s4:winbind: don't leak libnet_context into the main event context
[Samba/gebeck_regimport.git] / source4 / winbind / wb_init_domain.c
blob70dbaa9ce8101548f2f2fc9479d13ab96437f281
1 /*
2 Unix SMB/CIFS implementation.
4 A composite API for initializing a domain
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "includes.h"
24 #include "libcli/composite/composite.h"
25 #include "winbind/wb_server.h"
26 #include "smbd/service_task.h"
27 #include "librpc/gen_ndr/ndr_netlogon.h"
28 #include "librpc/gen_ndr/ndr_lsa_c.h"
29 #include "librpc/gen_ndr/ndr_samr_c.h"
30 #include "libcli/libcli.h"
32 #include "libcli/security/security.h"
35 #include "auth/credentials/credentials.h"
36 #include "param/param.h"
39 * Initialize a domain:
41 * - With schannel credentials, try to open the SMB connection and
42 * NETLOGON pipe with the machine creds. This works against W2k3SP1
43 * with an NTLMSSP session setup. Fall back to anonymous (for the CIFS level).
45 * - If we have schannel creds, do the auth2 and open the schannel'ed netlogon
46 * pipe.
48 * - Open LSA. If we have machine creds, try to open with SPNEGO or NTLMSSP. Fall back
49 * to schannel.
51 * - With queryinfopolicy, verify that we're talking to the right domain
53 * A bit complex, but with all the combinations I think it's the best we can
54 * get. NT4, W2k3 and W2k all have different combinations, but in the end we
55 * have a signed&sealed lsa connection on all of them.
57 * Not sure if it is overkill, but it seems to work.
60 struct init_domain_state {
61 struct composite_context *ctx;
62 struct wbsrv_domain *domain;
63 struct wbsrv_service *service;
65 struct lsa_ObjectAttribute objectattr;
66 struct lsa_OpenPolicy2 lsa_openpolicy;
67 struct lsa_QueryInfoPolicy queryinfo;
68 union lsa_PolicyInformation *info;
71 static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
72 static void init_domain_recv_lsa_pipe(struct composite_context *ctx);
73 static void init_domain_recv_lsa_policy(struct tevent_req *subreq);
74 static void init_domain_recv_queryinfo(struct tevent_req *subreq);
75 static void init_domain_recv_samr(struct composite_context *ctx);
77 static struct dcerpc_binding *init_domain_binding(struct init_domain_state *state,
78 const struct ndr_interface_table *table)
80 struct dcerpc_binding *binding;
81 char *s;
82 NTSTATUS status;
84 /* Make a binding string */
85 if ((lpcfg_server_role(state->service->task->lp_ctx) != ROLE_DOMAIN_MEMBER) &&
86 dom_sid_equal(state->domain->info->sid, state->service->primary_sid) &&
87 state->service->sec_channel_type != SEC_CHAN_RODC) {
88 s = talloc_asprintf(state, "ncalrpc:%s", state->domain->dc_name);
89 if (s == NULL) return NULL;
90 } else {
91 s = talloc_asprintf(state, "ncacn_np:%s", state->domain->dc_name);
92 if (s == NULL) return NULL;
95 status = dcerpc_parse_binding(state, s, &binding);
96 talloc_free(s);
97 if (!NT_STATUS_IS_OK(status)) {
98 return NULL;
101 /* Alter binding to contain hostname, but also address (so we don't look it up twice) */
102 binding->target_hostname = state->domain->dc_name;
103 binding->host = state->domain->dc_address;
105 if (binding->transport == NCALRPC) {
106 return binding;
109 /* This shouldn't make a network call, as the mappings for named pipes are well known */
110 status = dcerpc_epm_map_binding(binding, binding, table, state->service->task->event_ctx,
111 state->service->task->lp_ctx);
112 if (!NT_STATUS_IS_OK(status)) {
113 return NULL;
116 return binding;
119 struct composite_context *wb_init_domain_send(TALLOC_CTX *mem_ctx,
120 struct wbsrv_service *service,
121 struct wb_dom_info *dom_info)
123 struct composite_context *result, *ctx;
124 struct init_domain_state *state;
126 result = composite_create(mem_ctx, service->task->event_ctx);
127 if (result == NULL) goto failed;
129 state = talloc_zero(result, struct init_domain_state);
130 if (state == NULL) goto failed;
