?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
net: Use new samba_getpass() function for 'net rpc'.
[Samba/vl.git] / source3 / utils / net_rpc.c
blob57d619e28b2a3e81b882f8a48efc57453147fc44
1 /*
2 Samba Unix/Linux SMB client library
3 Distributed SMB/CIFS Server Management Utility
4 Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org)
5 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
6 Copyright (C) 2004,2008 Guenther Deschner (gd@samba.org)
7 Copyright (C) 2005 Jeremy Allison (jra@samba.org)
8 Copyright (C) 2006 Jelmer Vernooij (jelmer@samba.org)
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
22
23 #include "includes.h"
24 #include "utils/net.h"
25 #include "rpc_client/cli_pipe.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../librpc/gen_ndr/ndr_samr_c.h"
28 #include "rpc_client/cli_samr.h"
29 #include "rpc_client/init_samr.h"
30 #include "../librpc/gen_ndr/ndr_lsa_c.h"
31 #include "rpc_client/cli_lsarpc.h"
32 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "../librpc/gen_ndr/ndr_srvsvc_c.h"
34 #include "../librpc/gen_ndr/ndr_spoolss.h"
35 #include "../librpc/gen_ndr/ndr_initshutdown_c.h"
36 #include "../librpc/gen_ndr/ndr_winreg_c.h"
37 #include "secrets.h"
38 #include "lib/netapi/netapi.h"
39 #include "lib/netapi/netapi_net.h"
40 #include "rpc_client/init_lsa.h"
41 #include "../libcli/security/security.h"
42 #include "libsmb/libsmb.h"
43 #include "libsmb/clirap.h"
44 #include "nsswitch/libwbclient/wbclient.h"
45 #include "passdb.h"
46 #include "../libcli/smb/smbXcli_base.h"
47
48 static int net_mode_share;
49 static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask);
50
51 /**
52 * @file net_rpc.c
53 *
54 * @brief RPC based subcommands for the 'net' utility.
55 *
56 * This file should contain much of the functionality that used to
57 * be found in rpcclient, execpt that the commands should change
58 * less often, and the fucntionality should be sane (the user is not
59 * expected to know a rid/sid before they conduct an operation etc.)
60 *
61 * @todo Perhaps eventually these should be split out into a number
62 * of files, as this could get quite big.
63 **/
64
65
66 /**
67 * Many of the RPC functions need the domain sid. This function gets
68 * it at the start of every run
69 *
70 * @param cli A cli_state already connected to the remote machine
71 *
72 * @return The Domain SID of the remote machine.
73 **/
74
75 NTSTATUS net_get_remote_domain_sid(struct cli_state *cli, TALLOC_CTX *mem_ctx,
76 struct dom_sid **domain_sid,
77 const char **domain_name)
78 {
79 struct rpc_pipe_client *lsa_pipe = NULL;
80 struct policy_handle pol;
81 NTSTATUS status, result;
82 union lsa_PolicyInformation *info = NULL;
83 struct dcerpc_binding_handle *b;
84
85 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
86 &lsa_pipe);
87 if (!NT_STATUS_IS_OK(status)) {
88 d_fprintf(stderr, _("Could not initialise lsa pipe\n"));
89 return status;
90 }
91
92 b = lsa_pipe->binding_handle;
93
94 status = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, false,
95 SEC_FLAG_MAXIMUM_ALLOWED,
96 &pol);
97 if (!NT_STATUS_IS_OK(status)) {
98 d_fprintf(stderr, "open_policy %s: %s\n",
99 _("failed"),
100 nt_errstr(status));
101 return status;
102 }
103
104 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
105 &pol,
106 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
107 &info,
108 &result);
109 if (!NT_STATUS_IS_OK(status)) {
110 d_fprintf(stderr, "lsaquery %s: %s\n",
111 _("failed"),
112 nt_errstr(status));
113 return status;
114 }
115 if (!NT_STATUS_IS_OK(result)) {
116 d_fprintf(stderr, "lsaquery %s: %s\n",
117 _("failed"),
118 nt_errstr(result));
119 return result;
120 }
121
122 *domain_name = info->account_domain.name.string;
123 *domain_sid = info->account_domain.sid;
124
125 dcerpc_lsa_Close(b, mem_ctx, &pol, &result);
126 TALLOC_FREE(lsa_pipe);
127
128 return NT_STATUS_OK;
129 }
130
131 /**
132 * Run a single RPC command, from start to finish.
133 *
134 * @param pipe_name the pipe to connect to (usually a PIPE_ constant)
135 * @param conn_flag a NET_FLAG_ combination. Passed to
136 * net_make_ipc_connection.
137 * @param argc Standard main() style argc.
138 * @param argv Standard main() style argv. Initial components are already
139 * stripped.
140 * @return A shell status integer (0 for success).
141 */
142
143 int run_rpc_command(struct net_context *c,
144 struct cli_state *cli_arg,
145 const struct ndr_interface_table *table,
146 int conn_flags,
147 rpc_command_fn fn,
148 int argc,
149 const char **argv)
150 {
151 struct cli_state *cli = NULL;
152 struct rpc_pipe_client *pipe_hnd = NULL;
153 TALLOC_CTX *mem_ctx;
154 NTSTATUS nt_status;
155 struct dom_sid *domain_sid;
156 const char *domain_name;
157 int ret = -1;
158
159 /* make use of cli_state handed over as an argument, if possible */
160 if (!cli_arg) {
161 nt_status = net_make_ipc_connection(c, conn_flags, &cli);
162 if (!NT_STATUS_IS_OK(nt_status)) {
163 DEBUG(1, ("failed to make ipc connection: %s\n",
164 nt_errstr(nt_status)));
165 return -1;
166 }
167 } else {
168 cli = cli_arg;
169 }
170
171 if (!cli) {
172 return -1;
173 }
174
175 /* Create mem_ctx */
176
177 if (!(mem_ctx = talloc_init("run_rpc_command"))) {
178 DEBUG(0, ("talloc_init() failed\n"));
179 goto fail;
180 }
181
182 nt_status = net_get_remote_domain_sid(cli, mem_ctx, &domain_sid,
183 &domain_name);
184 if (!NT_STATUS_IS_OK(nt_status)) {
185 goto fail;
186 }
187
188 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
189 if (lp_client_schannel()
190 && (ndr_syntax_id_equal(&table->syntax_id,
191 &ndr_table_netlogon.syntax_id))) {
192 /* Always try and create an schannel netlogon pipe. */
193 nt_status = cli_rpc_pipe_open_schannel(
194 cli, &table->syntax_id, NCACN_NP,
195 DCERPC_AUTH_LEVEL_PRIVACY, domain_name,
196 &pipe_hnd);
197 if (!NT_STATUS_IS_OK(nt_status)) {
198 DEBUG(0, ("Could not initialise schannel netlogon pipe. Error was %s\n",
199 nt_errstr(nt_status) ));
200 goto fail;
201 }
202 } else {
203 if (conn_flags & NET_FLAGS_SEAL) {
204 nt_status = cli_rpc_pipe_open_generic_auth(
205 cli, table,
206 (conn_flags & NET_FLAGS_TCP) ?
207 NCACN_IP_TCP : NCACN_NP,
208 DCERPC_AUTH_TYPE_NTLMSSP,
209 DCERPC_AUTH_LEVEL_PRIVACY,
210 smbXcli_conn_remote_name(cli->conn),
211 lp_workgroup(), c->opt_user_name,
212 c->opt_password, &pipe_hnd);
213 } else {
214 nt_status = cli_rpc_pipe_open_noauth(
215 cli, &table->syntax_id,
216 &pipe_hnd);
217 }
218 if (!NT_STATUS_IS_OK(nt_status)) {
219 DEBUG(0, ("Could not initialise pipe %s. Error was %s\n",
220 table->name,
221 nt_errstr(nt_status) ));
222 goto fail;
223 }
224 }
225 }
226
227 nt_status = fn(c, domain_sid, domain_name, cli, pipe_hnd, mem_ctx, argc, argv);
228
229 if (!NT_STATUS_IS_OK(nt_status)) {
230 DEBUG(1, ("rpc command function failed! (%s)\n", nt_errstr(nt_status)));
231 } else {
232 ret = 0;
233 DEBUG(5, ("rpc command function succedded\n"));
234 }
235
236 if (!(conn_flags & NET_FLAGS_NO_PIPE)) {
237 if (pipe_hnd) {
238 TALLOC_FREE(pipe_hnd);
239 }
240 }
241
242 fail:
243 /* close the connection only if it was opened here */
244 if (!cli_arg) {
245 cli_shutdown(cli);
246 }
247
248 talloc_destroy(mem_ctx);
249 return ret;
250 }
251
252 /**
253 * Force a change of the trust acccount password.
254 *
255 * All parameters are provided by the run_rpc_command function, except for
256 * argc, argv which are passed through.
257 *
258 * @param domain_sid The domain sid acquired from the remote server.
259 * @param cli A cli_state connected to the server.
260 * @param mem_ctx Talloc context, destroyed on completion of the function.
261 * @param argc Standard main() style argc.
262 * @param argv Standard main() style argv. Initial components are already
263 * stripped.
264 *
265 * @return Normal NTSTATUS return.
266 **/
267
268 static NTSTATUS rpc_changetrustpw_internals(struct net_context *c,
269 const struct dom_sid *domain_sid,
270 const char *domain_name,
271 struct cli_state *cli,
272 struct rpc_pipe_client *pipe_hnd,
273 TALLOC_CTX *mem_ctx,
274 int argc,
275 const char **argv)
276 {
277 NTSTATUS status;
278
279 status = trust_pw_find_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup);
280 if (!NT_STATUS_IS_OK(status)) {
281 d_fprintf(stderr, _("Failed to change machine account password: %s\n"),
282 nt_errstr(status));
283 return status;
284 }
285
286 return NT_STATUS_OK;
287 }
288
289 /**
290 * Force a change of the trust acccount password.
291 *
292 * @param argc Standard main() style argc.
293 * @param argv Standard main() style argv. Initial components are already
294 * stripped.
295 *
296 * @return A shell status integer (0 for success).
297 **/
298
299 int net_rpc_changetrustpw(struct net_context *c, int argc, const char **argv)
300 {
301 if (c->display_usage) {
302 d_printf( "%s\n"
303 "net rpc changetrustpw\n"
304 " %s\n",
305 _("Usage:"),
306 _("Change the machine trust password"));
307 return 0;
308 }
309
310 return run_rpc_command(c, NULL, &ndr_table_netlogon,
311 NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
312 rpc_changetrustpw_internals,
313 argc, argv);
314 }
315
316 /**
317 * Join a domain, the old way.
318 *
319 * This uses 'machinename' as the inital password, and changes it.
320 *
321 * The password should be created with 'server manager' or equiv first.
322 *
323 * All parameters are provided by the run_rpc_command function, except for
324 * argc, argv which are passed through.
325 *
326 * @param domain_sid The domain sid acquired from the remote server.
327 * @param cli A cli_state connected to the server.
328 * @param mem_ctx Talloc context, destroyed on completion of the function.
329 * @param argc Standard main() style argc.
330 * @param argv Standard main() style argv. Initial components are already
331 * stripped.
332 *
333 * @return Normal NTSTATUS return.
334 **/
335
336 static NTSTATUS rpc_oldjoin_internals(struct net_context *c,
337 const struct dom_sid *domain_sid,
338 const char *domain_name,
339 struct cli_state *cli,
340 struct rpc_pipe_client *pipe_hnd,
341 TALLOC_CTX *mem_ctx,
342 int argc,
343 const char **argv)
344 {
345
346 fstring trust_passwd;
347 unsigned char orig_trust_passwd_hash[16];
348 NTSTATUS result;
349 enum netr_SchannelType sec_channel_type;
350
351 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
352 &pipe_hnd);
353 if (!NT_STATUS_IS_OK(result)) {
354 DEBUG(0,("rpc_oldjoin_internals: netlogon pipe open to machine %s failed. "
355 "error was %s\n",
356 smbXcli_conn_remote_name(cli->conn),
357 nt_errstr(result) ));
358 return result;
359 }
360
361 /*
362 check what type of join - if the user want's to join as
363 a BDC, the server must agree that we are a BDC.
364 */
365 if (argc >= 0) {
366 sec_channel_type = get_sec_channel_type(argv[0]);
367 } else {
368 sec_channel_type = get_sec_channel_type(NULL);
369 }
370
371 fstrcpy(trust_passwd, lp_netbios_name());
372 strlower_m(trust_passwd);
373
374 /*
375 * Machine names can be 15 characters, but the max length on
376 * a password is 14. --jerry
377 */
378
379 trust_passwd[14] = '\0';
380
381 E_md4hash(trust_passwd, orig_trust_passwd_hash);
382
383 result = trust_pw_change_and_store_it(pipe_hnd, mem_ctx, c->opt_target_workgroup,
384 lp_netbios_name(),
385 orig_trust_passwd_hash,
386 sec_channel_type);
387
388 if (NT_STATUS_IS_OK(result))
389 printf(_("Joined domain %s.\n"), c->opt_target_workgroup);
390
391
392 if (!secrets_store_domain_sid(c->opt_target_workgroup, domain_sid)) {
393 DEBUG(0, ("error storing domain sid for %s\n", c->opt_target_workgroup));
394 result = NT_STATUS_UNSUCCESSFUL;
395 }
396
397 return result;
398 }
399
400 /**
401 * Join a domain, the old way.
402 *
403 * @param argc Standard main() style argc.
404 * @param argv Standard main() style argv. Initial components are already
405 * stripped.
406 *
407 * @return A shell status integer (0 for success).
408 **/
409
410 static int net_rpc_perform_oldjoin(struct net_context *c, int argc, const char **argv)
411 {
412 return run_rpc_command(c, NULL, &ndr_table_netlogon,
413 NET_FLAGS_NO_PIPE | NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
414 rpc_oldjoin_internals,
415 argc, argv);
416 }
417
418 /**
419 * Join a domain, the old way. This function exists to allow
420 * the message to be displayed when oldjoin was explicitly
421 * requested, but not when it was implied by "net rpc join".
422 *
423 * @param argc Standard main() style argc.
424 * @param argv Standard main() style argv. Initial components are already
425 * stripped.
426 *
427 * @return A shell status integer (0 for success).
428 **/
429
430 static int net_rpc_oldjoin(struct net_context *c, int argc, const char **argv)
431 {
432 int rc = -1;
433
434 if (c->display_usage) {
435 d_printf( "%s\n"
436 "net rpc oldjoin\n"
437 " %s\n",
438 _("Usage:"),
439 _("Join a domain the old way"));
440 return 0;
441 }
442
443 rc = net_rpc_perform_oldjoin(c, argc, argv);
444
445 if (rc) {
446 d_fprintf(stderr, _("Failed to join domain\n"));
447 }
448
449 return rc;
450 }
451
452 /**
453 * 'net rpc join' entrypoint.
454 * @param argc Standard main() style argc.
455 * @param argv Standard main() style argv. Initial components are already
456 * stripped
457 *
458 * Main 'net_rpc_join()' (where the admin username/password is used) is
459 * in net_rpc_join.c.
460 * Try to just change the password, but if that doesn't work, use/prompt
461 * for a username/password.
