv)
1140 {
1141 return werror_to_ntstatus(W_ERROR(rpc_user_info(c, argc, argv)));
1142 }
1143
1144 static NTSTATUS rpc_sh_handle_user(struct net_context *c,
1145 TALLOC_CTX *mem_ctx,
1146 struct rpc_sh_ctx *ctx,
1147 struct rpc_pipe_client *pipe_hnd,
1148 int argc, const char **argv,
1149 NTSTATUS (*fn)(
1150 struct net_context *c,
1151 TALLOC_CTX *mem_ctx,
1152 struct rpc_sh_ctx *ctx,
1153 struct rpc_pipe_client *pipe_hnd,
1154 struct policy_handle *user_hnd,
1155 int argc, const char **argv))
1156 {
1157 struct policy_handle connect_pol, domain_pol, user_pol;
1158 NTSTATUS status, result;
1159 struct dom_sid sid;
1160 uint32 rid;
1161 enum lsa_SidType type;
1162 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1163
1164 if (argc == 0) {
1165 d_fprintf(stderr, "%s %s <username>\n", _("Usage:"),
1166 ctx->whoami);
1167 return NT_STATUS_INVALID_PARAMETER;
1168 }
1169
1170 ZERO_STRUCT(connect_pol);
1171 ZERO_STRUCT(domain_pol);
1172 ZERO_STRUCT(user_pol);
1173
1174 status = net_rpc_lookup_name(c, mem_ctx, rpc_pipe_np_smb_conn(pipe_hnd),
1175 argv[0], NULL, NULL, &sid, &type);
1176 if (!NT_STATUS_IS_OK(status)) {
1177 d_fprintf(stderr, _("Could not lookup %s: %s\n"), argv[0],
1178 nt_errstr(status));
1179 goto done;
1180 }
1181
1182 if (type != SID_NAME_USER) {
1183 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
1184 sid_type_lookup(type));
1185 status = NT_STATUS_NO_SUCH_USER;
1186 goto done;
1187 }
1188
1189 if (!sid_peek_check_rid(ctx->domain_sid, &sid, &rid)) {
1190 d_fprintf(stderr, _("%s is not in our domain\n"), argv[0]);
1191 status = NT_STATUS_NO_SUCH_USER;
1192 goto done;
1193 }
1194
1195 status = dcerpc_samr_Connect2(b, mem_ctx,
1196 pipe_hnd->desthost,
1197 MAXIMUM_ALLOWED_ACCESS,
1198 &connect_pol,
1199 &result);
1200 if (!NT_STATUS_IS_OK(status)) {
1201 goto done;
1202 }
1203 if (!NT_STATUS_IS_OK(result)) {
1204 status = result;
1205 goto done;
1206 }
1207
1208 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1209 &connect_pol,
1210 MAXIMUM_ALLOWED_ACCESS,
1211 ctx->domain_sid,
1212 &domain_pol,
1213 &result);
1214 if (!NT_STATUS_IS_OK(status)) {
1215 goto done;
1216 }
1217 if (!NT_STATUS_IS_OK(result)) {
1218 status = result;
1219 goto done;
1220 }
1221
1222 status = dcerpc_samr_OpenUser(b, mem_ctx,
1223 &domain_pol,
1224 MAXIMUM_ALLOWED_ACCESS,
1225 rid,
1226 &user_pol,
1227 &result);
1228 if (!NT_STATUS_IS_OK(status)) {
1229 goto done;
1230 }
1231 if (!NT_STATUS_IS_OK(result)) {
1232 status = result;
1233 goto done;
1234 }
1235
1236 status = fn(c, mem_ctx, ctx, pipe_hnd, &user_pol, argc-1, argv+1);
1237
1238 done:
1239 if (is_valid_policy_hnd(&user_pol)) {
1240 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1241 }
1242 if (is_valid_policy_hnd(&domain_pol)) {
1243 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1244 }
1245 if (is_valid_policy_hnd(&connect_pol)) {
1246 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
1247 }
1248 return status;
1249 }
1250
1251 static NTSTATUS rpc_sh_user_show_internals(struct net_context *c,
1252 TALLOC_CTX *mem_ctx,
1253 struct rpc_sh_ctx *ctx,
1254 struct rpc_pipe_client *pipe_hnd,
1255 struct policy_handle *user_hnd,
1256 int argc, const char **argv)
1257 {
1258 NTSTATUS status, result;
1259 union samr_UserInfo *info = NULL;
1260 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1261
1262 if (argc != 0) {
1263 d_fprintf(stderr, "%s %s show <username>\n", _("Usage:"),
1264 ctx->whoami);
1265 return NT_STATUS_INVALID_PARAMETER;
1266 }
1267
1268 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1269 user_hnd,
1270 21,
1271 &info,
1272 &result);
1273 if (!NT_STATUS_IS_OK(status)) {
1274 return status;
1275 }
1276 if (!NT_STATUS_IS_OK(result)) {
1277 return result;
1278 }
1279
1280 d_printf(_("user rid: %d, group rid: %d\n"),
1281 info->info21.rid,
1282 info->info21.primary_gid);
1283
1284 return result;
1285 }
1286
1287 static NTSTATUS rpc_sh_user_show(struct net_context *c,
1288 TALLOC_CTX *mem_ctx,
1289 struct rpc_sh_ctx *ctx,
1290 struct rpc_pipe_client *pipe_hnd,
1291 int argc, const char **argv)
1292 {
1293 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1294 rpc_sh_user_show_internals);
1295 }
1296
1297 #define FETCHSTR(name, rec) \
1298 do { if (strequal(ctx->thiscmd, name)) { \
1299 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1300 } while (0);
1301
1302 #define SETSTR(name, rec, flag) \
1303 do { if (strequal(ctx->thiscmd, name)) { \
1304 init_lsa_String(&(info->info21.rec), argv[0]); \
1305 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1306 } while (0);
1307
1308 static NTSTATUS rpc_sh_user_str_edit_internals(struct net_context *c,
1309 TALLOC_CTX *mem_ctx,
1310 struct rpc_sh_ctx *ctx,
1311 struct rpc_pipe_client *pipe_hnd,
1312 struct policy_handle *user_hnd,
1313 int argc, const char **argv)
1314 {
1315 NTSTATUS status, result;
1316 const char *username;
1317 const char *oldval = "";
1318 union samr_UserInfo *info = NULL;
1319 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1320
1321 if (argc > 1) {
1322 d_fprintf(stderr, "%s %s <username> [new value|NULL]\n",
1323 _("Usage:"), ctx->whoami);
1324 return NT_STATUS_INVALID_PARAMETER;
1325 }
1326
1327 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1328 user_hnd,
1329 21,
1330 &info,
1331 &result);
1332 if (!NT_STATUS_IS_OK(status)) {
1333 return status;
1334 }
1335 if (!NT_STATUS_IS_OK(result)) {
1336 return result;
1337 }
1338
1339 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1340
1341 FETCHSTR("fullname", full_name);
1342 FETCHSTR("homedir", home_directory);
1343 FETCHSTR("homedrive", home_drive);
1344 FETCHSTR("logonscript", logon_script);
1345 FETCHSTR("profilepath", profile_path);
1346 FETCHSTR("description", description);
1347
1348 if (argc == 0) {
1349 d_printf(_("%s's %s: [%s]\n"), username, ctx->thiscmd, oldval);
1350 goto done;
1351 }
1352
1353 if (strcmp(argv[0], "NULL") == 0) {
1354 argv[0] = "";
1355 }
1356
1357 ZERO_STRUCT(info->info21);
1358
1359 SETSTR("fullname", full_name, FULL_NAME);
1360 SETSTR("homedir", home_directory, HOME_DIRECTORY);
1361 SETSTR("homedrive", home_drive, HOME_DRIVE);
1362 SETSTR("logonscript", logon_script, LOGON_SCRIPT);
1363 SETSTR("profilepath", profile_path, PROFILE_PATH);
1364 SETSTR("description", description, DESCRIPTION);
1365
1366 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1367 user_hnd,
1368 21,
1369 info,
1370 &result);
1371 if (!NT_STATUS_IS_OK(status)) {
1372 return status;
1373 }
1374
1375 status = result;
1376
1377 d_printf(_("Set %s's %s from [%s] to [%s]\n"), username,
1378 ctx->thiscmd, oldval, argv[0]);
1379
1380 done:
1381
1382 return status;
1383 }
1384
1385 #define HANDLEFLG(name, rec) \
1386 do { if (strequal(ctx->thiscmd, name)) { \
1387 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1388 if (newval) { \
1389 newflags = oldflags | ACB_##rec; \
1390 } else { \
1391 newflags = oldflags & ~ACB_##rec; \
1392 } } } while (0);
1393
1394 static NTSTATUS rpc_sh_user_str_edit(struct net_context *c,
1395 TALLOC_CTX *mem_ctx,
1396 struct rpc_sh_ctx *ctx,
1397 struct rpc_pipe_client *pipe_hnd,
1398 int argc, const char **argv)
1399 {
1400 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1401 rpc_sh_user_str_edit_internals);
1402 }
1403
1404 static NTSTATUS rpc_sh_user_flag_edit_internals(struct net_context *c,
1405 TALLOC_CTX *mem_ctx,
1406 struct rpc_sh_ctx *ctx,
1407 struct rpc_pipe_client *pipe_hnd,
1408 struct policy_handle *user_hnd,
1409 int argc, const char **argv)
1410 {
1411 NTSTATUS status, result;
1412 const char *username;
1413 const char *oldval = "unknown";
1414 uint32 oldflags, newflags;
1415 bool newval;
1416 union samr_UserInfo *info = NULL;
1417 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1418
1419 if ((argc > 1) ||
1420 ((argc == 1) && !strequal(argv[0], "yes") &&
1421 !strequal(argv[0], "no"))) {
1422 /* TRANSATORS: The yes|no here are program keywords. Please do
1423 not translate. */
1424 d_fprintf(stderr, _("Usage: %s <username> [yes|no]\n"),
1425 ctx->whoami);
1426 return NT_STATUS_INVALID_PARAMETER;
1427 }
1428
1429 newval = strequal(argv[0], "yes");
1430
1431 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1432 user_hnd,
1433 21,
1434 &info,
1435 &result);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 return status;
1438 }
1439 if (!NT_STATUS_IS_OK(result)) {
1440 return result;
1441 }
1442
1443 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1444 oldflags = info->info21.acct_flags;
1445 newflags = info->info21.acct_flags;
1446
1447 HANDLEFLG("disabled", DISABLED);
1448 HANDLEFLG("pwnotreq", PWNOTREQ);
1449 HANDLEFLG("autolock", AUTOLOCK);
1450 HANDLEFLG("pwnoexp", PWNOEXP);
1451
1452 if (argc == 0) {
1453 d_printf(_("%s's %s flag: %s\n"), username, ctx->thiscmd,
1454 oldval);
1455 goto done;
1456 }
1457
1458 ZERO_STRUCT(info->info21);
1459
1460 info->info21.acct_flags = newflags;
1461 info->info21.fields_present = SAMR_FIELD_ACCT_FLAGS;
1462
1463 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1464 user_hnd,
1465 21,
1466 info,
1467 &result);
1468 if (!NT_STATUS_IS_OK(status)) {
1469 goto done;
1470 }
1471 status = result;
1472 if (NT_STATUS_IS_OK(result)) {
1473 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username,
1474 ctx->thiscmd, oldval, argv[0]);
1475 }
1476
1477 done:
1478
1479 return status;
1480 }
1481
1482 static NTSTATUS rpc_sh_user_flag_edit(struct net_context *c,
1483 TALLOC_CTX *mem_ctx,
1484 struct rpc_sh_ctx *ctx,
1485 struct rpc_pipe_client *pipe_hnd,
1486 int argc, const char **argv)
1487 {
1488 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1489 rpc_sh_user_flag_edit_internals);
1490 }
1491
1492 struct rpc_sh_cmd *net_rpc_user_edit_cmds(struct net_context *c,
1493 TALLOC_CTX *mem_ctx,
1494 struct rpc_sh_ctx *ctx)
1495 {
1496 static struct rpc_sh_cmd cmds[] = {
1497
1498 { "fullname", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1499 N_("Show/Set a user's full name") },
1500
1501 { "homedir", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1502 N_("Show/Set a user's home directory") },
1503
1504 { "homedrive", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1505 N_("Show/Set a user's home drive") },
1506
1507 { "logonscript", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1508 N_("Show/Set a user's logon script") },
1509
1510 { "profilepath", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1511 N_("Show/Set a user's profile path") },
1512
1513 { "description", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1514 N_("Show/Set a user's description") },
1515
1516 { "disabled", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1517 N_("Show/Set whether a user is disabled") },
1518
1519 { "autolock", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1520 N_("Show/Set whether a user locked out") },
1521
1522 { "pwnotreq", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1523 N_("Show/Set whether a user does not need a password") },
1524
1525 { "pwnoexp", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1526 N_("Show/Set whether a user's password does not expire") },
1527
1528 { NULL, NULL, 0, NULL, NULL }
1529 };
1530
1531 return cmds;
1532 }
1533
1534 struct rpc_sh_cmd *net_rpc_user_cmds(struct net_context *c,
1535 TALLOC_CTX *mem_ctx,
1536 struct rpc_sh_ctx *ctx)
1537 {
1538 static struct rpc_sh_cmd cmds[] = {
1539
1540 { "list", NULL, &ndr_table_samr, rpc_sh_user_list,
1541 N_("List available users") },
1542
1543 { "info", NULL, &ndr_table_samr, rpc_sh_user_info,
1544 N_("List the domain groups a user is member of") },
1545
1546 { "show", NULL, &ndr_table_samr, rpc_sh_user_show,
1547 N_("Show info about a user") },
1548
1549 { "edit", net_rpc_user_edit_cmds, 0, NULL,
1550 N_("Show/Modify a user's fields") },
1551
1552 { NULL, NULL, 0, NULL, NULL }
1553 };
1554
1555 return cmds;
1556 }
1557
1558 /****************************************************************************/
1559
1560 /**
1561 * Basic usage function for 'net rpc group'.
1562 * @param argc Standard main() style argc.
1563 * @param argv Standard main() style argv. Initial components are already
1564 * stripped.
1565 **/
1566
1567 static int rpc_group_usage(struct net_context *c, int argc, const char **argv)
1568 {
1569 return net_group_usage(c, argc, argv);
1570 }
1571
1572 /**
1573 * Delete group on a remote RPC server.
1574 *
1575 * All parameters are provided by the run_rpc_command function, except for
1576 * argc, argv which are passed through.
1577 *
1578 * @param domain_sid The domain sid acquired from the remote server.
1579 * @param cli A cli_state connected to the server.
1580 * @param mem_ctx Talloc context, destroyed on completion of the function.
1581 * @param argc Standard main() style argc.
1582 * @param argv Standard main() style argv. Initial components are already
1583 * stripped.
1584 *
1585 * @return Normal NTSTATUS return.
1586 **/
1587
1588 static NTSTATUS rpc_group_delete_internals(struct net_context *c,
1589 const struct dom_sid *domain_sid,
1590 const char *domain_name,
1591 struct cli_state *cli,
1592 struct rpc_pipe_client *pipe_hnd,
1593 TALLOC_CTX *mem_ctx,
1594 int argc,
1595 const char **argv)
1596 {
1597 struct policy_handle connect_pol, domain_pol, group_pol, user_pol;
1598 bool group_is_primary = false;
1599 NTSTATUS status, result;
1600 uint32_t group_rid;
1601 struct samr_RidAttrArray *rids = NULL;
1602 /* char **names; */
1603 int i;
1604 /* struct samr_RidWithAttribute *user_gids; */
1605 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1606
1607 struct samr_Ids group_rids, name_types;
1608 struct lsa_String lsa_acct_name;
1609 union samr_UserInfo *info = NULL;
1610
1611 if (argc < 1 || c->display_usage) {
1612 rpc_group_usage(c, argc,argv);
1613 return NT_STATUS_OK; /* ok? */
1614 }
1615
1616 status = dcerpc_samr_Connect2(b, mem_ctx,
1617 pipe_hnd->desthost,
1618 MAXIMUM_ALLOWED_ACCESS,
1619 &connect_pol,
1620 &result);
1621 if (!NT_STATUS_IS_OK(status)) {
1622 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1623 goto done;
1624 }
1625
1626 if (!NT_STATUS_IS_OK(result)) {
1627 status = result;
1628 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1629 goto done;
1630 }
1631
1632 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1633 &connect_pol,
1634 MAXIMUM_ALLOWED_ACCESS,
1635 discard_const_p(struct dom_sid2, domain_sid),
1636 &domain_pol,
1637 &result);
1638 if (!NT_STATUS_IS_OK(status)) {
1639 d_fprintf(stderr, _("Request open_domain failed\n"));
1640 goto done;
1641 }
1642
1643 if (!NT_STATUS_IS_OK(result)) {
1644 status = result;
1645 d_fprintf(stderr, _("Request open_domain failed\n"));
1646 goto done;
1647 }
1648
1649 init_lsa_String(&lsa_acct_name, argv[0]);
1650
1651 status = dcerpc_samr_LookupNames(b, mem_ctx,
1652 &domain_pol,
1653 1,
1654 &lsa_acct_name,
1655 &group_rids,
1656 &name_types,
1657 &result);
1658 if (!NT_STATUS_IS_OK(status)) {
1659 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1660 goto done;
1661 }
1662
1663 if (!NT_STATUS_IS_OK(result)) {
1664 status = result;
1665 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1666 goto done;
1667 }
1668
1669 switch (name_types.ids[0])
1670 {
1671 case SID_NAME_DOM_GRP:
1672 status = dcerpc_samr_OpenGroup(b, mem_ctx,
1673 &domain_pol,
1674 MAXIMUM_ALLOWED_ACCESS,
1675 group_rids.ids[0],
1676 &group_pol,
1677 &result);
1678 if (!NT_STATUS_IS_OK(status)) {
1679 d_fprintf(stderr, _("Request open_group failed"));
1680 goto done;
1681 }
1682
1683 if (!NT_STATUS_IS_OK(result)) {
1684 status = result;
1685 d_fprintf(stderr, _("Request open_group failed"));
1686 goto done;
1687 }
1688
1689 group_rid = group_rids.ids[0];
1690
1691 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
1692 &group_pol,
1693 &rids,
1694 &result);
1695 if (!NT_STATUS_IS_OK(status)) {
1696 d_fprintf(stderr,
1697 _("Unable to query group members of %s"),
1698 argv[0]);
1699 goto done;
1700 }
1701
1702 if (!NT_STATUS_IS_OK(result)) {
1703 status = result;
1704 d_fprintf(stderr,
1705 _("Unable to query group members of %s"),
1706 argv[0]);
1707 goto done;
1708 }
1709
1710 if (c->opt_verbose) {
1711 d_printf(
1712 _("Domain Group %s (rid: %d) has %d members\n"),
1713 argv[0],group_rid, rids->count);
1714 }
1715
1716 /* Check if group is anyone's primary group */
1717 for (i = 0; i < rids->count; i++)
1718 {
1719 status = dcerpc_samr_OpenUser(b, mem_ctx,
1720 &domain_pol,
1721 MAXIMUM_ALLOWED_ACCESS,
1722 rids->rids[i],
1723 &user_pol,
1724 &result);
1725 if (!NT_STATUS_IS_OK(status)) {
1726 d_fprintf(stderr,
1727 _("Unable to open group member %d\n"),
1728 rids->rids[i]);
1729 goto done;
1730 }
1731
1732 if (!NT_STATUS_IS_OK(result)) {
1733 status = result;
1734 d_fprintf(stderr,
1735 _("Unable to open group member %d\n"),
1736 rids->rids[i]);
1737 goto done;
1738 }
1739
1740 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1741 &user_pol,
1742 21,
1743 &info,
1744 &result);
1745 if (!NT_STATUS_IS_OK(status)) {
1746 d_fprintf(stderr,
1747 _("Unable to lookup userinfo for group "
1748 "member %d\n"),
1749 rids->rids[i]);
1750 goto done;
1751 }
1752
1753 if (!NT_STATUS_IS_OK(result)) {
1754 status = result;
1755 d_fprintf(stderr,
1756 _("Unable to lookup userinfo for group "
1757 "member %d\n"),
1758 rids->rids[i]);
1759 goto done;
1760 }
1761
1762 if (info->info21.primary_gid == group_rid) {
1763 if (c->opt_verbose) {
1764 d_printf(_("Group is primary group "
1765 "of %s\n"),
1766 info->info21.account_name.string);
1767 }
1768 group_is_primary = true;
1769 }
1770
1771 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1772 }
1773
1774 if (group_is_primary) {
1775 d_fprintf(stderr, _("Unable to delete group because "
1776 "some of it's members have it as primary "
1777 "group\n"));
1778 status = NT_STATUS_MEMBERS_PRIMARY_GROUP;
1779 goto done;
1780 }
1781
1782 /* remove all group members */
1783 for (i = 0; i < rids->count; i++)
1784 {
1785 if (c->opt_verbose)
1786 d_printf(_("Remove group member %d..."),
1787 rids->rids[i]);
1788 status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
1789 &group_pol,
1790 rids->rids[i],
1791 &result);
1792 if (!NT_STATUS_IS_OK(status)) {
1793 goto done;
1794 }
1795 status = result;
1796 if (NT_STATUS_IS_OK(result)) {
1797 if (c->opt_verbose)
1798 d_printf(_("ok\n"));
1799 } else {
1800 if (c->opt_verbose)
1801 d_printf("%s\n", _("failed"));
1802 goto done;
1803 }
1804 }
1805
1806 status = dcerpc_samr_DeleteDomainGroup(b, mem_ctx,
1807 &group_pol,
1808 &result);
1809 if (!NT_STATUS_IS_OK(status)) {
1810 break;
1811 }
1812
1813 status = result;
1814
1815 break;
1816 /* removing a local group is easier... */
1817 case SID_NAME_ALIAS:
1818 status = dcerpc_samr_OpenAlias(b, mem_ctx,
1819 &domain_pol,
1820 MAXIMUM_ALLOWED_ACCESS,
1821 group_rids.ids[0],
1822 &group_pol,
1823 &result);
1824 if (!NT_STATUS_IS_OK(status)) {
1825 d_fprintf(stderr, _("Request open_alias failed\n"));
1826 goto done;
1827 }
1828 if (!NT_STATUS_IS_OK(result)) {
1829 status = result;
1830 d_fprintf(stderr, _("Request open_alias failed\n"));
1831 goto done;
1832 }
1833
1834 status = dcerpc_samr_DeleteDomAlias(b, mem_ctx,
1835 &group_pol,
1836 &result);
1837 if (!NT_STATUS_IS_OK(status)) {
1838 break;
1839 }
1840
1841 status = result;
1842
1843 break;
1844 default:
1845 d_fprintf(stderr, _("%s is of type %s. This command is only "
1846 "for deleting local or global groups\n"),
1847 argv[0],sid_type_lookup(name_types.ids[0]));
1848 status = NT_STATUS_UNSUCCESSFUL;
1849 goto done;
1850 }
1851
1852 if (NT_STATUS_IS_OK(status)) {
1853 if (c->opt_verbose)
1854 d_printf(_("Deleted %s '%s'\n"),
1855 sid_type_lookup(name_types.ids[0]), argv[0]);
1856 } else {
1857 d_fprintf(stderr, _("Deleting of %s failed: %s\n"), argv[0],
1858 get_friendly_nt_error_msg(status));
1859 }
1860
1861 done:
1862 return status;
1863
1864 }
1865
1866 static int rpc_group_delete(struct net_context *c, int argc, const char **argv)
1867 {
1868 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
1869 rpc_group_delete_internals, argc,argv);
1870 }
1871
1872 static int rpc_group_add_internals(struct net_context *c, int argc, const char **argv)
1873 {
1874 NET_API_STATUS status;
1875 struct GROUP_INFO_1 info1;
1876 uint32_t parm_error = 0;
1877
1878 if (argc != 1 || c->display_usage) {
1879 rpc_group_usage(c, argc, argv);
1880 return 0;
1881 }
1882
1883 ZERO_STRUCT(info1);
1884
1885 info1.grpi1_name = argv[0];
1886 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1887 info1.grpi1_comment = c->opt_comment;
1888 }
1889
1890 status = NetGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1891
1892 if (status != 0) {
1893 d_fprintf(stderr,
1894 _("Failed to add group '%s' with error: %s.\n"),
1895 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1896 status));
1897 return -1;
1898 } else {
1899 d_printf(_("Added group '%s'.\n"), argv[0]);
1900 }
1901
1902 return 0;
1903 }
1904
1905 static int rpc_alias_add_internals(struct net_context *c, int argc, const char **argv)
1906 {
1907 NET_API_STATUS status;
1908 struct LOCALGROUP_INFO_1 info1;
1909 uint32_t parm_error = 0;
1910
1911 if (argc != 1 || c->display_usage) {
1912 rpc_group_usage(c, argc, argv);
1913 return 0;
1914 }
1915
1916 ZERO_STRUCT(info1);
1917
1918 info1.lgrpi1_name = argv[0];
1919 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1920 info1.lgrpi1_comment = c->opt_comment;
1921 }
1922
1923 status = NetLocalGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1924
1925 if (status != 0) {
1926 d_fprintf(stderr,
1927 _("Failed to add alias '%s' with error: %s.\n"),
1928 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1929 status));
1930 return -1;
1931 } else {
1932 d_printf(_("Added alias '%s'.\n"), argv[0]);
1933 }
1934
1935 return 0;
1936 }
1937
1938 static int rpc_group_add(struct net_context *c, int argc, const char **argv)
1939 {
1940 if (c->opt_localgroup)
1941 return rpc_alias_add_internals(c, argc, argv);
1942
1943 return rpc_group_add_internals(c, argc, argv);
1944 }
1945
1946 static NTSTATUS get_sid_from_name(struct cli_state *cli,
1947 TALLOC_CTX *mem_ctx,
1948 const char *name,
1949 struct dom_sid *sid,
1950 enum lsa_SidType *type)
1951 {
1952 struct dom_sid *sids = NULL;
1953 enum lsa_SidType *types = NULL;
1954 struct rpc_pipe_client *pipe_hnd = NULL;
1955 struct policy_handle lsa_pol;
1956 NTSTATUS status, result;
1957 struct dcerpc_binding_handle *b;
1958
1959 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
1960 &pipe_hnd);
1961 if (!NT_STATUS_IS_OK(status)) {
1962 goto done;
1963 }
1964
1965 b = pipe_hnd->binding_handle;
