?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
provision: Make dsacl2fsacl() take a security.dom_sid, not str
[Samba/gebeck_regimport.git] / source3 / utils / net_rpc.c
blob60000242e05f025d79b2b14e97c7d130c2652c45
1 /*
2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
22
23 #include "includes.h"
24 #include "utils/net.h"
25 #include "rpc_client/cli_pipe.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_samr_c.h"
28 #include "rpc_client/cli_samr.h"
29 #include "rpc_client/init_samr.h"
30 #include "../librpc/gen_ndr/ndr_lsa_c.h"
31 #include "rpc_client/cli_lsarpc.h"
32 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
34 #include "../librpc/gen_ndr/ndr_spoolss.h"
35 #include "../librpc/gen_ndr/ndr_initshutdown_c.h"
36 #include "../librpc/gen_ndr/ndr_winreg_c.h"
37 #include "secrets.h"
38 #include "lib/netapi/netapi.h"
39 #include "lib/netapi/netapi_net.h"
40 #include "rpc_client/init_lsa.h"
41 #include "../libcli/security/security.h"
42 #include "libsmb/libsmb.h"
43 #include "libsmb/clirap.h"
44 #include "nsswitch/libwbclient/wbclient.h"
45 #include "passdb.h"
46 #include "../libcli/smb/smbXcli_base.h"
47
48 static int net_mode_share;
49 static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask);
50
51 /**
52 * @file net_rpc.c
53 *
54 * @brief RPC based subcommands for the 'net' utility.
55 *
56 * This file should contain much of the functionality that used to
57 * be found in rpcclient, execpt that the commands should change
58 * less often, and the fucntionality should be sane (the user is not
59 * expected to know a rid/sid before they conduct an operation etc.)
60 *
61 * @todo Perhaps eventually these should be split out into a number
62 * of files, as this could get quite big.
63 **/
64
65
66 /**
67 * Many of the RPC functions need the domain sid. This function gets
68 * it at the start of every run
69 *
70 * @param cli A cli_state already connected to the remote machine
71 *
72 * @return The Domain SID of the remote machine.
73 **/
74
75 NTSTATUS net_get_remote_domain_sid(struct cli_state *cli, TALLOC_CTX *mem_ctx,
76 struct dom_sid **domain_sid,
77 const char **domain_name)
78 {
79 struct rpc_pipe_client *lsa_pipe = NULL;
80 struct policy_handle pol;
81 NTSTATUS status, result;
82 union lsa_PolicyInformation *info = NULL;
83 struct dcerpc_binding_handle *b;
84
85 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
86 &lsa_pipe);
87 if (!NT_STATUS_IS_OK(status)) {
88 d_fprintf(stderr, _("Could not initialise lsa pipe\n"));
89 return status;
90 }
91
92 b = lsa_pipe->binding_handle;
93
94 status = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, false,
95 SEC_FLAG_MAXIMUM_ALLOWED,
96 &pol);
97 if (!NT_STATUS_IS_OK(status)) {
98 d_fprintf(stderr, "open_policy %s: %s\n",
99 _("failed"),
100 nt_errstr(status));
101 return status;
102 }
103
104 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
105 &pol,
106 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
107 &info,
108 &result);
109 if (!NT_STATUS_IS_OK(status)) {
110 d_fprintf(stderr, "lsaquery %s: %s\n",
111 _("failed"),
112 nt_errstr(status));
113 return status;
114 }
115 if (!NT_STATUS_IS_OK(result)) {
116 d_fprintf(stderr, "lsaquery %s: %s\n",
117 _("failed"),
118 nt_errstr(result));
119 return result;
120 }
121
122 *domain_name = info->account_domain.name.string;
123 *domain_sid = info->account_domain.sid;
124
125 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
126 TALLOC_FREE(lsa_pipe);
127
128 return NT_STATUS_OK;
129 }
130
131 /**
132 * Run a single RPC command, from start to finish.
133 *
134 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
135 * @param conn_flag a NET_FLAG_ combination. Passed to
136 * net_make_ipc_connection.
137 * @param argc Standard main() style argc.
138 * @param argv Standard main() style argv. Initial components are already
139 * stripped.
140 * @return A shell status integer (0 for success).
141 */
142
143 int run_rpc_command(struct net_context *c,
144 struct cli_state *cli_arg,
145 const struct ndr_interface_table *table,
146 int conn_flags,
147 rpc_command_fn fn,
148 int argc,
149 const char **argv)
150 {
151 struct cli_state *cli = NULL;
152 struct rpc_pipe_client *pipe_hnd = NULL;
153 TALLOC_CTX *mem_ctx;
154 NTSTATUS nt_status;
155 struct dom_sid *domain_sid;
156 const char *domain_name;
157 int ret = -1;
158
159 /* make use of cli_state handed over as an argument, if possible */
160 if (!cli_arg) {
161 nt_status = net_make_ipc_connection(c, conn_flags, &cli);
162 if (!NT_STATUS_IS_OK(nt_status)) {
163 DEBUG(1, ("failed to make ipc connection: %s\n",
164 nt_errstr(nt_status)));
165 return -1;
166 }
167 } else {
168 cli = cli_arg;
169 }
170
171 if (!cli) {
172 return -1;
173 }
174
175 /* Create mem_ctx */
176
177 if (!(mem_ctx = talloc_init("run_rpc_command"))) {
178 DEBUG(0, ("talloc_init() failed\n"));
179 goto fail;
180 }
181
182 nt_status = net_get_remote_domain_sid(cli, mem_ctx, &domain_sid,
183 &domain_name);
184 if (!NT_STATUS_IS_OK(nt_status)) {
185 goto fail;
186 }
187
188 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
189 if (lp_client_schannel()
190 && (ndr_syntax_id_equal(&table->syntax_id,
191 &ndr_table_netlogon.syntax_id))) {
192 /* Always try and create an schannel netlogon pipe. */
193 nt_status = cli_rpc_pipe_open_schannel(
194 cli, &table->syntax_id, NCACN_NP,
195 DCERPC_AUTH_LEVEL_PRIVACY, domain_name,
196 &pipe_hnd);
197 if (!NT_STATUS_IS_OK(nt_status)) {
198 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
199 nt_errstr(nt_status) ));
200 goto fail;
201 }
202 } else {
203 if (conn_flags & NET_FLAGS_SEAL) {
204 nt_status = cli_rpc_pipe_open_generic_auth(
205 cli, table,
206 (conn_flags & NET_FLAGS_TCP) ?
207 NCACN_IP_TCP : NCACN_NP,
208 DCERPC_AUTH_TYPE_NTLMSSP,
209 DCERPC_AUTH_LEVEL_PRIVACY,
210 smbXcli_conn_remote_name(cli->conn),
211 lp_workgroup(), c->opt_user_name,
212 c->opt_password, &pipe_hnd);
213 } else {
214 nt_status = cli_rpc_pipe_open_noauth(
215 cli, &table->syntax_id,
216 &pipe_hnd);
217 }
218 if (!NT_STATUS_IS_OK(nt_status)) {
219 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
220 table->name,
221 nt_errstr(nt_status) ));
222 goto fail;
223 }
224 }
225 }
226
227 nt_status = fn(c, domain_sid, domain_name, cli, pipe_hnd, mem_ctx, argc, argv);
228
229 if (!NT_STATUS_IS_OK(nt_status)) {
230 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status)));
231 } else {
232 ret = 0;
233 DEBUG(5, ("rpc command function succedded\n"));
234 }
235
236 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
237 if (pipe_hnd) {
238 TALLOC_FREE(pipe_hnd);
239 }
240 }
241
242 fail:
243 /* close the connection only if it was opened here */
244 if (!cli_arg) {
245 cli_shutdown(cli);
246 }
247
248 talloc_destroy(mem_ctx);
249 return ret;
250 }
251
252 /**
253 * Force a change of the trust acccount password.
254 *
255 * All parameters are provided by the run_rpc_command function, except for
256 * argc, argv which are passed through.
257 *
258 * @param domain_sid The domain sid acquired from the remote server.
259 * @param cli A cli_state connected to the server.
260 * @param mem_ctx Talloc context, destroyed on completion of the function.
261 * @param argc Standard main() style argc.
262 * @param argv Standard main() style argv. Initial components are already
263 * stripped.
264 *
265 * @return Normal NTSTATUS return.
266 **/
267
268 static NTSTATUS rpc_changetrustpw_internals(struct net_context *c,
269 const struct dom_sid *domain_sid,
270 const char *domain_name,
271 struct cli_state *cli,
272 struct rpc_pipe_client *pipe_hnd,
273 TALLOC_CTX *mem_ctx,
274 int argc,
275 const char **argv)
276 {
277 NTSTATUS status;
278
279 status = trust_pw_find_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup);
280 if (!NT_STATUS_IS_OK(status)) {
281 d_fprintf(stderr, _("Failed to change machine account password: %s\n"),
282 nt_errstr(status));
283 return status;
284 }
285
286 return NT_STATUS_OK;
287 }
288
289 /**
290 * Force a change of the trust acccount password.
291 *
292 * @param argc Standard main() style argc.
293 * @param argv Standard main() style argv. Initial components are already
294 * stripped.
295 *
296 * @return A shell status integer (0 for success).
297 **/
298
299 int net_rpc_changetrustpw(struct net_context *c, int argc, const char **argv)
300 {
301 if (c->display_usage) {
302 d_printf( "%s\n"
303 "net rpc changetrustpw\n"
304 " %s\n",
305 _("Usage:"),
306 _("Change the machine trust password"));
307 return 0;
308 }
309
310 return run_rpc_command(c, NULL, &ndr_table_netlogon,
311 NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
312 rpc_changetrustpw_internals,
313 argc, argv);
314 }
315
316 /**
317 * Join a domain, the old way.
318 *
319 * This uses 'machinename' as the inital password, and changes it.
320 *
321 * The password should be created with 'server manager' or equiv first.
322 *
323 * All parameters are provided by the run_rpc_command function, except for
324 * argc, argv which are passed through.
325 *
326 * @param domain_sid The domain sid acquired from the remote server.
327 * @param cli A cli_state connected to the server.
328 * @param mem_ctx Talloc context, destroyed on completion of the function.
329 * @param argc Standard main() style argc.
330 * @param argv Standard main() style argv. Initial components are already
331 * stripped.
332 *
333 * @return Normal NTSTATUS return.
334 **/
335
336 static NTSTATUS rpc_oldjoin_internals(struct net_context *c,
337 const struct dom_sid *domain_sid,
338 const char *domain_name,
339 struct cli_state *cli,
340 struct rpc_pipe_client *pipe_hnd,
341 TALLOC_CTX *mem_ctx,
342 int argc,
343 const char **argv)
344 {
345
346 fstring trust_passwd;
347 unsigned char orig_trust_passwd_hash[16];
348 NTSTATUS result;
349 enum netr_SchannelType sec_channel_type;
350
351 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
352 &pipe_hnd);
353 if (!NT_STATUS_IS_OK(result)) {
354 DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
355 "error was %s\n",
356 smbXcli_conn_remote_name(cli->conn),
357 nt_errstr(result) ));
358 return result;
359 }
360
361 /*
362 check what type of join - if the user want's to join as
363 a BDC, the server must agree that we are a BDC.
364 */
365 if (argc >= 0) {
366 sec_channel_type = get_sec_channel_type(argv[0]);
367 } else {
368 sec_channel_type = get_sec_channel_type(NULL);
369 }
370
371 fstrcpy(trust_passwd, lp_netbios_name());
372 strlower_m(trust_passwd);
373
374 /*
375 * Machine names can be 15 characters, but the max length on
376 * a password is 14. --jerry
377 */
378
379 trust_passwd[14] = '\0';
380
381 E_md4hash(trust_passwd, orig_trust_passwd_hash);
382
383 result = trust_pw_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup,
384 lp_netbios_name(),
385 orig_trust_passwd_hash,
386 sec_channel_type);
387
388 if (NT_STATUS_IS_OK(result))
389 printf(_("Joined domain %s.\n"), c->opt_target_workgroup);
390
391
392 if (!secrets_store_domain_sid(c->opt_target_workgroup, domain_sid)) {
393 DEBUG(0, ("error storing domain sid for %s\n", c->opt_target_workgroup));
394 result = NT_STATUS_UNSUCCESSFUL;
395 }
396
397 return result;
398 }
399
400 /**
401 * Join a domain, the old way.
402 *
403 * @param argc Standard main() style argc.
404 * @param argv Standard main() style argv. Initial components are already
405 * stripped.
406 *
407 * @return A shell status integer (0 for success).
408 **/
409
410 static int net_rpc_perform_oldjoin(struct net_context *c, int argc, const char **argv)
411 {
412 return run_rpc_command(c, NULL, &ndr_table_netlogon,
413 NET_FLAGS_NO_PIPE | NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
414 rpc_oldjoin_internals,
415 argc, argv);
416 }
417
418 /**
419 * Join a domain, the old way. This function exists to allow
420 * the message to be displayed when oldjoin was explicitly
421 * requested, but not when it was implied by "net rpc join".
422 *
423 * @param argc Standard main() style argc.
424 * @param argv Standard main() style argv. Initial components are already
425 * stripped.
426 *
427 * @return A shell status integer (0 for success).
428 **/
429
430 static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)
431 {
432 int rc = -1;
433
434 if (c->display_usage) {
435 d_printf( "%s\n"
436 "net rpc oldjoin\n"
437 " %s\n",
438 _("Usage:"),
439 _("Join a domain the old way"));
440 return 0;
441 }
442
443 rc = net_rpc_perform_oldjoin(c, argc, argv);
444
445 if (rc) {
446 d_fprintf(stderr, _("Failed to join domain\n"));
447 }
448
449 return rc;
450 }
451
452 /**
453 * 'net rpc join' entrypoint.
454 * @param argc Standard main() style argc.
455 * @param argv Standard main() style argv. Initial components are already
456 * stripped
457 *
458 * Main 'net_rpc_join()' (where the admin username/password is used) is
459 * in net_rpc_join.c.
460 * Try to just change the password, but if that doesn't work, use/prompt
461 * for a username/password.
462 **/
463
464 int net_rpc_join(struct net_context *c, int argc, const char **argv)
465 {
466 if (c->display_usage) {
467 d_printf("%s\n%s",
468 _("Usage:"),
469 _("net rpc join -U <username>[%%password] <type>\n"
470 " Join a domain\n"
471 " username\tName of the admin user"
472 " password\tPassword of the admin user, will "
473 "prompt if not specified\n"
474 " type\tCan be one of the following:\n"
475 "\t\tMEMBER\tJoin as member server (default)\n"
476 "\t\tBDC\tJoin as BDC\n"
477 "\t\tPDC\tJoin as PDC\n"));
478 return 0;
479 }
480
481 if (lp_server_role() == ROLE_STANDALONE) {
482 d_printf(_("cannot join as standalone machine\n"));
483 return -1;
484 }
485
486 if (strlen(lp_netbios_name()) > 15) {
487 d_printf(_("Our netbios name can be at most 15 chars long, "
488 "\"%s\" is %u chars long\n"),
489 lp_netbios_name(), (unsigned int)strlen(lp_netbios_name()));
490 return -1;
491 }
492
493 if ((net_rpc_perform_oldjoin(c, argc, argv) == 0))
494 return 0;
495
496 return net_rpc_join_newstyle(c, argc, argv);
497 }
498
499 /**
500 * display info about a rpc domain
501 *
502 * All parameters are provided by the run_rpc_command function, except for
503 * argc, argv which are passed through.
504 *
505 * @param domain_sid The domain sid acquired from the remote server
506 * @param cli A cli_state connected to the server.
507 * @param mem_ctx Talloc context, destroyed on completion of the function.
508 * @param argc Standard main() style argc.
509 * @param argv Standard main() style argv. Initial components are already
510 * stripped.
511 *
512 * @return Normal NTSTATUS return.
513 **/
514
515 NTSTATUS rpc_info_internals(struct net_context *c,
516 const struct dom_sid *domain_sid,
517 const char *domain_name,
518 struct cli_state *cli,
519 struct rpc_pipe_client *pipe_hnd,
520 TALLOC_CTX *mem_ctx,
521 int argc,
522 const char **argv)
523 {
524 struct policy_handle connect_pol, domain_pol;
525 NTSTATUS status, result;
526 union samr_DomainInfo *info = NULL;
527 fstring sid_str;
528 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
529
530 sid_to_fstring(sid_str, domain_sid);
531
532 /* Get sam policy handle */
533 status = dcerpc_samr_Connect2(b, mem_ctx,
534 pipe_hnd->desthost,
535 MAXIMUM_ALLOWED_ACCESS,
536 &connect_pol,
537 &result);
538 if (!NT_STATUS_IS_OK(status)) {
539 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
540 nt_errstr(status));
541 goto done;
542 }
543
544 if (!NT_STATUS_IS_OK(result)) {
545 status = result;
546 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
547 nt_errstr(result));
548 goto done;
549 }
550
551 /* Get domain policy handle */
552 status = dcerpc_samr_OpenDomain(b, mem_ctx,
553 &connect_pol,
554 MAXIMUM_ALLOWED_ACCESS,
555 discard_const_p(struct dom_sid2, domain_sid),
556 &domain_pol,
557 &result);
558 if (!NT_STATUS_IS_OK(status)) {
559 d_fprintf(stderr, _("Could not open domain: %s\n"),
560 nt_errstr(status));
561 goto done;
562 }
563 if (!NT_STATUS_IS_OK(result)) {
564 status = result;
565 d_fprintf(stderr, _("Could not open domain: %s\n"),
566 nt_errstr(result));
567 goto done;
568 }
569
570 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
571 &domain_pol,
572 2,
573 &info,
574 &result);
575 if (!NT_STATUS_IS_OK(status)) {
576 goto done;
577 }
578 status = result;
579 if (NT_STATUS_IS_OK(result)) {
580 d_printf(_("Domain Name: %s\n"),
581 info->general.domain_name.string);
582 d_printf(_("Domain SID: %s\n"), sid_str);
583 d_printf(_("Sequence number: %llu\n"),
584 (unsigned long long)info->general.sequence_num);
585 d_printf(_("Num users: %u\n"), info->general.num_users);
586 d_printf(_("Num domain groups: %u\n"),info->general.num_groups);
587 d_printf(_("Num local groups: %u\n"),info->general.num_aliases);
588 }
589
590 done:
591 return status;
592 }
593
594 /**
595 * 'net rpc info' entrypoint.
596 * @param argc Standard main() style argc.
597 * @param argv Standard main() style argv. Initial components are already
598 * stripped.
599 **/
600
601 int net_rpc_info(struct net_context *c, int argc, const char **argv)
602 {
603 if (c->display_usage) {
604 d_printf( "%s\n"
605 "net rpc info\n"
606 " %s\n",
607 _("Usage:"),
608 _("Display information about the domain"));
609 return 0;
610 }
611
612 return run_rpc_command(c, NULL, &ndr_table_samr,
613 NET_FLAGS_PDC, rpc_info_internals,
614 argc, argv);
615 }
616
617 /**
618 * Fetch domain SID into the local secrets.tdb.
619 *
620 * All parameters are provided by the run_rpc_command function, except for
621 * argc, argv which are passed through.
622 *
623 * @param domain_sid The domain sid acquired from the remote server.
624 * @param cli A cli_state connected to the server.
625 * @param mem_ctx Talloc context, destroyed on completion of the function.
626 * @param argc Standard main() style argc.
627 * @param argv Standard main() style argv. Initial components are already
628 * stripped.
629 *
630 * @return Normal NTSTATUS return.
631 **/
632
633 static NTSTATUS rpc_getsid_internals(struct net_context *c,
634 const struct dom_sid *domain_sid,
635 const char *domain_name,
636 struct cli_state *cli,
637 struct rpc_pipe_client *pipe_hnd,
638 TALLOC_CTX *mem_ctx,
639 int argc,
640 const char **argv)
641 {
642 fstring sid_str;
643
644 sid_to_fstring(sid_str, domain_sid);
645 d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
646 sid_str, domain_name);
647
648 if (!secrets_store_domain_sid(domain_name, domain_sid)) {
649 DEBUG(0,("Can't store domain SID\n"));
650 return NT_STATUS_UNSUCCESSFUL;
651 }
652
653 return NT_STATUS_OK;
654 }
655
656 /**
657 * 'net rpc getsid' entrypoint.
658 * @param argc Standard main() style argc.
659 * @param argv Standard main() style argv. Initial components are already
660 * stripped.
661 **/
662
663 int net_rpc_getsid(struct net_context *c, int argc, const char **argv)
664 {
665 int conn_flags = NET_FLAGS_PDC;
666
667 if (!c->opt_user_specified) {
668 conn_flags |= NET_FLAGS_ANONYMOUS;
669 }
670
671 if (c->display_usage) {
672 d_printf( "%s\n"
673 "net rpc getsid\n"
674 " %s\n",
675 _("Usage:"),
676 _("Fetch domain SID into local secrets.tdb"));
677 return 0;
678 }
679
680 return run_rpc_command(c, NULL, &ndr_table_samr,
681 conn_flags,
682 rpc_getsid_internals,
683 argc, argv);
684 }
685
686 /****************************************************************************/
687
688 /**
689 * Basic usage function for 'net rpc user'.
690 * @param argc Standard main() style argc.
691 * @param argv Standard main() style argv. Initial components are already
692 * stripped.
693 **/
694
695 static int rpc_user_usage(struct net_context *c, int argc, const char **argv)
696 {
697 return net_user_usage(c, argc, argv);
698 }
699
700 /**
701 * Add a new user to a remote RPC server.
702 *
703 * @param argc Standard main() style argc.
704 * @param argv Standard main() style argv. Initial components are already
705 * stripped.
706 *
707 * @return A shell status integer (0 for success).
708 **/
709
710 static int rpc_user_add(struct net_context *c, int argc, const char **argv)
711 {
712 NET_API_STATUS status;
713 struct USER_INFO_1 info1;
714 uint32_t parm_error = 0;
715
716 if (argc < 1 || c->display_usage) {
717 rpc_user_usage(c, argc, argv);
718 return 0;
719 }
720
721 ZERO_STRUCT(info1);
722
723 info1.usri1_name = argv[0];
724 if (argc == 2) {
725 info1.usri1_password = argv[1];
726 }
727
728 status = NetUserAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
729
730 if (status != 0) {
731 d_fprintf(stderr,_("Failed to add user '%s' with error: %s.\n"),
732 argv[0], libnetapi_get_error_string(c->netapi_ctx,
733 status));
734 return -1;
735 } else {
736 d_printf(_("Added user '%s'.\n"), argv[0]);
737 }
738
739 return 0;
740 }
741
742 /**
743 * Rename a user on a remote RPC server.
744 *
745 * @param argc Standard main() style argc.
746 * @param argv Standard main() style argv. Initial components are already
747 * stripped.
748 *
749 * @return A shell status integer (0 for success).
750 **/
751
752 static int rpc_user_rename(struct net_context *c, int argc, const char **argv)
753 {
754 NET_API_STATUS status;
755 struct USER_INFO_0 u0;
756 uint32_t parm_err = 0;
757
758 if (argc != 2 || c->display_usage) {
759 rpc_user_usage(c, argc, argv);
760 return 0;
761 }
762
763 u0.usri0_name = argv[1];
764
765 status = NetUserSetInfo(c->opt_host, argv[0],
766 0, (uint8_t *)&u0, &parm_err);
767 if (status) {
768 d_fprintf(stderr,
769 _("Failed to rename user from %s to %s - %s\n"),
770 argv[0], argv[1],
771 libnetapi_get_error_string(c->netapi_ctx, status));
772 } else {
773 d_printf(_("Renamed user from %s to %s\n"), argv[0], argv[1]);
774 }
775
776 return status;
777 }
778
779 /**
780 * Set a user's primary group
781 *
782 * @param argc Standard main() style argc.
783 * @param argv Standard main() style argv. Initial components are already
784 * stripped.
785 *
786 * @return A shell status integer (0 for success).
787 **/
788
789 static int rpc_user_setprimarygroup(struct net_context *c, int argc,
790 const char **argv)
791 {
792 NET_API_STATUS status;
793 uint8_t *buffer;
794 struct GROUP_INFO_2 *g2;
795 struct USER_INFO_1051 u1051;
796 uint32_t parm_err = 0;
797
798 if (argc != 2 || c->display_usage) {
799 rpc_user_usage(c, argc, argv);
800 return 0;
801 }
802
803 status = NetGroupGetInfo(c->opt_host, argv[1], 2, &buffer);
804 if (status) {
805 d_fprintf(stderr, _("Failed to find group name %s -- %s\n"),
806 argv[1],
807 libnetapi_get_error_string(c->netapi_ctx, status));
808 return status;
809 }
810 g2 = (struct GROUP_INFO_2 *)buffer;
811
812 u1051.usri1051_primary_group_id = g2->grpi2_group_id;
813
814 NetApiBufferFree(buffer);
815
816 status = NetUserSetInfo(c->opt_host, argv[0], 1051,
817 (uint8_t *)&u1051, &parm_err);
818 if (status) {
819 d_fprintf(stderr,
820 _("Failed to set user's primary group %s to %s - "
821 "%s\n"), argv[0], argv[1],
822 libnetapi_get_error_string(c->netapi_ctx, status));
823 } else {
824 d_printf(_("Set primary group of user %s to %s\n"), argv[0],
825 argv[1]);
826 }
827 return status;
828 }
829
830 /**
831 * Delete a user from a remote RPC server.
832 *
833 * @param argc Standard main() style argc.
834 * @param argv Standard main() style argv. Initial components are already
835 * stripped.
836 *
837 * @return A shell status integer (0 for success).
838 **/
839
840 static int rpc_user_delete(struct net_context *c, int argc, const char **argv)
841 {
842 NET_API_STATUS status;
843
844 if (argc < 1 || c->display_usage) {
845 rpc_user_usage(c, argc, argv);
846 return 0;
847 }
848
849 status = NetUserDel(c->opt_host, argv[0]);
850
851 if (status != 0) {
852 d_fprintf(stderr, _("Failed to delete user '%s' with: %s.\n"),
853 argv[0],
854 libnetapi_get_error_string(c->netapi_ctx, status));
855 return -1;
856 } else {
857 d_printf(_("Deleted user '%s'.\n"), argv[0]);
858 }
859
860 return 0;
861 }
862
863 /**
864 * Set a user's password on a remote RPC server.
865 *
866 * @param argc Standard main() style argc.
867 * @param argv Standard main() style argv. Initial components are already
868 * stripped.
869 *
870 * @return A shell status integer (0 for success).
871 **/
872
873 static int rpc_user_password(struct net_context *c, int argc, const char **argv)
874 {
875 NET_API_STATUS status;
876 char *prompt = NULL;
877 struct USER_INFO_1003 u1003;
878 uint32_t parm_err = 0;
879 int ret;
880
881 if (argc < 1 || c->display_usage) {
882 rpc_user_usage(c, argc, argv);
883 return 0;
884 }
885
886 if (argv[1]) {
887 u1003.usri1003_password = argv[1];
888 } else {
889 ret = asprintf(&prompt, _("Enter new password for %s:"),
890 argv[0]);
891 if (ret == -1) {
892 return -1;
893 }
894 u1003.usri1003_password = talloc_strdup(c, getpass(prompt));
895 SAFE_FREE(prompt);
896 if (u1003.usri1003_password == NULL) {
897 return -1;
898 }
899 }
900
901 status = NetUserSetInfo(c->opt_host, argv[0], 1003, (uint8_t *)&u1003, &parm_err);
902
903 /* Display results */
904 if (status != 0) {
905 d_fprintf(stderr,
906 _("Failed to set password for '%s' with error: %s.\n"),
907 argv[0], libnetapi_get_error_string(c->netapi_ctx,
908 status));
909 return -1;
910 }
911
912 return 0;
913 }
914
915 /**
916 * List a user's groups from a remote RPC server.
917 *
918 * @param argc Standard main() style argc.
919 * @param argv Standard main() style argv. Initial components are already
920 * stripped.
921 *
922 * @return A shell status integer (0 for success)
923 **/
924
925 static int rpc_user_info(struct net_context *c, int argc, const char **argv)
926
927 {
928 NET_API_STATUS status;
929 struct GROUP_USERS_INFO_0 *u0 = NULL;
930 uint32_t entries_read = 0;
931 uint32_t total_entries = 0;
932 int i;
933
934
935 if (argc < 1 || c->display_usage) {
936 rpc_user_usage(c, argc, argv);
937 return 0;
938 }
939
940 status = NetUserGetGroups(c->opt_host,
941 argv[0],
942 0,
943 (uint8_t **)(void *)&u0,
944 (uint32_t)-1,
945 &entries_read,
946 &total_entries);
947 if (status != 0) {
948 d_fprintf(stderr,
949 _("Failed to get groups for '%s' with error: %s.\n"),
950 argv[0], libnetapi_get_error_string(c->netapi_ctx,
951 status));
952 return -1;
953 }
954
955 for (i=0; i < entries_read; i++) {
956 printf("%s\n", u0->grui0_name);
957 u0++;
958 }
959
960 return 0;
961 }
962
963 /**
964 * List users on a remote RPC server.
965 *
966 * All parameters are provided by the run_rpc_command function, except for
967 * argc, argv which are passed through.
968 *
969 * @param domain_sid The domain sid acquired from the remote server.
970 * @param cli A cli_state connected to the server.
971 * @param mem_ctx Talloc context, destroyed on completion of the function.
972 * @param argc Standard main() style argc.
973 * @param argv Standard main() style argv. Initial components are already
974 * stripped.
975 *
976 * @return Normal NTSTATUS return.
977 **/
978
979 static int rpc_user_list(struct net_context *c, int argc, const char **argv)
980 {
981 NET_API_STATUS status;
982 uint32_t start_idx=0, num_entries, i, loop_count = 0;
983 struct NET_DISPLAY_USER *info = NULL;
984 void *buffer = NULL;
985
986 /* Query domain users */
987 if (c->opt_long_list_entries)
988 d_printf(_("\nUser name Comment"
989 "\n-----------------------------\n"));
990 do {
991 uint32_t max_entries, max_size;
992
993 dcerpc_get_query_dispinfo_params(
994 loop_count, &max_entries, &max_size);
995
996 status = NetQueryDisplayInformation(c->opt_host,
997 1,
998 start_idx,
999 max_entries,
1000 max_size,
1001 &num_entries,
1002 &buffer);
1003 if (status != 0 && status != ERROR_MORE_DATA) {
1004 return status;
1005 }
1006
1007 info = (struct NET_DISPLAY_USER *)buffer;
1008
1009 for (i = 0; i < num_entries; i++) {
1010
1011 if (c->opt_long_list_entries)
1012 printf("%-21.21s %s\n", info->usri1_name,
1013 info->usri1_comment);
1014 else
1015 printf("%s\n", info->usri1_name);
1016 info++;
1017 }
1018
1019 NetApiBufferFree(buffer);
1020
1021 loop_count++;
1022 start_idx += num_entries;
1023
1024 } while (status == ERROR_MORE_DATA);
1025
1026 return status;
1027 }
1028
1029 /**
1030 * 'net rpc user' entrypoint.
