2 Unix SMB/CIFS implementation.
4 Winbind daemon connection manager
6 Copyright (C) Tim Potter 2001
7 Copyright (C) Andrew Bartlett 2002
8 Copyright (C) Gerald (Jerry) Carter 2003-2005.
9 Copyright (C) Volker Lendecke 2004-2005
10 Copyright (C) Jeremy Allison 2006
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 We need to manage connections to domain controllers without having to
28 mess up the main winbindd code with other issues. The aim of the
29 connection manager is to:
31 - make connections to domain controllers and cache them
32 - re-establish connections when networks or servers go down
33 - centralise the policy on connection timeouts, domain controller
35 - manage re-entrancy for when winbindd becomes able to handle
36 multiple outstanding rpc requests
38 Why not have connection management as part of the rpc layer like tng?
39 Good question. This code may morph into libsmb/rpc_cache.c or something
40 like that but at the moment it's simply staying as part of winbind. I
41 think the TNG architecture of forcing every user of the rpc layer to use
42 the connection caching system is a bad idea. It should be an optional
43 method of using the routines.
45 The TNG design is quite good but I disagree with some aspects of the
53 - I'm pretty annoyed by all the make_nmb_name() stuff. It should be
54 moved down into another function.
56 - Take care when destroying cli_structs as they can be shared between
63 #include "../libcli/auth/libcli_auth.h"
64 #include "../librpc/gen_ndr/cli_netlogon.h"
65 #include "../librpc/gen_ndr/cli_samr.h"
66 #include "../librpc/gen_ndr/cli_lsa.h"
67 #include "../librpc/gen_ndr/cli_dssetup.h"
70 #define DBGC_CLASS DBGC_WINBIND
74 struct sockaddr_storage ss
;
77 extern struct winbindd_methods reconnect_methods
;
78 extern bool override_logfile
;
80 static NTSTATUS
init_dc_connection_network(struct winbindd_domain
*domain
);
81 static void set_dc_type_and_flags( struct winbindd_domain
*domain
);
82 static bool get_dcs(TALLOC_CTX
*mem_ctx
, struct winbindd_domain
*domain
,
83 struct dc_name_ip
**dcs
, int *num_dcs
);
85 /****************************************************************
86 Child failed to find DC's. Reschedule check.
87 ****************************************************************/
89 static void msg_failed_to_go_online(struct messaging_context
*msg
,
92 struct server_id server_id
,
95 struct winbindd_domain
*domain
;
96 const char *domainname
= (const char *)data
->data
;
98 if (data
->data
== NULL
|| data
->length
== 0) {
102 DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname
));
104 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
105 if (domain
->internal
) {
109 if (strequal(domain
->name
, domainname
)) {
110 if (domain
->online
) {
111 /* We're already online, ignore. */
112 DEBUG(5,("msg_fail_to_go_online: domain %s "
113 "already online.\n", domainname
));
117 /* Reschedule the online check. */
118 set_domain_offline(domain
);
124 /****************************************************************
125 Actually cause a reconnect from a message.
126 ****************************************************************/
128 static void msg_try_to_go_online(struct messaging_context
*msg
,
131 struct server_id server_id
,
134 struct winbindd_domain
*domain
;
135 const char *domainname
= (const char *)data
->data
;
137 if (data
->data
== NULL
|| data
->length
== 0) {
141 DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname
));
143 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
144 if (domain
->internal
) {
148 if (strequal(domain
->name
, domainname
)) {
150 if (domain
->online
) {
151 /* We're already online, ignore. */
152 DEBUG(5,("msg_try_to_go_online: domain %s "
153 "already online.\n", domainname
));
157 /* This call takes care of setting the online
158 flag to true if we connected, or re-adding
159 the offline handler if false. Bypasses online
160 check so always does network calls. */
162 init_dc_connection_network(domain
);
168 /****************************************************************
169 Fork a child to try and contact a DC. Do this as contacting a
170 DC requires blocking lookups and we don't want to block our
172 ****************************************************************/
174 static bool fork_child_dc_connect(struct winbindd_domain
*domain
)
176 struct dc_name_ip
*dcs
= NULL
;
178 TALLOC_CTX
*mem_ctx
= NULL
;
179 pid_t parent_pid
= sys_getpid();
185 if (domain
->dc_probe_pid
!= (pid_t
)-1) {
187 * We might already have a DC probe
188 * child working, check.
190 if (process_exists_by_pid(domain
->dc_probe_pid
)) {
191 DEBUG(10,("fork_child_dc_connect: pid %u already "
192 "checking for DC's.\n",
193 (unsigned int)domain
->dc_probe_pid
));
196 domain
->dc_probe_pid
= (pid_t
)-1;
199 domain
->dc_probe_pid
= sys_fork();
201 if (domain
->dc_probe_pid
== (pid_t
)-1) {
202 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno
)));
206 if (domain
->dc_probe_pid
!= (pid_t
)0) {
208 messaging_register(winbind_messaging_context(), NULL
,
209 MSG_WINBIND_TRY_TO_GO_ONLINE
,
210 msg_try_to_go_online
);
211 messaging_register(winbind_messaging_context(), NULL
,
212 MSG_WINBIND_FAILED_TO_GO_ONLINE
,
213 msg_failed_to_go_online
);
219 /* Leave messages blocked - we will never process one. */
221 if (!override_logfile
) {
222 if (asprintf(&lfile
, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
223 DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
228 if (!winbindd_reinit_after_fork(lfile
)) {
229 messaging_send_buf(winbind_messaging_context(),
230 pid_to_procid(parent_pid
),
231 MSG_WINBIND_FAILED_TO_GO_ONLINE
,
232 (uint8
*)domain
->name
,
233 strlen(domain
->name
)+1);
238 mem_ctx
= talloc_init("fork_child_dc_connect");
240 DEBUG(0,("talloc_init failed.\n"));
241 messaging_send_buf(winbind_messaging_context(),
242 pid_to_procid(parent_pid
),
243 MSG_WINBIND_FAILED_TO_GO_ONLINE
,
244 (uint8
*)domain
->name
,
245 strlen(domain
->name
)+1);
249 if ((!get_dcs(mem_ctx
, domain
, &dcs
, &num_dcs
)) || (num_dcs
== 0)) {
250 /* Still offline ? Can't find DC's. */
251 messaging_send_buf(winbind_messaging_context(),
252 pid_to_procid(parent_pid
),
253 MSG_WINBIND_FAILED_TO_GO_ONLINE
,
254 (uint8
*)domain
->name
,
255 strlen(domain
->name
)+1);
259 /* We got a DC. Send a message to our parent to get it to
260 try and do the same. */
262 messaging_send_buf(winbind_messaging_context(),
263 pid_to_procid(parent_pid
),
264 MSG_WINBIND_TRY_TO_GO_ONLINE
,
265 (uint8
*)domain
->name
,
266 strlen(domain
->name
)+1);
270 /****************************************************************
271 Handler triggered if we're offline to try and detect a DC.
272 ****************************************************************/
274 static void check_domain_online_handler(struct event_context
*ctx
,
275 struct timed_event
*te
,
279 struct winbindd_domain
*domain
=
280 (struct winbindd_domain
*)private_data
;
282 DEBUG(10,("check_domain_online_handler: called for domain "
283 "%s (online = %s)\n", domain
->name
,
284 domain
->online
? "True" : "False" ));
286 TALLOC_FREE(domain
->check_online_event
);
288 /* Are we still in "startup" mode ? */
290 if (domain
->startup
&& (now
.tv_sec
> domain
->startup_time
+ 30)) {
291 /* No longer in "startup" mode. */
292 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
294 domain
->startup
= False
;
297 /* We've been told to stay offline, so stay
300 if (get_global_winbindd_state_offline()) {
301 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
306 /* Fork a child to test if it can contact a DC.