1966
1967 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, false,
1968 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
1969
1970 if (!NT_STATUS_IS_OK(status)) {
1971 goto done;
1972 }
1973
1974 status = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &lsa_pol, 1,
1975 &name, NULL, 1, &sids, &types);
1976
1977 if (NT_STATUS_IS_OK(status)) {
1978 sid_copy(sid, &sids[0]);
1979 *type = types[0];
1980 }
1981
1982 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
1983
1984 done:
1985 if (pipe_hnd) {
1986 TALLOC_FREE(pipe_hnd);
1987 }
1988
1989 if (!NT_STATUS_IS_OK(status) && (strncasecmp_m(name, "S-", 2) == 0)) {
1990
1991 /* Try as S-1-5-whatever */
1992
1993 struct dom_sid tmp_sid;
1994
1995 if (string_to_sid(&tmp_sid, name)) {
1996 sid_copy(sid, &tmp_sid);
1997 *type = SID_NAME_UNKNOWN;
1998 status = NT_STATUS_OK;
1999 }
2000 }
2001
2002 return status;
2003 }
2004
2005 static NTSTATUS rpc_add_groupmem(struct rpc_pipe_client *pipe_hnd,
2006 TALLOC_CTX *mem_ctx,
2007 const struct dom_sid *group_sid,
2008 const char *member)
2009 {
2010 struct policy_handle connect_pol, domain_pol;
2011 NTSTATUS status, result;
2012 uint32 group_rid;
2013 struct policy_handle group_pol;
2014 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2015
2016 struct samr_Ids rids, rid_types;
2017 struct lsa_String lsa_acct_name;
2018
2019 struct dom_sid sid;
2020
2021 sid_copy(&sid, group_sid);
2022
2023 if (!sid_split_rid(&sid, &group_rid)) {
2024 return NT_STATUS_UNSUCCESSFUL;
2025 }
2026
2027 /* Get sam policy handle */
2028 status = dcerpc_samr_Connect2(b, mem_ctx,
2029 pipe_hnd->desthost,
2030 MAXIMUM_ALLOWED_ACCESS,
2031 &connect_pol,
2032 &result);
2033 if (!NT_STATUS_IS_OK(status)) {
2034 return status;
2035 }
2036 if (!NT_STATUS_IS_OK(result)) {
2037 return result;
2038 }
2039
2040 /* Get domain policy handle */
2041 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2042 &connect_pol,
2043 MAXIMUM_ALLOWED_ACCESS,
2044 &sid,
2045 &domain_pol,
2046 &result);
2047 if (!NT_STATUS_IS_OK(status)) {
2048 return status;
2049 }
2050 if (!NT_STATUS_IS_OK(result)) {
2051 return result;
2052 }
2053
2054 init_lsa_String(&lsa_acct_name, member);
2055
2056 status = dcerpc_samr_LookupNames(b, mem_ctx,
2057 &domain_pol,
2058 1,
2059 &lsa_acct_name,
2060 &rids,
2061 &rid_types,
2062 &result);
2063 if (!NT_STATUS_IS_OK(status)) {
2064 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2065 member);
2066 goto done;
2067 }
2068
2069 if (!NT_STATUS_IS_OK(result)) {
2070 status = result;
2071 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2072 member);
2073 goto done;
2074 }
2075
2076 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2077 &domain_pol,
2078 MAXIMUM_ALLOWED_ACCESS,
2079 group_rid,
2080 &group_pol,
2081 &result);
2082 if (!NT_STATUS_IS_OK(status)) {
2083 goto done;
2084 }
2085
2086 if (!NT_STATUS_IS_OK(result)) {
2087 status = result;
2088 goto done;
2089 }
2090
2091 status = dcerpc_samr_AddGroupMember(b, mem_ctx,
2092 &group_pol,
2093 rids.ids[0],
2094 0x0005, /* unknown flags */
2095 &result);
2096 if (!NT_STATUS_IS_OK(status)) {
2097 goto done;
2098 }
2099
2100 status = result;
2101
2102 done:
2103 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2104 return status;
2105 }
2106
2107 static NTSTATUS rpc_add_aliasmem(struct rpc_pipe_client *pipe_hnd,
2108 TALLOC_CTX *mem_ctx,
2109 const struct dom_sid *alias_sid,
2110 const char *member)
2111 {
2112 struct policy_handle connect_pol, domain_pol;
2113 NTSTATUS status, result;
2114 uint32 alias_rid;
2115 struct policy_handle alias_pol;
2116 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2117
2118 struct dom_sid member_sid;
2119 enum lsa_SidType member_type;
2120
2121 struct dom_sid sid;
2122
2123 sid_copy(&sid, alias_sid);
2124
2125 if (!sid_split_rid(&sid, &alias_rid)) {
2126 return NT_STATUS_UNSUCCESSFUL;
2127 }
2128
2129 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
2130 member, &member_sid, &member_type);
2131
2132 if (!NT_STATUS_IS_OK(result)) {
2133 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2134 member);
2135 return result;
2136 }
2137
2138 /* Get sam policy handle */
2139 status = dcerpc_samr_Connect2(b, mem_ctx,
2140 pipe_hnd->desthost,
2141 MAXIMUM_ALLOWED_ACCESS,
2142 &connect_pol,
2143 &result);
2144 if (!NT_STATUS_IS_OK(status)) {
2145 goto done;
2146 }
2147 if (!NT_STATUS_IS_OK(result)) {
2148 status = result;
2149 goto done;
2150 }
2151
2152 /* Get domain policy handle */
2153 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2154 &connect_pol,
2155 MAXIMUM_ALLOWED_ACCESS,
2156 &sid,
2157 &domain_pol,
2158 &result);
2159 if (!NT_STATUS_IS_OK(status)) {
2160 goto done;
2161 }
2162 if (!NT_STATUS_IS_OK(result)) {
2163 status = result;
2164 goto done;
2165 }
2166
2167 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2168 &domain_pol,
2169 MAXIMUM_ALLOWED_ACCESS,
2170 alias_rid,
2171 &alias_pol,
2172 &result);
2173 if (!NT_STATUS_IS_OK(status)) {
2174 return status;
2175 }
2176 if (!NT_STATUS_IS_OK(result)) {
2177 return result;
2178 }
2179
2180 status = dcerpc_samr_AddAliasMember(b, mem_ctx,
2181 &alias_pol,
2182 &member_sid,
2183 &result);
2184 if (!NT_STATUS_IS_OK(status)) {
2185 return status;
2186 }
2187
2188 status = result;
2189
2190 done:
2191 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2192 return status;
2193 }
2194
2195 static NTSTATUS rpc_group_addmem_internals(struct net_context *c,
2196 const struct dom_sid *domain_sid,
2197 const char *domain_name,
2198 struct cli_state *cli,
2199 struct rpc_pipe_client *pipe_hnd,
2200 TALLOC_CTX *mem_ctx,
2201 int argc,
2202 const char **argv)
2203 {
2204 struct dom_sid group_sid;
2205 enum lsa_SidType group_type;
2206
2207 if (argc != 2 || c->display_usage) {
2208 d_printf("%s\n%s",
2209 _("Usage:"),
2210 _("net rpc group addmem <group> <member>\n"
2211 " Add a member to a group\n"
2212 " group\tGroup to add member to\n"
2213 " member\tMember to add to group\n"));
2214 return NT_STATUS_UNSUCCESSFUL;
2215 }
2216
2217 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2218 &group_sid, &group_type))) {
2219 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2220 argv[0]);
2221 return NT_STATUS_UNSUCCESSFUL;
2222 }
2223
2224 if (group_type == SID_NAME_DOM_GRP) {
2225 NTSTATUS result = rpc_add_groupmem(pipe_hnd, mem_ctx,
2226 &group_sid, argv[1]);
2227
2228 if (!NT_STATUS_IS_OK(result)) {
2229 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2230 argv[1], argv[0], nt_errstr(result));
2231 }
2232 return result;
2233 }
2234
2235 if (group_type == SID_NAME_ALIAS) {
2236 NTSTATUS result = rpc_add_aliasmem(pipe_hnd, mem_ctx,
2237 &group_sid, argv[1]);
2238
2239 if (!NT_STATUS_IS_OK(result)) {
2240 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2241 argv[1], argv[0], nt_errstr(result));
2242 }
2243 return result;
2244 }
2245
2246 d_fprintf(stderr, _("Can only add members to global or local groups "
2247 "which %s is not\n"), argv[0]);
2248
2249 return NT_STATUS_UNSUCCESSFUL;
2250 }
2251
2252 static int rpc_group_addmem(struct net_context *c, int argc, const char **argv)
2253 {
2254 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2255 rpc_group_addmem_internals,
2256 argc, argv);
2257 }
2258
2259 static NTSTATUS rpc_del_groupmem(struct net_context *c,
2260 struct rpc_pipe_client *pipe_hnd,
2261 TALLOC_CTX *mem_ctx,
2262 const struct dom_sid *group_sid,
2263 const char *member)
2264 {
2265 struct policy_handle connect_pol, domain_pol;
2266 NTSTATUS status, result;
2267 uint32 group_rid;
2268 struct policy_handle group_pol;
2269 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2270
2271 struct samr_Ids rids, rid_types;
2272 struct lsa_String lsa_acct_name;
2273
2274 struct dom_sid sid;
2275
2276 sid_copy(&sid, group_sid);
2277
2278 if (!sid_split_rid(&sid, &group_rid))
2279 return NT_STATUS_UNSUCCESSFUL;
2280
2281 /* Get sam policy handle */
2282 status = dcerpc_samr_Connect2(b, mem_ctx,
2283 pipe_hnd->desthost,
2284 MAXIMUM_ALLOWED_ACCESS,
2285 &connect_pol,
2286 &result);
2287 if (!NT_STATUS_IS_OK(status)) {
2288 return status;
2289 }
2290 if (!NT_STATUS_IS_OK(result)) {
2291 return result;
2292 }
2293
2294
2295 /* Get domain policy handle */
2296 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2297 &connect_pol,
2298 MAXIMUM_ALLOWED_ACCESS,
2299 &sid,
2300 &domain_pol,
2301 &result);
2302 if (!NT_STATUS_IS_OK(status)) {
2303 return status;
2304 }
2305 if (!NT_STATUS_IS_OK(result)) {
2306 return result;
2307 }
2308
2309 init_lsa_String(&lsa_acct_name, member);
2310
2311 status = dcerpc_samr_LookupNames(b, mem_ctx,
2312 &domain_pol,
2313 1,
2314 &lsa_acct_name,
2315 &rids,
2316 &rid_types,
2317 &result);
2318 if (!NT_STATUS_IS_OK(status)) {
2319 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2320 member);
2321 goto done;
2322 }
2323
2324 if (!NT_STATUS_IS_OK(result)) {
2325 status = result;
2326 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2327 member);
2328 goto done;
2329 }
2330
2331 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2332 &domain_pol,
2333 MAXIMUM_ALLOWED_ACCESS,
2334 group_rid,
2335 &group_pol,
2336 &result);
2337 if (!NT_STATUS_IS_OK(status)) {
2338 goto done;
2339 }
2340 if (!NT_STATUS_IS_OK(result)) {
2341 status = result;
2342 goto done;
2343 }
2344
2345 status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
2346 &group_pol,
2347 rids.ids[0],
2348 &result);
2349 if (!NT_STATUS_IS_OK(status)) {
2350 goto done;
2351 }
2352
2353 status = result;
2354 done:
2355 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2356 return status;
2357 }
2358
2359 static NTSTATUS rpc_del_aliasmem(struct rpc_pipe_client *pipe_hnd,
2360 TALLOC_CTX *mem_ctx,
2361 const struct dom_sid *alias_sid,
2362 const char *member)
2363 {
2364 struct policy_handle connect_pol, domain_pol;
2365 NTSTATUS status, result;
2366 uint32 alias_rid;
2367 struct policy_handle alias_pol;
2368 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2369
2370 struct dom_sid member_sid;
2371 enum lsa_SidType member_type;
2372
2373 struct dom_sid sid;
2374
2375 sid_copy(&sid, alias_sid);
2376
2377 if (!sid_split_rid(&sid, &alias_rid))
2378 return NT_STATUS_UNSUCCESSFUL;
2379
2380 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
2381 member, &member_sid, &member_type);
2382
2383 if (!NT_STATUS_IS_OK(result)) {
2384 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2385 member);
2386 return result;
2387 }
2388
2389 /* Get sam policy handle */
2390 status = dcerpc_samr_Connect2(b, mem_ctx,
2391 pipe_hnd->desthost,
2392 MAXIMUM_ALLOWED_ACCESS,
2393 &connect_pol,
2394 &result);
2395 if (!NT_STATUS_IS_OK(status)) {
2396 goto done;
2397 }
2398 if (!NT_STATUS_IS_OK(result)) {
2399 status = result;
2400 goto done;
2401 }
2402
2403 /* Get domain policy handle */
2404 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2405 &connect_pol,
2406 MAXIMUM_ALLOWED_ACCESS,
2407 &sid,
2408 &domain_pol,
2409 &result);
2410 if (!NT_STATUS_IS_OK(status)) {
2411 goto done;
2412 }
2413 if (!NT_STATUS_IS_OK(result)) {
2414 status = result;
2415 goto done;
2416 }
2417
2418 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2419 &domain_pol,
2420 MAXIMUM_ALLOWED_ACCESS,
2421 alias_rid,
2422 &alias_pol,
2423 &result);
2424 if (!NT_STATUS_IS_OK(status)) {
2425 return status;
2426 }
2427
2428 if (!NT_STATUS_IS_OK(result)) {
2429 return result;
2430 }
2431
2432 status = dcerpc_samr_DeleteAliasMember(b, mem_ctx,
2433 &alias_pol,
2434 &member_sid,
2435 &result);
2436
2437 if (!NT_STATUS_IS_OK(status)) {
2438 return status;
2439 }
2440
2441 status = result;
2442
2443 done:
2444 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2445 return status;
2446 }
2447
2448 static NTSTATUS rpc_group_delmem_internals(struct net_context *c,
2449 const struct dom_sid *domain_sid,
2450 const char *domain_name,
2451 struct cli_state *cli,
2452 struct rpc_pipe_client *pipe_hnd,
2453 TALLOC_CTX *mem_ctx,
2454 int argc,
2455 const char **argv)
2456 {
2457 struct dom_sid group_sid;
2458 enum lsa_SidType group_type;
2459
2460 if (argc != 2 || c->display_usage) {
2461 d_printf("%s\n%s",
2462 _("Usage:"),
2463 _("net rpc group delmem <group> <member>\n"
2464 " Delete a member from a group\n"
2465 " group\tGroup to delete member from\n"
2466 " member\tMember to delete from group\n"));
2467 return NT_STATUS_UNSUCCESSFUL;
2468 }
2469
2470 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2471 &group_sid, &group_type))) {
2472 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2473 argv[0]);
2474 return NT_STATUS_UNSUCCESSFUL;
2475 }
2476
2477 if (group_type == SID_NAME_DOM_GRP) {
2478 NTSTATUS result = rpc_del_groupmem(c, pipe_hnd, mem_ctx,
2479 &group_sid, argv[1]);
2480
2481 if (!NT_STATUS_IS_OK(result)) {
2482 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2483 argv[1], argv[0], nt_errstr(result));
2484 }
2485 return result;
2486 }
2487
2488 if (group_type == SID_NAME_ALIAS) {
2489 NTSTATUS result = rpc_del_aliasmem(pipe_hnd, mem_ctx,
2490 &group_sid, argv[1]);
2491
2492 if (!NT_STATUS_IS_OK(result)) {
2493 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2494 argv[1], argv[0], nt_errstr(result));
2495 }
2496 return result;
2497 }
2498
2499 d_fprintf(stderr, _("Can only delete members from global or local "
2500 "groups which %s is not\n"), argv[0]);
2501
2502 return NT_STATUS_UNSUCCESSFUL;
2503 }
2504
2505 static int rpc_group_delmem(struct net_context *c, int argc, const char **argv)
2506 {
2507 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2508 rpc_group_delmem_internals,
2509 argc, argv);
2510 }
2511
2512 /**
2513 * List groups on a remote RPC server.
2514 *
2515 * All parameters are provided by the run_rpc_command function, except for
2516 * argc, argv which are passes through.
2517 *
2518 * @param domain_sid The domain sid acquired from the remote server.
2519 * @param cli A cli_state connected to the server.
2520 * @param mem_ctx Talloc context, destroyed on completion of the function.
2521 * @param argc Standard main() style argc.
2522 * @param argv Standard main() style argv. Initial components are already
2523 * stripped.
2524 *
2525 * @return Normal NTSTATUS return.
2526 **/
2527
2528 static NTSTATUS rpc_group_list_internals(struct net_context *c,
2529 const struct dom_sid *domain_sid,
2530 const char *domain_name,
2531 struct cli_state *cli,
2532 struct rpc_pipe_client *pipe_hnd,
2533 TALLOC_CTX *mem_ctx,
2534 int argc,
2535 const char **argv)
2536 {
2537 struct policy_handle connect_pol, domain_pol;
2538 NTSTATUS status, result;
2539 uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
2540 struct samr_SamArray *groups = NULL;
2541 bool global = false;
2542 bool local = false;
2543 bool builtin = false;
2544 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2545
2546 if (c->display_usage) {
2547 d_printf("%s\n%s",
2548 _("Usage:"),
2549 _("net rpc group list [global] [local] [builtin]\n"
2550 " List groups on RPC server\n"
2551 " global\tList global groups\n"
2552 " local\tList local groups\n"
2553 " builtin\tList builtin groups\n"
2554 " If none of global, local or builtin is "
2555 "specified, all three options are considered "
2556 "set\n"));
2557 return NT_STATUS_OK;
2558 }
2559
2560 if (argc == 0) {
2561 global = true;
2562 local = true;
2563 builtin = true;
2564 }
2565
2566 for (i=0; i<argc; i++) {
2567 if (strequal(argv[i], "global"))
2568 global = true;
2569
2570 if (strequal(argv[i], "local"))
2571 local = true;
2572
2573 if (strequal(argv[i], "builtin"))
2574 builtin = true;
2575 }
2576
2577 /* Get sam policy handle */
2578
2579 status = dcerpc_samr_Connect2(b, mem_ctx,
2580 pipe_hnd->desthost,
2581 MAXIMUM_ALLOWED_ACCESS,
2582 &connect_pol,
2583 &result);
2584 if (!NT_STATUS_IS_OK(status)) {
2585 goto done;
2586 }
2587 if (!NT_STATUS_IS_OK(result)) {
2588 status = result;
2589 goto done;
2590 }
2591
2592 /* Get domain policy handle */
2593
2594 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2595 &connect_pol,
2596 MAXIMUM_ALLOWED_ACCESS,
2597 discard_const_p(struct dom_sid2, domain_sid),
2598 &domain_pol,
2599 &result);
2600 if (!NT_STATUS_IS_OK(status)) {
2601 goto done;
2602 }
2603 if (!NT_STATUS_IS_OK(result)) {
2604 status = result;
2605 goto done;
2606 }
2607
2608 /* Query domain groups */
2609 if (c->opt_long_list_entries)
2610 d_printf(_("\nGroup name Comment"
2611 "\n-----------------------------\n"));
2612 do {
2613 uint32_t max_size, total_size, returned_size;
2614 union samr_DispInfo info;
2615
2616 if (!global) break;
2617
2618 dcerpc_get_query_dispinfo_params(
2619 loop_count, &max_entries, &max_size);
2620
2621 status = dcerpc_samr_QueryDisplayInfo(b, mem_ctx,
2622 &domain_pol,
2623 3,
2624 start_idx,
2625 max_entries,
2626 max_size,
2627 &total_size,
2628 &returned_size,
2629 &info,
2630 &result);
2631 if (!NT_STATUS_IS_OK(status)) {
2632 goto done;
2633 }
2634 num_entries = info.info3.count;
2635 start_idx += info.info3.count;
2636
2637 if (!NT_STATUS_IS_OK(result) &&
2638 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2639 break;
2640
2641 for (i = 0; i < num_entries; i++) {
2642
2643 const char *group = NULL;
2644 const char *desc = NULL;
2645
2646 group = info.info3.entries[i].account_name.string;
2647 desc = info.info3.entries[i].description.string;
2648
2649 if (c->opt_long_list_entries)
2650 printf("%-21.21s %-50.50s\n",
2651 group, desc);
2652 else
2653 printf("%s\n", group);
2654 }
2655 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2656 /* query domain aliases */
2657 start_idx = 0;
2658 do {
2659 if (!local) break;
2660
2661 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2662 &domain_pol,
2663 &start_idx,
2664 &groups,
2665 0xffff,
2666 &num_entries,
2667 &result);
2668 if (!NT_STATUS_IS_OK(status)) {
2669 goto done;
2670 }
2671 if (!NT_STATUS_IS_OK(result) &&
2672 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2673 break;
2674
2675 for (i = 0; i < num_entries; i++) {
2676
2677 const char *description = NULL;
2678
2679 if (c->opt_long_list_entries) {
2680
2681 struct policy_handle alias_pol;
2682 union samr_AliasInfo *info = NULL;
2683 NTSTATUS _result;
2684
2685 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2686 &domain_pol,
2687 0x8,
2688 groups->entries[i].idx,
2689 &alias_pol,
2690 &_result);
2691 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2692 status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2693 &alias_pol,
2694 3,
2695 &info,
2696 &_result);
2697 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2698 status = dcerpc_samr_Close(b, mem_ctx,
2699 &alias_pol,
2700 &_result);
2701 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2702 description = info->description.string;
2703 }
2704 }
2705 }
2706 }
2707
2708 if (description != NULL) {
2709 printf("%-21.21s %-50.50s\n",
2710 groups->entries[i].name.string,
2711 description);
2712 } else {
2713 printf("%s\n", groups->entries[i].name.string);
2714 }
2715 }
2716 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2717 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
2718 /* Get builtin policy handle */
2719
2720 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2721 &connect_pol,
2722 MAXIMUM_ALLOWED_ACCESS,
2723 discard_const_p(struct dom_sid2, &global_sid_Builtin),
2724 &domain_pol,
2725 &result);
2726 if (!NT_STATUS_IS_OK(status)) {
2727 goto done;
2728 }
2729 if (!NT_STATUS_IS_OK(result)) {
2730 status = result;
2731 goto done;
2732 }
2733
2734 /* query builtin aliases */
2735 start_idx = 0;
2736 do {
2737 if (!builtin) break;
2738
2739 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2740 &domain_pol,
2741 &start_idx,
2742 &groups,
2743 max_entries,
2744 &num_entries,
2745 &result);
2746 if (!NT_STATUS_IS_OK(status)) {
2747 break;
2748 }
2749 if (!NT_STATUS_IS_OK(result) &&
2750 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
2751 status = result;
2752 break;
2753 }
2754
2755 for (i = 0; i < num_entries; i++) {
2756
2757 const char *description = NULL;
2758
2759 if (c->opt_long_list_entries) {
2760
2761 struct policy_handle alias_pol;
2762 union samr_AliasInfo *info = NULL;
2763 NTSTATUS _result;
2764
2765 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2766 &domain_pol,
2767 0x8,
2768 groups->entries[i].idx,
2769 &alias_pol,
2770 &_result);
2771 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2772 status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2773 &alias_pol,
2774 3,
2775 &info,
2776 &_result);
2777 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2778 status = dcerpc_samr_Close(b, mem_ctx,
2779 &alias_pol,
2780 &_result);
2781 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2782 description = info->description.string;
2783 }
2784 }
2785 }
2786 }
2787
2788 if (description != NULL) {
2789 printf("%-21.21s %-50.50s\n",
2790 groups->entries[i].name.string,
2791 description);
2792 } else {
2793 printf("%s\n", groups->entries[i].name.string);
2794 }
2795 }
2796 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2797
2798 status = result;
2799
2800 done:
2801 return status;
2802 }
2803
2804 static int rpc_group_list(struct net_context *c, int argc, const char **argv)
2805 {
2806 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2807 rpc_group_list_internals,
2808 argc, argv);
2809 }
2810
2811 static NTSTATUS rpc_list_group_members(struct net_context *c,
2812 struct rpc_pipe_client *pipe_hnd,
2813 TALLOC_CTX *mem_ctx,
2814 const char *domain_name,
2815 const struct dom_sid *domain_sid,
2816 struct policy_handle *domain_pol,
2817 uint32 rid)
2818 {
2819 NTSTATUS result, status;
2820 struct policy_handle group_pol;
2821 uint32 num_members, *group_rids;
2822 int i;
2823 struct samr_RidAttrArray *rids = NULL;
2824 struct lsa_Strings names;
2825 struct samr_Ids types;
2826 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2827
2828 fstring sid_str;
2829 sid_to_fstring(sid_str, domain_sid);
2830
2831 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2832 domain_pol,
2833 MAXIMUM_ALLOWED_ACCESS,
2834 rid,
2835 &group_pol,
2836 &result);
2837 if (!NT_STATUS_IS_OK(status)) {
2838 return status;
2839 }
2840 if (!NT_STATUS_IS_OK(result)) {
2841 return result;
2842 }
2843
2844 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
2845 &group_pol,
2846 &rids,
2847 &result);
2848 if (!NT_STATUS_IS_OK(status)) {
2849 return status;
2850 }
2851 if (!NT_STATUS_IS_OK(result)) {
2852 return result;
2853 }
2854
2855 num_members = rids->count;
2856 group_rids = rids->rids;
2857
2858 while (num_members > 0) {
2859 int this_time = 512;
2860
2861 if (num_members < this_time)