1031 * @param argc Standard main() style argc.
1032 * @param argv Standard main() style argv. Initial components are already
1033 * stripped.
1034 **/
1035
1036 int net_rpc_user(struct net_context *c, int argc, const char **argv)
1037 {
1038 NET_API_STATUS status;
1039
1040 struct functable func[] = {
1041 {
1042 "add",
1043 rpc_user_add,
1044 NET_TRANSPORT_RPC,
1045 N_("Add specified user"),
1046 N_("net rpc user add\n"
1047 " Add specified user")
1048 },
1049 {
1050 "info",
1051 rpc_user_info,
1052 NET_TRANSPORT_RPC,
1053 N_("List domain groups of user"),
1054 N_("net rpc user info\n"
1055 " List domain groups of user")
1056 },
1057 {
1058 "delete",
1059 rpc_user_delete,
1060 NET_TRANSPORT_RPC,
1061 N_("Remove specified user"),
1062 N_("net rpc user delete\n"
1063 " Remove specified user")
1064 },
1065 {
1066 "password",
1067 rpc_user_password,
1068 NET_TRANSPORT_RPC,
1069 N_("Change user password"),
1070 N_("net rpc user password\n"
1071 " Change user password")
1072 },
1073 {
1074 "rename",
1075 rpc_user_rename,
1076 NET_TRANSPORT_RPC,
1077 N_("Rename specified user"),
1078 N_("net rpc user rename\n"
1079 " Rename specified user")
1080 },
1081 {
1082 "setprimarygroup",
1083 rpc_user_setprimarygroup,
1084 NET_TRANSPORT_RPC,
1085 "Set a user's primary group",
1086 "net rpc user setprimarygroup\n"
1087 " Set a user's primary group"
1088 },
1089 {NULL, NULL, 0, NULL, NULL}
1090 };
1091
1092 status = libnetapi_net_init(&c->netapi_ctx);
1093 if (status != 0) {
1094 return -1;
1095 }
1096 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
1097 libnetapi_set_password(c->netapi_ctx, c->opt_password);
1098 if (c->opt_kerberos) {
1099 libnetapi_set_use_kerberos(c->netapi_ctx);
1100 }
1101
1102 if (argc == 0) {
1103 if (c->display_usage) {
1104 d_printf( "%s\n"
1105 "net rpc user\n"
1106 " %s\n",
1107 _("Usage:"),
1108 _("List all users"));
1109 net_display_usage_from_functable(func);
1110 return 0;
1111 }
1112
1113 return rpc_user_list(c, argc, argv);
1114 }
1115
1116 return net_run_function(c, argc, argv, "net rpc user", func);
1117 }
1118
1119 static NTSTATUS rpc_sh_user_list(struct net_context *c,
1120 TALLOC_CTX *mem_ctx,
1121 struct rpc_sh_ctx *ctx,
1122 struct rpc_pipe_client *pipe_hnd,
1123 int argc, const char **argv)
1124 {
1125 return werror_to_ntstatus(W_ERROR(rpc_user_list(c, argc, argv)));
1126 }
1127
1128 static NTSTATUS rpc_sh_user_info(struct net_context *c,
1129 TALLOC_CTX *mem_ctx,
1130 struct rpc_sh_ctx *ctx,
1131 struct rpc_pipe_client *pipe_hnd,
1132 int argc, const char **argv)
1133 {
1134 return werror_to_ntstatus(W_ERROR(rpc_user_info(c, argc, argv)));
1135 }
1136
1137 static NTSTATUS rpc_sh_handle_user(struct net_context *c,
1138 TALLOC_CTX *mem_ctx,
1139 struct rpc_sh_ctx *ctx,
1140 struct rpc_pipe_client *pipe_hnd,
1141 int argc, const char **argv,
1142 NTSTATUS (*fn)(
1143 struct net_context *c,
1144 TALLOC_CTX *mem_ctx,
1145 struct rpc_sh_ctx *ctx,
1146 struct rpc_pipe_client *pipe_hnd,
1147 struct policy_handle *user_hnd,
1148 int argc, const char **argv))
1149 {
1150 struct policy_handle connect_pol, domain_pol, user_pol;
1151 NTSTATUS status, result;
1152 struct dom_sid sid;
1153 uint32 rid;
1154 enum lsa_SidType type;
1155 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1156
1157 if (argc == 0) {
1158 d_fprintf(stderr, "%s %s <username>\n", _("Usage:"),
1159 ctx->whoami);
1160 return NT_STATUS_INVALID_PARAMETER;
1161 }
1162
1163 ZERO_STRUCT(connect_pol);
1164 ZERO_STRUCT(domain_pol);
1165 ZERO_STRUCT(user_pol);
1166
1167 status = net_rpc_lookup_name(c, mem_ctx, rpc_pipe_np_smb_conn(pipe_hnd),
1168 argv[0], NULL, NULL, &sid, &type);
1169 if (!NT_STATUS_IS_OK(status)) {
1170 d_fprintf(stderr, _("Could not lookup %s: %s\n"), argv[0],
1171 nt_errstr(status));
1172 goto done;
1173 }
1174
1175 if (type != SID_NAME_USER) {
1176 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
1177 sid_type_lookup(type));
1178 status = NT_STATUS_NO_SUCH_USER;
1179 goto done;
1180 }
1181
1182 if (!sid_peek_check_rid(ctx->domain_sid, &sid, &rid)) {
1183 d_fprintf(stderr, _("%s is not in our domain\n"), argv[0]);
1184 status = NT_STATUS_NO_SUCH_USER;
1185 goto done;
1186 }
1187
1188 status = dcerpc_samr_Connect2(b, mem_ctx,
1189 pipe_hnd->desthost,
1190 MAXIMUM_ALLOWED_ACCESS,
1191 &connect_pol,
1192 &result);
1193 if (!NT_STATUS_IS_OK(status)) {
1194 goto done;
1195 }
1196 if (!NT_STATUS_IS_OK(result)) {
1197 status = result;
1198 goto done;
1199 }
1200
1201 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1202 &connect_pol,
1203 MAXIMUM_ALLOWED_ACCESS,
1204 ctx->domain_sid,
1205 &domain_pol,
1206 &result);
1207 if (!NT_STATUS_IS_OK(status)) {
1208 goto done;
1209 }
1210 if (!NT_STATUS_IS_OK(result)) {
1211 status = result;
1212 goto done;
1213 }
1214
1215 status = dcerpc_samr_OpenUser(b, mem_ctx,
1216 &domain_pol,
1217 MAXIMUM_ALLOWED_ACCESS,
1218 rid,
1219 &user_pol,
1220 &result);
1221 if (!NT_STATUS_IS_OK(status)) {
1222 goto done;
1223 }
1224 if (!NT_STATUS_IS_OK(result)) {
1225 status = result;
1226 goto done;
1227 }
1228
1229 status = fn(c, mem_ctx, ctx, pipe_hnd, &user_pol, argc-1, argv+1);
1230
1231 done:
1232 if (is_valid_policy_hnd(&user_pol)) {
1233 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1234 }
1235 if (is_valid_policy_hnd(&domain_pol)) {
1236 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1237 }
1238 if (is_valid_policy_hnd(&connect_pol)) {
1239 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
1240 }
1241 return status;
1242 }
1243
1244 static NTSTATUS rpc_sh_user_show_internals(struct net_context *c,
1245 TALLOC_CTX *mem_ctx,
1246 struct rpc_sh_ctx *ctx,
1247 struct rpc_pipe_client *pipe_hnd,
1248 struct policy_handle *user_hnd,
1249 int argc, const char **argv)
1250 {
1251 NTSTATUS status, result;
1252 union samr_UserInfo *info = NULL;
1253 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1254
1255 if (argc != 0) {
1256 d_fprintf(stderr, "%s %s show <username>\n", _("Usage:"),
1257 ctx->whoami);
1258 return NT_STATUS_INVALID_PARAMETER;
1259 }
1260
1261 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1262 user_hnd,
1263 21,
1264 &info,
1265 &result);
1266 if (!NT_STATUS_IS_OK(status)) {
1267 return status;
1268 }
1269 if (!NT_STATUS_IS_OK(result)) {
1270 return result;
1271 }
1272
1273 d_printf(_("user rid: %d, group rid: %d\n"),
1274 info->info21.rid,
1275 info->info21.primary_gid);
1276
1277 return result;
1278 }
1279
1280 static NTSTATUS rpc_sh_user_show(struct net_context *c,
1281 TALLOC_CTX *mem_ctx,
1282 struct rpc_sh_ctx *ctx,
1283 struct rpc_pipe_client *pipe_hnd,
1284 int argc, const char **argv)
1285 {
1286 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1287 rpc_sh_user_show_internals);
1288 }
1289
1290 #define FETCHSTR(name, rec) \
1291 do { if (strequal(ctx->thiscmd, name)) { \
1292 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1293 } while (0);
1294
1295 #define SETSTR(name, rec, flag) \
1296 do { if (strequal(ctx->thiscmd, name)) { \
1297 init_lsa_String(&(info->info21.rec), argv[0]); \
1298 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1299 } while (0);
1300
1301 static NTSTATUS rpc_sh_user_str_edit_internals(struct net_context *c,
1302 TALLOC_CTX *mem_ctx,
1303 struct rpc_sh_ctx *ctx,
1304 struct rpc_pipe_client *pipe_hnd,
1305 struct policy_handle *user_hnd,
1306 int argc, const char **argv)
1307 {
1308 NTSTATUS status, result;
1309 const char *username;
1310 const char *oldval = "";
1311 union samr_UserInfo *info = NULL;
1312 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1313
1314 if (argc > 1) {
1315 d_fprintf(stderr, "%s %s <username> [new value|NULL]\n",
1316 _("Usage:"), ctx->whoami);
1317 return NT_STATUS_INVALID_PARAMETER;
1318 }
1319
1320 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1321 user_hnd,
1322 21,
1323 &info,
1324 &result);
1325 if (!NT_STATUS_IS_OK(status)) {
1326 return status;
1327 }
1328 if (!NT_STATUS_IS_OK(result)) {
1329 return result;
1330 }
1331
1332 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1333
1334 FETCHSTR("fullname", full_name);
1335 FETCHSTR("homedir", home_directory);
1336 FETCHSTR("homedrive", home_drive);
1337 FETCHSTR("logonscript", logon_script);
1338 FETCHSTR("profilepath", profile_path);
1339 FETCHSTR("description", description);
1340
1341 if (argc == 0) {
1342 d_printf(_("%s's %s: [%s]\n"), username, ctx->thiscmd, oldval);
1343 goto done;
1344 }
1345
1346 if (strcmp(argv[0], "NULL") == 0) {
1347 argv[0] = "";
1348 }
1349
1350 ZERO_STRUCT(info->info21);
1351
1352 SETSTR("fullname", full_name, FULL_NAME);
1353 SETSTR("homedir", home_directory, HOME_DIRECTORY);
1354 SETSTR("homedrive", home_drive, HOME_DRIVE);
1355 SETSTR("logonscript", logon_script, LOGON_SCRIPT);
1356 SETSTR("profilepath", profile_path, PROFILE_PATH);
1357 SETSTR("description", description, DESCRIPTION);
1358
1359 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1360 user_hnd,
1361 21,
1362 info,
1363 &result);
1364 if (!NT_STATUS_IS_OK(status)) {
1365 return status;
1366 }
1367
1368 status = result;
1369
1370 d_printf(_("Set %s's %s from [%s] to [%s]\n"), username,
1371 ctx->thiscmd, oldval, argv[0]);
1372
1373 done:
1374
1375 return status;
1376 }
1377
1378 #define HANDLEFLG(name, rec) \
1379 do { if (strequal(ctx->thiscmd, name)) { \
1380 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1381 if (newval) { \
1382 newflags = oldflags | ACB_##rec; \
1383 } else { \
1384 newflags = oldflags & ~ACB_##rec; \
1385 } } } while (0);
1386
1387 static NTSTATUS rpc_sh_user_str_edit(struct net_context *c,
1388 TALLOC_CTX *mem_ctx,
1389 struct rpc_sh_ctx *ctx,
1390 struct rpc_pipe_client *pipe_hnd,
1391 int argc, const char **argv)
1392 {
1393 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1394 rpc_sh_user_str_edit_internals);
1395 }
1396
1397 static NTSTATUS rpc_sh_user_flag_edit_internals(struct net_context *c,
1398 TALLOC_CTX *mem_ctx,
1399 struct rpc_sh_ctx *ctx,
1400 struct rpc_pipe_client *pipe_hnd,
1401 struct policy_handle *user_hnd,
1402 int argc, const char **argv)
1403 {
1404 NTSTATUS status, result;
1405 const char *username;
1406 const char *oldval = "unknown";
1407 uint32 oldflags, newflags;
1408 bool newval;
1409 union samr_UserInfo *info = NULL;
1410 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1411
1412 if ((argc > 1) ||
1413 ((argc == 1) && !strequal(argv[0], "yes") &&
1414 !strequal(argv[0], "no"))) {
1415 /* TRANSATORS: The yes|no here are program keywords. Please do
1416 not translate. */
1417 d_fprintf(stderr, _("Usage: %s <username> [yes|no]\n"),
1418 ctx->whoami);
1419 return NT_STATUS_INVALID_PARAMETER;
1420 }
1421
1422 newval = strequal(argv[0], "yes");
1423
1424 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1425 user_hnd,
1426 21,
1427 &info,
1428 &result);
1429 if (!NT_STATUS_IS_OK(status)) {
1430 return status;
1431 }
1432 if (!NT_STATUS_IS_OK(result)) {
1433 return result;
1434 }
1435
1436 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1437 oldflags = info->info21.acct_flags;
1438 newflags = info->info21.acct_flags;
1439
1440 HANDLEFLG("disabled", DISABLED);
1441 HANDLEFLG("pwnotreq", PWNOTREQ);
1442 HANDLEFLG("autolock", AUTOLOCK);
1443 HANDLEFLG("pwnoexp", PWNOEXP);
1444
1445 if (argc == 0) {
1446 d_printf(_("%s's %s flag: %s\n"), username, ctx->thiscmd,
1447 oldval);
1448 goto done;
1449 }
1450
1451 ZERO_STRUCT(info->info21);
1452
1453 info->info21.acct_flags = newflags;
1454 info->info21.fields_present = SAMR_FIELD_ACCT_FLAGS;
1455
1456 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1457 user_hnd,
1458 21,
1459 info,
1460 &result);
1461 if (!NT_STATUS_IS_OK(status)) {
1462 goto done;
1463 }
1464 status = result;
1465 if (NT_STATUS_IS_OK(result)) {
1466 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username,
1467 ctx->thiscmd, oldval, argv[0]);
1468 }
1469
1470 done:
1471
1472 return status;
1473 }
1474
1475 static NTSTATUS rpc_sh_user_flag_edit(struct net_context *c,
1476 TALLOC_CTX *mem_ctx,
1477 struct rpc_sh_ctx *ctx,
1478 struct rpc_pipe_client *pipe_hnd,
1479 int argc, const char **argv)
1480 {
1481 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1482 rpc_sh_user_flag_edit_internals);
1483 }
1484
1485 struct rpc_sh_cmd *net_rpc_user_edit_cmds(struct net_context *c,
1486 TALLOC_CTX *mem_ctx,
1487 struct rpc_sh_ctx *ctx)
1488 {
1489 static struct rpc_sh_cmd cmds[] = {
1490
1491 { "fullname", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1492 N_("Show/Set a user's full name") },
1493
1494 { "homedir", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1495 N_("Show/Set a user's home directory") },
1496
1497 { "homedrive", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1498 N_("Show/Set a user's home drive") },
1499
1500 { "logonscript", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1501 N_("Show/Set a user's logon script") },
1502
1503 { "profilepath", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1504 N_("Show/Set a user's profile path") },
1505
1506 { "description", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1507 N_("Show/Set a user's description") },
1508
1509 { "disabled", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1510 N_("Show/Set whether a user is disabled") },
1511
1512 { "autolock", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1513 N_("Show/Set whether a user locked out") },
1514
1515 { "pwnotreq", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1516 N_("Show/Set whether a user does not need a password") },
1517
1518 { "pwnoexp", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1519 N_("Show/Set whether a user's password does not expire") },
1520
1521 { NULL, NULL, 0, NULL, NULL }
1522 };
1523
1524 return cmds;
1525 }
1526
1527 struct rpc_sh_cmd *net_rpc_user_cmds(struct net_context *c,
1528 TALLOC_CTX *mem_ctx,
1529 struct rpc_sh_ctx *ctx)
1530 {
1531 static struct rpc_sh_cmd cmds[] = {
1532
1533 { "list", NULL, &ndr_table_samr, rpc_sh_user_list,
1534 N_("List available users") },
1535
1536 { "info", NULL, &ndr_table_samr, rpc_sh_user_info,
1537 N_("List the domain groups a user is member of") },
1538
1539 { "show", NULL, &ndr_table_samr, rpc_sh_user_show,
1540 N_("Show info about a user") },
1541
1542 { "edit", net_rpc_user_edit_cmds, 0, NULL,
1543 N_("Show/Modify a user's fields") },
1544
1545 { NULL, NULL, 0, NULL, NULL }
1546 };
1547
1548 return cmds;
1549 }
1550
1551 /****************************************************************************/
1552
1553 /**
1554 * Basic usage function for 'net rpc group'.
1555 * @param argc Standard main() style argc.
1556 * @param argv Standard main() style argv. Initial components are already
1557 * stripped.
1558 **/
1559
1560 static int rpc_group_usage(struct net_context *c, int argc, const char **argv)
1561 {
1562 return net_group_usage(c, argc, argv);
1563 }
1564
1565 /**
1566 * Delete group on a remote RPC server.
1567 *
1568 * All parameters are provided by the run_rpc_command function, except for
1569 * argc, argv which are passed through.
1570 *
1571 * @param domain_sid The domain sid acquired from the remote server.
1572 * @param cli A cli_state connected to the server.
1573 * @param mem_ctx Talloc context, destroyed on completion of the function.
1574 * @param argc Standard main() style argc.
1575 * @param argv Standard main() style argv. Initial components are already
1576 * stripped.
1577 *
1578 * @return Normal NTSTATUS return.
1579 **/
1580
1581 static NTSTATUS rpc_group_delete_internals(struct net_context *c,
1582 const struct dom_sid *domain_sid,
1583 const char *domain_name,
1584 struct cli_state *cli,
1585 struct rpc_pipe_client *pipe_hnd,
1586 TALLOC_CTX *mem_ctx,
1587 int argc,
1588 const char **argv)
1589 {
1590 struct policy_handle connect_pol, domain_pol, group_pol, user_pol;
1591 bool group_is_primary = false;
1592 NTSTATUS status, result;
1593 uint32_t group_rid;
1594 struct samr_RidAttrArray *rids = NULL;
1595 /* char **names; */
1596 int i;
1597 /* struct samr_RidWithAttribute *user_gids; */
1598 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1599
1600 struct samr_Ids group_rids, name_types;
1601 struct lsa_String lsa_acct_name;
1602 union samr_UserInfo *info = NULL;
1603
1604 if (argc < 1 || c->display_usage) {
1605 rpc_group_usage(c, argc,argv);
1606 return NT_STATUS_OK; /* ok? */
1607 }
1608
1609 status = dcerpc_samr_Connect2(b, mem_ctx,
1610 pipe_hnd->desthost,
1611 MAXIMUM_ALLOWED_ACCESS,
1612 &connect_pol,
1613 &result);
1614 if (!NT_STATUS_IS_OK(status)) {
1615 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1616 goto done;
1617 }
1618
1619 if (!NT_STATUS_IS_OK(result)) {
1620 status = result;
1621 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1622 goto done;
1623 }
1624
1625 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1626 &connect_pol,
1627 MAXIMUM_ALLOWED_ACCESS,
1628 discard_const_p(struct dom_sid2, domain_sid),
1629 &domain_pol,
1630 &result);
1631 if (!NT_STATUS_IS_OK(status)) {
1632 d_fprintf(stderr, _("Request open_domain failed\n"));
1633 goto done;
1634 }
1635
1636 if (!NT_STATUS_IS_OK(result)) {
1637 status = result;
1638 d_fprintf(stderr, _("Request open_domain failed\n"));
1639 goto done;
1640 }
1641
1642 init_lsa_String(&lsa_acct_name, argv[0]);
1643
1644 status = dcerpc_samr_LookupNames(b, mem_ctx,
1645 &domain_pol,
1646 1,
1647 &lsa_acct_name,
1648 &group_rids,
1649 &name_types,
1650 &result);
1651 if (!NT_STATUS_IS_OK(status)) {
1652 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1653 goto done;
1654 }
1655
1656 if (!NT_STATUS_IS_OK(result)) {
1657 status = result;
1658 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1659 goto done;
1660 }
1661
1662 switch (name_types.ids[0])
1663 {
1664 case SID_NAME_DOM_GRP:
1665 status = dcerpc_samr_OpenGroup(b, mem_ctx,
1666 &domain_pol,
1667 MAXIMUM_ALLOWED_ACCESS,
1668 group_rids.ids[0],
1669 &group_pol,
1670 &result);
1671 if (!NT_STATUS_IS_OK(status)) {
1672 d_fprintf(stderr, _("Request open_group failed"));
1673 goto done;
1674 }
1675
1676 if (!NT_STATUS_IS_OK(result)) {
1677 status = result;
1678 d_fprintf(stderr, _("Request open_group failed"));
1679 goto done;
1680 }
1681
1682 group_rid = group_rids.ids[0];
1683
1684 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
1685 &group_pol,
1686 &rids,
1687 &result);
1688 if (!NT_STATUS_IS_OK(status)) {
1689 d_fprintf(stderr,
1690 _("Unable to query group members of %s"),
1691 argv[0]);
1692 goto done;
1693 }
1694
1695 if (!NT_STATUS_IS_OK(result)) {
1696 status = result;
1697 d_fprintf(stderr,
1698 _("Unable to query group members of %s"),
1699 argv[0]);
1700 goto done;
1701 }
1702
1703 if (c->opt_verbose) {
1704 d_printf(
1705 _("Domain Group %s (rid: %d) has %d members\n"),
1706 argv[0],group_rid, rids->count);
1707 }
1708
1709 /* Check if group is anyone's primary group */
1710 for (i = 0; i < rids->count; i++)
1711 {
1712 status = dcerpc_samr_OpenUser(b, mem_ctx,
1713 &domain_pol,
1714 MAXIMUM_ALLOWED_ACCESS,
1715 rids->rids[i],
1716 &user_pol,
1717 &result);
1718 if (!NT_STATUS_IS_OK(status)) {
1719 d_fprintf(stderr,
1720 _("Unable to open group member %d\n"),
1721 rids->rids[i]);
1722 goto done;
1723 }
1724
1725 if (!NT_STATUS_IS_OK(result)) {
1726 status = result;
1727 d_fprintf(stderr,
1728 _("Unable to open group member %d\n"),
1729 rids->rids[i]);
1730 goto done;
1731 }
1732
1733 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1734 &user_pol,
1735 21,
1736 &info,
1737 &result);
1738 if (!NT_STATUS_IS_OK(status)) {
1739 d_fprintf(stderr,
1740 _("Unable to lookup userinfo for group "
1741 "member %d\n"),
1742 rids->rids[i]);
1743 goto done;
1744 }
1745
1746 if (!NT_STATUS_IS_OK(result)) {
1747 status = result;
1748 d_fprintf(stderr,
1749 _("Unable to lookup userinfo for group "
1750 "member %d\n"),
1751 rids->rids[i]);
1752 goto done;
1753 }
1754
1755 if (info->info21.primary_gid == group_rid) {
1756 if (c->opt_verbose) {
1757 d_printf(_("Group is primary group "
1758 "of %s\n"),
1759 info->info21.account_name.string);
1760 }
1761 group_is_primary = true;
1762 }
1763
1764 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1765 }
1766
1767 if (group_is_primary) {
1768 d_fprintf(stderr, _("Unable to delete group because "
1769 "some of it's members have it as primary "
1770 "group\n"));
1771 status = NT_STATUS_MEMBERS_PRIMARY_GROUP;
1772 goto done;
1773 }
1774
1775 /* remove all group members */
1776 for (i = 0; i < rids->count; i++)
1777 {
1778 if (c->opt_verbose)
1779 d_printf(_("Remove group member %d..."),
1780 rids->rids[i]);
1781 status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
1782 &group_pol,
1783 rids->rids[i],
1784 &result);
1785 if (!NT_STATUS_IS_OK(status)) {
1786 goto done;
1787 }
1788 status = result;
1789 if (NT_STATUS_IS_OK(result)) {
1790 if (c->opt_verbose)
1791 d_printf(_("ok\n"));
1792 } else {
1793 if (c->opt_verbose)
1794 d_printf("%s\n", _("failed"));
1795 goto done;
1796 }
1797 }
1798
1799 status = dcerpc_samr_DeleteDomainGroup(b, mem_ctx,
1800 &group_pol,
1801 &result);
1802 if (!NT_STATUS_IS_OK(status)) {
1803 break;
1804 }
1805
1806 status = result;
1807
1808 break;
1809 /* removing a local group is easier... */
1810 case SID_NAME_ALIAS:
1811 status = dcerpc_samr_OpenAlias(b, mem_ctx,
1812 &domain_pol,
1813 MAXIMUM_ALLOWED_ACCESS,
1814 group_rids.ids[0],
1815 &group_pol,
1816 &result);
1817 if (!NT_STATUS_IS_OK(status)) {
1818 d_fprintf(stderr, _("Request open_alias failed\n"));
1819 goto done;
1820 }
1821 if (!NT_STATUS_IS_OK(result)) {
1822 status = result;
1823 d_fprintf(stderr, _("Request open_alias failed\n"));
1824 goto done;
1825 }
1826
1827 status = dcerpc_samr_DeleteDomAlias(b, mem_ctx,
1828 &group_pol,
1829 &result);
1830 if (!NT_STATUS_IS_OK(status)) {
1831 break;
1832 }
1833
1834 status = result;
1835
1836 break;
1837 default:
1838 d_fprintf(stderr, _("%s is of type %s. This command is only "
1839 "for deleting local or global groups\n"),
1840 argv[0],sid_type_lookup(name_types.ids[0]));
1841 status = NT_STATUS_UNSUCCESSFUL;
1842 goto done;
1843 }
1844
1845 if (NT_STATUS_IS_OK(status)) {
1846 if (c->opt_verbose)
1847 d_printf(_("Deleted %s '%s'\n"),
1848 sid_type_lookup(name_types.ids[0]), argv[0]);
1849 } else {
1850 d_fprintf(stderr, _("Deleting of %s failed: %s\n"), argv[0],
1851 get_friendly_nt_error_msg(status));
1852 }
1853
1854 done:
1855 return status;
1856
1857 }
1858
1859 static int rpc_group_delete(struct net_context *c, int argc, const char **argv)
1860 {
1861 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
1862 rpc_group_delete_internals, argc,argv);
1863 }
1864
1865 static int rpc_group_add_internals(struct net_context *c, int argc, const char **argv)
1866 {
1867 NET_API_STATUS status;
1868 struct GROUP_INFO_1 info1;
1869 uint32_t parm_error = 0;
1870
1871 if (argc != 1 || c->display_usage) {
1872 rpc_group_usage(c, argc, argv);
1873 return 0;
1874 }
1875
1876 ZERO_STRUCT(info1);
1877
1878 info1.grpi1_name = argv[0];
1879 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1880 info1.grpi1_comment = c->opt_comment;
1881 }
1882
1883 status = NetGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1884
1885 if (status != 0) {
1886 d_fprintf(stderr,
1887 _("Failed to add group '%s' with error: %s.\n"),
1888 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1889 status));
1890 return -1;
1891 } else {
1892 d_printf(_("Added group '%s'.\n"), argv[0]);
1893 }
1894
1895 return 0;
1896 }
1897
1898 static int rpc_alias_add_internals(struct net_context *c, int argc, const char **argv)
1899 {
1900 NET_API_STATUS status;
1901 struct LOCALGROUP_INFO_1 info1;
1902 uint32_t parm_error = 0;
1903
1904 if (argc != 1 || c->display_usage) {
1905 rpc_group_usage(c, argc, argv);
1906 return 0;
1907 }
1908
1909 ZERO_STRUCT(info1);
1910
1911 info1.lgrpi1_name = argv[0];
1912 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1913 info1.lgrpi1_comment = c->opt_comment;
1914 }
1915
1916 status = NetLocalGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1917
1918 if (status != 0) {
1919 d_fprintf(stderr,
1920 _("Failed to add alias '%s' with error: %s.\n"),
1921 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1922 status));
1923 return -1;
1924 } else {
1925 d_printf(_("Added alias '%s'.\n"), argv[0]);
1926 }
1927
1928 return 0;
1929 }
1930
1931 static int rpc_group_add(struct net_context *c, int argc, const char **argv)
1932 {
1933 if (c->opt_localgroup)
1934 return rpc_alias_add_internals(c, argc, argv);
1935
1936 return rpc_group_add_internals(c, argc, argv);
1937 }
1938
1939 static NTSTATUS get_sid_from_name(struct cli_state *cli,
1940 TALLOC_CTX *mem_ctx,
1941 const char *name,
1942 struct dom_sid *sid,
1943 enum lsa_SidType *type)
1944 {
1945 struct dom_sid *sids = NULL;
1946 enum lsa_SidType *types = NULL;
1947 struct rpc_pipe_client *pipe_hnd = NULL;
1948 struct policy_handle lsa_pol;
1949 NTSTATUS status, result;
1950 struct dcerpc_binding_handle *b;
1951
1952 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
1953 &pipe_hnd);
1954 if (!NT_STATUS_IS_OK(status)) {
1955 goto done;
1956 }
1957
1958 b = pipe_hnd->binding_handle;
1959
1960 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, false,
1961 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
1962
1963 if (!NT_STATUS_IS_OK(status)) {
1964 goto done;
1965 }
1966
1967 status = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &lsa_pol, 1,
1968 &name, NULL, 1, &sids, &types);
1969
1970 if (NT_STATUS_IS_OK(status)) {
1971 sid_copy(sid, &sids[0]);
1972 *type = types[0];
1973 }
1974
1975 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
1976
1977 done:
1978 if (pipe_hnd) {
1979 TALLOC_FREE(pipe_hnd);
1980 }
1981
1982 if (!NT_STATUS_IS_OK(status) && (strncasecmp_m(name, "S-", 2) == 0)) {
1983
1984 /* Try as S-1-5-whatever */
1985
1986 struct dom_sid tmp_sid;
1987
1988 if (string_to_sid(&tmp_sid, name)) {
1989 sid_copy(sid, &tmp_sid);
1990 *type = SID_NAME_UNKNOWN;
1991 status = NT_STATUS_OK;
1992 }
1993 }
1994
1995 return status;
1996 }
1997
1998 static NTSTATUS rpc_add_groupmem(struct rpc_pipe_client *pipe_hnd,
1999 TALLOC_CTX *mem_ctx,
2000 const struct dom_sid *group_sid,
2001 const char *member)
2002 {
2003 struct policy_handle connect_pol, domain_pol;
2004 NTSTATUS status, result;
2005 uint32 group_rid;
2006 struct policy_handle group_pol;
2007 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2008
2009 struct samr_Ids rids, rid_types;
2010 struct lsa_String lsa_acct_name;
2011
2012 struct dom_sid sid;
2013
2014 sid_copy(&sid, group_sid);
2015
2016 if (!sid_split_rid(&sid, &group_rid)) {
2017 return NT_STATUS_UNSUCCESSFUL;
2018 }
2019
2020 /* Get sam policy handle */
2021 status = dcerpc_samr_Connect2(b, mem_ctx,
2022 pipe_hnd->desthost,
2023 MAXIMUM_ALLOWED_ACCESS,
2024 &connect_pol,
2025 &result);
2026 if (!NT_STATUS_IS_OK(status)) {
2027 return status;
2028 }
2029 if (!NT_STATUS_IS_OK(result)) {
2030 return result;
2031 }
2032
2033 /* Get domain policy handle */
2034 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2035 &connect_pol,
2036 MAXIMUM_ALLOWED_ACCESS,
2037 &sid,
2038 &domain_pol,
2039 &result);
2040 if (!NT_STATUS_IS_OK(status)) {
2041 return status;
2042 }
2043 if (!NT_STATUS_IS_OK(result)) {
2044 return result;
2045 }
2046
2047 init_lsa_String(&lsa_acct_name, member);
2048
2049 status = dcerpc_samr_LookupNames(b, mem_ctx,
2050 &domain_pol,
2051 1,
2052 &lsa_acct_name,
2053 &rids,
2054 &rid_types,
2055 &result);
2056 if (!NT_STATUS_IS_OK(status)) {
2057 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2058 member);
2059 goto done;
2060 }
2061
2062 if (!NT_STATUS_IS_OK(result)) {
2063 status = result;
2064 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2065 member);
2066 goto done;
2067 }
2068
2069 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2070 &domain_pol,
2071 MAXIMUM_ALLOWED_ACCESS,
2072 group_rid,
2073 &group_pol,
2074 &result);
2075 if (!NT_STATUS_IS_OK(status)) {