307 If it can then send ourselves a message to
308 cause a reconnect. */
310 fork_child_dc_connect(domain
);
313 /****************************************************************
314 If we're still offline setup the timeout check.
315 ****************************************************************/
317 static void calc_new_online_timeout_check(struct winbindd_domain
*domain
)
319 int wbr
= lp_winbind_reconnect_delay();
321 if (domain
->startup
) {
322 domain
->check_online_timeout
= 10;
323 } else if (domain
->check_online_timeout
< wbr
) {
324 domain
->check_online_timeout
= wbr
;
328 /****************************************************************
329 Set domain offline and also add handler to put us back online
331 ****************************************************************/
333 void set_domain_offline(struct winbindd_domain
*domain
)
335 DEBUG(10,("set_domain_offline: called for domain %s\n",
338 TALLOC_FREE(domain
->check_online_event
);
340 if (domain
->internal
) {
341 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
346 domain
->online
= False
;
348 /* Offline domains are always initialized. They're
349 re-initialized when they go back online. */
351 domain
->initialized
= True
;
353 /* We only add the timeout handler that checks and
354 allows us to go back online when we've not
355 been told to remain offline. */
357 if (get_global_winbindd_state_offline()) {
358 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
363 /* If we're in startup mode, check again in 10 seconds, not in
364 lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
366 calc_new_online_timeout_check(domain
);
368 domain
->check_online_event
= event_add_timed(winbind_event_context(),
370 timeval_current_ofs(domain
->check_online_timeout
,0),
371 check_domain_online_handler
,
374 /* The above *has* to succeed for winbindd to work. */
375 if (!domain
->check_online_event
) {
376 smb_panic("set_domain_offline: failed to add online handler");
379 DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
382 /* Send an offline message to the idmap child when our
383 primary domain goes offline */
385 if ( domain
->primary
) {
386 struct winbindd_child
*idmap
= idmap_child();
388 if ( idmap
->pid
!= 0 ) {
389 messaging_send_buf(winbind_messaging_context(),
390 pid_to_procid(idmap
->pid
),
392 (uint8
*)domain
->name
,
393 strlen(domain
->name
)+1);
400 /****************************************************************
401 Set domain online - if allowed.
402 ****************************************************************/
404 static void set_domain_online(struct winbindd_domain
*domain
)
406 DEBUG(10,("set_domain_online: called for domain %s\n",
409 if (domain
->internal
) {
410 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
415 if (get_global_winbindd_state_offline()) {
416 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
421 winbindd_set_locator_kdc_envs(domain
);
423 /* If we are waiting to get a krb5 ticket, trigger immediately. */
424 ccache_regain_all_now();
426 /* Ok, we're out of any startup mode now... */
427 domain
->startup
= False
;
429 if (domain
->online
== False
) {
430 /* We were offline - now we're online. We default to
431 using the MS-RPC backend if we started offline,
432 and if we're going online for the first time we
433 should really re-initialize the backends and the
434 checks to see if we're talking to an AD or NT domain.
437 domain
->initialized
= False
;
439 /* 'reconnect_methods' is the MS-RPC backend. */
440 if (domain
->backend
== &reconnect_methods
) {
441 domain
->backend
= NULL
;
445 /* Ensure we have no online timeout checks. */
446 domain
->check_online_timeout
= 0;
447 TALLOC_FREE(domain
->check_online_event
);
449 /* Ensure we ignore any pending child messages. */
450 messaging_deregister(winbind_messaging_context(),
451 MSG_WINBIND_TRY_TO_GO_ONLINE
, NULL
);
452 messaging_deregister(winbind_messaging_context(),
453 MSG_WINBIND_FAILED_TO_GO_ONLINE
, NULL
);
455 domain
->online
= True
;
457 /* Send an online message to the idmap child when our
458 primary domain comes online */
460 if ( domain
->primary
) {
461 struct winbindd_child
*idmap
= idmap_child();
463 if ( idmap
->pid
!= 0 ) {
464 messaging_send_buf(winbind_messaging_context(),
465 pid_to_procid(idmap
->pid
),
467 (uint8
*)domain
->name
,
468 strlen(domain
->name
)+1);
475 /****************************************************************
476 Requested to set a domain online.
477 ****************************************************************/
479 void set_domain_online_request(struct winbindd_domain
*domain
)
483 DEBUG(10,("set_domain_online_request: called for domain %s\n",
486 if (get_global_winbindd_state_offline()) {
487 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
492 if (domain
->internal
) {
493 DEBUG(10, ("set_domain_online_request: Internal domains are "
498 /* We've been told it's safe to go online and
499 try and connect to a DC. But I don't believe it
500 because network manager seems to lie.
501 Wait at least 5 seconds. Heuristics suck... */
506 /* Go into "startup" mode again. */
507 domain
->startup_time
= tev
.tv_sec
;
508 domain
->startup
= True
;
512 if (!domain
->check_online_event
) {
513 /* If we've come from being globally offline we
514 don't have a check online event handler set.
515 We need to add one now we're trying to go
518 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
522 TALLOC_FREE(domain
->check_online_event
);
524 domain
->check_online_event
= event_add_timed(winbind_event_context(),
527 check_domain_online_handler
,
530 /* The above *has* to succeed for winbindd to work. */
531 if (!domain
->check_online_event
) {
532 smb_panic("set_domain_online_request: failed to add online handler");
536 /****************************************************************
537 Add -ve connection cache entries for domain and realm.
538 ****************************************************************/
540 void winbind_add_failed_connection_entry(const struct winbindd_domain
*domain
,
544 add_failed_connection_entry(domain
->name
, server
, result
);
545 /* If this was the saf name for the last thing we talked to,
547 saf_delete(domain
->name
);
548 if (*domain
->alt_name
) {
549 add_failed_connection_entry(domain
->alt_name
, server
, result
);
550 saf_delete(domain
->alt_name
);
552 winbindd_unset_locator_kdc_env(domain
);
555 /* Choose between anonymous or authenticated connections. We need to use
556 an authenticated connection if DCs have the RestrictAnonymous registry
557 entry set > 0, or the "Additional restrictions for anonymous
558 connections" set in the win2k Local Security Policy.
560 Caller to free() result in domain, username, password
563 static void cm_get_ipc_userpass(char **username
, char **domain
, char **password
)
565 *username
= (char *)secrets_fetch(SECRETS_AUTH_USER
, NULL
);
566 *domain
= (char *)secrets_fetch(SECRETS_AUTH_DOMAIN
, NULL
);
567 *password
= (char *)secrets_fetch(SECRETS_AUTH_PASSWORD
, NULL
);
569 if (*username
&& **username
) {
571 if (!*domain
|| !**domain
)
572 *domain
= smb_xstrdup(lp_workgroup());
574 if (!*password
|| !**password
)
575 *password
= smb_xstrdup("");
577 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
578 *domain
, *username
));
581 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
582 *username
= smb_xstrdup("");
583 *domain
= smb_xstrdup("");
584 *password
= smb_xstrdup("");
588 static bool get_dc_name_via_netlogon(struct winbindd_domain
*domain
,
590 struct sockaddr_storage
*dc_ss
)
592 struct winbindd_domain
*our_domain
= NULL
;
593 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
597 unsigned int orig_timeout
;
598 const char *tmp
= NULL
;
601 /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
608 if (domain
->primary
) {
612 our_domain
= find_our_domain();
614 if ((mem_ctx
= talloc_init("get_dc_name_via_netlogon")) == NULL
) {
618 result
= cm_connect_netlogon(our_domain
, &netlogon_pipe
);
619 if (!NT_STATUS_IS_OK(result
)) {
620 talloc_destroy(mem_ctx
);
624 /* This call can take a long time - allow the server to time out.