2862 this_time = num_members;
2863
2864 status = dcerpc_samr_LookupRids(b, mem_ctx,
2865 domain_pol,
2866 this_time,
2867 group_rids,
2868 &names,
2869 &types,
2870 &result);
2871 if (!NT_STATUS_IS_OK(status)) {
2872 return status;
2873 }
2874 if (!NT_STATUS_IS_OK(result)) {
2875 return result;
2876 }
2877
2878 /* We only have users as members, but make the output
2879 the same as the output of alias members */
2880
2881 for (i = 0; i < this_time; i++) {
2882
2883 if (c->opt_long_list_entries) {
2884 printf("%s-%d %s\\%s %d\n", sid_str,
2885 group_rids[i], domain_name,
2886 names.names[i].string,
2887 SID_NAME_USER);
2888 } else {
2889 printf("%s\\%s\n", domain_name,
2890 names.names[i].string);
2891 }
2892 }
2893
2894 num_members -= this_time;
2895 group_rids += 512;
2896 }
2897
2898 return NT_STATUS_OK;
2899 }
2900
2901 static NTSTATUS rpc_list_alias_members(struct net_context *c,
2902 struct rpc_pipe_client *pipe_hnd,
2903 TALLOC_CTX *mem_ctx,
2904 struct policy_handle *domain_pol,
2905 uint32 rid)
2906 {
2907 NTSTATUS result, status;
2908 struct rpc_pipe_client *lsa_pipe;
2909 struct policy_handle alias_pol, lsa_pol;
2910 uint32 num_members;
2911 struct dom_sid *alias_sids;
2912 char **domains;
2913 char **names;
2914 enum lsa_SidType *types;
2915 int i;
2916 struct lsa_SidArray sid_array;
2917 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2918
2919 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2920 domain_pol,
2921 MAXIMUM_ALLOWED_ACCESS,
2922 rid,
2923 &alias_pol,
2924 &result);
2925 if (!NT_STATUS_IS_OK(status)) {
2926 return status;
2927 }
2928 if (!NT_STATUS_IS_OK(result)) {
2929 return result;
2930 }
2931
2932 status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
2933 &alias_pol,
2934 &sid_array,
2935 &result);
2936 if (!NT_STATUS_IS_OK(status)) {
2937 d_fprintf(stderr, _("Couldn't list alias members\n"));
2938 return status;
2939 }
2940 if (!NT_STATUS_IS_OK(result)) {
2941 d_fprintf(stderr, _("Couldn't list alias members\n"));
2942 return result;
2943 }
2944
2945 num_members = sid_array.num_sids;
2946
2947 if (num_members == 0) {
2948 return NT_STATUS_OK;
2949 }
2950
2951 result = cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd),
2952 &ndr_table_lsarpc.syntax_id,
2953 &lsa_pipe);
2954 if (!NT_STATUS_IS_OK(result)) {
2955 d_fprintf(stderr, _("Couldn't open LSA pipe. Error was %s\n"),
2956 nt_errstr(result) );
2957 return result;
2958 }
2959
2960 result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, true,
2961 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
2962
2963 if (!NT_STATUS_IS_OK(result)) {
2964 d_fprintf(stderr, _("Couldn't open LSA policy handle\n"));
2965 TALLOC_FREE(lsa_pipe);
2966 return result;
2967 }
2968
2969 alias_sids = talloc_zero_array(mem_ctx, struct dom_sid, num_members);
2970 if (!alias_sids) {
2971 d_fprintf(stderr, _("Out of memory\n"));
2972 TALLOC_FREE(lsa_pipe);
2973 return NT_STATUS_NO_MEMORY;
2974 }
2975
2976 for (i=0; i<num_members; i++) {
2977 sid_copy(&alias_sids[i], sid_array.sids[i].sid);
2978 }
2979
2980 result = rpccli_lsa_lookup_sids(lsa_pipe, mem_ctx, &lsa_pol,
2981 num_members, alias_sids,
2982 &domains, &names, &types);
2983
2984 if (!NT_STATUS_IS_OK(result) &&
2985 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2986 d_fprintf(stderr, _("Couldn't lookup SIDs\n"));
2987 TALLOC_FREE(lsa_pipe);
2988 return result;
2989 }
2990
2991 for (i = 0; i < num_members; i++) {
2992 fstring sid_str;
2993 sid_to_fstring(sid_str, &alias_sids[i]);
2994
2995 if (c->opt_long_list_entries) {
2996 printf("%s %s\\%s %d\n", sid_str,
2997 domains[i] ? domains[i] : _("*unknown*"),
2998 names[i] ? names[i] : _("*unknown*"), types[i]);
2999 } else {
3000 if (domains[i])
3001 printf("%s\\%s\n", domains[i], names[i]);
3002 else
3003 printf("%s\n", sid_str);
3004 }
3005 }
3006
3007 TALLOC_FREE(lsa_pipe);
3008 return NT_STATUS_OK;
3009 }
3010
3011 static NTSTATUS rpc_group_members_internals(struct net_context *c,
3012 const struct dom_sid *domain_sid,
3013 const char *domain_name,
3014 struct cli_state *cli,
3015 struct rpc_pipe_client *pipe_hnd,
3016 TALLOC_CTX *mem_ctx,
3017 int argc,
3018 const char **argv)
3019 {
3020 NTSTATUS result, status;
3021 struct policy_handle connect_pol, domain_pol;
3022 struct samr_Ids rids, rid_types;
3023 struct lsa_String lsa_acct_name;
3024 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3025
3026 /* Get sam policy handle */
3027
3028 status = dcerpc_samr_Connect2(b, mem_ctx,
3029 pipe_hnd->desthost,
3030 MAXIMUM_ALLOWED_ACCESS,
3031 &connect_pol,
3032 &result);
3033 if (!NT_STATUS_IS_OK(status)) {
3034 return status;
3035 }
3036 if (!NT_STATUS_IS_OK(result)) {
3037 return result;
3038 }
3039
3040 /* Get domain policy handle */
3041
3042 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3043 &connect_pol,
3044 MAXIMUM_ALLOWED_ACCESS,
3045 discard_const_p(struct dom_sid2, domain_sid),
3046 &domain_pol,
3047 &result);
3048 if (!NT_STATUS_IS_OK(status)) {
3049 return status;
3050 }
3051 if (!NT_STATUS_IS_OK(result)) {
3052 return result;
3053 }
3054
3055 init_lsa_String(&lsa_acct_name, argv[0]); /* sure? */
3056
3057 status = dcerpc_samr_LookupNames(b, mem_ctx,
3058 &domain_pol,
3059 1,
3060 &lsa_acct_name,
3061 &rids,
3062 &rid_types,
3063 &result);
3064 if (!NT_STATUS_IS_OK(status)) {
3065 return status;
3066 }
3067
3068 if (!NT_STATUS_IS_OK(result)) {
3069
3070 /* Ok, did not find it in the global sam, try with builtin */
3071
3072 struct dom_sid sid_Builtin;
3073
3074 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
3075
3076 sid_copy(&sid_Builtin, &global_sid_Builtin);
3077
3078 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3079 &connect_pol,
3080 MAXIMUM_ALLOWED_ACCESS,
3081 &sid_Builtin,
3082 &domain_pol,
3083 &result);
3084 if (!NT_STATUS_IS_OK(status)) {
3085 return status;
3086 }
3087 if (!NT_STATUS_IS_OK(result)) {
3088 d_fprintf(stderr, _("Couldn't find group %s\n"),
3089 argv[0]);
3090 return result;
3091 }
3092
3093 status = dcerpc_samr_LookupNames(b, mem_ctx,
3094 &domain_pol,
3095 1,
3096 &lsa_acct_name,
3097 &rids,
3098 &rid_types,
3099 &result);
3100 if (!NT_STATUS_IS_OK(status)) {
3101 return status;
3102 }
3103 if (!NT_STATUS_IS_OK(result)) {
3104 d_fprintf(stderr, _("Couldn't find group %s\n"),
3105 argv[0]);
3106 return result;
3107 }
3108 }
3109
3110 if (rids.count != 1) {
3111 d_fprintf(stderr, _("Couldn't find group %s\n"),
3112 argv[0]);
3113 return result;
3114 }
3115
3116 if (rid_types.ids[0] == SID_NAME_DOM_GRP) {
3117 return rpc_list_group_members(c, pipe_hnd, mem_ctx, domain_name,
3118 domain_sid, &domain_pol,
3119 rids.ids[0]);
3120 }
3121
3122 if (rid_types.ids[0] == SID_NAME_ALIAS) {
3123 return rpc_list_alias_members(c, pipe_hnd, mem_ctx, &domain_pol,
3124 rids.ids[0]);
3125 }
3126
3127 return NT_STATUS_NO_SUCH_GROUP;
3128 }
3129
3130 static int rpc_group_members(struct net_context *c, int argc, const char **argv)
3131 {
3132 if (argc != 1 || c->display_usage) {
3133 return rpc_group_usage(c, argc, argv);
3134 }
3135
3136 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3137 rpc_group_members_internals,
3138 argc, argv);
3139 }
3140
3141 static int rpc_group_rename_internals(struct net_context *c, int argc, const char **argv)
3142 {
3143 NET_API_STATUS status;
3144 struct GROUP_INFO_0 g0;
3145 uint32_t parm_err;
3146
3147 if (argc != 2) {
3148 d_printf(_("Usage:\n"));
3149 d_printf("net rpc group rename group newname\n");
3150 return -1;
3151 }
3152
3153 g0.grpi0_name = argv[1];
3154
3155 status = NetGroupSetInfo(c->opt_host,
3156 argv[0],
3157 0,
3158 (uint8_t *)&g0,
3159 &parm_err);
3160
3161 if (status != 0) {
3162 d_fprintf(stderr, _("Renaming group %s failed with: %s\n"),
3163 argv[0], libnetapi_get_error_string(c->netapi_ctx,
3164 status));
3165 return -1;
3166 }
3167
3168 return 0;
3169 }
3170
3171 static int rpc_group_rename(struct net_context *c, int argc, const char **argv)
3172 {
3173 if (argc != 2 || c->display_usage) {
3174 return rpc_group_usage(c, argc, argv);
3175 }
3176
3177 return rpc_group_rename_internals(c, argc, argv);
3178 }
3179
3180 /**
3181 * 'net rpc group' entrypoint.
3182 * @param argc Standard main() style argc.
3183 * @param argv Standard main() style argv. Initial components are already
3184 * stripped.
3185 **/
3186
3187 int net_rpc_group(struct net_context *c, int argc, const char **argv)
3188 {
3189 NET_API_STATUS status;
3190
3191 struct functable func[] = {
3192 {
3193 "add",
3194 rpc_group_add,
3195 NET_TRANSPORT_RPC,
3196 N_("Create specified group"),
3197 N_("net rpc group add\n"
3198 " Create specified group")
3199 },
3200 {
3201 "delete",
3202 rpc_group_delete,
3203 NET_TRANSPORT_RPC,
3204 N_("Delete specified group"),
3205 N_("net rpc group delete\n"
3206 " Delete specified group")
3207 },
3208 {
3209 "addmem",
3210 rpc_group_addmem,
3211 NET_TRANSPORT_RPC,
3212 N_("Add member to group"),
3213 N_("net rpc group addmem\n"
3214 " Add member to group")
3215 },
3216 {
3217 "delmem",
3218 rpc_group_delmem,
3219 NET_TRANSPORT_RPC,
3220 N_("Remove member from group"),
3221 N_("net rpc group delmem\n"
3222 " Remove member from group")
3223 },
3224 {
3225 "list",
3226 rpc_group_list,
3227 NET_TRANSPORT_RPC,
3228 N_("List groups"),
3229 N_("net rpc group list\n"
3230 " List groups")
3231 },
3232 {
3233 "members",
3234 rpc_group_members,
3235 NET_TRANSPORT_RPC,
3236 N_("List group members"),
3237 N_("net rpc group members\n"
3238 " List group members")
3239 },
3240 {
3241 "rename",
3242 rpc_group_rename,
3243 NET_TRANSPORT_RPC,
3244 N_("Rename group"),
3245 N_("net rpc group rename\n"
3246 " Rename group")
3247 },
3248 {NULL, NULL, 0, NULL, NULL}
3249 };
3250
3251 status = libnetapi_net_init(&c->netapi_ctx);
3252 if (status != 0) {
3253 return -1;
3254 }
3255 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
3256 libnetapi_set_password(c->netapi_ctx, c->opt_password);
3257 if (c->opt_kerberos) {
3258 libnetapi_set_use_kerberos(c->netapi_ctx);
3259 }
3260
3261 if (argc == 0) {
3262 if (c->display_usage) {
3263 d_printf(_("Usage:\n"));
3264 d_printf(_("net rpc group\n"
3265 " Alias for net rpc group list global "
3266 "local builtin\n"));
3267 net_display_usage_from_functable(func);
3268 return 0;
3269 }
3270
3271 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3272 rpc_group_list_internals,
3273 argc, argv);
3274 }
3275
3276 return net_run_function(c, argc, argv, "net rpc group", func);
3277 }
3278
3279 /****************************************************************************/
3280
3281 static int rpc_share_usage(struct net_context *c, int argc, const char **argv)
3282 {
3283 return net_share_usage(c, argc, argv);
3284 }
3285
3286 /**
3287 * Add a share on a remote RPC server.
3288 *
3289 * @param argc Standard main() style argc.
3290 * @param argv Standard main() style argv. Initial components are already
3291 * stripped.
3292 *
3293 * @return A shell status integer (0 for success).
3294 **/
3295
3296 static int rpc_share_add(struct net_context *c, int argc, const char **argv)
3297 {
3298 NET_API_STATUS status;
3299 char *sharename;
3300 char *path;
3301 uint32 type = STYPE_DISKTREE; /* only allow disk shares to be added */
3302 uint32 num_users=0, perms=0;
3303 char *password=NULL; /* don't allow a share password */
3304 struct SHARE_INFO_2 i2;
3305 uint32_t parm_error = 0;
3306
3307 if ((argc < 1) || !strchr(argv[0], '=') || c->display_usage) {
3308 return rpc_share_usage(c, argc, argv);
3309 }
3310
3311 if ((sharename = talloc_strdup(c, argv[0])) == NULL) {
3312 return -1;
3313 }
3314
3315 path = strchr(sharename, '=');
3316 if (!path) {
3317 return -1;
3318 }
3319
3320 *path++ = '\0';
3321
3322 i2.shi2_netname = sharename;
3323 i2.shi2_type = type;
3324 i2.shi2_remark = c->opt_comment;
3325 i2.shi2_permissions = perms;
3326 i2.shi2_max_uses = c->opt_maxusers;
3327 i2.shi2_current_uses = num_users;
3328 i2.shi2_path = path;
3329 i2.shi2_passwd = password;
3330
3331 status = NetShareAdd(c->opt_host,
3332 2,
3333 (uint8_t *)&i2,
3334 &parm_error);
3335 if (status != 0) {
3336 printf(_("NetShareAdd failed with: %s\n"),
3337 libnetapi_get_error_string(c->netapi_ctx, status));
3338 }
3339
3340 return status;
3341 }
3342
3343 /**
3344 * Delete a share on a remote RPC server.
3345 *
3346 * @param domain_sid The domain sid acquired from the remote server.
3347 * @param argc Standard main() style argc.
3348 * @param argv Standard main() style argv. Initial components are already
3349 * stripped.
3350 *
3351 * @return A shell status integer (0 for success).
3352 **/
3353 static int rpc_share_delete(struct net_context *c, int argc, const char **argv)
3354 {
3355 if (argc < 1 || c->display_usage) {
3356 return rpc_share_usage(c, argc, argv);
3357 }
3358
3359 return NetShareDel(c->opt_host, argv[0], 0);
3360 }
3361
3362 /**
3363 * Formatted print of share info
3364 *
3365 * @param r pointer to SHARE_INFO_1 to format
3366 **/
3367
3368 static void display_share_info_1(struct net_context *c,
3369 struct SHARE_INFO_1 *r)
3370 {
3371 if (c->opt_long_list_entries) {
3372 d_printf("%-12s %-8.8s %-50s\n",
3373 r->shi1_netname,
3374 net_share_type_str(r->shi1_type & ~(STYPE_TEMPORARY|STYPE_HIDDEN)),
3375 r->shi1_remark);
3376 } else {
3377 d_printf("%s\n", r->shi1_netname);
3378 }
3379 }
3380
3381 static WERROR get_share_info(struct net_context *c,
3382 struct rpc_pipe_client *pipe_hnd,
3383 TALLOC_CTX *mem_ctx,
3384 uint32 level,
3385 int argc,
3386 const char **argv,
3387 struct srvsvc_NetShareInfoCtr *info_ctr)
3388 {
3389 WERROR result;
3390 NTSTATUS status;
3391 union srvsvc_NetShareInfo info;
3392 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3393
3394 /* no specific share requested, enumerate all */
3395 if (argc == 0) {
3396
3397 uint32_t preferred_len = 0xffffffff;
3398 uint32_t total_entries = 0;
3399 uint32_t resume_handle = 0;
3400
3401 info_ctr->level = level;
3402
3403 status = dcerpc_srvsvc_NetShareEnumAll(b, mem_ctx,
3404 pipe_hnd->desthost,
3405 info_ctr,
3406 preferred_len,
3407 &total_entries,
3408 &resume_handle,
3409 &result);
3410 if (!NT_STATUS_IS_OK(status)) {
3411 return ntstatus_to_werror(status);
3412 }
3413 return result;
3414 }
3415
3416 /* request just one share */
3417 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
3418 pipe_hnd->desthost,
3419 argv[0],
3420 level,
3421 &info,
3422 &result);
3423
3424 if (!NT_STATUS_IS_OK(status)) {
3425 result = ntstatus_to_werror(status);
3426 goto done;
3427 }
3428
3429 if (!W_ERROR_IS_OK(result)) {
3430 goto done;
3431 }
3432
3433 /* construct ctr */
3434 ZERO_STRUCTP(info_ctr);
3435
3436 info_ctr->level = level;
3437
3438 switch (level) {
3439 case 1:
3440 {
3441 struct srvsvc_NetShareCtr1 *ctr1;
3442
3443 ctr1 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr1);
3444 W_ERROR_HAVE_NO_MEMORY(ctr1);
3445
3446 ctr1->count = 1;
3447 ctr1->array = info.info1;
3448
3449 info_ctr->ctr.ctr1 = ctr1;
3450
3451 break;
3452 }
3453 case 2:
3454 {
3455 struct srvsvc_NetShareCtr2 *ctr2;
3456
3457 ctr2 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr2);
3458 W_ERROR_HAVE_NO_MEMORY(ctr2);
3459
3460 ctr2->count = 1;
3461 ctr2->array = info.info2;
3462
3463 info_ctr->ctr.ctr2 = ctr2;
3464
3465 break;
3466 }
3467 case 502:
3468 {
3469 struct srvsvc_NetShareCtr502 *ctr502;
3470
3471 ctr502 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr502);
3472 W_ERROR_HAVE_NO_MEMORY(ctr502);
3473
3474 ctr502->count = 1;
3475 ctr502->array = info.info502;
3476
3477 info_ctr->ctr.ctr502 = ctr502;
3478
3479 break;
3480 }
3481 } /* switch */
3482 done:
3483 return result;
3484 }
3485
3486 /***
3487 * 'net rpc share list' entrypoint.
3488 * @param argc Standard main() style argc.
3489 * @param argv Standard main() style argv. Initial components are already
3490 * stripped.
3491 **/
3492 static int rpc_share_list(struct net_context *c, int argc, const char **argv)
3493 {
3494 NET_API_STATUS status;
3495 struct SHARE_INFO_1 *i1 = NULL;
3496 uint32_t entries_read = 0;
3497 uint32_t total_entries = 0;
3498 uint32_t resume_handle = 0;
3499 uint32_t i, level = 1;
3500
3501 if (c->display_usage) {
3502 d_printf( "%s\n"
3503 "net rpc share list\n"
3504 " %s\n",
3505 _("Usage:"),
3506 _("List shares on remote server"));
3507 return 0;
3508 }
3509
3510 status = NetShareEnum(c->opt_host,
3511 level,
3512 (uint8_t **)(void *)&i1,
3513 (uint32_t)-1,
3514 &entries_read,
3515 &total_entries,
3516 &resume_handle);
3517 if (status != 0) {
3518 goto done;
3519 }
3520
3521 /* Display results */
3522
3523 if (c->opt_long_list_entries) {
3524 d_printf(_(
3525 "\nEnumerating shared resources (exports) on remote server:\n\n"
3526 "\nShare name Type Description\n"
3527 "---------- ---- -----------\n"));
3528 }
3529 for (i = 0; i < entries_read; i++)
3530 display_share_info_1(c, &i1[i]);
3531 done:
3532 return status;
3533 }
3534
3535 static bool check_share_availability(struct cli_state *cli, const char *netname)
3536 {
3537 NTSTATUS status;
3538
3539 status = cli_tree_connect(cli, netname, "A:", "", 0);
3540 if (!NT_STATUS_IS_OK(status)) {
3541 d_printf(_("skipping [%s]: not a file share.\n"), netname);
3542 return false;
3543 }
3544
3545 status = cli_tdis(cli);
3546 if (!NT_STATUS_IS_OK(status)) {
3547 d_printf(_("cli_tdis returned %s\n"), nt_errstr(status));
3548 return false;
3549 }
3550
3551 return true;
3552 }
3553
3554 static bool check_share_sanity(struct net_context *c, struct cli_state *cli,
3555 const char *netname, uint32 type)
3556 {
3557 /* only support disk shares */
3558 if (! ( type == STYPE_DISKTREE || type == (STYPE_DISKTREE | STYPE_HIDDEN)) ) {
3559 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname,
3560 type);
3561 return false;
3562 }
3563
3564 /* skip builtin shares */
3565 /* FIXME: should print$ be added too ? */
3566 if (strequal(netname,"IPC$") || strequal(netname,"ADMIN$") ||
3567 strequal(netname,"global"))
3568 return false;
3569
3570 if (c->opt_exclude && in_list(netname, c->opt_exclude, false)) {
3571 printf(_("excluding [%s]\n"), netname);
3572 return false;
3573 }
3574
3575 return check_share_availability(cli, netname);
3576 }
3577
3578 /**
3579 * Migrate shares from a remote RPC server to the local RPC server.
3580 *
3581 * All parameters are provided by the run_rpc_command function, except for
3582 * argc, argv which are passed through.
3583 *
3584 * @param domain_sid The domain sid acquired from the remote server.
3585 * @param cli A cli_state connected to the server.
3586 * @param mem_ctx Talloc context, destroyed on completion of the function.
3587 * @param argc Standard main() style argc.
3588 * @param argv Standard main() style argv. Initial components are already
3589 * stripped.
3590 *
3591 * @return Normal NTSTATUS return.
3592 **/
3593
3594 static NTSTATUS rpc_share_migrate_shares_internals(struct net_context *c,
3595 const struct dom_sid *domain_sid,
3596 const char *domain_name,
3597 struct cli_state *cli,
3598 struct rpc_pipe_client *pipe_hnd,
3599 TALLOC_CTX *mem_ctx,
3600 int argc,
3601 const char **argv)
3602 {
3603 WERROR result;
3604 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3605 struct srvsvc_NetShareInfoCtr ctr_src;
3606 uint32 i;
3607 struct rpc_pipe_client *srvsvc_pipe = NULL;
3608 struct cli_state *cli_dst = NULL;
3609 uint32 level = 502; /* includes secdesc */
3610 uint32_t parm_error = 0;
3611 struct dcerpc_binding_handle *b;
3612
3613 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3614 &ctr_src);
3615 if (!W_ERROR_IS_OK(result))
3616 goto done;
3617
3618 /* connect destination PI_SRVSVC */
3619 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
3620 &ndr_table_srvsvc.syntax_id);
3621 if (!NT_STATUS_IS_OK(nt_status))
3622 return nt_status;
3623
3624 b = srvsvc_pipe->binding_handle;
3625
3626 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3627
3628 union srvsvc_NetShareInfo info;
3629 struct srvsvc_NetShareInfo502 info502 =
3630 ctr_src.ctr.ctr502->array[i];
3631
3632 /* reset error-code */
3633 nt_status = NT_STATUS_UNSUCCESSFUL;
3634
3635 if (!check_share_sanity(c, cli, info502.name, info502.type))
3636 continue;
3637
3638 /* finally add the share on the dst server */
3639
3640 printf(_("migrating: [%s], path: %s, comment: %s, without "
3641 "share-ACLs\n"),
3642 info502.name, info502.path, info502.comment);
3643
3644 info.info502 = &info502;
3645
3646 nt_status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
3647 srvsvc_pipe->desthost,
3648 502,
3649 &info,
3650 &parm_error,
3651 &result);
3652 if (!NT_STATUS_IS_OK(nt_status)) {
3653 printf(_("cannot add share: %s\n"),
3654 nt_errstr(nt_status));
3655 goto done;
3656 }
3657 if (W_ERROR_V(result) == W_ERROR_V(WERR_FILE_EXISTS)) {
3658 printf(_(" [%s] does already exist\n"),
3659 info502.name);
3660 continue;
3661 }
3662
3663 if (!W_ERROR_IS_OK(result)) {
3664 nt_status = werror_to_ntstatus(result);
3665 printf(_("cannot add share: %s\n"),
3666 win_errstr(result));
3667 goto done;
3668 }
3669
3670 }
3671
3672 nt_status = NT_STATUS_OK;
3673
3674 done:
3675 if (cli_dst) {
3676 cli_shutdown(cli_dst);
3677 }
3678
3679 return nt_status;
3680
3681 }
3682
3683 /**
3684 * Migrate shares from a RPC server to another.
3685 *
3686 * @param argc Standard main() style argc.
3687 * @param argv Standard main() style argv. Initial components are already
3688 * stripped.
3689 *
3690 * @return A shell status integer (0 for success).
3691 **/
3692 static int rpc_share_migrate_shares(struct net_context *c, int argc,
3693 const char **argv)
3694 {
3695 if (c->display_usage) {
3696 d_printf( "%s\n"
3697 "net rpc share migrate shares\n"
3698 " %s\n",
3699 _("Usage:"),
3700 _("Migrate shares to local server"));
3701 return 0;
3702 }
3703
3704 if (!c->opt_host) {
3705 printf(_("no server to migrate\n"));
3706 return -1;
3707 }
3708
3709 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
3710 rpc_share_migrate_shares_internals,
3711 argc, argv);
3712 }
3713
3714 /**
3715 * Copy a file/dir
3716 *
3717 * @param f file_info
3718 * @param mask current search mask
3719 * @param state arg-pointer
3720 *
3721 **/
3722 static NTSTATUS copy_fn(const char *mnt, struct file_info *f,
3723 const char *mask, void *state)
3724 {
3725 static NTSTATUS nt_status;
3726 static struct copy_clistate *local_state;
3727 static fstring filename, new_mask;
3728 fstring dir;
3729 char *old_dir;
3730 struct net_context *c;
3731
3732 local_state = (struct copy_clistate *)state;
3733 nt_status = NT_STATUS_UNSUCCESSFUL;
3734
3735 c = local_state->c;
3736
3737 if (strequal(f->name, ".") || strequal(f->name, ".."))
