s3:winbindd: s/struct timed_event/struct tevent_timer
[Samba/gebeck_regimport.git] / source3 / winbindd / winbindd_cm.c
blobb2f8cc481a0b923733efe3a7268a116bf0d94812
1 /*
2 Unix SMB/CIFS implementation.
4 Winbind daemon connection manager
6 Copyright (C) Tim Potter 2001
7 Copyright (C) Andrew Bartlett 2002
8 Copyright (C) Gerald (Jerry) Carter 2003-2005.
9 Copyright (C) Volker Lendecke 2004-2005
10 Copyright (C) Jeremy Allison 2006
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 We need to manage connections to domain controllers without having to
28 mess up the main winbindd code with other issues. The aim of the
29 connection manager is to:
31 - make connections to domain controllers and cache them
32 - re-establish connections when networks or servers go down
33 - centralise the policy on connection timeouts, domain controller
34 selection etc
35 - manage re-entrancy for when winbindd becomes able to handle
36 multiple outstanding rpc requests
38 Why not have connection management as part of the rpc layer like tng?
39 Good question. This code may morph into libsmb/rpc_cache.c or something
40 like that but at the moment it's simply staying as part of winbind. I
41 think the TNG architecture of forcing every user of the rpc layer to use
42 the connection caching system is a bad idea. It should be an optional
43 method of using the routines.
45 The TNG design is quite good but I disagree with some aspects of the
46 implementation. -tpot
51 TODO:
53 - I'm pretty annoyed by all the make_nmb_name() stuff. It should be
54 moved down into another function.
56 - Take care when destroying cli_structs as they can be shared between
57 various sam handles.
61 #include "includes.h"
62 #include "winbindd.h"
63 #include "../libcli/auth/libcli_auth.h"
64 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
65 #include "rpc_client/cli_pipe.h"
66 #include "rpc_client/cli_netlogon.h"
67 #include "../librpc/gen_ndr/ndr_samr_c.h"
68 #include "../librpc/gen_ndr/ndr_lsa_c.h"
69 #include "rpc_client/cli_lsarpc.h"
70 #include "../librpc/gen_ndr/ndr_dssetup_c.h"
71 #include "libads/sitename_cache.h"
72 #include "libsmb/libsmb.h"
73 #include "libsmb/clidgram.h"
74 #include "ads.h"
75 #include "secrets.h"
76 #include "../libcli/security/security.h"
77 #include "passdb.h"
78 #include "messages.h"
79 #include "auth/gensec/gensec.h"
80 #include "../libcli/smb/smbXcli_base.h"
81 #include "lib/param/loadparm.h"
83 #undef DBGC_CLASS
84 #define DBGC_CLASS DBGC_WINBIND
86 struct dc_name_ip {
87 fstring name;
88 struct sockaddr_storage ss;
91 extern struct winbindd_methods reconnect_methods;
92 extern bool override_logfile;
94 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
95 static void set_dc_type_and_flags( struct winbindd_domain *domain );
96 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
97 struct dc_name_ip **dcs, int *num_dcs);
99 /****************************************************************
100 Child failed to find DC's. Reschedule check.
101 ****************************************************************/
103 static void msg_failed_to_go_online(struct messaging_context *msg,
104 void *private_data,
105 uint32_t msg_type,
106 struct server_id server_id,
107 DATA_BLOB *data)
109 struct winbindd_domain *domain;
110 const char *domainname = (const char *)data->data;
112 if (data->data == NULL || data->length == 0) {
113 return;
116 DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
118 for (domain = domain_list(); domain; domain = domain->next) {
119 if (domain->internal) {
120 continue;
123 if (strequal(domain->name, domainname)) {
124 if (domain->online) {
125 /* We're already online, ignore. */
126 DEBUG(5,("msg_fail_to_go_online: domain %s "
127 "already online.\n", domainname));
128 continue;
131 /* Reschedule the online check. */
132 set_domain_offline(domain);
133 break;
138 /****************************************************************
139 Actually cause a reconnect from a message.
140 ****************************************************************/
142 static void msg_try_to_go_online(struct messaging_context *msg,
143 void *private_data,
144 uint32_t msg_type,
145 struct server_id server_id,
146 DATA_BLOB *data)
148 struct winbindd_domain *domain;
149 const char *domainname = (const char *)data->data;
151 if (data->data == NULL || data->length == 0) {
152 return;
155 DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
157 for (domain = domain_list(); domain; domain = domain->next) {
158 if (domain->internal) {
159 continue;
162 if (strequal(domain->name, domainname)) {
164 if (domain->online) {
165 /* We're already online, ignore. */
166 DEBUG(5,("msg_try_to_go_online: domain %s "
167 "already online.\n", domainname));
168 continue;
171 /* This call takes care of setting the online
172 flag to true if we connected, or re-adding
173 the offline handler if false. Bypasses online
174 check so always does network calls. */
176 init_dc_connection_network(domain);
177 break;
182 /****************************************************************
183 Fork a child to try and contact a DC. Do this as contacting a
184 DC requires blocking lookups and we don't want to block our
185 parent.
186 ****************************************************************/
188 static bool fork_child_dc_connect(struct winbindd_domain *domain)
190 struct dc_name_ip *dcs = NULL;
191 int num_dcs = 0;
192 TALLOC_CTX *mem_ctx = NULL;
193 pid_t parent_pid = getpid();
194 char *lfile = NULL;
195 NTSTATUS status;
197 if (domain->dc_probe_pid != (pid_t)-1) {
199 * We might already have a DC probe
200 * child working, check.
202 if (process_exists_by_pid(domain->dc_probe_pid)) {
203 DEBUG(10,("fork_child_dc_connect: pid %u already "
204 "checking for DC's.\n",
205 (unsigned int)domain->dc_probe_pid));
206 return true;
208 domain->dc_probe_pid = (pid_t)-1;
211 domain->dc_probe_pid = fork();
213 if (domain->dc_probe_pid == (pid_t)-1) {
214 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
215 return False;
218 if (domain->dc_probe_pid != (pid_t)0) {
219 /* Parent */
220 messaging_register(winbind_messaging_context(), NULL,
221 MSG_WINBIND_TRY_TO_GO_ONLINE,
222 msg_try_to_go_online);
223 messaging_register(winbind_messaging_context(), NULL,
224 MSG_WINBIND_FAILED_TO_GO_ONLINE,
225 msg_failed_to_go_online);
226 return True;
229 /* Child. */
231 /* Leave messages blocked - we will never process one. */
233 if (!override_logfile) {
234 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
235 DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
236 _exit(1);
240 status = winbindd_reinit_after_fork(NULL, lfile);
241 if (!NT_STATUS_IS_OK(status)) {
242 DEBUG(1, ("winbindd_reinit_after_fork failed: %s\n",
243 nt_errstr(status)));
244 messaging_send_buf(winbind_messaging_context(),
245 pid_to_procid(parent_pid),
246 MSG_WINBIND_FAILED_TO_GO_ONLINE,
247 (uint8 *)domain->name,
248 strlen(domain->name)+1);
249 _exit(1);
251 SAFE_FREE(lfile);
253 mem_ctx = talloc_init("fork_child_dc_connect");
254 if (!mem_ctx) {
255 DEBUG(0,("talloc_init failed.\n"));
256 messaging_send_buf(winbind_messaging_context(),
257 pid_to_procid(parent_pid),
258 MSG_WINBIND_FAILED_TO_GO_ONLINE,
259 (uint8 *)domain->name,
260 strlen(domain->name)+1);
261 _exit(1);
264 if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
265 /* Still offline ? Can't find DC's. */
266 messaging_send_buf(winbind_messaging_context(),
267 pid_to_procid(parent_pid),
268 MSG_WINBIND_FAILED_TO_GO_ONLINE,
269 (uint8 *)domain->name,
270 strlen(domain->name)+1);
271 _exit(0);
274 /* We got a DC. Send a message to our parent to get it to
275 try and do the same. */
277 messaging_send_buf(winbind_messaging_context(),
278 pid_to_procid(parent_pid),
279 MSG_WINBIND_TRY_TO_GO_ONLINE,
280 (uint8 *)domain->name,
281 strlen(domain->name)+1);
282 _exit(0);
285 /****************************************************************
286 Handler triggered if we're offline to try and detect a DC.
287 ****************************************************************/
289 static void check_domain_online_handler(struct tevent_context *ctx,
290 struct tevent_timer *te,
291 struct timeval now,
292 void *private_data)
294 struct winbindd_domain *domain =
295 (struct winbindd_domain *)private_data;
297 DEBUG(10,("check_domain_online_handler: called for domain "
298 "%s (online = %s)\n", domain->name,
299 domain->online ? "True" : "False" ));
301 TALLOC_FREE(domain->check_online_event);
303 /* Are we still in "startup" mode ? */
305 if (domain->startup && (time_mono(NULL) > domain->startup_time + 30)) {
306 /* No longer in "startup" mode. */
307 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
308 domain->name ));
309 domain->startup = False;
312 /* We've been told to stay offline, so stay
313 that way. */
315 if (get_global_winbindd_state_offline()) {
316 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
317 domain->name ));
318 return;
321 /* Fork a child to test if it can contact a DC.
322 If it can then send ourselves a message to
323 cause a reconnect. */
325 fork_child_dc_connect(domain);
328 /****************************************************************
329 If we're still offline setup the timeout check.
330 ****************************************************************/
332 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
334 int wbr = lp_winbind_reconnect_delay();
336 if (domain->startup) {
337 domain->check_online_timeout = 10;
338 } else if (domain->check_online_timeout < wbr) {
339 domain->check_online_timeout = wbr;
343 /****************************************************************
344 Set domain offline and also add handler to put us back online
345 if we detect a DC.