625 35 seconds should do it. */
627 orig_timeout
= rpccli_set_timeout(netlogon_pipe
, 35000);
629 if (our_domain
->active_directory
) {
630 struct netr_DsRGetDCNameInfo
*domain_info
= NULL
;
632 result
= rpccli_netr_DsRGetDCName(netlogon_pipe
,
641 if (NT_STATUS_IS_OK(result
) && W_ERROR_IS_OK(werr
)) {
643 mem_ctx
, domain_info
->dc_unc
);
645 DEBUG(0, ("talloc_strdup failed\n"));
646 talloc_destroy(mem_ctx
);
649 if (strlen(domain
->alt_name
) == 0) {
650 fstrcpy(domain
->alt_name
,
651 domain_info
->domain_name
);
653 if (strlen(domain
->forest_name
) == 0) {
654 fstrcpy(domain
->forest_name
,
655 domain_info
->forest_name
);
659 result
= rpccli_netr_GetAnyDCName(netlogon_pipe
, mem_ctx
,
666 /* And restore our original timeout. */
667 rpccli_set_timeout(netlogon_pipe
, orig_timeout
);
669 if (!NT_STATUS_IS_OK(result
)) {
670 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
672 talloc_destroy(mem_ctx
);
676 if (!W_ERROR_IS_OK(werr
)) {
677 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
679 talloc_destroy(mem_ctx
);
683 /* rpccli_netr_GetAnyDCName gives us a name with \\ */
684 p
= strip_hostname(tmp
);
688 talloc_destroy(mem_ctx
);
690 DEBUG(10,("rpccli_netr_GetAnyDCName returned %s\n", dcname
));
692 if (!resolve_name(dcname
, dc_ss
, 0x20, true)) {
700 * Helper function to assemble trust password and account name
702 static NTSTATUS
get_trust_creds(const struct winbindd_domain
*domain
,
703 char **machine_password
,
704 char **machine_account
,
705 char **machine_krb5_principal
)
707 const char *account_name
;
708 const char *name
= NULL
;
710 /* If we are a DC and this is not our own domain */
715 struct winbindd_domain
*our_domain
= find_our_domain();
718 return NT_STATUS_INVALID_SERVER_STATE
;
720 name
= our_domain
->name
;
723 if (!get_trust_pw_clear(name
, machine_password
,
724 &account_name
, NULL
))
726 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
729 if ((machine_account
!= NULL
) &&
730 (asprintf(machine_account
, "%s$", account_name
) == -1))
732 return NT_STATUS_NO_MEMORY
;
735 /* For now assume our machine account only exists in our domain */
737 if (machine_krb5_principal
!= NULL
)
739 struct winbindd_domain
*our_domain
= find_our_domain();
742 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
745 if (asprintf(machine_krb5_principal
, "%s$@%s",
746 account_name
, our_domain
->alt_name
) == -1)
748 return NT_STATUS_NO_MEMORY
;
751 strupper_m(*machine_krb5_principal
);
757 /************************************************************************
758 Given a fd with a just-connected TCP connection to a DC, open a connection
760 ************************************************************************/
762 static NTSTATUS
cm_prepare_connection(const struct winbindd_domain
*domain
,
764 const char *controller
,
765 struct cli_state
**cli
,
768 char *machine_password
= NULL
;
769 char *machine_krb5_principal
= NULL
;
770 char *machine_account
= NULL
;
771 char *ipc_username
= NULL
;
772 char *ipc_domain
= NULL
;
773 char *ipc_password
= NULL
;
775 struct named_mutex
*mutex
;
777 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
779 struct sockaddr peeraddr
;
780 socklen_t peeraddr_len
;
782 struct sockaddr_in
*peeraddr_in
=
783 (struct sockaddr_in
*)(void *)&peeraddr
;
785 DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
786 controller
, domain
->name
));
790 mutex
= grab_named_mutex(talloc_tos(), controller
,
791 WINBIND_SERVER_MUTEX_WAIT_TIME
);
793 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
795 result
= NT_STATUS_POSSIBLE_DEADLOCK
;
799 if ((*cli
= cli_initialise()) == NULL
) {
800 DEBUG(1, ("Could not cli_initialize\n"));
801 result
= NT_STATUS_NO_MEMORY
;
805 (*cli
)->timeout
= 10000; /* 10 seconds */
807 fstrcpy((*cli
)->desthost
, controller
);
808 (*cli
)->use_kerberos
= True
;
810 peeraddr_len
= sizeof(peeraddr
);
812 if ((getpeername((*cli
)->fd
, &peeraddr
, &peeraddr_len
) != 0) ||
813 (peeraddr_len
!= sizeof(struct sockaddr_in
)) ||
814 (peeraddr_in
->sin_family
!= PF_INET
))
816 DEBUG(0,("cm_prepare_connection: %s\n", strerror(errno
)));
817 result
= NT_STATUS_UNSUCCESSFUL
;
821 if (ntohs(peeraddr_in
->sin_port
) == 139) {
822 struct nmb_name calling
;
823 struct nmb_name called
;
825 make_nmb_name(&calling
, global_myname(), 0x0);
826 make_nmb_name(&called
, "*SMBSERVER", 0x20);
828 if (!cli_session_request(*cli
, &calling
, &called
)) {
829 DEBUG(8, ("cli_session_request failed for %s\n",
831 result
= NT_STATUS_UNSUCCESSFUL
;
836 result
= cli_negprot(*cli
);
838 if (!NT_STATUS_IS_OK(result
)) {
839 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result
)));
843 if (!is_dc_trusted_domain_situation(domain
->name
) &&
844 (*cli
)->protocol
>= PROTOCOL_NT1
&&
845 (*cli
)->capabilities
& CAP_EXTENDED_SECURITY
)
847 ADS_STATUS ads_status
;
849 result
= get_trust_creds(domain
, &machine_password
,
851 &machine_krb5_principal
);
852 if (!NT_STATUS_IS_OK(result
)) {
856 if (lp_security() == SEC_ADS
) {
858 /* Try a krb5 session */
860 (*cli
)->use_kerberos
= True
;
861 DEBUG(5, ("connecting to %s from %s with kerberos principal "
862 "[%s] and realm [%s]\n", controller
, global_myname(),
863 machine_krb5_principal
, domain
->alt_name
));
865 winbindd_set_locator_kdc_envs(domain
);
867 ads_status
= cli_session_setup_spnego(*cli
,
868 machine_krb5_principal
,
873 if (!ADS_ERR_OK(ads_status
)) {
874 DEBUG(4,("failed kerberos session setup with %s\n",
875 ads_errstr(ads_status
)));
878 result
= ads_ntstatus(ads_status
);
879 if (NT_STATUS_IS_OK(result
)) {
880 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
881 result
= cli_init_creds(*cli
, machine_account
, lp_workgroup(), machine_password
);
882 if (!NT_STATUS_IS_OK(result
)) {
885 goto session_setup_done
;
889 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
890 (*cli
)->use_kerberos
= False
;
892 DEBUG(5, ("connecting to %s from %s with username "
893 "[%s]\\[%s]\n", controller
, global_myname(),
894 lp_workgroup(), machine_account
));
896 ads_status
= cli_session_setup_spnego(*cli
,
901 if (!ADS_ERR_OK(ads_status
)) {
902 DEBUG(4, ("authenticated session setup failed with %s\n",
903 ads_errstr(ads_status
)));
906 result
= ads_ntstatus(ads_status
);
907 if (NT_STATUS_IS_OK(result
)) {
908 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
909 result
= cli_init_creds(*cli
, machine_account
, lp_workgroup(), machine_password
);
910 if (!NT_STATUS_IS_OK(result
)) {
913 goto session_setup_done
;
917 /* Fall back to non-kerberos session setup with auth_user */
919 (*cli
)->use_kerberos
= False
;
921 cm_get_ipc_userpass(&ipc_username
, &ipc_domain
, &ipc_password
);
923 if ((((*cli
)->sec_mode
& NEGOTIATE_SECURITY_CHALLENGE_RESPONSE
) != 0) &&
924 (strlen(ipc_username
) > 0)) {
926 /* Only try authenticated if we have a username */
928 DEBUG(5, ("connecting to %s from %s with username "
929 "[%s]\\[%s]\n", controller
, global_myname(),
930 ipc_domain
, ipc_username
));
932 if (NT_STATUS_IS_OK(cli_session_setup(
934 ipc_password
, strlen(ipc_password
)+1,
935 ipc_password
, strlen(ipc_password
)+1,
937 /* Successful logon with given username. */
938 result
= cli_init_creds(*cli
, ipc_username
, ipc_domain
, ipc_password
);
939 if (!NT_STATUS_IS_OK(result
)) {
942 goto session_setup_done
;
944 DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
945 ipc_domain
, ipc_username
));
951 /* Fall back to anonymous connection, this might fail later */
952 DEBUG(10,("cm_prepare_connection: falling back to anonymous "
953 "connection for DC %s\n",
956 if (NT_STATUS_IS_OK(cli_session_setup(*cli
, "", NULL
, 0,
958 DEBUG(5, ("Connected anonymously\n"));
959 result
= cli_init_creds(*cli
, "", "", "");
960 if (!NT_STATUS_IS_OK(result
)) {
963 goto session_setup_done
;
966 result
= cli_nt_error(*cli
);
968 if (NT_STATUS_IS_OK(result
))
969 result
= NT_STATUS_UNSUCCESSFUL
;
971 /* We can't session setup */
977 /* cache the server name for later connections */
979 saf_store( domain
->name
, (*cli
)->desthost
);
980 if (domain
->alt_name
&& (*cli
)->use_kerberos
) {
981 saf_store( domain
->alt_name
, (*cli
)->desthost
);
984 winbindd_set_locator_kdc_envs(domain
);
986 result
= cli_tcon_andx(*cli
, "IPC$", "IPC", "", 0);
988 if (!NT_STATUS_IS_OK(result
)) {
989 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result
)));
996 /* set the domain if empty; needed for schannel connections */
997 if ( !(*cli
)->domain
[0] ) {
998 result
= cli_set_domain((*cli
), domain
->name
);
999 if (!NT_STATUS_IS_OK(result
)) {
1004 result
= NT_STATUS_OK
;
1008 SAFE_FREE(machine_account
);
1009 SAFE_FREE(machine_password
);
1010 SAFE_FREE(machine_krb5_principal
);
1011 SAFE_FREE(ipc_username
);
1012 SAFE_FREE(ipc_domain
);
1013 SAFE_FREE(ipc_password
);
1015 if (!NT_STATUS_IS_OK(result
)) {
1016 winbind_add_failed_connection_entry(domain
, controller
, result
);
1017 if ((*cli
) != NULL
) {
1026 /*******************************************************************
1027 Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1030 Keeps the list unique by not adding duplicate entries.