3738 return NT_STATUS_OK;
3739
3740 DEBUG(3,("got mask: %s, name: %s\n", mask, f->name));
3741
3742 /* DIRECTORY */
3743 if (f->mode & FILE_ATTRIBUTE_DIRECTORY) {
3744
3745 DEBUG(3,("got dir: %s\n", f->name));
3746
3747 fstrcpy(dir, local_state->cwd);
3748 fstrcat(dir, "\\");
3749 fstrcat(dir, f->name);
3750
3751 switch (net_mode_share)
3752 {
3753 case NET_MODE_SHARE_MIGRATE:
3754 /* create that directory */
3755 nt_status = net_copy_file(c, local_state->mem_ctx,
3756 local_state->cli_share_src,
3757 local_state->cli_share_dst,
3758 dir, dir,
3759 c->opt_acls? true : false,
3760 c->opt_attrs? true : false,
3761 c->opt_timestamps? true:false,
3762 false);
3763 break;
3764 default:
3765 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3766 return NT_STATUS_INTERNAL_ERROR;
3767 }
3768
3769 if (!NT_STATUS_IS_OK(nt_status)) {
3770 printf(_("could not handle dir %s: %s\n"),
3771 dir, nt_errstr(nt_status));
3772 return nt_status;
3773 }
3774
3775 /* search below that directory */
3776 if (strlcpy(new_mask, dir, sizeof(new_mask)) >= sizeof(new_mask)) {
3777 return NT_STATUS_NO_MEMORY;
3778 }
3779 if (strlcat(new_mask, "\\*", sizeof(new_mask)) >= sizeof(new_mask)) {
3780 return NT_STATUS_NO_MEMORY;
3781 }
3782
3783 old_dir = local_state->cwd;
3784 local_state->cwd = dir;
3785 nt_status = sync_files(local_state, new_mask);
3786 if (!NT_STATUS_IS_OK(nt_status)) {
3787 printf(_("could not handle files\n"));
3788 }
3789 local_state->cwd = old_dir;
3790
3791 return nt_status;
3792 }
3793
3794
3795 /* FILE */
3796 fstrcpy(filename, local_state->cwd);
3797 fstrcat(filename, "\\");
3798 fstrcat(filename, f->name);
3799
3800 DEBUG(3,("got file: %s\n", filename));
3801
3802 switch (net_mode_share)
3803 {
3804 case NET_MODE_SHARE_MIGRATE:
3805 nt_status = net_copy_file(c, local_state->mem_ctx,
3806 local_state->cli_share_src,
3807 local_state->cli_share_dst,
3808 filename, filename,
3809 c->opt_acls? true : false,
3810 c->opt_attrs? true : false,
3811 c->opt_timestamps? true: false,
3812 true);
3813 break;
3814 default:
3815 d_fprintf(stderr, _("Unsupported file mode %d\n"),
3816 net_mode_share);
3817 return NT_STATUS_INTERNAL_ERROR;
3818 }
3819
3820 if (!NT_STATUS_IS_OK(nt_status))
3821 printf(_("could not handle file %s: %s\n"),
3822 filename, nt_errstr(nt_status));
3823 return nt_status;
3824 }
3825
3826 /**
3827 * sync files, can be called recursivly to list files
3828 * and then call copy_fn for each file
3829 *
3830 * @param cp_clistate pointer to the copy_clistate we work with
3831 * @param mask the current search mask
3832 *
3833 * @return Boolean result
3834 **/
3835 static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask)
3836 {
3837 struct cli_state *targetcli;
3838 char *targetpath = NULL;
3839 NTSTATUS status;
3840
3841 DEBUG(3,("calling cli_list with mask: %s\n", mask));
3842
3843 status = cli_resolve_path(talloc_tos(), "", NULL,
3844 cp_clistate->cli_share_src,
3845 mask, &targetcli, &targetpath);
3846 if (!NT_STATUS_IS_OK(status)) {
3847 d_fprintf(stderr, _("cli_resolve_path %s failed with error: "
3848 "%s\n"),
3849 mask, nt_errstr(status));
3850 return status;
3851 }
3852
3853 status = cli_list(targetcli, targetpath, cp_clistate->attribute,
3854 copy_fn, cp_clistate);
3855 if (!NT_STATUS_IS_OK(status)) {
3856 d_fprintf(stderr, _("listing %s failed with error: %s\n"),
3857 mask, nt_errstr(status));
3858 }
3859
3860 return status;
3861 }
3862
3863
3864 /**
3865 * Set the top level directory permissions before we do any further copies.
3866 * Should set up ACL inheritance.
3867 **/
3868
3869 bool copy_top_level_perms(struct net_context *c,
3870 struct copy_clistate *cp_clistate,
3871 const char *sharename)
3872 {
3873 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3874
3875 switch (net_mode_share) {
3876 case NET_MODE_SHARE_MIGRATE:
3877 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename));
3878 nt_status = net_copy_fileattr(c,
3879 cp_clistate->mem_ctx,
3880 cp_clistate->cli_share_src,
3881 cp_clistate->cli_share_dst,
3882 "\\", "\\",
3883 c->opt_acls? true : false,
3884 c->opt_attrs? true : false,
3885 c->opt_timestamps? true: false,
3886 false);
3887 break;
3888 default:
3889 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3890 break;
3891 }
3892
3893 if (!NT_STATUS_IS_OK(nt_status)) {
3894 printf(_("Could handle directory attributes for top level "
3895 "directory of share %s. Error %s\n"),
3896 sharename, nt_errstr(nt_status));
3897 return false;
3898 }
3899
3900 return true;
3901 }
3902
3903 /**
3904 * Sync all files inside a remote share to another share (over smb).
3905 *
3906 * All parameters are provided by the run_rpc_command function, except for
3907 * argc, argv which are passed through.
3908 *
3909 * @param domain_sid The domain sid acquired from the remote server.
3910 * @param cli A cli_state connected to the server.
3911 * @param mem_ctx Talloc context, destroyed on completion of the function.
3912 * @param argc Standard main() style argc.
3913 * @param argv Standard main() style argv. Initial components are already
3914 * stripped.
3915 *
3916 * @return Normal NTSTATUS return.
3917 **/
3918
3919 static NTSTATUS rpc_share_migrate_files_internals(struct net_context *c,
3920 const struct dom_sid *domain_sid,
3921 const char *domain_name,
3922 struct cli_state *cli,
3923 struct rpc_pipe_client *pipe_hnd,
3924 TALLOC_CTX *mem_ctx,
3925 int argc,
3926 const char **argv)
3927 {
3928 WERROR result;
3929 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3930 struct srvsvc_NetShareInfoCtr ctr_src;
3931 uint32 i;
3932 uint32 level = 502;
3933 struct copy_clistate cp_clistate;
3934 bool got_src_share = false;
3935 bool got_dst_share = false;
3936 const char *mask = "\\*";
3937 char *dst = NULL;
3938
3939 dst = SMB_STRDUP(c->opt_destination?c->opt_destination:"127.0.0.1");
3940 if (dst == NULL) {
3941 nt_status = NT_STATUS_NO_MEMORY;
3942 goto done;
3943 }
3944
3945 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3946 &ctr_src);
3947
3948 if (!W_ERROR_IS_OK(result))
3949 goto done;
3950
3951 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3952
3953 struct srvsvc_NetShareInfo502 info502 =
3954 ctr_src.ctr.ctr502->array[i];
3955
3956 if (!check_share_sanity(c, cli, info502.name, info502.type))
3957 continue;
3958
3959 /* one might not want to mirror whole discs :) */
3960 if (strequal(info502.name, "print$") || info502.name[1] == '$') {
3961 d_printf(_("skipping [%s]: builtin/hidden share\n"),
3962 info502.name);
3963 continue;
3964 }
3965
3966 switch (net_mode_share)
3967 {
3968 case NET_MODE_SHARE_MIGRATE:
3969 printf("syncing");
3970 break;
3971 default:
3972 d_fprintf(stderr, _("Unsupported mode %d\n"),
3973 net_mode_share);
3974 break;
3975 }
3976 printf(_(" [%s] files and directories %s ACLs, %s DOS "
3977 "Attributes %s\n"),
3978 info502.name,
3979 c->opt_acls ? _("including") : _("without"),
3980 c->opt_attrs ? _("including") : _("without"),
3981 c->opt_timestamps ? _("(preserving timestamps)") : "");
3982
3983 cp_clistate.mem_ctx = mem_ctx;
3984 cp_clistate.cli_share_src = NULL;
3985 cp_clistate.cli_share_dst = NULL;
3986 cp_clistate.cwd = NULL;
3987 cp_clistate.attribute = FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
3988 cp_clistate.c = c;
3989
3990 /* open share source */
3991 nt_status = connect_to_service(c, &cp_clistate.cli_share_src,
3992 smbXcli_conn_remote_sockaddr(cli->conn),
3993 smbXcli_conn_remote_name(cli->conn),
3994 info502.name, "A:");
3995 if (!NT_STATUS_IS_OK(nt_status))
3996 goto done;
3997
3998 got_src_share = true;
3999
4000 if (net_mode_share == NET_MODE_SHARE_MIGRATE) {
4001 /* open share destination */
4002 nt_status = connect_to_service(c, &cp_clistate.cli_share_dst,
4003 NULL, dst, info502.name, "A:");
4004 if (!NT_STATUS_IS_OK(nt_status))
4005 goto done;
4006
4007 got_dst_share = true;
4008 }
4009
4010 if (!copy_top_level_perms(c, &cp_clistate, info502.name)) {
4011 d_fprintf(stderr, _("Could not handle the top level "
4012 "directory permissions for the "
4013 "share: %s\n"), info502.name);
4014 nt_status = NT_STATUS_UNSUCCESSFUL;
4015 goto done;
4016 }
4017
4018 nt_status = sync_files(&cp_clistate, mask);
4019 if (!NT_STATUS_IS_OK(nt_status)) {
4020 d_fprintf(stderr, _("could not handle files for share: "
4021 "%s\n"), info502.name);
4022 goto done;
4023 }
4024 }
4025
4026 nt_status = NT_STATUS_OK;
4027
4028 done:
4029
4030 if (got_src_share)
4031 cli_shutdown(cp_clistate.cli_share_src);
4032
4033 if (got_dst_share)
4034 cli_shutdown(cp_clistate.cli_share_dst);
4035
4036 SAFE_FREE(dst);
4037 return nt_status;
4038
4039 }
4040
4041 static int rpc_share_migrate_files(struct net_context *c, int argc, const char **argv)
4042 {
4043 if (c->display_usage) {
4044 d_printf( "%s\n"
4045 "net share migrate files\n"
4046 " %s\n",
4047 _("Usage:"),
4048 _("Migrate files to local server"));
4049 return 0;
4050 }
4051
4052 if (!c->opt_host) {
4053 d_printf(_("no server to migrate\n"));
4054 return -1;
4055 }
4056
4057 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4058 rpc_share_migrate_files_internals,
4059 argc, argv);
4060 }
4061
4062 /**
4063 * Migrate share-ACLs from a remote RPC server to the local RPC server.
4064 *
4065 * All parameters are provided by the run_rpc_command function, except for
4066 * argc, argv which are passed through.
4067 *
4068 * @param domain_sid The domain sid acquired from the remote server.
4069 * @param cli A cli_state connected to the server.
4070 * @param mem_ctx Talloc context, destroyed on completion of the function.
4071 * @param argc Standard main() style argc.
4072 * @param argv Standard main() style argv. Initial components are already
4073 * stripped.
4074 *
4075 * @return Normal NTSTATUS return.
4076 **/
4077
4078 static NTSTATUS rpc_share_migrate_security_internals(struct net_context *c,
4079 const struct dom_sid *domain_sid,
4080 const char *domain_name,
4081 struct cli_state *cli,
4082 struct rpc_pipe_client *pipe_hnd,
4083 TALLOC_CTX *mem_ctx,
4084 int argc,
4085 const char **argv)
4086 {
4087 WERROR result;
4088 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
4089 struct srvsvc_NetShareInfoCtr ctr_src;
4090 union srvsvc_NetShareInfo info;
4091 uint32 i;
4092 struct rpc_pipe_client *srvsvc_pipe = NULL;
4093 struct cli_state *cli_dst = NULL;
4094 uint32 level = 502; /* includes secdesc */
4095 uint32_t parm_error = 0;
4096 struct dcerpc_binding_handle *b;
4097
4098 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
4099 &ctr_src);
4100
4101 if (!W_ERROR_IS_OK(result))
4102 goto done;
4103
4104 /* connect destination PI_SRVSVC */
4105 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
4106 &ndr_table_srvsvc.syntax_id);
4107 if (!NT_STATUS_IS_OK(nt_status))
4108 return nt_status;
4109
4110 b = srvsvc_pipe->binding_handle;
4111
4112 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
4113
4114 struct srvsvc_NetShareInfo502 info502 =
4115 ctr_src.ctr.ctr502->array[i];
4116
4117 /* reset error-code */
4118 nt_status = NT_STATUS_UNSUCCESSFUL;
4119
4120 if (!check_share_sanity(c, cli, info502.name, info502.type))
4121 continue;
4122
4123 printf(_("migrating: [%s], path: %s, comment: %s, including "
4124 "share-ACLs\n"),
4125 info502.name, info502.path, info502.comment);
4126
4127 if (c->opt_verbose)
4128 display_sec_desc(info502.sd_buf.sd);
4129
4130 /* FIXME: shouldn't we be able to just set the security descriptor ? */
4131 info.info502 = &info502;
4132
4133 /* finally modify the share on the dst server */
4134 nt_status = dcerpc_srvsvc_NetShareSetInfo(b, mem_ctx,
4135 srvsvc_pipe->desthost,
4136 info502.name,
4137 level,
4138 &info,
4139 &parm_error,
4140 &result);
4141 if (!NT_STATUS_IS_OK(nt_status)) {
4142 printf(_("cannot set share-acl: %s\n"),
4143 nt_errstr(nt_status));
4144 goto done;
4145 }
4146 if (!W_ERROR_IS_OK(result)) {
4147 nt_status = werror_to_ntstatus(result);
4148 printf(_("cannot set share-acl: %s\n"),
4149 win_errstr(result));
4150 goto done;
4151 }
4152
4153 }
4154
4155 nt_status = NT_STATUS_OK;
4156
4157 done:
4158 if (cli_dst) {
4159 cli_shutdown(cli_dst);
4160 }
4161
4162 return nt_status;
4163
4164 }
4165
4166 /**
4167 * Migrate share-acls from a RPC server to another.
4168 *
4169 * @param argc Standard main() style argc.
4170 * @param argv Standard main() style argv. Initial components are already
4171 * stripped.
4172 *
4173 * @return A shell status integer (0 for success).
4174 **/
4175 static int rpc_share_migrate_security(struct net_context *c, int argc,
4176 const char **argv)
4177 {
4178 if (c->display_usage) {
4179 d_printf( "%s\n"
4180 "net rpc share migrate security\n"
4181 " %s\n",
4182 _("Usage:"),
4183 _("Migrate share-acls to local server"));
4184 return 0;
4185 }
4186
4187 if (!c->opt_host) {
4188 d_printf(_("no server to migrate\n"));
4189 return -1;
4190 }
4191
4192 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4193 rpc_share_migrate_security_internals,
4194 argc, argv);
4195 }
4196
4197 /**
4198 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
4199 * from one server to another.
4200 *
4201 * @param argc Standard main() style argc.
4202 * @param argv Standard main() style argv. Initial components are already
4203 * stripped.
4204 *
4205 * @return A shell status integer (0 for success).
4206 *
4207 **/
4208 static int rpc_share_migrate_all(struct net_context *c, int argc,
4209 const char **argv)
4210 {
4211 int ret;
4212
4213 if (c->display_usage) {
4214 d_printf( "%s\n"
4215 "net rpc share migrate all\n"
4216 " %s\n",
4217 _("Usage:"),
4218 _("Migrates shares including all share settings"));
4219 return 0;
4220 }
4221
4222 if (!c->opt_host) {
4223 d_printf(_("no server to migrate\n"));
4224 return -1;
4225 }
4226
4227 /* order is important. we don't want to be locked out by the share-acl
4228 * before copying files - gd */
4229
4230 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4231 rpc_share_migrate_shares_internals, argc, argv);
4232 if (ret)
4233 return ret;
4234
4235 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4236 rpc_share_migrate_files_internals, argc, argv);
4237 if (ret)
4238 return ret;
4239
4240 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4241 rpc_share_migrate_security_internals, argc,
4242 argv);
4243 }
4244
4245
4246 /**
4247 * 'net rpc share migrate' entrypoint.
4248 * @param argc Standard main() style argc.
4249 * @param argv Standard main() style argv. Initial components are already
4250 * stripped.
4251 **/
4252 static int rpc_share_migrate(struct net_context *c, int argc, const char **argv)
4253 {
4254
4255 struct functable func[] = {
4256 {
4257 "all",
4258 rpc_share_migrate_all,
4259 NET_TRANSPORT_RPC,
4260 N_("Migrate shares from remote to local server"),
4261 N_("net rpc share migrate all\n"
4262 " Migrate shares from remote to local server")
4263 },
4264 {
4265 "files",
4266 rpc_share_migrate_files,
4267 NET_TRANSPORT_RPC,
4268 N_("Migrate files from remote to local server"),
4269 N_("net rpc share migrate files\n"
4270 " Migrate files from remote to local server")
4271 },
4272 {
4273 "security",
4274 rpc_share_migrate_security,
4275 NET_TRANSPORT_RPC,
4276 N_("Migrate share-ACLs from remote to local server"),
4277 N_("net rpc share migrate security\n"
4278 " Migrate share-ACLs from remote to local server")
4279 },
4280 {
4281 "shares",
4282 rpc_share_migrate_shares,
4283 NET_TRANSPORT_RPC,
4284 N_("Migrate shares from remote to local server"),
4285 N_("net rpc share migrate shares\n"
4286 " Migrate shares from remote to local server")
4287 },
4288 {NULL, NULL, 0, NULL, NULL}
4289 };
4290
4291 net_mode_share = NET_MODE_SHARE_MIGRATE;
4292
4293 return net_run_function(c, argc, argv, "net rpc share migrate", func);
4294 }
4295
4296 struct full_alias {
4297 struct dom_sid sid;
4298 uint32 num_members;
4299 struct dom_sid *members;
4300 };
4301
4302 static int num_server_aliases;
4303 static struct full_alias *server_aliases;
4304
4305 /*
4306 * Add an alias to the static list.
4307 */
4308 static void push_alias(TALLOC_CTX *mem_ctx, struct full_alias *alias)
4309 {
4310 if (server_aliases == NULL)
4311 server_aliases = SMB_MALLOC_ARRAY(struct full_alias, 100);
4312
4313 server_aliases[num_server_aliases] = *alias;
4314 num_server_aliases += 1;
4315 }
4316
4317 /*
4318 * For a specific domain on the server, fetch all the aliases
4319 * and their members. Add all of them to the server_aliases.
4320 */
4321
4322 static NTSTATUS rpc_fetch_domain_aliases(struct rpc_pipe_client *pipe_hnd,
4323 TALLOC_CTX *mem_ctx,
4324 struct policy_handle *connect_pol,
4325 const struct dom_sid *domain_sid)
4326 {
4327 uint32 start_idx, max_entries, num_entries, i;
4328 struct samr_SamArray *groups = NULL;
4329 NTSTATUS result, status;
4330 struct policy_handle domain_pol;
4331 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4332
4333 /* Get domain policy handle */
4334
4335 status = dcerpc_samr_OpenDomain(b, mem_ctx,
4336 connect_pol,
4337 MAXIMUM_ALLOWED_ACCESS,
4338 discard_const_p(struct dom_sid2, domain_sid),
4339 &domain_pol,
4340 &result);
4341 if (!NT_STATUS_IS_OK(status)) {
4342 return status;
4343 }
4344 if (!NT_STATUS_IS_OK(result)) {
4345 return result;
4346 }
4347
4348 start_idx = 0;
4349 max_entries = 250;
4350
4351 do {
4352 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
4353 &domain_pol,
4354 &start_idx,
4355 &groups,
4356 max_entries,
4357 &num_entries,
4358 &result);
4359 if (!NT_STATUS_IS_OK(status)) {
4360 goto done;
4361 }
4362 for (i = 0; i < num_entries; i++) {
4363
4364 struct policy_handle alias_pol;
4365 struct full_alias alias;
4366 struct lsa_SidArray sid_array;
4367 int j;
4368 NTSTATUS _result;
4369
4370 status = dcerpc_samr_OpenAlias(b, mem_ctx,
4371 &domain_pol,
4372 MAXIMUM_ALLOWED_ACCESS,
4373 groups->entries[i].idx,
4374 &alias_pol,
4375 &_result);
4376 if (!NT_STATUS_IS_OK(status)) {
4377 goto done;
4378 }
4379 if (!NT_STATUS_IS_OK(_result)) {
4380 status = _result;
4381 goto done;
4382 }
4383
4384 status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
4385 &alias_pol,
4386 &sid_array,
4387 &_result);
4388 if (!NT_STATUS_IS_OK(status)) {
4389 goto done;
4390 }
4391 if (!NT_STATUS_IS_OK(_result)) {
4392 status = _result;
4393 goto done;
4394 }
4395
4396 alias.num_members = sid_array.num_sids;
4397
4398 status = dcerpc_samr_Close(b, mem_ctx, &alias_pol, &_result);
4399 if (!NT_STATUS_IS_OK(status)) {
4400 goto done;
4401 }
4402 if (!NT_STATUS_IS_OK(_result)) {
4403 status = _result;
4404 goto done;
4405 }
4406
4407 alias.members = NULL;
4408
4409 if (alias.num_members > 0) {
4410 alias.members = SMB_MALLOC_ARRAY(struct dom_sid, alias.num_members);
4411
4412 for (j = 0; j < alias.num_members; j++)
4413 sid_copy(&alias.members[j],
4414 sid_array.sids[j].sid);
4415 }
4416
4417 sid_compose(&alias.sid, domain_sid,
4418 groups->entries[i].idx);
4419
4420 push_alias(mem_ctx, &alias);
4421 }
4422 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
4423
4424 status = NT_STATUS_OK;
4425
4426 done:
4427 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
4428
4429 return status;
4430 }
4431
4432 /*
4433 * Dump server_aliases as names for debugging purposes.
4434 */
4435
4436 static NTSTATUS rpc_aliaslist_dump(struct net_context *c,
4437 const struct dom_sid *domain_sid,
4438 const char *domain_name,
4439 struct cli_state *cli,
4440 struct rpc_pipe_client *pipe_hnd,
4441 TALLOC_CTX *mem_ctx,
4442 int argc,
4443 const char **argv)
4444 {
4445 int i;
4446 NTSTATUS result;
4447 struct policy_handle lsa_pol;
4448 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4449
4450 result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
4451 SEC_FLAG_MAXIMUM_ALLOWED,
4452 &lsa_pol);
4453 if (!NT_STATUS_IS_OK(result))
4454 return result;
4455
4456 for (i=0; i<num_server_aliases; i++) {
4457 char **names;
4458 char **domains;
4459 enum lsa_SidType *types;
4460 int j;
4461
4462 struct full_alias *alias = &server_aliases[i];
4463
4464 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol, 1,
4465 &alias->sid,
4466 &domains, &names, &types);
4467 if (!NT_STATUS_IS_OK(result))
4468 continue;
4469
4470 DEBUG(1, ("%s\\%s %d: ", domains[0], names[0], types[0]));
4471
4472 if (alias->num_members == 0) {
4473 DEBUG(1, ("\n"));
4474 continue;
4475 }
4476
4477 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol,
4478 alias->num_members,
4479 alias->members,
4480 &domains, &names, &types);
4481
4482 if (!NT_STATUS_IS_OK(result) &&
4483 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
4484 continue;
4485
4486 for (j=0; j<alias->num_members; j++)
4487 DEBUG(1, ("%s\\%s (%d); ",
4488 domains[j] ? domains[j] : "*unknown*",
4489 names[j] ? names[j] : "*unknown*",types[j]));
4490 DEBUG(1, ("\n"));
4491 }
4492
4493 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
4494
4495 return NT_STATUS_OK;
4496 }
4497
4498 /*
4499 * Fetch a list of all server aliases and their members into
4500 * server_aliases.
4501 */
4502
4503 static NTSTATUS rpc_aliaslist_internals(struct net_context *c,
4504 const struct dom_sid *domain_sid,
4505 const char *domain_name,
4506 struct cli_state *cli,
4507 struct rpc_pipe_client *pipe_hnd,
4508 TALLOC_CTX *mem_ctx,
4509 int argc,
4510 const char **argv)
4511 {
4512 NTSTATUS result, status;
4513 struct policy_handle connect_pol;
4514 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4515
4516 status = dcerpc_samr_Connect2(b, mem_ctx,
4517 pipe_hnd->desthost,
4518 MAXIMUM_ALLOWED_ACCESS,
4519 &connect_pol,
4520 &result);
4521 if (!NT_STATUS_IS_OK(status)) {
4522 goto done;
4523 }
4524 if (!NT_STATUS_IS_OK(result)) {
4525 status = result;
4526 goto done;
4527 }
4528
4529 status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4530 &global_sid_Builtin);
4531 if (!NT_STATUS_IS_OK(status)) {
4532 goto done;
4533 }
4534
4535 status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4536 domain_sid);
4537
4538 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
4539 done:
4540 return status;
4541 }
4542
4543 static void init_user_token(struct security_token *token, struct dom_sid *user_sid)
4544 {
4545 token->num_sids = 4;
4546
4547 if (!(token->sids = SMB_MALLOC_ARRAY(struct dom_sid, 4))) {
4548 d_fprintf(stderr, "malloc %s\n",_("failed"));
4549 token->num_sids = 0;
4550 return;
4551 }
4552
4553 token->sids[0] = *user_sid;
4554 sid_copy(&token->sids[1], &global_sid_World);
4555 sid_copy(&token->sids[2], &global_sid_Network);
4556 sid_copy(&token->sids[3], &global_sid_Authenticated_Users);
4557 }
4558
4559 static void free_user_token(struct security_token *token)
4560 {
4561 SAFE_FREE(token->sids);
4562 }
4563
4564 static void add_sid_to_token(struct security_token *token, struct dom_sid *sid)
4565 {
4566 if (security_token_has_sid(token, sid))
4567 return;
4568
4569 token->sids = SMB_REALLOC_ARRAY(token->sids, struct dom_sid, token->num_sids+1);
4570 if (!token->sids) {
4571 return;
4572 }
4573
4574 sid_copy(&token->sids[token->num_sids], sid);
4575
4576 token->num_sids += 1;
4577 }
4578
4579 struct user_token {
4580 fstring name;
4581 struct security_token token;
4582 };
4583
4584 static void dump_user_token(struct user_token *token)
4585 {
4586 int i;
4587
4588 d_printf("%s\n", token->name);
4589
4590 for (i=0; i<token->token.num_sids; i++) {
4591 d_printf(" %s\n", sid_string_tos(&token->token.sids[i]));
4592 }
4593 }
4594
4595 static bool is_alias_member(struct dom_sid *sid, struct full_alias *alias)
4596 {
4597 int i;
4598
4599 for (i=0; i<alias->num_members; i++) {
4600 if (dom_sid_compare(sid, &alias->members[i]) == 0)
4601 return true;
4602 }
4603
4604 return false;
4605 }
4606
4607 static void collect_sid_memberships(struct security_token *token, struct dom_sid sid)
4608 {
4609 int i;
4610
4611 for (i=0; i<num_server_aliases; i++) {
4612 if (is_alias_member(&sid, &server_aliases[i]))
4613 add_sid_to_token(token, &server_aliases[i].sid);
4614 }
4615 }
4616
4617 /*
4618 * We got a user token with all the SIDs we can know about without asking the
4619 * server directly. These are the user and domain group sids. All of these can
4620 * be members of aliases. So scan the list of aliases for each of the SIDs and
4621 * add them to the token.
