source3/winbindd/winbindd_cm.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon connection manager
   5
   6    Copyright (C) Tim Potter                2001
   7    Copyright (C) Andrew Bartlett           2002
   8    Copyright (C) Gerald (Jerry) Carter     2003-2005.
   9    Copyright (C) Volker Lendecke           2004-2005
  10    Copyright (C) Jeremy Allison            2006
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 /*
  27    We need to manage connections to domain controllers without having to
  28    mess up the main winbindd code with other issues.  The aim of the
  29    connection manager is to:
  30
  31        - make connections to domain controllers and cache them
  32        - re-establish connections when networks or servers go down
  33        - centralise the policy on connection timeouts, domain controller
  34          selection etc
  35        - manage re-entrancy for when winbindd becomes able to handle
  36          multiple outstanding rpc requests
  37
  38    Why not have connection management as part of the rpc layer like tng?
  39    Good question.  This code may morph into libsmb/rpc_cache.c or something
  40    like that but at the moment it's simply staying as part of winbind.  I
  41    think the TNG architecture of forcing every user of the rpc layer to use
  42    the connection caching system is a bad idea.  It should be an optional
  43    method of using the routines.
  44
  45    The TNG design is quite good but I disagree with some aspects of the
  46    implementation. -tpot
  47
  48  */
  49
  50 /*
  51    TODO:
  52
  53      - I'm pretty annoyed by all the make_nmb_name() stuff.  It should be
  54        moved down into another function.
  55
  56      - Take care when destroying cli_structs as they can be shared between
  57        various sam handles.
  58
  59  */
  60
  61 #include "includes.h"
  62 #include "winbindd.h"
  63 #include "../libcli/auth/libcli_auth.h"
  64 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
  65 #include "rpc_client/cli_pipe.h"
  66 #include "rpc_client/cli_netlogon.h"
  67 #include "../librpc/gen_ndr/ndr_samr_c.h"
  68 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  69 #include "rpc_client/cli_lsarpc.h"
  70 #include "../librpc/gen_ndr/ndr_dssetup_c.h"
  71 #include "libads/sitename_cache.h"
  72 #include "libsmb/libsmb.h"
  73 #include "libsmb/clidgram.h"
  74 #include "ads.h"
  75 #include "secrets.h"
  76 #include "../libcli/security/security.h"
  77 #include "passdb.h"
  78 #include "messages.h"
  79 #include "auth/gensec/gensec.h"
  80 #include "../libcli/smb/smbXcli_base.h"
  81 #include "lib/param/loadparm.h"
  82
  83 #undef DBGC_CLASS
  84 #define DBGC_CLASS DBGC_WINBIND
  85
  86 struct dc_name_ip {
  87         fstring name;
  88         struct sockaddr_storage ss;
  89 };
  90
  91 extern struct winbindd_methods reconnect_methods;
  92 extern bool override_logfile;
  93
  94 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
  95 static void set_dc_type_and_flags( struct winbindd_domain *domain );
  96 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
  97                     struct dc_name_ip **dcs, int *num_dcs);
  98
  99 /****************************************************************
 100  Child failed to find DC's. Reschedule check.
 101 ****************************************************************/
 102
 103 static void msg_failed_to_go_online(struct messaging_context *msg,
 104                                     void *private_data,
 105                                     uint32_t msg_type,
 106                                     struct server_id server_id,
 107                                     DATA_BLOB *data)
 108 {
 109         struct winbindd_domain *domain;
 110         const char *domainname = (const char *)data->data;
 111
 112         if (data->data == NULL || data->length == 0) {
 113                 return;
 114         }
 115
 116         DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
 117
 118         for (domain = domain_list(); domain; domain = domain->next) {
 119                 if (domain->internal) {
 120                         continue;
 121                 }
 122
 123                 if (strequal(domain->name, domainname)) {
 124                         if (domain->online) {
 125                                 /* We're already online, ignore. */
 126                                 DEBUG(5,("msg_fail_to_go_online: domain %s "
 127                                         "already online.\n", domainname));
 128                                 continue;
 129                         }
 130
 131                         /* Reschedule the online check. */
 132                         set_domain_offline(domain);
 133                         break;
 134                 }
 135         }
 136 }
 137
 138 /****************************************************************
 139  Actually cause a reconnect from a message.
 140 ****************************************************************/
 141
 142 static void msg_try_to_go_online(struct messaging_context *msg,
 143                                  void *private_data,
 144                                  uint32_t msg_type,
 145                                  struct server_id server_id,
 146                                  DATA_BLOB *data)
 147 {
 148         struct winbindd_domain *domain;
 149         const char *domainname = (const char *)data->data;
 150
 151         if (data->data == NULL || data->length == 0) {
 152                 return;
 153         }
 154
 155         DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
 156
 157         for (domain = domain_list(); domain; domain = domain->next) {
 158                 if (domain->internal) {
 159                         continue;
 160                 }
 161
 162                 if (strequal(domain->name, domainname)) {
 163
 164                         if (domain->online) {
 165                                 /* We're already online, ignore. */
 166                                 DEBUG(5,("msg_try_to_go_online: domain %s "
 167                                         "already online.\n", domainname));
 168                                 continue;
 169                         }
 170
 171                         /* This call takes care of setting the online
 172                            flag to true if we connected, or re-adding
 173                            the offline handler if false. Bypasses online
 174                            check so always does network calls. */
 175
 176                         init_dc_connection_network(domain);
 177                         break;
 178                 }
 179         }
 180 }
 181
 182 /****************************************************************
 183  Fork a child to try and contact a DC. Do this as contacting a
 184  DC requires blocking lookups and we don't want to block our
 185  parent.
 186 ****************************************************************/
 187
 188 static bool fork_child_dc_connect(struct winbindd_domain *domain)
 189 {
 190         struct dc_name_ip *dcs = NULL;
 191         int num_dcs = 0;
 192         TALLOC_CTX *mem_ctx = NULL;
 193         pid_t parent_pid = getpid();
 194         char *lfile = NULL;
 195         NTSTATUS status;
 196
 197         if (domain->dc_probe_pid != (pid_t)-1) {
 198                 /*
 199                  * We might already have a DC probe
 200                  * child working, check.
 201                  */
 202                 if (process_exists_by_pid(domain->dc_probe_pid)) {
 203                         DEBUG(10,("fork_child_dc_connect: pid %u already "
 204                                 "checking for DC's.\n",
 205                                 (unsigned int)domain->dc_probe_pid));
 206                         return true;
 207                 }
 208                 domain->dc_probe_pid = (pid_t)-1;
 209         }
 210
 211         domain->dc_probe_pid = fork();
 212
 213         if (domain->dc_probe_pid == (pid_t)-1) {
 214                 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
 215                 return False;
 216         }
 217
 218         if (domain->dc_probe_pid != (pid_t)0) {
 219                 /* Parent */
 220                 messaging_register(winbind_messaging_context(), NULL,
 221                                    MSG_WINBIND_TRY_TO_GO_ONLINE,
 222                                    msg_try_to_go_online);
 223                 messaging_register(winbind_messaging_context(), NULL,
 224                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 225                                    msg_failed_to_go_online);
 226                 return True;
 227         }
 228
 229         /* Child. */
 230
 231         /* Leave messages blocked - we will never process one. */
 232
 233         if (!override_logfile) {
 234                 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
 235                         DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
 236                         _exit(1);
 237                 }
 238         }
 239
 240         status = winbindd_reinit_after_fork(NULL, lfile);
 241         if (!NT_STATUS_IS_OK(status)) {
 242                 DEBUG(1, ("winbindd_reinit_after_fork failed: %s\n",
 243                           nt_errstr(status)));
 244                 messaging_send_buf(winbind_messaging_context(),
 245                                    pid_to_procid(parent_pid),
 246                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 247                                    (uint8 *)domain->name,
 248                                    strlen(domain->name)+1);
 249                 _exit(1);
 250         }
 251         SAFE_FREE(lfile);
 252
 253         mem_ctx = talloc_init("fork_child_dc_connect");
 254         if (!mem_ctx) {
 255                 DEBUG(0,("talloc_init failed.\n"));
 256                 messaging_send_buf(winbind_messaging_context(),
 257                                    pid_to_procid(parent_pid),
 258                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 259                                    (uint8 *)domain->name,
 260                                    strlen(domain->name)+1);
 261                 _exit(1);
 262         }
 263
 264         if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
 265                 /* Still offline ? Can't find DC's. */
 266                 messaging_send_buf(winbind_messaging_context(),
 267                                    pid_to_procid(parent_pid),
 268                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 269                                    (uint8 *)domain->name,
 270                                    strlen(domain->name)+1);
 271                 _exit(0);
 272         }
 273
 274         /* We got a DC. Send a message to our parent to get it to
 275            try and do the same. */
 276
 277         messaging_send_buf(winbind_messaging_context(),
 278                            pid_to_procid(parent_pid),
 279                            MSG_WINBIND_TRY_TO_GO_ONLINE,
 280                            (uint8 *)domain->name,
 281                            strlen(domain->name)+1);
 282         _exit(0);
 283 }
 284
 285 /****************************************************************
 286  Handler triggered if we're offline to try and detect a DC.
 287 ****************************************************************/
 288
 289 static void check_domain_online_handler(struct event_context *ctx,
 290                                         struct timed_event *te,
 291                                         struct timeval now,
 292                                         void *private_data)
 293 {
 294         struct winbindd_domain *domain =
 295                 (struct winbindd_domain *)private_data;
 296
 297         DEBUG(10,("check_domain_online_handler: called for domain "
 298                   "%s (online = %s)\n", domain->name,
 299                   domain->online ? "True" : "False" ));
 300
 301         TALLOC_FREE(domain->check_online_event);
 302
 303         /* Are we still in "startup" mode ? */
 304
 305         if (domain->startup && (time_mono(NULL) > domain->startup_time + 30)) {
 306                 /* No longer in "startup" mode. */
 307                 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
 308                         domain->name ));
 309                 domain->startup = False;
 310         }
 311
 312         /* We've been told to stay offline, so stay
 313            that way. */
 314
 315         if (get_global_winbindd_state_offline()) {
 316                 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
 317                         domain->name ));
 318                 return;
 319         }
 320
 321         /* Fork a child to test if it can contact a DC.
 322            If it can then send ourselves a message to
 323            cause a reconnect. */
 324
 325         fork_child_dc_connect(domain);
 326 }
 327
 328 /****************************************************************
 329  If we're still offline setup the timeout check.
 330 ****************************************************************/
 331
 332 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
 333 {
 334         int wbr = lp_winbind_reconnect_delay();
 335
 336         if (domain->startup) {
 337                 domain->check_online_timeout = 10;
 338         } else if (domain->check_online_timeout < wbr) {
 339                 domain->check_online_timeout = wbr;
 340         }
 341 }
 342
 343 /****************************************************************
 344  Set domain offline and also add handler to put us back online
 345  if we detect a DC.