346 ****************************************************************/
348 void set_domain_offline(struct winbindd_domain *domain)
350 DEBUG(10,("set_domain_offline: called for domain %s\n",
351 domain->name ));
353 TALLOC_FREE(domain->check_online_event);
355 if (domain->internal) {
356 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
357 domain->name ));
358 return;
361 domain->online = False;
363 /* Offline domains are always initialized. They're
364 re-initialized when they go back online. */
366 domain->initialized = True;
368 /* We only add the timeout handler that checks and
369 allows us to go back online when we've not
370 been told to remain offline. */
372 if (get_global_winbindd_state_offline()) {
373 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
374 domain->name ));
375 return;
378 /* If we're in startup mode, check again in 10 seconds, not in
379 lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
381 calc_new_online_timeout_check(domain);
383 domain->check_online_event = event_add_timed(winbind_event_context(),
384 NULL,
385 timeval_current_ofs(domain->check_online_timeout,0),
386 check_domain_online_handler,
387 domain);
389 /* The above *has* to succeed for winbindd to work. */
390 if (!domain->check_online_event) {
391 smb_panic("set_domain_offline: failed to add online handler");
394 DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
395 domain->name ));
397 /* Send an offline message to the idmap child when our
398 primary domain goes offline */
400 if ( domain->primary ) {
401 struct winbindd_child *idmap = idmap_child();
403 if ( idmap->pid != 0 ) {
404 messaging_send_buf(winbind_messaging_context(),
405 pid_to_procid(idmap->pid),
406 MSG_WINBIND_OFFLINE,
407 (uint8 *)domain->name,
408 strlen(domain->name)+1);
412 return;
415 /****************************************************************
416 Set domain online - if allowed.
417 ****************************************************************/
419 static void set_domain_online(struct winbindd_domain *domain)
421 DEBUG(10,("set_domain_online: called for domain %s\n",
422 domain->name ));
424 if (domain->internal) {
425 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
426 domain->name ));
427 return;
430 if (get_global_winbindd_state_offline()) {
431 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
432 domain->name ));
433 return;
436 winbindd_set_locator_kdc_envs(domain);
438 /* If we are waiting to get a krb5 ticket, trigger immediately. */
439 ccache_regain_all_now();
441 /* Ok, we're out of any startup mode now... */
442 domain->startup = False;
444 if (domain->online == False) {
445 /* We were offline - now we're online. We default to
446 using the MS-RPC backend if we started offline,
447 and if we're going online for the first time we
448 should really re-initialize the backends and the
449 checks to see if we're talking to an AD or NT domain.
452 domain->initialized = False;
454 /* 'reconnect_methods' is the MS-RPC backend. */
455 if (domain->backend == &reconnect_methods) {
456 domain->backend = NULL;
460 /* Ensure we have no online timeout checks. */
461 domain->check_online_timeout = 0;
462 TALLOC_FREE(domain->check_online_event);
464 /* Ensure we ignore any pending child messages. */
465 messaging_deregister(winbind_messaging_context(),
466 MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
467 messaging_deregister(winbind_messaging_context(),
468 MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
470 domain->online = True;
472 /* Send an online message to the idmap child when our
473 primary domain comes online */
475 if ( domain->primary ) {
476 struct winbindd_child *idmap = idmap_child();
478 if ( idmap->pid != 0 ) {
479 messaging_send_buf(winbind_messaging_context(),
480 pid_to_procid(idmap->pid),
481 MSG_WINBIND_ONLINE,
482 (uint8 *)domain->name,
483 strlen(domain->name)+1);
487 return;
490 /****************************************************************
491 Requested to set a domain online.
492 ****************************************************************/
494 void set_domain_online_request(struct winbindd_domain *domain)
496 struct timeval tev;
498 DEBUG(10,("set_domain_online_request: called for domain %s\n",
499 domain->name ));
501 if (get_global_winbindd_state_offline()) {
502 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
503 domain->name ));
504 return;
507 if (domain->internal) {
508 DEBUG(10, ("set_domain_online_request: Internal domains are "
509 "always online\n"));
510 return;
513 /* We've been told it's safe to go online and
514 try and connect to a DC. But I don't believe it
515 because network manager seems to lie.
516 Wait at least 5 seconds. Heuristics suck... */
519 GetTimeOfDay(&tev);
521 /* Go into "startup" mode again. */
522 domain->startup_time = time_mono(NULL);
523 domain->startup = True;
525 tev.tv_sec += 5;
527 if (!domain->check_online_event) {
528 /* If we've come from being globally offline we
529 don't have a check online event handler set.
530 We need to add one now we're trying to go
531 back online. */
533 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
534 domain->name ));
537 TALLOC_FREE(domain->check_online_event);
539 domain->check_online_event = event_add_timed(winbind_event_context(),
540 NULL,
541 tev,
542 check_domain_online_handler,
543 domain);
545 /* The above *has* to succeed for winbindd to work. */
546 if (!domain->check_online_event) {
547 smb_panic("set_domain_online_request: failed to add online handler");
551 /****************************************************************
552 Add -ve connection cache entries for domain and realm.
553 ****************************************************************/
555 static void winbind_add_failed_connection_entry(
556 const struct winbindd_domain *domain,
557 const char *server,
558 NTSTATUS result)
560 add_failed_connection_entry(domain->name, server, result);
561 /* If this was the saf name for the last thing we talked to,
562 remove it. */
563 saf_delete(domain->name);
564 if (*domain->alt_name) {
565 add_failed_connection_entry(domain->alt_name, server, result);
566 saf_delete(domain->alt_name);
568 winbindd_unset_locator_kdc_env(domain);
571 /* Choose between anonymous or authenticated connections. We need to use
572 an authenticated connection if DCs have the RestrictAnonymous registry
573 entry set > 0, or the "Additional restrictions for anonymous
574 connections" set in the win2k Local Security Policy.
576 Caller to free() result in domain, username, password
579 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
581 *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
582 *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
583 *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
585 if (*username && **username) {
587 if (!*domain || !**domain)
588 *domain = smb_xstrdup(lp_workgroup());
590 if (!*password || !**password)
591 *password = smb_xstrdup("");
593 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
594 *domain, *username));
596 } else {
597 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
598 *username = smb_xstrdup("");
599 *domain = smb_xstrdup("");
600 *password = smb_xstrdup("");
604 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
605 fstring dcname,
606 struct sockaddr_storage *dc_ss)
608 struct winbindd_domain *our_domain = NULL;
609 struct rpc_pipe_client *netlogon_pipe = NULL;
610 NTSTATUS result;
611 WERROR werr;
612 TALLOC_CTX *mem_ctx;
613 unsigned int orig_timeout;
614 const char *tmp = NULL;
615 const char *p;
616 struct dcerpc_binding_handle *b;
618 /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
619 * moment.... */
621 if (IS_DC) {
622 return False;
625 if (domain->primary) {
626 return False;
629 our_domain = find_our_domain();
631 if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
632 return False;
635 result = cm_connect_netlogon(our_domain, &netlogon_pipe);
636 if (!NT_STATUS_IS_OK(result)) {
637 talloc_destroy(mem_ctx);
638 return False;
641 b = netlogon_pipe->binding_handle;
643 /* This call can take a long time - allow the server to time out.
644 35 seconds should do it. */
646 orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
648 if (our_domain->active_directory) {
649 struct netr_DsRGetDCNameInfo *domain_info = NULL;
651 result = dcerpc_netr_DsRGetDCName(b,
652 mem_ctx,
653 our_domain->dcname,
654 domain->name,
655 NULL,
656 NULL,
657 DS_RETURN_DNS_NAME,
658 &domain_info,
659 &werr);
660 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
661 tmp = talloc_strdup(
662 mem_ctx, domain_info->dc_unc);
663 if (tmp == NULL) {
664 DEBUG(0, ("talloc_strdup failed\n"));
665 talloc_destroy(mem_ctx);
666 return false;
668 if (strlen(domain->alt_name) == 0) {
669 fstrcpy(domain->alt_name,
670 domain_info->domain_name);
672 if (strlen(domain->forest_name) == 0) {
673 fstrcpy(domain->forest_name,
674 domain_info->forest_name);
677 } else {
678 result = dcerpc_netr_GetAnyDCName(b, mem_ctx,
679 our_domain->dcname,
680 domain->name,
681 &tmp,
682 &werr);
685 /* And restore our original timeout. */
686 rpccli_set_timeout(netlogon_pipe, orig_timeout);
688 if (!NT_STATUS_IS_OK(result)) {
689 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
690 nt_errstr(result)));
691 talloc_destroy(mem_ctx);
692 return false;
695 if (!W_ERROR_IS_OK(werr)) {
696 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
697 win_errstr(werr)));
698 talloc_destroy(mem_ctx);
699 return false;
702 /* dcerpc_netr_GetAnyDCName gives us a name with \\ */
703 p = strip_hostname(tmp);
705 fstrcpy(dcname, p);
707 talloc_destroy(mem_ctx);
709 DEBUG(10,("dcerpc_netr_GetAnyDCName returned %s\n", dcname));
711 if (!resolve_name(dcname, dc_ss, 0x20, true)) {
712 return False;
715 return True;
719 * Helper function to assemble trust password and account name
721 static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
722 char **machine_password,
723 char **machine_account,
724 char **machine_krb5_principal)
726 const char *account_name;
727 const char *name = NULL;
729 /* If we are a DC and this is not our own domain */
731 if (IS_DC) {
732 name = domain->name;
733 } else {
734 struct winbindd_domain *our_domain = find_our_domain();
736 if (!our_domain)
737 return NT_STATUS_INVALID_SERVER_STATE;
739 name = our_domain->name;
742 if (!get_trust_pw_clear(name, machine_password,
743 &account_name, NULL))
745 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
748 if ((machine_account != NULL) &&
749 (asprintf(machine_account, "%s$", account_name) == -1))
751 return NT_STATUS_NO_MEMORY;
754 /* For now assume our machine account only exists in our domain */
756 if (machine_krb5_principal != NULL)
758 struct winbindd_domain *our_domain = find_our_domain();
760 if (!our_domain) {
761 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
764 if (asprintf(machine_krb5_principal, "%s$@%s",
765 account_name, our_domain->alt_name) == -1)
767 return NT_STATUS_NO_MEMORY;
770 if (!strupper_m(*machine_krb5_principal)) {
771 SAFE_FREE(machine_krb5_principal);
772 return NT_STATUS_INVALID_PARAMETER;
776 return NT_STATUS_OK;
779 /************************************************************************
780 Given a fd with a just-connected TCP connection to a DC, open a connection
781 to the pipe.