1032 @param[in] mem_ctx talloc memory context to allocate from
1033 @param[in] domain_name domain of the DC
1034 @param[in] dcname name of the DC to add to the list
1035 @param[in] pss Internet address and port pair to add to the list
1036 @param[in,out] dcs array of dc_name_ip structures to add to
1037 @param[in,out] num_dcs number of dcs returned in the dcs array
1038 @return true if the list was added to, false otherwise
1039 *******************************************************************/
1041 static bool add_one_dc_unique(TALLOC_CTX
*mem_ctx
, const char *domain_name
,
1042 const char *dcname
, struct sockaddr_storage
*pss
,
1043 struct dc_name_ip
**dcs
, int *num
)
1047 if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name
, dcname
))) {
1048 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname
));
1052 /* Make sure there's no duplicates in the list */
1053 for (i
=0; i
<*num
; i
++)
1055 (struct sockaddr
*)(void *)&(*dcs
)[i
].ss
,
1056 (struct sockaddr
*)(void *)pss
))
1059 *dcs
= TALLOC_REALLOC_ARRAY(mem_ctx
, *dcs
, struct dc_name_ip
, (*num
)+1);
1064 fstrcpy((*dcs
)[*num
].name
, dcname
);
1065 (*dcs
)[*num
].ss
= *pss
;
1070 static bool add_sockaddr_to_array(TALLOC_CTX
*mem_ctx
,
1071 struct sockaddr_storage
*pss
, uint16 port
,
1072 struct sockaddr_storage
**addrs
, int *num
)
1074 *addrs
= TALLOC_REALLOC_ARRAY(mem_ctx
, *addrs
, struct sockaddr_storage
, (*num
)+1);
1076 if (*addrs
== NULL
) {
1081 (*addrs
)[*num
] = *pss
;
1082 set_sockaddr_port((struct sockaddr
*)&(*addrs
)[*num
], port
);
1088 /*******************************************************************
1089 convert an ip to a name
1090 *******************************************************************/
1092 static bool dcip_to_name(TALLOC_CTX
*mem_ctx
,
1093 const struct winbindd_domain
*domain
,
1094 struct sockaddr_storage
*pss
,
1097 struct ip_service ip_list
;
1098 uint32_t nt_version
= NETLOGON_NT_VERSION_1
;
1104 /* For active directory servers, try to get the ldap server name.
1105 None of these failures should be considered critical for now */
1107 if (lp_security() == SEC_ADS
) {
1109 ADS_STATUS ads_status
;
1110 char addr
[INET6_ADDRSTRLEN
];
1112 print_sockaddr(addr
, sizeof(addr
), pss
);
1114 ads
= ads_init(domain
->alt_name
, domain
->name
, addr
);
1115 ads
->auth
.flags
|= ADS_AUTH_NO_BIND
;
1117 ads_status
= ads_connect(ads
);
1118 if (ADS_ERR_OK(ads_status
)) {
1119 /* We got a cldap packet. */
1120 fstrcpy(name
, ads
->config
.ldap_server_name
);
1121 namecache_store(name
, 0x20, 1, &ip_list
);
1123 DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads
->config
.flags
));
1125 if (domain
->primary
&& (ads
->config
.flags
& NBT_SERVER_KDC
)) {
1126 if (ads_closest_dc(ads
)) {
1127 char *sitename
= sitename_fetch(ads
->config
.realm
);
1129 /* We're going to use this KDC for this realm/domain.
1130 If we are using sites, then force the krb5 libs
1133 create_local_private_krb5_conf_for_domain(domain
->alt_name
,
1138 SAFE_FREE(sitename
);
1140 /* use an off site KDC */
1141 create_local_private_krb5_conf_for_domain(domain
->alt_name
,
1146 winbindd_set_locator_kdc_envs(domain
);
1148 /* Ensure we contact this DC also. */
1149 saf_store( domain
->name
, name
);
1150 saf_store( domain
->alt_name
, name
);
1153 ads_destroy( &ads
);
1157 ads_destroy( &ads
);
1161 /* try GETDC requests next */
1163 if (send_getdc_request(mem_ctx
, winbind_messaging_context(),
1164 pss
, domain
->name
, &domain
->sid
,
1166 const char *dc_name
= NULL
;
1169 for (i
=0; i
<5; i
++) {
1170 if (receive_getdc_response(mem_ctx
, pss
, domain
->name
,
1173 fstrcpy(name
, dc_name
);
1174 namecache_store(name
, 0x20, 1, &ip_list
);
1181 /* try node status request */
1183 if ( name_status_find(domain
->name
, 0x1c, 0x20, pss
, name
) ) {
1184 namecache_store(name
, 0x20, 1, &ip_list
);
1190 /*******************************************************************
1191 Retrieve a list of IP addresses for domain controllers.
1193 The array is sorted in the preferred connection order.
1195 @param[in] mem_ctx talloc memory context to allocate from
1196 @param[in] domain domain to retrieve DCs for
1197 @param[out] dcs array of dcs that will be returned
1198 @param[out] num_dcs number of dcs returned in the dcs array
1200 *******************************************************************/
1202 static bool get_dcs(TALLOC_CTX
*mem_ctx
, struct winbindd_domain
*domain
,
1203 struct dc_name_ip
**dcs
, int *num_dcs
)
1206 struct sockaddr_storage ss
;
1207 struct ip_service
*ip_list
= NULL
;
1208 int iplist_size
= 0;
1211 enum security_types sec
= (enum security_types
)lp_security();
1213 is_our_domain
= strequal(domain
->name
, lp_workgroup());
1215 /* If not our domain, get the preferred DC, by asking our primary DC */
1217 && get_dc_name_via_netlogon(domain
, dcname
, &ss
)
1218 && add_one_dc_unique(mem_ctx
, domain
->name
, dcname
, &ss
, dcs
,
1221 char addr
[INET6_ADDRSTRLEN
];
1222 print_sockaddr(addr
, sizeof(addr
), &ss
);
1223 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1228 if (sec
== SEC_ADS
) {
1229 char *sitename
= NULL
;
1231 /* We need to make sure we know the local site before
1232 doing any DNS queries, as this will restrict the
1233 get_sorted_dc_list() call below to only fetching
1234 DNS records for the correct site. */
1236 /* Find any DC to get the site record.
1237 We deliberately don't care about the
1240 get_dc_name(domain
->name
, domain
->alt_name
, dcname
, &ss
);
1242 sitename
= sitename_fetch(domain
->alt_name
);
1245 /* Do the site-specific AD dns lookup first. */
1246 get_sorted_dc_list(domain
->alt_name
, sitename
, &ip_list
,
1247 &iplist_size
, True
);
1249 /* Add ips to the DC array. We don't look up the name
1250 of the DC in this function, but we fill in the char*
1251 of the ip now to make the failed connection cache
1253 for ( i
=0; i
<iplist_size
; i
++ ) {
1254 char addr
[INET6_ADDRSTRLEN
];
1255 print_sockaddr(addr
, sizeof(addr
),
1257 add_one_dc_unique(mem_ctx
,
1266 SAFE_FREE(sitename
);
1270 /* Now we add DCs from the main AD DNS lookup. */
1271 get_sorted_dc_list(domain
->alt_name
, NULL
, &ip_list
,
1272 &iplist_size
, True
);
1274 for ( i
=0; i
<iplist_size
; i
++ ) {
1275 char addr
[INET6_ADDRSTRLEN
];
1276 print_sockaddr(addr
, sizeof(addr
),
1278 add_one_dc_unique(mem_ctx
,
1290 /* Try standard netbios queries if no ADS */
1291 if (*num_dcs
== 0) {
1292 get_sorted_dc_list(domain
->name
, NULL
, &ip_list
, &iplist_size
,
1295 for ( i
=0; i
<iplist_size
; i
++ ) {
1296 char addr
[INET6_ADDRSTRLEN
];