 346 ****************************************************************/
 347
 348 void set_domain_offline(struct winbindd_domain *domain)
 349 {
 350         DEBUG(10,("set_domain_offline: called for domain %s\n",
 351                 domain->name ));
 352
 353         TALLOC_FREE(domain->check_online_event);
 354
 355         if (domain->internal) {
 356                 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
 357                         domain->name ));
 358                 return;
 359         }
 360
 361         domain->online = False;
 362
 363         /* Offline domains are always initialized. They're
 364            re-initialized when they go back online. */
 365
 366         domain->initialized = True;
 367
 368         /* We only add the timeout handler that checks and
 369            allows us to go back online when we've not
 370            been told to remain offline. */
 371
 372         if (get_global_winbindd_state_offline()) {
 373                 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
 374                         domain->name ));
 375                 return;
 376         }
 377
 378         /* If we're in startup mode, check again in 10 seconds, not in
 379            lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
 380
 381         calc_new_online_timeout_check(domain);
 382
 383         domain->check_online_event = event_add_timed(winbind_event_context(),
 384                                                 NULL,
 385                                                 timeval_current_ofs(domain->check_online_timeout,0),
 386                                                 check_domain_online_handler,
 387                                                 domain);
 388
 389         /* The above *has* to succeed for winbindd to work. */
 390         if (!domain->check_online_event) {
 391                 smb_panic("set_domain_offline: failed to add online handler");
 392         }
 393
 394         DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
 395                 domain->name ));
 396
 397         /* Send an offline message to the idmap child when our
 398            primary domain goes offline */
 399
 400         if ( domain->primary ) {
 401                 struct winbindd_child *idmap = idmap_child();
 402
 403                 if ( idmap->pid != 0 ) {
 404                         messaging_send_buf(winbind_messaging_context(),
 405                                            pid_to_procid(idmap->pid),
 406                                            MSG_WINBIND_OFFLINE,
 407                                            (uint8 *)domain->name,
 408                                            strlen(domain->name)+1);
 409                 }
 410         }
 411
 412         return;
 413 }
 414
 415 /****************************************************************
 416  Set domain online - if allowed.
 417 ****************************************************************/
 418
 419 static void set_domain_online(struct winbindd_domain *domain)
 420 {
 421         DEBUG(10,("set_domain_online: called for domain %s\n",
 422                 domain->name ));
 423
 424         if (domain->internal) {
 425                 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
 426                         domain->name ));
 427                 return;
 428         }
 429
 430         if (get_global_winbindd_state_offline()) {
 431                 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
 432                         domain->name ));
 433                 return;
 434         }
 435
 436         winbindd_set_locator_kdc_envs(domain);
 437
 438         /* If we are waiting to get a krb5 ticket, trigger immediately. */
 439         ccache_regain_all_now();
 440
 441         /* Ok, we're out of any startup mode now... */
 442         domain->startup = False;
 443
 444         if (domain->online == False) {
 445                 /* We were offline - now we're online. We default to
 446                    using the MS-RPC backend if we started offline,
 447                    and if we're going online for the first time we
 448                    should really re-initialize the backends and the
 449                    checks to see if we're talking to an AD or NT domain.
 450                 */
 451
 452                 domain->initialized = False;
 453
 454                 /* 'reconnect_methods' is the MS-RPC backend. */
 455                 if (domain->backend == &reconnect_methods) {
 456                         domain->backend = NULL;
 457                 }
 458         }
 459
 460         /* Ensure we have no online timeout checks. */
 461         domain->check_online_timeout = 0;
 462         TALLOC_FREE(domain->check_online_event);
 463
 464         /* Ensure we ignore any pending child messages. */
 465         messaging_deregister(winbind_messaging_context(),
 466                              MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
 467         messaging_deregister(winbind_messaging_context(),
 468                              MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
 469
 470         domain->online = True;
 471
 472         /* Send an online message to the idmap child when our
 473            primary domain comes online */
 474
 475         if ( domain->primary ) {
 476                 struct winbindd_child *idmap = idmap_child();
 477
 478                 if ( idmap->pid != 0 ) {
 479                         messaging_send_buf(winbind_messaging_context(),
 480                                            pid_to_procid(idmap->pid),
 481                                            MSG_WINBIND_ONLINE,
 482                                            (uint8 *)domain->name,
 483                                            strlen(domain->name)+1);
 484                 }
 485         }
 486
 487         return;
 488 }
 489
 490 /****************************************************************
 491  Requested to set a domain online.
 492 ****************************************************************/
 493
 494 void set_domain_online_request(struct winbindd_domain *domain)
 495 {
 496         struct timeval tev;
 497
 498         DEBUG(10,("set_domain_online_request: called for domain %s\n",
 499                 domain->name ));
 500
 501         if (get_global_winbindd_state_offline()) {
 502                 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
 503                         domain->name ));
 504                 return;
 505         }
 506
 507         if (domain->internal) {
 508                 DEBUG(10, ("set_domain_online_request: Internal domains are "
 509                            "always online\n"));
 510                 return;
 511         }
 512
 513         /* We've been told it's safe to go online and
 514            try and connect to a DC. But I don't believe it
 515            because network manager seems to lie.
 516            Wait at least 5 seconds. Heuristics suck... */
 517
 518
 519         GetTimeOfDay(&tev);
 520
 521         /* Go into "startup" mode again. */
 522         domain->startup_time = time_mono(NULL);
 523         domain->startup = True;
 524
 525         tev.tv_sec += 5;
 526
 527         if (!domain->check_online_event) {
 528                 /* If we've come from being globally offline we
 529                    don't have a check online event handler set.
 530                    We need to add one now we're trying to go
 531                    back online. */
 532
 533                 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
 534                         domain->name ));
 535         }
 536
 537         TALLOC_FREE(domain->check_online_event);
 538
 539         domain->check_online_event = event_add_timed(winbind_event_context(),
 540                                                      NULL,
 541                                                      tev,
 542                                                      check_domain_online_handler,
 543                                                      domain);
 544
 545         /* The above *has* to succeed for winbindd to work. */
 546         if (!domain->check_online_event) {
 547                 smb_panic("set_domain_online_request: failed to add online handler");
 548         }
 549 }
 550
 551 /****************************************************************
 552  Add -ve connection cache entries for domain and realm.
 553 ****************************************************************/
 554
 555 static void winbind_add_failed_connection_entry(
 556         const struct winbindd_domain *domain,
 557         const char *server,
 558         NTSTATUS result)
 559 {
 560         add_failed_connection_entry(domain->name, server, result);
 561         /* If this was the saf name for the last thing we talked to,
 562            remove it. */
 563         saf_delete(domain->name);
 564         if (*domain->alt_name) {
 565                 add_failed_connection_entry(domain->alt_name, server, result);
 566                 saf_delete(domain->alt_name);
 567         }
 568         winbindd_unset_locator_kdc_env(domain);
 569 }
 570
 571 /* Choose between anonymous or authenticated connections.  We need to use
 572    an authenticated connection if DCs have the RestrictAnonymous registry
 573    entry set > 0, or the "Additional restrictions for anonymous
 574    connections" set in the win2k Local Security Policy.
 575
 576    Caller to free() result in domain, username, password
 577 */
 578
 579 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
 580 {
 581         *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
 582         *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 583         *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
 584
 585         if (*username && **username) {
 586
 587                 if (!*domain || !**domain)
 588                         *domain = smb_xstrdup(lp_workgroup());
 589
 590                 if (!*password || !**password)
 591                         *password = smb_xstrdup("");
 592
 593                 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
 594                           *domain, *username));
 595
 596         } else {
 597                 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
 598                 *username = smb_xstrdup("");
 599                 *domain = smb_xstrdup("");
 600                 *password = smb_xstrdup("");
 601         }
 602 }
 603
 604 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
 605                                      fstring dcname,
 606                                      struct sockaddr_storage *dc_ss)
 607 {
 608         struct winbindd_domain *our_domain = NULL;
 609         struct rpc_pipe_client *netlogon_pipe = NULL;
 610         NTSTATUS result;
 611         WERROR werr;
 612         TALLOC_CTX *mem_ctx;
 613         unsigned int orig_timeout;
 614         const char *tmp = NULL;
 615         const char *p;
 616         struct dcerpc_binding_handle *b;
 617
 618         /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
 619          * moment.... */
 620
 621         if (IS_DC) {
 622                 return False;
 623         }
 624
 625         if (domain->primary) {
 626                 return False;
 627         }
 628
 629         our_domain = find_our_domain();
 630
 631         if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
 632                 return False;
 633         }
 634
 635         result = cm_connect_netlogon(our_domain, &netlogon_pipe);
 636         if (!NT_STATUS_IS_OK(result)) {
 637                 talloc_destroy(mem_ctx);
 638                 return False;
 639         }
 640
 641         b = netlogon_pipe->binding_handle;
 642
 643         /* This call can take a long time - allow the server to time out.
 644            35 seconds should do it. */
 645
 646         orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
 647
 648         if (our_domain->active_directory) {
 649                 struct netr_DsRGetDCNameInfo *domain_info = NULL;
 650
 651                 result = dcerpc_netr_DsRGetDCName(b,
 652                                                   mem_ctx,
 653                                                   our_domain->dcname,
 654                                                   domain->name,
 655                                                   NULL,
 656                                                   NULL,
 657                                                   DS_RETURN_DNS_NAME,
 658                                                   &domain_info,
 659                                                   &werr);
 660                 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
 661                         tmp = talloc_strdup(
 662                                 mem_ctx, domain_info->dc_unc);
 663                         if (tmp == NULL) {
 664                                 DEBUG(0, ("talloc_strdup failed\n"));
 665                                 talloc_destroy(mem_ctx);
 666                                 return false;
 667                         }
 668                         if (strlen(domain->alt_name) == 0) {
 669                                 fstrcpy(domain->alt_name,
 670                                         domain_info->domain_name);
 671                         }
 672                         if (strlen(domain->forest_name) == 0) {
 673                                 fstrcpy(domain->forest_name,
 674                                         domain_info->forest_name);
 675                         }
 676                 }
 677         } else {
 678                 result = dcerpc_netr_GetAnyDCName(b, mem_ctx,
 679                                                   our_domain->dcname,
 680                                                   domain->name,
 681                                                   &tmp,
 682                                                   &werr);
 683         }
 684
 685         /* And restore our original timeout. */
 686         rpccli_set_timeout(netlogon_pipe, orig_timeout);
 687
 688         if (!NT_STATUS_IS_OK(result)) {
 689                 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
 690                         nt_errstr(result)));
 691                 talloc_destroy(mem_ctx);
 692                 return false;
 693         }
 694
 695         if (!W_ERROR_IS_OK(werr)) {
 696                 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
 697                            win_errstr(werr)));
 698                 talloc_destroy(mem_ctx);
 699                 return false;
 700         }
 701
 702         /* dcerpc_netr_GetAnyDCName gives us a name with \\ */
 703         p = strip_hostname(tmp);
 704
 705         fstrcpy(dcname, p);
 706
 707         talloc_destroy(mem_ctx);
 708
 709         DEBUG(10,("dcerpc_netr_GetAnyDCName returned %s\n", dcname));
 710
 711         if (!resolve_name(dcname, dc_ss, 0x20, true)) {
 712                 return False;
 713         }
 714
 715         return True;
 716 }
 717
 718 /**
 719  * Helper function to assemble trust password and account name
 720  */
 721 static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
 722                                 char **machine_password,
 723                                 char **machine_account,
 724                                 char **machine_krb5_principal)
 725 {
 726         const char *account_name;
 727         const char *name = NULL;
 728
 729         /* If we are a DC and this is not our own domain */
 730
 731         if (IS_DC) {
 732                 name = domain->name;
 733         } else {
 734                 struct winbindd_domain *our_domain = find_our_domain();
 735
 736                 if (!our_domain)
 737                         return NT_STATUS_INVALID_SERVER_STATE;
 738
 739                 name = our_domain->name;
 740         }
 741
 742         if (!get_trust_pw_clear(name, machine_password,
 743                                 &account_name, NULL))
 744         {
 745                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 746         }
 747
 748         if ((machine_account != NULL) &&
 749             (asprintf(machine_account, "%s$", account_name) == -1))
 750         {
 751                 return NT_STATUS_NO_MEMORY;
 752         }
 753
 754         /* For now assume our machine account only exists in our domain */
 755
 756         if (machine_krb5_principal != NULL)
 757         {
 758                 struct winbindd_domain *our_domain = find_our_domain();
 759
 760                 if (!our_domain) {
 761                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 762                 }
 763
 764                 if (asprintf(machine_krb5_principal, "%s$@%s",
 765                              account_name, our_domain->alt_name) == -1)
 766                 {
 767                         return NT_STATUS_NO_MEMORY;
 768                 }
 769
 770                 if (!strupper_m(*machine_krb5_principal)) {
 771                         SAFE_FREE(machine_krb5_principal);
 772                         return NT_STATUS_INVALID_PARAMETER;
 773                 }
 774         }
 775
 776         return NT_STATUS_OK;
 777 }
 778
 779 /************************************************************************
 780  Given a fd with a just-connected TCP connection to a DC, open a connection
 781  to the pipe.