782 ************************************************************************/
784 static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
785 const int sockfd,
786 const char *controller,
787 struct cli_state **cli,
788 bool *retry)
790 bool try_spnego = false;
791 bool try_ipc_auth = false;
792 char *machine_password = NULL;
793 char *machine_krb5_principal = NULL;
794 char *machine_account = NULL;
795 char *ipc_username = NULL;
796 char *ipc_domain = NULL;
797 char *ipc_password = NULL;
798 int flags = 0;
799 uint16_t sec_mode = 0;
801 struct named_mutex *mutex;
803 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
805 DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
806 controller, domain->name ));
808 *retry = True;
810 mutex = grab_named_mutex(talloc_tos(), controller,
811 WINBIND_SERVER_MUTEX_WAIT_TIME);
812 if (mutex == NULL) {
813 close(sockfd);
814 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
815 controller));
816 result = NT_STATUS_POSSIBLE_DEADLOCK;
817 goto done;
820 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
822 *cli = cli_state_create(NULL, sockfd,
823 controller, domain->alt_name,
824 SMB_SIGNING_DEFAULT, flags);
825 if (*cli == NULL) {
826 close(sockfd);
827 DEBUG(1, ("Could not cli_initialize\n"));
828 result = NT_STATUS_NO_MEMORY;
829 goto done;
832 cli_set_timeout(*cli, 10000); /* 10 seconds */
834 result = smbXcli_negprot((*cli)->conn, (*cli)->timeout, PROTOCOL_CORE,
835 PROTOCOL_LATEST);
837 if (!NT_STATUS_IS_OK(result)) {
838 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
839 goto done;
842 if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_NT1 &&
843 smb1cli_conn_capabilities((*cli)->conn) & CAP_EXTENDED_SECURITY) {
844 try_spnego = true;
845 } else if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
846 try_spnego = true;
849 if (!is_dc_trusted_domain_situation(domain->name) && try_spnego) {
850 result = get_trust_creds(domain, &machine_password,
851 &machine_account,
852 &machine_krb5_principal);
853 if (!NT_STATUS_IS_OK(result)) {
854 goto anon_fallback;
857 if (lp_security() == SEC_ADS) {
859 /* Try a krb5 session */
861 (*cli)->use_kerberos = True;
862 DEBUG(5, ("connecting to %s from %s with kerberos principal "
863 "[%s] and realm [%s]\n", controller, lp_netbios_name(),
864 machine_krb5_principal, domain->alt_name));
866 winbindd_set_locator_kdc_envs(domain);
868 result = cli_session_setup(*cli,
869 machine_krb5_principal,
870 machine_password,
871 strlen(machine_password)+1,
872 machine_password,
873 strlen(machine_password)+1,
874 lp_workgroup());
876 if (!NT_STATUS_IS_OK(result)) {
877 DEBUG(4,("failed kerberos session setup with %s\n",
878 nt_errstr(result)));
881 if (NT_STATUS_IS_OK(result)) {
882 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
883 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
884 if (!NT_STATUS_IS_OK(result)) {
885 goto done;
887 goto session_setup_done;
891 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
892 (*cli)->use_kerberos = False;
894 DEBUG(5, ("connecting to %s from %s with username "
895 "[%s]\\[%s]\n", controller, lp_netbios_name(),
896 lp_workgroup(), machine_account));
898 result = cli_session_setup(*cli,
899 machine_account,
900 machine_password,
901 strlen(machine_password)+1,
902 machine_password,
903 strlen(machine_password)+1,
904 lp_workgroup());
905 if (!NT_STATUS_IS_OK(result)) {
906 DEBUG(4, ("authenticated session setup failed with %s\n",
907 nt_errstr(result)));
910 if (NT_STATUS_IS_OK(result)) {
911 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
912 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
913 if (!NT_STATUS_IS_OK(result)) {
914 goto done;
916 goto session_setup_done;
920 /* Fall back to non-kerberos session setup with auth_user */
922 (*cli)->use_kerberos = False;
924 cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
926 sec_mode = smb1cli_conn_server_security_mode((*cli)->conn);
928 try_ipc_auth = false;
929 if (try_spnego) {
930 try_ipc_auth = true;
931 } else if (sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) {
932 try_ipc_auth = true;
935 if (try_ipc_auth && (strlen(ipc_username) > 0)) {
937 /* Only try authenticated if we have a username */
939 DEBUG(5, ("connecting to %s from %s with username "
940 "[%s]\\[%s]\n", controller, lp_netbios_name(),
941 ipc_domain, ipc_username));
943 if (NT_STATUS_IS_OK(cli_session_setup(
944 *cli, ipc_username,
945 ipc_password, strlen(ipc_password)+1,
946 ipc_password, strlen(ipc_password)+1,
947 ipc_domain))) {
948 /* Successful logon with given username. */
949 result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
950 if (!NT_STATUS_IS_OK(result)) {
951 goto done;
953 goto session_setup_done;
954 } else {
955 DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
956 ipc_domain, ipc_username ));
960 anon_fallback:
962 /* Fall back to anonymous connection, this might fail later */
963 DEBUG(10,("cm_prepare_connection: falling back to anonymous "
964 "connection for DC %s\n",
965 controller ));
967 result = cli_session_setup(*cli, "", NULL, 0, NULL, 0, "");
968 if (NT_STATUS_IS_OK(result)) {
969 DEBUG(5, ("Connected anonymously\n"));
970 result = cli_init_creds(*cli, "", "", "");
971 if (!NT_STATUS_IS_OK(result)) {
972 goto done;
974 goto session_setup_done;
977 /* We can't session setup */
978 goto done;
980 session_setup_done:
983 * This should be a short term hack until
984 * dynamic re-authentication is implemented.
986 * See Bug 9175 - winbindd doesn't recover from
987 * NT_STATUS_NETWORK_SESSION_EXPIRED
989 if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
990 smbXcli_session_set_disconnect_expired((*cli)->smb2.session);
993 /* cache the server name for later connections */
995 saf_store(domain->name, controller);
996 if (domain->alt_name && (*cli)->use_kerberos) {
997 saf_store(domain->alt_name, controller);
1000 winbindd_set_locator_kdc_envs(domain);
1002 result = cli_tree_connect(*cli, "IPC$", "IPC", "", 0);
1004 if (!NT_STATUS_IS_OK(result)) {
1005 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
1006 goto done;
1009 TALLOC_FREE(mutex);
1010 *retry = False;
1012 /* set the domain if empty; needed for schannel connections */
1013 if ( !(*cli)->domain[0] ) {
1014 result = cli_set_domain((*cli), domain->name);
1015 if (!NT_STATUS_IS_OK(result)) {
1016 return result;
1020 result = NT_STATUS_OK;
1022 done:
1023 TALLOC_FREE(mutex);
1024 SAFE_FREE(machine_account);
1025 SAFE_FREE(machine_password);
1026 SAFE_FREE(machine_krb5_principal);
1027 SAFE_FREE(ipc_username);
1028 SAFE_FREE(ipc_domain);
1029 SAFE_FREE(ipc_password);
1031 if (!NT_STATUS_IS_OK(result)) {
1032 winbind_add_failed_connection_entry(domain, controller, result);
1033 if ((*cli) != NULL) {
1034 cli_shutdown(*cli);
1035 *cli = NULL;
1039 return result;
1042 /*******************************************************************
1043 Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1044 array.
1046 Keeps the list unique by not adding duplicate entries.
1048 @param[in] mem_ctx talloc memory context to allocate from
1049 @param[in] domain_name domain of the DC
1050 @param[in] dcname name of the DC to add to the list
1051 @param[in] pss Internet address and port pair to add to the list
1052 @param[in,out] dcs array of dc_name_ip structures to add to
1053 @param[in,out] num_dcs number of dcs returned in the dcs array
1054 @return true if the list was added to, false otherwise
1055 *******************************************************************/
1057 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
1058 const char *dcname, struct sockaddr_storage *pss,
1059 struct dc_name_ip **dcs, int *num)
1061 int i = 0;
1063 if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1064 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1065 return False;
1068 /* Make sure there's no duplicates in the list */
1069 for (i=0; i<*num; i++)
1070 if (sockaddr_equal(
1071 (struct sockaddr *)(void *)&(*dcs)[i].ss,
1072 (struct sockaddr *)(void *)pss))
1073 return False;
1075 *dcs = talloc_realloc(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1077 if (*dcs == NULL)
1078 return False;
1080 fstrcpy((*dcs)[*num].name, dcname);
1081 (*dcs)[*num].ss = *pss;
1082 *num += 1;
1083 return True;
1086 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
1087 struct sockaddr_storage *pss, uint16 port,
1088 struct sockaddr_storage **addrs, int *num)
1090 *addrs = talloc_realloc(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1092 if (*addrs == NULL) {
1093 *num = 0;
1094 return False;
1097 (*addrs)[*num] = *pss;
1098 set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1100 *num += 1;
1101 return True;
1104 /*******************************************************************
1105 convert an ip to a name
1106 *******************************************************************/
1108 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
1109 const struct winbindd_domain *domain,
1110 struct sockaddr_storage *pss,
1111 fstring name )
1113 struct ip_service ip_list;
1114 uint32_t nt_version = NETLOGON_NT_VERSION_1;
1115 NTSTATUS status;
1116 const char *dc_name;
1118 ip_list.ss = *pss;
1119 ip_list.port = 0;
1121 #ifdef HAVE_ADS
1122 /* For active directory servers, try to get the ldap server name.