4622 */
4623
4624 static void collect_alias_memberships(struct security_token *token)
4625 {
4626 int num_global_sids = token->num_sids;
4627 int i;
4628
4629 for (i=0; i<num_global_sids; i++) {
4630 collect_sid_memberships(token, token->sids[i]);
4631 }
4632 }
4633
4634 static bool get_user_sids(const char *domain, const char *user, struct security_token *token)
4635 {
4636 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4637 enum wbcSidType type;
4638 fstring full_name;
4639 struct wbcDomainSid wsid;
4640 char sid_str[WBC_SID_STRING_BUFLEN];
4641 struct dom_sid user_sid;
4642 uint32_t num_groups;
4643 gid_t *groups = NULL;
4644 uint32_t i;
4645
4646 fstr_sprintf(full_name, "%s%c%s",
4647 domain, *lp_winbind_separator(), user);
4648
4649 /* First let's find out the user sid */
4650
4651 wbc_status = wbcLookupName(domain, user, &wsid, &type);
4652
4653 if (!WBC_ERROR_IS_OK(wbc_status)) {
4654 DEBUG(1, ("winbind could not find %s: %s\n",
4655 full_name, wbcErrorString(wbc_status)));
4656 return false;
4657 }
4658
4659 wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4660
4661 if (type != WBC_SID_NAME_USER) {
4662 DEBUG(1, ("%s is not a user\n", full_name));
4663 return false;
4664 }
4665
4666 if (!string_to_sid(&user_sid, sid_str)) {
4667 DEBUG(1,("Could not convert sid %s from string\n", sid_str));
4668 return false;
4669 }
4670
4671 init_user_token(token, &user_sid);
4672
4673 /* And now the groups winbind knows about */
4674
4675 wbc_status = wbcGetGroups(full_name, &num_groups, &groups);
4676 if (!WBC_ERROR_IS_OK(wbc_status)) {
4677 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4678 full_name, wbcErrorString(wbc_status)));
4679 return false;
4680 }
4681
4682 for (i = 0; i < num_groups; i++) {
4683 gid_t gid = groups[i];
4684 struct dom_sid sid;
4685 bool ok;
4686
4687 wbc_status = wbcGidToSid(gid, &wsid);
4688 if (!WBC_ERROR_IS_OK(wbc_status)) {
4689 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4690 (unsigned int)gid, wbcErrorString(wbc_status)));
4691 wbcFreeMemory(groups);
4692 return false;
4693 }
4694
4695 wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4696
4697 DEBUG(3, (" %s\n", sid_str));
4698
4699 ok = string_to_sid(&sid, sid_str);
4700 if (!ok) {
4701 DEBUG(1, ("Failed to convert string to SID\n"));
4702 wbcFreeMemory(groups);
4703 return false;
4704 }
4705 add_sid_to_token(token, &sid);
4706 }
4707 wbcFreeMemory(groups);
4708
4709 return true;
4710 }
4711
4712 /**
4713 * Get a list of all user tokens we want to look at
4714 **/
4715
4716 static bool get_user_tokens(struct net_context *c, int *num_tokens,
4717 struct user_token **user_tokens)
4718 {
4719 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4720 uint32_t i, num_users;
4721 const char **users;
4722 struct user_token *result;
4723 TALLOC_CTX *frame = NULL;
4724
4725 if (lp_winbind_use_default_domain() &&
4726 (c->opt_target_workgroup == NULL)) {
4727 d_fprintf(stderr, _("winbind use default domain = yes set, "
4728 "please specify a workgroup\n"));
4729 return false;
4730 }
4731
4732 /* Send request to winbind daemon */
4733
4734 wbc_status = wbcListUsers(NULL, &num_users, &users);
4735 if (!WBC_ERROR_IS_OK(wbc_status)) {
4736 DEBUG(1, (_("winbind could not list users: %s\n"),
4737 wbcErrorString(wbc_status)));
4738 return false;
4739 }
4740
4741 result = SMB_MALLOC_ARRAY(struct user_token, num_users);
4742
4743 if (result == NULL) {
4744 DEBUG(1, ("Could not malloc sid array\n"));
4745 wbcFreeMemory(users);
4746 return false;
4747 }
4748
4749 frame = talloc_stackframe();
4750 for (i=0; i < num_users; i++) {
4751 fstring domain, user;
4752 char *p;
4753
4754 fstrcpy(result[i].name, users[i]);
4755
4756 p = strchr(users[i], *lp_winbind_separator());
4757
4758 DEBUG(3, ("%s\n", users[i]));
4759
4760 if (p == NULL) {
4761 fstrcpy(domain, c->opt_target_workgroup);
4762 fstrcpy(user, users[i]);
4763 } else {
4764 *p++ = '\0';
4765 fstrcpy(domain, users[i]);
4766 if (!strupper_m(domain)) {
4767 DEBUG(1, ("strupper_m %s failed\n", domain));
4768 wbcFreeMemory(users);
4769 return false;
4770 }
4771 fstrcpy(user, p);
4772 }
4773
4774 get_user_sids(domain, user, &(result[i].token));
4775 }
4776 TALLOC_FREE(frame);
4777 wbcFreeMemory(users);
4778
4779 *num_tokens = num_users;
4780 *user_tokens = result;
4781
4782 return true;
4783 }
4784
4785 static bool get_user_tokens_from_file(FILE *f,
4786 int *num_tokens,
4787 struct user_token **tokens)
4788 {
4789 struct user_token *token = NULL;
4790
4791 while (!feof(f)) {
4792 fstring line;
4793
4794 if (fgets(line, sizeof(line)-1, f) == NULL) {
4795 return true;
4796 }
4797
4798 if ((strlen(line) > 0) && (line[strlen(line)-1] == '\n')) {
4799 line[strlen(line)-1] = '\0';
4800 }
4801
4802 if (line[0] == ' ') {
4803 /* We have a SID */
4804
4805 struct dom_sid sid;
4806 if(!string_to_sid(&sid, &line[1])) {
4807 DEBUG(1,("get_user_tokens_from_file: Could "
4808 "not convert sid %s \n",&line[1]));
4809 return false;
4810 }
4811
4812 if (token == NULL) {
4813 DEBUG(0, ("File does not begin with username"));
4814 return false;
4815 }
4816
4817 add_sid_to_token(&token->token, &sid);
4818 continue;
4819 }
4820
4821 /* And a new user... */
4822
4823 *num_tokens += 1;
4824 *tokens = SMB_REALLOC_ARRAY(*tokens, struct user_token, *num_tokens);
4825 if (*tokens == NULL) {
4826 DEBUG(0, ("Could not realloc tokens\n"));
4827 return false;
4828 }
4829
4830 token = &((*tokens)[*num_tokens-1]);
4831
4832 if (strlcpy(token->name, line, sizeof(token->name)) >= sizeof(token->name)) {
4833 return false;
4834 }
4835 token->token.num_sids = 0;
4836 token->token.sids = NULL;
4837 continue;
4838 }
4839
4840 return false;
4841 }
4842
4843
4844 /*
4845 * Show the list of all users that have access to a share
4846 */
4847
4848 static void show_userlist(struct rpc_pipe_client *pipe_hnd,
4849 TALLOC_CTX *mem_ctx,
4850 const char *netname,
4851 int num_tokens,
4852 struct user_token *tokens)
4853 {
4854 uint16_t fnum;
4855 struct security_descriptor *share_sd = NULL;
4856 struct security_descriptor *root_sd = NULL;
4857 struct cli_state *cli = rpc_pipe_np_smb_conn(pipe_hnd);
4858 int i;
4859 union srvsvc_NetShareInfo info;
4860 WERROR result;
4861 NTSTATUS status;
4862 uint16 cnum;
4863 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4864
4865 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
4866 pipe_hnd->desthost,
4867 netname,
4868 502,
4869 &info,
4870 &result);
4871
4872 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
4873 DEBUG(1, ("Coult not query secdesc for share %s\n",
4874 netname));
4875 return;
4876 }
4877
4878 share_sd = info.info502->sd_buf.sd;
4879 if (share_sd == NULL) {
4880 DEBUG(1, ("Got no secdesc for share %s\n",
4881 netname));
4882 }
4883
4884 cnum = cli_state_get_tid(cli);
4885
4886 if (!NT_STATUS_IS_OK(cli_tree_connect(cli, netname, "A:", "", 0))) {
4887 return;
4888 }
4889
4890 if (!NT_STATUS_IS_OK(cli_ntcreate(cli, "\\", 0, READ_CONTROL_ACCESS, 0,
4891 FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
4892 cli_query_secdesc(cli, fnum, mem_ctx, &root_sd);
4893 }
4894
4895 for (i=0; i<num_tokens; i++) {
4896 uint32 acc_granted;
4897
4898 if (share_sd != NULL) {
4899 status = se_access_check(share_sd, &tokens[i].token,
4900 1, &acc_granted);
4901
4902 if (!NT_STATUS_IS_OK(status)) {
4903 DEBUG(1, ("Could not check share_sd for "
4904 "user %s\n",
4905 tokens[i].name));
4906 continue;
4907 }
4908 }
4909
4910 if (root_sd == NULL) {
4911 d_printf(" %s\n", tokens[i].name);
4912 continue;
4913 }
4914
4915 status = se_access_check(root_sd, &tokens[i].token,
4916 1, &acc_granted);
4917 if (!NT_STATUS_IS_OK(status)) {
4918 DEBUG(1, ("Could not check root_sd for user %s\n",
4919 tokens[i].name));
4920 continue;
4921 }
4922 d_printf(" %s\n", tokens[i].name);
4923 }
4924
4925 if (fnum != (uint16_t)-1)
4926 cli_close(cli, fnum);
4927 cli_tdis(cli);
4928 cli_state_set_tid(cli, cnum);
4929
4930 return;
4931 }
4932
4933 /**
4934 * List shares on a remote RPC server, including the security descriptors.
4935 *
4936 * All parameters are provided by the run_rpc_command function, except for
4937 * argc, argv which are passed through.
4938 *
4939 * @param domain_sid The domain sid acquired from the remote server.
4940 * @param cli A cli_state connected to the server.
4941 * @param mem_ctx Talloc context, destroyed on completion of the function.
4942 * @param argc Standard main() style argc.
4943 * @param argv Standard main() style argv. Initial components are already
4944 * stripped.
4945 *
4946 * @return Normal NTSTATUS return.
4947 **/
4948
4949 static NTSTATUS rpc_share_allowedusers_internals(struct net_context *c,
4950 const struct dom_sid *domain_sid,
4951 const char *domain_name,
4952 struct cli_state *cli,
4953 struct rpc_pipe_client *pipe_hnd,
4954 TALLOC_CTX *mem_ctx,
4955 int argc,
4956 const char **argv)
4957 {
4958 bool r;
4959 FILE *f;
4960 NTSTATUS nt_status = NT_STATUS_OK;
4961 uint32_t total_entries = 0;
4962 uint32_t resume_handle = 0;
4963 uint32_t preferred_len = 0xffffffff;
4964 uint32_t i;
4965 struct dcerpc_binding_handle *b = NULL;
4966 struct srvsvc_NetShareInfoCtr info_ctr;
4967 struct srvsvc_NetShareCtr1 ctr1;
4968 WERROR result;
4969
4970 struct user_token *tokens = NULL;
4971 int num_tokens = 0;
4972
4973 if (argc == 0) {
4974 f = stdin;
4975 } else {
4976 f = fopen(argv[0], "r");
4977 }
4978
4979 if (f == NULL) {
4980 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno)));
4981 return NT_STATUS_UNSUCCESSFUL;
4982 }
4983
4984 r = get_user_tokens_from_file(f, &num_tokens, &tokens);
4985
4986 if (f != stdin)
4987 fclose(f);
4988
4989 if (!r) {
4990 DEBUG(0, ("Could not read users from file\n"));
4991 return NT_STATUS_UNSUCCESSFUL;
4992 }
4993
4994 for (i=0; i<num_tokens; i++)
4995 collect_alias_memberships(&tokens[i].token);
4996
4997 ZERO_STRUCT(info_ctr);
4998 ZERO_STRUCT(ctr1);
4999
5000 info_ctr.level = 1;
5001 info_ctr.ctr.ctr1 = &ctr1;
5002
5003 b = pipe_hnd->binding_handle;
5004
5005 /* Issue the NetShareEnum RPC call and retrieve the response */
5006 nt_status = dcerpc_srvsvc_NetShareEnumAll(b,
5007 talloc_tos(),
5008 pipe_hnd->desthost,
5009 &info_ctr,
5010 preferred_len,
5011 &total_entries,
5012 &resume_handle,
5013 &result);
5014
5015 /* Was it successful? */
5016 if (!NT_STATUS_IS_OK(nt_status)) {
5017 /* Nope. Go clean up. */
5018 goto done;
5019 }
5020
5021 if (!W_ERROR_IS_OK(result)) {
5022 /* Nope. Go clean up. */
5023 nt_status = werror_to_ntstatus(result);
5024 goto done;
5025 }
5026
5027 if (total_entries == 0) {
5028 goto done;
5029 }
5030
5031 /* For each returned entry... */
5032 for (i = 0; i < info_ctr.ctr.ctr1->count; i++) {
5033 const char *netname = info_ctr.ctr.ctr1->array[i].name;
5034
5035 if (info_ctr.ctr.ctr1->array[i].type != STYPE_DISKTREE) {
5036 continue;
5037 }
5038
5039 d_printf("%s\n", netname);
5040
5041 show_userlist(pipe_hnd, mem_ctx, netname,
5042 num_tokens, tokens);
5043 }
5044 done:
5045 for (i=0; i<num_tokens; i++) {
5046 free_user_token(&tokens[i].token);
5047 }
5048 SAFE_FREE(tokens);
5049
5050 return nt_status;
5051 }
5052
5053 static int rpc_share_allowedusers(struct net_context *c, int argc,
5054 const char **argv)
5055 {
5056 int result;
5057
5058 if (c->display_usage) {
5059 d_printf( "%s\n"
5060 "net rpc share allowedusers\n"
5061 " %s\n",
5062 _("Usage:"),
5063 _("List allowed users"));
5064 return 0;
5065 }
5066
5067 result = run_rpc_command(c, NULL, &ndr_table_samr, 0,
5068 rpc_aliaslist_internals,
5069 argc, argv);
5070 if (result != 0)
5071 return result;
5072
5073 result = run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
5074 rpc_aliaslist_dump,
5075 argc, argv);
5076 if (result != 0)
5077 return result;
5078
5079 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
5080 rpc_share_allowedusers_internals,
5081 argc, argv);
5082 }
5083
5084 int net_usersidlist(struct net_context *c, int argc, const char **argv)
5085 {
5086 int num_tokens = 0;
5087 struct user_token *tokens = NULL;
5088 int i;
5089
5090 if (argc != 0) {
5091 net_usersidlist_usage(c, argc, argv);
5092 return 0;
5093 }
5094
5095 if (!get_user_tokens(c, &num_tokens, &tokens)) {
5096 DEBUG(0, ("Could not get the user/sid list\n"));
5097 return -1;
5098 }
5099
5100 for (i=0; i<num_tokens; i++) {
5101 dump_user_token(&tokens[i]);
5102 free_user_token(&tokens[i].token);
5103 }
5104
5105 SAFE_FREE(tokens);
5106 return 0;
5107 }
5108
5109 int net_usersidlist_usage(struct net_context *c, int argc, const char **argv)
5110 {
5111 d_printf(_("net usersidlist\n"
5112 "\tprints out a list of all users the running winbind knows\n"
5113 "\tabout, together with all their SIDs. This is used as\n"
5114 "\tinput to the 'net rpc share allowedusers' command.\n\n"));
5115
5116 net_common_flags_usage(c, argc, argv);
5117 return -1;
5118 }
5119
5120 /**
5121 * 'net rpc share' entrypoint.
5122 * @param argc Standard main() style argc.
5123 * @param argv Standard main() style argv. Initial components are already
5124 * stripped.
5125 **/
5126
5127 int net_rpc_share(struct net_context *c, int argc, const char **argv)
5128 {
5129 NET_API_STATUS status;
5130
5131 struct functable func[] = {
5132 {
5133 "add",
5134 rpc_share_add,
5135 NET_TRANSPORT_RPC,
5136 N_("Add share"),
5137 N_("net rpc share add\n"
5138 " Add share")
5139 },
5140 {
5141 "delete",
5142 rpc_share_delete,
5143 NET_TRANSPORT_RPC,
5144 N_("Remove share"),
5145 N_("net rpc share delete\n"
5146 " Remove share")
5147 },
5148 {
5149 "allowedusers",
5150 rpc_share_allowedusers,
5151 NET_TRANSPORT_RPC,
5152 N_("Modify allowed users"),
5153 N_("net rpc share allowedusers\n"
5154 " Modify allowed users")
5155 },
5156 {
5157 "migrate",
5158 rpc_share_migrate,
5159 NET_TRANSPORT_RPC,
5160 N_("Migrate share to local server"),
5161 N_("net rpc share migrate\n"
5162 " Migrate share to local server")
5163 },
5164 {
5165 "list",
5166 rpc_share_list,
5167 NET_TRANSPORT_RPC,
5168 N_("List shares"),
5169 N_("net rpc share list\n"
5170 " List shares")
5171 },
5172 {NULL, NULL, 0, NULL, NULL}
5173 };
5174
5175 status = libnetapi_net_init(&c->netapi_ctx);
5176 if (status != 0) {
5177 return -1;
5178 }
5179 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5180 libnetapi_set_password(c->netapi_ctx, c->opt_password);
5181 if (c->opt_kerberos) {
5182 libnetapi_set_use_kerberos(c->netapi_ctx);
5183 }
5184
5185 if (argc == 0) {
5186 if (c->display_usage) {
5187 d_printf("%s\n%s",
5188 _("Usage:"),
5189 _("net rpc share\n"
5190 " List shares\n"
5191 " Alias for net rpc share list\n"));
5192 net_display_usage_from_functable(func);
5193 return 0;
5194 }
5195
5196 return rpc_share_list(c, argc, argv);
5197 }
5198
5199 return net_run_function(c, argc, argv, "net rpc share", func);
5200 }
5201
5202 static NTSTATUS rpc_sh_share_list(struct net_context *c,
5203 TALLOC_CTX *mem_ctx,
5204 struct rpc_sh_ctx *ctx,
5205 struct rpc_pipe_client *pipe_hnd,
5206 int argc, const char **argv)
5207 {
5208
5209 return werror_to_ntstatus(W_ERROR(rpc_share_list(c, argc, argv)));
5210 }
5211
5212 static NTSTATUS rpc_sh_share_add(struct net_context *c,
5213 TALLOC_CTX *mem_ctx,
5214 struct rpc_sh_ctx *ctx,
5215 struct rpc_pipe_client *pipe_hnd,
5216 int argc, const char **argv)
5217 {
5218 NET_API_STATUS status;
5219 uint32_t parm_err = 0;
5220 struct SHARE_INFO_2 i2;
5221
5222 if ((argc < 2) || (argc > 3)) {
5223 d_fprintf(stderr, _("Usage: %s <share> <path> [comment]\n"),
5224 ctx->whoami);
5225 return NT_STATUS_INVALID_PARAMETER;
5226 }
5227
5228 i2.shi2_netname = argv[0];
5229 i2.shi2_type = STYPE_DISKTREE;
5230 i2.shi2_remark = (argc == 3) ? argv[2] : "";
5231 i2.shi2_permissions = 0;
5232 i2.shi2_max_uses = 0;
5233 i2.shi2_current_uses = 0;
5234 i2.shi2_path = argv[1];
5235 i2.shi2_passwd = NULL;
5236
5237 status = NetShareAdd(pipe_hnd->desthost,
5238 2,
5239 (uint8_t *)&i2,
5240 &parm_err);
5241
5242 return werror_to_ntstatus(W_ERROR(status));
5243 }
5244
5245 static NTSTATUS rpc_sh_share_delete(struct net_context *c,
5246 TALLOC_CTX *mem_ctx,
5247 struct rpc_sh_ctx *ctx,
5248 struct rpc_pipe_client *pipe_hnd,
5249 int argc, const char **argv)
5250 {
5251 if (argc != 1) {
5252 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5253 return NT_STATUS_INVALID_PARAMETER;
5254 }
5255
5256 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd->desthost, argv[0], 0)));
5257 }
5258
5259 static NTSTATUS rpc_sh_share_info(struct net_context *c,
5260 TALLOC_CTX *mem_ctx,
5261 struct rpc_sh_ctx *ctx,
5262 struct rpc_pipe_client *pipe_hnd,
5263 int argc, const char **argv)
5264 {
5265 union srvsvc_NetShareInfo info;
5266 WERROR result;
5267 NTSTATUS status;
5268 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5269
5270 if (argc != 1) {
5271 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5272 return NT_STATUS_INVALID_PARAMETER;
5273 }
5274
5275 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
5276 pipe_hnd->desthost,
5277 argv[0],
5278 2,
5279 &info,
5280 &result);
5281 if (!NT_STATUS_IS_OK(status)) {
5282 result = ntstatus_to_werror(status);
5283 goto done;
5284 }
5285 if (!W_ERROR_IS_OK(result)) {
5286 goto done;
5287 }
5288
5289 d_printf(_("Name: %s\n"), info.info2->name);
5290 d_printf(_("Comment: %s\n"), info.info2->comment);
5291 d_printf(_("Path: %s\n"), info.info2->path);
5292 d_printf(_("Password: %s\n"), info.info2->password);
5293
5294 done:
5295 return werror_to_ntstatus(result);
5296 }
5297
5298 struct rpc_sh_cmd *net_rpc_share_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
5299 struct rpc_sh_ctx *ctx)
5300 {
5301 static struct rpc_sh_cmd cmds[] = {
5302
5303 { "list", NULL, &ndr_table_srvsvc, rpc_sh_share_list,
5304 N_("List available shares") },
5305
5306 { "add", NULL, &ndr_table_srvsvc, rpc_sh_share_add,
5307 N_("Add a share") },
5308
5309 { "delete", NULL, &ndr_table_srvsvc, rpc_sh_share_delete,
5310 N_("Delete a share") },
5311
5312 { "info", NULL, &ndr_table_srvsvc, rpc_sh_share_info,
5313 N_("Get information about a share") },
5314
5315 { NULL, NULL, 0, NULL, NULL }
5316 };
5317
5318 return cmds;
5319 }
5320
5321 /****************************************************************************/
5322
5323 static int rpc_file_usage(struct net_context *c, int argc, const char **argv)
5324 {
5325 return net_file_usage(c, argc, argv);
5326 }
5327
5328 /**
5329 * Close a file on a remote RPC server.
5330 *
5331 * @param argc Standard main() style argc.
5332 * @param argv Standard main() style argv. Initial components are already
5333 * stripped.
5334 *
5335 * @return A shell status integer (0 for success).
5336 **/
5337 static int rpc_file_close(struct net_context *c, int argc, const char **argv)
5338 {
5339 if (argc < 1 || c->display_usage) {
5340 return rpc_file_usage(c, argc, argv);
5341 }
5342
5343 return NetFileClose(c->opt_host, atoi(argv[0]));
5344 }
5345
5346 /**
5347 * Formatted print of open file info
5348 *
5349 * @param r struct FILE_INFO_3 contents
5350 **/
5351
5352 static void display_file_info_3(struct FILE_INFO_3 *r)
5353 {
5354 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
5355 r->fi3_id, r->fi3_username, r->fi3_permissions,
5356 r->fi3_num_locks, r->fi3_pathname);
5357 }
5358
5359 /**
5360 * List files for a user on a remote RPC server.
5361 *
5362 * @param argc Standard main() style argc.
5363 * @param argv Standard main() style argv. Initial components are already
5364 * stripped.
5365 *
5366 * @return A shell status integer (0 for success)..
5367 **/
5368
5369 static int rpc_file_user(struct net_context *c, int argc, const char **argv)
5370 {
5371 NET_API_STATUS status;
5372 uint32 preferred_len = 0xffffffff, i;
5373 const char *username=NULL;
5374 uint32_t total_entries = 0;
5375 uint32_t entries_read = 0;
5376 uint32_t resume_handle = 0;
5377 struct FILE_INFO_3 *i3 = NULL;
5378
5379 if (c->display_usage) {
5380 return rpc_file_usage(c, argc, argv);
5381 }
5382
5383 /* if argc > 0, must be user command */
5384 if (argc > 0) {
5385 username = smb_xstrdup(argv[0]);
5386 }
5387
5388 status = NetFileEnum(c->opt_host,
5389 NULL,
5390 username,
5391 3,
5392 (uint8_t **)(void *)&i3,
5393 preferred_len,
5394 &entries_read,
5395 &total_entries,
5396 &resume_handle);
5397
5398 if (status != 0) {
5399 goto done;
5400 }
5401
5402 /* Display results */
5403
5404 d_printf(_(
5405 "\nEnumerating open files on remote server:\n\n"
5406 "\nFileId Opened by Perms Locks Path"
5407 "\n------ --------- ----- ----- ---- \n"));
5408 for (i = 0; i < entries_read; i++) {
5409 display_file_info_3(&i3[i]);
5410 }
5411 done:
5412 return status;
5413 }
5414
5415 /**
5416 * 'net rpc file' entrypoint.
5417 * @param argc Standard main() style argc.
5418 * @param argv Standard main() style argv. Initial components are already
5419 * stripped.
5420 **/
5421
5422 int net_rpc_file(struct net_context *c, int argc, const char **argv)
5423 {
5424 NET_API_STATUS status;
5425
5426 struct functable func[] = {
5427 {
5428 "close",
5429 rpc_file_close,
5430 NET_TRANSPORT_RPC,
5431 N_("Close opened file"),
5432 N_("net rpc file close\n"
5433 " Close opened file")
5434 },
5435 {
5436 "user",
5437 rpc_file_user,
5438 NET_TRANSPORT_RPC,
5439 N_("List files opened by user"),
5440 N_("net rpc file user\n"
5441 " List files opened by user")
5442 },
5443 #if 0
5444 {
5445 "info",
5446 rpc_file_info,
5447 NET_TRANSPORT_RPC,
5448 N_("Display information about opened file"),
5449 N_("net rpc file info\n"
5450 " Display information about opened file")
5451 },
5452 #endif
5453 {NULL, NULL, 0, NULL, NULL}
5454 };
5455
5456 status = libnetapi_net_init(&c->netapi_ctx);
5457 if (status != 0) {
5458 return -1;
5459 }
5460 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5461 libnetapi_set_password(c->netapi_ctx, c->opt_password);
5462 if (c->opt_kerberos) {
5463 libnetapi_set_use_kerberos(c->netapi_ctx);
5464 }
5465
5466 if (argc == 0) {
5467 if (c->display_usage) {
5468 d_printf(_("Usage:\n"));
5469 d_printf(_("net rpc file\n"
5470 " List opened files\n"));
5471 net_display_usage_from_functable(func);
5472 return 0;
5473 }
5474
5475 return rpc_file_user(c, argc, argv);
5476 }
5477
5478 return net_run_function(c, argc, argv, "net rpc file", func);
5479 }
5480
5481 /**
5482 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
5483 *
5484 * All parameters are provided by the run_rpc_command function, except for
5485 * argc, argv which are passed through.