 782 ************************************************************************/
 783
 784 static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 785                                       const int sockfd,
 786                                       const char *controller,
 787                                       struct cli_state **cli,
 788                                       bool *retry)
 789 {
 790         bool try_spnego = false;
 791         bool try_ipc_auth = false;
 792         char *machine_password = NULL;
 793         char *machine_krb5_principal = NULL;
 794         char *machine_account = NULL;
 795         char *ipc_username = NULL;
 796         char *ipc_domain = NULL;
 797         char *ipc_password = NULL;
 798         int flags = 0;
 799         uint16_t sec_mode = 0;
 800
 801         struct named_mutex *mutex;
 802
 803         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 804
 805         DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
 806                 controller, domain->name ));
 807
 808         *retry = True;
 809
 810         mutex = grab_named_mutex(talloc_tos(), controller,
 811                                  WINBIND_SERVER_MUTEX_WAIT_TIME);
 812         if (mutex == NULL) {
 813                 close(sockfd);
 814                 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
 815                          controller));
 816                 result = NT_STATUS_POSSIBLE_DEADLOCK;
 817                 goto done;
 818         }
 819
 820         flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
 821
 822         *cli = cli_state_create(NULL, sockfd,
 823                                 controller, domain->alt_name,
 824                                 SMB_SIGNING_DEFAULT, flags);
 825         if (*cli == NULL) {
 826                 close(sockfd);
 827                 DEBUG(1, ("Could not cli_initialize\n"));
 828                 result = NT_STATUS_NO_MEMORY;
 829                 goto done;
 830         }
 831
 832         cli_set_timeout(*cli, 10000); /* 10 seconds */
 833
 834         result = smbXcli_negprot((*cli)->conn, (*cli)->timeout, PROTOCOL_CORE,
 835                                  PROTOCOL_LATEST);
 836
 837         if (!NT_STATUS_IS_OK(result)) {
 838                 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
 839                 goto done;
 840         }
 841
 842         if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_NT1 &&
 843             smb1cli_conn_capabilities((*cli)->conn) & CAP_EXTENDED_SECURITY) {
 844                 try_spnego = true;
 845         } else if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
 846                 try_spnego = true;
 847         }
 848
 849         if (!is_dc_trusted_domain_situation(domain->name) && try_spnego) {
 850                 result = get_trust_creds(domain, &machine_password,
 851                                          &machine_account,
 852                                          &machine_krb5_principal);
 853                 if (!NT_STATUS_IS_OK(result)) {
 854                         goto anon_fallback;
 855                 }
 856
 857                 if (lp_security() == SEC_ADS) {
 858
 859                         /* Try a krb5 session */
 860
 861                         (*cli)->use_kerberos = True;
 862                         DEBUG(5, ("connecting to %s from %s with kerberos principal "
 863                                   "[%s] and realm [%s]\n", controller, lp_netbios_name(),
 864                                   machine_krb5_principal, domain->alt_name));
 865
 866                         winbindd_set_locator_kdc_envs(domain);
 867
 868                         result = cli_session_setup(*cli,
 869                                                    machine_krb5_principal,
 870                                                    machine_password,
 871                                                    strlen(machine_password)+1,
 872                                                    machine_password,
 873                                                    strlen(machine_password)+1,
 874                                                    lp_workgroup());
 875
 876                         if (!NT_STATUS_IS_OK(result)) {
 877                                 DEBUG(4,("failed kerberos session setup with %s\n",
 878                                         nt_errstr(result)));
 879                         }
 880
 881                         if (NT_STATUS_IS_OK(result)) {
 882                                 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 883                                 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 884                                 if (!NT_STATUS_IS_OK(result)) {
 885                                         goto done;
 886                                 }
 887                                 goto session_setup_done;
 888                         }
 889                 }
 890
 891                 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
 892                 (*cli)->use_kerberos = False;
 893
 894                 DEBUG(5, ("connecting to %s from %s with username "
 895                           "[%s]\\[%s]\n",  controller, lp_netbios_name(),
 896                           lp_workgroup(), machine_account));
 897
 898                 result = cli_session_setup(*cli,
 899                                            machine_account,
 900                                            machine_password,
 901                                            strlen(machine_password)+1,
 902                                            machine_password,
 903                                            strlen(machine_password)+1,
 904                                            lp_workgroup());
 905                 if (!NT_STATUS_IS_OK(result)) {
 906                         DEBUG(4, ("authenticated session setup failed with %s\n",
 907                                 nt_errstr(result)));
 908                 }
 909
 910                 if (NT_STATUS_IS_OK(result)) {
 911                         /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 912                         result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 913                         if (!NT_STATUS_IS_OK(result)) {
 914                                 goto done;
 915                         }
 916                         goto session_setup_done;
 917                 }
 918         }
 919
 920         /* Fall back to non-kerberos session setup with auth_user */
 921
 922         (*cli)->use_kerberos = False;
 923
 924         cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
 925
 926         sec_mode = smb1cli_conn_server_security_mode((*cli)->conn);
 927
 928         try_ipc_auth = false;
 929         if (try_spnego) {
 930                 try_ipc_auth = true;
 931         } else if (sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
 932                 try_ipc_auth = true;
 933         }
 934
 935         if (try_ipc_auth && (strlen(ipc_username) > 0)) {
 936
 937                 /* Only try authenticated if we have a username */
 938
 939                 DEBUG(5, ("connecting to %s from %s with username "
 940                           "[%s]\\[%s]\n",  controller, lp_netbios_name(),
 941                           ipc_domain, ipc_username));
 942
 943                 if (NT_STATUS_IS_OK(cli_session_setup(
 944                                             *cli, ipc_username,
 945                                             ipc_password, strlen(ipc_password)+1,
 946                                             ipc_password, strlen(ipc_password)+1,
 947                                             ipc_domain))) {
 948                         /* Successful logon with given username. */
 949                         result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
 950                         if (!NT_STATUS_IS_OK(result)) {
 951                                 goto done;
 952                         }
 953                         goto session_setup_done;
 954                 } else {
 955                         DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
 956                                 ipc_domain, ipc_username ));
 957                 }
 958         }
 959
 960  anon_fallback:
 961
 962         /* Fall back to anonymous connection, this might fail later */
 963         DEBUG(10,("cm_prepare_connection: falling back to anonymous "
 964                 "connection for DC %s\n",
 965                 controller ));
 966
 967         result = cli_session_setup(*cli, "", NULL, 0, NULL, 0, "");
 968         if (NT_STATUS_IS_OK(result)) {
 969                 DEBUG(5, ("Connected anonymously\n"));
 970                 result = cli_init_creds(*cli, "", "", "");
 971                 if (!NT_STATUS_IS_OK(result)) {
 972                         goto done;
 973                 }
 974                 goto session_setup_done;
 975         }
 976
 977         /* We can't session setup */
 978         goto done;
 979
 980  session_setup_done:
 981
 982         /*
 983          * This should be a short term hack until
 984          * dynamic re-authentication is implemented.
 985          *
 986          * See Bug 9175 - winbindd doesn't recover from
 987          * NT_STATUS_NETWORK_SESSION_EXPIRED
 988          */
 989         if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
 990                 smbXcli_session_set_disconnect_expired((*cli)->smb2.session);
 991         }
 992
 993         /* cache the server name for later connections */
 994
 995         saf_store(domain->name, controller);
 996         if (domain->alt_name && (*cli)->use_kerberos) {
 997                 saf_store(domain->alt_name, controller);
 998         }
 999
1000         winbindd_set_locator_kdc_envs(domain);
1001
1002         result = cli_tree_connect(*cli, "IPC$", "IPC", "", 0);
1003
1004         if (!NT_STATUS_IS_OK(result)) {
1005                 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
1006                 goto done;
1007         }
1008
1009         TALLOC_FREE(mutex);
1010         *retry = False;
1011
1012         /* set the domain if empty; needed for schannel connections */
1013         if ( !(*cli)->domain[0] ) {
1014                 result = cli_set_domain((*cli), domain->name);
1015                 if (!NT_STATUS_IS_OK(result)) {
1016                         return result;
1017                 }
1018         }
1019
1020         result = NT_STATUS_OK;
1021
1022  done:
1023         TALLOC_FREE(mutex);
1024         SAFE_FREE(machine_account);
1025         SAFE_FREE(machine_password);
1026         SAFE_FREE(machine_krb5_principal);
1027         SAFE_FREE(ipc_username);
1028         SAFE_FREE(ipc_domain);
1029         SAFE_FREE(ipc_password);
1030
1031         if (!NT_STATUS_IS_OK(result)) {
1032                 winbind_add_failed_connection_entry(domain, controller, result);
1033                 if ((*cli) != NULL) {
1034                         cli_shutdown(*cli);
1035                         *cli = NULL;
1036                 }
1037         }
1038
1039         return result;
1040 }
1041
1042 /*******************************************************************
1043  Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1044  array.