1297 print_sockaddr(addr
, sizeof(addr
),
1299 add_one_dc_unique(mem_ctx
,
1314 /*******************************************************************
1315 Find and make a connection to a DC in the given domain.
1317 @param[in] mem_ctx talloc memory context to allocate from
1318 @param[in] domain domain to find a dc in
1319 @param[out] dcname NetBIOS or FQDN of DC that's connected to
1320 @param[out] pss DC Internet address and port
1321 @param[out] fd fd of the open socket connected to the newly found dc
1322 @return true when a DC connection is made, false otherwise
1323 *******************************************************************/
1325 static bool find_new_dc(TALLOC_CTX
*mem_ctx
,
1326 struct winbindd_domain
*domain
,
1327 fstring dcname
, struct sockaddr_storage
*pss
, int *fd
)
1329 struct dc_name_ip
*dcs
= NULL
;
1332 const char **dcnames
= NULL
;
1333 int num_dcnames
= 0;
1335 struct sockaddr_storage
*addrs
= NULL
;
1343 if (!get_dcs(mem_ctx
, domain
, &dcs
, &num_dcs
) || (num_dcs
== 0))
1346 for (i
=0; i
<num_dcs
; i
++) {
1348 if (!add_string_to_array(mem_ctx
, dcs
[i
].name
,
1349 &dcnames
, &num_dcnames
)) {
1352 if (!add_sockaddr_to_array(mem_ctx
, &dcs
[i
].ss
, 445,
1353 &addrs
, &num_addrs
)) {
1357 if (!add_string_to_array(mem_ctx
, dcs
[i
].name
,
1358 &dcnames
, &num_dcnames
)) {
1361 if (!add_sockaddr_to_array(mem_ctx
, &dcs
[i
].ss
, 139,
1362 &addrs
, &num_addrs
)) {
1367 if ((num_dcnames
== 0) || (num_dcnames
!= num_addrs
))
1370 if ((addrs
== NULL
) || (dcnames
== NULL
))
1373 /* 5 second timeout. */
1374 if (!open_any_socket_out(addrs
, num_addrs
, 5000, &fd_index
, fd
) ) {
1375 for (i
=0; i
<num_dcs
; i
++) {
1376 char ab
[INET6_ADDRSTRLEN
];
1377 print_sockaddr(ab
, sizeof(ab
), &dcs
[i
].ss
);
1378 DEBUG(10, ("find_new_dc: open_any_socket_out failed for "
1379 "domain %s address %s. Error was %s\n",
1380 domain
->name
, ab
, strerror(errno
) ));
1381 winbind_add_failed_connection_entry(domain
,
1382 dcs
[i
].name
, NT_STATUS_UNSUCCESSFUL
);
1387 *pss
= addrs
[fd_index
];
1389 if (*dcnames
[fd_index
] != '\0' && !is_ipaddress(dcnames
[fd_index
])) {
1390 /* Ok, we've got a name for the DC */
1391 fstrcpy(dcname
, dcnames
[fd_index
]);
1395 /* Try to figure out the name */
1396 if (dcip_to_name(mem_ctx
, domain
, pss
, dcname
)) {
1400 /* We can not continue without the DC's name */
1401 winbind_add_failed_connection_entry(domain
, dcs
[fd_index
].name
,
1402 NT_STATUS_UNSUCCESSFUL
);
1404 /* Throw away all arrays as we're doing this again. */
1408 TALLOC_FREE(dcnames
);
1420 static NTSTATUS
cm_open_connection(struct winbindd_domain
*domain
,
1421 struct winbindd_cm_conn
*new_conn
)
1423 TALLOC_CTX
*mem_ctx
;
1425 char *saf_servername
= saf_fetch( domain
->name
);
1428 if ((mem_ctx
= talloc_init("cm_open_connection")) == NULL
) {
1429 SAFE_FREE(saf_servername
);
1430 set_domain_offline(domain
);
1431 return NT_STATUS_NO_MEMORY
;
1434 /* we have to check the server affinity cache here since
1435 later we selecte a DC based on response time and not preference */
1437 /* Check the negative connection cache
1438 before talking to it. It going down may have
1439 triggered the reconnection. */
1441 if ( saf_servername
&& NT_STATUS_IS_OK(check_negative_conn_cache( domain
->name
, saf_servername
))) {
1443 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1444 saf_servername
, domain
->name
));
1446 /* convert an ip address to a name */
1447 if (is_ipaddress( saf_servername
) ) {
1449 struct sockaddr_storage ss
;
1451 if (!interpret_string_addr(&ss
, saf_servername
,
1453 return NT_STATUS_UNSUCCESSFUL
;
1455 if (dcip_to_name(mem_ctx
, domain
, &ss
, saf_name
)) {
1456 fstrcpy( domain
->dcname
, saf_name
);
1458 winbind_add_failed_connection_entry(
1459 domain
, saf_servername
,
1460 NT_STATUS_UNSUCCESSFUL
);
1463 fstrcpy( domain
->dcname
, saf_servername
);
1466 SAFE_FREE( saf_servername
);
1469 for (retries
= 0; retries
< 3; retries
++) {
1473 result
= NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1475 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1476 domain
->dcname
, domain
->name
));
1479 && NT_STATUS_IS_OK(check_negative_conn_cache( domain
->name
, domain
->dcname
))
1480 && (resolve_name(domain
->dcname
, &domain
->dcaddr
, 0x20, true)))
1482 struct sockaddr_storage
*addrs
= NULL
;
1486 if (!add_sockaddr_to_array(mem_ctx
, &domain
->dcaddr
, 445, &addrs
, &num_addrs
)) {
1487 set_domain_offline(domain
);
1488 talloc_destroy(mem_ctx
);
1489 return NT_STATUS_NO_MEMORY
;
1491 if (!add_sockaddr_to_array(mem_ctx
, &domain
->dcaddr
, 139, &addrs
, &num_addrs
)) {
1492 set_domain_offline(domain
);
1493 talloc_destroy(mem_ctx
);
1494 return NT_STATUS_NO_MEMORY
;
1497 /* 5 second timeout. */
1498 if (!open_any_socket_out(addrs
, num_addrs
, 5000, &dummy
, &fd
)) {
1504 && !find_new_dc(mem_ctx
, domain
, domain
->dcname
, &domain
->dcaddr
, &fd
))
1506 /* This is the one place where we will
1507 set the global winbindd offline state
1508 to true, if a "WINBINDD_OFFLINE" entry
1509 is found in the winbindd cache. */
1510 set_global_winbindd_state_offline();
1514 new_conn
->cli
= NULL
;
1516 result
= cm_prepare_connection(domain
, fd
, domain
->dcname
,
1517 &new_conn
->cli
, &retry
);
1523 if (NT_STATUS_IS_OK(result
)) {
1525 winbindd_set_locator_kdc_envs(domain
);
1527 if (domain
->online
== False
) {
1528 /* We're changing state from offline to online. */
1529 set_global_winbindd_state_online();
1531 set_domain_online(domain
);
1533 /* Ensure we setup the retry handler. */
1534 set_domain_offline(domain
);
1537 talloc_destroy(mem_ctx
);
1541 /* Close down all open pipes on a connection. */
1543 void invalidate_cm_connection(struct winbindd_cm_conn
*conn
)
1545 /* We're closing down a possibly dead
1546 connection. Don't have impossibly long (10s) timeouts. */
1549 cli_set_timeout(conn
->cli
, 1000); /* 1 second. */
1552 if (conn
->samr_pipe
!= NULL
) {
1553 TALLOC_FREE(conn
->samr_pipe
);
1554 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1556 cli_set_timeout(conn
->cli
, 500);
1560 if (conn
->lsa_pipe
!= NULL
) {
1561 TALLOC_FREE(conn
->lsa_pipe
);
1562 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1564 cli_set_timeout(conn
->cli
, 500);
1568 if (conn
->lsa_pipe_tcp
!= NULL
) {
1569 TALLOC_FREE(conn
->lsa_pipe_tcp
);
1570 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1572 cli_set_timeout(conn
->cli
, 500);
1576 if (conn
->netlogon_pipe
!= NULL
) {
1577 TALLOC_FREE(conn
->netlogon_pipe
);
1578 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1580 cli_set_timeout(conn
->cli
, 500);
1585 cli_shutdown(conn
->cli
);
1591 void close_conns_after_fork(void)
1593 struct winbindd_domain
*domain
;
1595 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1596 if (domain
->conn
.cli
== NULL
)
1599 if (domain
->conn
.cli
->fd
== -1)
1602 close(domain
->conn
.cli
->fd
);
1603 domain
->conn
.cli
->fd
= -1;
1607 static bool connection_ok(struct winbindd_domain
*domain
)
1609 if (domain
->conn
.cli
== NULL
) {
1610 DEBUG(8, ("connection_ok: Connection to %s for domain %s has NULL "
1611 "cli!\n", domain
->dcname
, domain
->name
));
1615 if (!domain
->conn
.cli
->initialised
) {
1616 DEBUG(3, ("connection_ok: Connection to %s for domain %s was never "
1617 "initialised!\n", domain
->dcname
, domain
->name
));
1621 if (domain
->conn
.cli
->fd
== -1) {
1622 DEBUG(3, ("connection_ok: Connection to %s for domain %s has died or was "
1623 "never started (fd == -1)\n",
1624 domain
->dcname
, domain
->name
));
1628 if (domain
->online
== False
) {
1629 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain
->name
));
1636 /* Initialize a new connection up to the RPC BIND.