5486 *
5487 * @param c A net_context structure.
5488 * @param domain_sid The domain sid acquired from the remote server.
5489 * @param cli A cli_state connected to the server.
5490 * @param mem_ctx Talloc context, destroyed on completion of the function.
5491 * @param argc Standard main() style argc.
5492 * @param argv Standard main() style argv. Initial components are already
5493 * stripped.
5494 *
5495 * @return Normal NTSTATUS return.
5496 **/
5497
5498 static NTSTATUS rpc_shutdown_abort_internals(struct net_context *c,
5499 const struct dom_sid *domain_sid,
5500 const char *domain_name,
5501 struct cli_state *cli,
5502 struct rpc_pipe_client *pipe_hnd,
5503 TALLOC_CTX *mem_ctx,
5504 int argc,
5505 const char **argv)
5506 {
5507 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5508 WERROR result;
5509 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5510
5511 status = dcerpc_initshutdown_Abort(b, mem_ctx, NULL, &result);
5512 if (!NT_STATUS_IS_OK(status)) {
5513 return status;
5514 }
5515 if (W_ERROR_IS_OK(result)) {
5516 d_printf(_("\nShutdown successfully aborted\n"));
5517 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
5518 } else
5519 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
5520
5521 return werror_to_ntstatus(result);
5522 }
5523
5524 /**
5525 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
5526 *
5527 * All parameters are provided by the run_rpc_command function, except for
5528 * argc, argv which are passed through.
5529 *
5530 * @param c A net_context structure.
5531 * @param domain_sid The domain sid acquired from the remote server.
5532 * @param cli A cli_state connected to the server.
5533 * @param mem_ctx Talloc context, destroyed on completion of the function.
5534 * @param argc Standard main() style argc.
5535 * @param argv Standard main() style argv. Initial components are already
5536 * stripped.
5537 *
5538 * @return Normal NTSTATUS return.
5539 **/
5540
5541 static NTSTATUS rpc_reg_shutdown_abort_internals(struct net_context *c,
5542 const struct dom_sid *domain_sid,
5543 const char *domain_name,
5544 struct cli_state *cli,
5545 struct rpc_pipe_client *pipe_hnd,
5546 TALLOC_CTX *mem_ctx,
5547 int argc,
5548 const char **argv)
5549 {
5550 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5551 WERROR werr;
5552 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5553
5554 result = dcerpc_winreg_AbortSystemShutdown(b, mem_ctx, NULL, &werr);
5555
5556 if (!NT_STATUS_IS_OK(result)) {
5557 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5558 return result;
5559 }
5560 if (W_ERROR_IS_OK(werr)) {
5561 d_printf(_("\nShutdown successfully aborted\n"));
5562 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
5563 } else
5564 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5565
5566 return werror_to_ntstatus(werr);
5567 }
5568
5569 /**
5570 * ABORT the shutdown of a remote RPC server.
5571 *
5572 * @param argc Standard main() style argc.
5573 * @param argv Standard main() style argv. Initial components are already
5574 * stripped.
5575 *
5576 * @return A shell status integer (0 for success).
5577 **/
5578
5579 static int rpc_shutdown_abort(struct net_context *c, int argc,
5580 const char **argv)
5581 {
5582 int rc = -1;
5583
5584 if (c->display_usage) {
5585 d_printf( "%s\n"
5586 "net rpc abortshutdown\n"
5587 " %s\n",
5588 _("Usage:"),
5589 _("Abort a scheduled shutdown"));
5590 return 0;
5591 }
5592
5593 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5594 rpc_shutdown_abort_internals, argc, argv);
5595
5596 if (rc == 0)
5597 return rc;
5598
5599 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5600
5601 return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
5602 rpc_reg_shutdown_abort_internals,
5603 argc, argv);
5604 }
5605
5606 /**
5607 * Shut down a remote RPC Server via initshutdown pipe.
5608 *
5609 * All parameters are provided by the run_rpc_command function, except for
5610 * argc, argv which are passed through.
5611 *
5612 * @param c A net_context structure.
5613 * @param domain_sid The domain sid acquired from the remote server.
5614 * @param cli A cli_state connected to the server.
5615 * @param mem_ctx Talloc context, destroyed on completion of the function.
5616 * @param argc Standard main() style argc.
5617 * @param argv Standard main() style argv. Initial components are already
5618 * stripped.
5619 *
5620 * @return Normal NTSTATUS return.
5621 **/
5622
5623 NTSTATUS rpc_init_shutdown_internals(struct net_context *c,
5624 const struct dom_sid *domain_sid,
5625 const char *domain_name,
5626 struct cli_state *cli,
5627 struct rpc_pipe_client *pipe_hnd,
5628 TALLOC_CTX *mem_ctx,
5629 int argc,
5630 const char **argv)
5631 {
5632 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5633 WERROR result;
5634 const char *msg = N_("This machine will be shutdown shortly");
5635 uint32 timeout = 20;
5636 struct lsa_StringLarge msg_string;
5637 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5638
5639 if (c->opt_comment) {
5640 msg = c->opt_comment;
5641 }
5642 if (c->opt_timeout) {
5643 timeout = c->opt_timeout;
5644 }
5645
5646 msg_string.string = msg;
5647
5648 /* create an entry */
5649 status = dcerpc_initshutdown_Init(b, mem_ctx, NULL,
5650 &msg_string, timeout, c->opt_force, c->opt_reboot,
5651 &result);
5652 if (!NT_STATUS_IS_OK(status)) {
5653 return status;
5654 }
5655 if (W_ERROR_IS_OK(result)) {
5656 d_printf(_("\nShutdown of remote machine succeeded\n"));
5657 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5658 } else {
5659 DEBUG(1,("Shutdown of remote machine failed!\n"));
5660 }
5661 return werror_to_ntstatus(result);
5662 }
5663
5664 /**
5665 * Shut down a remote RPC Server via winreg pipe.
5666 *
5667 * All parameters are provided by the run_rpc_command function, except for
5668 * argc, argv which are passed through.
5669 *
5670 * @param c A net_context structure.
5671 * @param domain_sid The domain sid acquired from the remote server.
5672 * @param cli A cli_state connected to the server.
5673 * @param mem_ctx Talloc context, destroyed on completion of the function.
5674 * @param argc Standard main() style argc.
5675 * @param argv Standard main() style argv. Initial components are already
5676 * stripped.
5677 *
5678 * @return Normal NTSTATUS return.
5679 **/
5680
5681 NTSTATUS rpc_reg_shutdown_internals(struct net_context *c,
5682 const struct dom_sid *domain_sid,
5683 const char *domain_name,
5684 struct cli_state *cli,
5685 struct rpc_pipe_client *pipe_hnd,
5686 TALLOC_CTX *mem_ctx,
5687 int argc,
5688 const char **argv)
5689 {
5690 const char *msg = N_("This machine will be shutdown shortly");
5691 uint32 timeout = 20;
5692 struct lsa_StringLarge msg_string;
5693 NTSTATUS result;
5694 WERROR werr;
5695 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5696
5697 if (c->opt_comment) {
5698 msg = c->opt_comment;
5699 }
5700 msg_string.string = msg;
5701
5702 if (c->opt_timeout) {
5703 timeout = c->opt_timeout;
5704 }
5705
5706 /* create an entry */
5707 result = dcerpc_winreg_InitiateSystemShutdown(b, mem_ctx, NULL,
5708 &msg_string, timeout, c->opt_force, c->opt_reboot,
5709 &werr);
5710 if (!NT_STATUS_IS_OK(result)) {
5711 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5712 return result;
5713 }
5714
5715 if (W_ERROR_IS_OK(werr)) {
5716 d_printf(_("\nShutdown of remote machine succeeded\n"));
5717 } else {
5718 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5719 if ( W_ERROR_EQUAL(werr, WERR_MACHINE_LOCKED) )
5720 d_fprintf(stderr, "\nMachine locked, use -f switch to force\n");
5721 else
5722 d_fprintf(stderr, "\nresult was: %s\n", win_errstr(werr));
5723 }
5724
5725 return werror_to_ntstatus(werr);
5726 }
5727
5728 /**
5729 * Shut down a remote RPC server.
5730 *
5731 * @param argc Standard main() style argc.
5732 * @param argv Standard main() style argv. Initial components are already
5733 * stripped.
5734 *
5735 * @return A shell status integer (0 for success).
5736 **/
5737
5738 static int rpc_shutdown(struct net_context *c, int argc, const char **argv)
5739 {
5740 int rc = -1;
5741
5742 if (c->display_usage) {
5743 d_printf( "%s\n"
5744 "net rpc shutdown\n"
5745 " %s\n",
5746 _("Usage:"),
5747 _("Shut down a remote RPC server"));
5748 return 0;
5749 }
5750
5751 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5752 rpc_init_shutdown_internals, argc, argv);
5753
5754 if (rc) {
5755 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5756 rc = run_rpc_command(c, NULL, &ndr_table_winreg, 0,
5757 rpc_reg_shutdown_internals, argc, argv);
5758 }
5759
5760 return rc;
5761 }
5762
5763 /***************************************************************************
5764 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5765 ***************************************************************************/
5766
5767 /**
5768 * Add interdomain trust account to the RPC server.
5769 * All parameters (except for argc and argv) are passed by run_rpc_command
5770 * function.
5771 *
5772 * @param c A net_context structure.
5773 * @param domain_sid The domain sid acquired from the server.
5774 * @param cli A cli_state connected to the server.
5775 * @param mem_ctx Talloc context, destroyed on completion of the function.
5776 * @param argc Standard main() style argc.
5777 * @param argv Standard main() style argv. Initial components are already
5778 * stripped.
5779 *
5780 * @return normal NTSTATUS return code.
5781 */
5782
5783 static NTSTATUS rpc_trustdom_add_internals(struct net_context *c,
5784 const struct dom_sid *domain_sid,
5785 const char *domain_name,
5786 struct cli_state *cli,
5787 struct rpc_pipe_client *pipe_hnd,
5788 TALLOC_CTX *mem_ctx,
5789 int argc,
5790 const char **argv)
5791 {
5792 struct policy_handle connect_pol, domain_pol, user_pol;
5793 NTSTATUS status, result;
5794 char *acct_name;
5795 struct lsa_String lsa_acct_name;
5796 uint32 acb_info;
5797 uint32 acct_flags=0;
5798 uint32 user_rid;
5799 uint32_t access_granted = 0;
5800 union samr_UserInfo info;
5801 unsigned int orig_timeout;
5802 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5803 DATA_BLOB session_key = data_blob_null;
5804
5805 if (argc != 2) {
5806 d_printf("%s\n%s",
5807 _("Usage:"),
5808 _(" net rpc trustdom add <domain_name> "
5809 "<trust password>\n"));
5810 return NT_STATUS_INVALID_PARAMETER;
5811 }
5812
5813 /*
5814 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5815 */
5816
5817 if (asprintf(&acct_name, "%s$", argv[0]) < 0) {
5818 return NT_STATUS_NO_MEMORY;
5819 }
5820
5821 if (!strupper_m(acct_name)) {
5822 SAFE_FREE(acct_name);
5823 return NT_STATUS_INVALID_PARAMETER;
5824 }
5825
5826 init_lsa_String(&lsa_acct_name, acct_name);
5827
5828 status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
5829 if (!NT_STATUS_IS_OK(status)) {
5830 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
5831 nt_errstr(status)));
5832 goto done;
5833 }
5834
5835 /* Get samr policy handle */
5836 status = dcerpc_samr_Connect2(b, mem_ctx,
5837 pipe_hnd->desthost,
5838 MAXIMUM_ALLOWED_ACCESS,
5839 &connect_pol,
5840 &result);
5841 if (!NT_STATUS_IS_OK(status)) {
5842 goto done;
5843 }
5844 if (!NT_STATUS_IS_OK(result)) {
5845 status = result;
5846 goto done;
5847 }
5848
5849 /* Get domain policy handle */
5850 status = dcerpc_samr_OpenDomain(b, mem_ctx,
5851 &connect_pol,
5852 MAXIMUM_ALLOWED_ACCESS,
5853 discard_const_p(struct dom_sid2, domain_sid),
5854 &domain_pol,
5855 &result);
5856 if (!NT_STATUS_IS_OK(status)) {
5857 goto done;
5858 }
5859 if (!NT_STATUS_IS_OK(result)) {
5860 status = result;
5861 goto done;
5862 }
5863
5864 /* This call can take a long time - allow the server to time out.
5865 * 35 seconds should do it. */
5866
5867 orig_timeout = rpccli_set_timeout(pipe_hnd, 35000);
5868
5869 /* Create trusting domain's account */
5870 acb_info = ACB_NORMAL;
5871 acct_flags = SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
5872 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
5873 SAMR_USER_ACCESS_SET_PASSWORD |
5874 SAMR_USER_ACCESS_GET_ATTRIBUTES |
5875 SAMR_USER_ACCESS_SET_ATTRIBUTES;
5876
5877 status = dcerpc_samr_CreateUser2(b, mem_ctx,
5878 &domain_pol,
5879 &lsa_acct_name,
5880 acb_info,
5881 acct_flags,
5882 &user_pol,
5883 &access_granted,
5884 &user_rid,
5885 &result);
5886 if (!NT_STATUS_IS_OK(status)) {
5887 goto done;
5888 }
5889 /* And restore our original timeout. */
5890 rpccli_set_timeout(pipe_hnd, orig_timeout);
5891
5892 if (!NT_STATUS_IS_OK(result)) {
5893 status = result;
5894 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
5895 acct_name, nt_errstr(result));
5896 goto done;
5897 }
5898
5899 {
5900 struct samr_CryptPassword crypt_pwd;
5901
5902 ZERO_STRUCT(info.info23);
5903
5904 init_samr_CryptPassword(argv[1],
5905 &session_key,
5906 &crypt_pwd);
5907
5908 info.info23.info.fields_present = SAMR_FIELD_ACCT_FLAGS |
5909 SAMR_FIELD_NT_PASSWORD_PRESENT;
5910 info.info23.info.acct_flags = ACB_DOMTRUST;
5911 info.info23.password = crypt_pwd;
5912
5913 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
5914 &user_pol,
5915 23,
5916 &info,
5917 &result);
5918 if (!NT_STATUS_IS_OK(status)) {
5919 goto done;
5920 }
5921
5922 if (!NT_STATUS_IS_OK(result)) {
5923 status = result;
5924 DEBUG(0,("Could not set trust account password: %s\n",
5925 nt_errstr(result)));
5926 goto done;
5927 }
5928 }
5929
5930 done:
5931 SAFE_FREE(acct_name);
5932 data_blob_clear_free(&session_key);
5933 return status;
5934 }
5935
5936 /**
5937 * Create interdomain trust account for a remote domain.
5938 *
5939 * @param argc Standard argc.
5940 * @param argv Standard argv without initial components.
5941 *
5942 * @return Integer status (0 means success).
5943 **/
5944
5945 static int rpc_trustdom_add(struct net_context *c, int argc, const char **argv)
5946 {
5947 if (argc > 0 && !c->display_usage) {
5948 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
5949 rpc_trustdom_add_internals, argc, argv);
5950 } else {
5951 d_printf("%s\n%s",
5952 _("Usage:"),
5953 _("net rpc trustdom add <domain_name> <trust "
5954 "password>\n"));
5955 return -1;
5956 }
5957 }
5958
5959
5960 /**
5961 * Remove interdomain trust account from the RPC server.
5962 * All parameters (except for argc and argv) are passed by run_rpc_command
5963 * function.
5964 *
5965 * @param c A net_context structure.
5966 * @param domain_sid The domain sid acquired from the server.
5967 * @param cli A cli_state connected to the server.
5968 * @param mem_ctx Talloc context, destroyed on completion of the function.
5969 * @param argc Standard main() style argc.
5970 * @param argv Standard main() style argv. Initial components are already
5971 * stripped.
5972 *
5973 * @return normal NTSTATUS return code.
5974 */
5975
5976 static NTSTATUS rpc_trustdom_del_internals(struct net_context *c,
5977 const struct dom_sid *domain_sid,
5978 const char *domain_name,
5979 struct cli_state *cli,
5980 struct rpc_pipe_client *pipe_hnd,
5981 TALLOC_CTX *mem_ctx,
5982 int argc,
5983 const char **argv)
5984 {
5985 struct policy_handle connect_pol, domain_pol, user_pol;
5986 NTSTATUS status, result;
5987 char *acct_name;
5988 struct dom_sid trust_acct_sid;
5989 struct samr_Ids user_rids, name_types;
5990 struct lsa_String lsa_acct_name;
5991 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5992
5993 if (argc != 1) {
5994 d_printf("%s\n%s",
5995 _("Usage:"),
5996 _(" net rpc trustdom del <domain_name>\n"));
5997 return NT_STATUS_INVALID_PARAMETER;
5998 }
5999
6000 /*
6001 * Make valid trusting domain account (ie. uppercased and with '$' appended)
6002 */
6003 acct_name = talloc_asprintf(mem_ctx, "%s$", argv[0]);
6004
6005 if (acct_name == NULL)
6006 return NT_STATUS_NO_MEMORY;
6007
6008 if (!strupper_m(acct_name)) {
6009 TALLOC_FREE(acct_name);
6010 return NT_STATUS_INVALID_PARAMETER;
6011 }
6012
6013 /* Get samr policy handle */
6014 status = dcerpc_samr_Connect2(b, mem_ctx,
6015 pipe_hnd->desthost,
6016 MAXIMUM_ALLOWED_ACCESS,
6017 &connect_pol,
6018 &result);
6019 if (!NT_STATUS_IS_OK(status)) {
6020 goto done;
6021 }
6022 if (!NT_STATUS_IS_OK(result)) {
6023 status = result;
6024 goto done;
6025 }
6026
6027 /* Get domain policy handle */
6028 status = dcerpc_samr_OpenDomain(b, mem_ctx,
6029 &connect_pol,
6030 MAXIMUM_ALLOWED_ACCESS,
6031 discard_const_p(struct dom_sid2, domain_sid),
6032 &domain_pol,
6033 &result);
6034 if (!NT_STATUS_IS_OK(status)) {
6035 goto done;
6036 }
6037 if (!NT_STATUS_IS_OK(result)) {
6038 status = result;
6039 goto done;
6040 }
6041
6042 init_lsa_String(&lsa_acct_name, acct_name);
6043
6044 status = dcerpc_samr_LookupNames(b, mem_ctx,
6045 &domain_pol,
6046 1,
6047 &lsa_acct_name,
6048 &user_rids,
6049 &name_types,
6050 &result);
6051 if (!NT_STATUS_IS_OK(status)) {
6052 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6053 "failed %s\n"),
6054 acct_name, nt_errstr(status));
6055 goto done;
6056 }
6057 if (!NT_STATUS_IS_OK(result)) {
6058 status = result;
6059 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6060 "failed %s\n"),
6061 acct_name, nt_errstr(result) );
6062 goto done;
6063 }
6064
6065 status = dcerpc_samr_OpenUser(b, mem_ctx,
6066 &domain_pol,
6067 MAXIMUM_ALLOWED_ACCESS,
6068 user_rids.ids[0],
6069 &user_pol,
6070 &result);
6071 if (!NT_STATUS_IS_OK(status)) {
6072 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6073 "%s\n"),
6074 acct_name, nt_errstr(status) );
6075 goto done;
6076 }
6077
6078 if (!NT_STATUS_IS_OK(result)) {
6079 status = result;
6080 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6081 "%s\n"),
6082 acct_name, nt_errstr(result) );
6083 goto done;
6084 }
6085
6086 /* append the rid to the domain sid */
6087 if (!sid_compose(&trust_acct_sid, domain_sid, user_rids.ids[0])) {
6088 goto done;
6089 }
6090
6091 /* remove the sid */
6092
6093 status = dcerpc_samr_RemoveMemberFromForeignDomain(b, mem_ctx,
6094 &user_pol,
6095 &trust_acct_sid,
6096 &result);
6097 if (!NT_STATUS_IS_OK(status)) {
6098 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6099 " on user %s failed %s\n"),
6100 acct_name, nt_errstr(status));
6101 goto done;
6102 }
6103 if (!NT_STATUS_IS_OK(result)) {
6104 status = result;
6105 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6106 " on user %s failed %s\n"),
6107 acct_name, nt_errstr(result) );
6108 goto done;
6109 }
6110
6111
6112 /* Delete user */
6113
6114 status = dcerpc_samr_DeleteUser(b, mem_ctx,
6115 &user_pol,
6116 &result);
6117 if (!NT_STATUS_IS_OK(status)) {
6118 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6119 "%s\n"),
6120 acct_name, nt_errstr(status));
6121 goto done;
6122 }
6123
6124 if (!NT_STATUS_IS_OK(result)) {
6125 result = status;
6126 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6127 "%s\n"),
6128 acct_name, nt_errstr(result) );
6129 goto done;
6130 }
6131
6132 if (!NT_STATUS_IS_OK(result)) {
6133 d_printf(_("Could not set trust account password: %s\n"),
6134 nt_errstr(result));
6135 goto done;
6136 }
6137
6138 done:
6139 return status;
6140 }
6141
6142 /**
6143 * Delete interdomain trust account for a remote domain.
6144 *
6145 * @param argc Standard argc.
6146 * @param argv Standard argv without initial components.
6147 *
6148 * @return Integer status (0 means success).
6149 **/
6150
6151 static int rpc_trustdom_del(struct net_context *c, int argc, const char **argv)
6152 {
6153 if (argc > 0 && !c->display_usage) {
6154 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
6155 rpc_trustdom_del_internals, argc, argv);
6156 } else {
6157 d_printf("%s\n%s",
6158 _("Usage:"),
6159 _("net rpc trustdom del <domain>\n"));
6160 return -1;
6161 }
6162 }
6163
6164 static NTSTATUS rpc_trustdom_get_pdc(struct net_context *c,
6165 struct cli_state *cli,
6166 TALLOC_CTX *mem_ctx,
6167 const char *domain_name)
6168 {
6169 char *dc_name = NULL;
6170 const char *buffer = NULL;
6171 struct rpc_pipe_client *netr;
6172 NTSTATUS status;
6173 WERROR result;
6174 struct dcerpc_binding_handle *b;
6175
6176 /* Use NetServerEnum2 */
6177
6178 if (cli_get_pdc_name(cli, domain_name, &dc_name)) {
6179 SAFE_FREE(dc_name);
6180 return NT_STATUS_OK;
6181 }
6182
6183 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
6184 for domain %s\n", domain_name));
6185
6186 /* Try netr_GetDcName */
6187
6188 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
6189 &netr);
6190 if (!NT_STATUS_IS_OK(status)) {
6191 return status;
6192 }
6193
6194 b = netr->binding_handle;
6195
6196 status = dcerpc_netr_GetDcName(b, mem_ctx,
6197 netr->desthost,
6198 domain_name,
6199 &buffer,
6200 &result);
6201 TALLOC_FREE(netr);
6202
6203 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(result)) {
6204 return status;
6205 }
6206
6207 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
6208 for domain %s\n", domain_name));
6209
6210 if (!NT_STATUS_IS_OK(status)) {
6211 return status;
6212 }
6213
6214 return werror_to_ntstatus(result);
6215 }
6216
6217 /**
6218 * Establish trust relationship to a trusting domain.
6219 * Interdomain account must already be created on remote PDC.
6220 *
6221 * @param c A net_context structure.
6222 * @param argc Standard argc.
6223 * @param argv Standard argv without initial components.
6224 *
6225 * @return Integer status (0 means success).
6226 **/
6227
6228 static int rpc_trustdom_establish(struct net_context *c, int argc,
6229 const char **argv)
6230 {
6231 struct cli_state *cli = NULL;
6232 struct sockaddr_storage server_ss;
6233 struct rpc_pipe_client *pipe_hnd = NULL;
6234 struct policy_handle connect_hnd;
6235 TALLOC_CTX *mem_ctx;
6236 NTSTATUS nt_status, result;
6237 struct dom_sid *domain_sid;
6238
6239 char* domain_name;
6240 char* acct_name;
6241 fstring pdc_name;
6242 union lsa_PolicyInformation *info = NULL;
6243 struct dcerpc_binding_handle *b;
6244
6245 /*
6246 * Connect to \\server\ipc$ as 'our domain' account with password
6247 */
6248
6249 if (argc != 1 || c->display_usage) {
6250 d_printf("%s\n%s",
6251 _("Usage:"),
6252 _("net rpc trustdom establish <domain_name>\n"));
6253 return -1;
6254 }
6255
6256 domain_name = smb_xstrdup(argv[0]);
6257 if (!strupper_m(domain_name)) {
6258 SAFE_FREE(domain_name);
6259 return -1;
6260 }
6261
6262 /* account name used at first is our domain's name with '$' */
6263 if (asprintf(&acct_name, "%s$", lp_workgroup()) == -1) {
6264 return -1;
6265 }
6266 if (!strupper_m(acct_name)) {
6267 SAFE_FREE(domain_name);
6268 SAFE_FREE(acct_name);
6269 return -1;
6270 }
6271
6272 /*
6273 * opt_workgroup will be used by connection functions further,
6274 * hence it should be set to remote domain name instead of ours
6275 */
6276 if (c->opt_workgroup) {
6277 c->opt_workgroup = smb_xstrdup(domain_name);
6278 };
6279
6280 c->opt_user_name = acct_name;
6281
6282 /* find the domain controller */
6283 if (!net_find_pdc(&server_ss, pdc_name, domain_name)) {
6284 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name));
6285 return -1;
6286 }
6287
6288 /* connect to ipc$ as username/password */
6289 nt_status = connect_to_ipc(c, &cli, &server_ss, pdc_name);
6290 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
6291
6292 /* Is it trusting domain account for sure ? */
6293 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
6294 nt_errstr(nt_status)));
6295 return -1;
6296 }
6297
6298 /* store who we connected to */
6299
6300 saf_store( domain_name, pdc_name );
6301
6302 /*
6303 * Connect to \\server\ipc$ again (this time anonymously)
6304 */
6305
6306 nt_status = connect_to_ipc_anonymous(c, &cli, &server_ss,
6307 (char*)pdc_name);
6308
6309 if (NT_STATUS_IS_ERR(nt_status)) {
6310 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
6311 domain_name, nt_errstr(nt_status)));
6312 return -1;
6313 }
6314
6315 if (!(mem_ctx = talloc_init("establishing trust relationship to "
6316 "domain %s", domain_name))) {
6317 DEBUG(0, ("talloc_init() failed\n"));
6318 cli_shutdown(cli);
6319 return -1;
6320 }
6321
6322 /* Make sure we're talking to a proper server */
6323
6324 nt_status = rpc_trustdom_get_pdc(c, cli, mem_ctx, domain_name);
6325 if (!NT_STATUS_IS_OK(nt_status)) {
6326 cli_shutdown(cli);
6327 talloc_destroy(mem_ctx);
6328 return -1;
6329 }
6330
6331 /*
6332 * Call LsaOpenPolicy and LsaQueryInfo
6333 */
6334
6335 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6336 &pipe_hnd);
6337 if (!NT_STATUS_IS_OK(nt_status)) {
6338 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status) ));
6339 cli_shutdown(cli);
6340 talloc_destroy(mem_ctx);
6341 return -1;
6342 }
6343
6344 b = pipe_hnd->binding_handle;
6345
6346 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true, KEY_QUERY_VALUE,
6347 &connect_hnd);
6348 if (NT_STATUS_IS_ERR(nt_status)) {
6349 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6350 nt_errstr(nt_status)));
6351 cli_shutdown(cli);
6352 talloc_destroy(mem_ctx);
6353 return -1;
6354 }
6355
6356 /* Querying info level 5 */
6357
6358 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6359 &connect_hnd,
6360 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6361 &info,
6362 &result);
6363 if (NT_STATUS_IS_ERR(nt_status)) {
6364 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6365 nt_errstr(nt_status)));
6366 cli_shutdown(cli);
6367 talloc_destroy(mem_ctx);
6368 return -1;
6369 }
6370 if (NT_STATUS_IS_ERR(result)) {
6371 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6372 nt_errstr(result)));
6373 cli_shutdown(cli);
6374 talloc_destroy(mem_ctx);
6375 return -1;
6376 }
6377
6378 domain_sid = info->account_domain.sid;
6379
6380 /* There should be actually query info level 3 (following nt serv behaviour),
6381 but I still don't know if it's _really_ necessary */
6382
6383 /*
6384 * Store the password in secrets db
6385 */
6386
6387 if (!pdb_set_trusteddom_pw(domain_name, c->opt_password, domain_sid)) {
6388 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6389 cli_shutdown(cli);
6390 talloc_destroy(mem_ctx);
6391 return -1;
6392 }
6393
6394 /*
6395 * Close the pipes and clean up
6396 */
6397
6398 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6399 if (NT_STATUS_IS_ERR(nt_status)) {
6400 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
6401 nt_errstr(nt_status)));
6402 cli_shutdown(cli);
6403 talloc_destroy(mem_ctx);
6404 return -1;
6405 }
6406
6407 cli_shutdown(cli);
6408
6409 talloc_destroy(mem_ctx);
6410
6411 d_printf(_("Trust to domain %s established\n"), domain_name);
6412 return 0;
6413 }
6414
6415 /**
6416 * Revoke trust relationship to the remote domain.