131 state->ctx = result;
132 result->private_data = state;
134 state->service = service;
136 state->domain = talloc(state, struct wbsrv_domain);
137 if (state->domain == NULL) goto failed;
139 state->domain->info = talloc_reference(state->domain, dom_info);
140 if (state->domain->info == NULL) goto failed;
142 state->domain->dc_name = dom_info->dc->name;
143 state->domain->dc_address = dom_info->dc->address;
145 state->domain->libnet_ctx = libnet_context_init(service->task->event_ctx,
146 service->task->lp_ctx);
147 if (state->domain->libnet_ctx == NULL) goto failed;
148 talloc_steal(state->domain, state->domain->libnet_ctx);
150 /* Create a credentials structure */
151 state->domain->libnet_ctx->cred = cli_credentials_init(state->domain);
152 if (state->domain->libnet_ctx->cred == NULL) goto failed;
154 cli_credentials_set_conf(state->domain->libnet_ctx->cred, service->task->lp_ctx);
156 /* Connect the machine account to the credentials */
157 state->ctx->status =
158 cli_credentials_set_machine_account(state->domain->libnet_ctx->cred, state->domain->libnet_ctx->lp_ctx);
159 if (!NT_STATUS_IS_OK(state->ctx->status)) goto failed;
161 state->domain->netlogon_binding = init_domain_binding(state, &ndr_table_netlogon);
163 state->domain->netlogon_pipe = NULL;
165 state->domain->netlogon_queue = tevent_queue_create(state->domain,
166 "netlogon_queue");
167 if (state->domain->netlogon_queue == NULL) goto failed;
169 /* We start the queue when the connection is usable */
170 tevent_queue_stop(state->domain->netlogon_queue);
172 if ((!cli_credentials_is_anonymous(state->domain->libnet_ctx->cred)) &&
173 ((lpcfg_server_role(service->task->lp_ctx) == ROLE_DOMAIN_MEMBER) ||
174 (lpcfg_server_role(service->task->lp_ctx) == ROLE_ACTIVE_DIRECTORY_DC)) &&
175 (dom_sid_equal(state->domain->info->sid,
176 state->service->primary_sid))) {
177 state->domain->netlogon_binding->flags |= DCERPC_SCHANNEL | DCERPC_SCHANNEL_AUTO;
179 /* For debugging, it can be a real pain if all the traffic is encrypted */
180 if (lpcfg_winbind_sealed_pipes(service->task->lp_ctx)) {
181 state->domain->netlogon_binding->flags |= (DCERPC_SIGN | DCERPC_SEAL );
182 } else {
183 state->domain->netlogon_binding->flags |= (DCERPC_SIGN);
187 /* No encryption on anonymous pipes */
189 ctx = dcerpc_pipe_connect_b_send(state, state->domain->netlogon_binding,
190 &ndr_table_netlogon,
191 state->domain->libnet_ctx->cred,
192 service->task->event_ctx,
193 service->task->lp_ctx);
195 if (composite_nomem(ctx, state->ctx)) {
196 goto failed;
199 composite_continue(state->ctx, ctx, init_domain_recv_netlogonpipe,
200 state);
201 return result;
202 failed:
203 talloc_free(result);
204 return NULL;
207 /* Having make a netlogon connection (possibly secured with schannel),
208 * make an LSA connection to the same DC, on the same IPC$ share */
209 static void init_domain_recv_netlogonpipe(struct composite_context *ctx)
211 struct init_domain_state *state =
212 talloc_get_type(ctx->async.private_data,
213 struct init_domain_state);
215 state->ctx->status = dcerpc_pipe_connect_b_recv(ctx, state->domain,
216 &state->domain->netlogon_pipe);
218 if (!composite_is_ok(state->ctx)) {
219 return;
221 talloc_reparent(state, state->domain->netlogon_pipe, state->domain->netlogon_binding);
223 /* the netlogon connection is ready */
224 tevent_queue_start(state->domain->netlogon_queue);
226 state->domain->lsa_binding = init_domain_binding(state, &ndr_table_lsarpc);
228 /* For debugging, it can be a real pain if all the traffic is encrypted */
229 if (lpcfg_winbind_sealed_pipes(state->service->task->lp_ctx)) {
230 state->domain->lsa_binding->flags |= (DCERPC_SIGN | DCERPC_SEAL );
231 } else {
232 state->domain->lsa_binding->flags |= (DCERPC_SIGN);
235 state->domain->libnet_ctx->lsa.pipe = NULL;
237 /* this will make the secondary connection on the same IPC$ share,
238 secured with SPNEGO or NTLMSSP */