1045
1046  Keeps the list unique by not adding duplicate entries.
1047
1048  @param[in] mem_ctx talloc memory context to allocate from
1049  @param[in] domain_name domain of the DC
1050  @param[in] dcname name of the DC to add to the list
1051  @param[in] pss Internet address and port pair to add to the list
1052  @param[in,out] dcs array of dc_name_ip structures to add to
1053  @param[in,out] num_dcs number of dcs returned in the dcs array
1054  @return true if the list was added to, false otherwise
1055 *******************************************************************/
1056
1057 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
1058                               const char *dcname, struct sockaddr_storage *pss,
1059                               struct dc_name_ip **dcs, int *num)
1060 {
1061         int i = 0;
1062
1063         if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1064                 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1065                 return False;
1066         }
1067
1068         /* Make sure there's no duplicates in the list */
1069         for (i=0; i<*num; i++)
1070                 if (sockaddr_equal(
1071                             (struct sockaddr *)(void *)&(*dcs)[i].ss,
1072                             (struct sockaddr *)(void *)pss))
1073                         return False;
1074
1075         *dcs = talloc_realloc(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1076
1077         if (*dcs == NULL)
1078                 return False;
1079
1080         fstrcpy((*dcs)[*num].name, dcname);
1081         (*dcs)[*num].ss = *pss;
1082         *num += 1;
1083         return True;
1084 }
1085
1086 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
1087                                   struct sockaddr_storage *pss, uint16 port,
1088                                   struct sockaddr_storage **addrs, int *num)
1089 {
1090         *addrs = talloc_realloc(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1091
1092         if (*addrs == NULL) {
1093                 *num = 0;
1094                 return False;
1095         }
1096
1097         (*addrs)[*num] = *pss;
1098         set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1099
1100         *num += 1;
1101         return True;
1102 }
1103
1104 /*******************************************************************
1105  convert an ip to a name
1106 *******************************************************************/
1107
1108 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
1109                 const struct winbindd_domain *domain,
1110                 struct sockaddr_storage *pss,
1111                 fstring name )
1112 {
1113         struct ip_service ip_list;
1114         uint32_t nt_version = NETLOGON_NT_VERSION_1;
1115         NTSTATUS status;
1116         const char *dc_name;
1117
1118         ip_list.ss = *pss;
1119         ip_list.port = 0;
1120
1121 #ifdef HAVE_ADS
1122         /* For active directory servers, try to get the ldap server name.
1123            None of these failures should be considered critical for now */
1124
1125         if (lp_security() == SEC_ADS) {
1126                 ADS_STRUCT *ads;
1127                 ADS_STATUS ads_status;
1128                 char addr[INET6_ADDRSTRLEN];
1129
1130                 print_sockaddr(addr, sizeof(addr), pss);
1131
1132                 ads = ads_init(domain->alt_name, domain->name, addr);
1133                 ads->auth.flags |= ADS_AUTH_NO_BIND;
1134
1135                 ads_status = ads_connect(ads);
1136                 if (ADS_ERR_OK(ads_status)) {
1137                         /* We got a cldap packet. */
1138                         fstrcpy(name, ads->config.ldap_server_name);
1139                         namecache_store(name, 0x20, 1, &ip_list);
1140
1141                         DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1142
1143                         if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1144                                 if (ads_closest_dc(ads)) {
1145                                         char *sitename = sitename_fetch(ads->config.realm);
1146
1147                                         /* We're going to use this KDC for this realm/domain.
1148                                            If we are using sites, then force the krb5 libs
1149                                            to use this KDC. */
1150
1151                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1152                                                                         domain->name,
1153                                                                         sitename,
1154                                                                         pss,
1155                                                                         name);
1156
1157                                         SAFE_FREE(sitename);
1158                                 } else {
1159                                         /* use an off site KDC */
1160                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1161                                                                         domain->name,
1162                                                                         NULL,
1163                                                                         pss,
1164                                                                         name);
1165                                 }
1166                                 winbindd_set_locator_kdc_envs(domain);
1167
1168                                 /* Ensure we contact this DC also. */
1169                                 saf_store( domain->name, name);
1170                                 saf_store( domain->alt_name, name);
1171                         }
1172
1173                         ads_destroy( &ads );
1174                         return True;
1175                 }
1176
1177                 ads_destroy( &ads );
1178                 return false;
1179         }
1180 #endif
1181
1182         status = nbt_getdc(winbind_messaging_context(), 10, pss, domain->name,
1183                            &domain->sid, nt_version, mem_ctx, &nt_version,
1184                            &dc_name, NULL);
1185         if (NT_STATUS_IS_OK(status)) {
1186                 fstrcpy(name, dc_name);
1187                 namecache_store(name, 0x20, 1, &ip_list);
1188                 return True;
1189         }
1190
1191         /* try node status request */
1192
1193         if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
1194                 namecache_store(name, 0x20, 1, &ip_list);
1195                 return True;
1196         }
1197         return False;
1198 }
1199
1200 /*******************************************************************
1201  Retrieve a list of IP addresses for domain controllers.
1202
1203  The array is sorted in the preferred connection order.
1204
1205  @param[in] mem_ctx talloc memory context to allocate from
1206  @param[in] domain domain to retrieve DCs for
1207  @param[out] dcs array of dcs that will be returned
1208  @param[out] num_dcs number of dcs returned in the dcs array
1209  @return always true
1210 *******************************************************************/
1211
1212 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
1213                     struct dc_name_ip **dcs, int *num_dcs)
1214 {
1215         fstring dcname;
1216         struct  sockaddr_storage ss;
1217         struct  ip_service *ip_list = NULL;
1218         int     iplist_size = 0;
1219         int     i;
1220         bool    is_our_domain;
1221         enum security_types sec = (enum security_types)lp_security();
1222
1223         is_our_domain = strequal(domain->name, lp_workgroup());
1224
1225         /* If not our domain, get the preferred DC, by asking our primary DC */
1226         if ( !is_our_domain
1227                 && get_dc_name_via_netlogon(domain, dcname, &ss)
1228                 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1229                        num_dcs) )
1230         {
1231                 char addr[INET6_ADDRSTRLEN];
1232                 print_sockaddr(addr, sizeof(addr), &ss);
1233                 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1234                            dcname, addr));
1235                 return True;
1236         }
1237
1238         if (sec == SEC_ADS) {
1239                 char *sitename = NULL;
1240
1241                 /* We need to make sure we know the local site before
1242                    doing any DNS queries, as this will restrict the
1243                    get_sorted_dc_list() call below to only fetching
1244                    DNS records for the correct site. */
1245
1246                 /* Find any DC to get the site record.
1247                    We deliberately don't care about the
1248                    return here. */
1249
1250                 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1251
1252                 sitename = sitename_fetch(domain->alt_name);
1253                 if (sitename) {
1254
1255                         /* Do the site-specific AD dns lookup first. */
1256                         get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1257                                &iplist_size, True);
1258
1259                         /* Add ips to the DC array.  We don't look up the name
1260                            of the DC in this function, but we fill in the char*
1261                            of the ip now to make the failed connection cache
1262                            work */
1263                         for ( i=0; i<iplist_size; i++ ) {
1264                                 char addr[INET6_ADDRSTRLEN];
1265                                 print_sockaddr(addr, sizeof(addr),
1266                                                 &ip_list[i].ss);
1267                                 add_one_dc_unique(mem_ctx,
1268                                                 domain->name,
1269                                                 addr,
1270                                                 &ip_list[i].ss,
1271                                                 dcs,
1272                                                 num_dcs);
1273                         }
1274
1275                         SAFE_FREE(ip_list);
1276                         SAFE_FREE(sitename);
1277                         iplist_size = 0;
1278                 }
1279
1280                 /* Now we add DCs from the main AD DNS lookup. */
1281                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1282                         &iplist_size, True);
1283
1284                 for ( i=0; i<iplist_size; i++ ) {
1285                         char addr[INET6_ADDRSTRLEN];
1286                         print_sockaddr(addr, sizeof(addr),
1287                                         &ip_list[i].ss);
1288                         add_one_dc_unique(mem_ctx,
1289                                         domain->name,
1290                                         addr,
1291                                         &ip_list[i].ss,
1292                                         dcs,
1293                                         num_dcs);
1294                 }
1295
1296                 SAFE_FREE(ip_list);
1297                 iplist_size = 0;
1298         }
1299
1300         /* Try standard netbios queries if no ADS and fall back to DNS queries
1301          * if alt_name is available */
1302         if (*num_dcs == 0) {
1303                 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1304                        false);
1305                 if (iplist_size == 0) {
1306                         if (domain->alt_name != NULL) {
1307                                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1308                                        &iplist_size, true);
1309                         }
1310                 }
1311
1312                 for ( i=0; i<iplist_size; i++ ) {
1313                         char addr[INET6_ADDRSTRLEN];
1314                         print_sockaddr(addr, sizeof(addr),
1315                                         &ip_list[i].ss);
1316                         add_one_dc_unique(mem_ctx,
1317                                         domain->name,
1318                                         addr,
1319                                         &ip_list[i].ss,
1320                                         dcs,
1321                                         num_dcs);
1322                 }
1323
1324                 SAFE_FREE(ip_list);
1325                 iplist_size = 0;
1326         }
1327
1328         return True;