2076 goto done;
2077 }
2078
2079 if (!NT_STATUS_IS_OK(result)) {
2080 status = result;
2081 goto done;
2082 }
2083
2084 status = dcerpc_samr_AddGroupMember(b, mem_ctx,
2085 &group_pol,
2086 rids.ids[0],
2087 0x0005, /* unknown flags */
2088 &result);
2089 if (!NT_STATUS_IS_OK(status)) {
2090 goto done;
2091 }
2092
2093 status = result;
2094
2095 done:
2096 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2097 return status;
2098 }
2099
2100 static NTSTATUS rpc_add_aliasmem(struct rpc_pipe_client *pipe_hnd,
2101 TALLOC_CTX *mem_ctx,
2102 const struct dom_sid *alias_sid,
2103 const char *member)
2104 {
2105 struct policy_handle connect_pol, domain_pol;
2106 NTSTATUS status, result;
2107 uint32 alias_rid;
2108 struct policy_handle alias_pol;
2109 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2110
2111 struct dom_sid member_sid;
2112 enum lsa_SidType member_type;
2113
2114 struct dom_sid sid;
2115
2116 sid_copy(&sid, alias_sid);
2117
2118 if (!sid_split_rid(&sid, &alias_rid)) {
2119 return NT_STATUS_UNSUCCESSFUL;
2120 }
2121
2122 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
2123 member, &member_sid, &member_type);
2124
2125 if (!NT_STATUS_IS_OK(result)) {
2126 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2127 member);
2128 return result;
2129 }
2130
2131 /* Get sam policy handle */
2132 status = dcerpc_samr_Connect2(b, mem_ctx,
2133 pipe_hnd->desthost,
2134 MAXIMUM_ALLOWED_ACCESS,
2135 &connect_pol,
2136 &result);
2137 if (!NT_STATUS_IS_OK(status)) {
2138 goto done;
2139 }
2140 if (!NT_STATUS_IS_OK(result)) {
2141 status = result;
2142 goto done;
2143 }
2144
2145 /* Get domain policy handle */
2146 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2147 &connect_pol,
2148 MAXIMUM_ALLOWED_ACCESS,
2149 &sid,
2150 &domain_pol,
2151 &result);
2152 if (!NT_STATUS_IS_OK(status)) {
2153 goto done;
2154 }
2155 if (!NT_STATUS_IS_OK(result)) {
2156 status = result;
2157 goto done;
2158 }
2159
2160 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2161 &domain_pol,
2162 MAXIMUM_ALLOWED_ACCESS,
2163 alias_rid,
2164 &alias_pol,
2165 &result);
2166 if (!NT_STATUS_IS_OK(status)) {
2167 return status;
2168 }
2169 if (!NT_STATUS_IS_OK(result)) {
2170 return result;
2171 }
2172
2173 status = dcerpc_samr_AddAliasMember(b, mem_ctx,
2174 &alias_pol,
2175 &member_sid,
2176 &result);
2177 if (!NT_STATUS_IS_OK(status)) {
2178 return status;
2179 }
2180
2181 status = result;
2182
2183 done:
2184 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2185 return status;
2186 }
2187
2188 static NTSTATUS rpc_group_addmem_internals(struct net_context *c,
2189 const struct dom_sid *domain_sid,
2190 const char *domain_name,
2191 struct cli_state *cli,
2192 struct rpc_pipe_client *pipe_hnd,
2193 TALLOC_CTX *mem_ctx,
2194 int argc,
2195 const char **argv)
2196 {
2197 struct dom_sid group_sid;
2198 enum lsa_SidType group_type;
2199
2200 if (argc != 2 || c->display_usage) {
2201 d_printf("%s\n%s",
2202 _("Usage:"),
2203 _("net rpc group addmem <group> <member>\n"
2204 " Add a member to a group\n"
2205 " group\tGroup to add member to\n"
2206 " member\tMember to add to group\n"));
2207 return NT_STATUS_UNSUCCESSFUL;
2208 }
2209
2210 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2211 &group_sid, &group_type))) {
2212 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2213 argv[0]);
2214 return NT_STATUS_UNSUCCESSFUL;
2215 }
2216
2217 if (group_type == SID_NAME_DOM_GRP) {
2218 NTSTATUS result = rpc_add_groupmem(pipe_hnd, mem_ctx,
2219 &group_sid, argv[1]);
2220
2221 if (!NT_STATUS_IS_OK(result)) {
2222 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2223 argv[1], argv[0], nt_errstr(result));
2224 }
2225 return result;
2226 }
2227
2228 if (group_type == SID_NAME_ALIAS) {
2229 NTSTATUS result = rpc_add_aliasmem(pipe_hnd, mem_ctx,
2230 &group_sid, argv[1]);
2231
2232 if (!NT_STATUS_IS_OK(result)) {
2233 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2234 argv[1], argv[0], nt_errstr(result));
2235 }
2236 return result;
2237 }
2238
2239 d_fprintf(stderr, _("Can only add members to global or local groups "
2240 "which %s is not\n"), argv[0]);
2241
2242 return NT_STATUS_UNSUCCESSFUL;
2243 }
2244
2245 static int rpc_group_addmem(struct net_context *c, int argc, const char **argv)
2246 {
2247 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2248 rpc_group_addmem_internals,
2249 argc, argv);
2250 }
2251
2252 static NTSTATUS rpc_del_groupmem(struct net_context *c,
2253 struct rpc_pipe_client *pipe_hnd,
2254 TALLOC_CTX *mem_ctx,
2255 const struct dom_sid *group_sid,
2256 const char *member)
2257 {
2258 struct policy_handle connect_pol, domain_pol;
2259 NTSTATUS status, result;
2260 uint32 group_rid;
2261 struct policy_handle group_pol;
2262 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2263
2264 struct samr_Ids rids, rid_types;
2265 struct lsa_String lsa_acct_name;
2266
2267 struct dom_sid sid;
2268
2269 sid_copy(&sid, group_sid);
2270
2271 if (!sid_split_rid(&sid, &group_rid))
2272 return NT_STATUS_UNSUCCESSFUL;
2273
2274 /* Get sam policy handle */
2275 status = dcerpc_samr_Connect2(b, mem_ctx,
2276 pipe_hnd->desthost,
2277 MAXIMUM_ALLOWED_ACCESS,
2278 &connect_pol,
2279 &result);
2280 if (!NT_STATUS_IS_OK(status)) {
2281 return status;
2282 }
2283 if (!NT_STATUS_IS_OK(result)) {
2284 return result;
2285 }
2286
2287
2288 /* Get domain policy handle */
2289 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2290 &connect_pol,
2291 MAXIMUM_ALLOWED_ACCESS,
2292 &sid,
2293 &domain_pol,
2294 &result);
2295 if (!NT_STATUS_IS_OK(status)) {
2296 return status;
2297 }
2298 if (!NT_STATUS_IS_OK(result)) {
2299 return result;
2300 }
2301
2302 init_lsa_String(&lsa_acct_name, member);
2303
2304 status = dcerpc_samr_LookupNames(b, mem_ctx,
2305 &domain_pol,
2306 1,
2307 &lsa_acct_name,
2308 &rids,
2309 &rid_types,
2310 &result);
2311 if (!NT_STATUS_IS_OK(status)) {
2312 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2313 member);
2314 goto done;
2315 }
2316
2317 if (!NT_STATUS_IS_OK(result)) {
2318 status = result;
2319 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2320 member);
2321 goto done;
2322 }
2323
2324 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2325 &domain_pol,
2326 MAXIMUM_ALLOWED_ACCESS,
2327 group_rid,
2328 &group_pol,
2329 &result);
2330 if (!NT_STATUS_IS_OK(status)) {
2331 goto done;
2332 }
2333 if (!NT_STATUS_IS_OK(result)) {
2334 status = result;
2335 goto done;
2336 }
2337
2338 status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
2339 &group_pol,
2340 rids.ids[0],
2341 &result);
2342 if (!NT_STATUS_IS_OK(status)) {
2343 goto done;
2344 }
2345
2346 status = result;
2347 done:
2348 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2349 return status;
2350 }
2351
2352 static NTSTATUS rpc_del_aliasmem(struct rpc_pipe_client *pipe_hnd,
2353 TALLOC_CTX *mem_ctx,
2354 const struct dom_sid *alias_sid,
2355 const char *member)
2356 {
2357 struct policy_handle connect_pol, domain_pol;
2358 NTSTATUS status, result;
2359 uint32 alias_rid;
2360 struct policy_handle alias_pol;
2361 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2362
2363 struct dom_sid member_sid;
2364 enum lsa_SidType member_type;
2365
2366 struct dom_sid sid;
2367
2368 sid_copy(&sid, alias_sid);
2369
2370 if (!sid_split_rid(&sid, &alias_rid))
2371 return NT_STATUS_UNSUCCESSFUL;
2372
2373 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
2374 member, &member_sid, &member_type);
2375
2376 if (!NT_STATUS_IS_OK(result)) {
2377 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2378 member);
2379 return result;
2380 }
2381
2382 /* Get sam policy handle */
2383 status = dcerpc_samr_Connect2(b, mem_ctx,
2384 pipe_hnd->desthost,
2385 MAXIMUM_ALLOWED_ACCESS,
2386 &connect_pol,
2387 &result);
2388 if (!NT_STATUS_IS_OK(status)) {
2389 goto done;
2390 }
2391 if (!NT_STATUS_IS_OK(result)) {
2392 status = result;
2393 goto done;
2394 }
2395
2396 /* Get domain policy handle */
2397 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2398 &connect_pol,
2399 MAXIMUM_ALLOWED_ACCESS,
2400 &sid,
2401 &domain_pol,
2402 &result);
2403 if (!NT_STATUS_IS_OK(status)) {
2404 goto done;
2405 }
2406 if (!NT_STATUS_IS_OK(result)) {
2407 status = result;
2408 goto done;
2409 }
2410
2411 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2412 &domain_pol,
2413 MAXIMUM_ALLOWED_ACCESS,
2414 alias_rid,
2415 &alias_pol,
2416 &result);
2417 if (!NT_STATUS_IS_OK(status)) {
2418 return status;
2419 }
2420
2421 if (!NT_STATUS_IS_OK(result)) {
2422 return result;
2423 }
2424
2425 status = dcerpc_samr_DeleteAliasMember(b, mem_ctx,
2426 &alias_pol,
2427 &member_sid,
2428 &result);
2429
2430 if (!NT_STATUS_IS_OK(status)) {
2431 return status;
2432 }
2433
2434 status = result;
2435
2436 done:
2437 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2438 return status;
2439 }
2440
2441 static NTSTATUS rpc_group_delmem_internals(struct net_context *c,
2442 const struct dom_sid *domain_sid,
2443 const char *domain_name,
2444 struct cli_state *cli,
2445 struct rpc_pipe_client *pipe_hnd,
2446 TALLOC_CTX *mem_ctx,
2447 int argc,
2448 const char **argv)
2449 {
2450 struct dom_sid group_sid;
2451 enum lsa_SidType group_type;
2452
2453 if (argc != 2 || c->display_usage) {
2454 d_printf("%s\n%s",
2455 _("Usage:"),
2456 _("net rpc group delmem <group> <member>\n"
2457 " Delete a member from a group\n"
2458 " group\tGroup to delete member from\n"
2459 " member\tMember to delete from group\n"));
2460 return NT_STATUS_UNSUCCESSFUL;
2461 }
2462
2463 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2464 &group_sid, &group_type))) {
2465 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2466 argv[0]);
2467 return NT_STATUS_UNSUCCESSFUL;
2468 }
2469
2470 if (group_type == SID_NAME_DOM_GRP) {
2471 NTSTATUS result = rpc_del_groupmem(c, pipe_hnd, mem_ctx,
2472 &group_sid, argv[1]);
2473
2474 if (!NT_STATUS_IS_OK(result)) {
2475 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2476 argv[1], argv[0], nt_errstr(result));
2477 }
2478 return result;
2479 }
2480
2481 if (group_type == SID_NAME_ALIAS) {
2482 NTSTATUS result = rpc_del_aliasmem(pipe_hnd, mem_ctx,
2483 &group_sid, argv[1]);
2484
2485 if (!NT_STATUS_IS_OK(result)) {
2486 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2487 argv[1], argv[0], nt_errstr(result));
2488 }
2489 return result;
2490 }
2491
2492 d_fprintf(stderr, _("Can only delete members from global or local "
2493 "groups which %s is not\n"), argv[0]);
2494
2495 return NT_STATUS_UNSUCCESSFUL;
2496 }
2497
2498 static int rpc_group_delmem(struct net_context *c, int argc, const char **argv)
2499 {
2500 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2501 rpc_group_delmem_internals,
2502 argc, argv);
2503 }
2504
2505 /**
2506 * List groups on a remote RPC server.
2507 *
2508 * All parameters are provided by the run_rpc_command function, except for
2509 * argc, argv which are passes through.
2510 *
2511 * @param domain_sid The domain sid acquired from the remote server.
2512 * @param cli A cli_state connected to the server.
2513 * @param mem_ctx Talloc context, destroyed on completion of the function.
2514 * @param argc Standard main() style argc.
2515 * @param argv Standard main() style argv. Initial components are already
2516 * stripped.
2517 *
2518 * @return Normal NTSTATUS return.
2519 **/
2520
2521 static NTSTATUS rpc_group_list_internals(struct net_context *c,
2522 const struct dom_sid *domain_sid,
2523 const char *domain_name,
2524 struct cli_state *cli,
2525 struct rpc_pipe_client *pipe_hnd,
2526 TALLOC_CTX *mem_ctx,
2527 int argc,
2528 const char **argv)
2529 {
2530 struct policy_handle connect_pol, domain_pol;
2531 NTSTATUS status, result;
2532 uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
2533 struct samr_SamArray *groups = NULL;
2534 bool global = false;
2535 bool local = false;
2536 bool builtin = false;
2537 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2538
2539 if (c->display_usage) {
2540 d_printf("%s\n%s",
2541 _("Usage:"),
2542 _("net rpc group list [global] [local] [builtin]\n"
2543 " List groups on RPC server\n"
2544 " global\tList global groups\n"
2545 " local\tList local groups\n"
2546 " builtin\tList builtin groups\n"
2547 " If none of global, local or builtin is "
2548 "specified, all three options are considered "
2549 "set\n"));
2550 return NT_STATUS_OK;
2551 }
2552
2553 if (argc == 0) {
2554 global = true;
2555 local = true;
2556 builtin = true;
2557 }
2558
2559 for (i=0; i<argc; i++) {
2560 if (strequal(argv[i], "global"))
2561 global = true;
2562
2563 if (strequal(argv[i], "local"))
2564 local = true;
2565
2566 if (strequal(argv[i], "builtin"))
2567 builtin = true;
2568 }
2569
2570 /* Get sam policy handle */
2571
2572 status = dcerpc_samr_Connect2(b, mem_ctx,
2573 pipe_hnd->desthost,
2574 MAXIMUM_ALLOWED_ACCESS,
2575 &connect_pol,
2576 &result);
2577 if (!NT_STATUS_IS_OK(status)) {
2578 goto done;
2579 }
2580 if (!NT_STATUS_IS_OK(result)) {
2581 status = result;
2582 goto done;
2583 }
2584
2585 /* Get domain policy handle */
2586
2587 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2588 &connect_pol,
2589 MAXIMUM_ALLOWED_ACCESS,
2590 discard_const_p(struct dom_sid2, domain_sid),
2591 &domain_pol,
2592 &result);
2593 if (!NT_STATUS_IS_OK(status)) {
2594 goto done;
2595 }
2596 if (!NT_STATUS_IS_OK(result)) {
2597 status = result;
2598 goto done;
2599 }
2600
2601 /* Query domain groups */
2602 if (c->opt_long_list_entries)
2603 d_printf(_("\nGroup name Comment"
2604 "\n-----------------------------\n"));
2605 do {
2606 uint32_t max_size, total_size, returned_size;
2607 union samr_DispInfo info;
2608
2609 if (!global) break;
2610
2611 dcerpc_get_query_dispinfo_params(
2612 loop_count, &max_entries, &max_size);
2613
2614 status = dcerpc_samr_QueryDisplayInfo(b, mem_ctx,
2615 &domain_pol,
2616 3,
2617 start_idx,
2618 max_entries,
2619 max_size,
2620 &total_size,
2621 &returned_size,
2622 &info,
2623 &result);
2624 if (!NT_STATUS_IS_OK(status)) {
2625 goto done;
2626 }
2627 num_entries = info.info3.count;
2628 start_idx += info.info3.count;
2629
2630 if (!NT_STATUS_IS_OK(result) &&
2631 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2632 break;
2633
2634 for (i = 0; i < num_entries; i++) {
2635
2636 const char *group = NULL;
2637 const char *desc = NULL;
2638
2639 group = info.info3.entries[i].account_name.string;
2640 desc = info.info3.entries[i].description.string;
2641
2642 if (c->opt_long_list_entries)
2643 printf("%-21.21s %-50.50s\n",
2644 group, desc);
2645 else
2646 printf("%s\n", group);
2647 }
2648 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2649 /* query domain aliases */
2650 start_idx = 0;
2651 do {
2652 if (!local) break;
2653
2654 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2655 &domain_pol,
2656 &start_idx,
2657 &groups,
2658 0xffff,
2659 &num_entries,
2660 &result);
2661 if (!NT_STATUS_IS_OK(status)) {
2662 goto done;
2663 }
2664 if (!NT_STATUS_IS_OK(result) &&
2665 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2666 break;
2667
2668 for (i = 0; i < num_entries; i++) {
2669
2670 const char *description = NULL;
2671
2672 if (c->opt_long_list_entries) {
2673
2674 struct policy_handle alias_pol;
2675 union samr_AliasInfo *info = NULL;
2676 NTSTATUS _result;
2677
2678 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2679 &domain_pol,
2680 0x8,
2681 groups->entries[i].idx,
2682 &alias_pol,
2683 &_result);
2684 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2685 status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2686 &alias_pol,
2687 3,
2688 &info,
2689 &_result);
2690 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2691 status = dcerpc_samr_Close(b, mem_ctx,
2692 &alias_pol,
2693 &_result);
2694 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2695 description = info->description.string;
2696 }
2697 }
2698 }
2699 }
2700
2701 if (description != NULL) {
2702 printf("%-21.21s %-50.50s\n",
2703 groups->entries[i].name.string,
2704 description);
2705 } else {
2706 printf("%s\n", groups->entries[i].name.string);
2707 }
2708 }
2709 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2710 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
2711 /* Get builtin policy handle */
2712
2713 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2714 &connect_pol,
2715 MAXIMUM_ALLOWED_ACCESS,
2716 discard_const_p(struct dom_sid2, &global_sid_Builtin),
2717 &domain_pol,
2718 &result);
2719 if (!NT_STATUS_IS_OK(status)) {
2720 goto done;
2721 }
2722 if (!NT_STATUS_IS_OK(result)) {
2723 status = result;
2724 goto done;
2725 }
2726
2727 /* query builtin aliases */
2728 start_idx = 0;
2729 do {
2730 if (!builtin) break;
2731
2732 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2733 &domain_pol,
2734 &start_idx,
2735 &groups,
2736 max_entries,
2737 &num_entries,
2738 &result);
2739 if (!NT_STATUS_IS_OK(status)) {
2740 break;
2741 }
2742 if (!NT_STATUS_IS_OK(result) &&
2743 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
2744 status = result;
2745 break;
2746 }
2747
2748 for (i = 0; i < num_entries; i++) {
2749
2750 const char *description = NULL;
2751
2752 if (c->opt_long_list_entries) {
2753
2754 struct policy_handle alias_pol;
2755 union samr_AliasInfo *info = NULL;
2756 NTSTATUS _result;
2757
2758 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2759 &domain_pol,
2760 0x8,
2761 groups->entries[i].idx,
2762 &alias_pol,
2763 &_result);
2764 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2765 status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2766 &alias_pol,
2767 3,
2768 &info,
2769 &_result);
2770 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2771 status = dcerpc_samr_Close(b, mem_ctx,
2772 &alias_pol,
2773 &_result);
2774 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2775 description = info->description.string;
2776 }
2777 }
2778 }
2779 }
2780
2781 if (description != NULL) {
2782 printf("%-21.21s %-50.50s\n",
2783 groups->entries[i].name.string,
2784 description);
2785 } else {
2786 printf("%s\n", groups->entries[i].name.string);
2787 }
2788 }
2789 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2790
2791 status = result;
2792
2793 done:
2794 return status;
2795 }
2796
2797 static int rpc_group_list(struct net_context *c, int argc, const char **argv)
2798 {
2799 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2800 rpc_group_list_internals,
2801 argc, argv);
2802 }
2803
2804 static NTSTATUS rpc_list_group_members(struct net_context *c,
2805 struct rpc_pipe_client *pipe_hnd,
2806 TALLOC_CTX *mem_ctx,
2807 const char *domain_name,
2808 const struct dom_sid *domain_sid,
2809 struct policy_handle *domain_pol,
2810 uint32 rid)
2811 {
2812 NTSTATUS result, status;
2813 struct policy_handle group_pol;
2814 uint32 num_members, *group_rids;
2815 int i;
2816 struct samr_RidAttrArray *rids = NULL;
2817 struct lsa_Strings names;
2818 struct samr_Ids types;
2819 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2820
2821 fstring sid_str;
2822 sid_to_fstring(sid_str, domain_sid);
2823
2824 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2825 domain_pol,
2826 MAXIMUM_ALLOWED_ACCESS,
2827 rid,
2828 &group_pol,
2829 &result);
2830 if (!NT_STATUS_IS_OK(status)) {
2831 return status;
2832 }
2833 if (!NT_STATUS_IS_OK(result)) {
2834 return result;
2835 }
2836
2837 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
2838 &group_pol,
2839 &rids,
2840 &result);
2841 if (!NT_STATUS_IS_OK(status)) {
2842 return status;
2843 }
2844 if (!NT_STATUS_IS_OK(result)) {
2845 return result;
2846 }
2847
2848 num_members = rids->count;
2849 group_rids = rids->rids;
2850
2851 while (num_members > 0) {
2852 int this_time = 512;
2853
2854 if (num_members < this_time)
2855 this_time = num_members;
2856
2857 status = dcerpc_samr_LookupRids(b, mem_ctx,
2858 domain_pol,
2859 this_time,
2860 group_rids,
2861 &names,
2862 &types,
2863 &result);
2864 if (!NT_STATUS_IS_OK(status)) {
2865 return status;
2866 }
2867 if (!NT_STATUS_IS_OK(result)) {
2868 return result;
2869 }
2870
2871 /* We only have users as members, but make the output
2872 the same as the output of alias members */
2873
2874 for (i = 0; i < this_time; i++) {
2875
2876 if (c->opt_long_list_entries) {
2877 printf("%s-%d %s\\%s %d\n", sid_str,
2878 group_rids[i], domain_name,
2879 names.names[i].string,
2880 SID_NAME_USER);
2881 } else {
2882 printf("%s\\%s\n", domain_name,
2883 names.names[i].string);
2884 }
2885 }
2886
2887 num_members -= this_time;
2888 group_rids += 512;
2889 }
2890
2891 return NT_STATUS_OK;
2892 }
2893
2894 static NTSTATUS rpc_list_alias_members(struct net_context *c,
2895 struct rpc_pipe_client *pipe_hnd,
2896 TALLOC_CTX *mem_ctx,
2897 struct policy_handle *domain_pol,
2898 uint32 rid)
2899 {
2900 NTSTATUS result, status;
2901 struct rpc_pipe_client *lsa_pipe;
2902 struct policy_handle alias_pol, lsa_pol;
2903 uint32 num_members;
2904 struct dom_sid *alias_sids;
2905 char **domains;
2906 char **names;
2907 enum lsa_SidType *types;
2908 int i;
2909 struct lsa_SidArray sid_array;
2910 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2911
2912 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2913 domain_pol,
2914 MAXIMUM_ALLOWED_ACCESS,
2915 rid,
2916 &alias_pol,
2917 &result);
2918 if (!NT_STATUS_IS_OK(status)) {
2919 return status;
2920 }
2921 if (!NT_STATUS_IS_OK(result)) {
2922 return result;
2923 }
2924
2925 status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
2926 &alias_pol,
2927 &sid_array,
2928 &result);
2929 if (!NT_STATUS_IS_OK(status)) {
2930 d_fprintf(stderr, _("Couldn't list alias members\n"));
2931 return status;
2932 }
2933 if (!NT_STATUS_IS_OK(result)) {
2934 d_fprintf(stderr, _("Couldn't list alias members\n"));
2935 return result;
2936 }
2937
2938 num_members = sid_array.num_sids;
2939
2940 if (num_members == 0) {
2941 return NT_STATUS_OK;
2942 }
2943
2944 result = cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd),
2945 &ndr_table_lsarpc.syntax_id,
2946 &lsa_pipe);
2947 if (!NT_STATUS_IS_OK(result)) {
2948 d_fprintf(stderr, _("Couldn't open LSA pipe. Error was %s\n"),
2949 nt_errstr(result) );
2950 return result;
2951 }
2952
2953 result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, true,
2954 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
2955
2956 if (!NT_STATUS_IS_OK(result)) {
2957 d_fprintf(stderr, _("Couldn't open LSA policy handle\n"));
2958 TALLOC_FREE(lsa_pipe);
2959 return result;
2960 }
2961
2962 alias_sids = talloc_zero_array(mem_ctx, struct dom_sid, num_members);
2963 if (!alias_sids) {
2964 d_fprintf(stderr, _("Out of memory\n"));
2965 TALLOC_FREE(lsa_pipe);
2966 return NT_STATUS_NO_MEMORY;
2967 }
2968
2969 for (i=0; i<num_members; i++) {
2970 sid_copy(&alias_sids[i], sid_array.sids[i].sid);
2971 }
2972
2973 result = rpccli_lsa_lookup_sids(lsa_pipe, mem_ctx, &lsa_pol,
2974 num_members, alias_sids,
2975 &domains, &names, &types);
2976
2977 if (!NT_STATUS_IS_OK(result) &&
2978 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2979 d_fprintf(stderr, _("Couldn't lookup SIDs\n"));
2980 TALLOC_FREE(lsa_pipe);
2981 return result;
2982 }
2983
2984 for (i = 0; i < num_members; i++) {
2985 fstring sid_str;
2986 sid_to_fstring(sid_str, &alias_sids[i]);
2987
2988 if (c->opt_long_list_entries) {
2989 printf("%s %s\\%s %d\n", sid_str,
2990 domains[i] ? domains[i] : _("*unknown*"),
2991 names[i] ? names[i] : _("*unknown*"), types[i]);
2992 } else {
2993 if (domains[i])
2994 printf("%s\\%s\n", domains[i], names[i]);
2995 else
2996 printf("%s\n", sid_str);
2997 }
2998 }
2999
3000 TALLOC_FREE(lsa_pipe);
3001 return NT_STATUS_OK;
3002 }
3003
3004 static NTSTATUS rpc_group_members_internals(struct net_context *c,
3005 const struct dom_sid *domain_sid,
3006 const char *domain_name,
3007 struct cli_state *cli,
3008 struct rpc_pipe_client *pipe_hnd,
3009 TALLOC_CTX *mem_ctx,
3010 int argc,
3011 const char **argv)
3012 {
3013 NTSTATUS result, status;
3014 struct policy_handle connect_pol, domain_pol;
3015 struct samr_Ids rids, rid_types;
3016 struct lsa_String lsa_acct_name;
3017 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3018
3019 /* Get sam policy handle */
3020
3021 status = dcerpc_samr_Connect2(b, mem_ctx,
3022 pipe_hnd->desthost,
3023 MAXIMUM_ALLOWED_ACCESS,
3024 &connect_pol,
3025 &result);
3026 if (!NT_STATUS_IS_OK(status)) {
3027 return status;
3028 }
3029 if (!NT_STATUS_IS_OK(result)) {
3030 return result;
3031 }
3032
3033 /* Get domain policy handle */
3034
3035 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3036 &connect_pol,
3037 MAXIMUM_ALLOWED_ACCESS,
3038 discard_const_p(struct dom_sid2, domain_sid),
3039 &domain_pol,
3040 &result);
3041 if (!NT_STATUS_IS_OK(status)) {
3042 return status;
3043 }
3044 if (!NT_STATUS_IS_OK(result)) {
3045 return result;
3046 }
3047
3048 init_lsa_String(&lsa_acct_name, argv[0]); /* sure? */
3049
3050 status = dcerpc_samr_LookupNames(b, mem_ctx,
3051 &domain_pol,
3052 1,
3053 &lsa_acct_name,
3054 &rids,
3055 &rid_types,
3056 &result);
3057 if (!NT_STATUS_IS_OK(status)) {
3058 return status;
3059 }
3060
3061 if (!NT_STATUS_IS_OK(result)) {
3062
3063 /* Ok, did not find it in the global sam, try with builtin */
3064
3065 struct dom_sid sid_Builtin;
3066
3067 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
3068
3069 sid_copy(&sid_Builtin, &global_sid_Builtin);
3070
3071 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3072 &connect_pol,
3073 MAXIMUM_ALLOWED_ACCESS,
3074 &sid_Builtin,
3075 &domain_pol,
3076 &result);
3077 if (!NT_STATUS_IS_OK(status)) {
3078 return status;
3079 }
3080 if (!NT_STATUS_IS_OK(result)) {
3081 d_fprintf(stderr, _("Couldn't find group %s\n"),
3082 argv[0]);
3083 return result;
3084 }
3085
3086 status = dcerpc_samr_LookupNames(b, mem_ctx,
3087 &domain_pol,
3088 1,
3089 &lsa_acct_name,
3090 &rids,
3091 &rid_types,
3092 &result);
3093 if (!NT_STATUS_IS_OK(status)) {
3094 return status;
3095 }
3096 if (!NT_STATUS_IS_OK(result)) {
3097 d_fprintf(stderr, _("Couldn't find group %s\n"),
3098 argv[0]);
3099 return result;
3100 }
3101 }
3102
3103 if (rids.count != 1) {
3104 d_fprintf(stderr, _("Couldn't find group %s\n"),
3105 argv[0]);
3106 return result;
3107 }
3108
3109 if (rid_types.ids[0] == SID_NAME_DOM_GRP) {
3110 return rpc_list_group_members(c, pipe_hnd, mem_ctx, domain_name,
3111 domain_sid, &domain_pol,
3112 rids.ids[0]);
3113 }
3114
3115 if (rid_types.ids[0] == SID_NAME_ALIAS) {
3116 return rpc_list_alias_members(c, pipe_hnd, mem_ctx, &domain_pol,
3117 rids.ids[0]);
3118 }
3119
3120 return NT_STATUS_NO_SUCH_GROUP;
3121 }
3122
3123 static int rpc_group_members(struct net_context *c, int argc, const char **argv)
3124 {
3125 if (argc != 1 || c->display_usage) {
3126 return rpc_group_usage(c, argc, argv);
3127 }
3128
3129 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3130 rpc_group_members_internals,
3131 argc, argv);
3132 }
3133
3134 static int rpc_group_rename_internals(struct net_context *c, int argc, const char **argv)
3135 {
3136 NET_API_STATUS status;
3137 struct GROUP_INFO_0 g0;
3138 uint32_t parm_err;
3139
3140 if (argc != 2) {
3141 d_printf(_("Usage:\n"));
3142 d_printf("net rpc group rename group newname\n");
3143 return -1;
3144 }
3145
3146 g0.grpi0_name = argv[1];
3147
3148 status = NetGroupSetInfo(c->opt_host,
3149 argv[0],
3150 0,
3151 (uint8_t *)&g0,
3152 &parm_err);
3153
3154 if (status != 0) {
3155 d_fprintf(stderr, _("Renaming group %s failed with: %s\n"),
3156 argv[0], libnetapi_get_error_string(c->netapi_ctx,
3157 status));
3158 return -1;
3159 }
3160
3161 return 0;
3162 }
3163
3164 static int rpc_group_rename(struct net_context *c, int argc, const char **argv)
3165 {
3166 if (argc != 2 || c->display_usage) {
3167 return rpc_group_usage(c, argc, argv);
3168 }
3169
3170 return rpc_group_rename_internals(c, argc, argv);
3171 }
3172
3173 /**
3174 * 'net rpc group' entrypoint.