1637 Bypass online status check so always does network calls. */
1639 static NTSTATUS
init_dc_connection_network(struct winbindd_domain
*domain
)
1643 /* Internal connections never use the network. */
1644 if (domain
->internal
) {
1645 domain
->initialized
= True
;
1646 return NT_STATUS_OK
;
1649 if (connection_ok(domain
)) {
1650 if (!domain
->initialized
) {
1651 set_dc_type_and_flags(domain
);
1653 return NT_STATUS_OK
;
1656 invalidate_cm_connection(&domain
->conn
);
1658 result
= cm_open_connection(domain
, &domain
->conn
);
1660 if (NT_STATUS_IS_OK(result
) && !domain
->initialized
) {
1661 set_dc_type_and_flags(domain
);
1667 NTSTATUS
init_dc_connection(struct winbindd_domain
*domain
)
1669 if (domain
->initialized
&& !domain
->online
) {
1670 /* We check for online status elsewhere. */
1671 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1674 return init_dc_connection_network(domain
);
1677 /******************************************************************************
1678 Set the trust flags (direction and forest location) for a domain
1679 ******************************************************************************/
1681 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain
*domain
)
1683 struct winbindd_domain
*our_domain
;
1684 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1685 struct netr_DomainTrustList trusts
;
1687 uint32 flags
= (NETR_TRUST_FLAG_IN_FOREST
|
1688 NETR_TRUST_FLAG_OUTBOUND
|
1689 NETR_TRUST_FLAG_INBOUND
);
1690 struct rpc_pipe_client
*cli
;
1691 TALLOC_CTX
*mem_ctx
= NULL
;
1693 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain
->name
));
1695 /* Our primary domain doesn't need to worry about trust flags.
1696 Force it to go through the network setup */
1697 if ( domain
->primary
) {
1701 our_domain
= find_our_domain();
1703 if ( !connection_ok(our_domain
) ) {
1704 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1708 /* This won't work unless our domain is AD */
1710 if ( !our_domain
->active_directory
) {
1714 /* Use DsEnumerateDomainTrusts to get us the trust direction
1717 result
= cm_connect_netlogon(our_domain
, &cli
);
1719 if (!NT_STATUS_IS_OK(result
)) {
1720 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1721 "a connection to %s for PIPE_NETLOGON (%s)\n",
1722 domain
->name
, nt_errstr(result
)));
1726 if ( (mem_ctx
= talloc_init("set_dc_type_and_flags_trustinfo")) == NULL
) {
1727 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1731 result
= rpccli_netr_DsrEnumerateDomainTrusts(cli
, mem_ctx
,
1736 if (!NT_STATUS_IS_OK(result
)) {
1737 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1738 "failed to query trusted domain list: %s\n",
1739 nt_errstr(result
)));
1740 talloc_destroy(mem_ctx
);
1744 /* Now find the domain name and get the flags */
1746 for ( i
=0; i
<trusts
.count
; i
++ ) {
1747 if ( strequal( domain
->name
, trusts
.array
[i
].netbios_name
) ) {
1748 domain
->domain_flags
= trusts
.array
[i
].trust_flags
;
1749 domain
->domain_type
= trusts
.array
[i
].trust_type
;
1750 domain
->domain_trust_attribs
= trusts
.array
[i
].trust_attributes
;
1752 if ( domain
->domain_type
== NETR_TRUST_TYPE_UPLEVEL
)
1753 domain
->active_directory
= True
;
1755 /* This flag is only set if the domain is *our*
1756 primary domain and the primary domain is in
1759 domain
->native_mode
= (domain
->domain_flags
& NETR_TRUST_FLAG_NATIVE
);
1761 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1762 "native mode.\n", domain
->name
,
1763 domain
->native_mode
? "" : "NOT "));
1765 DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1766 "running active directory.\n", domain
->name
,
1767 domain
->active_directory
? "" : "NOT "));
1770 domain
->initialized
= True
;
1772 if ( !winbindd_can_contact_domain( domain
) )
1773 domain
->internal
= True
;
1779 talloc_destroy( mem_ctx
);
1781 return domain
->initialized
;
1784 /******************************************************************************
1785 We can 'sense' certain things about the DC by it's replies to certain
1788 This tells us if this particular remote server is Active Directory, and if it
1790 ******************************************************************************/
1792 static void set_dc_type_and_flags_connect( struct winbindd_domain
*domain
)
1796 TALLOC_CTX
*mem_ctx
= NULL
;
1797 struct rpc_pipe_client
*cli
= NULL
;
1798 struct policy_handle pol
;
1799 union dssetup_DsRoleInfo info
;
1800 union lsa_PolicyInformation
*lsa_info
= NULL
;
1802 if (!connection_ok(domain
)) {
1806 mem_ctx
= talloc_init("set_dc_type_and_flags on domain %s\n",
1809 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1813 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain
->name
));
1815 result
= cli_rpc_pipe_open_noauth(domain
->conn
.cli
,
1816 &ndr_table_dssetup
.syntax_id
,
1819 if (!NT_STATUS_IS_OK(result
)) {
1820 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1821 "PI_DSSETUP on domain %s: (%s)\n",
1822 domain
->name
, nt_errstr(result
)));
1824 /* if this is just a non-AD domain we need to continue
1825 * identifying so that we can in the end return with
1826 * domain->initialized = True - gd */
1831 result
= rpccli_dssetup_DsRoleGetPrimaryDomainInformation(cli
, mem_ctx
,
1832 DS_ROLE_BASIC_INFORMATION
,
1837 if (!NT_STATUS_IS_OK(result
)) {
1838 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1839 "on domain %s failed: (%s)\n",
1840 domain
->name
, nt_errstr(result
)));
1842 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1843 * every opcode on the DSSETUP pipe, continue with
1844 * no_dssetup mode here as well to get domain->initialized
1847 if (NT_STATUS_V(result
) == DCERPC_FAULT_OP_RNG_ERROR
) {
1851 TALLOC_FREE(mem_ctx
);
1855 if ((info
.basic
.flags
& DS_ROLE_PRIMARY_DS_RUNNING
) &&
1856 !(info
.basic
.flags
& DS_ROLE_PRIMARY_DS_MIXED_MODE
)) {
1857 domain
->native_mode
= True
;
1859 domain
->native_mode
= False
;
1863 result
= cli_rpc_pipe_open_noauth(domain
->conn
.cli
,
1864 &ndr_table_lsarpc
.syntax_id
, &cli
);
1866 if (!NT_STATUS_IS_OK(result
)) {
1867 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1868 "PI_LSARPC on domain %s: (%s)\n",
1869 domain
->name
, nt_errstr(result
)));
1871 TALLOC_FREE(mem_ctx
);
1875 result
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
1876 SEC_FLAG_MAXIMUM_ALLOWED
, &pol
);
1878 if (NT_STATUS_IS_OK(result
)) {
1879 /* This particular query is exactly what Win2k clients use
1880 to determine that the DC is active directory */
1881 result
= rpccli_lsa_QueryInfoPolicy2(cli
, mem_ctx
,
1883 LSA_POLICY_INFO_DNS
,
1887 if (NT_STATUS_IS_OK(result
)) {
1888 domain
->active_directory
= True
;
1890 if (lsa_info
->dns
.name
.string
) {
1891 fstrcpy(domain
->name
, lsa_info
->dns
.name
.string
);
1894 if (lsa_info
->dns
.dns_domain
.string
) {
1895 fstrcpy(domain
->alt_name
,
1896 lsa_info
->dns
.dns_domain
.string
);
1899 /* See if we can set some domain trust flags about
1902 if (lsa_info
->dns
.dns_forest
.string
) {
1903 fstrcpy(domain
->forest_name
,
1904 lsa_info
->dns
.dns_forest
.string
);
1906 if (strequal(domain
->forest_name
, domain
->alt_name
)) {
1907 domain
->domain_flags
|= NETR_TRUST_FLAG_TREEROOT
;
1911 if (lsa_info
->dns
.sid
) {
1912 sid_copy(&domain
->sid
, lsa_info
->dns
.sid
);
1915 domain
->active_directory
= False
;
1917 result
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
1918 SEC_FLAG_MAXIMUM_ALLOWED
,
1921 if (!NT_STATUS_IS_OK(result
)) {
1925 result
= rpccli_lsa_QueryInfoPolicy(cli
, mem_ctx
,
1927 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
1930 if (NT_STATUS_IS_OK(result
)) {
1932 if (lsa_info
->account_domain
.name
.string
) {
1933 fstrcpy(domain
->name
,
1934 lsa_info
->account_domain
.name
.string
);
1937 if (lsa_info
->account_domain
.sid
) {
1938 sid_copy(&domain
->sid
, lsa_info
->account_domain
.sid
);
1944 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
1945 domain
->name
, domain
->native_mode
? "" : "NOT "));
1947 DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
1948 domain
->name
, domain
->active_directory
? "" : "NOT "));
1950 domain
->can_do_ncacn_ip_tcp
= domain
->active_directory
;
1954 TALLOC_FREE(mem_ctx
);
1956 domain
->initialized
= True
;