1123 None of these failures should be considered critical for now */
1125 if (lp_security() == SEC_ADS) {
1126 ADS_STRUCT *ads;
1127 ADS_STATUS ads_status;
1128 char addr[INET6_ADDRSTRLEN];
1130 print_sockaddr(addr, sizeof(addr), pss);
1132 ads = ads_init(domain->alt_name, domain->name, addr);
1133 ads->auth.flags |= ADS_AUTH_NO_BIND;
1135 ads_status = ads_connect(ads);
1136 if (ADS_ERR_OK(ads_status)) {
1137 /* We got a cldap packet. */
1138 fstrcpy(name, ads->config.ldap_server_name);
1139 namecache_store(name, 0x20, 1, &ip_list);
1141 DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1143 if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1144 if (ads_closest_dc(ads)) {
1145 char *sitename = sitename_fetch(ads->config.realm);
1147 /* We're going to use this KDC for this realm/domain.
1148 If we are using sites, then force the krb5 libs
1149 to use this KDC. */
1151 create_local_private_krb5_conf_for_domain(domain->alt_name,
1152 domain->name,
1153 sitename,
1154 pss,
1155 name);
1157 SAFE_FREE(sitename);
1158 } else {
1159 /* use an off site KDC */
1160 create_local_private_krb5_conf_for_domain(domain->alt_name,
1161 domain->name,
1162 NULL,
1163 pss,
1164 name);
1166 winbindd_set_locator_kdc_envs(domain);
1168 /* Ensure we contact this DC also. */
1169 saf_store( domain->name, name);
1170 saf_store( domain->alt_name, name);
1173 ads_destroy( &ads );
1174 return True;
1177 ads_destroy( &ads );
1178 return false;
1180 #endif
1182 status = nbt_getdc(winbind_messaging_context(), 10, pss, domain->name,
1183 &domain->sid, nt_version, mem_ctx, &nt_version,
1184 &dc_name, NULL);
1185 if (NT_STATUS_IS_OK(status)) {
1186 fstrcpy(name, dc_name);
1187 namecache_store(name, 0x20, 1, &ip_list);
1188 return True;
1191 /* try node status request */
1193 if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
1194 namecache_store(name, 0x20, 1, &ip_list);
1195 return True;
1197 return False;
1200 /*******************************************************************
1201 Retrieve a list of IP addresses for domain controllers.
1203 The array is sorted in the preferred connection order.
1205 @param[in] mem_ctx talloc memory context to allocate from
1206 @param[in] domain domain to retrieve DCs for
1207 @param[out] dcs array of dcs that will be returned
1208 @param[out] num_dcs number of dcs returned in the dcs array
1209 @return always true
1210 *******************************************************************/
1212 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
1213 struct dc_name_ip **dcs, int *num_dcs)
1215 fstring dcname;
1216 struct sockaddr_storage ss;
1217 struct ip_service *ip_list = NULL;
1218 int iplist_size = 0;
1219 int i;
1220 bool is_our_domain;
1221 enum security_types sec = (enum security_types)lp_security();
1223 is_our_domain = strequal(domain->name, lp_workgroup());
1225 /* If not our domain, get the preferred DC, by asking our primary DC */
1226 if ( !is_our_domain
1227 && get_dc_name_via_netlogon(domain, dcname, &ss)
1228 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1229 num_dcs) )
1231 char addr[INET6_ADDRSTRLEN];
1232 print_sockaddr(addr, sizeof(addr), &ss);
1233 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1234 dcname, addr));
1235 return True;
1238 if (sec == SEC_ADS) {
1239 char *sitename = NULL;
1241 /* We need to make sure we know the local site before
1242 doing any DNS queries, as this will restrict the
1243 get_sorted_dc_list() call below to only fetching
1244 DNS records for the correct site. */
1246 /* Find any DC to get the site record.
1247 We deliberately don't care about the
1248 return here. */
1250 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1252 sitename = sitename_fetch(domain->alt_name);
1253 if (sitename) {
1255 /* Do the site-specific AD dns lookup first. */
1256 get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1257 &iplist_size, True);
1259 /* Add ips to the DC array. We don't look up the name
1260 of the DC in this function, but we fill in the char*
1261 of the ip now to make the failed connection cache
1262 work */
1263 for ( i=0; i<iplist_size; i++ ) {
1264 char addr[INET6_ADDRSTRLEN];
1265 print_sockaddr(addr, sizeof(addr),
1266 &ip_list[i].ss);
1267 add_one_dc_unique(mem_ctx,
1268 domain->name,
1269 addr,
1270 &ip_list[i].ss,
1271 dcs,
1272 num_dcs);
1275 SAFE_FREE(ip_list);
1276 SAFE_FREE(sitename);
1277 iplist_size = 0;
1280 /* Now we add DCs from the main AD DNS lookup. */
1281 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1282 &iplist_size, True);
1284 for ( i=0; i<iplist_size; i++ ) {
1285 char addr[INET6_ADDRSTRLEN];
1286 print_sockaddr(addr, sizeof(addr),
1287 &ip_list[i].ss);
1288 add_one_dc_unique(mem_ctx,
1289 domain->name,
1290 addr,
1291 &ip_list[i].ss,
1292 dcs,
1293 num_dcs);
1296 SAFE_FREE(ip_list);
1297 iplist_size = 0;
1300 /* Try standard netbios queries if no ADS and fall back to DNS queries
1301 * if alt_name is available */
1302 if (*num_dcs == 0) {
1303 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1304 false);
1305 if (iplist_size == 0) {
1306 if (domain->alt_name != NULL) {
1307 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1308 &iplist_size, true);
1312 for ( i=0; i<iplist_size; i++ ) {
1313 char addr[INET6_ADDRSTRLEN];
1314 print_sockaddr(addr, sizeof(addr),
1315 &ip_list[i].ss);
1316 add_one_dc_unique(mem_ctx,
1317 domain->name,
1318 addr,
1319 &ip_list[i].ss,
1320 dcs,
1321 num_dcs);
1324 SAFE_FREE(ip_list);
1325 iplist_size = 0;
1328 return True;
1331 /*******************************************************************
1332 Find and make a connection to a DC in the given domain.
1334 @param[in] mem_ctx talloc memory context to allocate from
1335 @param[in] domain domain to find a dc in
1336 @param[out] dcname NetBIOS or FQDN of DC that's connected to
1337 @param[out] pss DC Internet address and port
1338 @param[out] fd fd of the open socket connected to the newly found dc
1339 @return true when a DC connection is made, false otherwise
1340 *******************************************************************/
1342 static bool find_new_dc(TALLOC_CTX *mem_ctx,
1343 struct winbindd_domain *domain,
1344 fstring dcname, struct sockaddr_storage *pss, int *fd)
1346 struct dc_name_ip *dcs = NULL;
1347 int num_dcs = 0;
1349 const char **dcnames = NULL;
1350 int num_dcnames = 0;
1352 struct sockaddr_storage *addrs = NULL;
1353 int num_addrs = 0;
1355 int i;
1356 size_t fd_index;
1358 NTSTATUS status;
1360 *fd = -1;
1362 again:
1363 if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1364 return False;
1366 for (i=0; i<num_dcs; i++) {
1368 if (!add_string_to_array(mem_ctx, dcs[i].name,
1369 &dcnames, &num_dcnames)) {
1370 return False;
1372 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, TCP_SMB_PORT,
1373 &addrs, &num_addrs)) {
1374 return False;
1378 if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1379 return False;
1381 if ((addrs == NULL) || (dcnames == NULL))
1382 return False;
1384 status = smbsock_any_connect(addrs, dcnames, NULL, NULL, NULL,
1385 num_addrs, 0, 10, fd, &fd_index, NULL);
1386 if (!NT_STATUS_IS_OK(status)) {
1387 for (i=0; i<num_dcs; i++) {
1388 char ab[INET6_ADDRSTRLEN];
1389 print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1390 DEBUG(10, ("find_new_dc: smbsock_any_connect failed for "
1391 "domain %s address %s. Error was %s\n",
1392 domain->name, ab, nt_errstr(status) ));
1393 winbind_add_failed_connection_entry(domain,
1394 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1396 return False;
1399 *pss = addrs[fd_index];
1401 if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1402 /* Ok, we've got a name for the DC */
1403 fstrcpy(dcname, dcnames[fd_index]);
1404 return True;
1407 /* Try to figure out the name */
1408 if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1409 return True;
1412 /* We can not continue without the DC's name */
1413 winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1414 NT_STATUS_UNSUCCESSFUL);
1416 /* Throw away all arrays as we're doing this again. */
1417 TALLOC_FREE(dcs);
1418 num_dcs = 0;
