s3: Rename new parameter "ldap ref follow" to "ldap follow referral".
[Samba/gebeck_regimport.git] / source3 / utils / net_rpc_samsync.c
blob89568eef94d2e565140ecb08a8ccd4b24b036bab
1 /*
2    Unix SMB/CIFS implementation.
3    dump the remote SAM using rpc samsync operations
5    Copyright (C) Andrew Tridgell 2002
6    Copyright (C) Tim Potter 2001,2002
7    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
8    Modified by Volker Lendecke 2002
9    Copyright (C) Jeremy Allison 2005.
10    Copyright (C) Guenther Deschner 2008.
12    This program is free software; you can redistribute it and/or modify
13    it under the terms of the GNU General Public License as published by
14    the Free Software Foundation; either version 3 of the License, or
15    (at your option) any later version.
17    This program is distributed in the hope that it will be useful,
18    but WITHOUT ANY WARRANTY; without even the implied warranty of
19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20    GNU General Public License for more details.
22    You should have received a copy of the GNU General Public License
23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
26 #include "includes.h"
27 #include "utils/net.h"
29 static void parse_samsync_partial_replication_objects(TALLOC_CTX *mem_ctx,
30                                                       int argc,
31                                                       const char **argv,
32                                                       bool *do_single_object_replication,
33                                                       struct samsync_object **objects,
34                                                       uint32_t *num_objects)
36         int i;
38         if (argc > 0) {
39                 *do_single_object_replication = true;
40         }
42         for (i=0; i<argc; i++) {
44                 struct samsync_object o;
46                 ZERO_STRUCT(o);
48                 if (!StrnCaseCmp(argv[i], "user_rid=", strlen("user_rid="))) {
49                         o.object_identifier.rid         = get_int_param(argv[i]);
50                         o.object_type                   = NETR_DELTA_USER;
51                         o.database_id                   = SAM_DATABASE_DOMAIN;
52                 }
53                 if (!StrnCaseCmp(argv[i], "group_rid=", strlen("group_rid="))) {
54                         o.object_identifier.rid         = get_int_param(argv[i]);
55                         o.object_type                   = NETR_DELTA_GROUP;
56                         o.database_id                   = SAM_DATABASE_DOMAIN;
57                 }
58                 if (!StrnCaseCmp(argv[i], "group_member_rid=", strlen("group_member_rid="))) {
59                         o.object_identifier.rid         = get_int_param(argv[i]);
60                         o.object_type                   = NETR_DELTA_GROUP_MEMBER;
61                         o.database_id                   = SAM_DATABASE_DOMAIN;
62                 }
63                 if (!StrnCaseCmp(argv[i], "alias_rid=", strlen("alias_rid="))) {
64                         o.object_identifier.rid         = get_int_param(argv[i]);
65                         o.object_type                   = NETR_DELTA_ALIAS;
66                         o.database_id                   = SAM_DATABASE_BUILTIN;
67                 }
68                 if (!StrnCaseCmp(argv[i], "alias_member_rid=", strlen("alias_member_rid="))) {
69                         o.object_identifier.rid         = get_int_param(argv[i]);
70                         o.object_type                   = NETR_DELTA_ALIAS_MEMBER;
71                         o.database_id                   = SAM_DATABASE_BUILTIN;
72                 }
73                 if (!StrnCaseCmp(argv[i], "account_sid=", strlen("account_sid="))) {
74                         const char *sid_str = get_string_param(argv[i]);
75                         string_to_sid(&o.object_identifier.sid, sid_str);
76                         o.object_type                   = NETR_DELTA_ACCOUNT;
77                         o.database_id                   = SAM_DATABASE_PRIVS;
78                 }
79                 if (!StrnCaseCmp(argv[i], "policy_sid=", strlen("policy_sid="))) {
80                         const char *sid_str = get_string_param(argv[i]);
81                         string_to_sid(&o.object_identifier.sid, sid_str);
82                         o.object_type                   = NETR_DELTA_POLICY;
83                         o.database_id                   = SAM_DATABASE_PRIVS;
84                 }
85                 if (!StrnCaseCmp(argv[i], "trustdom_sid=", strlen("trustdom_sid="))) {
86                         const char *sid_str = get_string_param(argv[i]);
87                         string_to_sid(&o.object_identifier.sid, sid_str);
88                         o.object_type                   = NETR_DELTA_TRUSTED_DOMAIN;
89                         o.database_id                   = SAM_DATABASE_PRIVS;
90                 }
91                 if (!StrnCaseCmp(argv[i], "secret_name=", strlen("secret_name="))) {
92                         o.object_identifier.name        = get_string_param(argv[i]);
93                         o.object_type                   = NETR_DELTA_SECRET;
94                         o.database_id                   = SAM_DATABASE_PRIVS;
95                 }
97                 if (o.object_type > 0) {
98                         ADD_TO_ARRAY(mem_ctx, struct samsync_object, o,
99                                      objects, num_objects);