6417 *
6418 * @param c A net_context structure.
6419 * @param argc Standard argc.
6420 * @param argv Standard argv without initial components.
6421 *
6422 * @return Integer status (0 means success).
6423 **/
6424
6425 static int rpc_trustdom_revoke(struct net_context *c, int argc,
6426 const char **argv)
6427 {
6428 char* domain_name;
6429 int rc = -1;
6430
6431 if (argc < 1 || c->display_usage) {
6432 d_printf("%s\n%s",
6433 _("Usage:"),
6434 _("net rpc trustdom revoke <domain_name>\n"
6435 " Revoke trust relationship\n"
6436 " domain_name\tName of domain to revoke trust\n"));
6437 return -1;
6438 }
6439
6440 /* generate upper cased domain name */
6441 domain_name = smb_xstrdup(argv[0]);
6442 if (!strupper_m(domain_name)) {
6443 SAFE_FREE(domain_name);
6444 return -1;
6445 }
6446
6447 /* delete password of the trust */
6448 if (!pdb_del_trusteddom_pw(domain_name)) {
6449 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
6450 domain_name));
6451 goto done;
6452 };
6453
6454 rc = 0;
6455 done:
6456 SAFE_FREE(domain_name);
6457 return rc;
6458 }
6459
6460 static NTSTATUS rpc_query_domain_sid(struct net_context *c,
6461 const struct dom_sid *domain_sid,
6462 const char *domain_name,
6463 struct cli_state *cli,
6464 struct rpc_pipe_client *pipe_hnd,
6465 TALLOC_CTX *mem_ctx,
6466 int argc,
6467 const char **argv)
6468 {
6469 fstring str_sid;
6470 if (!sid_to_fstring(str_sid, domain_sid)) {
6471 return NT_STATUS_UNSUCCESSFUL;
6472 }
6473 d_printf("%s\n", str_sid);
6474 return NT_STATUS_OK;
6475 }
6476
6477 static void print_trusted_domain(struct dom_sid *dom_sid, const char *trusted_dom_name)
6478 {
6479 fstring ascii_sid;
6480
6481 /* convert sid into ascii string */
6482 sid_to_fstring(ascii_sid, dom_sid);
6483
6484 d_printf("%-20s%s\n", trusted_dom_name, ascii_sid);
6485 }
6486
6487 static NTSTATUS vampire_trusted_domain(struct rpc_pipe_client *pipe_hnd,
6488 TALLOC_CTX *mem_ctx,
6489 struct policy_handle *pol,
6490 struct dom_sid dom_sid,
6491 const char *trusted_dom_name)
6492 {
6493 NTSTATUS nt_status, result;
6494 union lsa_TrustedDomainInfo *info = NULL;
6495 char *cleartextpwd = NULL;
6496 DATA_BLOB session_key;
6497 DATA_BLOB data = data_blob_null;
6498 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
6499
6500 nt_status = dcerpc_lsa_QueryTrustedDomainInfoBySid(b, mem_ctx,
6501 pol,
6502 &dom_sid,
6503 LSA_TRUSTED_DOMAIN_INFO_PASSWORD,
6504 &info,
6505 &result);
6506 if (NT_STATUS_IS_ERR(nt_status)) {
6507 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6508 nt_errstr(nt_status)));
6509 goto done;
6510 }
6511 if (NT_STATUS_IS_ERR(result)) {
6512 nt_status = result;
6513 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6514 nt_errstr(result)));
6515 goto done;
6516 }
6517
6518 data = data_blob(info->password.password->data,
6519 info->password.password->length);
6520
6521 nt_status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
6522 if (!NT_STATUS_IS_OK(nt_status)) {
6523 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(nt_status)));
6524 goto done;
6525 }
6526
6527 cleartextpwd = sess_decrypt_string(mem_ctx, &data, &session_key);
6528 data_blob_free(&session_key);
6529
6530 if (cleartextpwd == NULL) {
6531 DEBUG(0,("retrieved NULL password\n"));
6532 nt_status = NT_STATUS_UNSUCCESSFUL;
6533 goto done;
6534 }
6535
6536 if (!pdb_set_trusteddom_pw(trusted_dom_name, cleartextpwd, &dom_sid)) {
6537 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6538 nt_status = NT_STATUS_UNSUCCESSFUL;
6539 goto done;
6540 }
6541
6542 #ifdef DEBUG_PASSWORD
6543 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
6544 "password: [%s]\n", trusted_dom_name,
6545 sid_string_dbg(&dom_sid), cleartextpwd));
6546 #endif
6547
6548 done:
6549 SAFE_FREE(cleartextpwd);
6550 data_blob_free(&data);
6551
6552 return nt_status;
6553 }
6554
6555 static int rpc_trustdom_vampire(struct net_context *c, int argc,
6556 const char **argv)
6557 {
6558 /* common variables */
6559 TALLOC_CTX* mem_ctx;
6560 struct cli_state *cli = NULL;
6561 struct rpc_pipe_client *pipe_hnd = NULL;
6562 NTSTATUS nt_status, result;
6563 const char *domain_name = NULL;
6564 struct policy_handle connect_hnd;
6565 union lsa_PolicyInformation *info = NULL;
6566
6567 /* trusted domains listing variables */
6568 unsigned int enum_ctx = 0;
6569 int i;
6570 struct lsa_DomainList dom_list;
6571 fstring pdc_name;
6572 struct dcerpc_binding_handle *b;
6573
6574 if (c->display_usage) {
6575 d_printf( "%s\n"
6576 "net rpc trustdom vampire\n"
6577 " %s\n",
6578 _("Usage:"),
6579 _("Vampire trust relationship from remote server"));
6580 return 0;
6581 }
6582
6583 /*
6584 * Listing trusted domains (stored in secrets.tdb, if local)
6585 */
6586
6587 mem_ctx = talloc_init("trust relationships vampire");
6588
6589 /*
6590 * set domain and pdc name to local samba server (default)
6591 * or to remote one given in command line
6592 */
6593
6594 if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
6595 domain_name = c->opt_workgroup;
6596 c->opt_target_workgroup = c->opt_workgroup;
6597 } else {
6598 fstrcpy(pdc_name, lp_netbios_name());
6599 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6600 c->opt_target_workgroup = domain_name;
6601 };
6602
6603 /* open \PIPE\lsarpc and open policy handle */
6604 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6605 if (!NT_STATUS_IS_OK(nt_status)) {
6606 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6607 nt_errstr(nt_status)));
6608 talloc_destroy(mem_ctx);
6609 return -1;
6610 };
6611
6612 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6613 &pipe_hnd);
6614 if (!NT_STATUS_IS_OK(nt_status)) {
6615 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6616 nt_errstr(nt_status) ));
6617 cli_shutdown(cli);
6618 talloc_destroy(mem_ctx);
6619 return -1;
6620 };
6621
6622 b = pipe_hnd->binding_handle;
6623
6624 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6625 &connect_hnd);
6626 if (NT_STATUS_IS_ERR(nt_status)) {
6627 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6628 nt_errstr(nt_status)));
6629 cli_shutdown(cli);
6630 talloc_destroy(mem_ctx);
6631 return -1;
6632 };
6633
6634 /* query info level 5 to obtain sid of a domain being queried */
6635 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6636 &connect_hnd,
6637 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6638 &info,
6639 &result);
6640
6641 if (NT_STATUS_IS_ERR(nt_status)) {
6642 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6643 nt_errstr(nt_status)));
6644 cli_shutdown(cli);
6645 talloc_destroy(mem_ctx);
6646 return -1;
6647 }
6648 if (NT_STATUS_IS_ERR(result)) {
6649 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6650 nt_errstr(result)));
6651 cli_shutdown(cli);
6652 talloc_destroy(mem_ctx);
6653 return -1;
6654 }
6655
6656 /*
6657 * Keep calling LsaEnumTrustdom over opened pipe until
6658 * the end of enumeration is reached
6659 */
6660
6661 d_printf(_("Vampire trusted domains:\n\n"));
6662
6663 do {
6664 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
6665 &connect_hnd,
6666 &enum_ctx,
6667 &dom_list,
6668 (uint32_t)-1,
6669 &result);
6670 if (NT_STATUS_IS_ERR(nt_status)) {
6671 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6672 nt_errstr(nt_status)));
6673 cli_shutdown(cli);
6674 talloc_destroy(mem_ctx);
6675 return -1;
6676 };
6677 if (NT_STATUS_IS_ERR(result)) {
6678 nt_status = result;
6679 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6680 nt_errstr(result)));
6681 cli_shutdown(cli);
6682 talloc_destroy(mem_ctx);
6683 return -1;
6684 };
6685
6686
6687 for (i = 0; i < dom_list.count; i++) {
6688
6689 print_trusted_domain(dom_list.domains[i].sid,
6690 dom_list.domains[i].name.string);
6691
6692 nt_status = vampire_trusted_domain(pipe_hnd, mem_ctx, &connect_hnd,
6693 *dom_list.domains[i].sid,
6694 dom_list.domains[i].name.string);
6695 if (!NT_STATUS_IS_OK(nt_status)) {
6696 cli_shutdown(cli);
6697 talloc_destroy(mem_ctx);
6698 return -1;
6699 }
6700 };
6701
6702 /*
6703 * in case of no trusted domains say something rather
6704 * than just display blank line
6705 */
6706 if (!dom_list.count) d_printf(_("none\n"));
6707
6708 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6709
6710 /* close this connection before doing next one */
6711 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6712 if (NT_STATUS_IS_ERR(nt_status)) {
6713 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6714 nt_errstr(nt_status)));
6715 cli_shutdown(cli);
6716 talloc_destroy(mem_ctx);
6717 return -1;
6718 };
6719
6720 /* close lsarpc pipe and connection to IPC$ */
6721 cli_shutdown(cli);
6722
6723 talloc_destroy(mem_ctx);
6724 return 0;
6725 }
6726
6727 static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
6728 {
6729 /* common variables */
6730 TALLOC_CTX* mem_ctx;
6731 struct cli_state *cli = NULL, *remote_cli = NULL;
6732 struct rpc_pipe_client *pipe_hnd = NULL;
6733 NTSTATUS nt_status, result;
6734 const char *domain_name = NULL;
6735 struct dom_sid *queried_dom_sid;
6736 int ascii_dom_name_len;
6737 struct policy_handle connect_hnd;
6738 union lsa_PolicyInformation *info = NULL;
6739 struct dcerpc_binding_handle *b = NULL;
6740
6741 /* trusted domains listing variables */
6742 unsigned int num_domains, enum_ctx = 0;
6743 int i;
6744 struct lsa_DomainList dom_list;
6745 fstring pdc_name;
6746 bool found_domain;
6747
6748 /* trusting domains listing variables */
6749 struct policy_handle domain_hnd;
6750 struct samr_SamArray *trusts = NULL;
6751
6752 if (c->display_usage) {
6753 d_printf( "%s\n"
6754 "net rpc trustdom list\n"
6755 " %s\n",
6756 _("Usage:"),
6757 _("List incoming and outgoing trust relationships"));
6758 return 0;
6759 }
6760
6761 /*
6762 * Listing trusted domains (stored in secrets.tdb, if local)
6763 */
6764
6765 mem_ctx = talloc_init("trust relationships listing");
6766
6767 /*
6768 * set domain and pdc name to local samba server (default)
6769 * or to remote one given in command line
6770 */
6771
6772 if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
6773 domain_name = c->opt_workgroup;
6774 c->opt_target_workgroup = c->opt_workgroup;
6775 } else {
6776 fstrcpy(pdc_name, lp_netbios_name());
6777 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6778 c->opt_target_workgroup = domain_name;
6779 };
6780
6781 /* open \PIPE\lsarpc and open policy handle */
6782 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6783 if (!NT_STATUS_IS_OK(nt_status)) {
6784 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6785 nt_errstr(nt_status)));
6786 talloc_destroy(mem_ctx);
6787 return -1;
6788 };
6789
6790 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6791 &pipe_hnd);
6792 if (!NT_STATUS_IS_OK(nt_status)) {
6793 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6794 nt_errstr(nt_status) ));
6795 cli_shutdown(cli);
6796 talloc_destroy(mem_ctx);
6797 return -1;
6798 };
6799
6800 b = pipe_hnd->binding_handle;
6801
6802 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6803 &connect_hnd);
6804 if (NT_STATUS_IS_ERR(nt_status)) {
6805 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6806 nt_errstr(nt_status)));
6807 cli_shutdown(cli);
6808 talloc_destroy(mem_ctx);
6809 return -1;
6810 };
6811
6812 /* query info level 5 to obtain sid of a domain being queried */
6813 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6814 &connect_hnd,
6815 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6816 &info,
6817 &result);
6818
6819 if (NT_STATUS_IS_ERR(nt_status)) {
6820 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6821 nt_errstr(nt_status)));
6822 cli_shutdown(cli);
6823 talloc_destroy(mem_ctx);
6824 return -1;
6825 }
6826 if (NT_STATUS_IS_ERR(result)) {
6827 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6828 nt_errstr(result)));
6829 cli_shutdown(cli);
6830 talloc_destroy(mem_ctx);
6831 return -1;
6832 }
6833
6834 queried_dom_sid = info->account_domain.sid;
6835
6836 /*
6837 * Keep calling LsaEnumTrustdom over opened pipe until
6838 * the end of enumeration is reached
6839 */
6840
6841 d_printf(_("Trusted domains list:\n\n"));
6842
6843 found_domain = false;
6844
6845 do {
6846 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
6847 &connect_hnd,
6848 &enum_ctx,
6849 &dom_list,
6850 (uint32_t)-1,
6851 &result);
6852 if (NT_STATUS_IS_ERR(nt_status)) {
6853 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6854 nt_errstr(nt_status)));
6855 cli_shutdown(cli);
6856 talloc_destroy(mem_ctx);
6857 return -1;
6858 };
6859 if (NT_STATUS_IS_ERR(result)) {
6860 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6861 nt_errstr(result)));
6862 cli_shutdown(cli);
6863 talloc_destroy(mem_ctx);
6864 return -1;
6865 };
6866
6867
6868 for (i = 0; i < dom_list.count; i++) {
6869 print_trusted_domain(dom_list.domains[i].sid,
6870 dom_list.domains[i].name.string);
6871 found_domain = true;
6872 };
6873
6874
6875 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6876
6877 /*
6878 * in case of no trusted domains say something rather
6879 * than just display blank line
6880 */
6881 if (!found_domain) {
6882 d_printf(_("none\n"));
6883 }
6884
6885 /* close this connection before doing next one */
6886 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6887 if (NT_STATUS_IS_ERR(nt_status)) {
6888 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6889 nt_errstr(nt_status)));
6890 cli_shutdown(cli);
6891 talloc_destroy(mem_ctx);
6892 return -1;
6893 };
6894
6895 TALLOC_FREE(pipe_hnd);
6896
6897 /*
6898 * Listing trusting domains (stored in passdb backend, if local)
6899 */
6900
6901 d_printf(_("\nTrusting domains list:\n\n"));
6902
6903 /*
6904 * Open \PIPE\samr and get needed policy handles
6905 */
6906 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
6907 &pipe_hnd);
6908 if (!NT_STATUS_IS_OK(nt_status)) {
6909 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status)));
6910 cli_shutdown(cli);
6911 talloc_destroy(mem_ctx);
6912 return -1;
6913 };
6914
6915 b = pipe_hnd->binding_handle;
6916
6917 /* SamrConnect2 */
6918 nt_status = dcerpc_samr_Connect2(b, mem_ctx,
6919 pipe_hnd->desthost,
6920 SAMR_ACCESS_LOOKUP_DOMAIN,
6921 &connect_hnd,
6922 &result);
6923 if (!NT_STATUS_IS_OK(nt_status)) {
6924 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6925 nt_errstr(nt_status)));
6926 cli_shutdown(cli);
6927 talloc_destroy(mem_ctx);
6928 return -1;
6929 };
6930 if (!NT_STATUS_IS_OK(result)) {
6931 nt_status = result;
6932 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6933 nt_errstr(result)));
6934 cli_shutdown(cli);
6935 talloc_destroy(mem_ctx);
6936 return -1;
6937 };
6938
6939 /* SamrOpenDomain - we have to open domain policy handle in order to be
6940 able to enumerate accounts*/
6941 nt_status = dcerpc_samr_OpenDomain(b, mem_ctx,
6942 &connect_hnd,
6943 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
6944 queried_dom_sid,
6945 &domain_hnd,
6946 &result);
6947 if (!NT_STATUS_IS_OK(nt_status)) {
6948 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6949 nt_errstr(nt_status)));
6950 cli_shutdown(cli);
6951 talloc_destroy(mem_ctx);
6952 return -1;
6953 };
6954 if (!NT_STATUS_IS_OK(result)) {
6955 nt_status = result;
6956 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6957 nt_errstr(result)));
6958 cli_shutdown(cli);
6959 talloc_destroy(mem_ctx);
6960 return -1;
6961 };
6962
6963 /*
6964 * perform actual enumeration
6965 */
6966
6967 found_domain = false;
6968
6969 enum_ctx = 0; /* reset enumeration context from last enumeration */
6970 do {
6971
6972 nt_status = dcerpc_samr_EnumDomainUsers(b, mem_ctx,
6973 &domain_hnd,
6974 &enum_ctx,
6975 ACB_DOMTRUST,
6976 &trusts,
6977 0xffff,
6978 &num_domains,
6979 &result);
6980 if (NT_STATUS_IS_ERR(nt_status)) {
6981 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6982 nt_errstr(nt_status)));
6983 cli_shutdown(cli);
6984 talloc_destroy(mem_ctx);
6985 return -1;
6986 };
6987 if (NT_STATUS_IS_ERR(result)) {
6988 nt_status = result;
6989 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6990 nt_errstr(result)));
6991 cli_shutdown(cli);
6992 talloc_destroy(mem_ctx);
6993 return -1;
6994 };
6995
6996 for (i = 0; i < num_domains; i++) {
6997
6998 char *str = discard_const_p(char, trusts->entries[i].name.string);
6999
7000 found_domain = true;
7001
7002 /*
7003 * get each single domain's sid (do we _really_ need this ?):
7004 * 1) connect to domain's pdc
7005 * 2) query the pdc for domain's sid
7006 */
7007
7008 /* get rid of '$' tail */
7009 ascii_dom_name_len = strlen(str);
7010 if (ascii_dom_name_len && ascii_dom_name_len < FSTRING_LEN)
7011 str[ascii_dom_name_len - 1] = '\0';
7012
7013 /* set opt_* variables to remote domain */
7014 if (!strupper_m(str)) {
7015 cli_shutdown(cli);
7016 talloc_destroy(mem_ctx);
7017 return -1;
7018 }
7019 c->opt_workgroup = talloc_strdup(mem_ctx, str);
7020 c->opt_target_workgroup = c->opt_workgroup;
7021
7022 d_printf("%-20s", str);
7023
7024 /* connect to remote domain controller */
7025 nt_status = net_make_ipc_connection(c,
7026 NET_FLAGS_PDC | NET_FLAGS_ANONYMOUS,
7027 &remote_cli);
7028 if (NT_STATUS_IS_OK(nt_status)) {
7029 /* query for domain's sid */
7030 if (run_rpc_command(
7031 c, remote_cli,
7032 &ndr_table_lsarpc, 0,
7033 rpc_query_domain_sid, argc,
7034 argv))
7035 d_printf(_("strange - couldn't get domain's sid\n"));
7036
7037 cli_shutdown(remote_cli);
7038
7039 } else {
7040 d_fprintf(stderr, _("domain controller is not "
7041 "responding: %s\n"),
7042 nt_errstr(nt_status));
7043 d_printf(_("couldn't get domain's sid\n"));
7044 }
7045 }
7046
7047 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
7048
7049 if (!found_domain) {
7050 d_printf("none\n");
7051 }
7052
7053 /* close opened samr and domain policy handles */
7054 nt_status = dcerpc_samr_Close(b, mem_ctx, &domain_hnd, &result);
7055 if (!NT_STATUS_IS_OK(nt_status)) {
7056 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name));
7057 };
7058
7059 nt_status = dcerpc_samr_Close(b, mem_ctx, &connect_hnd, &result);
7060 if (!NT_STATUS_IS_OK(nt_status)) {
7061 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name));
7062 };
7063
7064 /* close samr pipe and connection to IPC$ */
7065 cli_shutdown(cli);
7066
7067 talloc_destroy(mem_ctx);
7068 return 0;
7069 }
7070
7071 /**
7072 * Entrypoint for 'net rpc trustdom' code.
7073 *
7074 * @param argc Standard argc.
7075 * @param argv Standard argv without initial components.
7076 *
7077 * @return Integer status (0 means success).
7078 */
7079
7080 static int rpc_trustdom(struct net_context *c, int argc, const char **argv)
7081 {
7082 struct functable func[] = {
7083 {
7084 "add",
7085 rpc_trustdom_add,
7086 NET_TRANSPORT_RPC,
7087 N_("Add trusting domain's account"),
7088 N_("net rpc trustdom add\n"
7089 " Add trusting domain's account")
7090 },
7091 {
7092 "del",
7093 rpc_trustdom_del,
7094 NET_TRANSPORT_RPC,
7095 N_("Remove trusting domain's account"),
7096 N_("net rpc trustdom del\n"
7097 " Remove trusting domain's account")
7098 },
7099 {
7100 "establish",
7101 rpc_trustdom_establish,
7102 NET_TRANSPORT_RPC,
7103 N_("Establish outgoing trust relationship"),
7104 N_("net rpc trustdom establish\n"
7105 " Establish outgoing trust relationship")
7106 },
7107 {
7108 "revoke",
7109 rpc_trustdom_revoke,
7110 NET_TRANSPORT_RPC,
7111 N_("Revoke outgoing trust relationship"),
7112 N_("net rpc trustdom revoke\n"
7113 " Revoke outgoing trust relationship")
7114 },
7115 {
7116 "list",
7117 rpc_trustdom_list,
7118 NET_TRANSPORT_RPC,
7119 N_("List in- and outgoing domain trusts"),
7120 N_("net rpc trustdom list\n"
7121 " List in- and outgoing domain trusts")
7122 },
7123 {
7124 "vampire",
7125 rpc_trustdom_vampire,
7126 NET_TRANSPORT_RPC,
7127 N_("Vampire trusts from remote server"),
7128 N_("net rpc trustdom vampire\n"
7129 " Vampire trusts from remote server")
7130 },
7131 {NULL, NULL, 0, NULL, NULL}
7132 };
7133
7134 return net_run_function(c, argc, argv, "net rpc trustdom", func);
7135 }
7136
7137 /**
7138 * Check if a server will take rpc commands
7139 * @param flags Type of server to connect to (PDC, DMB, localhost)
7140 * if the host is not explicitly specified
7141 * @return bool (true means rpc supported)
7142 */
7143 bool net_rpc_check(struct net_context *c, unsigned flags)
7144 {
7145 struct cli_state *cli;
7146 bool ret = false;
7147 struct sockaddr_storage server_ss;
7148 char *server_name = NULL;
7149 NTSTATUS status;
7150
7151 /* flags (i.e. server type) may depend on command */
7152 if (!net_find_server(c, NULL, flags, &server_ss, &server_name))
7153 return false;
7154
7155 status = cli_connect_nb(server_name, &server_ss, 0, 0x20,
7156 lp_netbios_name(), SMB_SIGNING_DEFAULT,
7157 0, &cli);
7158 if (!NT_STATUS_IS_OK(status)) {
7159 return false;
7160 }
7161 status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
7162 PROTOCOL_NT1);
7163 if (!NT_STATUS_IS_OK(status))
7164 goto done;
7165 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_NT1)
7166 goto done;
7167
7168 ret = true;
7169 done:
7170 cli_shutdown(cli);
7171 return ret;
7172 }
7173
7174 /* dump sam database via samsync rpc calls */
7175 static int rpc_samdump(struct net_context *c, int argc, const char **argv) {
7176 if (c->display_usage) {
7177 d_printf( "%s\n"
7178 "net rpc samdump\n"
7179 " %s\n",
7180 _("Usage:"),
7181 _("Dump remote SAM database"));
7182 return 0;
7183 }
7184
7185 return run_rpc_command(c, NULL, &ndr_table_netlogon,
7186 NET_FLAGS_ANONYMOUS,
7187 rpc_samdump_internals, argc, argv);
7188 }
7189
7190 /* syncronise sam database via samsync rpc calls */
7191 static int rpc_vampire(struct net_context *c, int argc, const char **argv)
7192 {
7193 struct functable func[] = {
7194 {
7195 "ldif",
7196 rpc_vampire_ldif,
7197 NET_TRANSPORT_RPC,
7198 N_("Dump remote SAM database to ldif"),
7199 N_("net rpc vampire ldif\n"
7200 " Dump remote SAM database to LDIF file or "
7201 "stdout")
7202 },
7203 {
7204 "keytab",
7205 rpc_vampire_keytab,
7206 NET_TRANSPORT_RPC,
7207 N_("Dump remote SAM database to Kerberos Keytab"),
7208 N_("net rpc vampire keytab\n"
7209 " Dump remote SAM database to Kerberos keytab "
7210 "file")
7211 },
7212 {
7213 "passdb",
7214 rpc_vampire_passdb,
7215 NET_TRANSPORT_RPC,
7216 N_("Dump remote SAM database to passdb"),
7217 N_("net rpc vampire passdb\n"
7218 " Dump remote SAM database to passdb")
7219 },
7220
7221 {NULL, NULL, 0, NULL, NULL}
7222 };
7223
7224 if (argc == 0) {
7225 if (c->display_usage) {
7226 d_printf( "%s\n"
7227 "net rpc vampire\n"
7228 " %s\n",
7229 _("Usage:"),
7230 _("Vampire remote SAM database"));
7231 return 0;
7232 }
7233
7234 return rpc_vampire_passdb(c, argc, argv);
7235 }
7236
7237 return net_run_function(c, argc, argv, "net rpc vampire", func);
7238 }
7239
7240 /**
7241 * Migrate everything from a print server.