462 **/
463
464 int net_rpc_join(struct net_context *c, int argc, const char **argv)
465 {
466 if (c->display_usage) {
467 d_printf("%s\n%s",
468 _("Usage:"),
469 _("net rpc join -U <username>[%%password] <type>\n"
470 " Join a domain\n"
471 " username\tName of the admin user"
472 " password\tPassword of the admin user, will "
473 "prompt if not specified\n"
474 " type\tCan be one of the following:\n"
475 "\t\tMEMBER\tJoin as member server (default)\n"
476 "\t\tBDC\tJoin as BDC\n"
477 "\t\tPDC\tJoin as PDC\n"));
478 return 0;
479 }
480
481 if (lp_server_role() == ROLE_STANDALONE) {
482 d_printf(_("cannot join as standalone machine\n"));
483 return -1;
484 }
485
486 if (strlen(lp_netbios_name()) > 15) {
487 d_printf(_("Our netbios name can be at most 15 chars long, "
488 "\"%s\" is %u chars long\n"),
489 lp_netbios_name(), (unsigned int)strlen(lp_netbios_name()));
490 return -1;
491 }
492
493 if ((net_rpc_perform_oldjoin(c, argc, argv) == 0))
494 return 0;
495
496 return net_rpc_join_newstyle(c, argc, argv);
497 }
498
499 /**
500 * display info about a rpc domain
501 *
502 * All parameters are provided by the run_rpc_command function, except for
503 * argc, argv which are passed through.
504 *
505 * @param domain_sid The domain sid acquired from the remote server
506 * @param cli A cli_state connected to the server.
507 * @param mem_ctx Talloc context, destroyed on completion of the function.
508 * @param argc Standard main() style argc.
509 * @param argv Standard main() style argv. Initial components are already
510 * stripped.
511 *
512 * @return Normal NTSTATUS return.
513 **/
514
515 NTSTATUS rpc_info_internals(struct net_context *c,
516 const struct dom_sid *domain_sid,
517 const char *domain_name,
518 struct cli_state *cli,
519 struct rpc_pipe_client *pipe_hnd,
520 TALLOC_CTX *mem_ctx,
521 int argc,
522 const char **argv)
523 {
524 struct policy_handle connect_pol, domain_pol;
525 NTSTATUS status, result;
526 union samr_DomainInfo *info = NULL;
527 fstring sid_str;
528 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
529
530 sid_to_fstring(sid_str, domain_sid);
531
532 /* Get sam policy handle */
533 status = dcerpc_samr_Connect2(b, mem_ctx,
534 pipe_hnd->desthost,
535 MAXIMUM_ALLOWED_ACCESS,
536 &connect_pol,
537 &result);
538 if (!NT_STATUS_IS_OK(status)) {
539 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
540 nt_errstr(status));
541 goto done;
542 }
543
544 if (!NT_STATUS_IS_OK(result)) {
545 status = result;
546 d_fprintf(stderr, _("Could not connect to SAM: %s\n"),
547 nt_errstr(result));
548 goto done;
549 }
550
551 /* Get domain policy handle */
552 status = dcerpc_samr_OpenDomain(b, mem_ctx,
553 &connect_pol,
554 MAXIMUM_ALLOWED_ACCESS,
555 discard_const_p(struct dom_sid2, domain_sid),
556 &domain_pol,
557 &result);
558 if (!NT_STATUS_IS_OK(status)) {
559 d_fprintf(stderr, _("Could not open domain: %s\n"),
560 nt_errstr(status));
561 goto done;
562 }
563 if (!NT_STATUS_IS_OK(result)) {
564 status = result;
565 d_fprintf(stderr, _("Could not open domain: %s\n"),
566 nt_errstr(result));
567 goto done;
568 }
569
570 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
571 &domain_pol,
572 2,
573 &info,
574 &result);
575 if (!NT_STATUS_IS_OK(status)) {
576 goto done;
577 }
578 status = result;
579 if (NT_STATUS_IS_OK(result)) {
580 d_printf(_("Domain Name: %s\n"),
581 info->general.domain_name.string);
582 d_printf(_("Domain SID: %s\n"), sid_str);
583 d_printf(_("Sequence number: %llu\n"),
584 (unsigned long long)info->general.sequence_num);
585 d_printf(_("Num users: %u\n"), info->general.num_users);
586 d_printf(_("Num domain groups: %u\n"),info->general.num_groups);
587 d_printf(_("Num local groups: %u\n"),info->general.num_aliases);
588 }
589
590 done:
591 return status;
592 }
593
594 /**
595 * 'net rpc info' entrypoint.
596 * @param argc Standard main() style argc.
597 * @param argv Standard main() style argv. Initial components are already
598 * stripped.
599 **/
600
601 int net_rpc_info(struct net_context *c, int argc, const char **argv)
602 {
603 if (c->display_usage) {
604 d_printf( "%s\n"
605 "net rpc info\n"
606 " %s\n",
607 _("Usage:"),
608 _("Display information about the domain"));
609 return 0;
610 }
611
612 return run_rpc_command(c, NULL, &ndr_table_samr,
613 NET_FLAGS_PDC, rpc_info_internals,
614 argc, argv);
615 }
616
617 /**
618 * Fetch domain SID into the local secrets.tdb.
619 *
620 * All parameters are provided by the run_rpc_command function, except for
621 * argc, argv which are passed through.
622 *
623 * @param domain_sid The domain sid acquired from the remote server.
624 * @param cli A cli_state connected to the server.
625 * @param mem_ctx Talloc context, destroyed on completion of the function.
626 * @param argc Standard main() style argc.
627 * @param argv Standard main() style argv. Initial components are already
628 * stripped.
629 *
630 * @return Normal NTSTATUS return.
631 **/
632
633 static NTSTATUS rpc_getsid_internals(struct net_context *c,
634 const struct dom_sid *domain_sid,
635 const char *domain_name,
636 struct cli_state *cli,
637 struct rpc_pipe_client *pipe_hnd,
638 TALLOC_CTX *mem_ctx,
639 int argc,
640 const char **argv)
641 {
642 fstring sid_str;
643
644 sid_to_fstring(sid_str, domain_sid);
645 d_printf(_("Storing SID %s for Domain %s in secrets.tdb\n"),
646 sid_str, domain_name);
647
648 if (!secrets_store_domain_sid(domain_name, domain_sid)) {
649 DEBUG(0,("Can't store domain SID\n"));
650 return NT_STATUS_UNSUCCESSFUL;
651 }
652
653 return NT_STATUS_OK;
654 }
655
656 /**
657 * 'net rpc getsid' entrypoint.
658 * @param argc Standard main() style argc.
659 * @param argv Standard main() style argv. Initial components are already
660 * stripped.
661 **/
662
663 int net_rpc_getsid(struct net_context *c, int argc, const char **argv)
664 {
665 int conn_flags = NET_FLAGS_PDC;
666
667 if (!c->opt_user_specified) {
668 conn_flags |= NET_FLAGS_ANONYMOUS;
669 }
670
671 if (c->display_usage) {
672 d_printf( "%s\n"
673 "net rpc getsid\n"
674 " %s\n",
675 _("Usage:"),
676 _("Fetch domain SID into local secrets.tdb"));
677 return 0;
678 }
679
680 return run_rpc_command(c, NULL, &ndr_table_samr,
681 conn_flags,
682 rpc_getsid_internals,
683 argc, argv);
684 }
685
686 /****************************************************************************/
687
688 /**
689 * Basic usage function for 'net rpc user'.
690 * @param argc Standard main() style argc.
691 * @param argv Standard main() style argv. Initial components are already
692 * stripped.
693 **/
694
695 static int rpc_user_usage(struct net_context *c, int argc, const char **argv)
696 {
697 return net_user_usage(c, argc, argv);
698 }
699
700 /**
701 * Add a new user to a remote RPC server.
702 *
703 * @param argc Standard main() style argc.
704 * @param argv Standard main() style argv. Initial components are already
705 * stripped.
706 *
707 * @return A shell status integer (0 for success).
708 **/
709
710 static int rpc_user_add(struct net_context *c, int argc, const char **argv)
711 {
712 NET_API_STATUS status;
713 struct USER_INFO_1 info1;
714 uint32_t parm_error = 0;
715
716 if (argc < 1 || c->display_usage) {
717 rpc_user_usage(c, argc, argv);
718 return 0;
719 }
720
721 ZERO_STRUCT(info1);
722
723 info1.usri1_name = argv[0];
724 if (argc == 2) {
725 info1.usri1_password = argv[1];
726 }
727
728 status = NetUserAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
729
730 if (status != 0) {
731 d_fprintf(stderr,_("Failed to add user '%s' with error: %s.\n"),
732 argv[0], libnetapi_get_error_string(c->netapi_ctx,
733 status));
734 return -1;
735 } else {
736 d_printf(_("Added user '%s'.\n"), argv[0]);
737 }
738
739 return 0;
740 }
741
742 /**
743 * Rename a user on a remote RPC server.
744 *
745 * @param argc Standard main() style argc.
746 * @param argv Standard main() style argv. Initial components are already
747 * stripped.
748 *
749 * @return A shell status integer (0 for success).
750 **/
751
752 static int rpc_user_rename(struct net_context *c, int argc, const char **argv)
753 {
754 NET_API_STATUS status;
755 struct USER_INFO_0 u0;
756 uint32_t parm_err = 0;
757
758 if (argc != 2 || c->display_usage) {
759 rpc_user_usage(c, argc, argv);
760 return 0;
761 }
762
763 u0.usri0_name = argv[1];
764
765 status = NetUserSetInfo(c->opt_host, argv[0],
766 0, (uint8_t *)&u0, &parm_err);
767 if (status) {
768 d_fprintf(stderr,
769 _("Failed to rename user from %s to %s - %s\n"),
770 argv[0], argv[1],
771 libnetapi_get_error_string(c->netapi_ctx, status));
772 } else {
773 d_printf(_("Renamed user from %s to %s\n"), argv[0], argv[1]);
774 }
775
776 return status;
777 }
778
779 /**
780 * Set a user's primary group
781 *
782 * @param argc Standard main() style argc.
783 * @param argv Standard main() style argv. Initial components are already
784 * stripped.
785 *
786 * @return A shell status integer (0 for success).
787 **/
788
789 static int rpc_user_setprimarygroup(struct net_context *c, int argc,
790 const char **argv)
791 {
792 NET_API_STATUS status;
793 uint8_t *buffer;
794 struct GROUP_INFO_2 *g2;
795 struct USER_INFO_1051 u1051;
796 uint32_t parm_err = 0;
797
798 if (argc != 2 || c->display_usage) {
799 rpc_user_usage(c, argc, argv);
800 return 0;
801 }
802
803 status = NetGroupGetInfo(c->opt_host, argv[1], 2, &buffer);
804 if (status) {
805 d_fprintf(stderr, _("Failed to find group name %s -- %s\n"),
806 argv[1],
807 libnetapi_get_error_string(c->netapi_ctx, status));
808 return status;
809 }
810 g2 = (struct GROUP_INFO_2 *)buffer;
811
812 u1051.usri1051_primary_group_id = g2->grpi2_group_id;
813
814 NetApiBufferFree(buffer);
815
816 status = NetUserSetInfo(c->opt_host, argv[0], 1051,
817 (uint8_t *)&u1051, &parm_err);
818 if (status) {
819 d_fprintf(stderr,
820 _("Failed to set user's primary group %s to %s - "
821 "%s\n"), argv[0], argv[1],
822 libnetapi_get_error_string(c->netapi_ctx, status));
823 } else {
824 d_printf(_("Set primary group of user %s to %s\n"), argv[0],
825 argv[1]);
826 }
827 return status;
828 }
829
830 /**
831 * Delete a user from a remote RPC server.
832 *
833 * @param argc Standard main() style argc.
834 * @param argv Standard main() style argv. Initial components are already
835 * stripped.
836 *
837 * @return A shell status integer (0 for success).
838 **/
839
840 static int rpc_user_delete(struct net_context *c, int argc, const char **argv)
841 {
842 NET_API_STATUS status;
843
844 if (argc < 1 || c->display_usage) {
845 rpc_user_usage(c, argc, argv);
846 return 0;
847 }
848
849 status = NetUserDel(c->opt_host, argv[0]);
850
851 if (status != 0) {
852 d_fprintf(stderr, _("Failed to delete user '%s' with: %s.\n"),
853 argv[0],
854 libnetapi_get_error_string(c->netapi_ctx, status));
855 return -1;
856 } else {
857 d_printf(_("Deleted user '%s'.\n"), argv[0]);
858 }
859
860 return 0;
861 }
862
863 /**
864 * Set a user's password on a remote RPC server.
865 *
866 * @param argc Standard main() style argc.
867 * @param argv Standard main() style argv. Initial components are already
868 * stripped.
869 *
870 * @return A shell status integer (0 for success).
871 **/
872
873 static int rpc_user_password(struct net_context *c, int argc, const char **argv)
874 {
875 NET_API_STATUS status;
876 char *prompt = NULL;
877 struct USER_INFO_1003 u1003;
878 uint32_t parm_err = 0;
879 int ret;
880
881 if (argc < 1 || c->display_usage) {
882 rpc_user_usage(c, argc, argv);
883 return 0;
884 }
885
886 if (argv[1]) {
887 u1003.usri1003_password = argv[1];
888 } else {
889 char pwd[256] = {0};
890 ret = asprintf(&prompt, _("Enter new password for %s:"),
891 argv[0]);
892 if (ret == -1) {
893 return -1;
894 }
895
896 ret = samba_getpass(prompt, pwd, sizeof(pwd), false, false);
897 SAFE_FREE(prompt);
898 if (ret < 0) {
899 return -1;
900 }
901
902 u1003.usri1003_password = talloc_strdup(c, pwd);
903 if (u1003.usri1003_password == NULL) {
904 return -1;
905 }
906 }
907
908 status = NetUserSetInfo(c->opt_host, argv[0], 1003, (uint8_t *)&u1003, &parm_err);
909
910 /* Display results */
911 if (status != 0) {
912 d_fprintf(stderr,
913 _("Failed to set password for '%s' with error: %s.\n"),
914 argv[0], libnetapi_get_error_string(c->netapi_ctx,
915 status));
916 return -1;
917 }
918
919 return 0;
920 }
921
922 /**
923 * List a user's groups from a remote RPC server.
924 *
925 * @param argc Standard main() style argc.
926 * @param argv Standard main() style argv. Initial components are already
927 * stripped.
928 *
929 * @return A shell status integer (0 for success)
930 **/
931
932 static int rpc_user_info(struct net_context *c, int argc, const char **argv)
933
934 {
935 NET_API_STATUS status;
936 struct GROUP_USERS_INFO_0 *u0 = NULL;
937 uint32_t entries_read = 0;
938 uint32_t total_entries = 0;
939 int i;
940
941
942 if (argc < 1 || c->display_usage) {
943 rpc_user_usage(c, argc, argv);
944 return 0;
945 }
946
947 status = NetUserGetGroups(c->opt_host,
948 argv[0],
949 0,
950 (uint8_t **)(void *)&u0,
951 (uint32_t)-1,
952 &entries_read,
953 &total_entries);
954 if (status != 0) {
955 d_fprintf(stderr,
956 _("Failed to get groups for '%s' with error: %s.\n"),
957 argv[0], libnetapi_get_error_string(c->netapi_ctx,
958 status));
959 return -1;
960 }
961
962 for (i=0; i < entries_read; i++) {
963 printf("%s\n", u0->grui0_name);
964 u0++;
965 }
966
967 return 0;
968 }
969
970 /**
971 * List users on a remote RPC server.