3175 * @param argc Standard main() style argc.
3176 * @param argv Standard main() style argv. Initial components are already
3177 * stripped.
3178 **/
3179
3180 int net_rpc_group(struct net_context *c, int argc, const char **argv)
3181 {
3182 NET_API_STATUS status;
3183
3184 struct functable func[] = {
3185 {
3186 "add",
3187 rpc_group_add,
3188 NET_TRANSPORT_RPC,
3189 N_("Create specified group"),
3190 N_("net rpc group add\n"
3191 " Create specified group")
3192 },
3193 {
3194 "delete",
3195 rpc_group_delete,
3196 NET_TRANSPORT_RPC,
3197 N_("Delete specified group"),
3198 N_("net rpc group delete\n"
3199 " Delete specified group")
3200 },
3201 {
3202 "addmem",
3203 rpc_group_addmem,
3204 NET_TRANSPORT_RPC,
3205 N_("Add member to group"),
3206 N_("net rpc group addmem\n"
3207 " Add member to group")
3208 },
3209 {
3210 "delmem",
3211 rpc_group_delmem,
3212 NET_TRANSPORT_RPC,
3213 N_("Remove member from group"),
3214 N_("net rpc group delmem\n"
3215 " Remove member from group")
3216 },
3217 {
3218 "list",
3219 rpc_group_list,
3220 NET_TRANSPORT_RPC,
3221 N_("List groups"),
3222 N_("net rpc group list\n"
3223 " List groups")
3224 },
3225 {
3226 "members",
3227 rpc_group_members,
3228 NET_TRANSPORT_RPC,
3229 N_("List group members"),
3230 N_("net rpc group members\n"
3231 " List group members")
3232 },
3233 {
3234 "rename",
3235 rpc_group_rename,
3236 NET_TRANSPORT_RPC,
3237 N_("Rename group"),
3238 N_("net rpc group rename\n"
3239 " Rename group")
3240 },
3241 {NULL, NULL, 0, NULL, NULL}
3242 };
3243
3244 status = libnetapi_net_init(&c->netapi_ctx);
3245 if (status != 0) {
3246 return -1;
3247 }
3248 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
3249 libnetapi_set_password(c->netapi_ctx, c->opt_password);
3250 if (c->opt_kerberos) {
3251 libnetapi_set_use_kerberos(c->netapi_ctx);
3252 }
3253
3254 if (argc == 0) {
3255 if (c->display_usage) {
3256 d_printf(_("Usage:\n"));
3257 d_printf(_("net rpc group\n"
3258 " Alias for net rpc group list global "
3259 "local builtin\n"));
3260 net_display_usage_from_functable(func);
3261 return 0;
3262 }
3263
3264 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3265 rpc_group_list_internals,
3266 argc, argv);
3267 }
3268
3269 return net_run_function(c, argc, argv, "net rpc group", func);
3270 }
3271
3272 /****************************************************************************/
3273
3274 static int rpc_share_usage(struct net_context *c, int argc, const char **argv)
3275 {
3276 return net_share_usage(c, argc, argv);
3277 }
3278
3279 /**
3280 * Add a share on a remote RPC server.
3281 *
3282 * @param argc Standard main() style argc.
3283 * @param argv Standard main() style argv. Initial components are already
3284 * stripped.
3285 *
3286 * @return A shell status integer (0 for success).
3287 **/
3288
3289 static int rpc_share_add(struct net_context *c, int argc, const char **argv)
3290 {
3291 NET_API_STATUS status;
3292 char *sharename;
3293 char *path;
3294 uint32 type = STYPE_DISKTREE; /* only allow disk shares to be added */
3295 uint32 num_users=0, perms=0;
3296 char *password=NULL; /* don't allow a share password */
3297 struct SHARE_INFO_2 i2;
3298 uint32_t parm_error = 0;
3299
3300 if ((argc < 1) || !strchr(argv[0], '=') || c->display_usage) {
3301 return rpc_share_usage(c, argc, argv);
3302 }
3303
3304 if ((sharename = talloc_strdup(c, argv[0])) == NULL) {
3305 return -1;
3306 }
3307
3308 path = strchr(sharename, '=');
3309 if (!path) {
3310 return -1;
3311 }
3312
3313 *path++ = '\0';
3314
3315 i2.shi2_netname = sharename;
3316 i2.shi2_type = type;
3317 i2.shi2_remark = c->opt_comment;
3318 i2.shi2_permissions = perms;
3319 i2.shi2_max_uses = c->opt_maxusers;
3320 i2.shi2_current_uses = num_users;
3321 i2.shi2_path = path;
3322 i2.shi2_passwd = password;
3323
3324 status = NetShareAdd(c->opt_host,
3325 2,
3326 (uint8_t *)&i2,
3327 &parm_error);
3328 if (status != 0) {
3329 printf(_("NetShareAdd failed with: %s\n"),
3330 libnetapi_get_error_string(c->netapi_ctx, status));
3331 }
3332
3333 return status;
3334 }
3335
3336 /**
3337 * Delete a share on a remote RPC server.
3338 *
3339 * @param domain_sid The domain sid acquired from the remote server.
3340 * @param argc Standard main() style argc.
3341 * @param argv Standard main() style argv. Initial components are already
3342 * stripped.
3343 *
3344 * @return A shell status integer (0 for success).
3345 **/
3346 static int rpc_share_delete(struct net_context *c, int argc, const char **argv)
3347 {
3348 if (argc < 1 || c->display_usage) {
3349 return rpc_share_usage(c, argc, argv);
3350 }
3351
3352 return NetShareDel(c->opt_host, argv[0], 0);
3353 }
3354
3355 /**
3356 * Formatted print of share info
3357 *
3358 * @param r pointer to SHARE_INFO_1 to format
3359 **/
3360
3361 static void display_share_info_1(struct net_context *c,
3362 struct SHARE_INFO_1 *r)
3363 {
3364 if (c->opt_long_list_entries) {
3365 d_printf("%-12s %-8.8s %-50s\n",
3366 r->shi1_netname,
3367 net_share_type_str(r->shi1_type & ~(STYPE_TEMPORARY|STYPE_HIDDEN)),
3368 r->shi1_remark);
3369 } else {
3370 d_printf("%s\n", r->shi1_netname);
3371 }
3372 }
3373
3374 static WERROR get_share_info(struct net_context *c,
3375 struct rpc_pipe_client *pipe_hnd,
3376 TALLOC_CTX *mem_ctx,
3377 uint32 level,
3378 int argc,
3379 const char **argv,
3380 struct srvsvc_NetShareInfoCtr *info_ctr)
3381 {
3382 WERROR result;
3383 NTSTATUS status;
3384 union srvsvc_NetShareInfo info;
3385 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3386
3387 /* no specific share requested, enumerate all */
3388 if (argc == 0) {
3389
3390 uint32_t preferred_len = 0xffffffff;
3391 uint32_t total_entries = 0;
3392 uint32_t resume_handle = 0;
3393
3394 info_ctr->level = level;
3395
3396 status = dcerpc_srvsvc_NetShareEnumAll(b, mem_ctx,
3397 pipe_hnd->desthost,
3398 info_ctr,
3399 preferred_len,
3400 &total_entries,
3401 &resume_handle,
3402 &result);
3403 if (!NT_STATUS_IS_OK(status)) {
3404 return ntstatus_to_werror(status);
3405 }
3406 return result;
3407 }
3408
3409 /* request just one share */
3410 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
3411 pipe_hnd->desthost,
3412 argv[0],
3413 level,
3414 &info,
3415 &result);
3416
3417 if (!NT_STATUS_IS_OK(status)) {
3418 result = ntstatus_to_werror(status);
3419 goto done;
3420 }
3421
3422 if (!W_ERROR_IS_OK(result)) {
3423 goto done;
3424 }
3425
3426 /* construct ctr */
3427 ZERO_STRUCTP(info_ctr);
3428
3429 info_ctr->level = level;
3430
3431 switch (level) {
3432 case 1:
3433 {
3434 struct srvsvc_NetShareCtr1 *ctr1;
3435
3436 ctr1 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr1);
3437 W_ERROR_HAVE_NO_MEMORY(ctr1);
3438
3439 ctr1->count = 1;
3440 ctr1->array = info.info1;
3441
3442 info_ctr->ctr.ctr1 = ctr1;
3443
3444 break;
3445 }
3446 case 2:
3447 {
3448 struct srvsvc_NetShareCtr2 *ctr2;
3449
3450 ctr2 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr2);
3451 W_ERROR_HAVE_NO_MEMORY(ctr2);
3452
3453 ctr2->count = 1;
3454 ctr2->array = info.info2;
3455
3456 info_ctr->ctr.ctr2 = ctr2;
3457
3458 break;
3459 }
3460 case 502:
3461 {
3462 struct srvsvc_NetShareCtr502 *ctr502;
3463
3464 ctr502 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr502);
3465 W_ERROR_HAVE_NO_MEMORY(ctr502);
3466
3467 ctr502->count = 1;
3468 ctr502->array = info.info502;
3469
3470 info_ctr->ctr.ctr502 = ctr502;
3471
3472 break;
3473 }
3474 } /* switch */
3475 done:
3476 return result;
3477 }
3478
3479 /***
3480 * 'net rpc share list' entrypoint.
3481 * @param argc Standard main() style argc.
3482 * @param argv Standard main() style argv. Initial components are already
3483 * stripped.
3484 **/
3485 static int rpc_share_list(struct net_context *c, int argc, const char **argv)
3486 {
3487 NET_API_STATUS status;
3488 struct SHARE_INFO_1 *i1 = NULL;
3489 uint32_t entries_read = 0;
3490 uint32_t total_entries = 0;
3491 uint32_t resume_handle = 0;
3492 uint32_t i, level = 1;
3493
3494 if (c->display_usage) {
3495 d_printf( "%s\n"
3496 "net rpc share list\n"
3497 " %s\n",
3498 _("Usage:"),
3499 _("List shares on remote server"));
3500 return 0;
3501 }
3502
3503 status = NetShareEnum(c->opt_host,
3504 level,
3505 (uint8_t **)(void *)&i1,
3506 (uint32_t)-1,
3507 &entries_read,
3508 &total_entries,
3509 &resume_handle);
3510 if (status != 0) {
3511 goto done;
3512 }
3513
3514 /* Display results */
3515
3516 if (c->opt_long_list_entries) {
3517 d_printf(_(
3518 "\nEnumerating shared resources (exports) on remote server:\n\n"
3519 "\nShare name Type Description\n"
3520 "---------- ---- -----------\n"));
3521 }
3522 for (i = 0; i < entries_read; i++)
3523 display_share_info_1(c, &i1[i]);
3524 done:
3525 return status;
3526 }
3527
3528 static bool check_share_availability(struct cli_state *cli, const char *netname)
3529 {
3530 NTSTATUS status;
3531
3532 status = cli_tree_connect(cli, netname, "A:", "", 0);
3533 if (!NT_STATUS_IS_OK(status)) {
3534 d_printf(_("skipping [%s]: not a file share.\n"), netname);
3535 return false;
3536 }
3537
3538 status = cli_tdis(cli);
3539 if (!NT_STATUS_IS_OK(status)) {
3540 d_printf(_("cli_tdis returned %s\n"), nt_errstr(status));
3541 return false;
3542 }
3543
3544 return true;
3545 }
3546
3547 static bool check_share_sanity(struct net_context *c, struct cli_state *cli,
3548 const char *netname, uint32 type)
3549 {
3550 /* only support disk shares */
3551 if (! ( type == STYPE_DISKTREE || type == (STYPE_DISKTREE | STYPE_HIDDEN)) ) {
3552 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname,
3553 type);
3554 return false;
3555 }
3556
3557 /* skip builtin shares */
3558 /* FIXME: should print$ be added too ? */
3559 if (strequal(netname,"IPC$") || strequal(netname,"ADMIN$") ||
3560 strequal(netname,"global"))
3561 return false;
3562
3563 if (c->opt_exclude && in_list(netname, c->opt_exclude, false)) {
3564 printf(_("excluding [%s]\n"), netname);
3565 return false;
3566 }
3567
3568 return check_share_availability(cli, netname);
3569 }
3570
3571 /**
3572 * Migrate shares from a remote RPC server to the local RPC server.
3573 *
3574 * All parameters are provided by the run_rpc_command function, except for
3575 * argc, argv which are passed through.
3576 *
3577 * @param domain_sid The domain sid acquired from the remote server.
3578 * @param cli A cli_state connected to the server.
3579 * @param mem_ctx Talloc context, destroyed on completion of the function.
3580 * @param argc Standard main() style argc.
3581 * @param argv Standard main() style argv. Initial components are already
3582 * stripped.
3583 *
3584 * @return Normal NTSTATUS return.
3585 **/
3586
3587 static NTSTATUS rpc_share_migrate_shares_internals(struct net_context *c,
3588 const struct dom_sid *domain_sid,
3589 const char *domain_name,
3590 struct cli_state *cli,
3591 struct rpc_pipe_client *pipe_hnd,
3592 TALLOC_CTX *mem_ctx,
3593 int argc,
3594 const char **argv)
3595 {
3596 WERROR result;
3597 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3598 struct srvsvc_NetShareInfoCtr ctr_src;
3599 uint32 i;
3600 struct rpc_pipe_client *srvsvc_pipe = NULL;
3601 struct cli_state *cli_dst = NULL;
3602 uint32 level = 502; /* includes secdesc */
3603 uint32_t parm_error = 0;
3604 struct dcerpc_binding_handle *b;
3605
3606 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3607 &ctr_src);
3608 if (!W_ERROR_IS_OK(result))
3609 goto done;
3610
3611 /* connect destination PI_SRVSVC */
3612 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
3613 &ndr_table_srvsvc.syntax_id);
3614 if (!NT_STATUS_IS_OK(nt_status))
3615 return nt_status;
3616
3617 b = srvsvc_pipe->binding_handle;
3618
3619 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3620
3621 union srvsvc_NetShareInfo info;
3622 struct srvsvc_NetShareInfo502 info502 =
3623 ctr_src.ctr.ctr502->array[i];
3624
3625 /* reset error-code */
3626 nt_status = NT_STATUS_UNSUCCESSFUL;
3627
3628 if (!check_share_sanity(c, cli, info502.name, info502.type))
3629 continue;
3630
3631 /* finally add the share on the dst server */
3632
3633 printf(_("migrating: [%s], path: %s, comment: %s, without "
3634 "share-ACLs\n"),
3635 info502.name, info502.path, info502.comment);
3636
3637 info.info502 = &info502;
3638
3639 nt_status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
3640 srvsvc_pipe->desthost,
3641 502,
3642 &info,
3643 &parm_error,
3644 &result);
3645 if (!NT_STATUS_IS_OK(nt_status)) {
3646 printf(_("cannot add share: %s\n"),
3647 nt_errstr(nt_status));
3648 goto done;
3649 }
3650 if (W_ERROR_V(result) == W_ERROR_V(WERR_FILE_EXISTS)) {
3651 printf(_(" [%s] does already exist\n"),
3652 info502.name);
3653 continue;
3654 }
3655
3656 if (!W_ERROR_IS_OK(result)) {
3657 nt_status = werror_to_ntstatus(result);
3658 printf(_("cannot add share: %s\n"),
3659 win_errstr(result));
3660 goto done;
3661 }
3662
3663 }
3664
3665 nt_status = NT_STATUS_OK;
3666
3667 done:
3668 if (cli_dst) {
3669 cli_shutdown(cli_dst);
3670 }
3671
3672 return nt_status;
3673
3674 }
3675
3676 /**
3677 * Migrate shares from a RPC server to another.
3678 *
3679 * @param argc Standard main() style argc.
3680 * @param argv Standard main() style argv. Initial components are already
3681 * stripped.
3682 *
3683 * @return A shell status integer (0 for success).
3684 **/
3685 static int rpc_share_migrate_shares(struct net_context *c, int argc,
3686 const char **argv)
3687 {
3688 if (c->display_usage) {
3689 d_printf( "%s\n"
3690 "net rpc share migrate shares\n"
3691 " %s\n",
3692 _("Usage:"),
3693 _("Migrate shares to local server"));
3694 return 0;
3695 }
3696
3697 if (!c->opt_host) {
3698 printf(_("no server to migrate\n"));
3699 return -1;
3700 }
3701
3702 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
3703 rpc_share_migrate_shares_internals,
3704 argc, argv);
3705 }
3706
3707 /**
3708 * Copy a file/dir
3709 *
3710 * @param f file_info
3711 * @param mask current search mask
3712 * @param state arg-pointer
3713 *
3714 **/
3715 static NTSTATUS copy_fn(const char *mnt, struct file_info *f,
3716 const char *mask, void *state)
3717 {
3718 static NTSTATUS nt_status;
3719 static struct copy_clistate *local_state;
3720 static fstring filename, new_mask;
3721 fstring dir;
3722 char *old_dir;
3723 struct net_context *c;
3724
3725 local_state = (struct copy_clistate *)state;
3726 nt_status = NT_STATUS_UNSUCCESSFUL;
3727
3728 c = local_state->c;
3729
3730 if (strequal(f->name, ".") || strequal(f->name, ".."))
3731 return NT_STATUS_OK;
3732
3733 DEBUG(3,("got mask: %s, name: %s\n", mask, f->name));
3734
3735 /* DIRECTORY */
3736 if (f->mode & FILE_ATTRIBUTE_DIRECTORY) {
3737
3738 DEBUG(3,("got dir: %s\n", f->name));
3739
3740 fstrcpy(dir, local_state->cwd);
3741 fstrcat(dir, "\\");
3742 fstrcat(dir, f->name);
3743
3744 switch (net_mode_share)
3745 {
3746 case NET_MODE_SHARE_MIGRATE:
3747 /* create that directory */
3748 nt_status = net_copy_file(c, local_state->mem_ctx,
3749 local_state->cli_share_src,
3750 local_state->cli_share_dst,
3751 dir, dir,
3752 c->opt_acls? true : false,
3753 c->opt_attrs? true : false,
3754 c->opt_timestamps? true:false,
3755 false);
3756 break;
3757 default:
3758 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3759 return NT_STATUS_INTERNAL_ERROR;
3760 }
3761
3762 if (!NT_STATUS_IS_OK(nt_status)) {
3763 printf(_("could not handle dir %s: %s\n"),
3764 dir, nt_errstr(nt_status));
3765 return nt_status;
3766 }
3767
3768 /* search below that directory */
3769 if (strlcpy(new_mask, dir, sizeof(new_mask)) >= sizeof(new_mask)) {
3770 return NT_STATUS_NO_MEMORY;
3771 }
3772 if (strlcat(new_mask, "\\*", sizeof(new_mask)) >= sizeof(new_mask)) {
3773 return NT_STATUS_NO_MEMORY;
3774 }
3775
3776 old_dir = local_state->cwd;
3777 local_state->cwd = dir;
3778 nt_status = sync_files(local_state, new_mask);
3779 if (!NT_STATUS_IS_OK(nt_status)) {
3780 printf(_("could not handle files\n"));
3781 }
3782 local_state->cwd = old_dir;
3783
3784 return nt_status;
3785 }
3786
3787
3788 /* FILE */
3789 fstrcpy(filename, local_state->cwd);
3790 fstrcat(filename, "\\");
3791 fstrcat(filename, f->name);
3792
3793 DEBUG(3,("got file: %s\n", filename));
3794
3795 switch (net_mode_share)
3796 {
3797 case NET_MODE_SHARE_MIGRATE:
3798 nt_status = net_copy_file(c, local_state->mem_ctx,
3799 local_state->cli_share_src,
3800 local_state->cli_share_dst,
3801 filename, filename,
3802 c->opt_acls? true : false,
3803 c->opt_attrs? true : false,
3804 c->opt_timestamps? true: false,
3805 true);
3806 break;
3807 default:
3808 d_fprintf(stderr, _("Unsupported file mode %d\n"),
3809 net_mode_share);
3810 return NT_STATUS_INTERNAL_ERROR;
3811 }
3812
3813 if (!NT_STATUS_IS_OK(nt_status))
3814 printf(_("could not handle file %s: %s\n"),
3815 filename, nt_errstr(nt_status));
3816 return nt_status;
3817 }
3818
3819 /**
3820 * sync files, can be called recursivly to list files
3821 * and then call copy_fn for each file
3822 *
3823 * @param cp_clistate pointer to the copy_clistate we work with
3824 * @param mask the current search mask
3825 *
3826 * @return Boolean result
3827 **/
3828 static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask)
3829 {
3830 struct cli_state *targetcli;
3831 char *targetpath = NULL;
3832 NTSTATUS status;
3833
3834 DEBUG(3,("calling cli_list with mask: %s\n", mask));
3835
3836 status = cli_resolve_path(talloc_tos(), "", NULL,
3837 cp_clistate->cli_share_src,
3838 mask, &targetcli, &targetpath);
3839 if (!NT_STATUS_IS_OK(status)) {
3840 d_fprintf(stderr, _("cli_resolve_path %s failed with error: "
3841 "%s\n"),
3842 mask, nt_errstr(status));
3843 return status;
3844 }
3845
3846 status = cli_list(targetcli, targetpath, cp_clistate->attribute,
3847 copy_fn, cp_clistate);
3848 if (!NT_STATUS_IS_OK(status)) {
3849 d_fprintf(stderr, _("listing %s failed with error: %s\n"),
3850 mask, nt_errstr(status));
3851 }
3852
3853 return status;
3854 }
3855
3856
3857 /**
3858 * Set the top level directory permissions before we do any further copies.
3859 * Should set up ACL inheritance.
3860 **/
3861
3862 bool copy_top_level_perms(struct net_context *c,
3863 struct copy_clistate *cp_clistate,
3864 const char *sharename)
3865 {
3866 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3867
3868 switch (net_mode_share) {
3869 case NET_MODE_SHARE_MIGRATE:
3870 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename));
3871 nt_status = net_copy_fileattr(c,
3872 cp_clistate->mem_ctx,
3873 cp_clistate->cli_share_src,
3874 cp_clistate->cli_share_dst,
3875 "\\", "\\",
3876 c->opt_acls? true : false,
3877 c->opt_attrs? true : false,
3878 c->opt_timestamps? true: false,
3879 false);
3880 break;
3881 default:
3882 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3883 break;
3884 }
3885
3886 if (!NT_STATUS_IS_OK(nt_status)) {
3887 printf(_("Could handle directory attributes for top level "
3888 "directory of share %s. Error %s\n"),
3889 sharename, nt_errstr(nt_status));
3890 return false;
3891 }
3892
3893 return true;
3894 }
3895
3896 /**
3897 * Sync all files inside a remote share to another share (over smb).
3898 *
3899 * All parameters are provided by the run_rpc_command function, except for
3900 * argc, argv which are passed through.
3901 *
3902 * @param domain_sid The domain sid acquired from the remote server.
3903 * @param cli A cli_state connected to the server.
3904 * @param mem_ctx Talloc context, destroyed on completion of the function.
3905 * @param argc Standard main() style argc.
3906 * @param argv Standard main() style argv. Initial components are already
3907 * stripped.
3908 *
3909 * @return Normal NTSTATUS return.
3910 **/
3911
3912 static NTSTATUS rpc_share_migrate_files_internals(struct net_context *c,
3913 const struct dom_sid *domain_sid,
3914 const char *domain_name,
3915 struct cli_state *cli,
3916 struct rpc_pipe_client *pipe_hnd,
3917 TALLOC_CTX *mem_ctx,
3918 int argc,
3919 const char **argv)
3920 {
3921 WERROR result;
3922 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3923 struct srvsvc_NetShareInfoCtr ctr_src;
3924 uint32 i;
3925 uint32 level = 502;
3926 struct copy_clistate cp_clistate;
3927 bool got_src_share = false;
3928 bool got_dst_share = false;
3929 const char *mask = "\\*";
3930 char *dst = NULL;
3931
3932 dst = SMB_STRDUP(c->opt_destination?c->opt_destination:"127.0.0.1");
3933 if (dst == NULL) {
3934 nt_status = NT_STATUS_NO_MEMORY;
3935 goto done;
3936 }
3937
3938 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3939 &ctr_src);
3940
3941 if (!W_ERROR_IS_OK(result))
3942 goto done;
3943
3944 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3945
3946 struct srvsvc_NetShareInfo502 info502 =
3947 ctr_src.ctr.ctr502->array[i];
3948
3949 if (!check_share_sanity(c, cli, info502.name, info502.type))
3950 continue;
3951
3952 /* one might not want to mirror whole discs :) */
3953 if (strequal(info502.name, "print$") || info502.name[1] == '$') {
3954 d_printf(_("skipping [%s]: builtin/hidden share\n"),
3955 info502.name);
3956 continue;
3957 }
3958
3959 switch (net_mode_share)
3960 {
3961 case NET_MODE_SHARE_MIGRATE:
3962 printf("syncing");
3963 break;
3964 default:
3965 d_fprintf(stderr, _("Unsupported mode %d\n"),
3966 net_mode_share);
3967 break;
3968 }
3969 printf(_(" [%s] files and directories %s ACLs, %s DOS "
3970 "Attributes %s\n"),
3971 info502.name,
3972 c->opt_acls ? _("including") : _("without"),
3973 c->opt_attrs ? _("including") : _("without"),
3974 c->opt_timestamps ? _("(preserving timestamps)") : "");
3975
3976 cp_clistate.mem_ctx = mem_ctx;
3977 cp_clistate.cli_share_src = NULL;
3978 cp_clistate.cli_share_dst = NULL;
3979 cp_clistate.cwd = NULL;
3980 cp_clistate.attribute = FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
3981 cp_clistate.c = c;
3982
3983 /* open share source */
3984 nt_status = connect_to_service(c, &cp_clistate.cli_share_src,
3985 smbXcli_conn_remote_sockaddr(cli->conn),
3986 smbXcli_conn_remote_name(cli->conn),
3987 info502.name, "A:");
3988 if (!NT_STATUS_IS_OK(nt_status))
3989 goto done;
3990
3991 got_src_share = true;
3992
3993 if (net_mode_share == NET_MODE_SHARE_MIGRATE) {
3994 /* open share destination */
3995 nt_status = connect_to_service(c, &cp_clistate.cli_share_dst,
3996 NULL, dst, info502.name, "A:");
3997 if (!NT_STATUS_IS_OK(nt_status))
3998 goto done;
3999
4000 got_dst_share = true;
4001 }
4002
4003 if (!copy_top_level_perms(c, &cp_clistate, info502.name)) {
4004 d_fprintf(stderr, _("Could not handle the top level "
4005 "directory permissions for the "
4006 "share: %s\n"), info502.name);
4007 nt_status = NT_STATUS_UNSUCCESSFUL;
4008 goto done;
4009 }
4010
4011 nt_status = sync_files(&cp_clistate, mask);
4012 if (!NT_STATUS_IS_OK(nt_status)) {
4013 d_fprintf(stderr, _("could not handle files for share: "
4014 "%s\n"), info502.name);
4015 goto done;
4016 }
4017 }
4018
4019 nt_status = NT_STATUS_OK;
4020
4021 done:
4022
4023 if (got_src_share)
4024 cli_shutdown(cp_clistate.cli_share_src);
4025
4026 if (got_dst_share)
4027 cli_shutdown(cp_clistate.cli_share_dst);
4028
4029 SAFE_FREE(dst);
4030 return nt_status;
4031
4032 }
4033
4034 static int rpc_share_migrate_files(struct net_context *c, int argc, const char **argv)
4035 {
4036 if (c->display_usage) {
4037 d_printf( "%s\n"
4038 "net share migrate files\n"
4039 " %s\n",
4040 _("Usage:"),
4041 _("Migrate files to local server"));
4042 return 0;
4043 }
4044
4045 if (!c->opt_host) {
4046 d_printf(_("no server to migrate\n"));
4047 return -1;
4048 }
4049
4050 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4051 rpc_share_migrate_files_internals,
4052 argc, argv);
4053 }
4054
4055 /**
4056 * Migrate share-ACLs from a remote RPC server to the local RPC server.