1959 /**********************************************************************
1960 Set the domain_flags (trust attributes, domain operating modes, etc...
1961 ***********************************************************************/
1963 static void set_dc_type_and_flags( struct winbindd_domain
*domain
)
1965 /* we always have to contact our primary domain */
1967 if ( domain
->primary
) {
1968 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
1969 "primary domain\n"));
1970 set_dc_type_and_flags_connect( domain
);
1974 /* Use our DC to get the information if possible */
1976 if ( !set_dc_type_and_flags_trustinfo( domain
) ) {
1977 /* Otherwise, fallback to contacting the
1979 set_dc_type_and_flags_connect( domain
);
1987 /**********************************************************************
1988 ***********************************************************************/
1990 static bool cm_get_schannel_creds(struct winbindd_domain
*domain
,
1991 struct netlogon_creds_CredentialState
**ppdc
)
1994 struct rpc_pipe_client
*netlogon_pipe
;
1996 if (lp_client_schannel() == False
) {
2000 result
= cm_connect_netlogon(domain
, &netlogon_pipe
);
2001 if (!NT_STATUS_IS_OK(result
)) {
2005 /* Return a pointer to the struct netlogon_creds_CredentialState from the
2008 if (!domain
->conn
.netlogon_pipe
->dc
) {
2012 *ppdc
= domain
->conn
.netlogon_pipe
->dc
;
2016 NTSTATUS
cm_connect_sam(struct winbindd_domain
*domain
, TALLOC_CTX
*mem_ctx
,
2017 struct rpc_pipe_client
**cli
, struct policy_handle
*sam_handle
)
2019 struct winbindd_cm_conn
*conn
;
2020 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
2021 struct netlogon_creds_CredentialState
*p_creds
;
2022 char *machine_password
= NULL
;
2023 char *machine_account
= NULL
;
2024 char *domain_name
= NULL
;
2026 result
= init_dc_connection(domain
);
2027 if (!NT_STATUS_IS_OK(result
)) {
2031 conn
= &domain
->conn
;
2033 if (conn
->samr_pipe
!= NULL
) {
2039 * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2040 * sign and sealed pipe using the machine account password by
2041 * preference. If we can't - try schannel, if that fails, try
2045 if ((conn
->cli
->user_name
[0] == '\0') ||
2046 (conn
->cli
->domain
[0] == '\0') ||
2047 (conn
->cli
->password
== NULL
|| conn
->cli
->password
[0] == '\0'))
2049 result
= get_trust_creds(domain
, &machine_password
,
2050 &machine_account
, NULL
);
2051 if (!NT_STATUS_IS_OK(result
)) {
2052 DEBUG(10, ("cm_connect_sam: No no user available for "
2053 "domain %s, trying schannel\n", conn
->cli
->domain
));
2056 domain_name
= domain
->name
;
2058 machine_password
= SMB_STRDUP(conn
->cli
->password
);
2059 machine_account
= SMB_STRDUP(conn
->cli
->user_name
);
2060 domain_name
= conn
->cli
->domain
;
2063 if (!machine_password
|| !machine_account
) {
2064 result
= NT_STATUS_NO_MEMORY
;
2068 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2069 authenticated SAMR pipe with sign & seal. */
2070 result
= cli_rpc_pipe_open_spnego_ntlmssp(conn
->cli
,
2071 &ndr_table_samr
.syntax_id
,
2073 DCERPC_AUTH_LEVEL_PRIVACY
,
2079 if (!NT_STATUS_IS_OK(result
)) {
2080 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2081 "pipe for domain %s using NTLMSSP "
2082 "authenticated pipe: user %s\\%s. Error was "
2083 "%s\n", domain
->name
, domain_name
,
2084 machine_account
, nt_errstr(result
)));
2088 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2089 "domain %s using NTLMSSP authenticated "
2090 "pipe: user %s\\%s\n", domain
->name
,
2091 domain_name
, machine_account
));
2093 result
= rpccli_samr_Connect2(conn
->samr_pipe
, mem_ctx
,
2094 conn
->samr_pipe
->desthost
,
2095 SEC_FLAG_MAXIMUM_ALLOWED
,
2096 &conn
->sam_connect_handle
);
2097 if (NT_STATUS_IS_OK(result
)) {
2100 DEBUG(10,("cm_connect_sam: ntlmssp-sealed rpccli_samr_Connect2 "
2101 "failed for domain %s, error was %s. Trying schannel\n",
2102 domain
->name
, nt_errstr(result
) ));
2103 TALLOC_FREE(conn
->samr_pipe
);
2107 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2109 if (!cm_get_schannel_creds(domain
, &p_creds
)) {
2110 /* If this call fails - conn->cli can now be NULL ! */
2111 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2112 "for domain %s, trying anon\n", domain
->name
));
2115 result
= cli_rpc_pipe_open_schannel_with_key
2116 (conn
->cli
, &ndr_table_samr
.syntax_id
, NCACN_NP
,
2117 DCERPC_AUTH_LEVEL_PRIVACY
,
2118 domain
->name
, &p_creds
, &conn
->samr_pipe
);
2120 if (!NT_STATUS_IS_OK(result
)) {
2121 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2122 "domain %s using schannel. Error was %s\n",
2123 domain
->name
, nt_errstr(result
) ));
2126 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2127 "schannel.\n", domain
->name
));
2129 result
= rpccli_samr_Connect2(conn
->samr_pipe
, mem_ctx
,
2130 conn
->samr_pipe
->desthost
,
2131 SEC_FLAG_MAXIMUM_ALLOWED
,
2132 &conn
->sam_connect_handle
);
2133 if (NT_STATUS_IS_OK(result
)) {
2136 DEBUG(10,("cm_connect_sam: schannel-sealed rpccli_samr_Connect2 failed "
2137 "for domain %s, error was %s. Trying anonymous\n",
2138 domain
->name
, nt_errstr(result
) ));
2139 TALLOC_FREE(conn
->samr_pipe
);
2143 /* Finally fall back to anonymous. */
2144 result
= cli_rpc_pipe_open_noauth(conn
->cli
, &ndr_table_samr
.syntax_id
,
2147 if (!NT_STATUS_IS_OK(result
)) {
2151 result
= rpccli_samr_Connect2(conn
->samr_pipe
, mem_ctx
,
2152 conn
->samr_pipe
->desthost
,
2153 SEC_FLAG_MAXIMUM_ALLOWED
,
2154 &conn
->sam_connect_handle
);
2155 if (!NT_STATUS_IS_OK(result
)) {
2156 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2157 "for domain %s Error was %s\n",
2158 domain
->name
, nt_errstr(result
) ));
2163 result
= rpccli_samr_OpenDomain(conn
->samr_pipe
,
2165 &conn
->sam_connect_handle
,
2166 SEC_FLAG_MAXIMUM_ALLOWED
,
2168 &conn
->sam_domain_handle
);
2172 if (NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
)) {
2174 * if we got access denied, we might just have no access rights
2175 * to talk to the remote samr server server (e.g. when we are a
2176 * PDC and we are connecting a w2k8 pdc via an interdomain
2177 * trust). In that case do not invalidate the whole connection
2180 TALLOC_FREE(conn
->samr_pipe
);
2181 ZERO_STRUCT(conn
->sam_domain_handle
);
2183 } else if (!NT_STATUS_IS_OK(result
)) {
2184 invalidate_cm_connection(conn
);
2188 *cli
= conn
->samr_pipe
;
2189 *sam_handle
= conn
->sam_domain_handle
;
2190 SAFE_FREE(machine_password
);
2191 SAFE_FREE(machine_account
);
2195 /**********************************************************************
2196 open an schanneld ncacn_ip_tcp connection to LSA
2197 ***********************************************************************/
2199 NTSTATUS
cm_connect_lsa_tcp(struct winbindd_domain
*domain
,
2200 TALLOC_CTX
*mem_ctx
,
2201 struct rpc_pipe_client
**cli
)
2203 struct winbindd_cm_conn
*conn
;
2206 DEBUG(10,("cm_connect_lsa_tcp\n"));
2208 status
= init_dc_connection(domain
);
2209 if (!NT_STATUS_IS_OK(status
)) {
2213 conn
= &domain
->conn
;
2215 if (conn
->lsa_pipe_tcp
&&
2216 conn
->lsa_pipe_tcp
->transport
->transport
== NCACN_IP_TCP
&&
2217 conn
->lsa_pipe_tcp
->auth
->auth_level