1329 }
1330
1331 /*******************************************************************
1332  Find and make a connection to a DC in the given domain.
1333
1334  @param[in] mem_ctx talloc memory context to allocate from
1335  @param[in] domain domain to find a dc in
1336  @param[out] dcname NetBIOS or FQDN of DC that's connected to
1337  @param[out] pss DC Internet address and port
1338  @param[out] fd fd of the open socket connected to the newly found dc
1339  @return true when a DC connection is made, false otherwise
1340 *******************************************************************/
1341
1342 static bool find_new_dc(TALLOC_CTX *mem_ctx,
1343                         struct winbindd_domain *domain,
1344                         fstring dcname, struct sockaddr_storage *pss, int *fd)
1345 {
1346         struct dc_name_ip *dcs = NULL;
1347         int num_dcs = 0;
1348
1349         const char **dcnames = NULL;
1350         int num_dcnames = 0;
1351
1352         struct sockaddr_storage *addrs = NULL;
1353         int num_addrs = 0;
1354
1355         int i;
1356         size_t fd_index;
1357
1358         NTSTATUS status;
1359
1360         *fd = -1;
1361
1362  again:
1363         if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1364                 return False;
1365
1366         for (i=0; i<num_dcs; i++) {
1367
1368                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1369                                     &dcnames, &num_dcnames)) {
1370                         return False;
1371                 }
1372                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, TCP_SMB_PORT,
1373                                       &addrs, &num_addrs)) {
1374                         return False;
1375                 }
1376         }
1377
1378         if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1379                 return False;
1380
1381         if ((addrs == NULL) || (dcnames == NULL))
1382                 return False;
1383
1384         status = smbsock_any_connect(addrs, dcnames, NULL, NULL, NULL,
1385                                      num_addrs, 0, 10, fd, &fd_index, NULL);
1386         if (!NT_STATUS_IS_OK(status)) {
1387                 for (i=0; i<num_dcs; i++) {
1388                         char ab[INET6_ADDRSTRLEN];
1389                         print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1390                         DEBUG(10, ("find_new_dc: smbsock_any_connect failed for "
1391                                 "domain %s address %s. Error was %s\n",
1392                                    domain->name, ab, nt_errstr(status) ));
1393                         winbind_add_failed_connection_entry(domain,
1394                                 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1395                 }
1396                 return False;
1397         }
1398
1399         *pss = addrs[fd_index];
1400
1401         if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1402                 /* Ok, we've got a name for the DC */
1403                 fstrcpy(dcname, dcnames[fd_index]);
1404                 return True;
1405         }
1406
1407         /* Try to figure out the name */
1408         if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1409                 return True;
1410         }
1411
1412         /* We can not continue without the DC's name */
1413         winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1414                                     NT_STATUS_UNSUCCESSFUL);
1415
1416         /* Throw away all arrays as we're doing this again. */
1417         TALLOC_FREE(dcs);
1418         num_dcs = 0;
1419
1420         TALLOC_FREE(dcnames);
1421         num_dcnames = 0;
1422
1423         TALLOC_FREE(addrs);
1424         num_addrs = 0;
1425
1426         close(*fd);
1427         *fd = -1;
1428
1429         goto again;
1430 }
1431
1432 static char *current_dc_key(TALLOC_CTX *mem_ctx, const char *domain_name)
1433 {
1434         return talloc_asprintf_strupper_m(mem_ctx, "CURRENT_DCNAME/%s",
1435                                           domain_name);
1436 }
1437
1438 static void store_current_dc_in_gencache(const char *domain_name,
1439                                          const char *dc_name,
1440                                          struct cli_state *cli)
1441 {
1442         char addr[INET6_ADDRSTRLEN];
1443         char *key = NULL;
1444         char *value = NULL;
1445
1446         if (!cli_state_is_connected(cli)) {
1447                 return;
1448         }
1449
1450         print_sockaddr(addr, sizeof(addr),
1451                        smbXcli_conn_remote_sockaddr(cli->conn));
1452
1453         key = current_dc_key(talloc_tos(), domain_name);
1454         if (key == NULL) {
1455                 goto done;
1456         }
1457
1458         value = talloc_asprintf(talloc_tos(), "%s %s", addr, dc_name);
1459         if (value == NULL) {
1460                 goto done;
1461         }
1462
1463         gencache_set(key, value, 0x7fffffff);
1464 done:
1465         TALLOC_FREE(value);
1466         TALLOC_FREE(key);
1467 }
1468
1469 bool fetch_current_dc_from_gencache(TALLOC_CTX *mem_ctx,
1470                                     const char *domain_name,
1471                                     char **p_dc_name, char **p_dc_ip)
1472 {
1473         char *key, *value, *p;
1474         bool ret = false;
1475         char *dc_name = NULL;
1476         char *dc_ip = NULL;
1477
1478         key = current_dc_key(talloc_tos(), domain_name);
1479         if (key == NULL) {
1480                 goto done;
1481         }
1482         if (!gencache_get(key, &value, NULL)) {
1483                 goto done;
1484         }
1485         p = strchr(value, ' ');
1486         if (p == NULL) {
1487                 goto done;
1488         }
1489         dc_ip = talloc_strndup(mem_ctx, value, p - value);
1490         if (dc_ip == NULL) {
1491                 goto done;
1492         }
1493         dc_name = talloc_strdup(mem_ctx, p+1);
1494         if (dc_name == NULL) {
1495                 goto done;
1496         }
1497
1498         if (p_dc_ip != NULL) {
1499                 *p_dc_ip = dc_ip;
1500                 dc_ip = NULL;
1501         }
1502         if (p_dc_name != NULL) {
1503                 *p_dc_name = dc_name;
1504                 dc_name = NULL;
1505         }
1506         ret = true;
1507 done:
1508         TALLOC_FREE(dc_name);
1509         TALLOC_FREE(dc_ip);
1510         TALLOC_FREE(key);
1511         return ret;
1512 }
1513
1514 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
1515                                    struct winbindd_cm_conn *new_conn)
1516 {
1517         TALLOC_CTX *mem_ctx;
1518         NTSTATUS result;
1519         char *saf_servername = saf_fetch( domain->name );
1520         int retries;
1521
1522         if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1523                 SAFE_FREE(saf_servername);
1524                 set_domain_offline(domain);
1525                 return NT_STATUS_NO_MEMORY;
1526         }
1527
1528         /* we have to check the server affinity cache here since
1529            later we select a DC based on response time and not preference */
1530
1531         /* Check the negative connection cache
1532            before talking to it. It going down may have
1533            triggered the reconnection. */
1534
1535         if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1536
1537                 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1538                         saf_servername, domain->name ));
1539
1540                 /* convert an ip address to a name */
1541                 if (is_ipaddress( saf_servername ) ) {
1542                         fstring saf_name;
1543                         struct sockaddr_storage ss;
1544
1545                         if (!interpret_string_addr(&ss, saf_servername,
1546                                                 AI_NUMERICHOST)) {
1547                                 return NT_STATUS_UNSUCCESSFUL;
1548                         }
1549                         if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
1550                                 strlcpy(domain->dcname, saf_name, sizeof(domain->dcname));
1551                         } else {
1552                                 winbind_add_failed_connection_entry(
1553                                         domain, saf_servername,
1554                                         NT_STATUS_UNSUCCESSFUL);
1555                         }
1556                 } else {
1557                         fstrcpy( domain->dcname, saf_servername );
1558                 }
1559
1560                 SAFE_FREE( saf_servername );
1561         }
1562
1563         for (retries = 0; retries < 3; retries++) {
1564                 int fd = -1;
1565                 bool retry = False;
1566
1567                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1568
1569                 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1570                         domain->dcname, domain->name ));
1571
1572                 if (*domain->dcname
1573                         && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1574                         && (resolve_name(domain->dcname, &domain->dcaddr, 0x20, true)))
1575                 {
1576                         NTSTATUS status;
1577
1578                         status = smbsock_connect(&domain->dcaddr, 0,
1579                                                  NULL, -1, NULL, -1,
1580                                                  &fd, NULL, 10);
1581                         if (!NT_STATUS_IS_OK(status)) {
1582                                 fd = -1;
1583                         }
1584                 }
1585
1586                 if ((fd == -1)
1587                         && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
1588                 {
1589                         /* This is the one place where we will
1590                            set the global winbindd offline state
1591                            to true, if a "WINBINDD_OFFLINE" entry
1592                            is found in the winbindd cache. */
1593                         set_global_winbindd_state_offline();
1594                         break;
1595                 }
1596
1597                 new_conn->cli = NULL;
1598
1599                 result = cm_prepare_connection(domain, fd, domain->dcname,
1600                         &new_conn->cli, &retry);
1601
1602                 if (!retry)
1603                         break;
1604         }
1605
1606         if (NT_STATUS_IS_OK(result)) {
1607
1608                 winbindd_set_locator_kdc_envs(domain);
1609
1610                 if (domain->online == False) {
1611                         /* We're changing state from offline to online. */
1612                         set_global_winbindd_state_online();
1613                 }
1614                 set_domain_online(domain);
1615
1616                 /*
1617                  * Much as I hate global state, this seems to be the point
1618                  * where we can be certain that we have a proper connection to
1619                  * a DC. wbinfo --dc-info needs that information, store it in
1620                  * gencache with a looong timeout. This will need revisiting
1621                  * once we start to connect to multiple DCs, wbcDcInfo is
1622                  * already prepared for that.
1623                  */
1624                 store_current_dc_in_gencache(domain->name, domain->dcname,
1625                                              new_conn->cli);
1626         } else {
1627                 /* Ensure we setup the retry handler. */
1628                 set_domain_offline(domain);
1629         }
1630
1631         talloc_destroy(mem_ctx);
1632         return result;
1633 }
1634
1635 /* Close down all open pipes on a connection. */
1636
1637 void invalidate_cm_connection(struct winbindd_cm_conn *conn)
1638 {
1639         NTSTATUS result;
1640
1641         /* We're closing down a possibly dead
1642            connection. Don't have impossibly long (10s) timeouts. */
1643
1644         if (conn->cli) {
1645                 cli_set_timeout(conn->cli, 1000); /* 1 second. */
1646         }
1647
1648         if (conn->samr_pipe != NULL) {
1649                 if (is_valid_policy_hnd(&conn->sam_connect_handle)) {
1650                         dcerpc_samr_Close(conn->samr_pipe->binding_handle,
1651                                           talloc_tos(),
1652                                           &conn->sam_connect_handle,
1653                                           &result);
1654                 }
1655                 TALLOC_FREE(conn->samr_pipe);
1656                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1657                 if (conn->cli) {
1658                         cli_set_timeout(conn->cli, 500);
1659                 }
1660         }
1661
1662         if (conn->lsa_pipe != NULL) {
1663                 if (is_valid_policy_hnd(&conn->lsa_policy)) {
1664                         dcerpc_lsa_Close(conn->lsa_pipe->binding_handle,
1665                                          talloc_tos(),
1666                                          &conn->lsa_policy,
1667                                          &result);
1668                 }
1669                 TALLOC_FREE(conn->lsa_pipe);
1670                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1671                 if (conn->cli) {
1672                         cli_set_timeout(conn->cli, 500);
1673                 }
1674         }
1675
1676         if (conn->lsa_pipe_tcp != NULL) {
1677                 if (is_valid_policy_hnd(&conn->lsa_policy)) {
1678                         dcerpc_lsa_Close(conn->lsa_pipe_tcp->binding_handle,
1679                                          talloc_tos(),
1680                                          &conn->lsa_policy,
1681                                          &result);
1682                 }
1683                 TALLOC_FREE(conn->lsa_pipe_tcp);
1684                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1685                 if (conn->cli) {
1686                         cli_set_timeout(conn->cli, 500);
1687                 }
1688         }
1689
1690         if (conn->netlogon_pipe != NULL) {
1691                 TALLOC_FREE(conn->netlogon_pipe);
1692                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1693                 if (conn->cli) {
1694                         cli_set_timeout(conn->cli, 500);
1695                 }
1696         }
1697
1698         if (conn->cli) {
1699                 cli_shutdown(conn->cli);
1700         }
1701
1702         conn->cli = NULL;
1703 }
1704
1705 void close_conns_after_fork(void)
1706 {
1707         struct winbindd_domain *domain;
1708         struct winbindd_cli_state *cli_state;
1709
1710         for (domain = domain_list(); domain; domain = domain->next) {
1711                 /*
1712                  * first close the low level SMB TCP connection
1713                  * so that we don't generate any SMBclose
1714                  * requests in invalidate_cm_connection()
1715                  */
1716                 if (cli_state_is_connected(domain->conn.cli)) {
1717                         smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
1718                 }
1719
1720                 invalidate_cm_connection(&domain->conn);
1721         }
1722
1723         for (cli_state = winbindd_client_list();
1724              cli_state != NULL;
1725              cli_state = cli_state->next) {
1726                 if (cli_state->sock >= 0) {
1727                         close(cli_state->sock);
1728                         cli_state->sock = -1;
1729                 }
1730         }
1731 }
1732
1733 static bool connection_ok(struct winbindd_domain *domain)
1734 {
1735         bool ok;
1736
1737         ok = cli_state_is_connected(domain->conn.cli);
1738         if (!ok) {
1739                 DEBUG(3, ("connection_ok: Connection to %s for domain %s is not connected\n",
1740                           domain->dcname, domain->name));
1741                 return False;
1742         }
1743
1744         if (domain->online == False) {
1745                 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
1746                 return False;
1747         }
1748
1749         return True;
1750 }
1751
1752 /* Initialize a new connection up to the RPC BIND.