972 *
973 * All parameters are provided by the run_rpc_command function, except for
974 * argc, argv which are passed through.
975 *
976 * @param domain_sid The domain sid acquired from the remote server.
977 * @param cli A cli_state connected to the server.
978 * @param mem_ctx Talloc context, destroyed on completion of the function.
979 * @param argc Standard main() style argc.
980 * @param argv Standard main() style argv. Initial components are already
981 * stripped.
982 *
983 * @return Normal NTSTATUS return.
984 **/
985
986 static int rpc_user_list(struct net_context *c, int argc, const char **argv)
987 {
988 NET_API_STATUS status;
989 uint32_t start_idx=0, num_entries, i, loop_count = 0;
990 struct NET_DISPLAY_USER *info = NULL;
991 void *buffer = NULL;
992
993 /* Query domain users */
994 if (c->opt_long_list_entries)
995 d_printf(_("\nUser name Comment"
996 "\n-----------------------------\n"));
997 do {
998 uint32_t max_entries, max_size;
999
1000 dcerpc_get_query_dispinfo_params(
1001 loop_count, &max_entries, &max_size);
1002
1003 status = NetQueryDisplayInformation(c->opt_host,
1004 1,
1005 start_idx,
1006 max_entries,
1007 max_size,
1008 &num_entries,
1009 &buffer);
1010 if (status != 0 && status != ERROR_MORE_DATA) {
1011 return status;
1012 }
1013
1014 info = (struct NET_DISPLAY_USER *)buffer;
1015
1016 for (i = 0; i < num_entries; i++) {
1017
1018 if (c->opt_long_list_entries)
1019 printf("%-21.21s %s\n", info->usri1_name,
1020 info->usri1_comment);
1021 else
1022 printf("%s\n", info->usri1_name);
1023 info++;
1024 }
1025
1026 NetApiBufferFree(buffer);
1027
1028 loop_count++;
1029 start_idx += num_entries;
1030
1031 } while (status == ERROR_MORE_DATA);
1032
1033 return status;
1034 }
1035
1036 /**
1037 * 'net rpc user' entrypoint.
1038 * @param argc Standard main() style argc.
1039 * @param argv Standard main() style argv. Initial components are already
1040 * stripped.
1041 **/
1042
1043 int net_rpc_user(struct net_context *c, int argc, const char **argv)
1044 {
1045 NET_API_STATUS status;
1046
1047 struct functable func[] = {
1048 {
1049 "add",
1050 rpc_user_add,
1051 NET_TRANSPORT_RPC,
1052 N_("Add specified user"),
1053 N_("net rpc user add\n"
1054 " Add specified user")
1055 },
1056 {
1057 "info",
1058 rpc_user_info,
1059 NET_TRANSPORT_RPC,
1060 N_("List domain groups of user"),
1061 N_("net rpc user info\n"
1062 " List domain groups of user")
1063 },
1064 {
1065 "delete",
1066 rpc_user_delete,
1067 NET_TRANSPORT_RPC,
1068 N_("Remove specified user"),
1069 N_("net rpc user delete\n"
1070 " Remove specified user")
1071 },
1072 {
1073 "password",
1074 rpc_user_password,
1075 NET_TRANSPORT_RPC,
1076 N_("Change user password"),
1077 N_("net rpc user password\n"
1078 " Change user password")
1079 },
1080 {
1081 "rename",
1082 rpc_user_rename,
1083 NET_TRANSPORT_RPC,
1084 N_("Rename specified user"),
1085 N_("net rpc user rename\n"
1086 " Rename specified user")
1087 },
1088 {
1089 "setprimarygroup",
1090 rpc_user_setprimarygroup,
1091 NET_TRANSPORT_RPC,
1092 "Set a user's primary group",
1093 "net rpc user setprimarygroup\n"
1094 " Set a user's primary group"
1095 },
1096 {NULL, NULL, 0, NULL, NULL}
1097 };
1098
1099 status = libnetapi_net_init(&c->netapi_ctx);
1100 if (status != 0) {
1101 return -1;
1102 }
1103 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
1104 libnetapi_set_password(c->netapi_ctx, c->opt_password);
1105 if (c->opt_kerberos) {
1106 libnetapi_set_use_kerberos(c->netapi_ctx);
1107 }
1108
1109 if (argc == 0) {
1110 if (c->display_usage) {
1111 d_printf( "%s\n"
1112 "net rpc user\n"
1113 " %s\n",
1114 _("Usage:"),
1115 _("List all users"));
1116 net_display_usage_from_functable(func);
1117 return 0;
1118 }
1119
1120 return rpc_user_list(c, argc, argv);
1121 }
1122
1123 return net_run_function(c, argc, argv, "net rpc user", func);
1124 }
1125
1126 static NTSTATUS rpc_sh_user_list(struct net_context *c,
1127 TALLOC_CTX *mem_ctx,
1128 struct rpc_sh_ctx *ctx,
1129 struct rpc_pipe_client *pipe_hnd,
1130 int argc, const char **argv)
1131 {
1132 return werror_to_ntstatus(W_ERROR(rpc_user_list(c, argc, argv)));
1133 }
1134
1135 static NTSTATUS rpc_sh_user_info(struct net_context *c,
1136 TALLOC_CTX *mem_ctx,
1137 struct rpc_sh_ctx *ctx,
1138 struct rpc_pipe_client *pipe_hnd,
1139 int argc, const char **argv)
1140 {
1141 return werror_to_ntstatus(W_ERROR(rpc_user_info(c, argc, argv)));
1142 }
1143
1144 static NTSTATUS rpc_sh_handle_user(struct net_context *c,
1145 TALLOC_CTX *mem_ctx,
1146 struct rpc_sh_ctx *ctx,
1147 struct rpc_pipe_client *pipe_hnd,
1148 int argc, const char **argv,
1149 NTSTATUS (*fn)(
1150 struct net_context *c,
1151 TALLOC_CTX *mem_ctx,
1152 struct rpc_sh_ctx *ctx,
1153 struct rpc_pipe_client *pipe_hnd,
1154 struct policy_handle *user_hnd,
1155 int argc, const char **argv))
1156 {
1157 struct policy_handle connect_pol, domain_pol, user_pol;
1158 NTSTATUS status, result;
1159 struct dom_sid sid;
1160 uint32 rid;
1161 enum lsa_SidType type;
1162 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1163
1164 if (argc == 0) {
1165 d_fprintf(stderr, "%s %s <username>\n", _("Usage:"),
1166 ctx->whoami);
1167 return NT_STATUS_INVALID_PARAMETER;
1168 }
1169
1170 ZERO_STRUCT(connect_pol);
1171 ZERO_STRUCT(domain_pol);
1172 ZERO_STRUCT(user_pol);
1173
1174 status = net_rpc_lookup_name(c, mem_ctx, rpc_pipe_np_smb_conn(pipe_hnd),
1175 argv[0], NULL, NULL, &sid, &type);
1176 if (!NT_STATUS_IS_OK(status)) {
1177 d_fprintf(stderr, _("Could not lookup %s: %s\n"), argv[0],
1178 nt_errstr(status));
1179 goto done;
1180 }
1181
1182 if (type != SID_NAME_USER) {
1183 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
1184 sid_type_lookup(type));
1185 status = NT_STATUS_NO_SUCH_USER;
1186 goto done;
1187 }
1188
1189 if (!sid_peek_check_rid(ctx->domain_sid, &sid, &rid)) {
1190 d_fprintf(stderr, _("%s is not in our domain\n"), argv[0]);
1191 status = NT_STATUS_NO_SUCH_USER;
1192 goto done;
1193 }
1194
1195 status = dcerpc_samr_Connect2(b, mem_ctx,
1196 pipe_hnd->desthost,
1197 MAXIMUM_ALLOWED_ACCESS,
1198 &connect_pol,
1199 &result);
1200 if (!NT_STATUS_IS_OK(status)) {
1201 goto done;
1202 }
1203 if (!NT_STATUS_IS_OK(result)) {
1204 status = result;
1205 goto done;
1206 }
1207
1208 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1209 &connect_pol,
1210 MAXIMUM_ALLOWED_ACCESS,
1211 ctx->domain_sid,
1212 &domain_pol,
1213 &result);
1214 if (!NT_STATUS_IS_OK(status)) {
1215 goto done;
1216 }
1217 if (!NT_STATUS_IS_OK(result)) {
1218 status = result;
1219 goto done;
1220 }
1221
1222 status = dcerpc_samr_OpenUser(b, mem_ctx,
1223 &domain_pol,
1224 MAXIMUM_ALLOWED_ACCESS,
1225 rid,
1226 &user_pol,
1227 &result);
1228 if (!NT_STATUS_IS_OK(status)) {
1229 goto done;
1230 }
1231 if (!NT_STATUS_IS_OK(result)) {
1232 status = result;
1233 goto done;
1234 }
1235
1236 status = fn(c, mem_ctx, ctx, pipe_hnd, &user_pol, argc-1, argv+1);
1237
1238 done:
1239 if (is_valid_policy_hnd(&user_pol)) {
1240 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1241 }
1242 if (is_valid_policy_hnd(&domain_pol)) {
1243 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1244 }
1245 if (is_valid_policy_hnd(&connect_pol)) {
1246 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
1247 }
1248 return status;
1249 }
1250
1251 static NTSTATUS rpc_sh_user_show_internals(struct net_context *c,
1252 TALLOC_CTX *mem_ctx,
1253 struct rpc_sh_ctx *ctx,
1254 struct rpc_pipe_client *pipe_hnd,
1255 struct policy_handle *user_hnd,
1256 int argc, const char **argv)
1257 {
1258 NTSTATUS status, result;
1259 union samr_UserInfo *info = NULL;
1260 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1261
1262 if (argc != 0) {
1263 d_fprintf(stderr, "%s %s show <username>\n", _("Usage:"),
1264 ctx->whoami);
1265 return NT_STATUS_INVALID_PARAMETER;
1266 }
1267
1268 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1269 user_hnd,
1270 21,
1271 &info,
1272 &result);
1273 if (!NT_STATUS_IS_OK(status)) {
1274 return status;
1275 }
1276 if (!NT_STATUS_IS_OK(result)) {
1277 return result;
1278 }
1279
1280 d_printf(_("user rid: %d, group rid: %d\n"),
1281 info->info21.rid,
1282 info->info21.primary_gid);
1283
1284 return result;
1285 }
1286
1287 static NTSTATUS rpc_sh_user_show(struct net_context *c,
1288 TALLOC_CTX *mem_ctx,
1289 struct rpc_sh_ctx *ctx,
1290 struct rpc_pipe_client *pipe_hnd,
1291 int argc, const char **argv)
1292 {
1293 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1294 rpc_sh_user_show_internals);
1295 }
1296
1297 #define FETCHSTR(name, rec) \
1298 do { if (strequal(ctx->thiscmd, name)) { \
1299 oldval = talloc_strdup(mem_ctx, info->info21.rec.string); } \
1300 } while (0);
1301
1302 #define SETSTR(name, rec, flag) \
1303 do { if (strequal(ctx->thiscmd, name)) { \
1304 init_lsa_String(&(info->info21.rec), argv[0]); \
1305 info->info21.fields_present |= SAMR_FIELD_##flag; } \
1306 } while (0);
1307
1308 static NTSTATUS rpc_sh_user_str_edit_internals(struct net_context *c,
1309 TALLOC_CTX *mem_ctx,
1310 struct rpc_sh_ctx *ctx,
1311 struct rpc_pipe_client *pipe_hnd,
1312 struct policy_handle *user_hnd,
1313 int argc, const char **argv)
1314 {
1315 NTSTATUS status, result;
1316 const char *username;
1317 const char *oldval = "";
1318 union samr_UserInfo *info = NULL;
1319 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1320
1321 if (argc > 1) {
1322 d_fprintf(stderr, "%s %s <username> [new value|NULL]\n",
1323 _("Usage:"), ctx->whoami);
1324 return NT_STATUS_INVALID_PARAMETER;
1325 }
1326
1327 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1328 user_hnd,
1329 21,
1330 &info,
1331 &result);
1332 if (!NT_STATUS_IS_OK(status)) {
1333 return status;
1334 }
1335 if (!NT_STATUS_IS_OK(result)) {
1336 return result;
1337 }
1338
1339 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1340
1341 FETCHSTR("fullname", full_name);
1342 FETCHSTR("homedir", home_directory);
1343 FETCHSTR("homedrive", home_drive);
1344 FETCHSTR("logonscript", logon_script);
1345 FETCHSTR("profilepath", profile_path);
1346 FETCHSTR("description", description);
1347
1348 if (argc == 0) {
1349 d_printf(_("%s's %s: [%s]\n"), username, ctx->thiscmd, oldval);
1350 goto done;
1351 }
1352
1353 if (strcmp(argv[0], "NULL") == 0) {
1354 argv[0] = "";
1355 }
1356
1357 ZERO_STRUCT(info->info21);
1358
1359 SETSTR("fullname", full_name, FULL_NAME);
1360 SETSTR("homedir", home_directory, HOME_DIRECTORY);
1361 SETSTR("homedrive", home_drive, HOME_DRIVE);
1362 SETSTR("logonscript", logon_script, LOGON_SCRIPT);
1363 SETSTR("profilepath", profile_path, PROFILE_PATH);
1364 SETSTR("description", description, DESCRIPTION);
1365
1366 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1367 user_hnd,
1368 21,
1369 info,
1370 &result);
1371 if (!NT_STATUS_IS_OK(status)) {
1372 return status;
1373 }
1374
1375 status = result;
1376
1377 d_printf(_("Set %s's %s from [%s] to [%s]\n"), username,
1378 ctx->thiscmd, oldval, argv[0]);
1379
1380 done:
1381
1382 return status;
1383 }
1384
1385 #define HANDLEFLG(name, rec) \
1386 do { if (strequal(ctx->thiscmd, name)) { \
1387 oldval = (oldflags & ACB_##rec) ? "yes" : "no"; \
1388 if (newval) { \
1389 newflags = oldflags | ACB_##rec; \
1390 } else { \
1391 newflags = oldflags & ~ACB_##rec; \
1392 } } } while (0);
1393
1394 static NTSTATUS rpc_sh_user_str_edit(struct net_context *c,
1395 TALLOC_CTX *mem_ctx,
1396 struct rpc_sh_ctx *ctx,
1397 struct rpc_pipe_client *pipe_hnd,
1398 int argc, const char **argv)
1399 {
1400 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1401 rpc_sh_user_str_edit_internals);
1402 }
1403
1404 static NTSTATUS rpc_sh_user_flag_edit_internals(struct net_context *c,
1405 TALLOC_CTX *mem_ctx,
1406 struct rpc_sh_ctx *ctx,
1407 struct rpc_pipe_client *pipe_hnd,
1408 struct policy_handle *user_hnd,
1409 int argc, const char **argv)
1410 {
1411 NTSTATUS status, result;
1412 const char *username;
1413 const char *oldval = "unknown";
1414 uint32 oldflags, newflags;
1415 bool newval;
1416 union samr_UserInfo *info = NULL;
1417 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1418
1419 if ((argc > 1) ||
1420 ((argc == 1) && !strequal(argv[0], "yes") &&
1421 !strequal(argv[0], "no"))) {
1422 /* TRANSATORS: The yes|no here are program keywords. Please do
1423 not translate. */
1424 d_fprintf(stderr, _("Usage: %s <username> [yes|no]\n"),
1425 ctx->whoami);
1426 return NT_STATUS_INVALID_PARAMETER;
1427 }
1428
1429 newval = strequal(argv[0], "yes");
1430
1431 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1432 user_hnd,
1433 21,
1434 &info,
1435 &result);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 return status;
1438 }
1439 if (!NT_STATUS_IS_OK(result)) {
1440 return result;
1441 }
1442
1443 username = talloc_strdup(mem_ctx, info->info21.account_name.string);
1444 oldflags = info->info21.acct_flags;
1445 newflags = info->info21.acct_flags;
1446
1447 HANDLEFLG("disabled", DISABLED);
1448 HANDLEFLG("pwnotreq", PWNOTREQ);
1449 HANDLEFLG("autolock", AUTOLOCK);
1450 HANDLEFLG("pwnoexp", PWNOEXP);
1451
1452 if (argc == 0) {
1453 d_printf(_("%s's %s flag: %s\n"), username, ctx->thiscmd,
1454 oldval);
1455 goto done;
1456 }
1457
1458 ZERO_STRUCT(info->info21);
1459
1460 info->info21.acct_flags = newflags;
1461 info->info21.fields_present = SAMR_FIELD_ACCT_FLAGS;
1462
1463 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1464 user_hnd,
1465 21,
1466 info,
1467 &result);
1468 if (!NT_STATUS_IS_OK(status)) {
1469 goto done;
1470 }
1471 status = result;
1472 if (NT_STATUS_IS_OK(result)) {