239 ctx = dcerpc_secondary_auth_connection_send(state->domain->netlogon_pipe,
240 state->domain->lsa_binding,
241 &ndr_table_lsarpc,
242 state->domain->libnet_ctx->cred,
243 state->domain->libnet_ctx->lp_ctx
245 composite_continue(state->ctx, ctx, init_domain_recv_lsa_pipe, state);
248 static bool retry_with_schannel(struct init_domain_state *state,
249 struct dcerpc_binding *binding,
250 const struct ndr_interface_table *table,
251 void (*continuation)(struct composite_context *))
253 struct composite_context *ctx;
254 state->ctx->status = NT_STATUS_OK;
255 if (state->domain->netlogon_binding->flags & DCERPC_SCHANNEL
256 && !(binding->flags & DCERPC_SCHANNEL)) {
257 /* Opening a policy handle failed, perhaps it was
258 * because we don't get a 'wrong password' error on
259 * NTLMSSP binds */
261 /* Try again with schannel */
262 binding->flags |= DCERPC_SCHANNEL | DCERPC_SCHANNEL_AUTO;
264 /* Try again, likewise on the same IPC$ share,
265 secured with SCHANNEL */
266 ctx = dcerpc_secondary_auth_connection_send(state->domain->netlogon_pipe,
267 binding,
268 table,
269 state->domain->libnet_ctx->cred,
270 state->domain->libnet_ctx->lp_ctx);
271 composite_continue(state->ctx, ctx, continuation, state);
272 return true;
273 } else {
274 return false;
277 /* We should now have either an authenticated LSA pipe, or an error.
278 * On success, open a policy handle
280 static void init_domain_recv_lsa_pipe(struct composite_context *ctx)
282 struct init_domain_state *state =
283 talloc_get_type(ctx->async.private_data,
284 struct init_domain_state);
285 struct tevent_req *subreq;
287 state->ctx->status = dcerpc_secondary_auth_connection_recv(ctx, state->domain,
288 &state->domain->libnet_ctx->lsa.pipe);
289 if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_LOGON_FAILURE)) {
290 if (retry_with_schannel(state, state->domain->lsa_binding,
291 &ndr_table_lsarpc,
292 init_domain_recv_lsa_pipe)) {
293 return;
296 if (!composite_is_ok(state->ctx)) return;
298 talloc_steal(state->domain->libnet_ctx, state->domain->libnet_ctx->lsa.pipe);
299 talloc_reparent(state, state->domain->libnet_ctx->lsa.pipe, state->domain->lsa_binding);
300 state->domain->libnet_ctx->lsa.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
301 state->domain->libnet_ctx->lsa.name = state->domain->info->name;
303 ZERO_STRUCT(state->domain->libnet_ctx->lsa.handle);
304 state->lsa_openpolicy.in.system_name =
305 talloc_asprintf(state, "\\\\%s",
306 dcerpc_server_name(state->domain->libnet_ctx->lsa.pipe));
307 ZERO_STRUCT(state->objectattr);
308 state->lsa_openpolicy.in.attr = &state->objectattr;
309 state->lsa_openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
310 state->lsa_openpolicy.out.handle = &state->domain->libnet_ctx->lsa.handle;
312 subreq = dcerpc_lsa_OpenPolicy2_r_send(state,
313 state->ctx->event_ctx,
314 state->domain->libnet_ctx->lsa.pipe->binding_handle,
315 &state->lsa_openpolicy);
316 if (composite_nomem(subreq, state->ctx)) return;
317 tevent_req_set_callback(subreq, init_domain_recv_lsa_policy, state);
320 /* Receive a policy handle (or not, and retry the authentication) and
321 * obtain some basic information about the domain */
323 static void init_domain_recv_lsa_policy(struct tevent_req *subreq)
325 struct init_domain_state *state =
326 tevent_req_callback_data(subreq,
327 struct init_domain_state);
329 state->ctx->status = dcerpc_lsa_OpenPolicy2_r_recv(subreq, state);
330 TALLOC_FREE(subreq);
331 if ((!NT_STATUS_IS_OK(state->ctx->status)
332 || !NT_STATUS_IS_OK(state->lsa_openpolicy.out.result))) {
333 if (retry_with_schannel(state, state->domain->lsa_binding,
334 &ndr_table_lsarpc,
335 init_domain_recv_lsa_pipe)) {
336 return;
339 if (!composite_is_ok(state->ctx)) return;
340 state->ctx->status = state->lsa_openpolicy.out.result;
341 if (!composite_is_ok(state->ctx)) return;