4057 *
4058 * All parameters are provided by the run_rpc_command function, except for
4059 * argc, argv which are passed through.
4060 *
4061 * @param domain_sid The domain sid acquired from the remote server.
4062 * @param cli A cli_state connected to the server.
4063 * @param mem_ctx Talloc context, destroyed on completion of the function.
4064 * @param argc Standard main() style argc.
4065 * @param argv Standard main() style argv. Initial components are already
4066 * stripped.
4067 *
4068 * @return Normal NTSTATUS return.
4069 **/
4070
4071 static NTSTATUS rpc_share_migrate_security_internals(struct net_context *c,
4072 const struct dom_sid *domain_sid,
4073 const char *domain_name,
4074 struct cli_state *cli,
4075 struct rpc_pipe_client *pipe_hnd,
4076 TALLOC_CTX *mem_ctx,
4077 int argc,
4078 const char **argv)
4079 {
4080 WERROR result;
4081 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
4082 struct srvsvc_NetShareInfoCtr ctr_src;
4083 union srvsvc_NetShareInfo info;
4084 uint32 i;
4085 struct rpc_pipe_client *srvsvc_pipe = NULL;
4086 struct cli_state *cli_dst = NULL;
4087 uint32 level = 502; /* includes secdesc */
4088 uint32_t parm_error = 0;
4089 struct dcerpc_binding_handle *b;
4090
4091 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
4092 &ctr_src);
4093
4094 if (!W_ERROR_IS_OK(result))
4095 goto done;
4096
4097 /* connect destination PI_SRVSVC */
4098 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
4099 &ndr_table_srvsvc.syntax_id);
4100 if (!NT_STATUS_IS_OK(nt_status))
4101 return nt_status;
4102
4103 b = srvsvc_pipe->binding_handle;
4104
4105 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
4106
4107 struct srvsvc_NetShareInfo502 info502 =
4108 ctr_src.ctr.ctr502->array[i];
4109
4110 /* reset error-code */
4111 nt_status = NT_STATUS_UNSUCCESSFUL;
4112
4113 if (!check_share_sanity(c, cli, info502.name, info502.type))
4114 continue;
4115
4116 printf(_("migrating: [%s], path: %s, comment: %s, including "
4117 "share-ACLs\n"),
4118 info502.name, info502.path, info502.comment);
4119
4120 if (c->opt_verbose)
4121 display_sec_desc(info502.sd_buf.sd);
4122
4123 /* FIXME: shouldn't we be able to just set the security descriptor ? */
4124 info.info502 = &info502;
4125
4126 /* finally modify the share on the dst server */
4127 nt_status = dcerpc_srvsvc_NetShareSetInfo(b, mem_ctx,
4128 srvsvc_pipe->desthost,
4129 info502.name,
4130 level,
4131 &info,
4132 &parm_error,
4133 &result);
4134 if (!NT_STATUS_IS_OK(nt_status)) {
4135 printf(_("cannot set share-acl: %s\n"),
4136 nt_errstr(nt_status));
4137 goto done;
4138 }
4139 if (!W_ERROR_IS_OK(result)) {
4140 nt_status = werror_to_ntstatus(result);
4141 printf(_("cannot set share-acl: %s\n"),
4142 win_errstr(result));
4143 goto done;
4144 }
4145
4146 }
4147
4148 nt_status = NT_STATUS_OK;
4149
4150 done:
4151 if (cli_dst) {
4152 cli_shutdown(cli_dst);
4153 }
4154
4155 return nt_status;
4156
4157 }
4158
4159 /**
4160 * Migrate share-acls from a RPC server to another.
4161 *
4162 * @param argc Standard main() style argc.
4163 * @param argv Standard main() style argv. Initial components are already
4164 * stripped.
4165 *
4166 * @return A shell status integer (0 for success).
4167 **/
4168 static int rpc_share_migrate_security(struct net_context *c, int argc,
4169 const char **argv)
4170 {
4171 if (c->display_usage) {
4172 d_printf( "%s\n"
4173 "net rpc share migrate security\n"
4174 " %s\n",
4175 _("Usage:"),
4176 _("Migrate share-acls to local server"));
4177 return 0;
4178 }
4179
4180 if (!c->opt_host) {
4181 d_printf(_("no server to migrate\n"));
4182 return -1;
4183 }
4184
4185 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4186 rpc_share_migrate_security_internals,
4187 argc, argv);
4188 }
4189
4190 /**
4191 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
4192 * from one server to another.
4193 *
4194 * @param argc Standard main() style argc.
4195 * @param argv Standard main() style argv. Initial components are already
4196 * stripped.
4197 *
4198 * @return A shell status integer (0 for success).
4199 *
4200 **/
4201 static int rpc_share_migrate_all(struct net_context *c, int argc,
4202 const char **argv)
4203 {
4204 int ret;
4205
4206 if (c->display_usage) {
4207 d_printf( "%s\n"
4208 "net rpc share migrate all\n"
4209 " %s\n",
4210 _("Usage:"),
4211 _("Migrates shares including all share settings"));
4212 return 0;
4213 }
4214
4215 if (!c->opt_host) {
4216 d_printf(_("no server to migrate\n"));
4217 return -1;
4218 }
4219
4220 /* order is important. we don't want to be locked out by the share-acl
4221 * before copying files - gd */
4222
4223 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4224 rpc_share_migrate_shares_internals, argc, argv);
4225 if (ret)
4226 return ret;
4227
4228 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4229 rpc_share_migrate_files_internals, argc, argv);
4230 if (ret)
4231 return ret;
4232
4233 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4234 rpc_share_migrate_security_internals, argc,
4235 argv);
4236 }
4237
4238
4239 /**
4240 * 'net rpc share migrate' entrypoint.
4241 * @param argc Standard main() style argc.
4242 * @param argv Standard main() style argv. Initial components are already
4243 * stripped.
4244 **/
4245 static int rpc_share_migrate(struct net_context *c, int argc, const char **argv)
4246 {
4247
4248 struct functable func[] = {
4249 {
4250 "all",
4251 rpc_share_migrate_all,
4252 NET_TRANSPORT_RPC,
4253 N_("Migrate shares from remote to local server"),
4254 N_("net rpc share migrate all\n"
4255 " Migrate shares from remote to local server")
4256 },
4257 {
4258 "files",
4259 rpc_share_migrate_files,
4260 NET_TRANSPORT_RPC,
4261 N_("Migrate files from remote to local server"),
4262 N_("net rpc share migrate files\n"
4263 " Migrate files from remote to local server")
4264 },
4265 {
4266 "security",
4267 rpc_share_migrate_security,
4268 NET_TRANSPORT_RPC,
4269 N_("Migrate share-ACLs from remote to local server"),
4270 N_("net rpc share migrate security\n"
4271 " Migrate share-ACLs from remote to local server")
4272 },
4273 {
4274 "shares",
4275 rpc_share_migrate_shares,
4276 NET_TRANSPORT_RPC,
4277 N_("Migrate shares from remote to local server"),
4278 N_("net rpc share migrate shares\n"
4279 " Migrate shares from remote to local server")
4280 },
4281 {NULL, NULL, 0, NULL, NULL}
4282 };
4283
4284 net_mode_share = NET_MODE_SHARE_MIGRATE;
4285
4286 return net_run_function(c, argc, argv, "net rpc share migrate", func);
4287 }
4288
4289 struct full_alias {
4290 struct dom_sid sid;
4291 uint32 num_members;
4292 struct dom_sid *members;
4293 };
4294
4295 static int num_server_aliases;
4296 static struct full_alias *server_aliases;
4297
4298 /*
4299 * Add an alias to the static list.
4300 */
4301 static void push_alias(TALLOC_CTX *mem_ctx, struct full_alias *alias)
4302 {
4303 if (server_aliases == NULL)
4304 server_aliases = SMB_MALLOC_ARRAY(struct full_alias, 100);
4305
4306 server_aliases[num_server_aliases] = *alias;
4307 num_server_aliases += 1;
4308 }
4309
4310 /*
4311 * For a specific domain on the server, fetch all the aliases
4312 * and their members. Add all of them to the server_aliases.
4313 */
4314
4315 static NTSTATUS rpc_fetch_domain_aliases(struct rpc_pipe_client *pipe_hnd,
4316 TALLOC_CTX *mem_ctx,
4317 struct policy_handle *connect_pol,
4318 const struct dom_sid *domain_sid)
4319 {
4320 uint32 start_idx, max_entries, num_entries, i;
4321 struct samr_SamArray *groups = NULL;
4322 NTSTATUS result, status;
4323 struct policy_handle domain_pol;
4324 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4325
4326 /* Get domain policy handle */
4327
4328 status = dcerpc_samr_OpenDomain(b, mem_ctx,
4329 connect_pol,
4330 MAXIMUM_ALLOWED_ACCESS,
4331 discard_const_p(struct dom_sid2, domain_sid),
4332 &domain_pol,
4333 &result);
4334 if (!NT_STATUS_IS_OK(status)) {
4335 return status;
4336 }
4337 if (!NT_STATUS_IS_OK(result)) {
4338 return result;
4339 }
4340
4341 start_idx = 0;
4342 max_entries = 250;
4343
4344 do {
4345 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
4346 &domain_pol,
4347 &start_idx,
4348 &groups,
4349 max_entries,
4350 &num_entries,
4351 &result);
4352 if (!NT_STATUS_IS_OK(status)) {
4353 goto done;
4354 }
4355 for (i = 0; i < num_entries; i++) {
4356
4357 struct policy_handle alias_pol;
4358 struct full_alias alias;
4359 struct lsa_SidArray sid_array;
4360 int j;
4361 NTSTATUS _result;
4362
4363 status = dcerpc_samr_OpenAlias(b, mem_ctx,
4364 &domain_pol,
4365 MAXIMUM_ALLOWED_ACCESS,
4366 groups->entries[i].idx,
4367 &alias_pol,
4368 &_result);
4369 if (!NT_STATUS_IS_OK(status)) {
4370 goto done;
4371 }
4372 if (!NT_STATUS_IS_OK(_result)) {
4373 status = _result;
4374 goto done;
4375 }
4376
4377 status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
4378 &alias_pol,
4379 &sid_array,
4380 &_result);
4381 if (!NT_STATUS_IS_OK(status)) {
4382 goto done;
4383 }
4384 if (!NT_STATUS_IS_OK(_result)) {
4385 status = _result;
4386 goto done;
4387 }
4388
4389 alias.num_members = sid_array.num_sids;
4390
4391 status = dcerpc_samr_Close(b, mem_ctx, &alias_pol, &_result);
4392 if (!NT_STATUS_IS_OK(status)) {
4393 goto done;
4394 }
4395 if (!NT_STATUS_IS_OK(_result)) {
4396 status = _result;
4397 goto done;
4398 }
4399
4400 alias.members = NULL;
4401
4402 if (alias.num_members > 0) {
4403 alias.members = SMB_MALLOC_ARRAY(struct dom_sid, alias.num_members);
4404
4405 for (j = 0; j < alias.num_members; j++)
4406 sid_copy(&alias.members[j],
4407 sid_array.sids[j].sid);
4408 }
4409
4410 sid_compose(&alias.sid, domain_sid,
4411 groups->entries[i].idx);
4412
4413 push_alias(mem_ctx, &alias);
4414 }
4415 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
4416
4417 status = NT_STATUS_OK;
4418
4419 done:
4420 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
4421
4422 return status;
4423 }
4424
4425 /*
4426 * Dump server_aliases as names for debugging purposes.
4427 */
4428
4429 static NTSTATUS rpc_aliaslist_dump(struct net_context *c,
4430 const struct dom_sid *domain_sid,
4431 const char *domain_name,
4432 struct cli_state *cli,
4433 struct rpc_pipe_client *pipe_hnd,
4434 TALLOC_CTX *mem_ctx,
4435 int argc,
4436 const char **argv)
4437 {
4438 int i;
4439 NTSTATUS result;
4440 struct policy_handle lsa_pol;
4441 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4442
4443 result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
4444 SEC_FLAG_MAXIMUM_ALLOWED,
4445 &lsa_pol);
4446 if (!NT_STATUS_IS_OK(result))
4447 return result;
4448
4449 for (i=0; i<num_server_aliases; i++) {
4450 char **names;
4451 char **domains;
4452 enum lsa_SidType *types;
4453 int j;
4454
4455 struct full_alias *alias = &server_aliases[i];
4456
4457 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol, 1,
4458 &alias->sid,
4459 &domains, &names, &types);
4460 if (!NT_STATUS_IS_OK(result))
4461 continue;
4462
4463 DEBUG(1, ("%s\\%s %d: ", domains[0], names[0], types[0]));
4464
4465 if (alias->num_members == 0) {
4466 DEBUG(1, ("\n"));
4467 continue;
4468 }
4469
4470 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol,
4471 alias->num_members,
4472 alias->members,
4473 &domains, &names, &types);
4474
4475 if (!NT_STATUS_IS_OK(result) &&
4476 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
4477 continue;
4478
4479 for (j=0; j<alias->num_members; j++)
4480 DEBUG(1, ("%s\\%s (%d); ",
4481 domains[j] ? domains[j] : "*unknown*",
4482 names[j] ? names[j] : "*unknown*",types[j]));
4483 DEBUG(1, ("\n"));
4484 }
4485
4486 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
4487
4488 return NT_STATUS_OK;
4489 }
4490
4491 /*
4492 * Fetch a list of all server aliases and their members into
4493 * server_aliases.
4494 */
4495
4496 static NTSTATUS rpc_aliaslist_internals(struct net_context *c,
4497 const struct dom_sid *domain_sid,
4498 const char *domain_name,
4499 struct cli_state *cli,
4500 struct rpc_pipe_client *pipe_hnd,
4501 TALLOC_CTX *mem_ctx,
4502 int argc,
4503 const char **argv)
4504 {
4505 NTSTATUS result, status;
4506 struct policy_handle connect_pol;
4507 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4508
4509 status = dcerpc_samr_Connect2(b, mem_ctx,
4510 pipe_hnd->desthost,
4511 MAXIMUM_ALLOWED_ACCESS,
4512 &connect_pol,
4513 &result);
4514 if (!NT_STATUS_IS_OK(status)) {
4515 goto done;
4516 }
4517 if (!NT_STATUS_IS_OK(result)) {
4518 status = result;
4519 goto done;
4520 }
4521
4522 status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4523 &global_sid_Builtin);
4524 if (!NT_STATUS_IS_OK(status)) {
4525 goto done;
4526 }
4527
4528 status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4529 domain_sid);
4530
4531 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
4532 done:
4533 return status;
4534 }
4535
4536 static void init_user_token(struct security_token *token, struct dom_sid *user_sid)
4537 {
4538 token->num_sids = 4;
4539
4540 if (!(token->sids = SMB_MALLOC_ARRAY(struct dom_sid, 4))) {
4541 d_fprintf(stderr, "malloc %s\n",_("failed"));
4542 token->num_sids = 0;
4543 return;
4544 }
4545
4546 token->sids[0] = *user_sid;
4547 sid_copy(&token->sids[1], &global_sid_World);
4548 sid_copy(&token->sids[2], &global_sid_Network);
4549 sid_copy(&token->sids[3], &global_sid_Authenticated_Users);
4550 }
4551
4552 static void free_user_token(struct security_token *token)
4553 {
4554 SAFE_FREE(token->sids);
4555 }
4556
4557 static void add_sid_to_token(struct security_token *token, struct dom_sid *sid)
4558 {
4559 if (security_token_has_sid(token, sid))
4560 return;
4561
4562 token->sids = SMB_REALLOC_ARRAY(token->sids, struct dom_sid, token->num_sids+1);
4563 if (!token->sids) {
4564 return;
4565 }
4566
4567 sid_copy(&token->sids[token->num_sids], sid);
4568
4569 token->num_sids += 1;
4570 }
4571
4572 struct user_token {
4573 fstring name;
4574 struct security_token token;
4575 };
4576
4577 static void dump_user_token(struct user_token *token)
4578 {
4579 int i;
4580
4581 d_printf("%s\n", token->name);
4582
4583 for (i=0; i<token->token.num_sids; i++) {
4584 d_printf(" %s\n", sid_string_tos(&token->token.sids[i]));
4585 }
4586 }
4587
4588 static bool is_alias_member(struct dom_sid *sid, struct full_alias *alias)
4589 {
4590 int i;
4591
4592 for (i=0; i<alias->num_members; i++) {
4593 if (dom_sid_compare(sid, &alias->members[i]) == 0)
4594 return true;
4595 }
4596
4597 return false;
4598 }
4599
4600 static void collect_sid_memberships(struct security_token *token, struct dom_sid sid)
4601 {
4602 int i;
4603
4604 for (i=0; i<num_server_aliases; i++) {
4605 if (is_alias_member(&sid, &server_aliases[i]))
4606 add_sid_to_token(token, &server_aliases[i].sid);
4607 }
4608 }
4609
4610 /*
4611 * We got a user token with all the SIDs we can know about without asking the
4612 * server directly. These are the user and domain group sids. All of these can
4613 * be members of aliases. So scan the list of aliases for each of the SIDs and
4614 * add them to the token.
4615 */
4616
4617 static void collect_alias_memberships(struct security_token *token)
4618 {
4619 int num_global_sids = token->num_sids;
4620 int i;
4621
4622 for (i=0; i<num_global_sids; i++) {
4623 collect_sid_memberships(token, token->sids[i]);
4624 }
4625 }
4626
4627 static bool get_user_sids(const char *domain, const char *user, struct security_token *token)
4628 {
4629 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4630 enum wbcSidType type;
4631 fstring full_name;
4632 struct wbcDomainSid wsid;
4633 char sid_str[WBC_SID_STRING_BUFLEN];
4634 struct dom_sid user_sid;
4635 uint32_t num_groups;
4636 gid_t *groups = NULL;
4637 uint32_t i;
4638
4639 fstr_sprintf(full_name, "%s%c%s",
4640 domain, *lp_winbind_separator(), user);
4641
4642 /* First let's find out the user sid */
4643
4644 wbc_status = wbcLookupName(domain, user, &wsid, &type);
4645
4646 if (!WBC_ERROR_IS_OK(wbc_status)) {
4647 DEBUG(1, ("winbind could not find %s: %s\n",
4648 full_name, wbcErrorString(wbc_status)));
4649 return false;
4650 }
4651
4652 wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4653
4654 if (type != WBC_SID_NAME_USER) {
4655 DEBUG(1, ("%s is not a user\n", full_name));
4656 return false;
4657 }
4658
4659 if (!string_to_sid(&user_sid, sid_str)) {
4660 DEBUG(1,("Could not convert sid %s from string\n", sid_str));
4661 return false;
4662 }
4663
4664 init_user_token(token, &user_sid);
4665
4666 /* And now the groups winbind knows about */
4667
4668 wbc_status = wbcGetGroups(full_name, &num_groups, &groups);
4669 if (!WBC_ERROR_IS_OK(wbc_status)) {
4670 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4671 full_name, wbcErrorString(wbc_status)));
4672 return false;
4673 }
4674
4675 for (i = 0; i < num_groups; i++) {
4676 gid_t gid = groups[i];
4677 struct dom_sid sid;
4678
4679 wbc_status = wbcGidToSid(gid, &wsid);
4680 if (!WBC_ERROR_IS_OK(wbc_status)) {
4681 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4682 (unsigned int)gid, wbcErrorString(wbc_status)));
4683 wbcFreeMemory(groups);
4684 return false;
4685 }
4686
4687 wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4688
4689 DEBUG(3, (" %s\n", sid_str));
4690
4691 string_to_sid(&sid, sid_str);
4692 add_sid_to_token(token, &sid);
4693 }
4694 wbcFreeMemory(groups);
4695
4696 return true;
4697 }
4698
4699 /**
4700 * Get a list of all user tokens we want to look at
4701 **/
4702
4703 static bool get_user_tokens(struct net_context *c, int *num_tokens,
4704 struct user_token **user_tokens)
4705 {
4706 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4707 uint32_t i, num_users;
4708 const char **users;
4709 struct user_token *result;
4710 TALLOC_CTX *frame = NULL;
4711
4712 if (lp_winbind_use_default_domain() &&
4713 (c->opt_target_workgroup == NULL)) {
4714 d_fprintf(stderr, _("winbind use default domain = yes set, "
4715 "please specify a workgroup\n"));
4716 return false;
4717 }
4718
4719 /* Send request to winbind daemon */
4720
4721 wbc_status = wbcListUsers(NULL, &num_users, &users);
4722 if (!WBC_ERROR_IS_OK(wbc_status)) {
4723 DEBUG(1, (_("winbind could not list users: %s\n"),
4724 wbcErrorString(wbc_status)));
4725 return false;
4726 }
4727
4728 result = SMB_MALLOC_ARRAY(struct user_token, num_users);
4729
4730 if (result == NULL) {
4731 DEBUG(1, ("Could not malloc sid array\n"));
4732 wbcFreeMemory(users);
4733 return false;
4734 }
4735
4736 frame = talloc_stackframe();
4737 for (i=0; i < num_users; i++) {
4738 fstring domain, user;
4739 char *p;
4740
4741 fstrcpy(result[i].name, users[i]);
4742
4743 p = strchr(users[i], *lp_winbind_separator());
4744
4745 DEBUG(3, ("%s\n", users[i]));
4746
4747 if (p == NULL) {
4748 fstrcpy(domain, c->opt_target_workgroup);
4749 fstrcpy(user, users[i]);
4750 } else {
4751 *p++ = '\0';
4752 fstrcpy(domain, users[i]);
4753 if (!strupper_m(domain)) {
4754 DEBUG(1, ("strupper_m %s failed\n", domain));
4755 wbcFreeMemory(users);
4756 return false;
4757 }
4758 fstrcpy(user, p);
4759 }
4760
4761 get_user_sids(domain, user, &(result[i].token));
4762 }
4763 TALLOC_FREE(frame);
4764 wbcFreeMemory(users);
4765
4766 *num_tokens = num_users;
4767 *user_tokens = result;
4768
4769 return true;
4770 }
4771
4772 static bool get_user_tokens_from_file(FILE *f,
4773 int *num_tokens,
4774 struct user_token **tokens)
4775 {
4776 struct user_token *token = NULL;
4777
4778 while (!feof(f)) {
4779 fstring line;
4780
4781 if (fgets(line, sizeof(line)-1, f) == NULL) {
4782 return true;
4783 }
4784
4785 if ((strlen(line) > 0) && (line[strlen(line)-1] == '\n')) {
4786 line[strlen(line)-1] = '\0';
4787 }
4788
4789 if (line[0] == ' ') {
4790 /* We have a SID */
4791
4792 struct dom_sid sid;
4793 if(!string_to_sid(&sid, &line[1])) {
4794 DEBUG(1,("get_user_tokens_from_file: Could "
4795 "not convert sid %s \n",&line[1]));
4796 return false;
4797 }
4798
4799 if (token == NULL) {
4800 DEBUG(0, ("File does not begin with username"));
4801 return false;
4802 }
4803
4804 add_sid_to_token(&token->token, &sid);
4805 continue;
4806 }
4807
4808 /* And a new user... */
4809
4810 *num_tokens += 1;
4811 *tokens = SMB_REALLOC_ARRAY(*tokens, struct user_token, *num_tokens);
4812 if (*tokens == NULL) {
4813 DEBUG(0, ("Could not realloc tokens\n"));
4814 return false;
4815 }
4816
4817 token = &((*tokens)[*num_tokens-1]);
4818
4819 if (strlcpy(token->name, line, sizeof(token->name)) >= sizeof(token->name)) {
4820 return false;
4821 }
4822 token->token.num_sids = 0;
4823 token->token.sids = NULL;
4824 continue;
4825 }
4826
4827 return false;
4828 }
4829
4830
4831 /*
4832 * Show the list of all users that have access to a share
4833 */
4834
4835 static void show_userlist(struct rpc_pipe_client *pipe_hnd,
4836 TALLOC_CTX *mem_ctx,
4837 const char *netname,
4838 int num_tokens,
4839 struct user_token *tokens)
4840 {
4841 uint16_t fnum;
4842 struct security_descriptor *share_sd = NULL;
4843 struct security_descriptor *root_sd = NULL;
4844 struct cli_state *cli = rpc_pipe_np_smb_conn(pipe_hnd);
4845 int i;
4846 union srvsvc_NetShareInfo info;
4847 WERROR result;
4848 NTSTATUS status;
4849 uint16 cnum;
4850 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4851
4852 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
4853 pipe_hnd->desthost,
4854 netname,
4855 502,
4856 &info,
4857 &result);
4858
4859 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
4860 DEBUG(1, ("Coult not query secdesc for share %s\n",
4861 netname));
4862 return;
4863 }
4864
4865 share_sd = info.info502->sd_buf.sd;
4866 if (share_sd == NULL) {
4867 DEBUG(1, ("Got no secdesc for share %s\n",
4868 netname));
4869 }
4870
4871 cnum = cli_state_get_tid(cli);
4872
4873 if (!NT_STATUS_IS_OK(cli_tree_connect(cli, netname, "A:", "", 0))) {
4874 return;
4875 }
4876
4877 if (!NT_STATUS_IS_OK(cli_ntcreate(cli, "\\", 0, READ_CONTROL_ACCESS, 0,
4878 FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
4879 cli_query_secdesc(cli, fnum, mem_ctx, &root_sd);
4880 }
4881
4882 for (i=0; i<num_tokens; i++) {
4883 uint32 acc_granted;
4884
4885 if (share_sd != NULL) {
4886 status = se_access_check(share_sd, &tokens[i].token,
4887 1, &acc_granted);
4888
4889 if (!NT_STATUS_IS_OK(status)) {
4890 DEBUG(1, ("Could not check share_sd for "
4891 "user %s\n",
4892 tokens[i].name));
4893 continue;
4894 }
4895 }
4896
4897 if (root_sd == NULL) {
4898 d_printf(" %s\n", tokens[i].name);
4899 continue;
4900 }
4901
4902 status = se_access_check(root_sd, &tokens[i].token,
4903 1, &acc_granted);
4904 if (!NT_STATUS_IS_OK(status)) {
4905 DEBUG(1, ("Could not check root_sd for user %s\n",
4906 tokens[i].name));
4907 continue;
4908 }
4909 d_printf(" %s\n", tokens[i].name);
4910 }
4911
4912 if (fnum != (uint16_t)-1)
4913 cli_close(cli, fnum);
4914 cli_tdis(cli);
4915 cli_state_set_tid(cli, cnum);
4916
4917 return;
4918 }
4919
4920 /**
4921 * List shares on a remote RPC server, including the security descriptors.
4922 *
4923 * All parameters are provided by the run_rpc_command function, except for
4924 * argc, argv which are passed through.
4925 *
4926 * @param domain_sid The domain sid acquired from the remote server.
4927 * @param cli A cli_state connected to the server.
4928 * @param mem_ctx Talloc context, destroyed on completion of the function.
4929 * @param argc Standard main() style argc.
4930 * @param argv Standard main() style argv. Initial components are already
4931 * stripped.
4932 *
4933 * @return Normal NTSTATUS return.
4934 **/
4935
4936 static NTSTATUS rpc_share_allowedusers_internals(struct net_context *c,
4937 const struct dom_sid *domain_sid,
4938 const char *domain_name,
4939 struct cli_state *cli,
4940 struct rpc_pipe_client *pipe_hnd,
4941 TALLOC_CTX *mem_ctx,
4942 int argc,
4943 const char **argv)
4944 {
4945 bool r;
4946 FILE *f;
4947 NTSTATUS nt_status = NT_STATUS_OK;
4948 uint32_t total_entries = 0;
4949 uint32_t resume_handle = 0;
4950 uint32_t preferred_len = 0xffffffff;
4951 uint32_t i;
4952 struct dcerpc_binding_handle *b = NULL;
4953 struct srvsvc_NetShareInfoCtr info_ctr;
4954 struct srvsvc_NetShareCtr1 ctr1;
4955 WERROR result;
4956
4957 struct user_token *tokens = NULL;
4958 int num_tokens = 0;
4959
4960 if (argc == 0) {
4961 f = stdin;
4962 } else {
4963 f = fopen(argv[0], "r");
4964 }
4965
4966 if (f == NULL) {
4967 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno)));
4968 return NT_STATUS_UNSUCCESSFUL;
4969 }
4970
4971 r = get_user_tokens_from_file(f, &num_tokens, &tokens);
4972
4973 if (f != stdin)
4974 fclose(f);
4975
4976 if (!r) {
4977 DEBUG(0, ("Could not read users from file\n"));
4978 return NT_STATUS_UNSUCCESSFUL;
4979 }
4980
4981 for (i=0; i<num_tokens; i++)
4982 collect_alias_memberships(&tokens[i].token);
4983
4984 ZERO_STRUCT(info_ctr);
4985 ZERO_STRUCT(ctr1);
4986
4987 info_ctr.level = 1;
4988 info_ctr.ctr.ctr1 = &ctr1;
4989
4990 b = pipe_hnd->binding_handle;
4991
4992 /* Issue the NetShareEnum RPC call and retrieve the response */
4993 nt_status = dcerpc_srvsvc_NetShareEnumAll(b,
4994 talloc_tos(),
4995 pipe_hnd->desthost,
4996 &info_ctr,
4997 preferred_len,
4998 &total_entries,
4999 &resume_handle,
5000 &result);
5001
5002 /* Was it successful? */
5003 if (!NT_STATUS_IS_OK(nt_status)) {
5004 /* Nope. Go clean up. */
5005 goto done;
5006 }
5007
5008 if (!W_ERROR_IS_OK(result)) {
5009 /* Nope. Go clean up. */
5010 nt_status = werror_to_ntstatus(result);
5011 goto done;
5012 }
5013
5014 if (total_entries == 0) {
5015 goto done;
5016 }
5017
5018 /* For each returned entry... */
5019 for (i = 0; i < info_ctr.ctr.ctr1->count; i++) {
5020 const char *netname = info_ctr.ctr.ctr1->array[i].name;
5021
5022 if (info_ctr.ctr.ctr1->array[i].type != STYPE_DISKTREE) {
5023 continue;
5024 }
5025
5026 d_printf("%s\n", netname);
5027
5028 show_userlist(pipe_hnd, mem_ctx, netname,
5029 num_tokens, tokens);
5030 }
5031 done:
5032 for (i=0; i<num_tokens; i++) {
5033 free_user_token(&tokens[i].token);
5034 }
5035 SAFE_FREE(tokens);
5036
5037 return nt_status;
5038 }
5039
5040 static int rpc_share_allowedusers(struct net_context *c, int argc,
5041 const char **argv)
5042 {
5043 int result;
5044
5045 if (c->display_usage) {
5046 d_printf( "%s\n"
5047 "net rpc share allowedusers\n"
5048 " %s\n",
5049 _("Usage:"),
5050 _("List allowed users"));
5051 return 0;
5052 }
5053
5054 result = run_rpc_command(c, NULL, &ndr_table_samr, 0,
5055 rpc_aliaslist_internals,
5056 argc, argv);
5057 if (result != 0)
5058 return result;
5059
5060 result = run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
5061 rpc_aliaslist_dump,
5062 argc, argv);
5063 if (result != 0)
5064 return result;
5065
5066 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
5067 rpc_share_allowedusers_internals,
5068 argc, argv);
5069 }
5070
5071 int net_usersidlist(struct net_context *c, int argc, const char **argv)
5072 {
5073 int num_tokens = 0;
5074 struct user_token *tokens = NULL;
5075 int i;
5076
5077 if (argc != 0) {
5078 net_usersidlist_usage(c, argc, argv);
5079 return 0;
5080 }
5081
5082 if (!get_user_tokens(c, &num_tokens, &tokens)) {
5083 DEBUG(0, ("Could not get the user/sid list\n"));
5084 return -1;
5085 }
5086
5087 for (i=0; i<num_tokens; i++) {
5088 dump_user_token(&tokens[i]);
5089 free_user_token(&tokens[i].token);
5090 }
5091
5092 SAFE_FREE(tokens);
5093 return 0;
5094 }
5095
5096 int net_usersidlist_usage(struct net_context *c, int argc, const char **argv)
5097 {
5098 d_printf(_("net usersidlist\n"
5099 "\tprints out a list of all users the running winbind knows\n"
5100 "\tabout, together with all their SIDs. This is used as\n"
5101 "\tinput to the 'net rpc share allowedusers' command.\n\n"));
5102
5103 net_common_flags_usage(c, argc, argv);
5104 return -1;
5105 }
5106
5107 /**
5108 * 'net rpc share' entrypoint.