1420 TALLOC_FREE(dcnames);
1421 num_dcnames = 0;
1423 TALLOC_FREE(addrs);
1424 num_addrs = 0;
1426 close(*fd);
1427 *fd = -1;
1429 goto again;
1432 static char *current_dc_key(TALLOC_CTX *mem_ctx, const char *domain_name)
1434 return talloc_asprintf_strupper_m(mem_ctx, "CURRENT_DCNAME/%s",
1435 domain_name);
1438 static void store_current_dc_in_gencache(const char *domain_name,
1439 const char *dc_name,
1440 struct cli_state *cli)
1442 char addr[INET6_ADDRSTRLEN];
1443 char *key = NULL;
1444 char *value = NULL;
1446 if (!cli_state_is_connected(cli)) {
1447 return;
1450 print_sockaddr(addr, sizeof(addr),
1451 smbXcli_conn_remote_sockaddr(cli->conn));
1453 key = current_dc_key(talloc_tos(), domain_name);
1454 if (key == NULL) {
1455 goto done;
1458 value = talloc_asprintf(talloc_tos(), "%s %s", addr, dc_name);
1459 if (value == NULL) {
1460 goto done;
1463 gencache_set(key, value, 0x7fffffff);
1464 done:
1465 TALLOC_FREE(value);
1466 TALLOC_FREE(key);
1469 bool fetch_current_dc_from_gencache(TALLOC_CTX *mem_ctx,
1470 const char *domain_name,
1471 char **p_dc_name, char **p_dc_ip)
1473 char *key, *value, *p;
1474 bool ret = false;
1475 char *dc_name = NULL;
1476 char *dc_ip = NULL;
1478 key = current_dc_key(talloc_tos(), domain_name);
1479 if (key == NULL) {
1480 goto done;
1482 if (!gencache_get(key, &value, NULL)) {
1483 goto done;
1485 p = strchr(value, ' ');
1486 if (p == NULL) {
1487 goto done;
1489 dc_ip = talloc_strndup(mem_ctx, value, p - value);
1490 if (dc_ip == NULL) {
1491 goto done;
1493 dc_name = talloc_strdup(mem_ctx, p+1);
1494 if (dc_name == NULL) {
1495 goto done;
1498 if (p_dc_ip != NULL) {
1499 *p_dc_ip = dc_ip;
1500 dc_ip = NULL;
1502 if (p_dc_name != NULL) {
1503 *p_dc_name = dc_name;
1504 dc_name = NULL;
1506 ret = true;
1507 done:
1508 TALLOC_FREE(dc_name);
1509 TALLOC_FREE(dc_ip);
1510 TALLOC_FREE(key);
1511 return ret;
1514 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
1515 struct winbindd_cm_conn *new_conn)
1517 TALLOC_CTX *mem_ctx;
1518 NTSTATUS result;
1519 char *saf_servername = saf_fetch( domain->name );
1520 int retries;
1522 if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1523 SAFE_FREE(saf_servername);
1524 set_domain_offline(domain);
1525 return NT_STATUS_NO_MEMORY;
1528 /* we have to check the server affinity cache here since
1529 later we select a DC based on response time and not preference */
1531 /* Check the negative connection cache
1532 before talking to it. It going down may have
1533 triggered the reconnection. */
1535 if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1537 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1538 saf_servername, domain->name ));
1540 /* convert an ip address to a name */
1541 if (is_ipaddress( saf_servername ) ) {
1542 fstring saf_name;
1543 struct sockaddr_storage ss;
1545 if (!interpret_string_addr(&ss, saf_servername,
1546 AI_NUMERICHOST)) {
1547 return NT_STATUS_UNSUCCESSFUL;
1549 if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
1550 strlcpy(domain->dcname, saf_name, sizeof(domain->dcname));
1551 } else {
1552 winbind_add_failed_connection_entry(
1553 domain, saf_servername,
1554 NT_STATUS_UNSUCCESSFUL);
1556 } else {
1557 fstrcpy( domain->dcname, saf_servername );
1560 SAFE_FREE( saf_servername );
1563 for (retries = 0; retries < 3; retries++) {
1564 int fd = -1;
1565 bool retry = False;
1567 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1569 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1570 domain->dcname, domain->name ));
1572 if (*domain->dcname
1573 && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1574 && (resolve_name(domain->dcname, &domain->dcaddr, 0x20, true)))
1576 NTSTATUS status;
1578 status = smbsock_connect(&domain->dcaddr, 0,
1579 NULL, -1, NULL, -1,
1580 &fd, NULL, 10);
1581 if (!NT_STATUS_IS_OK(status)) {
1582 fd = -1;
1586 if ((fd == -1)
1587 && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
1589 /* This is the one place where we will
1590 set the global winbindd offline state
1591 to true, if a "WINBINDD_OFFLINE" entry
1592 is found in the winbindd cache. */
1593 set_global_winbindd_state_offline();
1594 break;
1597 new_conn->cli = NULL;
1599 result = cm_prepare_connection(domain, fd, domain->dcname,
1600 &new_conn->cli, &retry);
1601 if (!NT_STATUS_IS_OK(result)) {
1602 /* Don't leak the smb connection socket */
1603 close(fd);
1606 if (!retry)
1607 break;
1610 if (NT_STATUS_IS_OK(result)) {
1612 winbindd_set_locator_kdc_envs(domain);
1614 if (domain->online == False) {
1615 /* We're changing state from offline to online. */
1616 set_global_winbindd_state_online();
1618 set_domain_online(domain);
1621 * Much as I hate global state, this seems to be the point
1622 * where we can be certain that we have a proper connection to
1623 * a DC. wbinfo --dc-info needs that information, store it in
1624 * gencache with a looong timeout. This will need revisiting
1625 * once we start to connect to multiple DCs, wbcDcInfo is
1626 * already prepared for that.
1628 store_current_dc_in_gencache(domain->name, domain->dcname,
1629 new_conn->cli);
1630 } else {
1631 /* Ensure we setup the retry handler. */
1632 set_domain_offline(domain);
1635 talloc_destroy(mem_ctx);
1636 return result;
1639 /* Close down all open pipes on a connection. */
1641 void invalidate_cm_connection(struct winbindd_cm_conn *conn)
1643 NTSTATUS result;
1645 /* We're closing down a possibly dead
1646 connection. Don't have impossibly long (10s) timeouts. */
1648 if (conn->cli) {
1649 cli_set_timeout(conn->cli, 1000); /* 1 second. */
1652 if (conn->samr_pipe != NULL) {
1653 if (is_valid_policy_hnd(&conn->sam_connect_handle)) {
1654 dcerpc_samr_Close(conn->samr_pipe->binding_handle,
1655 talloc_tos(),
1656 &conn->sam_connect_handle,
1657 &result);
1659 TALLOC_FREE(conn->samr_pipe);
1660 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1661 if (conn->cli) {
1662 cli_set_timeout(conn->cli, 500);
1666 if (conn->lsa_pipe != NULL) {
1667 if (is_valid_policy_hnd(&conn->lsa_policy)) {
1668 dcerpc_lsa_Close(conn->lsa_pipe->binding_handle,
1669 talloc_tos(),
1670 &conn->lsa_policy,
1671 &result);
1673 TALLOC_FREE(conn->lsa_pipe);
1674 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1675 if (conn->cli) {
1676 cli_set_timeout(conn->cli, 500);
1680 if (conn->lsa_pipe_tcp != NULL) {
1681 if (is_valid_policy_hnd(&conn->lsa_policy)) {
1682 dcerpc_lsa_Close(conn->lsa_pipe_tcp->binding_handle,
1683 talloc_tos(),
1684 &conn->lsa_policy,
1685 &result);
1687 TALLOC_FREE(conn->lsa_pipe_tcp);
1688 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1689 if (conn->cli) {
1690 cli_set_timeout(conn->cli, 500);
1694 if (conn->netlogon_pipe != NULL) {
1695 TALLOC_FREE(conn->netlogon_pipe);
1696 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1697 if (conn->cli) {
1698 cli_set_timeout(conn->cli, 500);
1702 if (conn->cli) {
1703 cli_shutdown(conn->cli);
1706 conn->cli = NULL;
1709 void close_conns_after_fork(void)
1711 struct winbindd_domain *domain;
1712 struct winbindd_cli_state *cli_state;
1714 for (domain = domain_list(); domain; domain = domain->next) {
1716 * first close the low level SMB TCP connection
1717 * so that we don't generate any SMBclose
1718 * requests in invalidate_cm_connection()
1720 if (cli_state_is_connected(domain->conn.cli)) {
1721 smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
1724 invalidate_cm_connection(&domain->conn);
1727 for (cli_state = winbindd_client_list();
1728 cli_state != NULL;
1729 cli_state = cli_state->next) {
1730 if (cli_state->sock >= 0) {
1731 close(cli_state->sock);
1732 cli_state->sock = -1;
1737 static bool connection_ok(struct winbindd_domain *domain)
1739 bool ok;
1741 ok = cli_state_is_connected(domain->conn.cli);
1742 if (!ok) {
1743 DEBUG(3, ("connection_ok: Connection to %s for domain %s is not connected\n",
1744 domain->dcname, domain->name));
1745 return False;
1748 if (domain->online == False) {
1749 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
1750 return False;
1753 return True;
1756 /* Initialize a new connection up to the RPC BIND.