1473 d_printf(_("Set %s's %s flag from [%s] to [%s]\n"), username,
1474 ctx->thiscmd, oldval, argv[0]);
1475 }
1476
1477 done:
1478
1479 return status;
1480 }
1481
1482 static NTSTATUS rpc_sh_user_flag_edit(struct net_context *c,
1483 TALLOC_CTX *mem_ctx,
1484 struct rpc_sh_ctx *ctx,
1485 struct rpc_pipe_client *pipe_hnd,
1486 int argc, const char **argv)
1487 {
1488 return rpc_sh_handle_user(c, mem_ctx, ctx, pipe_hnd, argc, argv,
1489 rpc_sh_user_flag_edit_internals);
1490 }
1491
1492 struct rpc_sh_cmd *net_rpc_user_edit_cmds(struct net_context *c,
1493 TALLOC_CTX *mem_ctx,
1494 struct rpc_sh_ctx *ctx)
1495 {
1496 static struct rpc_sh_cmd cmds[] = {
1497
1498 { "fullname", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1499 N_("Show/Set a user's full name") },
1500
1501 { "homedir", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1502 N_("Show/Set a user's home directory") },
1503
1504 { "homedrive", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1505 N_("Show/Set a user's home drive") },
1506
1507 { "logonscript", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1508 N_("Show/Set a user's logon script") },
1509
1510 { "profilepath", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1511 N_("Show/Set a user's profile path") },
1512
1513 { "description", NULL, &ndr_table_samr, rpc_sh_user_str_edit,
1514 N_("Show/Set a user's description") },
1515
1516 { "disabled", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1517 N_("Show/Set whether a user is disabled") },
1518
1519 { "autolock", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1520 N_("Show/Set whether a user locked out") },
1521
1522 { "pwnotreq", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1523 N_("Show/Set whether a user does not need a password") },
1524
1525 { "pwnoexp", NULL, &ndr_table_samr, rpc_sh_user_flag_edit,
1526 N_("Show/Set whether a user's password does not expire") },
1527
1528 { NULL, NULL, 0, NULL, NULL }
1529 };
1530
1531 return cmds;
1532 }
1533
1534 struct rpc_sh_cmd *net_rpc_user_cmds(struct net_context *c,
1535 TALLOC_CTX *mem_ctx,
1536 struct rpc_sh_ctx *ctx)
1537 {
1538 static struct rpc_sh_cmd cmds[] = {
1539
1540 { "list", NULL, &ndr_table_samr, rpc_sh_user_list,
1541 N_("List available users") },
1542
1543 { "info", NULL, &ndr_table_samr, rpc_sh_user_info,
1544 N_("List the domain groups a user is member of") },
1545
1546 { "show", NULL, &ndr_table_samr, rpc_sh_user_show,
1547 N_("Show info about a user") },
1548
1549 { "edit", net_rpc_user_edit_cmds, 0, NULL,
1550 N_("Show/Modify a user's fields") },
1551
1552 { NULL, NULL, 0, NULL, NULL }
1553 };
1554
1555 return cmds;
1556 }
1557
1558 /****************************************************************************/
1559
1560 /**
1561 * Basic usage function for 'net rpc group'.
1562 * @param argc Standard main() style argc.
1563 * @param argv Standard main() style argv. Initial components are already
1564 * stripped.
1565 **/
1566
1567 static int rpc_group_usage(struct net_context *c, int argc, const char **argv)
1568 {
1569 return net_group_usage(c, argc, argv);
1570 }
1571
1572 /**
1573 * Delete group on a remote RPC server.
1574 *
1575 * All parameters are provided by the run_rpc_command function, except for
1576 * argc, argv which are passed through.
1577 *
1578 * @param domain_sid The domain sid acquired from the remote server.
1579 * @param cli A cli_state connected to the server.
1580 * @param mem_ctx Talloc context, destroyed on completion of the function.
1581 * @param argc Standard main() style argc.
1582 * @param argv Standard main() style argv. Initial components are already
1583 * stripped.
1584 *
1585 * @return Normal NTSTATUS return.
1586 **/
1587
1588 static NTSTATUS rpc_group_delete_internals(struct net_context *c,
1589 const struct dom_sid *domain_sid,
1590 const char *domain_name,
1591 struct cli_state *cli,
1592 struct rpc_pipe_client *pipe_hnd,
1593 TALLOC_CTX *mem_ctx,
1594 int argc,
1595 const char **argv)
1596 {
1597 struct policy_handle connect_pol, domain_pol, group_pol, user_pol;
1598 bool group_is_primary = false;
1599 NTSTATUS status, result;
1600 uint32_t group_rid;
1601 struct samr_RidAttrArray *rids = NULL;
1602 /* char **names; */
1603 int i;
1604 /* struct samr_RidWithAttribute *user_gids; */
1605 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
1606
1607 struct samr_Ids group_rids, name_types;
1608 struct lsa_String lsa_acct_name;
1609 union samr_UserInfo *info = NULL;
1610
1611 if (argc < 1 || c->display_usage) {
1612 rpc_group_usage(c, argc,argv);
1613 return NT_STATUS_OK; /* ok? */
1614 }
1615
1616 status = dcerpc_samr_Connect2(b, mem_ctx,
1617 pipe_hnd->desthost,
1618 MAXIMUM_ALLOWED_ACCESS,
1619 &connect_pol,
1620 &result);
1621 if (!NT_STATUS_IS_OK(status)) {
1622 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1623 goto done;
1624 }
1625
1626 if (!NT_STATUS_IS_OK(result)) {
1627 status = result;
1628 d_fprintf(stderr, _("Request samr_Connect2 failed\n"));
1629 goto done;
1630 }
1631
1632 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1633 &connect_pol,
1634 MAXIMUM_ALLOWED_ACCESS,
1635 discard_const_p(struct dom_sid2, domain_sid),
1636 &domain_pol,
1637 &result);
1638 if (!NT_STATUS_IS_OK(status)) {
1639 d_fprintf(stderr, _("Request open_domain failed\n"));
1640 goto done;
1641 }
1642
1643 if (!NT_STATUS_IS_OK(result)) {
1644 status = result;
1645 d_fprintf(stderr, _("Request open_domain failed\n"));
1646 goto done;
1647 }
1648
1649 init_lsa_String(&lsa_acct_name, argv[0]);
1650
1651 status = dcerpc_samr_LookupNames(b, mem_ctx,
1652 &domain_pol,
1653 1,
1654 &lsa_acct_name,
1655 &group_rids,
1656 &name_types,
1657 &result);
1658 if (!NT_STATUS_IS_OK(status)) {
1659 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1660 goto done;
1661 }
1662
1663 if (!NT_STATUS_IS_OK(result)) {
1664 status = result;
1665 d_fprintf(stderr, _("Lookup of '%s' failed\n"),argv[0]);
1666 goto done;
1667 }
1668
1669 switch (name_types.ids[0])
1670 {
1671 case SID_NAME_DOM_GRP:
1672 status = dcerpc_samr_OpenGroup(b, mem_ctx,
1673 &domain_pol,
1674 MAXIMUM_ALLOWED_ACCESS,
1675 group_rids.ids[0],
1676 &group_pol,
1677 &result);
1678 if (!NT_STATUS_IS_OK(status)) {
1679 d_fprintf(stderr, _("Request open_group failed"));
1680 goto done;
1681 }
1682
1683 if (!NT_STATUS_IS_OK(result)) {
1684 status = result;
1685 d_fprintf(stderr, _("Request open_group failed"));
1686 goto done;
1687 }
1688
1689 group_rid = group_rids.ids[0];
1690
1691 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
1692 &group_pol,
1693 &rids,
1694 &result);
1695 if (!NT_STATUS_IS_OK(status)) {
1696 d_fprintf(stderr,
1697 _("Unable to query group members of %s"),
1698 argv[0]);
1699 goto done;
1700 }
1701
1702 if (!NT_STATUS_IS_OK(result)) {
1703 status = result;
1704 d_fprintf(stderr,
1705 _("Unable to query group members of %s"),
1706 argv[0]);
1707 goto done;
1708 }
1709
1710 if (c->opt_verbose) {
1711 d_printf(
1712 _("Domain Group %s (rid: %d) has %d members\n"),
1713 argv[0],group_rid, rids->count);
1714 }
1715
1716 /* Check if group is anyone's primary group */
1717 for (i = 0; i < rids->count; i++)
1718 {
1719 status = dcerpc_samr_OpenUser(b, mem_ctx,
1720 &domain_pol,
1721 MAXIMUM_ALLOWED_ACCESS,
1722 rids->rids[i],
1723 &user_pol,
1724 &result);
1725 if (!NT_STATUS_IS_OK(status)) {
1726 d_fprintf(stderr,
1727 _("Unable to open group member %d\n"),
1728 rids->rids[i]);
1729 goto done;
1730 }
1731
1732 if (!NT_STATUS_IS_OK(result)) {
1733 status = result;
1734 d_fprintf(stderr,
1735 _("Unable to open group member %d\n"),
1736 rids->rids[i]);
1737 goto done;
1738 }
1739
1740 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1741 &user_pol,
1742 21,
1743 &info,
1744 &result);
1745 if (!NT_STATUS_IS_OK(status)) {
1746 d_fprintf(stderr,
1747 _("Unable to lookup userinfo for group "
1748 "member %d\n"),
1749 rids->rids[i]);
1750 goto done;
1751 }
1752
1753 if (!NT_STATUS_IS_OK(result)) {
1754 status = result;
1755 d_fprintf(stderr,
1756 _("Unable to lookup userinfo for group "
1757 "member %d\n"),
1758 rids->rids[i]);
1759 goto done;
1760 }
1761
1762 if (info->info21.primary_gid == group_rid) {
1763 if (c->opt_verbose) {
1764 d_printf(_("Group is primary group "
1765 "of %s\n"),
1766 info->info21.account_name.string);
1767 }
1768 group_is_primary = true;
1769 }
1770
1771 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1772 }
1773
1774 if (group_is_primary) {
1775 d_fprintf(stderr, _("Unable to delete group because "
1776 "some of it's members have it as primary "
1777 "group\n"));
1778 status = NT_STATUS_MEMBERS_PRIMARY_GROUP;
1779 goto done;
1780 }
1781
1782 /* remove all group members */
1783 for (i = 0; i < rids->count; i++)
1784 {
1785 if (c->opt_verbose)
1786 d_printf(_("Remove group member %d..."),
1787 rids->rids[i]);
1788 status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
1789 &group_pol,
1790 rids->rids[i],
1791 &result);
1792 if (!NT_STATUS_IS_OK(status)) {
1793 goto done;
1794 }
1795 status = result;
1796 if (NT_STATUS_IS_OK(result)) {
1797 if (c->opt_verbose)
1798 d_printf(_("ok\n"));
1799 } else {
1800 if (c->opt_verbose)
1801 d_printf("%s\n", _("failed"));
1802 goto done;
1803 }
1804 }
1805
1806 status = dcerpc_samr_DeleteDomainGroup(b, mem_ctx,
1807 &group_pol,
1808 &result);
1809 if (!NT_STATUS_IS_OK(status)) {
1810 break;
1811 }
1812
1813 status = result;
1814
1815 break;
1816 /* removing a local group is easier... */
1817 case SID_NAME_ALIAS:
1818 status = dcerpc_samr_OpenAlias(b, mem_ctx,
1819 &domain_pol,
1820 MAXIMUM_ALLOWED_ACCESS,
1821 group_rids.ids[0],
1822 &group_pol,
1823 &result);
1824 if (!NT_STATUS_IS_OK(status)) {
1825 d_fprintf(stderr, _("Request open_alias failed\n"));
1826 goto done;
1827 }
1828 if (!NT_STATUS_IS_OK(result)) {
1829 status = result;
1830 d_fprintf(stderr, _("Request open_alias failed\n"));
1831 goto done;
1832 }
1833
1834 status = dcerpc_samr_DeleteDomAlias(b, mem_ctx,
1835 &group_pol,
1836 &result);
1837 if (!NT_STATUS_IS_OK(status)) {
1838 break;
1839 }
1840
1841 status = result;
1842
1843 break;
1844 default:
1845 d_fprintf(stderr, _("%s is of type %s. This command is only "
1846 "for deleting local or global groups\n"),
1847 argv[0],sid_type_lookup(name_types.ids[0]));
1848 status = NT_STATUS_UNSUCCESSFUL;
1849 goto done;
1850 }
1851
1852 if (NT_STATUS_IS_OK(status)) {
1853 if (c->opt_verbose)
1854 d_printf(_("Deleted %s '%s'\n"),
1855 sid_type_lookup(name_types.ids[0]), argv[0]);
1856 } else {
1857 d_fprintf(stderr, _("Deleting of %s failed: %s\n"), argv[0],
1858 get_friendly_nt_error_msg(status));
1859 }
1860
1861 done:
1862 return status;
1863
1864 }
1865
1866 static int rpc_group_delete(struct net_context *c, int argc, const char **argv)
1867 {
1868 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
1869 rpc_group_delete_internals, argc,argv);
1870 }
1871
1872 static int rpc_group_add_internals(struct net_context *c, int argc, const char **argv)
1873 {
1874 NET_API_STATUS status;
1875 struct GROUP_INFO_1 info1;
1876 uint32_t parm_error = 0;
1877
1878 if (argc != 1 || c->display_usage) {
1879 rpc_group_usage(c, argc, argv);
1880 return 0;
1881 }
1882
1883 ZERO_STRUCT(info1);
1884
1885 info1.grpi1_name = argv[0];
1886 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1887 info1.grpi1_comment = c->opt_comment;
1888 }
1889
1890 status = NetGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1891
1892 if (status != 0) {
1893 d_fprintf(stderr,
1894 _("Failed to add group '%s' with error: %s.\n"),
1895 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1896 status));
1897 return -1;
1898 } else {
1899 d_printf(_("Added group '%s'.\n"), argv[0]);
1900 }
1901
1902 return 0;
1903 }
1904
1905 static int rpc_alias_add_internals(struct net_context *c, int argc, const char **argv)
1906 {
1907 NET_API_STATUS status;
1908 struct LOCALGROUP_INFO_1 info1;
1909 uint32_t parm_error = 0;
1910
1911 if (argc != 1 || c->display_usage) {
1912 rpc_group_usage(c, argc, argv);
1913 return 0;
1914 }
1915
1916 ZERO_STRUCT(info1);
1917
1918 info1.lgrpi1_name = argv[0];
1919 if (c->opt_comment && strlen(c->opt_comment) > 0) {
1920 info1.lgrpi1_comment = c->opt_comment;
1921 }
1922
1923 status = NetLocalGroupAdd(c->opt_host, 1, (uint8_t *)&info1, &parm_error);
1924
1925 if (status != 0) {
1926 d_fprintf(stderr,
1927 _("Failed to add alias '%s' with error: %s.\n"),
1928 argv[0], libnetapi_get_error_string(c->netapi_ctx,
1929 status));
1930 return -1;
1931 } else {
1932 d_printf(_("Added alias '%s'.\n"), argv[0]);
1933 }
1934
1935 return 0;
1936 }
1937
1938 static int rpc_group_add(struct net_context *c, int argc, const char **argv)
1939 {
1940 if (c->opt_localgroup)
1941 return rpc_alias_add_internals(c, argc, argv);
1942
1943 return rpc_group_add_internals(c, argc, argv);
1944 }
1945
1946 static NTSTATUS get_sid_from_name(struct cli_state *cli,
1947 TALLOC_CTX *mem_ctx,
1948 const char *name,
1949 struct dom_sid *sid,
1950 enum lsa_SidType *type)
1951 {
1952 struct dom_sid *sids = NULL;
1953 enum lsa_SidType *types = NULL;
1954 struct rpc_pipe_client *pipe_hnd = NULL;
1955 struct policy_handle lsa_pol;
1956 NTSTATUS status, result;
1957 struct dcerpc_binding_handle *b;
1958
1959 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
1960 &pipe_hnd);
1961 if (!NT_STATUS_IS_OK(status)) {
1962 goto done;
1963 }
1964
1965 b = pipe_hnd->binding_handle;
1966
1967 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, false,
1968 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