5109 * @param argc Standard main() style argc.
5110 * @param argv Standard main() style argv. Initial components are already
5111 * stripped.
5112 **/
5113
5114 int net_rpc_share(struct net_context *c, int argc, const char **argv)
5115 {
5116 NET_API_STATUS status;
5117
5118 struct functable func[] = {
5119 {
5120 "add",
5121 rpc_share_add,
5122 NET_TRANSPORT_RPC,
5123 N_("Add share"),
5124 N_("net rpc share add\n"
5125 " Add share")
5126 },
5127 {
5128 "delete",
5129 rpc_share_delete,
5130 NET_TRANSPORT_RPC,
5131 N_("Remove share"),
5132 N_("net rpc share delete\n"
5133 " Remove share")
5134 },
5135 {
5136 "allowedusers",
5137 rpc_share_allowedusers,
5138 NET_TRANSPORT_RPC,
5139 N_("Modify allowed users"),
5140 N_("net rpc share allowedusers\n"
5141 " Modify allowed users")
5142 },
5143 {
5144 "migrate",
5145 rpc_share_migrate,
5146 NET_TRANSPORT_RPC,
5147 N_("Migrate share to local server"),
5148 N_("net rpc share migrate\n"
5149 " Migrate share to local server")
5150 },
5151 {
5152 "list",
5153 rpc_share_list,
5154 NET_TRANSPORT_RPC,
5155 N_("List shares"),
5156 N_("net rpc share list\n"
5157 " List shares")
5158 },
5159 {NULL, NULL, 0, NULL, NULL}
5160 };
5161
5162 status = libnetapi_net_init(&c->netapi_ctx);
5163 if (status != 0) {
5164 return -1;
5165 }
5166 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5167 libnetapi_set_password(c->netapi_ctx, c->opt_password);
5168 if (c->opt_kerberos) {
5169 libnetapi_set_use_kerberos(c->netapi_ctx);
5170 }
5171
5172 if (argc == 0) {
5173 if (c->display_usage) {
5174 d_printf("%s\n%s",
5175 _("Usage:"),
5176 _("net rpc share\n"
5177 " List shares\n"
5178 " Alias for net rpc share list\n"));
5179 net_display_usage_from_functable(func);
5180 return 0;
5181 }
5182
5183 return rpc_share_list(c, argc, argv);
5184 }
5185
5186 return net_run_function(c, argc, argv, "net rpc share", func);
5187 }
5188
5189 static NTSTATUS rpc_sh_share_list(struct net_context *c,
5190 TALLOC_CTX *mem_ctx,
5191 struct rpc_sh_ctx *ctx,
5192 struct rpc_pipe_client *pipe_hnd,
5193 int argc, const char **argv)
5194 {
5195
5196 return werror_to_ntstatus(W_ERROR(rpc_share_list(c, argc, argv)));
5197 }
5198
5199 static NTSTATUS rpc_sh_share_add(struct net_context *c,
5200 TALLOC_CTX *mem_ctx,
5201 struct rpc_sh_ctx *ctx,
5202 struct rpc_pipe_client *pipe_hnd,
5203 int argc, const char **argv)
5204 {
5205 NET_API_STATUS status;
5206 uint32_t parm_err = 0;
5207 struct SHARE_INFO_2 i2;
5208
5209 if ((argc < 2) || (argc > 3)) {
5210 d_fprintf(stderr, _("Usage: %s <share> <path> [comment]\n"),
5211 ctx->whoami);
5212 return NT_STATUS_INVALID_PARAMETER;
5213 }
5214
5215 i2.shi2_netname = argv[0];
5216 i2.shi2_type = STYPE_DISKTREE;
5217 i2.shi2_remark = (argc == 3) ? argv[2] : "";
5218 i2.shi2_permissions = 0;
5219 i2.shi2_max_uses = 0;
5220 i2.shi2_current_uses = 0;
5221 i2.shi2_path = argv[1];
5222 i2.shi2_passwd = NULL;
5223
5224 status = NetShareAdd(pipe_hnd->desthost,
5225 2,
5226 (uint8_t *)&i2,
5227 &parm_err);
5228
5229 return werror_to_ntstatus(W_ERROR(status));
5230 }
5231
5232 static NTSTATUS rpc_sh_share_delete(struct net_context *c,
5233 TALLOC_CTX *mem_ctx,
5234 struct rpc_sh_ctx *ctx,
5235 struct rpc_pipe_client *pipe_hnd,
5236 int argc, const char **argv)
5237 {
5238 if (argc != 1) {
5239 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5240 return NT_STATUS_INVALID_PARAMETER;
5241 }
5242
5243 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd->desthost, argv[0], 0)));
5244 }
5245
5246 static NTSTATUS rpc_sh_share_info(struct net_context *c,
5247 TALLOC_CTX *mem_ctx,
5248 struct rpc_sh_ctx *ctx,
5249 struct rpc_pipe_client *pipe_hnd,
5250 int argc, const char **argv)
5251 {
5252 union srvsvc_NetShareInfo info;
5253 WERROR result;
5254 NTSTATUS status;
5255 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5256
5257 if (argc != 1) {
5258 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5259 return NT_STATUS_INVALID_PARAMETER;
5260 }
5261
5262 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
5263 pipe_hnd->desthost,
5264 argv[0],
5265 2,
5266 &info,
5267 &result);
5268 if (!NT_STATUS_IS_OK(status)) {
5269 result = ntstatus_to_werror(status);
5270 goto done;
5271 }
5272 if (!W_ERROR_IS_OK(result)) {
5273 goto done;
5274 }
5275
5276 d_printf(_("Name: %s\n"), info.info2->name);
5277 d_printf(_("Comment: %s\n"), info.info2->comment);
5278 d_printf(_("Path: %s\n"), info.info2->path);
5279 d_printf(_("Password: %s\n"), info.info2->password);
5280
5281 done:
5282 return werror_to_ntstatus(result);
5283 }
5284
5285 struct rpc_sh_cmd *net_rpc_share_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
5286 struct rpc_sh_ctx *ctx)
5287 {
5288 static struct rpc_sh_cmd cmds[] = {
5289
5290 { "list", NULL, &ndr_table_srvsvc, rpc_sh_share_list,
5291 N_("List available shares") },
5292
5293 { "add", NULL, &ndr_table_srvsvc, rpc_sh_share_add,
5294 N_("Add a share") },
5295
5296 { "delete", NULL, &ndr_table_srvsvc, rpc_sh_share_delete,
5297 N_("Delete a share") },
5298
5299 { "info", NULL, &ndr_table_srvsvc, rpc_sh_share_info,
5300 N_("Get information about a share") },
5301
5302 { NULL, NULL, 0, NULL, NULL }
5303 };
5304
5305 return cmds;
5306 }
5307
5308 /****************************************************************************/
5309
5310 static int rpc_file_usage(struct net_context *c, int argc, const char **argv)
5311 {
5312 return net_file_usage(c, argc, argv);
5313 }
5314
5315 /**
5316 * Close a file on a remote RPC server.
5317 *
5318 * @param argc Standard main() style argc.
5319 * @param argv Standard main() style argv. Initial components are already
5320 * stripped.
5321 *
5322 * @return A shell status integer (0 for success).
5323 **/
5324 static int rpc_file_close(struct net_context *c, int argc, const char **argv)
5325 {
5326 if (argc < 1 || c->display_usage) {
5327 return rpc_file_usage(c, argc, argv);
5328 }
5329
5330 return NetFileClose(c->opt_host, atoi(argv[0]));
5331 }
5332
5333 /**
5334 * Formatted print of open file info
5335 *
5336 * @param r struct FILE_INFO_3 contents
5337 **/
5338
5339 static void display_file_info_3(struct FILE_INFO_3 *r)
5340 {
5341 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
5342 r->fi3_id, r->fi3_username, r->fi3_permissions,
5343 r->fi3_num_locks, r->fi3_pathname);
5344 }
5345
5346 /**
5347 * List files for a user on a remote RPC server.
5348 *
5349 * @param argc Standard main() style argc.
5350 * @param argv Standard main() style argv. Initial components are already
5351 * stripped.
5352 *
5353 * @return A shell status integer (0 for success)..
5354 **/
5355
5356 static int rpc_file_user(struct net_context *c, int argc, const char **argv)
5357 {
5358 NET_API_STATUS status;
5359 uint32 preferred_len = 0xffffffff, i;
5360 const char *username=NULL;
5361 uint32_t total_entries = 0;
5362 uint32_t entries_read = 0;
5363 uint32_t resume_handle = 0;
5364 struct FILE_INFO_3 *i3 = NULL;
5365
5366 if (c->display_usage) {
5367 return rpc_file_usage(c, argc, argv);
5368 }
5369
5370 /* if argc > 0, must be user command */
5371 if (argc > 0) {
5372 username = smb_xstrdup(argv[0]);
5373 }
5374
5375 status = NetFileEnum(c->opt_host,
5376 NULL,
5377 username,
5378 3,
5379 (uint8_t **)(void *)&i3,
5380 preferred_len,
5381 &entries_read,
5382 &total_entries,
5383 &resume_handle);
5384
5385 if (status != 0) {
5386 goto done;
5387 }
5388
5389 /* Display results */
5390
5391 d_printf(_(
5392 "\nEnumerating open files on remote server:\n\n"
5393 "\nFileId Opened by Perms Locks Path"
5394 "\n------ --------- ----- ----- ---- \n"));
5395 for (i = 0; i < entries_read; i++) {
5396 display_file_info_3(&i3[i]);
5397 }
5398 done:
5399 return status;
5400 }
5401
5402 /**
5403 * 'net rpc file' entrypoint.
5404 * @param argc Standard main() style argc.
5405 * @param argv Standard main() style argv. Initial components are already
5406 * stripped.
5407 **/
5408
5409 int net_rpc_file(struct net_context *c, int argc, const char **argv)
5410 {
5411 NET_API_STATUS status;
5412
5413 struct functable func[] = {
5414 {
5415 "close",
5416 rpc_file_close,
5417 NET_TRANSPORT_RPC,
5418 N_("Close opened file"),
5419 N_("net rpc file close\n"
5420 " Close opened file")
5421 },
5422 {
5423 "user",
5424 rpc_file_user,
5425 NET_TRANSPORT_RPC,
5426 N_("List files opened by user"),
5427 N_("net rpc file user\n"
5428 " List files opened by user")
5429 },
5430 #if 0
5431 {
5432 "info",
5433 rpc_file_info,
5434 NET_TRANSPORT_RPC,
5435 N_("Display information about opened file"),
5436 N_("net rpc file info\n"
5437 " Display information about opened file")
5438 },
5439 #endif
5440 {NULL, NULL, 0, NULL, NULL}
5441 };
5442
5443 status = libnetapi_net_init(&c->netapi_ctx);
5444 if (status != 0) {
5445 return -1;
5446 }
5447 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5448 libnetapi_set_password(c->netapi_ctx, c->opt_password);
5449 if (c->opt_kerberos) {
5450 libnetapi_set_use_kerberos(c->netapi_ctx);
5451 }
5452
5453 if (argc == 0) {
5454 if (c->display_usage) {
5455 d_printf(_("Usage:\n"));
5456 d_printf(_("net rpc file\n"
5457 " List opened files\n"));
5458 net_display_usage_from_functable(func);
5459 return 0;
5460 }
5461
5462 return rpc_file_user(c, argc, argv);
5463 }
5464
5465 return net_run_function(c, argc, argv, "net rpc file", func);
5466 }
5467
5468 /**
5469 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
5470 *
5471 * All parameters are provided by the run_rpc_command function, except for
5472 * argc, argv which are passed through.
5473 *
5474 * @param c A net_context structure.
5475 * @param domain_sid The domain sid acquired from the remote server.
5476 * @param cli A cli_state connected to the server.
5477 * @param mem_ctx Talloc context, destroyed on completion of the function.
5478 * @param argc Standard main() style argc.
5479 * @param argv Standard main() style argv. Initial components are already
5480 * stripped.
5481 *
5482 * @return Normal NTSTATUS return.
5483 **/
5484
5485 static NTSTATUS rpc_shutdown_abort_internals(struct net_context *c,
5486 const struct dom_sid *domain_sid,
5487 const char *domain_name,
5488 struct cli_state *cli,
5489 struct rpc_pipe_client *pipe_hnd,
5490 TALLOC_CTX *mem_ctx,
5491 int argc,
5492 const char **argv)
5493 {
5494 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5495 WERROR result;
5496 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5497
5498 status = dcerpc_initshutdown_Abort(b, mem_ctx, NULL, &result);
5499 if (!NT_STATUS_IS_OK(status)) {
5500 return status;
5501 }
5502 if (W_ERROR_IS_OK(result)) {
5503 d_printf(_("\nShutdown successfully aborted\n"));
5504 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
5505 } else
5506 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
5507
5508 return werror_to_ntstatus(result);
5509 }
5510
5511 /**
5512 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
5513 *
5514 * All parameters are provided by the run_rpc_command function, except for
5515 * argc, argv which are passed through.
5516 *
5517 * @param c A net_context structure.
5518 * @param domain_sid The domain sid acquired from the remote server.
5519 * @param cli A cli_state connected to the server.
5520 * @param mem_ctx Talloc context, destroyed on completion of the function.
5521 * @param argc Standard main() style argc.
5522 * @param argv Standard main() style argv. Initial components are already
5523 * stripped.
5524 *
5525 * @return Normal NTSTATUS return.
5526 **/
5527
5528 static NTSTATUS rpc_reg_shutdown_abort_internals(struct net_context *c,
5529 const struct dom_sid *domain_sid,
5530 const char *domain_name,
5531 struct cli_state *cli,
5532 struct rpc_pipe_client *pipe_hnd,
5533 TALLOC_CTX *mem_ctx,
5534 int argc,
5535 const char **argv)
5536 {
5537 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5538 WERROR werr;
5539 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5540
5541 result = dcerpc_winreg_AbortSystemShutdown(b, mem_ctx, NULL, &werr);
5542
5543 if (!NT_STATUS_IS_OK(result)) {
5544 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5545 return result;
5546 }
5547 if (W_ERROR_IS_OK(werr)) {
5548 d_printf(_("\nShutdown successfully aborted\n"));
5549 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
5550 } else
5551 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5552
5553 return werror_to_ntstatus(werr);
5554 }
5555
5556 /**
5557 * ABORT the shutdown of a remote RPC server.
5558 *
5559 * @param argc Standard main() style argc.
5560 * @param argv Standard main() style argv. Initial components are already
5561 * stripped.
5562 *
5563 * @return A shell status integer (0 for success).
5564 **/
5565
5566 static int rpc_shutdown_abort(struct net_context *c, int argc,
5567 const char **argv)
5568 {
5569 int rc = -1;
5570
5571 if (c->display_usage) {
5572 d_printf( "%s\n"
5573 "net rpc abortshutdown\n"
5574 " %s\n",
5575 _("Usage:"),
5576 _("Abort a scheduled shutdown"));
5577 return 0;
5578 }
5579
5580 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5581 rpc_shutdown_abort_internals, argc, argv);
5582
5583 if (rc == 0)
5584 return rc;
5585
5586 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5587
5588 return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
5589 rpc_reg_shutdown_abort_internals,
5590 argc, argv);
5591 }
5592
5593 /**
5594 * Shut down a remote RPC Server via initshutdown pipe.
5595 *
5596 * All parameters are provided by the run_rpc_command function, except for
5597 * argc, argv which are passed through.
5598 *
5599 * @param c A net_context structure.
5600 * @param domain_sid The domain sid acquired from the remote server.
5601 * @param cli A cli_state connected to the server.
5602 * @param mem_ctx Talloc context, destroyed on completion of the function.
5603 * @param argc Standard main() style argc.
5604 * @param argv Standard main() style argv. Initial components are already
5605 * stripped.
5606 *
5607 * @return Normal NTSTATUS return.
5608 **/
5609
5610 NTSTATUS rpc_init_shutdown_internals(struct net_context *c,
5611 const struct dom_sid *domain_sid,
5612 const char *domain_name,
5613 struct cli_state *cli,
5614 struct rpc_pipe_client *pipe_hnd,
5615 TALLOC_CTX *mem_ctx,
5616 int argc,
5617 const char **argv)
5618 {
5619 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5620 WERROR result;
5621 const char *msg = N_("This machine will be shutdown shortly");
5622 uint32 timeout = 20;
5623 struct lsa_StringLarge msg_string;
5624 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5625
5626 if (c->opt_comment) {
5627 msg = c->opt_comment;
5628 }
5629 if (c->opt_timeout) {
5630 timeout = c->opt_timeout;
5631 }
5632
5633 msg_string.string = msg;
5634
5635 /* create an entry */
5636 status = dcerpc_initshutdown_Init(b, mem_ctx, NULL,
5637 &msg_string, timeout, c->opt_force, c->opt_reboot,
5638 &result);
5639 if (!NT_STATUS_IS_OK(status)) {
5640 return status;
5641 }
5642 if (W_ERROR_IS_OK(result)) {
5643 d_printf(_("\nShutdown of remote machine succeeded\n"));
5644 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5645 } else {
5646 DEBUG(1,("Shutdown of remote machine failed!\n"));
5647 }
5648 return werror_to_ntstatus(result);
5649 }
5650
5651 /**
5652 * Shut down a remote RPC Server via winreg pipe.
5653 *
5654 * All parameters are provided by the run_rpc_command function, except for
5655 * argc, argv which are passed through.
5656 *
5657 * @param c A net_context structure.
5658 * @param domain_sid The domain sid acquired from the remote server.
5659 * @param cli A cli_state connected to the server.
5660 * @param mem_ctx Talloc context, destroyed on completion of the function.
5661 * @param argc Standard main() style argc.
5662 * @param argv Standard main() style argv. Initial components are already
5663 * stripped.
5664 *
5665 * @return Normal NTSTATUS return.
5666 **/
5667
5668 NTSTATUS rpc_reg_shutdown_internals(struct net_context *c,
5669 const struct dom_sid *domain_sid,
5670 const char *domain_name,
5671 struct cli_state *cli,
5672 struct rpc_pipe_client *pipe_hnd,
5673 TALLOC_CTX *mem_ctx,
5674 int argc,
5675 const char **argv)
5676 {
5677 const char *msg = N_("This machine will be shutdown shortly");
5678 uint32 timeout = 20;
5679 struct lsa_StringLarge msg_string;
5680 NTSTATUS result;
5681 WERROR werr;
5682 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5683
5684 if (c->opt_comment) {
5685 msg = c->opt_comment;
5686 }
5687 msg_string.string = msg;
5688
5689 if (c->opt_timeout) {
5690 timeout = c->opt_timeout;
5691 }
5692
5693 /* create an entry */
5694 result = dcerpc_winreg_InitiateSystemShutdown(b, mem_ctx, NULL,
5695 &msg_string, timeout, c->opt_force, c->opt_reboot,
5696 &werr);
5697 if (!NT_STATUS_IS_OK(result)) {
5698 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5699 return result;
5700 }
5701
5702 if (W_ERROR_IS_OK(werr)) {
5703 d_printf(_("\nShutdown of remote machine succeeded\n"));
5704 } else {
5705 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5706 if ( W_ERROR_EQUAL(werr, WERR_MACHINE_LOCKED) )
5707 d_fprintf(stderr, "\nMachine locked, use -f switch to force\n");
5708 else
5709 d_fprintf(stderr, "\nresult was: %s\n", win_errstr(werr));
5710 }
5711
5712 return werror_to_ntstatus(werr);
5713 }
5714
5715 /**
5716 * Shut down a remote RPC server.
5717 *
5718 * @param argc Standard main() style argc.
5719 * @param argv Standard main() style argv. Initial components are already
5720 * stripped.
5721 *
5722 * @return A shell status integer (0 for success).
5723 **/
5724
5725 static int rpc_shutdown(struct net_context *c, int argc, const char **argv)
5726 {
5727 int rc = -1;
5728
5729 if (c->display_usage) {
5730 d_printf( "%s\n"
5731 "net rpc shutdown\n"
5732 " %s\n",
5733 _("Usage:"),
5734 _("Shut down a remote RPC server"));
5735 return 0;
5736 }
5737
5738 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5739 rpc_init_shutdown_internals, argc, argv);
5740
5741 if (rc) {
5742 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5743 rc = run_rpc_command(c, NULL, &ndr_table_winreg, 0,
5744 rpc_reg_shutdown_internals, argc, argv);
5745 }
5746
5747 return rc;
5748 }
5749
5750 /***************************************************************************
5751 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5752 ***************************************************************************/
5753
5754 /**
5755 * Add interdomain trust account to the RPC server.
5756 * All parameters (except for argc and argv) are passed by run_rpc_command
5757 * function.
5758 *
5759 * @param c A net_context structure.
5760 * @param domain_sid The domain sid acquired from the server.
5761 * @param cli A cli_state connected to the server.
5762 * @param mem_ctx Talloc context, destroyed on completion of the function.
5763 * @param argc Standard main() style argc.
5764 * @param argv Standard main() style argv. Initial components are already
5765 * stripped.
5766 *
5767 * @return normal NTSTATUS return code.
5768 */
5769
5770 static NTSTATUS rpc_trustdom_add_internals(struct net_context *c,
5771 const struct dom_sid *domain_sid,
5772 const char *domain_name,
5773 struct cli_state *cli,
5774 struct rpc_pipe_client *pipe_hnd,
5775 TALLOC_CTX *mem_ctx,
5776 int argc,
5777 const char **argv)
5778 {
5779 struct policy_handle connect_pol, domain_pol, user_pol;
5780 NTSTATUS status, result;
5781 char *acct_name;
5782 struct lsa_String lsa_acct_name;
5783 uint32 acb_info;
5784 uint32 acct_flags=0;
5785 uint32 user_rid;
5786 uint32_t access_granted = 0;
5787 union samr_UserInfo info;
5788 unsigned int orig_timeout;
5789 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5790 DATA_BLOB session_key = data_blob_null;
5791
5792 if (argc != 2) {
5793 d_printf("%s\n%s",
5794 _("Usage:"),
5795 _(" net rpc trustdom add <domain_name> "
5796 "<trust password>\n"));
5797 return NT_STATUS_INVALID_PARAMETER;
5798 }
5799
5800 /*
5801 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5802 */
5803
5804 if (asprintf(&acct_name, "%s$", argv[0]) < 0) {
5805 return NT_STATUS_NO_MEMORY;
5806 }
5807
5808 if (!strupper_m(acct_name)) {
5809 SAFE_FREE(acct_name);
5810 return NT_STATUS_INVALID_PARAMETER;
5811 }
5812
5813 init_lsa_String(&lsa_acct_name, acct_name);
5814
5815 status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
5816 if (!NT_STATUS_IS_OK(status)) {
5817 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
5818 nt_errstr(status)));
5819 goto done;
5820 }
5821
5822 /* Get samr policy handle */
5823 status = dcerpc_samr_Connect2(b, mem_ctx,
5824 pipe_hnd->desthost,
5825 MAXIMUM_ALLOWED_ACCESS,
5826 &connect_pol,
5827 &result);
5828 if (!NT_STATUS_IS_OK(status)) {
5829 goto done;
5830 }
5831 if (!NT_STATUS_IS_OK(result)) {
5832 status = result;
5833 goto done;
5834 }
5835
5836 /* Get domain policy handle */
5837 status = dcerpc_samr_OpenDomain(b, mem_ctx,
5838 &connect_pol,
5839 MAXIMUM_ALLOWED_ACCESS,
5840 discard_const_p(struct dom_sid2, domain_sid),
5841 &domain_pol,
5842 &result);
5843 if (!NT_STATUS_IS_OK(status)) {
5844 goto done;
5845 }
5846 if (!NT_STATUS_IS_OK(result)) {
5847 status = result;
5848 goto done;
5849 }
5850
5851 /* This call can take a long time - allow the server to time out.
5852 * 35 seconds should do it. */
5853
5854 orig_timeout = rpccli_set_timeout(pipe_hnd, 35000);
5855
5856 /* Create trusting domain's account */
5857 acb_info = ACB_NORMAL;
5858 acct_flags = SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
5859 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
5860 SAMR_USER_ACCESS_SET_PASSWORD |
5861 SAMR_USER_ACCESS_GET_ATTRIBUTES |
5862 SAMR_USER_ACCESS_SET_ATTRIBUTES;
5863
5864 status = dcerpc_samr_CreateUser2(b, mem_ctx,
5865 &domain_pol,
5866 &lsa_acct_name,
5867 acb_info,
5868 acct_flags,
5869 &user_pol,
5870 &access_granted,
5871 &user_rid,
5872 &result);
5873 if (!NT_STATUS_IS_OK(status)) {
5874 goto done;
5875 }
5876 /* And restore our original timeout. */
5877 rpccli_set_timeout(pipe_hnd, orig_timeout);
5878
5879 if (!NT_STATUS_IS_OK(result)) {
5880 status = result;
5881 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
5882 acct_name, nt_errstr(result));
5883 goto done;
5884 }
5885
5886 {
5887 struct samr_CryptPassword crypt_pwd;
5888
5889 ZERO_STRUCT(info.info23);
5890
5891 init_samr_CryptPassword(argv[1],
5892 &session_key,
5893 &crypt_pwd);
5894
5895 info.info23.info.fields_present = SAMR_FIELD_ACCT_FLAGS |
5896 SAMR_FIELD_NT_PASSWORD_PRESENT;
5897 info.info23.info.acct_flags = ACB_DOMTRUST;
5898 info.info23.password = crypt_pwd;
5899
5900 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
5901 &user_pol,
5902 23,
5903 &info,
5904 &result);
5905 if (!NT_STATUS_IS_OK(status)) {
5906 goto done;
5907 }
5908
5909 if (!NT_STATUS_IS_OK(result)) {
5910 status = result;
5911 DEBUG(0,("Could not set trust account password: %s\n",
5912 nt_errstr(result)));
5913 goto done;
5914 }
5915 }
5916
5917 done:
5918 SAFE_FREE(acct_name);
5919 data_blob_clear_free(&session_key);
5920 return status;
5921 }
5922
5923 /**
5924 * Create interdomain trust account for a remote domain.
5925 *
5926 * @param argc Standard argc.
5927 * @param argv Standard argv without initial components.
5928 *
5929 * @return Integer status (0 means success).
5930 **/
5931
5932 static int rpc_trustdom_add(struct net_context *c, int argc, const char **argv)
5933 {
5934 if (argc > 0 && !c->display_usage) {
5935 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
5936 rpc_trustdom_add_internals, argc, argv);
5937 } else {
5938 d_printf("%s\n%s",
5939 _("Usage:"),
5940 _("net rpc trustdom add <domain_name> <trust "
5941 "password>\n"));
5942 return -1;
5943 }
5944 }
5945
5946
5947 /**
5948 * Remove interdomain trust account from the RPC server.
5949 * All parameters (except for argc and argv) are passed by run_rpc_command
5950 * function.
5951 *
5952 * @param c A net_context structure.
5953 * @param domain_sid The domain sid acquired from the server.
5954 * @param cli A cli_state connected to the server.
5955 * @param mem_ctx Talloc context, destroyed on completion of the function.
5956 * @param argc Standard main() style argc.
5957 * @param argv Standard main() style argv. Initial components are already
5958 * stripped.
5959 *
5960 * @return normal NTSTATUS return code.