1753    Bypass online status check so always does network calls. */
1754
1755 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
1756 {
1757         NTSTATUS result;
1758
1759         /* Internal connections never use the network. */
1760         if (domain->internal) {
1761                 domain->initialized = True;
1762                 return NT_STATUS_OK;
1763         }
1764
1765         if (connection_ok(domain)) {
1766                 if (!domain->initialized) {
1767                         set_dc_type_and_flags(domain);
1768                 }
1769                 return NT_STATUS_OK;
1770         }
1771
1772         invalidate_cm_connection(&domain->conn);
1773
1774         result = cm_open_connection(domain, &domain->conn);
1775
1776         if (NT_STATUS_IS_OK(result) && !domain->initialized) {
1777                 set_dc_type_and_flags(domain);
1778         }
1779
1780         return result;
1781 }
1782
1783 NTSTATUS init_dc_connection(struct winbindd_domain *domain)
1784 {
1785         if (domain->internal) {
1786                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1787         }
1788
1789         if (domain->initialized && !domain->online) {
1790                 /* We check for online status elsewhere. */
1791                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1792         }
1793
1794         return init_dc_connection_network(domain);
1795 }
1796
1797 static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain)
1798 {
1799         NTSTATUS status;
1800
1801         status = init_dc_connection(domain);
1802         if (!NT_STATUS_IS_OK(status)) {
1803                 return status;
1804         }
1805
1806         if (!domain->internal && domain->conn.cli == NULL) {
1807                 /* happens for trusted domains without inbound trust */
1808                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
1809         }
1810
1811         return NT_STATUS_OK;
1812 }
1813
1814 /******************************************************************************
1815  Set the trust flags (direction and forest location) for a domain
1816 ******************************************************************************/
1817
1818 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
1819 {
1820         struct winbindd_domain *our_domain;
1821         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1822         WERROR werr;
1823         struct netr_DomainTrustList trusts;
1824         int i;
1825         uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
1826                         NETR_TRUST_FLAG_OUTBOUND |
1827                         NETR_TRUST_FLAG_INBOUND);
1828         struct rpc_pipe_client *cli;
1829         TALLOC_CTX *mem_ctx = NULL;
1830         struct dcerpc_binding_handle *b;
1831
1832         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
1833
1834         /* Our primary domain doesn't need to worry about trust flags.
1835            Force it to go through the network setup */
1836         if ( domain->primary ) {
1837                 return False;
1838         }
1839
1840         our_domain = find_our_domain();
1841
1842         if ( !connection_ok(our_domain) ) {
1843                 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1844                 return False;
1845         }
1846
1847         /* This won't work unless our domain is AD */
1848
1849         if ( !our_domain->active_directory ) {
1850                 return False;
1851         }
1852
1853         /* Use DsEnumerateDomainTrusts to get us the trust direction
1854            and type */
1855
1856         result = cm_connect_netlogon(our_domain, &cli);
1857
1858         if (!NT_STATUS_IS_OK(result)) {
1859                 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1860                           "a connection to %s for PIPE_NETLOGON (%s)\n",
1861                           domain->name, nt_errstr(result)));
1862                 return False;
1863         }
1864
1865         b = cli->binding_handle;
1866
1867         if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
1868                 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1869                 return False;
1870         }
1871
1872         result = dcerpc_netr_DsrEnumerateDomainTrusts(b, mem_ctx,
1873                                                       cli->desthost,
1874                                                       flags,
1875                                                       &trusts,
1876                                                       &werr);
1877         if (!NT_STATUS_IS_OK(result)) {
1878                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1879                         "failed to query trusted domain list: %s\n",
1880                         nt_errstr(result)));
1881                 talloc_destroy(mem_ctx);
1882                 return false;
1883         }
1884         if (!W_ERROR_IS_OK(werr)) {
1885                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1886                         "failed to query trusted domain list: %s\n",
1887                         win_errstr(werr)));
1888                 talloc_destroy(mem_ctx);
1889                 return false;
1890         }
1891
1892         /* Now find the domain name and get the flags */
1893
1894         for ( i=0; i<trusts.count; i++ ) {
1895                 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
1896                         domain->domain_flags          = trusts.array[i].trust_flags;
1897                         domain->domain_type           = trusts.array[i].trust_type;
1898                         domain->domain_trust_attribs  = trusts.array[i].trust_attributes;
1899
1900                         if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
1901                                 domain->active_directory = True;
1902
1903                         /* This flag is only set if the domain is *our*
1904                            primary domain and the primary domain is in
1905                            native mode */
1906
1907                         domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
1908
1909                         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1910                                   "native mode.\n", domain->name,
1911                                   domain->native_mode ? "" : "NOT "));
1912
1913                         DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1914                                  "running active directory.\n", domain->name,
1915                                  domain->active_directory ? "" : "NOT "));
1916
1917                         domain->can_do_ncacn_ip_tcp = domain->active_directory;
1918                         domain->can_do_validation6 = domain->active_directory;
1919
1920                         domain->initialized = True;
1921
1922                         break;
1923                 }
1924         }
1925
1926         talloc_destroy( mem_ctx );
1927
1928         return domain->initialized;
1929 }
1930
1931 /******************************************************************************
1932  We can 'sense' certain things about the DC by it's replies to certain
1933  questions.
1934
1935  This tells us if this particular remote server is Active Directory, and if it
1936  is native mode.
1937 ******************************************************************************/
1938
1939 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
1940 {
1941         NTSTATUS status, result;
1942         WERROR werr;
1943         TALLOC_CTX              *mem_ctx = NULL;
1944         struct rpc_pipe_client  *cli = NULL;
1945         struct policy_handle pol;
1946         union dssetup_DsRoleInfo info;
1947         union lsa_PolicyInformation *lsa_info = NULL;
1948
1949         if (!connection_ok(domain)) {
1950                 return;
1951         }
1952
1953         mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
1954                               domain->name);
1955         if (!mem_ctx) {
1956                 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1957                 return;
1958         }
1959
1960         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
1961
1962         status = cli_rpc_pipe_open_noauth(domain->conn.cli,
1963                                           &ndr_table_dssetup.syntax_id,
1964                                           &cli);
1965
1966         if (!NT_STATUS_IS_OK(status)) {
1967                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1968                           "PI_DSSETUP on domain %s: (%s)\n",
1969                           domain->name, nt_errstr(status)));
1970
1971                 /* if this is just a non-AD domain we need to continue
1972                  * identifying so that we can in the end return with
1973                  * domain->initialized = True - gd */
1974
1975                 goto no_dssetup;
1976         }
1977
1978         status = dcerpc_dssetup_DsRoleGetPrimaryDomainInformation(cli->binding_handle, mem_ctx,
1979                                                                   DS_ROLE_BASIC_INFORMATION,
1980                                                                   &info,
1981                                                                   &werr);
1982         TALLOC_FREE(cli);
1983
1984         if (NT_STATUS_IS_OK(status)) {
1985                 result = werror_to_ntstatus(werr);
1986         }
1987         if (!NT_STATUS_IS_OK(status)) {
1988                 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1989                           "on domain %s failed: (%s)\n",
1990                           domain->name, nt_errstr(status)));
1991
1992                 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1993                  * every opcode on the DSSETUP pipe, continue with
1994                  * no_dssetup mode here as well to get domain->initialized
1995                  * set - gd */
1996
1997                 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1998                         goto no_dssetup;
1999                 }
2000
2001                 TALLOC_FREE(mem_ctx);
2002                 return;
2003         }
2004
2005         if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
2006             !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
2007                 domain->native_mode = True;
2008         } else {
2009                 domain->native_mode = False;
2010         }
2011
2012 no_dssetup:
2013         status = cli_rpc_pipe_open_noauth(domain->conn.cli,
2014                                           &ndr_table_lsarpc.syntax_id, &cli);
2015
2016         if (!NT_STATUS_IS_OK(status)) {
2017                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
2018                           "PI_LSARPC on domain %s: (%s)\n",
2019                           domain->name, nt_errstr(status)));
2020                 TALLOC_FREE(cli);
2021                 TALLOC_FREE(mem_ctx);
2022                 return;
2023         }
2024
2025         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
2026                                          SEC_FLAG_MAXIMUM_ALLOWED, &pol);
2027
2028         if (NT_STATUS_IS_OK(status)) {
2029                 /* This particular query is exactly what Win2k clients use
2030                    to determine that the DC is active directory */
2031                 status = dcerpc_lsa_QueryInfoPolicy2(cli->binding_handle, mem_ctx,
2032                                                      &pol,
2033                                                      LSA_POLICY_INFO_DNS,
2034                                                      &lsa_info,
2035                                                      &result);
2036         }
2037
2038         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2039                 domain->active_directory = True;
2040
2041                 if (lsa_info->dns.name.string) {
2042                         fstrcpy(domain->name, lsa_info->dns.name.string);
2043                 }
2044
2045                 if (lsa_info->dns.dns_domain.string) {
2046                         fstrcpy(domain->alt_name,
2047                                 lsa_info->dns.dns_domain.string);
2048                 }
2049
2050                 /* See if we can set some domain trust flags about
2051                    ourself */
2052
2053                 if (lsa_info->dns.dns_forest.string) {
2054                         fstrcpy(domain->forest_name,
2055                                 lsa_info->dns.dns_forest.string);
2056
2057                         if (strequal(domain->forest_name, domain->alt_name)) {
2058                                 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
2059                         }
2060                 }
2061
2062                 if (lsa_info->dns.sid) {
2063                         sid_copy(&domain->sid, lsa_info->dns.sid);
2064                 }
2065         } else {
2066                 domain->active_directory = False;
2067
2068                 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
2069                                                 SEC_FLAG_MAXIMUM_ALLOWED,
2070                                                 &pol);
2071
2072                 if (!NT_STATUS_IS_OK(status)) {
2073                         goto done;
2074                 }
2075
2076                 status = dcerpc_lsa_QueryInfoPolicy(cli->binding_handle, mem_ctx,
2077                                                     &pol,
2078                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
2079                                                     &lsa_info,
2080                                                     &result);
2081                 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2082
2083                         if (lsa_info->account_domain.name.string) {
2084                                 fstrcpy(domain->name,
2085                                         lsa_info->account_domain.name.string);
2086                         }
2087
2088                         if (lsa_info->account_domain.sid) {
2089                                 sid_copy(&domain->sid, lsa_info->account_domain.sid);
2090                         }
2091                 }
2092         }
2093 done:
2094
2095         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
2096                   domain->name, domain->native_mode ? "" : "NOT "));
2097
2098         DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
2099                   domain->name, domain->active_directory ? "" : "NOT "));
2100
2101         domain->can_do_ncacn_ip_tcp = domain->active_directory;
2102         domain->can_do_validation6 = domain->active_directory;
2103
2104         TALLOC_FREE(cli);
2105
2106         TALLOC_FREE(mem_ctx);
2107
2108         domain->initialized = True;