7242 *
7243 * @param c A net_context structure.
7244 * @param argc Standard main() style argc.
7245 * @param argv Standard main() style argv. Initial components are already
7246 * stripped.
7247 *
7248 * @return A shell status integer (0 for success).
7249 *
7250 * The order is important !
7251 * To successfully add drivers the print queues have to exist !
7252 * Applying ACLs should be the last step, because you're easily locked out.
7253 *
7254 **/
7255 static int rpc_printer_migrate_all(struct net_context *c, int argc,
7256 const char **argv)
7257 {
7258 int ret;
7259
7260 if (c->display_usage) {
7261 d_printf( "%s\n"
7262 "net rpc printer migrate all\n"
7263 " %s\n",
7264 _("Usage:"),
7265 _("Migrate everything from a print server"));
7266 return 0;
7267 }
7268
7269 if (!c->opt_host) {
7270 d_printf(_("no server to migrate\n"));
7271 return -1;
7272 }
7273
7274 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7275 rpc_printer_migrate_printers_internals, argc,
7276 argv);
7277 if (ret)
7278 return ret;
7279
7280 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7281 rpc_printer_migrate_drivers_internals, argc,
7282 argv);
7283 if (ret)
7284 return ret;
7285
7286 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7287 rpc_printer_migrate_forms_internals, argc, argv);
7288 if (ret)
7289 return ret;
7290
7291 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7292 rpc_printer_migrate_settings_internals, argc,
7293 argv);
7294 if (ret)
7295 return ret;
7296
7297 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7298 rpc_printer_migrate_security_internals, argc,
7299 argv);
7300
7301 }
7302
7303 /**
7304 * Migrate print drivers from a print server.
7305 *
7306 * @param c A net_context structure.
7307 * @param argc Standard main() style argc.
7308 * @param argv Standard main() style argv. Initial components are already
7309 * stripped.
7310 *
7311 * @return A shell status integer (0 for success).
7312 **/
7313 static int rpc_printer_migrate_drivers(struct net_context *c, int argc,
7314 const char **argv)
7315 {
7316 if (c->display_usage) {
7317 d_printf( "%s\n"
7318 "net rpc printer migrate drivers\n"
7319 " %s\n",
7320 _("Usage:"),
7321 _("Migrate print-drivers from a print-server"));
7322 return 0;
7323 }
7324
7325 if (!c->opt_host) {
7326 d_printf(_("no server to migrate\n"));
7327 return -1;
7328 }
7329
7330 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7331 rpc_printer_migrate_drivers_internals,
7332 argc, argv);
7333 }
7334
7335 /**
7336 * Migrate print-forms from a print-server.
7337 *
7338 * @param c A net_context structure.
7339 * @param argc Standard main() style argc.
7340 * @param argv Standard main() style argv. Initial components are already
7341 * stripped.
7342 *
7343 * @return A shell status integer (0 for success).
7344 **/
7345 static int rpc_printer_migrate_forms(struct net_context *c, int argc,
7346 const char **argv)
7347 {
7348 if (c->display_usage) {
7349 d_printf( "%s\n"
7350 "net rpc printer migrate forms\n"
7351 " %s\n",
7352 _("Usage:"),
7353 _("Migrate print-forms from a print-server"));
7354 return 0;
7355 }
7356
7357 if (!c->opt_host) {
7358 d_printf(_("no server to migrate\n"));
7359 return -1;
7360 }
7361
7362 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7363 rpc_printer_migrate_forms_internals,
7364 argc, argv);
7365 }
7366
7367 /**
7368 * Migrate printers from a print-server.
7369 *
7370 * @param c A net_context structure.
7371 * @param argc Standard main() style argc.
7372 * @param argv Standard main() style argv. Initial components are already
7373 * stripped.
7374 *
7375 * @return A shell status integer (0 for success).
7376 **/
7377 static int rpc_printer_migrate_printers(struct net_context *c, int argc,
7378 const char **argv)
7379 {
7380 if (c->display_usage) {
7381 d_printf( "%s\n"
7382 "net rpc printer migrate printers\n"
7383 " %s\n",
7384 _("Usage:"),
7385 _("Migrate printers from a print-server"));
7386 return 0;
7387 }
7388
7389 if (!c->opt_host) {
7390 d_printf(_("no server to migrate\n"));
7391 return -1;
7392 }
7393
7394 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7395 rpc_printer_migrate_printers_internals,
7396 argc, argv);
7397 }
7398
7399 /**
7400 * Migrate printer-ACLs from a print-server
7401 *
7402 * @param c A net_context structure.
7403 * @param argc Standard main() style argc.
7404 * @param argv Standard main() style argv. Initial components are already
7405 * stripped.
7406 *
7407 * @return A shell status integer (0 for success).
7408 **/
7409 static int rpc_printer_migrate_security(struct net_context *c, int argc,
7410 const char **argv)
7411 {
7412 if (c->display_usage) {
7413 d_printf( "%s\n"
7414 "net rpc printer migrate security\n"
7415 " %s\n",
7416 _("Usage:"),
7417 _("Migrate printer-ACLs from a print-server"));
7418 return 0;
7419 }
7420
7421 if (!c->opt_host) {
7422 d_printf(_("no server to migrate\n"));
7423 return -1;
7424 }
7425
7426 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7427 rpc_printer_migrate_security_internals,
7428 argc, argv);
7429 }
7430
7431 /**
7432 * Migrate printer-settings from a print-server.
7433 *
7434 * @param c A net_context structure.
7435 * @param argc Standard main() style argc.
7436 * @param argv Standard main() style argv. Initial components are already
7437 * stripped.
7438 *
7439 * @return A shell status integer (0 for success).
7440 **/
7441 static int rpc_printer_migrate_settings(struct net_context *c, int argc,
7442 const char **argv)
7443 {
7444 if (c->display_usage) {
7445 d_printf( "%s\n"
7446 "net rpc printer migrate settings\n"
7447 " %s\n",
7448 _("Usage:"),
7449 _("Migrate printer-settings from a "
7450 "print-server"));
7451 return 0;
7452 }
7453
7454 if (!c->opt_host) {
7455 d_printf(_("no server to migrate\n"));
7456 return -1;
7457 }
7458
7459 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7460 rpc_printer_migrate_settings_internals,
7461 argc, argv);
7462 }
7463
7464 /**
7465 * 'net rpc printer' entrypoint.
7466 *
7467 * @param c A net_context structure.
7468 * @param argc Standard main() style argc.
7469 * @param argv Standard main() style argv. Initial components are already
7470 * stripped.
7471 **/
7472
7473 int rpc_printer_migrate(struct net_context *c, int argc, const char **argv)
7474 {
7475
7476 /* ouch: when addriver and setdriver are called from within
7477 rpc_printer_migrate_drivers_internals, the printer-queue already
7478 *has* to exist */
7479
7480 struct functable func[] = {
7481 {
7482 "all",
7483 rpc_printer_migrate_all,
7484 NET_TRANSPORT_RPC,
7485 N_("Migrate all from remote to local print server"),
7486 N_("net rpc printer migrate all\n"
7487 " Migrate all from remote to local print server")
7488 },
7489 {
7490 "drivers",
7491 rpc_printer_migrate_drivers,
7492 NET_TRANSPORT_RPC,
7493 N_("Migrate drivers to local server"),
7494 N_("net rpc printer migrate drivers\n"
7495 " Migrate drivers to local server")
7496 },
7497 {
7498 "forms",
7499 rpc_printer_migrate_forms,
7500 NET_TRANSPORT_RPC,
7501 N_("Migrate froms to local server"),
7502 N_("net rpc printer migrate forms\n"
7503 " Migrate froms to local server")
7504 },
7505 {
7506 "printers",
7507 rpc_printer_migrate_printers,
7508 NET_TRANSPORT_RPC,
7509 N_("Migrate printers to local server"),
7510 N_("net rpc printer migrate printers\n"
7511 " Migrate printers to local server")
7512 },
7513 {
7514 "security",
7515 rpc_printer_migrate_security,
7516 NET_TRANSPORT_RPC,
7517 N_("Mirgate printer ACLs to local server"),
7518 N_("net rpc printer migrate security\n"
7519 " Mirgate printer ACLs to local server")
7520 },
7521 {
7522 "settings",
7523 rpc_printer_migrate_settings,
7524 NET_TRANSPORT_RPC,
7525 N_("Migrate printer settings to local server"),
7526 N_("net rpc printer migrate settings\n"
7527 " Migrate printer settings to local server")
7528 },
7529 {NULL, NULL, 0, NULL, NULL}
7530 };
7531
7532 return net_run_function(c, argc, argv, "net rpc printer migrate",func);
7533 }
7534
7535
7536 /**
7537 * List printers on a remote RPC server.
7538 *
7539 * @param c A net_context structure.
7540 * @param argc Standard main() style argc.
7541 * @param argv Standard main() style argv. Initial components are already
7542 * stripped.
7543 *
7544 * @return A shell status integer (0 for success).
7545 **/
7546 static int rpc_printer_list(struct net_context *c, int argc, const char **argv)
7547 {
7548 if (c->display_usage) {
7549 d_printf( "%s\n"
7550 "net rpc printer list\n"
7551 " %s\n",
7552 _("Usage:"),
7553 _("List printers on a remote RPC server"));
7554 return 0;
7555 }
7556
7557 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7558 rpc_printer_list_internals,
7559 argc, argv);
7560 }
7561
7562 /**
7563 * List printer-drivers on a remote RPC server.
7564 *
7565 * @param c A net_context structure.
7566 * @param argc Standard main() style argc.
7567 * @param argv Standard main() style argv. Initial components are already
7568 * stripped.
7569 *
7570 * @return A shell status integer (0 for success).
7571 **/
7572 static int rpc_printer_driver_list(struct net_context *c, int argc,
7573 const char **argv)
7574 {
7575 if (c->display_usage) {
7576 d_printf( "%s\n"
7577 "net rpc printer driver\n"
7578 " %s\n",
7579 _("Usage:"),
7580 _("List printer-drivers on a remote RPC server"));
7581 return 0;
7582 }
7583
7584 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7585 rpc_printer_driver_list_internals,
7586 argc, argv);
7587 }
7588
7589 /**
7590 * Publish printer in ADS via MSRPC.
7591 *
7592 * @param c A net_context structure.
7593 * @param argc Standard main() style argc.
7594 * @param argv Standard main() style argv. Initial components are already
7595 * stripped.
7596 *
7597 * @return A shell status integer (0 for success).
7598 **/
7599 static int rpc_printer_publish_publish(struct net_context *c, int argc,
7600 const char **argv)
7601 {
7602 if (c->display_usage) {
7603 d_printf( "%s\n"
7604 "net rpc printer publish publish\n"
7605 " %s\n",
7606 _("Usage:"),
7607 _("Publish printer in ADS via MSRPC"));
7608 return 0;
7609 }
7610
7611 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7612 rpc_printer_publish_publish_internals,
7613 argc, argv);
7614 }
7615
7616 /**
7617 * Update printer in ADS via MSRPC.
7618 *
7619 * @param c A net_context structure.
7620 * @param argc Standard main() style argc.
7621 * @param argv Standard main() style argv. Initial components are already
7622 * stripped.
7623 *
7624 * @return A shell status integer (0 for success).
7625 **/
7626 static int rpc_printer_publish_update(struct net_context *c, int argc, const char **argv)
7627 {
7628 if (c->display_usage) {
7629 d_printf( "%s\n"
7630 "net rpc printer publish update\n"
7631 " %s\n",
7632 _("Usage:"),
7633 _("Update printer in ADS via MSRPC"));
7634 return 0;
7635 }
7636
7637 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7638 rpc_printer_publish_update_internals,
7639 argc, argv);
7640 }
7641
7642 /**
7643 * UnPublish printer in ADS via MSRPC.
7644 *
7645 * @param c A net_context structure.
7646 * @param argc Standard main() style argc.
7647 * @param argv Standard main() style argv. Initial components are already
7648 * stripped.
7649 *
7650 * @return A shell status integer (0 for success).
7651 **/
7652 static int rpc_printer_publish_unpublish(struct net_context *c, int argc,
7653 const char **argv)
7654 {
7655 if (c->display_usage) {
7656 d_printf( "%s\n"
7657 "net rpc printer publish unpublish\n"
7658 " %s\n",
7659 _("Usage:\n"),
7660 _("UnPublish printer in ADS via MSRPC"));
7661 return 0;
7662 }
7663
7664 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7665 rpc_printer_publish_unpublish_internals,
7666 argc, argv);
7667 }
7668
7669 /**
7670 * List published printers via MSRPC.
7671 *
7672 * @param c A net_context structure.
7673 * @param argc Standard main() style argc.
7674 * @param argv Standard main() style argv. Initial components are already
7675 * stripped.
7676 *
7677 * @return A shell status integer (0 for success).
7678 **/
7679 static int rpc_printer_publish_list(struct net_context *c, int argc,
7680 const char **argv)
7681 {
7682 if (c->display_usage) {
7683 d_printf( "%s\n"
7684 "net rpc printer publish list\n"
7685 " %s\n",
7686 _("Usage:"),
7687 _("List published printers via MSRPC"));
7688 return 0;
7689 }
7690
7691 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7692 rpc_printer_publish_list_internals,
7693 argc, argv);
7694 }
7695
7696
7697 /**
7698 * Publish printer in ADS.
7699 *
7700 * @param c A net_context structure.
7701 * @param argc Standard main() style argc.
7702 * @param argv Standard main() style argv. Initial components are already
7703 * stripped.
7704 *
7705 * @return A shell status integer (0 for success).
7706 **/
7707 static int rpc_printer_publish(struct net_context *c, int argc,
7708 const char **argv)
7709 {
7710
7711 struct functable func[] = {
7712 {
7713 "publish",
7714 rpc_printer_publish_publish,
7715 NET_TRANSPORT_RPC,
7716 N_("Publish printer in AD"),
7717 N_("net rpc printer publish publish\n"
7718 " Publish printer in AD")
7719 },
7720 {
7721 "update",
7722 rpc_printer_publish_update,
7723 NET_TRANSPORT_RPC,
7724 N_("Update printer in AD"),
7725 N_("net rpc printer publish update\n"
7726 " Update printer in AD")
7727 },
7728 {
7729 "unpublish",
7730 rpc_printer_publish_unpublish,
7731 NET_TRANSPORT_RPC,
7732 N_("Unpublish printer"),
7733 N_("net rpc printer publish unpublish\n"
7734 " Unpublish printer")
7735 },
7736 {
7737 "list",
7738 rpc_printer_publish_list,
7739 NET_TRANSPORT_RPC,
7740 N_("List published printers"),
7741 N_("net rpc printer publish list\n"
7742 " List published printers")
7743 },
7744 {NULL, NULL, 0, NULL, NULL}
7745 };
7746
7747 if (argc == 0) {
7748 if (c->display_usage) {
7749 d_printf(_("Usage:\n"));
7750 d_printf(_("net rpc printer publish\n"
7751 " List published printers\n"
7752 " Alias of net rpc printer publish "
7753 "list\n"));
7754 net_display_usage_from_functable(func);
7755 return 0;
7756 }
7757 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7758 rpc_printer_publish_list_internals,
7759 argc, argv);
7760 }
7761
7762 return net_run_function(c, argc, argv, "net rpc printer publish",func);
7763
7764 }
7765
7766
7767 /**
7768 * Display rpc printer help page.
7769 *
7770 * @param c A net_context structure.
7771 * @param argc Standard main() style argc.
7772 * @param argv Standard main() style argv. Initial components are already
7773 * stripped.
7774 **/
7775 int rpc_printer_usage(struct net_context *c, int argc, const char **argv)
7776 {
7777 d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
7778 "\tlists all printers on print-server\n\n"));
7779 d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
7780 "\tlists all printer-drivers on print-server\n\n"));
7781 d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
7782 "\tpublishes printer settings in Active Directory\n"
7783 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
7784 d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
7785 "\n\tmigrates printers from remote to local server\n\n"));
7786 d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
7787 "\n\tmigrates printer-settings from remote to local server\n\n"));
7788 d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
7789 "\n\tmigrates printer-drivers from remote to local server\n\n"));
7790 d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
7791 "\n\tmigrates printer-forms from remote to local server\n\n"));
7792 d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
7793 "\n\tmigrates printer-ACLs from remote to local server\n\n"));
7794 d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
7795 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
7796 "\tremote to local print-server\n\n"));
7797 net_common_methods_usage(c, argc, argv);
7798 net_common_flags_usage(c, argc, argv);
7799 d_printf(_(
7800 "\t-v or --verbose\t\t\tgive verbose output\n"
7801 "\t --destination\t\tmigration target server (default: localhost)\n"));
7802
7803 return -1;
7804 }
7805
7806 /**
7807 * 'net rpc printer' entrypoint.
7808 *
7809 * @param c A net_context structure.
7810 * @param argc Standard main() style argc.
7811 * @param argv Standard main() style argv. Initial components are already
7812 * stripped.
7813 **/
7814 int net_rpc_printer(struct net_context *c, int argc, const char **argv)
7815 {
7816 struct functable func[] = {
7817 {
7818 "list",
7819 rpc_printer_list,
7820 NET_TRANSPORT_RPC,
7821 N_("List all printers on print server"),
7822 N_("net rpc printer list\n"
7823 " List all printers on print server")
7824 },
7825 {
7826 "migrate",
7827 rpc_printer_migrate,
7828 NET_TRANSPORT_RPC,
7829 N_("Migrate printer to local server"),
7830 N_("net rpc printer migrate\n"
7831 " Migrate printer to local server")
7832 },
7833 {
7834 "driver",
7835 rpc_printer_driver_list,
7836 NET_TRANSPORT_RPC,
7837 N_("List printer drivers"),
7838 N_("net rpc printer driver\n"
7839 " List printer drivers")
7840 },
7841 {
7842 "publish",
7843 rpc_printer_publish,
7844 NET_TRANSPORT_RPC,
7845 N_("Publish printer in AD"),
7846 N_("net rpc printer publish\n"
7847 " Publish printer in AD")
7848 },
7849 {NULL, NULL, 0, NULL, NULL}
7850 };
7851
7852 if (argc == 0) {
7853 if (c->display_usage) {
7854 d_printf(_("Usage:\n"));
7855 d_printf(_("net rpc printer\n"
7856 " List printers\n"));
7857 net_display_usage_from_functable(func);
7858 return 0;
7859 }
7860 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7861 rpc_printer_list_internals,
7862 argc, argv);
7863 }
7864
7865 return net_run_function(c, argc, argv, "net rpc printer", func);
7866 }
7867
7868 /**
7869 * 'net rpc' entrypoint.
7870 *
7871 * @param c A net_context structure.
7872 * @param argc Standard main() style argc.
7873 * @param argv Standard main() style argv. Initial components are already
7874 * stripped.
7875 **/
7876
7877 int net_rpc(struct net_context *c, int argc, const char **argv)
7878 {
7879 NET_API_STATUS status;
7880
7881 struct functable func[] = {
7882 {
7883 "audit",
7884 net_rpc_audit,
7885 NET_TRANSPORT_RPC,
7886 N_("Modify global audit settings"),
7887 N_("net rpc audit\n"
7888 " Modify global audit settings")
7889 },
7890 {
7891 "info",
7892 net_rpc_info,
7893 NET_TRANSPORT_RPC,
7894 N_("Show basic info about a domain"),
7895 N_("net rpc info\n"
7896 " Show basic info about a domain")
7897 },
7898 {
7899 "join",
7900 net_rpc_join,
7901 NET_TRANSPORT_RPC,
7902 N_("Join a domain"),
7903 N_("net rpc join\n"
7904 " Join a domain")
7905 },
7906 {
7907 "oldjoin",
7908 net_rpc_oldjoin,
7909 NET_TRANSPORT_RPC,
7910 N_("Join a domain created in server manager"),
7911 N_("net rpc oldjoin\n"
7912 " Join a domain created in server manager")
7913 },
7914 {
7915 "testjoin",
7916 net_rpc_testjoin,
7917 NET_TRANSPORT_RPC,
7918 N_("Test that a join is valid"),
7919 N_("net rpc testjoin\n"
7920 " Test that a join is valid")
7921 },
7922 {
7923 "user",
7924 net_rpc_user,
7925 NET_TRANSPORT_RPC,
7926 N_("List/modify users"),
7927 N_("net rpc user\n"
7928 " List/modify users")
7929 },
7930 {
7931 "password",
7932 rpc_user_password,
7933 NET_TRANSPORT_RPC,
7934 N_("Change a user password"),
7935 N_("net rpc password\n"
7936 " Change a user password\n"
7937 " Alias for net rpc user password")
7938 },
7939 {
7940 "group",
7941 net_rpc_group,
7942 NET_TRANSPORT_RPC,
7943 N_("List/modify groups"),
7944 N_("net rpc group\n"
7945 " List/modify groups")
7946 },
7947 {
7948 "share",
7949 net_rpc_share,
7950 NET_TRANSPORT_RPC,
7951 N_("List/modify shares"),
7952 N_("net rpc share\n"
7953 " List/modify shares")
7954 },
7955 {
7956 "file",
7957 net_rpc_file,
7958 NET_TRANSPORT_RPC,
7959 N_("List open files"),
7960 N_("net rpc file\n"
7961 " List open files")
7962 },
7963 {
7964 "printer",
7965 net_rpc_printer,
7966 NET_TRANSPORT_RPC,
7967 N_("List/modify printers"),
7968 N_("net rpc printer\n"
7969 " List/modify printers")
7970 },
7971 {
7972 "changetrustpw",
7973 net_rpc_changetrustpw,
7974 NET_TRANSPORT_RPC,
7975 N_("Change trust account password"),
7976 N_("net rpc changetrustpw\n"
7977 " Change trust account password")
7978 },
7979 {
7980 "trustdom",
7981 rpc_trustdom,
7982 NET_TRANSPORT_RPC,
7983 N_("Modify domain trusts"),
7984 N_("net rpc trustdom\n"
7985 " Modify domain trusts")
7986 },
7987 {
7988 "abortshutdown",
7989 rpc_shutdown_abort,
7990 NET_TRANSPORT_RPC,
7991 N_("Abort a remote shutdown"),
7992 N_("net rpc abortshutdown\n"
7993 " Abort a remote shutdown")
7994 },
7995 {
7996 "shutdown",
7997 rpc_shutdown,
7998 NET_TRANSPORT_RPC,
7999 N_("Shutdown a remote server"),
8000 N_("net rpc shutdown\n"
8001 " Shutdown a remote server")
8002 },
8003 {
8004 "samdump",
8005 rpc_samdump,
8006 NET_TRANSPORT_RPC,
8007 N_("Dump SAM data of remote NT PDC"),
8008 N_("net rpc samdump\n"
8009 " Dump SAM data of remote NT PDC")
8010 },
8011 {
8012 "vampire",
8013 rpc_vampire,
8014 NET_TRANSPORT_RPC,
8015 N_("Sync a remote NT PDC's data into local passdb"),
8016 N_("net rpc vampire\n"
8017 " Sync a remote NT PDC's data into local passdb")
8018 },
8019 {
8020 "getsid",
8021 net_rpc_getsid,
8022 NET_TRANSPORT_RPC,
8023 N_("Fetch the domain sid into local secrets.tdb"),
8024 N_("net rpc getsid\n"
8025 " Fetch the domain sid into local secrets.tdb")
8026 },
8027 {
8028 "rights",
8029 net_rpc_rights,
8030 NET_TRANSPORT_RPC,
8031 N_("Manage privileges assigned to SID"),
8032 N_("net rpc rights\n"
8033 " Manage privileges assigned to SID")
8034 },
8035 {
8036 "service",
8037 net_rpc_service,
8038 NET_TRANSPORT_RPC,
8039 N_("Start/stop/query remote services"),
8040 N_("net rpc service\n"
8041 " Start/stop/query remote services")
8042 },
8043 {
8044 "registry",
8045 net_rpc_registry,
8046 NET_TRANSPORT_RPC,
8047 N_("Manage registry hives"),
8048 N_("net rpc registry\n"
8049 " Manage registry hives")
8050 },
8051 {
8052 "shell",
8053 net_rpc_shell,
8054 NET_TRANSPORT_RPC,
8055 N_("Open interactive shell on remote server"),
8056 N_("net rpc shell\n"
8057 " Open interactive shell on remote server")
8058 },
8059 {
8060 "trust",
8061 net_rpc_trust,
8062 NET_TRANSPORT_RPC,
8063 N_("Manage trusts"),
8064 N_("net rpc trust\n"
8065 " Manage trusts")
8066 },
8067 {
8068 "conf",
8069 net_rpc_conf,
8070 NET_TRANSPORT_RPC,
8071 N_("Configure a remote samba server"),
8072 N_("net rpc conf\n"
8073 " Configure a remote samba server")
8074 },
8075 {NULL, NULL, 0, NULL, NULL}
8076 };
8077
8078 status = libnetapi_net_init(&c->netapi_ctx);
8079 if (status != 0) {
8080 return -1;
8081 }
8082 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
8083 libnetapi_set_password(c->netapi_ctx, c->opt_password);
8084 if (c->opt_kerberos) {
8085 libnetapi_set_use_kerberos(c->netapi_ctx);
8086 }
8087 if (c->opt_ccache) {
8088 libnetapi_set_use_ccache(c->netapi_ctx);
8089 }
8090
8091 return net_run_function(c, argc, argv, "net rpc", func);
8092 }