5961 */
5962
5963 static NTSTATUS rpc_trustdom_del_internals(struct net_context *c,
5964 const struct dom_sid *domain_sid,
5965 const char *domain_name,
5966 struct cli_state *cli,
5967 struct rpc_pipe_client *pipe_hnd,
5968 TALLOC_CTX *mem_ctx,
5969 int argc,
5970 const char **argv)
5971 {
5972 struct policy_handle connect_pol, domain_pol, user_pol;
5973 NTSTATUS status, result;
5974 char *acct_name;
5975 struct dom_sid trust_acct_sid;
5976 struct samr_Ids user_rids, name_types;
5977 struct lsa_String lsa_acct_name;
5978 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5979
5980 if (argc != 1) {
5981 d_printf("%s\n%s",
5982 _("Usage:"),
5983 _(" net rpc trustdom del <domain_name>\n"));
5984 return NT_STATUS_INVALID_PARAMETER;
5985 }
5986
5987 /*
5988 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5989 */
5990 acct_name = talloc_asprintf(mem_ctx, "%s$", argv[0]);
5991
5992 if (acct_name == NULL)
5993 return NT_STATUS_NO_MEMORY;
5994
5995 if (!strupper_m(acct_name)) {
5996 TALLOC_FREE(acct_name);
5997 return NT_STATUS_INVALID_PARAMETER;
5998 }
5999
6000 /* Get samr policy handle */
6001 status = dcerpc_samr_Connect2(b, mem_ctx,
6002 pipe_hnd->desthost,
6003 MAXIMUM_ALLOWED_ACCESS,
6004 &connect_pol,
6005 &result);
6006 if (!NT_STATUS_IS_OK(status)) {
6007 goto done;
6008 }
6009 if (!NT_STATUS_IS_OK(result)) {
6010 status = result;
6011 goto done;
6012 }
6013
6014 /* Get domain policy handle */
6015 status = dcerpc_samr_OpenDomain(b, mem_ctx,
6016 &connect_pol,
6017 MAXIMUM_ALLOWED_ACCESS,
6018 discard_const_p(struct dom_sid2, domain_sid),
6019 &domain_pol,
6020 &result);
6021 if (!NT_STATUS_IS_OK(status)) {
6022 goto done;
6023 }
6024 if (!NT_STATUS_IS_OK(result)) {
6025 status = result;
6026 goto done;
6027 }
6028
6029 init_lsa_String(&lsa_acct_name, acct_name);
6030
6031 status = dcerpc_samr_LookupNames(b, mem_ctx,
6032 &domain_pol,
6033 1,
6034 &lsa_acct_name,
6035 &user_rids,
6036 &name_types,
6037 &result);
6038 if (!NT_STATUS_IS_OK(status)) {
6039 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6040 "failed %s\n"),
6041 acct_name, nt_errstr(status));
6042 goto done;
6043 }
6044 if (!NT_STATUS_IS_OK(result)) {
6045 status = result;
6046 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6047 "failed %s\n"),
6048 acct_name, nt_errstr(result) );
6049 goto done;
6050 }
6051
6052 status = dcerpc_samr_OpenUser(b, mem_ctx,
6053 &domain_pol,
6054 MAXIMUM_ALLOWED_ACCESS,
6055 user_rids.ids[0],
6056 &user_pol,
6057 &result);
6058 if (!NT_STATUS_IS_OK(status)) {
6059 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6060 "%s\n"),
6061 acct_name, nt_errstr(status) );
6062 goto done;
6063 }
6064
6065 if (!NT_STATUS_IS_OK(result)) {
6066 status = result;
6067 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6068 "%s\n"),
6069 acct_name, nt_errstr(result) );
6070 goto done;
6071 }
6072
6073 /* append the rid to the domain sid */
6074 if (!sid_compose(&trust_acct_sid, domain_sid, user_rids.ids[0])) {
6075 goto done;
6076 }
6077
6078 /* remove the sid */
6079
6080 status = dcerpc_samr_RemoveMemberFromForeignDomain(b, mem_ctx,
6081 &user_pol,
6082 &trust_acct_sid,
6083 &result);
6084 if (!NT_STATUS_IS_OK(status)) {
6085 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6086 " on user %s failed %s\n"),
6087 acct_name, nt_errstr(status));
6088 goto done;
6089 }
6090 if (!NT_STATUS_IS_OK(result)) {
6091 status = result;
6092 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6093 " on user %s failed %s\n"),
6094 acct_name, nt_errstr(result) );
6095 goto done;
6096 }
6097
6098
6099 /* Delete user */
6100
6101 status = dcerpc_samr_DeleteUser(b, mem_ctx,
6102 &user_pol,
6103 &result);
6104 if (!NT_STATUS_IS_OK(status)) {
6105 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6106 "%s\n"),
6107 acct_name, nt_errstr(status));
6108 goto done;
6109 }
6110
6111 if (!NT_STATUS_IS_OK(result)) {
6112 result = status;
6113 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6114 "%s\n"),
6115 acct_name, nt_errstr(result) );
6116 goto done;
6117 }
6118
6119 if (!NT_STATUS_IS_OK(result)) {
6120 d_printf(_("Could not set trust account password: %s\n"),
6121 nt_errstr(result));
6122 goto done;
6123 }
6124
6125 done:
6126 return status;
6127 }
6128
6129 /**
6130 * Delete interdomain trust account for a remote domain.
6131 *
6132 * @param argc Standard argc.
6133 * @param argv Standard argv without initial components.
6134 *
6135 * @return Integer status (0 means success).
6136 **/
6137
6138 static int rpc_trustdom_del(struct net_context *c, int argc, const char **argv)
6139 {
6140 if (argc > 0 && !c->display_usage) {
6141 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
6142 rpc_trustdom_del_internals, argc, argv);
6143 } else {
6144 d_printf("%s\n%s",
6145 _("Usage:"),
6146 _("net rpc trustdom del <domain>\n"));
6147 return -1;
6148 }
6149 }
6150
6151 static NTSTATUS rpc_trustdom_get_pdc(struct net_context *c,
6152 struct cli_state *cli,
6153 TALLOC_CTX *mem_ctx,
6154 const char *domain_name)
6155 {
6156 char *dc_name = NULL;
6157 const char *buffer = NULL;
6158 struct rpc_pipe_client *netr;
6159 NTSTATUS status;
6160 WERROR result;
6161 struct dcerpc_binding_handle *b;
6162
6163 /* Use NetServerEnum2 */
6164
6165 if (cli_get_pdc_name(cli, domain_name, &dc_name)) {
6166 SAFE_FREE(dc_name);
6167 return NT_STATUS_OK;
6168 }
6169
6170 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
6171 for domain %s\n", domain_name));
6172
6173 /* Try netr_GetDcName */
6174
6175 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
6176 &netr);
6177 if (!NT_STATUS_IS_OK(status)) {
6178 return status;
6179 }
6180
6181 b = netr->binding_handle;
6182
6183 status = dcerpc_netr_GetDcName(b, mem_ctx,
6184 netr->desthost,
6185 domain_name,
6186 &buffer,
6187 &result);
6188 TALLOC_FREE(netr);
6189
6190 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(result)) {
6191 return status;
6192 }
6193
6194 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
6195 for domain %s\n", domain_name));
6196
6197 if (!NT_STATUS_IS_OK(status)) {
6198 return status;
6199 }
6200
6201 return werror_to_ntstatus(result);
6202 }
6203
6204 /**
6205 * Establish trust relationship to a trusting domain.
6206 * Interdomain account must already be created on remote PDC.
6207 *
6208 * @param c A net_context structure.
6209 * @param argc Standard argc.
6210 * @param argv Standard argv without initial components.
6211 *
6212 * @return Integer status (0 means success).
6213 **/
6214
6215 static int rpc_trustdom_establish(struct net_context *c, int argc,
6216 const char **argv)
6217 {
6218 struct cli_state *cli = NULL;
6219 struct sockaddr_storage server_ss;
6220 struct rpc_pipe_client *pipe_hnd = NULL;
6221 struct policy_handle connect_hnd;
6222 TALLOC_CTX *mem_ctx;
6223 NTSTATUS nt_status, result;
6224 struct dom_sid *domain_sid;
6225
6226 char* domain_name;
6227 char* acct_name;
6228 fstring pdc_name;
6229 union lsa_PolicyInformation *info = NULL;
6230 struct dcerpc_binding_handle *b;
6231
6232 /*
6233 * Connect to \\server\ipc$ as 'our domain' account with password
6234 */
6235
6236 if (argc != 1 || c->display_usage) {
6237 d_printf("%s\n%s",
6238 _("Usage:"),
6239 _("net rpc trustdom establish <domain_name>\n"));
6240 return -1;
6241 }
6242
6243 domain_name = smb_xstrdup(argv[0]);
6244 if (!strupper_m(domain_name)) {
6245 SAFE_FREE(domain_name);
6246 return -1;
6247 }
6248
6249 /* account name used at first is our domain's name with '$' */
6250 if (asprintf(&acct_name, "%s$", lp_workgroup()) == -1) {
6251 return -1;
6252 }
6253 if (!strupper_m(acct_name)) {
6254 SAFE_FREE(domain_name);
6255 SAFE_FREE(acct_name);
6256 return -1;
6257 }
6258
6259 /*
6260 * opt_workgroup will be used by connection functions further,
6261 * hence it should be set to remote domain name instead of ours
6262 */
6263 if (c->opt_workgroup) {
6264 c->opt_workgroup = smb_xstrdup(domain_name);
6265 };
6266
6267 c->opt_user_name = acct_name;
6268
6269 /* find the domain controller */
6270 if (!net_find_pdc(&server_ss, pdc_name, domain_name)) {
6271 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name));
6272 return -1;
6273 }
6274
6275 /* connect to ipc$ as username/password */
6276 nt_status = connect_to_ipc(c, &cli, &server_ss, pdc_name);
6277 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
6278
6279 /* Is it trusting domain account for sure ? */
6280 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
6281 nt_errstr(nt_status)));
6282 return -1;
6283 }
6284
6285 /* store who we connected to */
6286
6287 saf_store( domain_name, pdc_name );
6288
6289 /*
6290 * Connect to \\server\ipc$ again (this time anonymously)
6291 */
6292
6293 nt_status = connect_to_ipc_anonymous(c, &cli, &server_ss,
6294 (char*)pdc_name);
6295
6296 if (NT_STATUS_IS_ERR(nt_status)) {
6297 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
6298 domain_name, nt_errstr(nt_status)));
6299 return -1;
6300 }
6301
6302 if (!(mem_ctx = talloc_init("establishing trust relationship to "
6303 "domain %s", domain_name))) {
6304 DEBUG(0, ("talloc_init() failed\n"));
6305 cli_shutdown(cli);
6306 return -1;
6307 }
6308
6309 /* Make sure we're talking to a proper server */
6310
6311 nt_status = rpc_trustdom_get_pdc(c, cli, mem_ctx, domain_name);
6312 if (!NT_STATUS_IS_OK(nt_status)) {
6313 cli_shutdown(cli);
6314 talloc_destroy(mem_ctx);
6315 return -1;
6316 }
6317
6318 /*
6319 * Call LsaOpenPolicy and LsaQueryInfo
6320 */
6321
6322 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6323 &pipe_hnd);
6324 if (!NT_STATUS_IS_OK(nt_status)) {
6325 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status) ));
6326 cli_shutdown(cli);
6327 talloc_destroy(mem_ctx);
6328 return -1;
6329 }
6330
6331 b = pipe_hnd->binding_handle;
6332
6333 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true, KEY_QUERY_VALUE,
6334 &connect_hnd);
6335 if (NT_STATUS_IS_ERR(nt_status)) {
6336 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6337 nt_errstr(nt_status)));
6338 cli_shutdown(cli);
6339 talloc_destroy(mem_ctx);
6340 return -1;
6341 }
6342
6343 /* Querying info level 5 */
6344
6345 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6346 &connect_hnd,
6347 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6348 &info,
6349 &result);
6350 if (NT_STATUS_IS_ERR(nt_status)) {
6351 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6352 nt_errstr(nt_status)));
6353 cli_shutdown(cli);
6354 talloc_destroy(mem_ctx);
6355 return -1;
6356 }
6357 if (NT_STATUS_IS_ERR(result)) {
6358 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6359 nt_errstr(result)));
6360 cli_shutdown(cli);
6361 talloc_destroy(mem_ctx);
6362 return -1;
6363 }
6364
6365 domain_sid = info->account_domain.sid;
6366
6367 /* There should be actually query info level 3 (following nt serv behaviour),
6368 but I still don't know if it's _really_ necessary */
6369
6370 /*
6371 * Store the password in secrets db
6372 */
6373
6374 if (!pdb_set_trusteddom_pw(domain_name, c->opt_password, domain_sid)) {
6375 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6376 cli_shutdown(cli);
6377 talloc_destroy(mem_ctx);
6378 return -1;
6379 }
6380
6381 /*
6382 * Close the pipes and clean up
6383 */
6384
6385 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6386 if (NT_STATUS_IS_ERR(nt_status)) {
6387 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
6388 nt_errstr(nt_status)));
6389 cli_shutdown(cli);
6390 talloc_destroy(mem_ctx);
6391 return -1;
6392 }
6393
6394 cli_shutdown(cli);
6395
6396 talloc_destroy(mem_ctx);
6397
6398 d_printf(_("Trust to domain %s established\n"), domain_name);
6399 return 0;
6400 }
6401
6402 /**
6403 * Revoke trust relationship to the remote domain.
6404 *
6405 * @param c A net_context structure.
6406 * @param argc Standard argc.
6407 * @param argv Standard argv without initial components.
6408 *
6409 * @return Integer status (0 means success).
6410 **/
6411
6412 static int rpc_trustdom_revoke(struct net_context *c, int argc,
6413 const char **argv)
6414 {
6415 char* domain_name;
6416 int rc = -1;
6417
6418 if (argc < 1 || c->display_usage) {
6419 d_printf("%s\n%s",
6420 _("Usage:"),
6421 _("net rpc trustdom revoke <domain_name>\n"
6422 " Revoke trust relationship\n"
6423 " domain_name\tName of domain to revoke trust\n"));
6424 return -1;
6425 }
6426
6427 /* generate upper cased domain name */
6428 domain_name = smb_xstrdup(argv[0]);
6429 if (!strupper_m(domain_name)) {
6430 SAFE_FREE(domain_name);
6431 return -1;
6432 }
6433
6434 /* delete password of the trust */
6435 if (!pdb_del_trusteddom_pw(domain_name)) {
6436 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
6437 domain_name));
6438 goto done;
6439 };
6440
6441 rc = 0;
6442 done:
6443 SAFE_FREE(domain_name);
6444 return rc;
6445 }
6446
6447 static NTSTATUS rpc_query_domain_sid(struct net_context *c,
6448 const struct dom_sid *domain_sid,
6449 const char *domain_name,
6450 struct cli_state *cli,
6451 struct rpc_pipe_client *pipe_hnd,
6452 TALLOC_CTX *mem_ctx,
6453 int argc,
6454 const char **argv)
6455 {
6456 fstring str_sid;
6457 if (!sid_to_fstring(str_sid, domain_sid)) {
6458 return NT_STATUS_UNSUCCESSFUL;
6459 }
6460 d_printf("%s\n", str_sid);
6461 return NT_STATUS_OK;
6462 }
6463
6464 static void print_trusted_domain(struct dom_sid *dom_sid, const char *trusted_dom_name)
6465 {
6466 fstring ascii_sid;
6467
6468 /* convert sid into ascii string */
6469 sid_to_fstring(ascii_sid, dom_sid);
6470
6471 d_printf("%-20s%s\n", trusted_dom_name, ascii_sid);
6472 }
6473
6474 static NTSTATUS vampire_trusted_domain(struct rpc_pipe_client *pipe_hnd,
6475 TALLOC_CTX *mem_ctx,
6476 struct policy_handle *pol,
6477 struct dom_sid dom_sid,
6478 const char *trusted_dom_name)
6479 {
6480 NTSTATUS nt_status, result;
6481 union lsa_TrustedDomainInfo *info = NULL;
6482 char *cleartextpwd = NULL;
6483 DATA_BLOB session_key;
6484 DATA_BLOB data = data_blob_null;
6485 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
6486
6487 nt_status = dcerpc_lsa_QueryTrustedDomainInfoBySid(b, mem_ctx,
6488 pol,
6489 &dom_sid,
6490 LSA_TRUSTED_DOMAIN_INFO_PASSWORD,
6491 &info,
6492 &result);
6493 if (NT_STATUS_IS_ERR(nt_status)) {
6494 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6495 nt_errstr(nt_status)));
6496 goto done;
6497 }
6498 if (NT_STATUS_IS_ERR(result)) {
6499 nt_status = result;
6500 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6501 nt_errstr(result)));
6502 goto done;
6503 }
6504
6505 data = data_blob(info->password.password->data,
6506 info->password.password->length);
6507
6508 nt_status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
6509 if (!NT_STATUS_IS_OK(nt_status)) {
6510 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(nt_status)));
6511 goto done;
6512 }
6513
6514 cleartextpwd = sess_decrypt_string(mem_ctx, &data, &session_key);
6515 data_blob_free(&session_key);
6516
6517 if (cleartextpwd == NULL) {
6518 DEBUG(0,("retrieved NULL password\n"));
6519 nt_status = NT_STATUS_UNSUCCESSFUL;
6520 goto done;
6521 }
6522
6523 if (!pdb_set_trusteddom_pw(trusted_dom_name, cleartextpwd, &dom_sid)) {
6524 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6525 nt_status = NT_STATUS_UNSUCCESSFUL;
6526 goto done;
6527 }
6528
6529 #ifdef DEBUG_PASSWORD
6530 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
6531 "password: [%s]\n", trusted_dom_name,
6532 sid_string_dbg(&dom_sid), cleartextpwd));
6533 #endif
6534
6535 done:
6536 SAFE_FREE(cleartextpwd);
6537 data_blob_free(&data);
6538
6539 return nt_status;
6540 }
6541
6542 static int rpc_trustdom_vampire(struct net_context *c, int argc,
6543 const char **argv)
6544 {
6545 /* common variables */
6546 TALLOC_CTX* mem_ctx;
6547 struct cli_state *cli = NULL;
6548 struct rpc_pipe_client *pipe_hnd = NULL;
6549 NTSTATUS nt_status, result;
6550 const char *domain_name = NULL;
6551 struct policy_handle connect_hnd;
6552 union lsa_PolicyInformation *info = NULL;
6553
6554 /* trusted domains listing variables */
6555 unsigned int enum_ctx = 0;
6556 int i;
6557 struct lsa_DomainList dom_list;
6558 fstring pdc_name;
6559 struct dcerpc_binding_handle *b;
6560
6561 if (c->display_usage) {
6562 d_printf( "%s\n"
6563 "net rpc trustdom vampire\n"
6564 " %s\n",
6565 _("Usage:"),
6566 _("Vampire trust relationship from remote server"));
6567 return 0;
6568 }
6569
6570 /*
6571 * Listing trusted domains (stored in secrets.tdb, if local)
6572 */
6573
6574 mem_ctx = talloc_init("trust relationships vampire");
6575
6576 /*
6577 * set domain and pdc name to local samba server (default)
6578 * or to remote one given in command line
6579 */
6580
6581 if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
6582 domain_name = c->opt_workgroup;
6583 c->opt_target_workgroup = c->opt_workgroup;
6584 } else {
6585 fstrcpy(pdc_name, lp_netbios_name());
6586 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6587 c->opt_target_workgroup = domain_name;
6588 };
6589
6590 /* open \PIPE\lsarpc and open policy handle */
6591 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6592 if (!NT_STATUS_IS_OK(nt_status)) {
6593 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6594 nt_errstr(nt_status)));
6595 talloc_destroy(mem_ctx);
6596 return -1;
6597 };
6598
6599 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6600 &pipe_hnd);
6601 if (!NT_STATUS_IS_OK(nt_status)) {
6602 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6603 nt_errstr(nt_status) ));
6604 cli_shutdown(cli);
6605 talloc_destroy(mem_ctx);
6606 return -1;
6607 };
6608
6609 b = pipe_hnd->binding_handle;
6610
6611 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6612 &connect_hnd);
6613 if (NT_STATUS_IS_ERR(nt_status)) {
6614 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6615 nt_errstr(nt_status)));
6616 cli_shutdown(cli);
6617 talloc_destroy(mem_ctx);
6618 return -1;
6619 };
6620
6621 /* query info level 5 to obtain sid of a domain being queried */
6622 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6623 &connect_hnd,
6624 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6625 &info,
6626 &result);
6627
6628 if (NT_STATUS_IS_ERR(nt_status)) {
6629 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6630 nt_errstr(nt_status)));
6631 cli_shutdown(cli);
6632 talloc_destroy(mem_ctx);
6633 return -1;
6634 }
6635 if (NT_STATUS_IS_ERR(result)) {
6636 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6637 nt_errstr(result)));
6638 cli_shutdown(cli);
6639 talloc_destroy(mem_ctx);
6640 return -1;
6641 }
6642
6643 /*
6644 * Keep calling LsaEnumTrustdom over opened pipe until
6645 * the end of enumeration is reached
6646 */
6647
6648 d_printf(_("Vampire trusted domains:\n\n"));
6649
6650 do {
6651 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
6652 &connect_hnd,
6653 &enum_ctx,
6654 &dom_list,
6655 (uint32_t)-1,
6656 &result);
6657 if (NT_STATUS_IS_ERR(nt_status)) {
6658 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6659 nt_errstr(nt_status)));
6660 cli_shutdown(cli);
6661 talloc_destroy(mem_ctx);
6662 return -1;
6663 };
6664 if (NT_STATUS_IS_ERR(result)) {
6665 nt_status = result;
6666 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6667 nt_errstr(result)));
6668 cli_shutdown(cli);
6669 talloc_destroy(mem_ctx);
6670 return -1;
6671 };
6672
6673
6674 for (i = 0; i < dom_list.count; i++) {
6675
6676 print_trusted_domain(dom_list.domains[i].sid,
6677 dom_list.domains[i].name.string);
6678
6679 nt_status = vampire_trusted_domain(pipe_hnd, mem_ctx, &connect_hnd,
6680 *dom_list.domains[i].sid,
6681 dom_list.domains[i].name.string);
6682 if (!NT_STATUS_IS_OK(nt_status)) {
6683 cli_shutdown(cli);
6684 talloc_destroy(mem_ctx);
6685 return -1;
6686 }
6687 };
6688
6689 /*
6690 * in case of no trusted domains say something rather
6691 * than just display blank line
6692 */
6693 if (!dom_list.count) d_printf(_("none\n"));
6694
6695 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6696
6697 /* close this connection before doing next one */
6698 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6699 if (NT_STATUS_IS_ERR(nt_status)) {
6700 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6701 nt_errstr(nt_status)));
6702 cli_shutdown(cli);
6703 talloc_destroy(mem_ctx);
6704 return -1;
6705 };
6706
6707 /* close lsarpc pipe and connection to IPC$ */
6708 cli_shutdown(cli);
6709
6710 talloc_destroy(mem_ctx);
6711 return 0;
6712 }
6713
6714 static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
6715 {
6716 /* common variables */
6717 TALLOC_CTX* mem_ctx;
6718 struct cli_state *cli = NULL, *remote_cli = NULL;
6719 struct rpc_pipe_client *pipe_hnd = NULL;
6720 NTSTATUS nt_status, result;
6721 const char *domain_name = NULL;
6722 struct dom_sid *queried_dom_sid;
6723 int ascii_dom_name_len;
6724 struct policy_handle connect_hnd;
6725 union lsa_PolicyInformation *info = NULL;
6726 struct dcerpc_binding_handle *b = NULL;
6727
6728 /* trusted domains listing variables */
6729 unsigned int num_domains, enum_ctx = 0;
6730 int i;
6731 struct lsa_DomainList dom_list;
6732 fstring pdc_name;
6733 bool found_domain;
6734
6735 /* trusting domains listing variables */
6736 struct policy_handle domain_hnd;
6737 struct samr_SamArray *trusts = NULL;
6738
6739 if (c->display_usage) {
6740 d_printf( "%s\n"
6741 "net rpc trustdom list\n"
6742 " %s\n",
6743 _("Usage:"),
6744 _("List incoming and outgoing trust relationships"));
6745 return 0;
6746 }
6747
6748 /*
6749 * Listing trusted domains (stored in secrets.tdb, if local)
6750 */
6751
6752 mem_ctx = talloc_init("trust relationships listing");
6753
6754 /*
6755 * set domain and pdc name to local samba server (default)
6756 * or to remote one given in command line
6757 */
6758
6759 if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
6760 domain_name = c->opt_workgroup;
6761 c->opt_target_workgroup = c->opt_workgroup;
6762 } else {
6763 fstrcpy(pdc_name, lp_netbios_name());
6764 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6765 c->opt_target_workgroup = domain_name;
6766 };
6767
6768 /* open \PIPE\lsarpc and open policy handle */
6769 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6770 if (!NT_STATUS_IS_OK(nt_status)) {
6771 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6772 nt_errstr(nt_status)));
6773 talloc_destroy(mem_ctx);
6774 return -1;
6775 };
6776
6777 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6778 &pipe_hnd);
6779 if (!NT_STATUS_IS_OK(nt_status)) {
6780 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6781 nt_errstr(nt_status) ));
6782 cli_shutdown(cli);
6783 talloc_destroy(mem_ctx);
6784 return -1;
6785 };
6786
6787 b = pipe_hnd->binding_handle;
6788
6789 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6790 &connect_hnd);
6791 if (NT_STATUS_IS_ERR(nt_status)) {
6792 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6793 nt_errstr(nt_status)));
6794 cli_shutdown(cli);
6795 talloc_destroy(mem_ctx);
6796 return -1;
6797 };
6798
6799 /* query info level 5 to obtain sid of a domain being queried */
6800 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6801 &connect_hnd,
6802 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6803 &info,
6804 &result);
6805
6806 if (NT_STATUS_IS_ERR(nt_status)) {
6807 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6808 nt_errstr(nt_status)));
6809 cli_shutdown(cli);
6810 talloc_destroy(mem_ctx);
6811 return -1;
6812 }
6813 if (NT_STATUS_IS_ERR(result)) {
6814 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6815 nt_errstr(result)));
6816 cli_shutdown(cli);
6817 talloc_destroy(mem_ctx);
6818 return -1;
6819 }
6820
6821 queried_dom_sid = info->account_domain.sid;
6822
6823 /*
6824 * Keep calling LsaEnumTrustdom over opened pipe until
6825 * the end of enumeration is reached
6826 */
6827
6828 d_printf(_("Trusted domains list:\n\n"));
6829
6830 found_domain = false;
6831
6832 do {
6833 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
6834 &connect_hnd,
6835 &enum_ctx,
6836 &dom_list,
6837 (uint32_t)-1,
6838 &result);
6839 if (NT_STATUS_IS_ERR(nt_status)) {
6840 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6841 nt_errstr(nt_status)));
6842 cli_shutdown(cli);
6843 talloc_destroy(mem_ctx);
6844 return -1;
6845 };
6846 if (NT_STATUS_IS_ERR(result)) {
6847 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6848 nt_errstr(result)));
6849 cli_shutdown(cli);
6850 talloc_destroy(mem_ctx);
6851 return -1;
6852 };
6853
6854
6855 for (i = 0; i < dom_list.count; i++) {
6856 print_trusted_domain(dom_list.domains[i].sid,
6857 dom_list.domains[i].name.string);
6858 found_domain = true;
6859 };
6860
6861
6862 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6863
6864 /*
6865 * in case of no trusted domains say something rather
6866 * than just display blank line
6867 */
6868 if (!found_domain) {
6869 d_printf(_("none\n"));
6870 }
6871
6872 /* close this connection before doing next one */
6873 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6874 if (NT_STATUS_IS_ERR(nt_status)) {
6875 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6876 nt_errstr(nt_status)));
6877 cli_shutdown(cli);
6878 talloc_destroy(mem_ctx);
6879 return -1;
6880 };
6881
6882 TALLOC_FREE(pipe_hnd);
6883
6884 /*
6885 * Listing trusting domains (stored in passdb backend, if local)
6886 */
6887
6888 d_printf(_("\nTrusting domains list:\n\n"));
6889
6890 /*
6891 * Open \PIPE\samr and get needed policy handles
6892 */
6893 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
6894 &pipe_hnd);
6895 if (!NT_STATUS_IS_OK(nt_status)) {
6896 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status)));
6897 cli_shutdown(cli);
6898 talloc_destroy(mem_ctx);
6899 return -1;
6900 };
6901
6902 b = pipe_hnd->binding_handle;
6903
6904 /* SamrConnect2 */
6905 nt_status = dcerpc_samr_Connect2(b, mem_ctx,
6906 pipe_hnd->desthost,
6907 SAMR_ACCESS_LOOKUP_DOMAIN,
6908 &connect_hnd,
6909 &result);
6910 if (!NT_STATUS_IS_OK(nt_status)) {
6911 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6912 nt_errstr(nt_status)));
6913 cli_shutdown(cli);
6914 talloc_destroy(mem_ctx);
6915 return -1;
6916 };
6917 if (!NT_STATUS_IS_OK(result)) {
6918 nt_status = result;
6919 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6920 nt_errstr(result)));
6921 cli_shutdown(cli);
6922 talloc_destroy(mem_ctx);
6923 return -1;
6924 };
6925
6926 /* SamrOpenDomain - we have to open domain policy handle in order to be
6927 able to enumerate accounts*/
6928 nt_status = dcerpc_samr_OpenDomain(b, mem_ctx,
6929 &connect_hnd,
6930 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
6931 queried_dom_sid,
6932 &domain_hnd,
6933 &result);
6934 if (!NT_STATUS_IS_OK(nt_status)) {
6935 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6936 nt_errstr(nt_status)));
6937 cli_shutdown(cli);
6938 talloc_destroy(mem_ctx);
6939 return -1;
6940 };
6941 if (!NT_STATUS_IS_OK(result)) {
6942 nt_status = result;
6943 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6944 nt_errstr(result)));
6945 cli_shutdown(cli);
6946 talloc_destroy(mem_ctx);
6947 return -1;
6948 };
6949
6950 /*
6951 * perform actual enumeration
6952 */
6953
6954 found_domain = false;
6955
6956 enum_ctx = 0; /* reset enumeration context from last enumeration */
6957 do {
6958
6959 nt_status = dcerpc_samr_EnumDomainUsers(b, mem_ctx,
6960 &domain_hnd,
6961 &enum_ctx,
6962 ACB_DOMTRUST,
6963 &trusts,
6964 0xffff,
6965 &num_domains,
6966 &result);
6967 if (NT_STATUS_IS_ERR(nt_status)) {
6968 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6969 nt_errstr(nt_status)));
6970 cli_shutdown(cli);
6971 talloc_destroy(mem_ctx);
6972 return -1;
6973 };
6974 if (NT_STATUS_IS_ERR(result)) {
6975 nt_status = result;
6976 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6977 nt_errstr(result)));
6978 cli_shutdown(cli);
6979 talloc_destroy(mem_ctx);
6980 return -1;
6981 };
6982
6983 for (i = 0; i < num_domains; i++) {
6984
6985 char *str = discard_const_p(char, trusts->entries[i].name.string);
6986
6987 found_domain = true;
6988
6989 /*
6990 * get each single domain's sid (do we _really_ need this ?):
6991 * 1) connect to domain's pdc
6992 * 2) query the pdc for domain's sid
6993 */
6994
6995 /* get rid of '$' tail */
6996 ascii_dom_name_len = strlen(str);
6997 if (ascii_dom_name_len && ascii_dom_name_len < FSTRING_LEN)
6998 str[ascii_dom_name_len - 1] = '\0';
6999
7000 /* set opt_* variables to remote domain */
7001 if (!strupper_m(str)) {
7002 cli_shutdown(cli);
7003 talloc_destroy(mem_ctx);
7004 return -1;
7005 }
7006 c->opt_workgroup = talloc_strdup(mem_ctx, str);
7007 c->opt_target_workgroup = c->opt_workgroup;
7008
7009 d_printf("%-20s", str);
7010
7011 /* connect to remote domain controller */
7012 nt_status = net_make_ipc_connection(c,
7013 NET_FLAGS_PDC | NET_FLAGS_ANONYMOUS,
7014 &remote_cli);
7015 if (NT_STATUS_IS_OK(nt_status)) {
7016 /* query for domain's sid */
7017 if (run_rpc_command(
7018 c, remote_cli,
7019 &ndr_table_lsarpc, 0,
7020 rpc_query_domain_sid, argc,
7021 argv))
7022 d_printf(_("strange - couldn't get domain's sid\n"));
7023
7024 cli_shutdown(remote_cli);
7025
7026 } else {
7027 d_fprintf(stderr, _("domain controller is not "
7028 "responding: %s\n"),
7029 nt_errstr(nt_status));
7030 d_printf(_("couldn't get domain's sid\n"));
7031 }
7032 }
7033
7034 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
7035
7036 if (!found_domain) {
7037 d_printf("none\n");
7038 }
7039
7040 /* close opened samr and domain policy handles */
7041 nt_status = dcerpc_samr_Close(b, mem_ctx, &domain_hnd, &result);
7042 if (!NT_STATUS_IS_OK(nt_status)) {
7043 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name));
7044 };
7045
7046 nt_status = dcerpc_samr_Close(b, mem_ctx, &connect_hnd, &result);
7047 if (!NT_STATUS_IS_OK(nt_status)) {
7048 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name));
7049 };
7050
7051 /* close samr pipe and connection to IPC$ */
7052 cli_shutdown(cli);
7053
7054 talloc_destroy(mem_ctx);
7055 return 0;
7056 }
7057
7058 /**
7059 * Entrypoint for 'net rpc trustdom' code.