1757 Bypass online status check so always does network calls. */
1759 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
1761 NTSTATUS result;
1763 /* Internal connections never use the network. */
1764 if (domain->internal) {
1765 domain->initialized = True;
1766 return NT_STATUS_OK;
1769 if (connection_ok(domain)) {
1770 if (!domain->initialized) {
1771 set_dc_type_and_flags(domain);
1773 return NT_STATUS_OK;
1776 invalidate_cm_connection(&domain->conn);
1778 result = cm_open_connection(domain, &domain->conn);
1780 if (NT_STATUS_IS_OK(result) && !domain->initialized) {
1781 set_dc_type_and_flags(domain);
1784 return result;
1787 NTSTATUS init_dc_connection(struct winbindd_domain *domain)
1789 if (domain->internal) {
1790 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1793 if (domain->initialized && !domain->online) {
1794 /* We check for online status elsewhere. */
1795 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1798 return init_dc_connection_network(domain);
1801 static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain)
1803 NTSTATUS status;
1805 status = init_dc_connection(domain);
1806 if (!NT_STATUS_IS_OK(status)) {
1807 return status;
1810 if (!domain->internal && domain->conn.cli == NULL) {
1811 /* happens for trusted domains without inbound trust */
1812 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
1815 return NT_STATUS_OK;
1818 /******************************************************************************
1819 Set the trust flags (direction and forest location) for a domain
1820 ******************************************************************************/
1822 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
1824 struct winbindd_domain *our_domain;
1825 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1826 WERROR werr;
1827 struct netr_DomainTrustList trusts;
1828 int i;
1829 uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
1830 NETR_TRUST_FLAG_OUTBOUND |
1831 NETR_TRUST_FLAG_INBOUND);
1832 struct rpc_pipe_client *cli;
1833 TALLOC_CTX *mem_ctx = NULL;
1834 struct dcerpc_binding_handle *b;
1836 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
1838 /* Our primary domain doesn't need to worry about trust flags.
1839 Force it to go through the network setup */
1840 if ( domain->primary ) {
1841 return False;
1844 our_domain = find_our_domain();
1846 if ( !connection_ok(our_domain) ) {
1847 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1848 return False;
1851 /* This won't work unless our domain is AD */
1853 if ( !our_domain->active_directory ) {
1854 return False;
1857 /* Use DsEnumerateDomainTrusts to get us the trust direction
1858 and type */
1860 result = cm_connect_netlogon(our_domain, &cli);
1862 if (!NT_STATUS_IS_OK(result)) {
1863 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1864 "a connection to %s for PIPE_NETLOGON (%s)\n",
1865 domain->name, nt_errstr(result)));
1866 return False;
1869 b = cli->binding_handle;
1871 if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
1872 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1873 return False;
1876 result = dcerpc_netr_DsrEnumerateDomainTrusts(b, mem_ctx,
1877 cli->desthost,
1878 flags,
1879 &trusts,
1880 &werr);
1881 if (!NT_STATUS_IS_OK(result)) {
1882 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1883 "failed to query trusted domain list: %s\n",
1884 nt_errstr(result)));
1885 talloc_destroy(mem_ctx);
1886 return false;
1888 if (!W_ERROR_IS_OK(werr)) {
1889 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1890 "failed to query trusted domain list: %s\n",
1891 win_errstr(werr)));
1892 talloc_destroy(mem_ctx);
1893 return false;
1896 /* Now find the domain name and get the flags */
1898 for ( i=0; i<trusts.count; i++ ) {
1899 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
1900 domain->domain_flags = trusts.array[i].trust_flags;
1901 domain->domain_type = trusts.array[i].trust_type;
1902 domain->domain_trust_attribs = trusts.array[i].trust_attributes;
1904 if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
1905 domain->active_directory = True;
1907 /* This flag is only set if the domain is *our*
1908 primary domain and the primary domain is in
1909 native mode */
1911 domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
1913 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1914 "native mode.\n", domain->name,
1915 domain->native_mode ? "" : "NOT "));
1917 DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1918 "running active directory.\n", domain->name,
1919 domain->active_directory ? "" : "NOT "));
1921 domain->can_do_ncacn_ip_tcp = domain->active_directory;
1922 domain->can_do_validation6 = domain->active_directory;
1924 domain->initialized = True;
1926 break;
1930 talloc_destroy( mem_ctx );
1932 return domain->initialized;
1935 /******************************************************************************
1936 We can 'sense' certain things about the DC by it's replies to certain
1937 questions.
1939 This tells us if this particular remote server is Active Directory, and if it
1940 is native mode.
1941 ******************************************************************************/
1943 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
1945 NTSTATUS status, result;
1946 WERROR werr;
1947 TALLOC_CTX *mem_ctx = NULL;
1948 struct rpc_pipe_client *cli = NULL;
1949 struct policy_handle pol;
1950 union dssetup_DsRoleInfo info;
1951 union lsa_PolicyInformation *lsa_info = NULL;
1953 if (!connection_ok(domain)) {
1954 return;
1957 mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
1958 domain->name);
1959 if (!mem_ctx) {
1960 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1961 return;
1964 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
1966 status = cli_rpc_pipe_open_noauth(domain->conn.cli,
1967 &ndr_table_dssetup.syntax_id,
1968 &cli);
1970 if (!NT_STATUS_IS_OK(status)) {
1971 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1972 "PI_DSSETUP on domain %s: (%s)\n",
1973 domain->name, nt_errstr(status)));
1975 /* if this is just a non-AD domain we need to continue
1976 * identifying so that we can in the end return with
1977 * domain->initialized = True - gd */
1979 goto no_dssetup;
1982 status = dcerpc_dssetup_DsRoleGetPrimaryDomainInformation(cli->binding_handle, mem_ctx,
1983 DS_ROLE_BASIC_INFORMATION,
1984 &info,
1985 &werr);
1986 TALLOC_FREE(cli);
1988 if (NT_STATUS_IS_OK(status)) {
1989 result = werror_to_ntstatus(werr);
1991 if (!NT_STATUS_IS_OK(status)) {
1992 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1993 "on domain %s failed: (%s)\n",
1994 domain->name, nt_errstr(status)));
1996 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1997 * every opcode on the DSSETUP pipe, continue with
1998 * no_dssetup mode here as well to get domain->initialized
1999 * set - gd */
2001 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
2002 goto no_dssetup;
2005 TALLOC_FREE(mem_ctx);
2006 return;
2009 if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
2010 !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
2011 domain->native_mode = True;
2012 } else {
2013 domain->native_mode = False;
2016 no_dssetup:
2017 status = cli_rpc_pipe_open_noauth(domain->conn.cli,
2018 &ndr_table_lsarpc.syntax_id, &cli);
2020 if (!NT_STATUS_IS_OK(status)) {
2021 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
2022 "PI_LSARPC on domain %s: (%s)\n",
2023 domain->name, nt_errstr(status)));
2024 TALLOC_FREE(cli);
2025 TALLOC_FREE(mem_ctx);
2026 return;
2029 status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
2030 SEC_FLAG_MAXIMUM_ALLOWED, &pol);
2032 if (NT_STATUS_IS_OK(status)) {
2033 /* This particular query is exactly what Win2k clients use
2034 to determine that the DC is active directory */
2035 status = dcerpc_lsa_QueryInfoPolicy2(cli->binding_handle, mem_ctx,
2036 &pol,
2037 LSA_POLICY_INFO_DNS,
2038 &lsa_info,
2039 &result);
2042 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2043 domain->active_directory = True;
2045 if (lsa_info->dns.name.string) {
2046 fstrcpy(domain->name, lsa_info->dns.name.string);
2049 if (lsa_info->dns.dns_domain.string) {
2050 fstrcpy(domain->alt_name,
2051 lsa_info->dns.dns_domain.string);
2054 /* See if we can set some domain trust flags about
2055 ourself */
2057 if (lsa_info->dns.dns_forest.string) {
2058 fstrcpy(domain->forest_name,
2059 lsa_info->dns.dns_forest.string);
2061 if (strequal(domain->forest_name, domain->alt_name)) {
2062 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
2066 if (lsa_info->dns.sid) {
2067 sid_copy(&domain->sid, lsa_info->dns.sid);
2069 } else {
2070 domain->active_directory = False;
2072 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
2073 SEC_FLAG_MAXIMUM_ALLOWED,
2074 &pol);
2076 if (!NT_STATUS_IS_OK(status)) {
2077 goto done;
2080 status = dcerpc_lsa_QueryInfoPolicy(cli->binding_handle, mem_ctx,
2081 &pol,
2082 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
2083 &lsa_info,
2084 &result);
2085 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2087 if (lsa_info->account_domain.name.string) {
2088 fstrcpy(domain->name,
2089 lsa_info->account_domain.name.string);
2092 if (lsa_info->account_domain.sid) {
2093 sid_copy(&domain->sid, lsa_info->account_domain.sid);
2097 done:
2099 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
2100 domain->name, domain->native_mode ? "" : "NOT "));
2102 DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
2103 domain->name, domain->active_directory ? "" : "NOT "));
2105 domain->can_do_ncacn_ip_tcp = domain->active_directory;
2106 domain->can_do_validation6 = domain->active_directory;
2108 TALLOC_FREE(cli);
2110 TALLOC_FREE(mem_ctx);
2112 domain->initialized = True;
2115 /**********************************************************************
2116 Set the domain_flags (trust attributes, domain operating modes, etc...
2117 ***********************************************************************/
2119 static void set_dc_type_and_flags( struct winbindd_domain *domain )
2121 /* we always have to contact our primary domain */
2123 if ( domain->primary ) {
2124 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
2125 "primary domain\n"));
2126 set_dc_type_and_flags_connect( domain );
2127 return;
2130 /* Use our DC to get the information if possible */
2132 if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
2133 /* Otherwise, fallback to contacting the
2134 domain directly */
2135 set_dc_type_and_flags_connect( domain );
2138 return;
2143 /**********************************************************************
2144 ***********************************************************************/
2146 static NTSTATUS cm_get_schannel_creds(struct winbindd_domain *domain,
2147 struct netlogon_creds_CredentialState **ppdc)
2149 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2150 struct rpc_pipe_client *netlogon_pipe;
2152 if (lp_client_schannel() == False) {
2153 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2156 result = cm_connect_netlogon(domain, &netlogon_pipe);
2157 if (!NT_STATUS_IS_OK(result)) {
2158 return result;
2161 /* Return a pointer to the struct netlogon_creds_CredentialState from the
2162 netlogon pipe. */
2164 if (!domain->conn.netlogon_pipe->dc) {
2165 return NT_STATUS_INTERNAL_ERROR; /* This shouldn't happen. */
2168 *ppdc = domain->conn.netlogon_pipe->dc;
2169 return NT_STATUS_OK;
2172 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2173 struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2175 struct winbindd_cm_conn *conn;
2176 NTSTATUS status, result;
2177 struct netlogon_creds_CredentialState *p_creds;
2178 char *machine_password = NULL;
2179 char *machine_account = NULL;
2180 char *domain_name = NULL;
2182 if (sid_check_is_our_sam(&domain->sid)) {
2183 return open_internal_samr_conn(mem_ctx, domain, cli, sam_handle);
2186 status = init_dc_connection_rpc(domain);
2187 if (!NT_STATUS_IS_OK(status)) {
2188 return status;
2191 conn = &domain->conn;
2193 if (rpccli_is_connected(conn->samr_pipe)) {
2194 goto done;
2197 TALLOC_FREE(conn->samr_pipe);
2200 * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2201 * sign and sealed pipe using the machine account password by
2202 * preference. If we can't - try schannel, if that fails, try
2203 * anonymous.