2109 }
2110
2111 /**********************************************************************
2112  Set the domain_flags (trust attributes, domain operating modes, etc...
2113 ***********************************************************************/
2114
2115 static void set_dc_type_and_flags( struct winbindd_domain *domain )
2116 {
2117         /* we always have to contact our primary domain */
2118
2119         if ( domain->primary ) {
2120                 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
2121                           "primary domain\n"));
2122                 set_dc_type_and_flags_connect( domain );
2123                 return;
2124         }
2125
2126         /* Use our DC to get the information if possible */
2127
2128         if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
2129                 /* Otherwise, fallback to contacting the
2130                    domain directly */
2131                 set_dc_type_and_flags_connect( domain );
2132         }
2133
2134         return;
2135 }
2136
2137
2138
2139 /**********************************************************************
2140 ***********************************************************************/
2141
2142 static NTSTATUS cm_get_schannel_creds(struct winbindd_domain *domain,
2143                                    struct netlogon_creds_CredentialState **ppdc)
2144 {
2145         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2146         struct rpc_pipe_client *netlogon_pipe;
2147
2148         if (lp_client_schannel() == False) {
2149                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2150         }
2151
2152         result = cm_connect_netlogon(domain, &netlogon_pipe);
2153         if (!NT_STATUS_IS_OK(result)) {
2154                 return result;
2155         }
2156
2157         /* Return a pointer to the struct netlogon_creds_CredentialState from the
2158            netlogon pipe. */
2159
2160         if (!domain->conn.netlogon_pipe->dc) {
2161                 return NT_STATUS_INTERNAL_ERROR; /* This shouldn't happen. */
2162         }
2163
2164         *ppdc = domain->conn.netlogon_pipe->dc;
2165         return NT_STATUS_OK;
2166 }
2167
2168 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2169                         struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2170 {
2171         struct winbindd_cm_conn *conn;
2172         NTSTATUS status, result;
2173         struct netlogon_creds_CredentialState *p_creds;
2174         char *machine_password = NULL;
2175         char *machine_account = NULL;
2176         char *domain_name = NULL;
2177
2178         if (sid_check_is_our_sam(&domain->sid)) {
2179                 return open_internal_samr_conn(mem_ctx, domain, cli, sam_handle);
2180         }
2181
2182         status = init_dc_connection_rpc(domain);
2183         if (!NT_STATUS_IS_OK(status)) {
2184                 return status;
2185         }
2186
2187         conn = &domain->conn;
2188
2189         if (rpccli_is_connected(conn->samr_pipe)) {
2190                 goto done;
2191         }
2192
2193         TALLOC_FREE(conn->samr_pipe);
2194
2195         /*
2196          * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2197          * sign and sealed pipe using the machine account password by
2198          * preference. If we can't - try schannel, if that fails, try
2199          * anonymous.
2200          */
2201
2202         if ((conn->cli->user_name[0] == '\0') ||
2203             (conn->cli->domain[0] == '\0') ||
2204             (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
2205         {
2206                 status = get_trust_creds(domain, &machine_password,
2207                                          &machine_account, NULL);
2208                 if (!NT_STATUS_IS_OK(status)) {
2209                         DEBUG(10, ("cm_connect_sam: No no user available for "
2210                                    "domain %s, trying schannel\n", conn->cli->domain));
2211                         goto schannel;
2212                 }
2213                 domain_name = domain->name;
2214         } else {
2215                 machine_password = SMB_STRDUP(conn->cli->password);
2216                 machine_account = SMB_STRDUP(conn->cli->user_name);
2217                 domain_name = conn->cli->domain;
2218         }
2219
2220         if (!machine_password || !machine_account) {
2221                 status = NT_STATUS_NO_MEMORY;
2222                 goto done;
2223         }
2224
2225         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2226            authenticated SAMR pipe with sign & seal. */
2227         status = cli_rpc_pipe_open_spnego(conn->cli,
2228                                           &ndr_table_samr,
2229                                           NCACN_NP,
2230                                           GENSEC_OID_NTLMSSP,
2231                                           DCERPC_AUTH_LEVEL_PRIVACY,
2232                                           smbXcli_conn_remote_name(conn->cli->conn),
2233                                           domain_name,
2234                                           machine_account,
2235                                           machine_password,
2236                                           &conn->samr_pipe);
2237
2238         if (!NT_STATUS_IS_OK(status)) {
2239                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2240                           "pipe for domain %s using NTLMSSP "
2241                           "authenticated pipe: user %s\\%s. Error was "
2242                           "%s\n", domain->name, domain_name,
2243                           machine_account, nt_errstr(status)));
2244                 goto schannel;
2245         }
2246
2247         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2248                   "domain %s using NTLMSSP authenticated "
2249                   "pipe: user %s\\%s\n", domain->name,
2250                   domain_name, machine_account));
2251
2252         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2253                                       conn->samr_pipe->desthost,
2254                                       SEC_FLAG_MAXIMUM_ALLOWED,
2255                                       &conn->sam_connect_handle,
2256                                       &result);
2257         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2258                 goto open_domain;
2259         }
2260         if (NT_STATUS_IS_OK(status)) {
2261                 status = result;
2262         }
2263
2264         DEBUG(10,("cm_connect_sam: ntlmssp-sealed dcerpc_samr_Connect2 "
2265                   "failed for domain %s, error was %s. Trying schannel\n",
2266                   domain->name, nt_errstr(status) ));
2267         TALLOC_FREE(conn->samr_pipe);
2268
2269  schannel:
2270
2271         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2272
2273         status = cm_get_schannel_creds(domain, &p_creds);
2274         if (!NT_STATUS_IS_OK(status)) {
2275                 /* If this call fails - conn->cli can now be NULL ! */
2276                 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2277                            "for domain %s (error %s), trying anon\n",
2278                         domain->name,
2279                         nt_errstr(status) ));
2280                 goto anonymous;
2281         }
2282         status = cli_rpc_pipe_open_schannel_with_key
2283                 (conn->cli, &ndr_table_samr.syntax_id, NCACN_NP,
2284                  DCERPC_AUTH_LEVEL_PRIVACY,
2285                  domain->name, &p_creds, &conn->samr_pipe);
2286
2287         if (!NT_STATUS_IS_OK(status)) {
2288                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2289                           "domain %s using schannel. Error was %s\n",
2290                           domain->name, nt_errstr(status) ));
2291                 goto anonymous;
2292         }
2293         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2294                   "schannel.\n", domain->name ));
2295
2296         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2297                                       conn->samr_pipe->desthost,
2298                                       SEC_FLAG_MAXIMUM_ALLOWED,
2299                                       &conn->sam_connect_handle,
2300                                       &result);
2301         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2302                 goto open_domain;
2303         }
2304         if (NT_STATUS_IS_OK(status)) {
2305                 status = result;
2306         }
2307         DEBUG(10,("cm_connect_sam: schannel-sealed dcerpc_samr_Connect2 failed "
2308                   "for domain %s, error was %s. Trying anonymous\n",
2309                   domain->name, nt_errstr(status) ));
2310         TALLOC_FREE(conn->samr_pipe);
2311
2312  anonymous:
2313
2314         /* Finally fall back to anonymous. */
2315         status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
2316                                           &conn->samr_pipe);
2317
2318         if (!NT_STATUS_IS_OK(status)) {
2319                 goto done;
2320         }
2321
2322         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2323                                       conn->samr_pipe->desthost,
2324                                       SEC_FLAG_MAXIMUM_ALLOWED,
2325                                       &conn->sam_connect_handle,
2326                                       &result);
2327         if (!NT_STATUS_IS_OK(status)) {
2328                 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2329                           "for domain %s Error was %s\n",
2330                           domain->name, nt_errstr(status) ));
2331                 goto done;
2332         }
2333         if (!NT_STATUS_IS_OK(result)) {
2334                 status = result;
2335                 DEBUG(10,("cm_connect_sam: dcerpc_samr_Connect2 failed "
2336                           "for domain %s Error was %s\n",
2337                           domain->name, nt_errstr(result)));
2338                 goto done;
2339         }
2340
2341  open_domain:
2342         status = dcerpc_samr_OpenDomain(conn->samr_pipe->binding_handle,
2343                                         mem_ctx,
2344                                         &conn->sam_connect_handle,
2345                                         SEC_FLAG_MAXIMUM_ALLOWED,
2346                                         &domain->sid,
2347                                         &conn->sam_domain_handle,
2348                                         &result);
2349         if (!NT_STATUS_IS_OK(status)) {
2350                 goto done;
2351         }
2352
2353         status = result;
2354  done:
2355
2356         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
2357                 /*
2358                  * if we got access denied, we might just have no access rights
2359                  * to talk to the remote samr server server (e.g. when we are a
2360                  * PDC and we are connecting a w2k8 pdc via an interdomain
2361                  * trust). In that case do not invalidate the whole connection
2362                  * stack
2363                  */
2364                 TALLOC_FREE(conn->samr_pipe);
2365                 ZERO_STRUCT(conn->sam_domain_handle);
2366                 return status;
2367         } else if (!NT_STATUS_IS_OK(status)) {
2368                 invalidate_cm_connection(conn);
2369                 return status;
2370         }
2371
2372         *cli = conn->samr_pipe;
2373         *sam_handle = conn->sam_domain_handle;
2374         SAFE_FREE(machine_password);
2375         SAFE_FREE(machine_account);
2376         return status;
2377 }
2378
2379 /**********************************************************************
2380  open an schanneld ncacn_ip_tcp connection to LSA
2381 ***********************************************************************/
2382
2383 NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
2384                             TALLOC_CTX *mem_ctx,
2385                             struct rpc_pipe_client **cli)
2386 {
2387         struct winbindd_cm_conn *conn;
2388         struct netlogon_creds_CredentialState *creds;
2389         NTSTATUS status;
2390
2391         DEBUG(10,("cm_connect_lsa_tcp\n"));
2392
2393         status = init_dc_connection_rpc(domain);
2394         if (!NT_STATUS_IS_OK(status)) {
2395                 return status;
2396         }
2397
2398         conn = &domain->conn;
2399
2400         if (conn->lsa_pipe_tcp &&
2401             conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2402             conn->lsa_pipe_tcp->auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY &&
2403             rpccli_is_connected(conn->lsa_pipe_tcp)) {
2404                 goto done;
2405         }
2406
2407         TALLOC_FREE(conn->lsa_pipe_tcp);
2408
2409         status = cm_get_schannel_creds(domain, &creds);
2410         if (!NT_STATUS_IS_OK(status)) {
2411                 goto done;
2412         }
2413
2414         status = cli_rpc_pipe_open_schannel_with_key(conn->cli,
2415                                                      &ndr_table_lsarpc.syntax_id,
2416                                                      NCACN_IP_TCP,
2417                                                      DCERPC_AUTH_LEVEL_PRIVACY,
2418                                                      domain->name,