7060 *
7061 * @param argc Standard argc.
7062 * @param argv Standard argv without initial components.
7063 *
7064 * @return Integer status (0 means success).
7065 */
7066
7067 static int rpc_trustdom(struct net_context *c, int argc, const char **argv)
7068 {
7069 struct functable func[] = {
7070 {
7071 "add",
7072 rpc_trustdom_add,
7073 NET_TRANSPORT_RPC,
7074 N_("Add trusting domain's account"),
7075 N_("net rpc trustdom add\n"
7076 " Add trusting domain's account")
7077 },
7078 {
7079 "del",
7080 rpc_trustdom_del,
7081 NET_TRANSPORT_RPC,
7082 N_("Remove trusting domain's account"),
7083 N_("net rpc trustdom del\n"
7084 " Remove trusting domain's account")
7085 },
7086 {
7087 "establish",
7088 rpc_trustdom_establish,
7089 NET_TRANSPORT_RPC,
7090 N_("Establish outgoing trust relationship"),
7091 N_("net rpc trustdom establish\n"
7092 " Establish outgoing trust relationship")
7093 },
7094 {
7095 "revoke",
7096 rpc_trustdom_revoke,
7097 NET_TRANSPORT_RPC,
7098 N_("Revoke outgoing trust relationship"),
7099 N_("net rpc trustdom revoke\n"
7100 " Revoke outgoing trust relationship")
7101 },
7102 {
7103 "list",
7104 rpc_trustdom_list,
7105 NET_TRANSPORT_RPC,
7106 N_("List in- and outgoing domain trusts"),
7107 N_("net rpc trustdom list\n"
7108 " List in- and outgoing domain trusts")
7109 },
7110 {
7111 "vampire",
7112 rpc_trustdom_vampire,
7113 NET_TRANSPORT_RPC,
7114 N_("Vampire trusts from remote server"),
7115 N_("net rpc trustdom vampire\n"
7116 " Vampire trusts from remote server")
7117 },
7118 {NULL, NULL, 0, NULL, NULL}
7119 };
7120
7121 return net_run_function(c, argc, argv, "net rpc trustdom", func);
7122 }
7123
7124 /**
7125 * Check if a server will take rpc commands
7126 * @param flags Type of server to connect to (PDC, DMB, localhost)
7127 * if the host is not explicitly specified
7128 * @return bool (true means rpc supported)
7129 */
7130 bool net_rpc_check(struct net_context *c, unsigned flags)
7131 {
7132 struct cli_state *cli;
7133 bool ret = false;
7134 struct sockaddr_storage server_ss;
7135 char *server_name = NULL;
7136 NTSTATUS status;
7137
7138 /* flags (i.e. server type) may depend on command */
7139 if (!net_find_server(c, NULL, flags, &server_ss, &server_name))
7140 return false;
7141
7142 status = cli_connect_nb(server_name, &server_ss, 0, 0x20,
7143 lp_netbios_name(), SMB_SIGNING_DEFAULT,
7144 0, &cli);
7145 if (!NT_STATUS_IS_OK(status)) {
7146 return false;
7147 }
7148 status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
7149 PROTOCOL_NT1);
7150 if (!NT_STATUS_IS_OK(status))
7151 goto done;
7152 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_NT1)
7153 goto done;
7154
7155 ret = true;
7156 done:
7157 cli_shutdown(cli);
7158 return ret;
7159 }
7160
7161 /* dump sam database via samsync rpc calls */
7162 static int rpc_samdump(struct net_context *c, int argc, const char **argv) {
7163 if (c->display_usage) {
7164 d_printf( "%s\n"
7165 "net rpc samdump\n"
7166 " %s\n",
7167 _("Usage:"),
7168 _("Dump remote SAM database"));
7169 return 0;
7170 }
7171
7172 return run_rpc_command(c, NULL, &ndr_table_netlogon,
7173 NET_FLAGS_ANONYMOUS,
7174 rpc_samdump_internals, argc, argv);
7175 }
7176
7177 /* syncronise sam database via samsync rpc calls */
7178 static int rpc_vampire(struct net_context *c, int argc, const char **argv)
7179 {
7180 struct functable func[] = {
7181 {
7182 "ldif",
7183 rpc_vampire_ldif,
7184 NET_TRANSPORT_RPC,
7185 N_("Dump remote SAM database to ldif"),
7186 N_("net rpc vampire ldif\n"
7187 " Dump remote SAM database to LDIF file or "
7188 "stdout")
7189 },
7190 {
7191 "keytab",
7192 rpc_vampire_keytab,
7193 NET_TRANSPORT_RPC,
7194 N_("Dump remote SAM database to Kerberos Keytab"),
7195 N_("net rpc vampire keytab\n"
7196 " Dump remote SAM database to Kerberos keytab "
7197 "file")
7198 },
7199 {
7200 "passdb",
7201 rpc_vampire_passdb,
7202 NET_TRANSPORT_RPC,
7203 N_("Dump remote SAM database to passdb"),
7204 N_("net rpc vampire passdb\n"
7205 " Dump remote SAM database to passdb")
7206 },
7207
7208 {NULL, NULL, 0, NULL, NULL}
7209 };
7210
7211 if (argc == 0) {
7212 if (c->display_usage) {
7213 d_printf( "%s\n"
7214 "net rpc vampire\n"
7215 " %s\n",
7216 _("Usage:"),
7217 _("Vampire remote SAM database"));
7218 return 0;
7219 }
7220
7221 return rpc_vampire_passdb(c, argc, argv);
7222 }
7223
7224 return net_run_function(c, argc, argv, "net rpc vampire", func);
7225 }
7226
7227 /**
7228 * Migrate everything from a print server.
7229 *
7230 * @param c A net_context structure.
7231 * @param argc Standard main() style argc.
7232 * @param argv Standard main() style argv. Initial components are already
7233 * stripped.
7234 *
7235 * @return A shell status integer (0 for success).
7236 *
7237 * The order is important !
7238 * To successfully add drivers the print queues have to exist !
7239 * Applying ACLs should be the last step, because you're easily locked out.
7240 *
7241 **/
7242 static int rpc_printer_migrate_all(struct net_context *c, int argc,
7243 const char **argv)
7244 {
7245 int ret;
7246
7247 if (c->display_usage) {
7248 d_printf( "%s\n"
7249 "net rpc printer migrate all\n"
7250 " %s\n",
7251 _("Usage:"),
7252 _("Migrate everything from a print server"));
7253 return 0;
7254 }
7255
7256 if (!c->opt_host) {
7257 d_printf(_("no server to migrate\n"));
7258 return -1;
7259 }
7260
7261 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7262 rpc_printer_migrate_printers_internals, argc,
7263 argv);
7264 if (ret)
7265 return ret;
7266
7267 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7268 rpc_printer_migrate_drivers_internals, argc,
7269 argv);
7270 if (ret)
7271 return ret;
7272
7273 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7274 rpc_printer_migrate_forms_internals, argc, argv);
7275 if (ret)
7276 return ret;
7277
7278 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7279 rpc_printer_migrate_settings_internals, argc,
7280 argv);
7281 if (ret)
7282 return ret;
7283
7284 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7285 rpc_printer_migrate_security_internals, argc,
7286 argv);
7287
7288 }
7289
7290 /**
7291 * Migrate print drivers from a print server.
7292 *
7293 * @param c A net_context structure.
7294 * @param argc Standard main() style argc.
7295 * @param argv Standard main() style argv. Initial components are already
7296 * stripped.
7297 *
7298 * @return A shell status integer (0 for success).
7299 **/
7300 static int rpc_printer_migrate_drivers(struct net_context *c, int argc,
7301 const char **argv)
7302 {
7303 if (c->display_usage) {
7304 d_printf( "%s\n"
7305 "net rpc printer migrate drivers\n"
7306 " %s\n",
7307 _("Usage:"),
7308 _("Migrate print-drivers from a print-server"));
7309 return 0;
7310 }
7311
7312 if (!c->opt_host) {
7313 d_printf(_("no server to migrate\n"));
7314 return -1;
7315 }
7316
7317 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7318 rpc_printer_migrate_drivers_internals,
7319 argc, argv);
7320 }
7321
7322 /**
7323 * Migrate print-forms from a print-server.
7324 *
7325 * @param c A net_context structure.
7326 * @param argc Standard main() style argc.
7327 * @param argv Standard main() style argv. Initial components are already
7328 * stripped.
7329 *
7330 * @return A shell status integer (0 for success).
7331 **/
7332 static int rpc_printer_migrate_forms(struct net_context *c, int argc,
7333 const char **argv)
7334 {
7335 if (c->display_usage) {
7336 d_printf( "%s\n"
7337 "net rpc printer migrate forms\n"
7338 " %s\n",
7339 _("Usage:"),
7340 _("Migrate print-forms from a print-server"));
7341 return 0;
7342 }
7343
7344 if (!c->opt_host) {
7345 d_printf(_("no server to migrate\n"));
7346 return -1;
7347 }
7348
7349 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7350 rpc_printer_migrate_forms_internals,
7351 argc, argv);
7352 }
7353
7354 /**
7355 * Migrate printers from a print-server.
7356 *
7357 * @param c A net_context structure.
7358 * @param argc Standard main() style argc.
7359 * @param argv Standard main() style argv. Initial components are already
7360 * stripped.
7361 *
7362 * @return A shell status integer (0 for success).
7363 **/
7364 static int rpc_printer_migrate_printers(struct net_context *c, int argc,
7365 const char **argv)
7366 {
7367 if (c->display_usage) {
7368 d_printf( "%s\n"
7369 "net rpc printer migrate printers\n"
7370 " %s\n",
7371 _("Usage:"),
7372 _("Migrate printers from a print-server"));
7373 return 0;
7374 }
7375
7376 if (!c->opt_host) {
7377 d_printf(_("no server to migrate\n"));
7378 return -1;
7379 }
7380
7381 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7382 rpc_printer_migrate_printers_internals,
7383 argc, argv);
7384 }
7385
7386 /**
7387 * Migrate printer-ACLs from a print-server
7388 *
7389 * @param c A net_context structure.
7390 * @param argc Standard main() style argc.
7391 * @param argv Standard main() style argv. Initial components are already
7392 * stripped.
7393 *
7394 * @return A shell status integer (0 for success).
7395 **/
7396 static int rpc_printer_migrate_security(struct net_context *c, int argc,
7397 const char **argv)
7398 {
7399 if (c->display_usage) {
7400 d_printf( "%s\n"
7401 "net rpc printer migrate security\n"
7402 " %s\n",
7403 _("Usage:"),
7404 _("Migrate printer-ACLs from a print-server"));
7405 return 0;
7406 }
7407
7408 if (!c->opt_host) {
7409 d_printf(_("no server to migrate\n"));
7410 return -1;
7411 }
7412
7413 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7414 rpc_printer_migrate_security_internals,
7415 argc, argv);
7416 }
7417
7418 /**
7419 * Migrate printer-settings from a print-server.
7420 *
7421 * @param c A net_context structure.
7422 * @param argc Standard main() style argc.
7423 * @param argv Standard main() style argv. Initial components are already
7424 * stripped.
7425 *
7426 * @return A shell status integer (0 for success).
7427 **/
7428 static int rpc_printer_migrate_settings(struct net_context *c, int argc,
7429 const char **argv)
7430 {
7431 if (c->display_usage) {
7432 d_printf( "%s\n"
7433 "net rpc printer migrate settings\n"
7434 " %s\n",
7435 _("Usage:"),
7436 _("Migrate printer-settings from a "
7437 "print-server"));
7438 return 0;
7439 }
7440
7441 if (!c->opt_host) {
7442 d_printf(_("no server to migrate\n"));
7443 return -1;
7444 }
7445
7446 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7447 rpc_printer_migrate_settings_internals,
7448 argc, argv);
7449 }
7450
7451 /**
7452 * 'net rpc printer' entrypoint.
7453 *
7454 * @param c A net_context structure.
7455 * @param argc Standard main() style argc.
7456 * @param argv Standard main() style argv. Initial components are already
7457 * stripped.
7458 **/
7459
7460 int rpc_printer_migrate(struct net_context *c, int argc, const char **argv)
7461 {
7462
7463 /* ouch: when addriver and setdriver are called from within
7464 rpc_printer_migrate_drivers_internals, the printer-queue already
7465 *has* to exist */
7466
7467 struct functable func[] = {
7468 {
7469 "all",
7470 rpc_printer_migrate_all,
7471 NET_TRANSPORT_RPC,
7472 N_("Migrate all from remote to local print server"),
7473 N_("net rpc printer migrate all\n"
7474 " Migrate all from remote to local print server")
7475 },
7476 {
7477 "drivers",
7478 rpc_printer_migrate_drivers,
7479 NET_TRANSPORT_RPC,
7480 N_("Migrate drivers to local server"),
7481 N_("net rpc printer migrate drivers\n"
7482 " Migrate drivers to local server")
7483 },
7484 {
7485 "forms",
7486 rpc_printer_migrate_forms,
7487 NET_TRANSPORT_RPC,
7488 N_("Migrate froms to local server"),
7489 N_("net rpc printer migrate forms\n"
7490 " Migrate froms to local server")
7491 },
7492 {
7493 "printers",
7494 rpc_printer_migrate_printers,
7495 NET_TRANSPORT_RPC,
7496 N_("Migrate printers to local server"),
7497 N_("net rpc printer migrate printers\n"
7498 " Migrate printers to local server")
7499 },
7500 {
7501 "security",
7502 rpc_printer_migrate_security,
7503 NET_TRANSPORT_RPC,
7504 N_("Mirgate printer ACLs to local server"),
7505 N_("net rpc printer migrate security\n"
7506 " Mirgate printer ACLs to local server")
7507 },
7508 {
7509 "settings",
7510 rpc_printer_migrate_settings,
7511 NET_TRANSPORT_RPC,
7512 N_("Migrate printer settings to local server"),
7513 N_("net rpc printer migrate settings\n"
7514 " Migrate printer settings to local server")
7515 },
7516 {NULL, NULL, 0, NULL, NULL}
7517 };
7518
7519 return net_run_function(c, argc, argv, "net rpc printer migrate",func);
7520 }
7521
7522
7523 /**
7524 * List printers on a remote RPC server.
7525 *
7526 * @param c A net_context structure.
7527 * @param argc Standard main() style argc.
7528 * @param argv Standard main() style argv. Initial components are already
7529 * stripped.
7530 *
7531 * @return A shell status integer (0 for success).
7532 **/
7533 static int rpc_printer_list(struct net_context *c, int argc, const char **argv)
7534 {
7535 if (c->display_usage) {
7536 d_printf( "%s\n"
7537 "net rpc printer list\n"
7538 " %s\n",
7539 _("Usage:"),
7540 _("List printers on a remote RPC server"));
7541 return 0;
7542 }
7543
7544 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7545 rpc_printer_list_internals,
7546 argc, argv);
7547 }
7548
7549 /**
7550 * List printer-drivers on a remote RPC server.
7551 *
7552 * @param c A net_context structure.
7553 * @param argc Standard main() style argc.
7554 * @param argv Standard main() style argv. Initial components are already
7555 * stripped.
7556 *
7557 * @return A shell status integer (0 for success).
7558 **/
7559 static int rpc_printer_driver_list(struct net_context *c, int argc,
7560 const char **argv)
7561 {
7562 if (c->display_usage) {
7563 d_printf( "%s\n"
7564 "net rpc printer driver\n"
7565 " %s\n",
7566 _("Usage:"),
7567 _("List printer-drivers on a remote RPC server"));
7568 return 0;
7569 }
7570
7571 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7572 rpc_printer_driver_list_internals,
7573 argc, argv);
7574 }
7575
7576 /**
7577 * Publish printer in ADS via MSRPC.
7578 *
7579 * @param c A net_context structure.
7580 * @param argc Standard main() style argc.
7581 * @param argv Standard main() style argv. Initial components are already
7582 * stripped.
7583 *
7584 * @return A shell status integer (0 for success).
7585 **/
7586 static int rpc_printer_publish_publish(struct net_context *c, int argc,
7587 const char **argv)
7588 {
7589 if (c->display_usage) {
7590 d_printf( "%s\n"
7591 "net rpc printer publish publish\n"
7592 " %s\n",
7593 _("Usage:"),
7594 _("Publish printer in ADS via MSRPC"));
7595 return 0;
7596 }
7597
7598 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7599 rpc_printer_publish_publish_internals,
7600 argc, argv);
7601 }
7602
7603 /**
7604 * Update printer in ADS via MSRPC.
7605 *
7606 * @param c A net_context structure.
7607 * @param argc Standard main() style argc.
7608 * @param argv Standard main() style argv. Initial components are already
7609 * stripped.
7610 *
7611 * @return A shell status integer (0 for success).
7612 **/
7613 static int rpc_printer_publish_update(struct net_context *c, int argc, const char **argv)
7614 {
7615 if (c->display_usage) {
7616 d_printf( "%s\n"
7617 "net rpc printer publish update\n"
7618 " %s\n",
7619 _("Usage:"),
7620 _("Update printer in ADS via MSRPC"));
7621 return 0;
7622 }
7623
7624 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7625 rpc_printer_publish_update_internals,
7626 argc, argv);
7627 }
7628
7629 /**
7630 * UnPublish printer in ADS via MSRPC.
7631 *
7632 * @param c A net_context structure.
7633 * @param argc Standard main() style argc.
7634 * @param argv Standard main() style argv. Initial components are already
7635 * stripped.
7636 *
7637 * @return A shell status integer (0 for success).
7638 **/
7639 static int rpc_printer_publish_unpublish(struct net_context *c, int argc,
7640 const char **argv)
7641 {
7642 if (c->display_usage) {
7643 d_printf( "%s\n"
7644 "net rpc printer publish unpublish\n"
7645 " %s\n",
7646 _("Usage:\n"),
7647 _("UnPublish printer in ADS via MSRPC"));
7648 return 0;
7649 }
7650
7651 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7652 rpc_printer_publish_unpublish_internals,
7653 argc, argv);
7654 }
7655
7656 /**
7657 * List published printers via MSRPC.
7658 *
7659 * @param c A net_context structure.
7660 * @param argc Standard main() style argc.
7661 * @param argv Standard main() style argv. Initial components are already
7662 * stripped.
7663 *
7664 * @return A shell status integer (0 for success).
7665 **/
7666 static int rpc_printer_publish_list(struct net_context *c, int argc,
7667 const char **argv)
7668 {
7669 if (c->display_usage) {
7670 d_printf( "%s\n"
7671 "net rpc printer publish list\n"
7672 " %s\n",
7673 _("Usage:"),
7674 _("List published printers via MSRPC"));
7675 return 0;
7676 }
7677
7678 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7679 rpc_printer_publish_list_internals,
7680 argc, argv);
7681 }
7682
7683
7684 /**
7685 * Publish printer in ADS.
7686 *
7687 * @param c A net_context structure.
7688 * @param argc Standard main() style argc.
7689 * @param argv Standard main() style argv. Initial components are already
7690 * stripped.
7691 *
7692 * @return A shell status integer (0 for success).
7693 **/
7694 static int rpc_printer_publish(struct net_context *c, int argc,
7695 const char **argv)
7696 {
7697
7698 struct functable func[] = {
7699 {
7700 "publish",
7701 rpc_printer_publish_publish,
7702 NET_TRANSPORT_RPC,
7703 N_("Publish printer in AD"),
7704 N_("net rpc printer publish publish\n"
7705 " Publish printer in AD")
7706 },
7707 {
7708 "update",
7709 rpc_printer_publish_update,
7710 NET_TRANSPORT_RPC,
7711 N_("Update printer in AD"),
7712 N_("net rpc printer publish update\n"
7713 " Update printer in AD")
7714 },
7715 {
7716 "unpublish",
7717 rpc_printer_publish_unpublish,
7718 NET_TRANSPORT_RPC,
7719 N_("Unpublish printer"),
7720 N_("net rpc printer publish unpublish\n"
7721 " Unpublish printer")
7722 },
7723 {
7724 "list",
7725 rpc_printer_publish_list,
7726 NET_TRANSPORT_RPC,
7727 N_("List published printers"),
7728 N_("net rpc printer publish list\n"
7729 " List published printers")
7730 },
7731 {NULL, NULL, 0, NULL, NULL}
7732 };
7733
7734 if (argc == 0) {
7735 if (c->display_usage) {
7736 d_printf(_("Usage:\n"));
7737 d_printf(_("net rpc printer publish\n"
7738 " List published printers\n"
7739 " Alias of net rpc printer publish "
7740 "list\n"));
7741 net_display_usage_from_functable(func);
7742 return 0;
7743 }
7744 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7745 rpc_printer_publish_list_internals,
7746 argc, argv);
7747 }
7748
7749 return net_run_function(c, argc, argv, "net rpc printer publish",func);
7750
7751 }
7752
7753
7754 /**
7755 * Display rpc printer help page.
7756 *
7757 * @param c A net_context structure.
7758 * @param argc Standard main() style argc.
7759 * @param argv Standard main() style argv. Initial components are already
7760 * stripped.
7761 **/
7762 int rpc_printer_usage(struct net_context *c, int argc, const char **argv)
7763 {
7764 d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
7765 "\tlists all printers on print-server\n\n"));
7766 d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
7767 "\tlists all printer-drivers on print-server\n\n"));
7768 d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
7769 "\tpublishes printer settings in Active Directory\n"
7770 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
7771 d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
7772 "\n\tmigrates printers from remote to local server\n\n"));
7773 d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
7774 "\n\tmigrates printer-settings from remote to local server\n\n"));
7775 d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
7776 "\n\tmigrates printer-drivers from remote to local server\n\n"));
7777 d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
7778 "\n\tmigrates printer-forms from remote to local server\n\n"));
7779 d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
7780 "\n\tmigrates printer-ACLs from remote to local server\n\n"));
7781 d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
7782 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
7783 "\tremote to local print-server\n\n"));
7784 net_common_methods_usage(c, argc, argv);
7785 net_common_flags_usage(c, argc, argv);
7786 d_printf(_(
7787 "\t-v or --verbose\t\t\tgive verbose output\n"
7788 "\t --destination\t\tmigration target server (default: localhost)\n"));
7789
7790 return -1;
7791 }
7792
7793 /**
7794 * 'net rpc printer' entrypoint.
7795 *
7796 * @param c A net_context structure.
7797 * @param argc Standard main() style argc.
7798 * @param argv Standard main() style argv. Initial components are already
7799 * stripped.
7800 **/
7801 int net_rpc_printer(struct net_context *c, int argc, const char **argv)
7802 {
7803 struct functable func[] = {
7804 {
7805 "list",
7806 rpc_printer_list,
7807 NET_TRANSPORT_RPC,
7808 N_("List all printers on print server"),
7809 N_("net rpc printer list\n"
7810 " List all printers on print server")
7811 },
7812 {
7813 "migrate",
7814 rpc_printer_migrate,
7815 NET_TRANSPORT_RPC,
7816 N_("Migrate printer to local server"),
7817 N_("net rpc printer migrate\n"
7818 " Migrate printer to local server")
7819 },
7820 {
7821 "driver",
7822 rpc_printer_driver_list,
7823 NET_TRANSPORT_RPC,
7824 N_("List printer drivers"),
7825 N_("net rpc printer driver\n"
7826 " List printer drivers")
7827 },
7828 {
7829 "publish",
7830 rpc_printer_publish,
7831 NET_TRANSPORT_RPC,
7832 N_("Publish printer in AD"),
7833 N_("net rpc printer publish\n"
7834 " Publish printer in AD")
7835 },
7836 {NULL, NULL, 0, NULL, NULL}
7837 };
7838
7839 if (argc == 0) {
7840 if (c->display_usage) {
7841 d_printf(_("Usage:\n"));
7842 d_printf(_("net rpc printer\n"
7843 " List printers\n"));
7844 net_display_usage_from_functable(func);
7845 return 0;
7846 }
7847 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7848 rpc_printer_list_internals,
7849 argc, argv);
7850 }
7851
7852 return net_run_function(c, argc, argv, "net rpc printer", func);
7853 }
7854
7855 /**
7856 * 'net rpc' entrypoint.
7857 *
7858 * @param c A net_context structure.
7859 * @param argc Standard main() style argc.
7860 * @param argv Standard main() style argv. Initial components are already
7861 * stripped.
7862 **/
7863
7864 int net_rpc(struct net_context *c, int argc, const char **argv)
7865 {
7866 NET_API_STATUS status;
7867
7868 struct functable func[] = {
7869 {
7870 "audit",
7871 net_rpc_audit,
7872 NET_TRANSPORT_RPC,
7873 N_("Modify global audit settings"),
7874 N_("net rpc audit\n"
7875 " Modify global audit settings")
7876 },
7877 {
7878 "info",
7879 net_rpc_info,
7880 NET_TRANSPORT_RPC,
7881 N_("Show basic info about a domain"),
7882 N_("net rpc info\n"
7883 " Show basic info about a domain")
7884 },
7885 {
7886 "join",
7887 net_rpc_join,
7888 NET_TRANSPORT_RPC,
7889 N_("Join a domain"),
7890 N_("net rpc join\n"
7891 " Join a domain")
7892 },
7893 {
7894 "oldjoin",
7895 net_rpc_oldjoin,
7896 NET_TRANSPORT_RPC,
7897 N_("Join a domain created in server manager"),
7898 N_("net rpc oldjoin\n"
7899 " Join a domain created in server manager")
7900 },
7901 {
7902 "testjoin",
7903 net_rpc_testjoin,
7904 NET_TRANSPORT_RPC,
7905 N_("Test that a join is valid"),
7906 N_("net rpc testjoin\n"
7907 " Test that a join is valid")
7908 },
7909 {
7910 "user",
7911 net_rpc_user,
7912 NET_TRANSPORT_RPC,
7913 N_("List/modify users"),
7914 N_("net rpc user\n"
7915 " List/modify users")
7916 },
7917 {
7918 "password",
7919 rpc_user_password,
7920 NET_TRANSPORT_RPC,
7921 N_("Change a user password"),
7922 N_("net rpc password\n"
7923 " Change a user password\n"
7924 " Alias for net rpc user password")
7925 },
7926 {
7927 "group",
7928 net_rpc_group,
7929 NET_TRANSPORT_RPC,
7930 N_("List/modify groups"),
7931 N_("net rpc group\n"
7932 " List/modify groups")
7933 },
7934 {
7935 "share",
7936 net_rpc_share,
7937 NET_TRANSPORT_RPC,
7938 N_("List/modify shares"),
7939 N_("net rpc share\n"
7940 " List/modify shares")
7941 },
7942 {
7943 "file",
7944 net_rpc_file,
7945 NET_TRANSPORT_RPC,
7946 N_("List open files"),
7947 N_("net rpc file\n"
7948 " List open files")
7949 },
7950 {
7951 "printer",
7952 net_rpc_printer,
7953 NET_TRANSPORT_RPC,
7954 N_("List/modify printers"),
7955 N_("net rpc printer\n"
7956 " List/modify printers")
7957 },
7958 {
7959 "changetrustpw",
7960 net_rpc_changetrustpw,
7961 NET_TRANSPORT_RPC,
7962 N_("Change trust account password"),
7963 N_("net rpc changetrustpw\n"
7964 " Change trust account password")
7965 },
7966 {
7967 "trustdom",
7968 rpc_trustdom,
7969 NET_TRANSPORT_RPC,
7970 N_("Modify domain trusts"),
7971 N_("net rpc trustdom\n"
7972 " Modify domain trusts")
7973 },
7974 {
7975 "abortshutdown",
7976 rpc_shutdown_abort,
7977 NET_TRANSPORT_RPC,
7978 N_("Abort a remote shutdown"),
7979 N_("net rpc abortshutdown\n"
7980 " Abort a remote shutdown")
7981 },
7982 {
7983 "shutdown",
7984 rpc_shutdown,
7985 NET_TRANSPORT_RPC,
7986 N_("Shutdown a remote server"),
7987 N_("net rpc shutdown\n"
7988 " Shutdown a remote server")
7989 },
7990 {
7991 "samdump",
7992 rpc_samdump,
7993 NET_TRANSPORT_RPC,
7994 N_("Dump SAM data of remote NT PDC"),
7995 N_("net rpc samdump\n"
7996 " Dump SAM data of remote NT PDC")
7997 },
7998 {
7999 "vampire",
8000 rpc_vampire,
8001 NET_TRANSPORT_RPC,
8002 N_("Sync a remote NT PDC's data into local passdb"),
8003 N_("net rpc vampire\n"
8004 " Sync a remote NT PDC's data into local passdb")
8005 },
8006 {
8007 "getsid",
8008 net_rpc_getsid,
8009 NET_TRANSPORT_RPC,
8010 N_("Fetch the domain sid into local secrets.tdb"),
8011 N_("net rpc getsid\n"
8012 " Fetch the domain sid into local secrets.tdb")
8013 },
8014 {
8015 "rights",
8016 net_rpc_rights,
8017 NET_TRANSPORT_RPC,
8018 N_("Manage privileges assigned to SID"),
8019 N_("net rpc rights\n"
8020 " Manage privileges assigned to SID")
8021 },
8022 {
8023 "service",
8024 net_rpc_service,
8025 NET_TRANSPORT_RPC,
8026 N_("Start/stop/query remote services"),
8027 N_("net rpc service\n"
8028 " Start/stop/query remote services")
8029 },
8030 {
8031 "registry",
8032 net_rpc_registry,
8033 NET_TRANSPORT_RPC,
8034 N_("Manage registry hives"),
8035 N_("net rpc registry\n"
8036 " Manage registry hives")
8037 },
8038 {
8039 "shell",
8040 net_rpc_shell,
8041 NET_TRANSPORT_RPC,
8042 N_("Open interactive shell on remote server"),
8043 N_("net rpc shell\n"
8044 " Open interactive shell on remote server")
8045 },
8046 {
8047 "trust",
8048 net_rpc_trust,
8049 NET_TRANSPORT_RPC,
8050 N_("Manage trusts"),
8051 N_("net rpc trust\n"
8052 " Manage trusts")
8053 },
8054 {
8055 "conf",
8056 net_rpc_conf,
8057 NET_TRANSPORT_RPC,
8058 N_("Configure a remote samba server"),
8059 N_("net rpc conf\n"
8060 " Configure a remote samba server")
8061 },
8062 {NULL, NULL, 0, NULL, NULL}
8063 };
8064
8065 status = libnetapi_net_init(&c->netapi_ctx);
8066 if (status != 0) {
8067 return -1;
8068 }
8069 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
8070 libnetapi_set_password(c->netapi_ctx, c->opt_password);
8071 if (c->opt_kerberos) {
8072 libnetapi_set_use_kerberos(c->netapi_ctx);
8073 }
8074 if (c->opt_ccache) {
8075 libnetapi_set_use_ccache(c->netapi_ctx);
8076 }
8077
8078 return net_run_function(c, argc, argv, "net rpc", func);
8079 }
reg import