100                 }
101         }
104 /* dump sam database via samsync rpc calls */
105 NTSTATUS rpc_samdump_internals(struct net_context *c,
106                                 const DOM_SID *domain_sid,
107                                 const char *domain_name,
108                                 struct cli_state *cli,
109                                 struct rpc_pipe_client *pipe_hnd,
110                                 TALLOC_CTX *mem_ctx,
111                                 int argc,
112                                 const char **argv)
114         struct samsync_context *ctx = NULL;
115         NTSTATUS status;
117         status = libnet_samsync_init_context(mem_ctx,
118                                              domain_sid,
119                                              &ctx);
120         if (!NT_STATUS_IS_OK(status)) {
121                 return status;
122         }
124         ctx->mode               = NET_SAMSYNC_MODE_DUMP;
125         ctx->cli                = pipe_hnd;
126         ctx->ops                = &libnet_samsync_display_ops;
127         ctx->domain_name        = domain_name;
129         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
130         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
132         parse_samsync_partial_replication_objects(ctx, argc, argv,
133                                                   &ctx->single_object_replication,
134                                                   &ctx->objects,
135                                                   &ctx->num_objects);
137         libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
139         libnet_samsync(SAM_DATABASE_BUILTIN, ctx);
141         libnet_samsync(SAM_DATABASE_PRIVS, ctx);
143         TALLOC_FREE(ctx);
145         return NT_STATUS_OK;
149  * Basic usage function for 'net rpc vampire'
151  * @param c     A net_context structure
152  * @param argc  Standard main() style argc
153  * @param argc  Standard main() style argv.  Initial components are already
154  *              stripped
155  **/
157 int rpc_vampire_usage(struct net_context *c, int argc, const char **argv)
159         d_printf(_("net rpc vampire ([ldif [<ldif-filename>] | [keytab] "
160                    "[<keytab-filename]) [options]\n"
161                    "\t to pull accounts from a remote PDC where we are a BDC\n"
162                    "\t\t no args puts accounts in local passdb from smb.conf\n"
163                    "\t\t ldif - put accounts in ldif format (file defaults to "
164                    "/tmp/tmp.ldif)\n"
165                    "\t\t keytab - put account passwords in krb5 keytab "
166                    "(defaults to system keytab)\n"));
168         net_common_flags_usage(c, argc, argv);
169         return -1;
173 /* dump sam database via samsync rpc calls */
174 NTSTATUS rpc_vampire_internals(struct net_context *c,
175                                 const DOM_SID *domain_sid,
176                                 const char *domain_name,
177                                 struct cli_state *cli,
178                                 struct rpc_pipe_client *pipe_hnd,
179                                 TALLOC_CTX *mem_ctx,
180                                 int argc,
181                                 const char **argv)
183         NTSTATUS result;
184         struct samsync_context *ctx = NULL;
186         if (!sid_equal(domain_sid, get_global_sam_sid())) {
187                 d_printf(_("Cannot import users from %s at this time, "
188                            "as the current domain:\n\t%s: %s\nconflicts "
189                            "with the remote domain\n\t%s: %s\n"
190                            "Perhaps you need to set: \n\n\tsecurity=user\n\t"
191                            "workgroup=%s\n\n in your smb.conf?\n"),
192                          domain_name,
193                          get_global_sam_name(),
194                          sid_string_dbg(get_global_sam_sid()),
195                          domain_name,
196                          sid_string_dbg(domain_sid),
197                          domain_name);
198                 return NT_STATUS_UNSUCCESSFUL;
199         }
201         result = libnet_samsync_init_context(mem_ctx,
202                                              domain_sid,
203                                              &ctx);
204         if (!NT_STATUS_IS_OK(result)) {
205                 return result;
206         }
208         ctx->mode               = NET_SAMSYNC_MODE_FETCH_PASSDB;
209         ctx->cli                = pipe_hnd;
210         ctx->ops                = &libnet_samsync_passdb_ops;
211         ctx->domain_name        = domain_name;
213         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
214         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
216         parse_samsync_partial_replication_objects(ctx, argc, argv,
217                                                   &ctx->single_object_replication,
218                                                   &ctx->objects,
219                                                   &ctx->num_objects);
221         /* fetch domain */
222         result = libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
224         if (!NT_STATUS_IS_OK(result) && ctx->error_message) {
225                 d_fprintf(stderr, "%s\n", ctx->error_message);
226                 goto fail;
227         }
229         if (ctx->result_message) {
230                 d_fprintf(stdout, "%s\n", ctx->result_message);
231         }
233         /* fetch builtin */