== DCERPC_AUTH_LEVEL_PRIVACY
) {
2221 TALLOC_FREE(conn
->lsa_pipe_tcp
);
2223 status
= cli_rpc_pipe_open_schannel(conn
->cli
,
2224 &ndr_table_lsarpc
.syntax_id
,
2226 DCERPC_AUTH_LEVEL_PRIVACY
,
2228 &conn
->lsa_pipe_tcp
);
2229 if (!NT_STATUS_IS_OK(status
)) {
2230 DEBUG(10,("cli_rpc_pipe_open_schannel failed: %s\n",
2231 nt_errstr(status
)));
2236 if (!NT_STATUS_IS_OK(status
)) {
2237 TALLOC_FREE(conn
->lsa_pipe_tcp
);
2241 *cli
= conn
->lsa_pipe_tcp
;
2246 NTSTATUS
cm_connect_lsa(struct winbindd_domain
*domain
, TALLOC_CTX
*mem_ctx
,
2247 struct rpc_pipe_client
**cli
, struct policy_handle
*lsa_policy
)
2249 struct winbindd_cm_conn
*conn
;
2250 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
2251 struct netlogon_creds_CredentialState
*p_creds
;
2253 result
= init_dc_connection(domain
);
2254 if (!NT_STATUS_IS_OK(result
))
2257 conn
= &domain
->conn
;
2259 if (conn
->lsa_pipe
!= NULL
) {
2263 if ((conn
->cli
->user_name
[0] == '\0') ||
2264 (conn
->cli
->domain
[0] == '\0') ||
2265 (conn
->cli
->password
== NULL
|| conn
->cli
->password
[0] == '\0')) {
2266 DEBUG(10, ("cm_connect_lsa: No no user available for "
2267 "domain %s, trying schannel\n", conn
->cli
->domain
));
2271 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2272 * authenticated LSA pipe with sign & seal. */
2273 result
= cli_rpc_pipe_open_spnego_ntlmssp
2274 (conn
->cli
, &ndr_table_lsarpc
.syntax_id
, NCACN_NP
,
2275 DCERPC_AUTH_LEVEL_PRIVACY
,
2276 conn
->cli
->domain
, conn
->cli
->user_name
, conn
->cli
->password
,
2279 if (!NT_STATUS_IS_OK(result
)) {
2280 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2281 "domain %s using NTLMSSP authenticated pipe: user "
2282 "%s\\%s. Error was %s. Trying schannel.\n",
2283 domain
->name
, conn
->cli
->domain
,
2284 conn
->cli
->user_name
, nt_errstr(result
)));
2288 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2289 "NTLMSSP authenticated pipe: user %s\\%s\n",
2290 domain
->name
, conn
->cli
->domain
, conn
->cli
->user_name
));
2292 result
= rpccli_lsa_open_policy(conn
->lsa_pipe
, mem_ctx
, True
,
2293 SEC_FLAG_MAXIMUM_ALLOWED
,
2295 if (NT_STATUS_IS_OK(result
)) {
2299 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2302 TALLOC_FREE(conn
->lsa_pipe
);
2306 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2308 if (!cm_get_schannel_creds(domain
, &p_creds
)) {
2309 /* If this call fails - conn->cli can now be NULL ! */
2310 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2311 "for domain %s, trying anon\n", domain
->name
));
2314 result
= cli_rpc_pipe_open_schannel_with_key
2315 (conn
->cli
, &ndr_table_lsarpc
.syntax_id
, NCACN_NP
,
2316 DCERPC_AUTH_LEVEL_PRIVACY
,
2317 domain
->name
, &p_creds
, &conn
->lsa_pipe
);
2319 if (!NT_STATUS_IS_OK(result
)) {
2320 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2321 "domain %s using schannel. Error was %s\n",
2322 domain
->name
, nt_errstr(result
) ));
2325 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2326 "schannel.\n", domain
->name
));
2328 result
= rpccli_lsa_open_policy(conn
->lsa_pipe
, mem_ctx
, True
,
2329 SEC_FLAG_MAXIMUM_ALLOWED
,
2331 if (NT_STATUS_IS_OK(result
)) {
2335 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2338 TALLOC_FREE(conn
->lsa_pipe
);
2342 result
= cli_rpc_pipe_open_noauth(conn
->cli
,
2343 &ndr_table_lsarpc
.syntax_id
,
2345 if (!NT_STATUS_IS_OK(result
)) {
2346 result
= NT_STATUS_PIPE_NOT_AVAILABLE
;
2350 result
= rpccli_lsa_open_policy(conn
->lsa_pipe
, mem_ctx
, True
,
2351 SEC_FLAG_MAXIMUM_ALLOWED
,
2354 if (!NT_STATUS_IS_OK(result
)) {
2355 invalidate_cm_connection(conn
);
2359 *cli
= conn
->lsa_pipe
;
2360 *lsa_policy
= conn
->lsa_policy
;
2364 /****************************************************************************
2365 Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2366 session key stored in conn->netlogon_pipe->dc->sess_key.
2367 ****************************************************************************/
2369 NTSTATUS
cm_connect_netlogon(struct winbindd_domain
*domain
,
2370 struct rpc_pipe_client
**cli
)
2372 struct winbindd_cm_conn
*conn
;
2375 uint32_t neg_flags
= NETLOGON_NEG_AUTH2_ADS_FLAGS
;
2377 enum netr_SchannelType sec_chan_type
;
2378 const char *account_name
;
2379 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
2383 result
= init_dc_connection(domain
);
2384 if (!NT_STATUS_IS_OK(result
)) {
2388 conn
= &domain
->conn
;
2390 if (conn
->netlogon_pipe
!= NULL
) {
2391 *cli
= conn
->netlogon_pipe
;
2392 return NT_STATUS_OK
;
2395 result
= cli_rpc_pipe_open_noauth(conn
->cli
,
2396 &ndr_table_netlogon
.syntax_id
,
2398 if (!NT_STATUS_IS_OK(result
)) {
2402 if ((!IS_DC
) && (!domain
->primary
)) {
2403 /* Clear the schannel request bit and drop down */
2404 neg_flags
&= ~NETLOGON_NEG_SCHANNEL
;
2408 if (lp_client_schannel() != False
) {
2409 neg_flags
|= NETLOGON_NEG_SCHANNEL
;
2412 if (!get_trust_pw_hash(domain
->name
, mach_pwd
, &account_name
,
2415 TALLOC_FREE(netlogon_pipe
);
2416 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
2419 result
= rpccli_netlogon_setup_creds(
2421 domain
->dcname
, /* server name. */
2422 domain
->name
, /* domain name */
2423 global_myname(), /* client name */
2424 account_name
, /* machine account */
2425 mach_pwd
, /* machine password */
2426 sec_chan_type
, /* from get_trust_pw */
2429 if (!NT_STATUS_IS_OK(result
)) {
2430 TALLOC_FREE(netlogon_pipe
);
2434 if ((lp_client_schannel() == True
) &&
2435 ((neg_flags
& NETLOGON_NEG_SCHANNEL
) == 0)) {
2436 DEBUG(3, ("Server did not offer schannel\n"));
2437 TALLOC_FREE(netlogon_pipe
);
2438 return NT_STATUS_ACCESS_DENIED
;
2442 if ((lp_client_schannel() == False
) ||
2443 ((neg_flags
& NETLOGON_NEG_SCHANNEL
) == 0)) {
2445 * NetSamLogonEx only works for schannel
2447 domain
->can_do_samlogon_ex
= False
;
2449 /* We're done - just keep the existing connection to NETLOGON
2451 conn
->netlogon_pipe
= netlogon_pipe
;
2452 *cli
= conn
->netlogon_pipe
;
2453 return NT_STATUS_OK
;
2456 /* Using the credentials from the first pipe, open a signed and sealed
2457 second netlogon pipe. The session key is stored in the schannel
2458 part of the new pipe auth struct.
2461 result
= cli_rpc_pipe_open_schannel_with_key(
2462 conn
->cli
, &ndr_table_netlogon
.syntax_id
, NCACN_NP
,
2463 DCERPC_AUTH_LEVEL_PRIVACY
, domain
->name
, &netlogon_pipe
->dc
,
2464 &conn
->netlogon_pipe
);
2466 /* We can now close the initial netlogon pipe. */
2467 TALLOC_FREE(netlogon_pipe
);
2469 if (!NT_STATUS_IS_OK(result
)) {
2470 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2471 "was %s\n", nt_errstr(result
)));
2473 /* make sure we return something besides OK */
2474 return !NT_STATUS_IS_OK(result
) ? result
: NT_STATUS_PIPE_NOT_AVAILABLE
;
2478 * Always try netr_LogonSamLogonEx. We will fall back for NT4
2479 * which gives DCERPC_FAULT_OP_RNG_ERROR (function not
2480 * supported). We used to only try SamLogonEx for AD, but
2481 * Samba DCs can also do it. And because we don't distinguish
2482 * between Samba and NT4, always try it once.
2484 domain
->can_do_samlogon_ex
= true;
2486 *cli
= conn
->netlogon_pipe
;
2487 return NT_STATUS_OK
;