1969
1970 if (!NT_STATUS_IS_OK(status)) {
1971 goto done;
1972 }
1973
1974 status = rpccli_lsa_lookup_names(pipe_hnd, mem_ctx, &lsa_pol, 1,
1975 &name, NULL, 1, &sids, &types);
1976
1977 if (NT_STATUS_IS_OK(status)) {
1978 sid_copy(sid, &sids[0]);
1979 *type = types[0];
1980 }
1981
1982 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
1983
1984 done:
1985 if (pipe_hnd) {
1986 TALLOC_FREE(pipe_hnd);
1987 }
1988
1989 if (!NT_STATUS_IS_OK(status) && (strncasecmp_m(name, "S-", 2) == 0)) {
1990
1991 /* Try as S-1-5-whatever */
1992
1993 struct dom_sid tmp_sid;
1994
1995 if (string_to_sid(&tmp_sid, name)) {
1996 sid_copy(sid, &tmp_sid);
1997 *type = SID_NAME_UNKNOWN;
1998 status = NT_STATUS_OK;
1999 }
2000 }
2001
2002 return status;
2003 }
2004
2005 static NTSTATUS rpc_add_groupmem(struct rpc_pipe_client *pipe_hnd,
2006 TALLOC_CTX *mem_ctx,
2007 const struct dom_sid *group_sid,
2008 const char *member)
2009 {
2010 struct policy_handle connect_pol, domain_pol;
2011 NTSTATUS status, result;
2012 uint32 group_rid;
2013 struct policy_handle group_pol;
2014 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2015
2016 struct samr_Ids rids, rid_types;
2017 struct lsa_String lsa_acct_name;
2018
2019 struct dom_sid sid;
2020
2021 sid_copy(&sid, group_sid);
2022
2023 if (!sid_split_rid(&sid, &group_rid)) {
2024 return NT_STATUS_UNSUCCESSFUL;
2025 }
2026
2027 /* Get sam policy handle */
2028 status = dcerpc_samr_Connect2(b, mem_ctx,
2029 pipe_hnd->desthost,
2030 MAXIMUM_ALLOWED_ACCESS,
2031 &connect_pol,
2032 &result);
2033 if (!NT_STATUS_IS_OK(status)) {
2034 return status;
2035 }
2036 if (!NT_STATUS_IS_OK(result)) {
2037 return result;
2038 }
2039
2040 /* Get domain policy handle */
2041 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2042 &connect_pol,
2043 MAXIMUM_ALLOWED_ACCESS,
2044 &sid,
2045 &domain_pol,
2046 &result);
2047 if (!NT_STATUS_IS_OK(status)) {
2048 return status;
2049 }
2050 if (!NT_STATUS_IS_OK(result)) {
2051 return result;
2052 }
2053
2054 init_lsa_String(&lsa_acct_name, member);
2055
2056 status = dcerpc_samr_LookupNames(b, mem_ctx,
2057 &domain_pol,
2058 1,
2059 &lsa_acct_name,
2060 &rids,
2061 &rid_types,
2062 &result);
2063 if (!NT_STATUS_IS_OK(status)) {
2064 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2065 member);
2066 goto done;
2067 }
2068
2069 if (!NT_STATUS_IS_OK(result)) {
2070 status = result;
2071 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2072 member);
2073 goto done;
2074 }
2075
2076 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2077 &domain_pol,
2078 MAXIMUM_ALLOWED_ACCESS,
2079 group_rid,
2080 &group_pol,
2081 &result);
2082 if (!NT_STATUS_IS_OK(status)) {
2083 goto done;
2084 }
2085
2086 if (!NT_STATUS_IS_OK(result)) {
2087 status = result;
2088 goto done;
2089 }
2090
2091 status = dcerpc_samr_AddGroupMember(b, mem_ctx,
2092 &group_pol,
2093 rids.ids[0],
2094 0x0005, /* unknown flags */
2095 &result);
2096 if (!NT_STATUS_IS_OK(status)) {
2097 goto done;
2098 }
2099
2100 status = result;
2101
2102 done:
2103 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2104 return status;
2105 }
2106
2107 static NTSTATUS rpc_add_aliasmem(struct rpc_pipe_client *pipe_hnd,
2108 TALLOC_CTX *mem_ctx,
2109 const struct dom_sid *alias_sid,
2110 const char *member)
2111 {
2112 struct policy_handle connect_pol, domain_pol;
2113 NTSTATUS status, result;
2114 uint32 alias_rid;
2115 struct policy_handle alias_pol;
2116 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2117
2118 struct dom_sid member_sid;
2119 enum lsa_SidType member_type;
2120
2121 struct dom_sid sid;
2122
2123 sid_copy(&sid, alias_sid);
2124
2125 if (!sid_split_rid(&sid, &alias_rid)) {
2126 return NT_STATUS_UNSUCCESSFUL;
2127 }
2128
2129 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
2130 member, &member_sid, &member_type);
2131
2132 if (!NT_STATUS_IS_OK(result)) {
2133 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2134 member);
2135 return result;
2136 }
2137
2138 /* Get sam policy handle */
2139 status = dcerpc_samr_Connect2(b, mem_ctx,
2140 pipe_hnd->desthost,
2141 MAXIMUM_ALLOWED_ACCESS,
2142 &connect_pol,
2143 &result);
2144 if (!NT_STATUS_IS_OK(status)) {
2145 goto done;
2146 }
2147 if (!NT_STATUS_IS_OK(result)) {
2148 status = result;
2149 goto done;
2150 }
2151
2152 /* Get domain policy handle */
2153 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2154 &connect_pol,
2155 MAXIMUM_ALLOWED_ACCESS,
2156 &sid,
2157 &domain_pol,
2158 &result);
2159 if (!NT_STATUS_IS_OK(status)) {
2160 goto done;
2161 }
2162 if (!NT_STATUS_IS_OK(result)) {
2163 status = result;
2164 goto done;
2165 }
2166
2167 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2168 &domain_pol,
2169 MAXIMUM_ALLOWED_ACCESS,
2170 alias_rid,
2171 &alias_pol,
2172 &result);
2173 if (!NT_STATUS_IS_OK(status)) {
2174 return status;
2175 }
2176 if (!NT_STATUS_IS_OK(result)) {
2177 return result;
2178 }
2179
2180 status = dcerpc_samr_AddAliasMember(b, mem_ctx,
2181 &alias_pol,
2182 &member_sid,
2183 &result);
2184 if (!NT_STATUS_IS_OK(status)) {
2185 return status;
2186 }
2187
2188 status = result;
2189
2190 done:
2191 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2192 return status;
2193 }
2194
2195 static NTSTATUS rpc_group_addmem_internals(struct net_context *c,
2196 const struct dom_sid *domain_sid,
2197 const char *domain_name,
2198 struct cli_state *cli,
2199 struct rpc_pipe_client *pipe_hnd,
2200 TALLOC_CTX *mem_ctx,
2201 int argc,
2202 const char **argv)
2203 {
2204 struct dom_sid group_sid;
2205 enum lsa_SidType group_type;
2206
2207 if (argc != 2 || c->display_usage) {
2208 d_printf("%s\n%s",
2209 _("Usage:"),
2210 _("net rpc group addmem <group> <member>\n"
2211 " Add a member to a group\n"
2212 " group\tGroup to add member to\n"
2213 " member\tMember to add to group\n"));
2214 return NT_STATUS_UNSUCCESSFUL;
2215 }
2216
2217 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2218 &group_sid, &group_type))) {
2219 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2220 argv[0]);
2221 return NT_STATUS_UNSUCCESSFUL;
2222 }
2223
2224 if (group_type == SID_NAME_DOM_GRP) {
2225 NTSTATUS result = rpc_add_groupmem(pipe_hnd, mem_ctx,
2226 &group_sid, argv[1]);
2227
2228 if (!NT_STATUS_IS_OK(result)) {
2229 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2230 argv[1], argv[0], nt_errstr(result));
2231 }
2232 return result;
2233 }
2234
2235 if (group_type == SID_NAME_ALIAS) {
2236 NTSTATUS result = rpc_add_aliasmem(pipe_hnd, mem_ctx,
2237 &group_sid, argv[1]);
2238
2239 if (!NT_STATUS_IS_OK(result)) {
2240 d_fprintf(stderr, _("Could not add %s to %s: %s\n"),
2241 argv[1], argv[0], nt_errstr(result));
2242 }
2243 return result;
2244 }
2245
2246 d_fprintf(stderr, _("Can only add members to global or local groups "
2247 "which %s is not\n"), argv[0]);
2248
2249 return NT_STATUS_UNSUCCESSFUL;
2250 }
2251
2252 static int rpc_group_addmem(struct net_context *c, int argc, const char **argv)
2253 {
2254 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2255 rpc_group_addmem_internals,
2256 argc, argv);
2257 }
2258
2259 static NTSTATUS rpc_del_groupmem(struct net_context *c,
2260 struct rpc_pipe_client *pipe_hnd,
2261 TALLOC_CTX *mem_ctx,
2262 const struct dom_sid *group_sid,
2263 const char *member)
2264 {
2265 struct policy_handle connect_pol, domain_pol;
2266 NTSTATUS status, result;
2267 uint32 group_rid;
2268 struct policy_handle group_pol;
2269 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2270
2271 struct samr_Ids rids, rid_types;
2272 struct lsa_String lsa_acct_name;
2273
2274 struct dom_sid sid;
2275
2276 sid_copy(&sid, group_sid);
2277
2278 if (!sid_split_rid(&sid, &group_rid))
2279 return NT_STATUS_UNSUCCESSFUL;
2280
2281 /* Get sam policy handle */
2282 status = dcerpc_samr_Connect2(b, mem_ctx,
2283 pipe_hnd->desthost,
2284 MAXIMUM_ALLOWED_ACCESS,
2285 &connect_pol,
2286 &result);
2287 if (!NT_STATUS_IS_OK(status)) {
2288 return status;
2289 }
2290 if (!NT_STATUS_IS_OK(result)) {
2291 return result;
2292 }
2293
2294
2295 /* Get domain policy handle */
2296 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2297 &connect_pol,
2298 MAXIMUM_ALLOWED_ACCESS,
2299 &sid,
2300 &domain_pol,
2301 &result);
2302 if (!NT_STATUS_IS_OK(status)) {
2303 return status;
2304 }
2305 if (!NT_STATUS_IS_OK(result)) {
2306 return result;
2307 }
2308
2309 init_lsa_String(&lsa_acct_name, member);
2310
2311 status = dcerpc_samr_LookupNames(b, mem_ctx,
2312 &domain_pol,
2313 1,
2314 &lsa_acct_name,
2315 &rids,
2316 &rid_types,
2317 &result);
2318 if (!NT_STATUS_IS_OK(status)) {
2319 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2320 member);
2321 goto done;
2322 }
2323
2324 if (!NT_STATUS_IS_OK(result)) {
2325 status = result;
2326 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2327 member);
2328 goto done;
2329 }
2330
2331 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2332 &domain_pol,
2333 MAXIMUM_ALLOWED_ACCESS,
2334 group_rid,
2335 &group_pol,
2336 &result);
2337 if (!NT_STATUS_IS_OK(status)) {
2338 goto done;
2339 }
2340 if (!NT_STATUS_IS_OK(result)) {
2341 status = result;
2342 goto done;
2343 }
2344
2345 status = dcerpc_samr_DeleteGroupMember(b, mem_ctx,
2346 &group_pol,
2347 rids.ids[0],
2348 &result);
2349 if (!NT_STATUS_IS_OK(status)) {
2350 goto done;
2351 }
2352
2353 status = result;
2354 done:
2355 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2356 return status;
2357 }
2358
2359 static NTSTATUS rpc_del_aliasmem(struct rpc_pipe_client *pipe_hnd,
2360 TALLOC_CTX *mem_ctx,
2361 const struct dom_sid *alias_sid,
2362 const char *member)
2363 {
2364 struct policy_handle connect_pol, domain_pol;
2365 NTSTATUS status, result;
2366 uint32 alias_rid;
2367 struct policy_handle alias_pol;
2368 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2369
2370 struct dom_sid member_sid;
2371 enum lsa_SidType member_type;
2372
2373 struct dom_sid sid;
2374
2375 sid_copy(&sid, alias_sid);
2376
2377 if (!sid_split_rid(&sid, &alias_rid))
2378 return NT_STATUS_UNSUCCESSFUL;
2379
2380 result = get_sid_from_name(rpc_pipe_np_smb_conn(pipe_hnd), mem_ctx,
2381 member, &member_sid, &member_type);
2382
2383 if (!NT_STATUS_IS_OK(result)) {
2384 d_fprintf(stderr, _("Could not lookup up group member %s\n"),
2385 member);
2386 return result;
2387 }
2388
2389 /* Get sam policy handle */
2390 status = dcerpc_samr_Connect2(b, mem_ctx,
2391 pipe_hnd->desthost,
2392 MAXIMUM_ALLOWED_ACCESS,
2393 &connect_pol,
2394 &result);
2395 if (!NT_STATUS_IS_OK(status)) {
2396 goto done;
2397 }
2398 if (!NT_STATUS_IS_OK(result)) {
2399 status = result;
2400 goto done;
2401 }
2402
2403 /* Get domain policy handle */
2404 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2405 &connect_pol,
2406 MAXIMUM_ALLOWED_ACCESS,
2407 &sid,
2408 &domain_pol,
2409 &result);
2410 if (!NT_STATUS_IS_OK(status)) {
2411 goto done;
2412 }
2413 if (!NT_STATUS_IS_OK(result)) {
2414 status = result;
2415 goto done;
2416 }
2417
2418 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2419 &domain_pol,
2420 MAXIMUM_ALLOWED_ACCESS,
2421 alias_rid,
2422 &alias_pol,
2423 &result);
2424 if (!NT_STATUS_IS_OK(status)) {
2425 return status;
2426 }
2427
2428 if (!NT_STATUS_IS_OK(result)) {
2429 return result;
2430 }
2431
2432 status = dcerpc_samr_DeleteAliasMember(b, mem_ctx,
2433 &alias_pol,
2434 &member_sid,
2435 &result);
2436
2437 if (!NT_STATUS_IS_OK(status)) {
2438 return status;
2439 }
2440
2441 status = result;
2442
2443 done:
2444 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
2445 return status;
2446 }
2447
2448 static NTSTATUS rpc_group_delmem_internals(struct net_context *c,
2449 const struct dom_sid *domain_sid,
2450 const char *domain_name,
2451 struct cli_state *cli,
2452 struct rpc_pipe_client *pipe_hnd,
2453 TALLOC_CTX *mem_ctx,
2454 int argc,
2455 const char **argv)
2456 {
2457 struct dom_sid group_sid;
2458 enum lsa_SidType group_type;
2459
2460 if (argc != 2 || c->display_usage) {
2461 d_printf("%s\n%s",
2462 _("Usage:"),
2463 _("net rpc group delmem <group> <member>\n"
2464 " Delete a member from a group\n"
2465 " group\tGroup to delete member from\n"
2466 " member\tMember to delete from group\n"));
2467 return NT_STATUS_UNSUCCESSFUL;
2468 }
2469
2470 if (!NT_STATUS_IS_OK(get_sid_from_name(cli, mem_ctx, argv[0],
2471 &group_sid, &group_type))) {
2472 d_fprintf(stderr, _("Could not lookup group name %s\n"),
2473 argv[0]);
2474 return NT_STATUS_UNSUCCESSFUL;
2475 }
2476
2477 if (group_type == SID_NAME_DOM_GRP) {
2478 NTSTATUS result = rpc_del_groupmem(c, pipe_hnd, mem_ctx,
2479 &group_sid, argv[1]);
2480
2481 if (!NT_STATUS_IS_OK(result)) {
2482 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2483 argv[1], argv[0], nt_errstr(result));
2484 }
2485 return result;
2486 }
2487
2488 if (group_type == SID_NAME_ALIAS) {
2489 NTSTATUS result = rpc_del_aliasmem(pipe_hnd, mem_ctx,
2490 &group_sid, argv[1]);
2491
2492 if (!NT_STATUS_IS_OK(result)) {
2493 d_fprintf(stderr, _("Could not del %s from %s: %s\n"),
2494 argv[1], argv[0], nt_errstr(result));
2495 }
2496 return result;
2497 }
2498
2499 d_fprintf(stderr, _("Can only delete members from global or local "
2500 "groups which %s is not\n"), argv[0]);
2501
2502 return NT_STATUS_UNSUCCESSFUL;
2503 }
2504
2505 static int rpc_group_delmem(struct net_context *c, int argc, const char **argv)
2506 {
2507 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2508 rpc_group_delmem_internals,
2509 argc, argv);
2510 }
2511
2512 /**
2513 * List groups on a remote RPC server.