343 state->info = talloc_zero(state->ctx, union lsa_PolicyInformation);
344 if (composite_nomem(state->info, state->ctx)) return;
346 state->queryinfo.in.handle = &state->domain->libnet_ctx->lsa.handle;
347 state->queryinfo.in.level = LSA_POLICY_INFO_ACCOUNT_DOMAIN;
348 state->queryinfo.out.info = &state->info;
350 subreq = dcerpc_lsa_QueryInfoPolicy_r_send(state,
351 state->ctx->event_ctx,
352 state->domain->libnet_ctx->lsa.pipe->binding_handle,
353 &state->queryinfo);
354 if (composite_nomem(subreq, state->ctx)) return;
355 tevent_req_set_callback(subreq, init_domain_recv_queryinfo, state);
358 static void init_domain_recv_queryinfo(struct tevent_req *subreq)
360 struct init_domain_state *state =
361 tevent_req_callback_data(subreq,
362 struct init_domain_state);
363 struct lsa_DomainInfo *dominfo;
364 struct composite_context *ctx;
366 state->ctx->status = dcerpc_lsa_QueryInfoPolicy_r_recv(subreq, state);
367 TALLOC_FREE(subreq);
368 if (!composite_is_ok(state->ctx)) return;
369 state->ctx->status = state->queryinfo.out.result;
370 if (!composite_is_ok(state->ctx)) return;
372 dominfo = &(*state->queryinfo.out.info)->account_domain;
374 if (strcasecmp(state->domain->info->name, dominfo->name.string) != 0) {
375 DEBUG(2, ("Expected domain name %s, DC %s said %s\n",
376 state->domain->info->name,
377 dcerpc_server_name(state->domain->libnet_ctx->lsa.pipe),
378 dominfo->name.string));
379 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
380 return;
383 if (!dom_sid_equal(state->domain->info->sid, dominfo->sid)) {
384 DEBUG(2, ("Expected domain sid %s, DC %s said %s\n",
385 dom_sid_string(state, state->domain->info->sid),
386 dcerpc_server_name(state->domain->libnet_ctx->lsa.pipe),
387 dom_sid_string(state, dominfo->sid)));
388 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
389 return;
392 state->domain->samr_binding = init_domain_binding(state, &ndr_table_samr);
394 /* We want to use the same flags as the LSA pipe did (so, if
395 * it needed schannel, then we need that here too) */
396 state->domain->samr_binding->flags = state->domain->lsa_binding->flags;
398 state->domain->libnet_ctx->samr.pipe = NULL;
400 ctx = wb_connect_samr_send(state, state->domain);
401 composite_continue(state->ctx, ctx, init_domain_recv_samr, state);
404 /* Recv the SAMR details (SamrConnect and SamrOpenDomain handle) and
405 * open an LDAP connection */
406 static void init_domain_recv_samr(struct composite_context *ctx)
408 struct init_domain_state *state =
409 talloc_get_type(ctx->async.private_data,
410 struct init_domain_state);
412 state->ctx->status = wb_connect_samr_recv(
413 ctx, state->domain,
414 &state->domain->libnet_ctx->samr.pipe,
415 &state->domain->libnet_ctx->samr.connect_handle,
416 &state->domain->libnet_ctx->samr.handle);
417 if (!composite_is_ok(state->ctx)) return;
419 talloc_reparent(state, state->domain->libnet_ctx->samr.pipe, state->domain->samr_binding);
420 state->domain->libnet_ctx->samr.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
421 state->domain->libnet_ctx->samr.name = state->domain->info->name;
422 state->domain->libnet_ctx->samr.sid = dom_sid_dup(
423 state->domain->libnet_ctx,
424 state->domain->info->sid);
426 composite_done(state->ctx);
429 NTSTATUS wb_init_domain_recv(struct composite_context *c,
430 TALLOC_CTX *mem_ctx,
431 struct wbsrv_domain **result)
433 NTSTATUS status = composite_wait(c);
434 if (NT_STATUS_IS_OK(status)) {
435 struct init_domain_state *state =
436 talloc_get_type(c->private_data,
437 struct init_domain_state);
438 *result = talloc_steal(mem_ctx, state->domain);
440 talloc_free(c);
441 return status;
444 NTSTATUS wb_init_domain(TALLOC_CTX *mem_ctx, struct wbsrv_service *service,
445 struct wb_dom_info *dom_info,
446 struct wbsrv_domain **result)
448 struct composite_context *c =
449 wb_init_domain_send(mem_ctx, service, dom_info);
450 return wb_init_domain_recv(c, mem_ctx, result);