2206 if ((conn->cli->user_name[0] == '\0') ||
2207 (conn->cli->domain[0] == '\0') ||
2208 (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
2210 status = get_trust_creds(domain, &machine_password,
2211 &machine_account, NULL);
2212 if (!NT_STATUS_IS_OK(status)) {
2213 DEBUG(10, ("cm_connect_sam: No no user available for "
2214 "domain %s, trying schannel\n", conn->cli->domain));
2215 goto schannel;
2217 domain_name = domain->name;
2218 } else {
2219 machine_password = SMB_STRDUP(conn->cli->password);
2220 machine_account = SMB_STRDUP(conn->cli->user_name);
2221 domain_name = conn->cli->domain;
2224 if (!machine_password || !machine_account) {
2225 status = NT_STATUS_NO_MEMORY;
2226 goto done;
2229 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2230 authenticated SAMR pipe with sign & seal. */
2231 status = cli_rpc_pipe_open_spnego(conn->cli,
2232 &ndr_table_samr,
2233 NCACN_NP,
2234 GENSEC_OID_NTLMSSP,
2235 DCERPC_AUTH_LEVEL_PRIVACY,
2236 smbXcli_conn_remote_name(conn->cli->conn),
2237 domain_name,
2238 machine_account,
2239 machine_password,
2240 &conn->samr_pipe);
2242 if (!NT_STATUS_IS_OK(status)) {
2243 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2244 "pipe for domain %s using NTLMSSP "
2245 "authenticated pipe: user %s\\%s. Error was "
2246 "%s\n", domain->name, domain_name,
2247 machine_account, nt_errstr(status)));
2248 goto schannel;
2251 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2252 "domain %s using NTLMSSP authenticated "
2253 "pipe: user %s\\%s\n", domain->name,
2254 domain_name, machine_account));
2256 status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2257 conn->samr_pipe->desthost,
2258 SEC_FLAG_MAXIMUM_ALLOWED,
2259 &conn->sam_connect_handle,
2260 &result);
2261 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2262 goto open_domain;
2264 if (NT_STATUS_IS_OK(status)) {
2265 status = result;
2268 DEBUG(10,("cm_connect_sam: ntlmssp-sealed dcerpc_samr_Connect2 "
2269 "failed for domain %s, error was %s. Trying schannel\n",
2270 domain->name, nt_errstr(status) ));
2271 TALLOC_FREE(conn->samr_pipe);
2273 schannel:
2275 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2277 status = cm_get_schannel_creds(domain, &p_creds);
2278 if (!NT_STATUS_IS_OK(status)) {
2279 /* If this call fails - conn->cli can now be NULL ! */
2280 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2281 "for domain %s (error %s), trying anon\n",
2282 domain->name,
2283 nt_errstr(status) ));
2284 goto anonymous;
2286 status = cli_rpc_pipe_open_schannel_with_key
2287 (conn->cli, &ndr_table_samr.syntax_id, NCACN_NP,
2288 DCERPC_AUTH_LEVEL_PRIVACY,
2289 domain->name, &p_creds, &conn->samr_pipe);
2291 if (!NT_STATUS_IS_OK(status)) {
2292 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2293 "domain %s using schannel. Error was %s\n",
2294 domain->name, nt_errstr(status) ));
2295 goto anonymous;
2297 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2298 "schannel.\n", domain->name ));
2300 status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2301 conn->samr_pipe->desthost,
2302 SEC_FLAG_MAXIMUM_ALLOWED,
2303 &conn->sam_connect_handle,
2304 &result);
2305 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2306 goto open_domain;
2308 if (NT_STATUS_IS_OK(status)) {
2309 status = result;
2311 DEBUG(10,("cm_connect_sam: schannel-sealed dcerpc_samr_Connect2 failed "
2312 "for domain %s, error was %s. Trying anonymous\n",
2313 domain->name, nt_errstr(status) ));
2314 TALLOC_FREE(conn->samr_pipe);
2316 anonymous:
2318 /* Finally fall back to anonymous. */
2319 status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
2320 &conn->samr_pipe);
2322 if (!NT_STATUS_IS_OK(status)) {
2323 goto done;
2326 status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2327 conn->samr_pipe->desthost,
2328 SEC_FLAG_MAXIMUM_ALLOWED,
2329 &conn->sam_connect_handle,
2330 &result);
2331 if (!NT_STATUS_IS_OK(status)) {
2332 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2333 "for domain %s Error was %s\n",
2334 domain->name, nt_errstr(status) ));
2335 goto done;
2337 if (!NT_STATUS_IS_OK(result)) {
2338 status = result;
2339 DEBUG(10,("cm_connect_sam: dcerpc_samr_Connect2 failed "
2340 "for domain %s Error was %s\n",
2341 domain->name, nt_errstr(result)));
2342 goto done;
2345 open_domain:
2346 status = dcerpc_samr_OpenDomain(conn->samr_pipe->binding_handle,
2347 mem_ctx,
2348 &conn->sam_connect_handle,
2349 SEC_FLAG_MAXIMUM_ALLOWED,
2350 &domain->sid,
2351 &conn->sam_domain_handle,
2352 &result);
2353 if (!NT_STATUS_IS_OK(status)) {
2354 goto done;
2357 status = result;
2358 done:
2360 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
2362 * if we got access denied, we might just have no access rights
2363 * to talk to the remote samr server server (e.g. when we are a
2364 * PDC and we are connecting a w2k8 pdc via an interdomain
2365 * trust). In that case do not invalidate the whole connection
2366 * stack
2368 TALLOC_FREE(conn->samr_pipe);
2369 ZERO_STRUCT(conn->sam_domain_handle);
2370 return status;
2371 } else if (!NT_STATUS_IS_OK(status)) {
2372 invalidate_cm_connection(conn);
2373 return status;
2376 *cli = conn->samr_pipe;
2377 *sam_handle = conn->sam_domain_handle;
2378 SAFE_FREE(machine_password);
2379 SAFE_FREE(machine_account);
2380 return status;
2383 /**********************************************************************
2384 open an schanneld ncacn_ip_tcp connection to LSA
2385 ***********************************************************************/
2387 NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
2388 TALLOC_CTX *mem_ctx,
2389 struct rpc_pipe_client **cli)
2391 struct winbindd_cm_conn *conn;
2392 struct netlogon_creds_CredentialState *creds;
2393 NTSTATUS status;
2395 DEBUG(10,("cm_connect_lsa_tcp\n"));
2397 status = init_dc_connection_rpc(domain);
2398 if (!NT_STATUS_IS_OK(status)) {
2399 return status;
2402 conn = &domain->conn;
2404 if (conn->lsa_pipe_tcp &&
2405 conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2406 conn->lsa_pipe_tcp->auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY &&
2407 rpccli_is_connected(conn->lsa_pipe_tcp)) {
2408 goto done;
2411 TALLOC_FREE(conn->lsa_pipe_tcp);
2413 status = cm_get_schannel_creds(domain, &creds);
2414 if (!NT_STATUS_IS_OK(status)) {
2415 goto done;
2418 status = cli_rpc_pipe_open_schannel_with_key(conn->cli,
2419 &ndr_table_lsarpc.syntax_id,
2420 NCACN_IP_TCP,
2421 DCERPC_AUTH_LEVEL_PRIVACY,
2422 domain->name,
2423 &creds,
2424 &conn->lsa_pipe_tcp);
2425 if (!NT_STATUS_IS_OK(status)) {
2426 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
2427 nt_errstr(status)));
2428 goto done;
2431 done:
2432 if (!NT_STATUS_IS_OK(status)) {
2433 TALLOC_FREE(conn->lsa_pipe_tcp);
2434 return status;
2437 *cli = conn->lsa_pipe_tcp;
2439 return status;
2442 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2443 struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2445 struct winbindd_cm_conn *conn;
2446 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2447 struct netlogon_creds_CredentialState *p_creds;
2449 result = init_dc_connection_rpc(domain);
2450 if (!NT_STATUS_IS_OK(result))
2451 return result;
2453 conn = &domain->conn;
2455 if (rpccli_is_connected(conn->lsa_pipe)) {
2456 goto done;
2459 TALLOC_FREE(conn->lsa_pipe);
2461 if ((conn->cli->user_name[0] == '\0') ||
2462 (conn->cli->domain[0] == '\0') ||
2463 (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
2464 DEBUG(10, ("cm_connect_lsa: No no user available for "
2465 "domain %s, trying schannel\n", conn->cli->domain));
2466 goto schannel;
2469 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2470 * authenticated LSA pipe with sign & seal. */
2471 result = cli_rpc_pipe_open_spnego
2472 (conn->cli, &ndr_table_lsarpc, NCACN_NP,
2473 GENSEC_OID_NTLMSSP,
2474 DCERPC_AUTH_LEVEL_PRIVACY,
2475 smbXcli_conn_remote_name(conn->cli->conn),
2476 conn->cli->domain, conn->cli->user_name, conn->cli->password,
2477 &conn->lsa_pipe);
2479 if (!NT_STATUS_IS_OK(result)) {
2480 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2481 "domain %s using NTLMSSP authenticated pipe: user "
2482 "%s\\%s. Error was %s. Trying schannel.\n",
2483 domain->name, conn->cli->domain,
2484 conn->cli->user_name, nt_errstr(result)));