2514 *
2515 * All parameters are provided by the run_rpc_command function, except for
2516 * argc, argv which are passes through.
2517 *
2518 * @param domain_sid The domain sid acquired from the remote server.
2519 * @param cli A cli_state connected to the server.
2520 * @param mem_ctx Talloc context, destroyed on completion of the function.
2521 * @param argc Standard main() style argc.
2522 * @param argv Standard main() style argv. Initial components are already
2523 * stripped.
2524 *
2525 * @return Normal NTSTATUS return.
2526 **/
2527
2528 static NTSTATUS rpc_group_list_internals(struct net_context *c,
2529 const struct dom_sid *domain_sid,
2530 const char *domain_name,
2531 struct cli_state *cli,
2532 struct rpc_pipe_client *pipe_hnd,
2533 TALLOC_CTX *mem_ctx,
2534 int argc,
2535 const char **argv)
2536 {
2537 struct policy_handle connect_pol, domain_pol;
2538 NTSTATUS status, result;
2539 uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0;
2540 struct samr_SamArray *groups = NULL;
2541 bool global = false;
2542 bool local = false;
2543 bool builtin = false;
2544 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2545
2546 if (c->display_usage) {
2547 d_printf("%s\n%s",
2548 _("Usage:"),
2549 _("net rpc group list [global] [local] [builtin]\n"
2550 " List groups on RPC server\n"
2551 " global\tList global groups\n"
2552 " local\tList local groups\n"
2553 " builtin\tList builtin groups\n"
2554 " If none of global, local or builtin is "
2555 "specified, all three options are considered "
2556 "set\n"));
2557 return NT_STATUS_OK;
2558 }
2559
2560 if (argc == 0) {
2561 global = true;
2562 local = true;
2563 builtin = true;
2564 }
2565
2566 for (i=0; i<argc; i++) {
2567 if (strequal(argv[i], "global"))
2568 global = true;
2569
2570 if (strequal(argv[i], "local"))
2571 local = true;
2572
2573 if (strequal(argv[i], "builtin"))
2574 builtin = true;
2575 }
2576
2577 /* Get sam policy handle */
2578
2579 status = dcerpc_samr_Connect2(b, mem_ctx,
2580 pipe_hnd->desthost,
2581 MAXIMUM_ALLOWED_ACCESS,
2582 &connect_pol,
2583 &result);
2584 if (!NT_STATUS_IS_OK(status)) {
2585 goto done;
2586 }
2587 if (!NT_STATUS_IS_OK(result)) {
2588 status = result;
2589 goto done;
2590 }
2591
2592 /* Get domain policy handle */
2593
2594 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2595 &connect_pol,
2596 MAXIMUM_ALLOWED_ACCESS,
2597 discard_const_p(struct dom_sid2, domain_sid),
2598 &domain_pol,
2599 &result);
2600 if (!NT_STATUS_IS_OK(status)) {
2601 goto done;
2602 }
2603 if (!NT_STATUS_IS_OK(result)) {
2604 status = result;
2605 goto done;
2606 }
2607
2608 /* Query domain groups */
2609 if (c->opt_long_list_entries)
2610 d_printf(_("\nGroup name Comment"
2611 "\n-----------------------------\n"));
2612 do {
2613 uint32_t max_size, total_size, returned_size;
2614 union samr_DispInfo info;
2615
2616 if (!global) break;
2617
2618 dcerpc_get_query_dispinfo_params(
2619 loop_count, &max_entries, &max_size);
2620
2621 status = dcerpc_samr_QueryDisplayInfo(b, mem_ctx,
2622 &domain_pol,
2623 3,
2624 start_idx,
2625 max_entries,
2626 max_size,
2627 &total_size,
2628 &returned_size,
2629 &info,
2630 &result);
2631 if (!NT_STATUS_IS_OK(status)) {
2632 goto done;
2633 }
2634 num_entries = info.info3.count;
2635 start_idx += info.info3.count;
2636
2637 if (!NT_STATUS_IS_OK(result) &&
2638 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2639 break;
2640
2641 for (i = 0; i < num_entries; i++) {
2642
2643 const char *group = NULL;
2644 const char *desc = NULL;
2645
2646 group = info.info3.entries[i].account_name.string;
2647 desc = info.info3.entries[i].description.string;
2648
2649 if (c->opt_long_list_entries)
2650 printf("%-21.21s %-50.50s\n",
2651 group, desc);
2652 else
2653 printf("%s\n", group);
2654 }
2655 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2656 /* query domain aliases */
2657 start_idx = 0;
2658 do {
2659 if (!local) break;
2660
2661 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2662 &domain_pol,
2663 &start_idx,
2664 &groups,
2665 0xffff,
2666 &num_entries,
2667 &result);
2668 if (!NT_STATUS_IS_OK(status)) {
2669 goto done;
2670 }
2671 if (!NT_STATUS_IS_OK(result) &&
2672 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
2673 break;
2674
2675 for (i = 0; i < num_entries; i++) {
2676
2677 const char *description = NULL;
2678
2679 if (c->opt_long_list_entries) {
2680
2681 struct policy_handle alias_pol;
2682 union samr_AliasInfo *info = NULL;
2683 NTSTATUS _result;
2684
2685 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2686 &domain_pol,
2687 0x8,
2688 groups->entries[i].idx,
2689 &alias_pol,
2690 &_result);
2691 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2692 status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2693 &alias_pol,
2694 3,
2695 &info,
2696 &_result);
2697 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2698 status = dcerpc_samr_Close(b, mem_ctx,
2699 &alias_pol,
2700 &_result);
2701 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2702 description = info->description.string;
2703 }
2704 }
2705 }
2706 }
2707
2708 if (description != NULL) {
2709 printf("%-21.21s %-50.50s\n",
2710 groups->entries[i].name.string,
2711 description);
2712 } else {
2713 printf("%s\n", groups->entries[i].name.string);
2714 }
2715 }
2716 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2717 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
2718 /* Get builtin policy handle */
2719
2720 status = dcerpc_samr_OpenDomain(b, mem_ctx,
2721 &connect_pol,
2722 MAXIMUM_ALLOWED_ACCESS,
2723 discard_const_p(struct dom_sid2, &global_sid_Builtin),
2724 &domain_pol,
2725 &result);
2726 if (!NT_STATUS_IS_OK(status)) {
2727 goto done;
2728 }
2729 if (!NT_STATUS_IS_OK(result)) {
2730 status = result;
2731 goto done;
2732 }
2733
2734 /* query builtin aliases */
2735 start_idx = 0;
2736 do {
2737 if (!builtin) break;
2738
2739 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
2740 &domain_pol,
2741 &start_idx,
2742 &groups,
2743 max_entries,
2744 &num_entries,
2745 &result);
2746 if (!NT_STATUS_IS_OK(status)) {
2747 break;
2748 }
2749 if (!NT_STATUS_IS_OK(result) &&
2750 !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
2751 status = result;
2752 break;
2753 }
2754
2755 for (i = 0; i < num_entries; i++) {
2756
2757 const char *description = NULL;
2758
2759 if (c->opt_long_list_entries) {
2760
2761 struct policy_handle alias_pol;
2762 union samr_AliasInfo *info = NULL;
2763 NTSTATUS _result;
2764
2765 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2766 &domain_pol,
2767 0x8,
2768 groups->entries[i].idx,
2769 &alias_pol,
2770 &_result);
2771 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2772 status = dcerpc_samr_QueryAliasInfo(b, mem_ctx,
2773 &alias_pol,
2774 3,
2775 &info,
2776 &_result);
2777 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2778 status = dcerpc_samr_Close(b, mem_ctx,
2779 &alias_pol,
2780 &_result);
2781 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(_result)) {
2782 description = info->description.string;
2783 }
2784 }
2785 }
2786 }
2787
2788 if (description != NULL) {
2789 printf("%-21.21s %-50.50s\n",
2790 groups->entries[i].name.string,
2791 description);
2792 } else {
2793 printf("%s\n", groups->entries[i].name.string);
2794 }
2795 }
2796 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
2797
2798 status = result;
2799
2800 done:
2801 return status;
2802 }
2803
2804 static int rpc_group_list(struct net_context *c, int argc, const char **argv)
2805 {
2806 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
2807 rpc_group_list_internals,
2808 argc, argv);
2809 }
2810
2811 static NTSTATUS rpc_list_group_members(struct net_context *c,
2812 struct rpc_pipe_client *pipe_hnd,
2813 TALLOC_CTX *mem_ctx,
2814 const char *domain_name,
2815 const struct dom_sid *domain_sid,
2816 struct policy_handle *domain_pol,
2817 uint32 rid)
2818 {
2819 NTSTATUS result, status;
2820 struct policy_handle group_pol;
2821 uint32 num_members, *group_rids;
2822 int i;
2823 struct samr_RidAttrArray *rids = NULL;
2824 struct lsa_Strings names;
2825 struct samr_Ids types;
2826 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2827
2828 fstring sid_str;
2829 sid_to_fstring(sid_str, domain_sid);
2830
2831 status = dcerpc_samr_OpenGroup(b, mem_ctx,
2832 domain_pol,
2833 MAXIMUM_ALLOWED_ACCESS,
2834 rid,
2835 &group_pol,
2836 &result);
2837 if (!NT_STATUS_IS_OK(status)) {
2838 return status;
2839 }
2840 if (!NT_STATUS_IS_OK(result)) {
2841 return result;
2842 }
2843
2844 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
2845 &group_pol,
2846 &rids,
2847 &result);
2848 if (!NT_STATUS_IS_OK(status)) {
2849 return status;
2850 }
2851 if (!NT_STATUS_IS_OK(result)) {
2852 return result;
2853 }
2854
2855 num_members = rids->count;
2856 group_rids = rids->rids;
2857
2858 while (num_members > 0) {
2859 int this_time = 512;
2860
2861 if (num_members < this_time)
2862 this_time = num_members;
2863
2864 status = dcerpc_samr_LookupRids(b, mem_ctx,
2865 domain_pol,
2866 this_time,
2867 group_rids,
2868 &names,
2869 &types,
2870 &result);
2871 if (!NT_STATUS_IS_OK(status)) {
2872 return status;
2873 }
2874 if (!NT_STATUS_IS_OK(result)) {
2875 return result;
2876 }
2877
2878 /* We only have users as members, but make the output
2879 the same as the output of alias members */
2880
2881 for (i = 0; i < this_time; i++) {
2882
2883 if (c->opt_long_list_entries) {
2884 printf("%s-%d %s\\%s %d\n", sid_str,
2885 group_rids[i], domain_name,
2886 names.names[i].string,
2887 SID_NAME_USER);
2888 } else {
2889 printf("%s\\%s\n", domain_name,
2890 names.names[i].string);
2891 }
2892 }
2893
2894 num_members -= this_time;
2895 group_rids += 512;
2896 }
2897
2898 return NT_STATUS_OK;
2899 }
2900
2901 static NTSTATUS rpc_list_alias_members(struct net_context *c,
2902 struct rpc_pipe_client *pipe_hnd,
2903 TALLOC_CTX *mem_ctx,
2904 struct policy_handle *domain_pol,
2905 uint32 rid)
2906 {
2907 NTSTATUS result, status;
2908 struct rpc_pipe_client *lsa_pipe;
2909 struct policy_handle alias_pol, lsa_pol;
2910 uint32 num_members;
2911 struct dom_sid *alias_sids;
2912 char **domains;
2913 char **names;
2914 enum lsa_SidType *types;
2915 int i;
2916 struct lsa_SidArray sid_array;
2917 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
2918
2919 status = dcerpc_samr_OpenAlias(b, mem_ctx,
2920 domain_pol,
2921 MAXIMUM_ALLOWED_ACCESS,
2922 rid,
2923 &alias_pol,
2924 &result);
2925 if (!NT_STATUS_IS_OK(status)) {
2926 return status;
2927 }
2928 if (!NT_STATUS_IS_OK(result)) {
2929 return result;
2930 }
2931
2932 status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
2933 &alias_pol,
2934 &sid_array,
2935 &result);
2936 if (!NT_STATUS_IS_OK(status)) {