2419                                                      &creds,
2420                                                      &conn->lsa_pipe_tcp);
2421         if (!NT_STATUS_IS_OK(status)) {
2422                 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
2423                         nt_errstr(status)));
2424                 goto done;
2425         }
2426
2427  done:
2428         if (!NT_STATUS_IS_OK(status)) {
2429                 TALLOC_FREE(conn->lsa_pipe_tcp);
2430                 return status;
2431         }
2432
2433         *cli = conn->lsa_pipe_tcp;
2434
2435         return status;
2436 }
2437
2438 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2439                         struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2440 {
2441         struct winbindd_cm_conn *conn;
2442         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2443         struct netlogon_creds_CredentialState *p_creds;
2444
2445         result = init_dc_connection_rpc(domain);
2446         if (!NT_STATUS_IS_OK(result))
2447                 return result;
2448
2449         conn = &domain->conn;
2450
2451         if (rpccli_is_connected(conn->lsa_pipe)) {
2452                 goto done;
2453         }
2454
2455         TALLOC_FREE(conn->lsa_pipe);
2456
2457         if ((conn->cli->user_name[0] == '\0') ||
2458             (conn->cli->domain[0] == '\0') ||
2459             (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
2460                 DEBUG(10, ("cm_connect_lsa: No no user available for "
2461                            "domain %s, trying schannel\n", conn->cli->domain));
2462                 goto schannel;
2463         }
2464
2465         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2466          * authenticated LSA pipe with sign & seal. */
2467         result = cli_rpc_pipe_open_spnego
2468                 (conn->cli, &ndr_table_lsarpc, NCACN_NP,
2469                  GENSEC_OID_NTLMSSP,
2470                  DCERPC_AUTH_LEVEL_PRIVACY,
2471                  smbXcli_conn_remote_name(conn->cli->conn),
2472                  conn->cli->domain, conn->cli->user_name, conn->cli->password,
2473                  &conn->lsa_pipe);
2474
2475         if (!NT_STATUS_IS_OK(result)) {
2476                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2477                           "domain %s using NTLMSSP authenticated pipe: user "
2478                           "%s\\%s. Error was %s. Trying schannel.\n",
2479                           domain->name, conn->cli->domain,
2480                           conn->cli->user_name, nt_errstr(result)));
2481                 goto schannel;
2482         }
2483
2484         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2485                   "NTLMSSP authenticated pipe: user %s\\%s\n",
2486                   domain->name, conn->cli->domain, conn->cli->user_name ));
2487
2488         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2489                                         SEC_FLAG_MAXIMUM_ALLOWED,
2490                                         &conn->lsa_policy);
2491         if (NT_STATUS_IS_OK(result)) {
2492                 goto done;
2493         }
2494
2495         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2496                   "schannel\n"));
2497
2498         TALLOC_FREE(conn->lsa_pipe);
2499
2500  schannel:
2501
2502         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2503
2504         result = cm_get_schannel_creds(domain, &p_creds);
2505         if (!NT_STATUS_IS_OK(result)) {
2506                 /* If this call fails - conn->cli can now be NULL ! */
2507                 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2508                            "for domain %s (error %s), trying anon\n",
2509                         domain->name,
2510                         nt_errstr(result) ));
2511                 goto anonymous;
2512         }
2513         result = cli_rpc_pipe_open_schannel_with_key
2514                 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2515                  DCERPC_AUTH_LEVEL_PRIVACY,
2516                  domain->name, &p_creds, &conn->lsa_pipe);
2517
2518         if (!NT_STATUS_IS_OK(result)) {
2519                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2520                           "domain %s using schannel. Error was %s\n",
2521                           domain->name, nt_errstr(result) ));
2522                 goto anonymous;
2523         }
2524         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2525                   "schannel.\n", domain->name ));
2526
2527         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2528                                         SEC_FLAG_MAXIMUM_ALLOWED,
2529                                         &conn->lsa_policy);
2530         if (NT_STATUS_IS_OK(result)) {
2531                 goto done;
2532         }
2533
2534         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2535                   "anonymous\n"));
2536
2537         TALLOC_FREE(conn->lsa_pipe);
2538
2539  anonymous:
2540
2541         result = cli_rpc_pipe_open_noauth(conn->cli,
2542                                           &ndr_table_lsarpc.syntax_id,
2543                                           &conn->lsa_pipe);
2544         if (!NT_STATUS_IS_OK(result)) {
2545                 result = NT_STATUS_PIPE_NOT_AVAILABLE;
2546                 goto done;
2547         }
2548
2549         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2550                                         SEC_FLAG_MAXIMUM_ALLOWED,
2551                                         &conn->lsa_policy);
2552  done:
2553         if (!NT_STATUS_IS_OK(result)) {
2554                 invalidate_cm_connection(conn);
2555                 return result;
2556         }
2557
2558         *cli = conn->lsa_pipe;
2559         *lsa_policy = conn->lsa_policy;
2560         return result;
2561 }
2562
2563 /****************************************************************************
2564  Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2565  session key stored in conn->netlogon_pipe->dc->sess_key.
2566 ****************************************************************************/
2567
2568 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
2569                              struct rpc_pipe_client **cli)
2570 {
2571         struct winbindd_cm_conn *conn;
2572         NTSTATUS result;
2573
2574         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES;
2575         uint8  mach_pwd[16];
2576         enum netr_SchannelType sec_chan_type;
2577         const char *account_name;
2578         struct rpc_pipe_client *netlogon_pipe = NULL;
2579
2580         *cli = NULL;
2581
2582         result = init_dc_connection_rpc(domain);
2583         if (!NT_STATUS_IS_OK(result)) {
2584                 return result;
2585         }
2586
2587         conn = &domain->conn;
2588
2589         if (rpccli_is_connected(conn->netlogon_pipe)) {
2590                 *cli = conn->netlogon_pipe;
2591                 return NT_STATUS_OK;
2592         }
2593
2594         TALLOC_FREE(conn->netlogon_pipe);
2595
2596         result = cli_rpc_pipe_open_noauth(conn->cli,
2597                                           &ndr_table_netlogon.syntax_id,
2598                                           &netlogon_pipe);
2599         if (!NT_STATUS_IS_OK(result)) {
2600                 return result;
2601         }
2602
2603         if ((!IS_DC) && (!domain->primary)) {
2604                 /* Clear the schannel request bit and drop down */
2605                 neg_flags &= ~NETLOGON_NEG_SCHANNEL;
2606                 goto no_schannel;
2607         }
2608
2609         if (lp_client_schannel() != False) {
2610                 neg_flags |= NETLOGON_NEG_SCHANNEL;
2611         }
2612
2613         if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
2614                                &sec_chan_type))
2615         {
2616                 TALLOC_FREE(netlogon_pipe);
2617                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2618         }
2619
2620         result = rpccli_netlogon_setup_creds(
2621                  netlogon_pipe,
2622                  domain->dcname, /* server name. */
2623                  domain->name,   /* domain name */
2624                  lp_netbios_name(), /* client name */
2625                  account_name,   /* machine account */
2626                  mach_pwd,       /* machine password */
2627                  sec_chan_type,  /* from get_trust_pw */
2628                  &neg_flags);
2629
2630         if (!NT_STATUS_IS_OK(result)) {
2631                 TALLOC_FREE(netlogon_pipe);
2632                 return result;
2633         }
2634
2635         if ((lp_client_schannel() == True) &&
2636                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2637                 DEBUG(3, ("Server did not offer schannel\n"));
2638                 TALLOC_FREE(netlogon_pipe);
2639                 return NT_STATUS_ACCESS_DENIED;
2640         }
2641
2642  no_schannel:
2643         if ((lp_client_schannel() == False) ||
2644                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2645                 /*
2646                  * NetSamLogonEx only works for schannel
2647                  */
2648                 domain->can_do_samlogon_ex = False;
2649
2650                 /* We're done - just keep the existing connection to NETLOGON
2651                  * open */
2652                 conn->netlogon_pipe = netlogon_pipe;
2653                 *cli = conn->netlogon_pipe;
2654                 return NT_STATUS_OK;
2655         }
2656
2657         /* Using the credentials from the first pipe, open a signed and sealed
2658            second netlogon pipe. The session key is stored in the schannel
2659            part of the new pipe auth struct.
2660         */
2661
2662         result = cli_rpc_pipe_open_schannel_with_key(
2663                 conn->cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
2664                 DCERPC_AUTH_LEVEL_PRIVACY, domain->name, &netlogon_pipe->dc,
2665                 &conn->netlogon_pipe);
2666
2667         /* We can now close the initial netlogon pipe. */
2668         TALLOC_FREE(netlogon_pipe);
2669
2670         if (!NT_STATUS_IS_OK(result)) {
2671                 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2672                           "was %s\n", nt_errstr(result)));
2673
2674                 invalidate_cm_connection(conn);
2675                 return result;
2676         }
2677
2678         /*
2679          * Always try netr_LogonSamLogonEx. We will fall back for NT4
2680          * which gives DCERPC_FAULT_OP_RNG_ERROR (function not
2681          * supported). We used to only try SamLogonEx for AD, but
2682          * Samba DCs can also do it. And because we don't distinguish
2683          * between Samba and NT4, always try it once.
2684          */
2685         domain->can_do_samlogon_ex = true;
2686
2687         *cli = conn->netlogon_pipe;
2688         return NT_STATUS_OK;
2689 }
2690
2691 void winbind_msg_ip_dropped(struct messaging_context *msg_ctx,
2692                             void *private_data,
2693                             uint32_t msg_type,
2694                             struct server_id server_id,
2695                             DATA_BLOB *data)
2696 {
2697         struct winbindd_domain *domain;
2698         char *freeit = NULL;
2699         char *addr;
2700
2701         if ((data == NULL)
2702             || (data->data == NULL)
2703             || (data->length == 0)
2704             || (data->data[data->length-1] != '\0')) {
2705                 DEBUG(1, ("invalid msg_ip_dropped message: not a valid "
2706                           "string\n"));
2707                 return;
2708         }
2709
2710         addr = (char *)data->data;
2711         DEBUG(10, ("IP %s dropped\n", addr));
2712
2713         if (!is_ipaddress(addr)) {
2714                 char *slash;
2715                 /*
2716                  * Some code sends us ip addresses with the /netmask
2717                  * suffix
2718                  */
2719                 slash = strchr(addr, '/');
2720                 if (slash == NULL) {
2721                         DEBUG(1, ("invalid msg_ip_dropped message: %s",
2722                                   addr));
2723                         return;
2724                 }
2725                 freeit = talloc_strndup(talloc_tos(), addr, slash-addr);
2726                 if (freeit == NULL) {
2727                         DEBUG(1, ("talloc failed\n"));
2728                         return;
2729                 }
2730                 addr = freeit;
2731                 DEBUG(10, ("Stripped /netmask to IP %s\n", addr));
2732         }
2733
2734         for (domain = domain_list(); domain != NULL; domain = domain->next) {
2735                 char sockaddr[INET6_ADDRSTRLEN];
2736
2737                 if (!cli_state_is_connected(domain->conn.cli)) {
2738                         continue;
2739                 }
2740
2741                 print_sockaddr(sockaddr, sizeof(sockaddr),
2742                                smbXcli_conn_local_sockaddr(domain->conn.cli->conn));
2743
2744                 if (strequal(sockaddr, addr)) {
2745                         smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
2746                 }
2747         }
2748         TALLOC_FREE(freeit);
2749 }