2485 goto schannel;
2488 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2489 "NTLMSSP authenticated pipe: user %s\\%s\n",
2490 domain->name, conn->cli->domain, conn->cli->user_name ));
2492 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2493 SEC_FLAG_MAXIMUM_ALLOWED,
2494 &conn->lsa_policy);
2495 if (NT_STATUS_IS_OK(result)) {
2496 goto done;
2499 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2500 "schannel\n"));
2502 TALLOC_FREE(conn->lsa_pipe);
2504 schannel:
2506 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2508 result = cm_get_schannel_creds(domain, &p_creds);
2509 if (!NT_STATUS_IS_OK(result)) {
2510 /* If this call fails - conn->cli can now be NULL ! */
2511 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2512 "for domain %s (error %s), trying anon\n",
2513 domain->name,
2514 nt_errstr(result) ));
2515 goto anonymous;
2517 result = cli_rpc_pipe_open_schannel_with_key
2518 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2519 DCERPC_AUTH_LEVEL_PRIVACY,
2520 domain->name, &p_creds, &conn->lsa_pipe);
2522 if (!NT_STATUS_IS_OK(result)) {
2523 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2524 "domain %s using schannel. Error was %s\n",
2525 domain->name, nt_errstr(result) ));
2526 goto anonymous;
2528 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2529 "schannel.\n", domain->name ));
2531 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2532 SEC_FLAG_MAXIMUM_ALLOWED,
2533 &conn->lsa_policy);
2534 if (NT_STATUS_IS_OK(result)) {
2535 goto done;
2538 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2539 "anonymous\n"));
2541 TALLOC_FREE(conn->lsa_pipe);
2543 anonymous:
2545 result = cli_rpc_pipe_open_noauth(conn->cli,
2546 &ndr_table_lsarpc.syntax_id,
2547 &conn->lsa_pipe);
2548 if (!NT_STATUS_IS_OK(result)) {
2549 result = NT_STATUS_PIPE_NOT_AVAILABLE;
2550 goto done;
2553 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2554 SEC_FLAG_MAXIMUM_ALLOWED,
2555 &conn->lsa_policy);
2556 done:
2557 if (!NT_STATUS_IS_OK(result)) {
2558 invalidate_cm_connection(conn);
2559 return result;
2562 *cli = conn->lsa_pipe;
2563 *lsa_policy = conn->lsa_policy;
2564 return result;
2567 /****************************************************************************
2568 Open a LSA connection to a DC, suiteable for LSA lookup calls.
2569 ****************************************************************************/
2571 NTSTATUS cm_connect_lsat(struct winbindd_domain *domain,
2572 TALLOC_CTX *mem_ctx,
2573 struct rpc_pipe_client **cli,
2574 struct policy_handle *lsa_policy)
2576 NTSTATUS status;
2578 if (domain->can_do_ncacn_ip_tcp) {
2579 status = cm_connect_lsa_tcp(domain, mem_ctx, cli);
2580 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
2581 NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
2582 NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
2583 invalidate_cm_connection(&domain->conn);
2584 status = cm_connect_lsa_tcp(domain, mem_ctx, cli);
2586 if (!NT_STATUS_IS_OK(status)) {
2587 return status;
2590 return NT_STATUS_OK;
2593 status = cm_connect_lsa(domain, mem_ctx, cli, lsa_policy);
2595 return status;
2598 /****************************************************************************
2599 Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2600 session key stored in conn->netlogon_pipe->dc->sess_key.
2601 ****************************************************************************/
2603 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
2604 struct rpc_pipe_client **cli)
2606 struct winbindd_cm_conn *conn;
2607 NTSTATUS result;
2609 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS | NETLOGON_NEG_SUPPORTS_AES;
2610 uint8 mach_pwd[16];
2611 enum netr_SchannelType sec_chan_type;
2612 const char *account_name;
2613 struct rpc_pipe_client *netlogon_pipe = NULL;
2615 *cli = NULL;
2617 result = init_dc_connection_rpc(domain);
2618 if (!NT_STATUS_IS_OK(result)) {
2619 return result;
2622 conn = &domain->conn;
2624 if (rpccli_is_connected(conn->netlogon_pipe)) {
2625 *cli = conn->netlogon_pipe;
2626 return NT_STATUS_OK;
2629 TALLOC_FREE(conn->netlogon_pipe);
2631 result = cli_rpc_pipe_open_noauth(conn->cli,
2632 &ndr_table_netlogon.syntax_id,
2633 &netlogon_pipe);
2634 if (!NT_STATUS_IS_OK(result)) {
2635 return result;
2638 if ((!IS_DC) && (!domain->primary)) {
2639 /* Clear the schannel request bit and drop down */
2640 neg_flags &= ~NETLOGON_NEG_SCHANNEL;
2641 goto no_schannel;
2644 if (lp_client_schannel() != False) {
2645 neg_flags |= NETLOGON_NEG_SCHANNEL;
2648 if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
2649 &sec_chan_type))
2651 TALLOC_FREE(netlogon_pipe);
2652 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2655 result = rpccli_netlogon_setup_creds(
2656 netlogon_pipe,
2657 domain->dcname, /* server name. */
2658 domain->name, /* domain name */
2659 lp_netbios_name(), /* client name */
2660 account_name, /* machine account */
2661 mach_pwd, /* machine password */
2662 sec_chan_type, /* from get_trust_pw */
2663 &neg_flags);
2665 if (!NT_STATUS_IS_OK(result)) {
2666 TALLOC_FREE(netlogon_pipe);
2667 return result;
2670 if ((lp_client_schannel() == True) &&
2671 ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2672 DEBUG(3, ("Server did not offer schannel\n"));
2673 TALLOC_FREE(netlogon_pipe);
2674 return NT_STATUS_ACCESS_DENIED;
2677 no_schannel:
2678 if ((lp_client_schannel() == False) ||
2679 ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2681 * NetSamLogonEx only works for schannel
2683 domain->can_do_samlogon_ex = False;
2685 /* We're done - just keep the existing connection to NETLOGON
2686 * open */
2687 conn->netlogon_pipe = netlogon_pipe;
2688 *cli = conn->netlogon_pipe;
2689 return NT_STATUS_OK;
2692 /* Using the credentials from the first pipe, open a signed and sealed
2693 second netlogon pipe. The session key is stored in the schannel
2694 part of the new pipe auth struct.
2697 result = cli_rpc_pipe_open_schannel_with_key(
2698 conn->cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
2699 DCERPC_AUTH_LEVEL_PRIVACY, domain->name, &netlogon_pipe->dc,
2700 &conn->netlogon_pipe);
2702 /* We can now close the initial netlogon pipe. */
2703 TALLOC_FREE(netlogon_pipe);
2705 if (!NT_STATUS_IS_OK(result)) {
2706 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2707 "was %s\n", nt_errstr(result)));
2709 invalidate_cm_connection(conn);
2710 return result;
2714 * Always try netr_LogonSamLogonEx. We will fall back for NT4
2715 * which gives DCERPC_FAULT_OP_RNG_ERROR (function not
2716 * supported). We used to only try SamLogonEx for AD, but
2717 * Samba DCs can also do it. And because we don't distinguish
2718 * between Samba and NT4, always try it once.
2720 domain->can_do_samlogon_ex = true;
2722 *cli = conn->netlogon_pipe;
2723 return NT_STATUS_OK;
2726 void winbind_msg_ip_dropped(struct messaging_context *msg_ctx,
2727 void *private_data,
2728 uint32_t msg_type,
2729 struct server_id server_id,
2730 DATA_BLOB *data)
2732 struct winbindd_domain *domain;
2733 char *freeit = NULL;
2734 char *addr;
2736 if ((data == NULL)
2737 || (data->data == NULL)
2738 || (data->length == 0)
2739 || (data->data[data->length-1] != '\0')) {
2740 DEBUG(1, ("invalid msg_ip_dropped message: not a valid "
2741 "string\n"));
2742 return;
2745 addr = (char *)data->data;
2746 DEBUG(10, ("IP %s dropped\n", addr));
2748 if (!is_ipaddress(addr)) {
2749 char *slash;
2751 * Some code sends us ip addresses with the /netmask
2752 * suffix
2754 slash = strchr(addr, '/');
2755 if (slash == NULL) {
2756 DEBUG(1, ("invalid msg_ip_dropped message: %s",
2757 addr));
2758 return;
2760 freeit = talloc_strndup(talloc_tos(), addr, slash-addr);
2761 if (freeit == NULL) {
2762 DEBUG(1, ("talloc failed\n"));
2763 return;
2765 addr = freeit;
2766 DEBUG(10, ("Stripped /netmask to IP %s\n", addr));
2769 for (domain = domain_list(); domain != NULL; domain = domain->next) {
2770 char sockaddr[INET6_ADDRSTRLEN];
2772 if (!cli_state_is_connected(domain->conn.cli)) {
2773 continue;
2776 print_sockaddr(sockaddr, sizeof(sockaddr),
2777 smbXcli_conn_local_sockaddr(domain->conn.cli->conn));
2779 if (strequal(sockaddr, addr)) {
2780 smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
2783 TALLOC_FREE(freeit);