2937 d_fprintf(stderr, _("Couldn't list alias members\n"));
2938 return status;
2939 }
2940 if (!NT_STATUS_IS_OK(result)) {
2941 d_fprintf(stderr, _("Couldn't list alias members\n"));
2942 return result;
2943 }
2944
2945 num_members = sid_array.num_sids;
2946
2947 if (num_members == 0) {
2948 return NT_STATUS_OK;
2949 }
2950
2951 result = cli_rpc_pipe_open_noauth(rpc_pipe_np_smb_conn(pipe_hnd),
2952 &ndr_table_lsarpc.syntax_id,
2953 &lsa_pipe);
2954 if (!NT_STATUS_IS_OK(result)) {
2955 d_fprintf(stderr, _("Couldn't open LSA pipe. Error was %s\n"),
2956 nt_errstr(result) );
2957 return result;
2958 }
2959
2960 result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, true,
2961 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
2962
2963 if (!NT_STATUS_IS_OK(result)) {
2964 d_fprintf(stderr, _("Couldn't open LSA policy handle\n"));
2965 TALLOC_FREE(lsa_pipe);
2966 return result;
2967 }
2968
2969 alias_sids = talloc_zero_array(mem_ctx, struct dom_sid, num_members);
2970 if (!alias_sids) {
2971 d_fprintf(stderr, _("Out of memory\n"));
2972 TALLOC_FREE(lsa_pipe);
2973 return NT_STATUS_NO_MEMORY;
2974 }
2975
2976 for (i=0; i<num_members; i++) {
2977 sid_copy(&alias_sids[i], sid_array.sids[i].sid);
2978 }
2979
2980 result = rpccli_lsa_lookup_sids(lsa_pipe, mem_ctx, &lsa_pol,
2981 num_members, alias_sids,
2982 &domains, &names, &types);
2983
2984 if (!NT_STATUS_IS_OK(result) &&
2985 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
2986 d_fprintf(stderr, _("Couldn't lookup SIDs\n"));
2987 TALLOC_FREE(lsa_pipe);
2988 return result;
2989 }
2990
2991 for (i = 0; i < num_members; i++) {
2992 fstring sid_str;
2993 sid_to_fstring(sid_str, &alias_sids[i]);
2994
2995 if (c->opt_long_list_entries) {
2996 printf("%s %s\\%s %d\n", sid_str,
2997 domains[i] ? domains[i] : _("*unknown*"),
2998 names[i] ? names[i] : _("*unknown*"), types[i]);
2999 } else {
3000 if (domains[i])
3001 printf("%s\\%s\n", domains[i], names[i]);
3002 else
3003 printf("%s\n", sid_str);
3004 }
3005 }
3006
3007 TALLOC_FREE(lsa_pipe);
3008 return NT_STATUS_OK;
3009 }
3010
3011 static NTSTATUS rpc_group_members_internals(struct net_context *c,
3012 const struct dom_sid *domain_sid,
3013 const char *domain_name,
3014 struct cli_state *cli,
3015 struct rpc_pipe_client *pipe_hnd,
3016 TALLOC_CTX *mem_ctx,
3017 int argc,
3018 const char **argv)
3019 {
3020 NTSTATUS result, status;
3021 struct policy_handle connect_pol, domain_pol;
3022 struct samr_Ids rids, rid_types;
3023 struct lsa_String lsa_acct_name;
3024 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3025
3026 /* Get sam policy handle */
3027
3028 status = dcerpc_samr_Connect2(b, mem_ctx,
3029 pipe_hnd->desthost,
3030 MAXIMUM_ALLOWED_ACCESS,
3031 &connect_pol,
3032 &result);
3033 if (!NT_STATUS_IS_OK(status)) {
3034 return status;
3035 }
3036 if (!NT_STATUS_IS_OK(result)) {
3037 return result;
3038 }
3039
3040 /* Get domain policy handle */
3041
3042 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3043 &connect_pol,
3044 MAXIMUM_ALLOWED_ACCESS,
3045 discard_const_p(struct dom_sid2, domain_sid),
3046 &domain_pol,
3047 &result);
3048 if (!NT_STATUS_IS_OK(status)) {
3049 return status;
3050 }
3051 if (!NT_STATUS_IS_OK(result)) {
3052 return result;
3053 }
3054
3055 init_lsa_String(&lsa_acct_name, argv[0]); /* sure? */
3056
3057 status = dcerpc_samr_LookupNames(b, mem_ctx,
3058 &domain_pol,
3059 1,
3060 &lsa_acct_name,
3061 &rids,
3062 &rid_types,
3063 &result);
3064 if (!NT_STATUS_IS_OK(status)) {
3065 return status;
3066 }
3067
3068 if (!NT_STATUS_IS_OK(result)) {
3069
3070 /* Ok, did not find it in the global sam, try with builtin */
3071
3072 struct dom_sid sid_Builtin;
3073
3074 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
3075
3076 sid_copy(&sid_Builtin, &global_sid_Builtin);
3077
3078 status = dcerpc_samr_OpenDomain(b, mem_ctx,
3079 &connect_pol,
3080 MAXIMUM_ALLOWED_ACCESS,
3081 &sid_Builtin,
3082 &domain_pol,
3083 &result);
3084 if (!NT_STATUS_IS_OK(status)) {
3085 return status;
3086 }
3087 if (!NT_STATUS_IS_OK(result)) {
3088 d_fprintf(stderr, _("Couldn't find group %s\n"),
3089 argv[0]);
3090 return result;
3091 }
3092
3093 status = dcerpc_samr_LookupNames(b, mem_ctx,
3094 &domain_pol,
3095 1,
3096 &lsa_acct_name,
3097 &rids,
3098 &rid_types,
3099 &result);
3100 if (!NT_STATUS_IS_OK(status)) {
3101 return status;
3102 }
3103 if (!NT_STATUS_IS_OK(result)) {
3104 d_fprintf(stderr, _("Couldn't find group %s\n"),
3105 argv[0]);
3106 return result;
3107 }
3108 }
3109
3110 if (rids.count != 1) {
3111 d_fprintf(stderr, _("Couldn't find group %s\n"),
3112 argv[0]);
3113 return result;
3114 }
3115
3116 if (rid_types.ids[0] == SID_NAME_DOM_GRP) {
3117 return rpc_list_group_members(c, pipe_hnd, mem_ctx, domain_name,
3118 domain_sid, &domain_pol,
3119 rids.ids[0]);
3120 }
3121
3122 if (rid_types.ids[0] == SID_NAME_ALIAS) {
3123 return rpc_list_alias_members(c, pipe_hnd, mem_ctx, &domain_pol,
3124 rids.ids[0]);
3125 }
3126
3127 return NT_STATUS_NO_SUCH_GROUP;
3128 }
3129
3130 static int rpc_group_members(struct net_context *c, int argc, const char **argv)
3131 {
3132 if (argc != 1 || c->display_usage) {
3133 return rpc_group_usage(c, argc, argv);
3134 }
3135
3136 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3137 rpc_group_members_internals,
3138 argc, argv);
3139 }
3140
3141 static int rpc_group_rename_internals(struct net_context *c, int argc, const char **argv)
3142 {
3143 NET_API_STATUS status;
3144 struct GROUP_INFO_0 g0;
3145 uint32_t parm_err;
3146
3147 if (argc != 2) {
3148 d_printf(_("Usage:\n"));
3149 d_printf("net rpc group rename group newname\n");
3150 return -1;
3151 }
3152
3153 g0.grpi0_name = argv[1];
3154
3155 status = NetGroupSetInfo(c->opt_host,
3156 argv[0],
3157 0,
3158 (uint8_t *)&g0,
3159 &parm_err);
3160
3161 if (status != 0) {
3162 d_fprintf(stderr, _("Renaming group %s failed with: %s\n"),
3163 argv[0], libnetapi_get_error_string(c->netapi_ctx,
3164 status));
3165 return -1;
3166 }
3167
3168 return 0;
3169 }
3170
3171 static int rpc_group_rename(struct net_context *c, int argc, const char **argv)
3172 {
3173 if (argc != 2 || c->display_usage) {
3174 return rpc_group_usage(c, argc, argv);
3175 }
3176
3177 return rpc_group_rename_internals(c, argc, argv);
3178 }
3179
3180 /**
3181 * 'net rpc group' entrypoint.
3182 * @param argc Standard main() style argc.
3183 * @param argv Standard main() style argv. Initial components are already
3184 * stripped.
3185 **/
3186
3187 int net_rpc_group(struct net_context *c, int argc, const char **argv)
3188 {
3189 NET_API_STATUS status;
3190
3191 struct functable func[] = {
3192 {
3193 "add",
3194 rpc_group_add,
3195 NET_TRANSPORT_RPC,
3196 N_("Create specified group"),
3197 N_("net rpc group add\n"
3198 " Create specified group")
3199 },
3200 {
3201 "delete",
3202 rpc_group_delete,
3203 NET_TRANSPORT_RPC,
3204 N_("Delete specified group"),
3205 N_("net rpc group delete\n"
3206 " Delete specified group")
3207 },
3208 {
3209 "addmem",
3210 rpc_group_addmem,
3211 NET_TRANSPORT_RPC,
3212 N_("Add member to group"),
3213 N_("net rpc group addmem\n"
3214 " Add member to group")
3215 },
3216 {
3217 "delmem",
3218 rpc_group_delmem,
3219 NET_TRANSPORT_RPC,
3220 N_("Remove member from group"),
3221 N_("net rpc group delmem\n"
3222 " Remove member from group")
3223 },
3224 {
3225 "list",
3226 rpc_group_list,
3227 NET_TRANSPORT_RPC,
3228 N_("List groups"),
3229 N_("net rpc group list\n"
3230 " List groups")
3231 },
3232 {
3233 "members",
3234 rpc_group_members,
3235 NET_TRANSPORT_RPC,
3236 N_("List group members"),
3237 N_("net rpc group members\n"
3238 " List group members")
3239 },
3240 {
3241 "rename",
3242 rpc_group_rename,
3243 NET_TRANSPORT_RPC,
3244 N_("Rename group"),
3245 N_("net rpc group rename\n"
3246 " Rename group")
3247 },
3248 {NULL, NULL, 0, NULL, NULL}
3249 };
3250
3251 status = libnetapi_net_init(&c->netapi_ctx);
3252 if (status != 0) {
3253 return -1;
3254 }
3255 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
3256 libnetapi_set_password(c->netapi_ctx, c->opt_password);
3257 if (c->opt_kerberos) {
3258 libnetapi_set_use_kerberos(c->netapi_ctx);
3259 }
3260
3261 if (argc == 0) {
3262 if (c->display_usage) {
3263 d_printf(_("Usage:\n"));
3264 d_printf(_("net rpc group\n"
3265 " Alias for net rpc group list global "
3266 "local builtin\n"));
3267 net_display_usage_from_functable(func);
3268 return 0;
3269 }
3270
3271 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
3272 rpc_group_list_internals,
3273 argc, argv);
3274 }
3275
3276 return net_run_function(c, argc, argv, "net rpc group", func);
3277 }
3278
3279 /****************************************************************************/
3280
3281 static int rpc_share_usage(struct net_context *c, int argc, const char **argv)
3282 {
3283 return net_share_usage(c, argc, argv);
3284 }
3285
3286 /**
3287 * Add a share on a remote RPC server.
3288 *
3289 * @param argc Standard main() style argc.
3290 * @param argv Standard main() style argv. Initial components are already
3291 * stripped.
3292 *
3293 * @return A shell status integer (0 for success).
3294 **/
3295
3296 static int rpc_share_add(struct net_context *c, int argc, const char **argv)
3297 {
3298 NET_API_STATUS status;
3299 char *sharename;
3300 char *path;
3301 uint32 type = STYPE_DISKTREE; /* only allow disk shares to be added */
3302 uint32 num_users=0, perms=0;
3303 char *password=NULL; /* don't allow a share password */
3304 struct SHARE_INFO_2 i2;
3305 uint32_t parm_error = 0;
3306
3307 if ((argc < 1) || !strchr(argv[0], '=') || c->display_usage) {
3308 return rpc_share_usage(c, argc, argv);
3309 }
3310
3311 if ((sharename = talloc_strdup(c, argv[0])) == NULL) {
3312 return -1;
3313 }
3314
3315 path = strchr(sharename, '=');
3316 if (!path) {
3317 return -1;
3318 }
3319
3320 *path++ = '\0';
3321
3322 i2.shi2_netname = sharename;
3323 i2.shi2_type = type;
3324 i2.shi2_remark = c->opt_comment;
3325 i2.shi2_permissions = perms;
3326 i2.shi2_max_uses = c->opt_maxusers;
3327 i2.shi2_current_uses = num_users;
3328 i2.shi2_path = path;
3329 i2.shi2_passwd = password;
3330
3331 status = NetShareAdd(c->opt_host,
3332 2,
3333 (uint8_t *)&i2,
3334 &parm_error);
3335 if (status != 0) {
3336 printf(_("NetShareAdd failed with: %s\n"),
3337 libnetapi_get_error_string(c->netapi_ctx, status));
3338 }
3339
3340 return status;
3341 }
3342
3343 /**
3344 * Delete a share on a remote RPC server.
3345 *
3346 * @param domain_sid The domain sid acquired from the remote server.
3347 * @param argc Standard main() style argc.
3348 * @param argv Standard main() style argv. Initial components are already
3349 * stripped.
3350 *
3351 * @return A shell status integer (0 for success).