234         ctx->domain_sid = sid_dup_talloc(mem_ctx, &global_sid_Builtin);
235         ctx->domain_sid_str = sid_string_talloc(mem_ctx, ctx->domain_sid);
236         result = libnet_samsync(SAM_DATABASE_BUILTIN, ctx);
238         if (!NT_STATUS_IS_OK(result) && ctx->error_message) {
239                 d_fprintf(stderr, "%s\n", ctx->error_message);
240                 goto fail;
241         }
243         if (ctx->result_message) {
244                 d_fprintf(stdout, "%s\n", ctx->result_message);
245         }
247  fail:
248         TALLOC_FREE(ctx);
249         return result;
252 int rpc_vampire_passdb(struct net_context *c, int argc, const char **argv)
254         if (c->display_usage) {
255                 d_printf(_("Usage:\n"
256                            "net rpc vampire passdb\n"
257                            "    Dump remote SAM database to passdb\n"));
258                 return 0;
259         }
261         return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id, 0,
262                                rpc_vampire_internals, argc, argv);
265 NTSTATUS rpc_vampire_ldif_internals(struct net_context *c,
266                                     const DOM_SID *domain_sid,
267                                     const char *domain_name,
268                                     struct cli_state *cli,
269                                     struct rpc_pipe_client *pipe_hnd,
270                                     TALLOC_CTX *mem_ctx,
271                                     int argc,
272                                     const char **argv)
274         NTSTATUS status;
275         struct samsync_context *ctx = NULL;
277         status = libnet_samsync_init_context(mem_ctx,
278                                              domain_sid,
279                                              &ctx);
280         if (!NT_STATUS_IS_OK(status)) {
281                 return status;
282         }
284         if (argc >= 1) {
285                 ctx->output_filename = argv[0];
286         }
287         if (argc >= 2) {
288                 parse_samsync_partial_replication_objects(ctx, argc-1, argv+1,
289                                                           &ctx->single_object_replication,
290                                                           &ctx->objects,
291                                                           &ctx->num_objects);
292         }
294         ctx->mode               = NET_SAMSYNC_MODE_FETCH_LDIF;
295         ctx->cli                = pipe_hnd;
296         ctx->ops                = &libnet_samsync_ldif_ops;
297         ctx->domain_name        = domain_name;
299         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
300         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
302         /* fetch domain */
303         status = libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
305         if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
306                 d_fprintf(stderr, "%s\n", ctx->error_message);
307                 goto fail;
308         }
310         if (ctx->result_message) {
311                 d_fprintf(stdout, "%s\n", ctx->result_message);
312         }
314         /* fetch builtin */
315         ctx->domain_sid = sid_dup_talloc(mem_ctx, &global_sid_Builtin);
316         ctx->domain_sid_str = sid_string_talloc(mem_ctx, ctx->domain_sid);
317         status = libnet_samsync(SAM_DATABASE_BUILTIN, ctx);
319         if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
320                 d_fprintf(stderr, "%s\n", ctx->error_message);
321                 goto fail;
322         }
324         if (ctx->result_message) {
325                 d_fprintf(stdout, "%s\n", ctx->result_message);
326         }
328  fail:
329         TALLOC_FREE(ctx);
330         return status;
333 int rpc_vampire_ldif(struct net_context *c, int argc, const char **argv)
335         if (c->display_usage) {
336                 d_printf(_("Usage:\n"
337                            "net rpc vampire ldif\n"
338                            "    Dump remote SAM database to LDIF file or "
339                            "stdout\n"));
340                 return 0;
341         }
343         return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id, 0,
344                                rpc_vampire_ldif_internals, argc, argv);
348 NTSTATUS rpc_vampire_keytab_internals(struct net_context *c,
349                                       const DOM_SID *domain_sid,
350                                       const char *domain_name,
351                                       struct cli_state *cli,
352                                       struct rpc_pipe_client *pipe_hnd,
353                                       TALLOC_CTX *mem_ctx,
354                                       int argc,
355                                       const char **argv)
357         NTSTATUS status;
358         struct samsync_context *ctx = NULL;
360         status = libnet_samsync_init_context(mem_ctx,
361                                              domain_sid,
362                                              &ctx);
363         if (!NT_STATUS_IS_OK(status)) {
364                 return status;
365         }
367         if (argc < 1) {
368                 /* the caller should ensure that a filename is provided */
369                 return NT_STATUS_INVALID_PARAMETER;
370         } else {
371                 ctx->output_filename = argv[0];
372         }
373         if (argc >= 2) {
374                 parse_samsync_partial_replication_objects(ctx, argc-1, argv+1,
375                                                           &ctx->single_object_replication,
376                                                           &ctx->objects,
377                                                           &ctx->num_objects);
378         }
380         ctx->mode               = NET_SAMSYNC_MODE_FETCH_KEYTAB;
381         ctx->cli                = pipe_hnd;
382         ctx->ops                = &libnet_samsync_keytab_ops;
383         ctx->domain_name        = domain_name;
384         ctx->username           = c->opt_user_name;
385         ctx->password           = c->opt_password;
387         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
388         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
390         /* fetch domain */
391         status = libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
393         if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
394                 d_fprintf(stderr, "%s\n", ctx->error_message);
395                 goto out;
396         }
398         if (ctx->result_message) {
399                 d_fprintf(stdout, "%s\n", ctx->result_message);
400         }
402  out:
403         TALLOC_FREE(ctx);
405         return status;
408 static NTSTATUS rpc_vampire_keytab_ds_internals(struct net_context *c,
409                                                 const DOM_SID *domain_sid,
410                                                 const char *domain_name,
411                                                 struct cli_state *cli,
412                                                 struct rpc_pipe_client *pipe_hnd,
413                                                 TALLOC_CTX *mem_ctx,
414                                                 int argc,
415                                                 const char **argv)
417         NTSTATUS status;
418         struct dssync_context *ctx = NULL;
420         status = libnet_dssync_init_context(mem_ctx,
421                                             &ctx);
422         if (!NT_STATUS_IS_OK(status)) {
423                 return status;
424         }
426         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
427         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
429         if (argc < 1) {
430                 /* the caller should ensure that a filename is provided */
431                 return NT_STATUS_INVALID_PARAMETER;
432         } else {
433                 ctx->output_filename = argv[0];
434         }
436         if (argc >= 2) {
437                 ctx->object_dns = &argv[1];
438                 ctx->object_count = argc - 1;
439                 ctx->single_object_replication = c->opt_single_obj_repl ? true
440                                                                         : false;
441         }
443         ctx->cli                = pipe_hnd;
444         ctx->domain_name        = domain_name;
445         ctx->ops                = &libnet_dssync_keytab_ops;
447         status = libnet_dssync(mem_ctx, ctx);
448         if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
449                 d_fprintf(stderr, "%s\n", ctx->error_message);
450                 goto out;
451         }
453         if (ctx->result_message) {
454                 d_fprintf(stdout, "%s\n", ctx->result_message);
455         }
457  out:
458         TALLOC_FREE(ctx);
460         return status;
464  * Basic function for 'net rpc vampire keytab'
466  * @param c     A net_context structure
467  * @param argc  Standard main() style argc
468  * @param argc  Standard main() style argv.  Initial components are already
469  *              stripped
470  **/
472 int rpc_vampire_keytab(struct net_context *c, int argc, const char **argv)
474         int ret = 0;
475         NTSTATUS status;
476         struct cli_state *cli = NULL;
477         struct net_dc_info dc_info;
479         if (c->display_usage || (argc < 1)) {
480                 d_printf(_("Usage:\n"
481                            "net rpc vampire keytab <keytabfile>\n"
482                            "    Dump remote SAM database to Kerberos keytab "
483                            "file\n"));
484                 return 0;
485         }
487         status = net_make_ipc_connection(c, 0, &cli);
488         if (!NT_STATUS_IS_OK(status)) {
489                 return -1;
490         }
492         status = net_scan_dc(c, cli, &dc_info);
493         if (!NT_STATUS_IS_OK(status)) {
494                 return -1;
495         }
497         if (!dc_info.is_ad) {
498                 printf(_("DC is not running Active Directory\n"));
499                 ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
500                                       0,
501                                       rpc_vampire_keytab_internals, argc, argv);
502                 return -1;
503         } else {
504                 ret = run_rpc_command(c, cli, &ndr_table_drsuapi.syntax_id,
505                                       NET_FLAGS_SEAL | NET_FLAGS_TCP,
506                                       rpc_vampire_keytab_ds_internals, argc, argv);
507                 if (ret != 0 && dc_info.is_mixed_mode) {
508                         printf(_("Fallback to NT4 vampire on Mixed-Mode AD "
509                                  "Domain\n"));
510                         ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
511                                               0,
512                                               rpc_vampire_keytab_internals, argc, argv);
513                 }
514         }
516         return ret;