3352 **/
3353 static int rpc_share_delete(struct net_context *c, int argc, const char **argv)
3354 {
3355 if (argc < 1 || c->display_usage) {
3356 return rpc_share_usage(c, argc, argv);
3357 }
3358
3359 return NetShareDel(c->opt_host, argv[0], 0);
3360 }
3361
3362 /**
3363 * Formatted print of share info
3364 *
3365 * @param r pointer to SHARE_INFO_1 to format
3366 **/
3367
3368 static void display_share_info_1(struct net_context *c,
3369 struct SHARE_INFO_1 *r)
3370 {
3371 if (c->opt_long_list_entries) {
3372 d_printf("%-12s %-8.8s %-50s\n",
3373 r->shi1_netname,
3374 net_share_type_str(r->shi1_type & ~(STYPE_TEMPORARY|STYPE_HIDDEN)),
3375 r->shi1_remark);
3376 } else {
3377 d_printf("%s\n", r->shi1_netname);
3378 }
3379 }
3380
3381 static WERROR get_share_info(struct net_context *c,
3382 struct rpc_pipe_client *pipe_hnd,
3383 TALLOC_CTX *mem_ctx,
3384 uint32 level,
3385 int argc,
3386 const char **argv,
3387 struct srvsvc_NetShareInfoCtr *info_ctr)
3388 {
3389 WERROR result;
3390 NTSTATUS status;
3391 union srvsvc_NetShareInfo info;
3392 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
3393
3394 /* no specific share requested, enumerate all */
3395 if (argc == 0) {
3396
3397 uint32_t preferred_len = 0xffffffff;
3398 uint32_t total_entries = 0;
3399 uint32_t resume_handle = 0;
3400
3401 info_ctr->level = level;
3402
3403 status = dcerpc_srvsvc_NetShareEnumAll(b, mem_ctx,
3404 pipe_hnd->desthost,
3405 info_ctr,
3406 preferred_len,
3407 &total_entries,
3408 &resume_handle,
3409 &result);
3410 if (!NT_STATUS_IS_OK(status)) {
3411 return ntstatus_to_werror(status);
3412 }
3413 return result;
3414 }
3415
3416 /* request just one share */
3417 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
3418 pipe_hnd->desthost,
3419 argv[0],
3420 level,
3421 &info,
3422 &result);
3423
3424 if (!NT_STATUS_IS_OK(status)) {
3425 result = ntstatus_to_werror(status);
3426 goto done;
3427 }
3428
3429 if (!W_ERROR_IS_OK(result)) {
3430 goto done;
3431 }
3432
3433 /* construct ctr */
3434 ZERO_STRUCTP(info_ctr);
3435
3436 info_ctr->level = level;
3437
3438 switch (level) {
3439 case 1:
3440 {
3441 struct srvsvc_NetShareCtr1 *ctr1;
3442
3443 ctr1 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr1);
3444 W_ERROR_HAVE_NO_MEMORY(ctr1);
3445
3446 ctr1->count = 1;
3447 ctr1->array = info.info1;
3448
3449 info_ctr->ctr.ctr1 = ctr1;
3450
3451 break;
3452 }
3453 case 2:
3454 {
3455 struct srvsvc_NetShareCtr2 *ctr2;
3456
3457 ctr2 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr2);
3458 W_ERROR_HAVE_NO_MEMORY(ctr2);
3459
3460 ctr2->count = 1;
3461 ctr2->array = info.info2;
3462
3463 info_ctr->ctr.ctr2 = ctr2;
3464
3465 break;
3466 }
3467 case 502:
3468 {
3469 struct srvsvc_NetShareCtr502 *ctr502;
3470
3471 ctr502 = talloc_zero(mem_ctx, struct srvsvc_NetShareCtr502);
3472 W_ERROR_HAVE_NO_MEMORY(ctr502);
3473
3474 ctr502->count = 1;
3475 ctr502->array = info.info502;
3476
3477 info_ctr->ctr.ctr502 = ctr502;
3478
3479 break;
3480 }
3481 } /* switch */
3482 done:
3483 return result;
3484 }
3485
3486 /***
3487 * 'net rpc share list' entrypoint.
3488 * @param argc Standard main() style argc.
3489 * @param argv Standard main() style argv. Initial components are already
3490 * stripped.
3491 **/
3492 static int rpc_share_list(struct net_context *c, int argc, const char **argv)
3493 {
3494 NET_API_STATUS status;
3495 struct SHARE_INFO_1 *i1 = NULL;
3496 uint32_t entries_read = 0;
3497 uint32_t total_entries = 0;
3498 uint32_t resume_handle = 0;
3499 uint32_t i, level = 1;
3500
3501 if (c->display_usage) {
3502 d_printf( "%s\n"
3503 "net rpc share list\n"
3504 " %s\n",
3505 _("Usage:"),
3506 _("List shares on remote server"));
3507 return 0;
3508 }
3509
3510 status = NetShareEnum(c->opt_host,
3511 level,
3512 (uint8_t **)(void *)&i1,
3513 (uint32_t)-1,
3514 &entries_read,
3515 &total_entries,
3516 &resume_handle);
3517 if (status != 0) {
3518 goto done;
3519 }
3520
3521 /* Display results */
3522
3523 if (c->opt_long_list_entries) {
3524 d_printf(_(
3525 "\nEnumerating shared resources (exports) on remote server:\n\n"
3526 "\nShare name Type Description\n"
3527 "---------- ---- -----------\n"));
3528 }
3529 for (i = 0; i < entries_read; i++)
3530 display_share_info_1(c, &i1[i]);
3531 done:
3532 return status;
3533 }
3534
3535 static bool check_share_availability(struct cli_state *cli, const char *netname)
3536 {
3537 NTSTATUS status;
3538
3539 status = cli_tree_connect(cli, netname, "A:", "", 0);
3540 if (!NT_STATUS_IS_OK(status)) {
3541 d_printf(_("skipping [%s]: not a file share.\n"), netname);
3542 return false;
3543 }
3544
3545 status = cli_tdis(cli);
3546 if (!NT_STATUS_IS_OK(status)) {
3547 d_printf(_("cli_tdis returned %s\n"), nt_errstr(status));
3548 return false;
3549 }
3550
3551 return true;
3552 }
3553
3554 static bool check_share_sanity(struct net_context *c, struct cli_state *cli,
3555 const char *netname, uint32 type)
3556 {
3557 /* only support disk shares */
3558 if (! ( type == STYPE_DISKTREE || type == (STYPE_DISKTREE | STYPE_HIDDEN)) ) {
3559 printf(_("share [%s] is not a diskshare (type: %x)\n"), netname,
3560 type);
3561 return false;
3562 }
3563
3564 /* skip builtin shares */
3565 /* FIXME: should print$ be added too ? */
3566 if (strequal(netname,"IPC$") || strequal(netname,"ADMIN$") ||
3567 strequal(netname,"global"))
3568 return false;
3569
3570 if (c->opt_exclude && in_list(netname, c->opt_exclude, false)) {
3571 printf(_("excluding [%s]\n"), netname);
3572 return false;
3573 }
3574
3575 return check_share_availability(cli, netname);
3576 }
3577
3578 /**
3579 * Migrate shares from a remote RPC server to the local RPC server.
3580 *
3581 * All parameters are provided by the run_rpc_command function, except for
3582 * argc, argv which are passed through.
3583 *
3584 * @param domain_sid The domain sid acquired from the remote server.
3585 * @param cli A cli_state connected to the server.
3586 * @param mem_ctx Talloc context, destroyed on completion of the function.
3587 * @param argc Standard main() style argc.
3588 * @param argv Standard main() style argv. Initial components are already
3589 * stripped.
3590 *
3591 * @return Normal NTSTATUS return.
3592 **/
3593
3594 static NTSTATUS rpc_share_migrate_shares_internals(struct net_context *c,
3595 const struct dom_sid *domain_sid,
3596 const char *domain_name,
3597 struct cli_state *cli,
3598 struct rpc_pipe_client *pipe_hnd,
3599 TALLOC_CTX *mem_ctx,
3600 int argc,
3601 const char **argv)
3602 {
3603 WERROR result;
3604 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3605 struct srvsvc_NetShareInfoCtr ctr_src;
3606 uint32 i;
3607 struct rpc_pipe_client *srvsvc_pipe = NULL;
3608 struct cli_state *cli_dst = NULL;
3609 uint32 level = 502; /* includes secdesc */
3610 uint32_t parm_error = 0;
3611 struct dcerpc_binding_handle *b;
3612
3613 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3614 &ctr_src);
3615 if (!W_ERROR_IS_OK(result))
3616 goto done;
3617
3618 /* connect destination PI_SRVSVC */
3619 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
3620 &ndr_table_srvsvc.syntax_id);
3621 if (!NT_STATUS_IS_OK(nt_status))
3622 return nt_status;
3623
3624 b = srvsvc_pipe->binding_handle;
3625
3626 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3627
3628 union srvsvc_NetShareInfo info;
3629 struct srvsvc_NetShareInfo502 info502 =
3630 ctr_src.ctr.ctr502->array[i];
3631
3632 /* reset error-code */
3633 nt_status = NT_STATUS_UNSUCCESSFUL;
3634
3635 if (!check_share_sanity(c, cli, info502.name, info502.type))
3636 continue;
3637
3638 /* finally add the share on the dst server */
3639
3640 printf(_("migrating: [%s], path: %s, comment: %s, without "
3641 "share-ACLs\n"),
3642 info502.name, info502.path, info502.comment);
3643
3644 info.info502 = &info502;
3645
3646 nt_status = dcerpc_srvsvc_NetShareAdd(b, mem_ctx,
3647 srvsvc_pipe->desthost,
3648 502,
3649 &info,
3650 &parm_error,
3651 &result);
3652 if (!NT_STATUS_IS_OK(nt_status)) {
3653 printf(_("cannot add share: %s\n"),
3654 nt_errstr(nt_status));
3655 goto done;
3656 }
3657 if (W_ERROR_V(result) == W_ERROR_V(WERR_FILE_EXISTS)) {
3658 printf(_(" [%s] does already exist\n"),
3659 info502.name);
3660 continue;
3661 }
3662
3663 if (!W_ERROR_IS_OK(result)) {
3664 nt_status = werror_to_ntstatus(result);
3665 printf(_("cannot add share: %s\n"),
3666 win_errstr(result));
3667 goto done;
3668 }
3669
3670 }
3671
3672 nt_status = NT_STATUS_OK;
3673
3674 done:
3675 if (cli_dst) {
3676 cli_shutdown(cli_dst);
3677 }
3678
3679 return nt_status;
3680
3681 }
3682
3683 /**
3684 * Migrate shares from a RPC server to another.
3685 *
3686 * @param argc Standard main() style argc.
3687 * @param argv Standard main() style argv. Initial components are already
3688 * stripped.
3689 *
3690 * @return A shell status integer (0 for success).
3691 **/
3692 static int rpc_share_migrate_shares(struct net_context *c, int argc,
3693 const char **argv)
3694 {
3695 if (c->display_usage) {
3696 d_printf( "%s\n"
3697 "net rpc share migrate shares\n"
3698 " %s\n",
3699 _("Usage:"),
3700 _("Migrate shares to local server"));
3701 return 0;
3702 }
3703
3704 if (!c->opt_host) {
3705 printf(_("no server to migrate\n"));
3706 return -1;
3707 }
3708
3709 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
3710 rpc_share_migrate_shares_internals,
3711 argc, argv);
3712 }
3713
3714 /**
3715 * Copy a file/dir
3716 *
3717 * @param f file_info
3718 * @param mask current search mask
3719 * @param state arg-pointer
3720 *
3721 **/
3722 static NTSTATUS copy_fn(const char *mnt, struct file_info *f,
3723 const char *mask, void *state)
3724 {
3725 static NTSTATUS nt_status;
3726 static struct copy_clistate *local_state;
3727 static fstring filename, new_mask;
3728 fstring dir;
3729 char *old_dir;
3730 struct net_context *c;
3731
3732 local_state = (struct copy_clistate *)state;
3733 nt_status = NT_STATUS_UNSUCCESSFUL;
3734
3735 c = local_state->c;
3736
3737 if (strequal(f->name, ".") || strequal(f->name, ".."))
3738 return NT_STATUS_OK;
3739
3740 DEBUG(3,("got mask: %s, name: %s\n", mask, f->name));
3741
3742 /* DIRECTORY */
3743 if (f->mode & FILE_ATTRIBUTE_DIRECTORY) {
3744
3745 DEBUG(3,("got dir: %s\n", f->name));
3746
3747 fstrcpy(dir, local_state->cwd);
3748 fstrcat(dir, "\\");
3749 fstrcat(dir, f->name);
3750
3751 switch (net_mode_share)
3752 {
3753 case NET_MODE_SHARE_MIGRATE:
3754 /* create that directory */
3755 nt_status = net_copy_file(c, local_state->mem_ctx,
3756 local_state->cli_share_src,
3757 local_state->cli_share_dst,
3758 dir, dir,
3759 c->opt_acls? true : false,
3760 c->opt_attrs? true : false,
3761 c->opt_timestamps? true:false,
3762 false);
3763 break;
3764 default:
3765 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3766 return NT_STATUS_INTERNAL_ERROR;
3767 }
3768
3769 if (!NT_STATUS_IS_OK(nt_status)) {
3770 printf(_("could not handle dir %s: %s\n"),
3771 dir, nt_errstr(nt_status));
3772 return nt_status;
3773 }
3774
3775 /* search below that directory */
3776 if (strlcpy(new_mask, dir, sizeof(new_mask)) >= sizeof(new_mask)) {
3777 return NT_STATUS_NO_MEMORY;
3778 }
3779 if (strlcat(new_mask, "\\*", sizeof(new_mask)) >= sizeof(new_mask)) {
3780 return NT_STATUS_NO_MEMORY;
3781 }
3782
3783 old_dir = local_state->cwd;
3784 local_state->cwd = dir;
3785 nt_status = sync_files(local_state, new_mask);
3786 if (!NT_STATUS_IS_OK(nt_status)) {
3787 printf(_("could not handle files\n"));
3788 }
3789 local_state->cwd = old_dir;
3790
3791 return nt_status;
3792 }
3793
3794
3795 /* FILE */
3796 fstrcpy(filename, local_state->cwd);
3797 fstrcat(filename, "\\");
3798 fstrcat(filename, f->name);
3799
3800 DEBUG(3,("got file: %s\n", filename));
3801
3802 switch (net_mode_share)
3803 {
3804 case NET_MODE_SHARE_MIGRATE:
3805 nt_status = net_copy_file(c, local_state->mem_ctx,
3806 local_state->cli_share_src,
3807 local_state->cli_share_dst,
3808 filename, filename,
3809 c->opt_acls? true : false,
3810 c->opt_attrs? true : false,
3811 c->opt_timestamps? true: false,
3812 true);
3813 break;
3814 default:
3815 d_fprintf(stderr, _("Unsupported file mode %d\n"),
3816 net_mode_share);
3817 return NT_STATUS_INTERNAL_ERROR;
3818 }
3819
3820 if (!NT_STATUS_IS_OK(nt_status))
3821 printf(_("could not handle file %s: %s\n"),
3822 filename, nt_errstr(nt_status));
3823 return nt_status;
3824 }
3825
3826 /**
3827 * sync files, can be called recursivly to list files
3828 * and then call copy_fn for each file
3829 *
3830 * @param cp_clistate pointer to the copy_clistate we work with
3831 * @param mask the current search mask
3832 *
3833 * @return Boolean result
3834 **/
3835 static NTSTATUS sync_files(struct copy_clistate *cp_clistate, const char *mask)
3836 {
3837 struct cli_state *targetcli;
3838 char *targetpath = NULL;
3839 NTSTATUS status;
3840
3841 DEBUG(3,("calling cli_list with mask: %s\n", mask));
3842
3843 status = cli_resolve_path(talloc_tos(), "", NULL,
3844 cp_clistate->cli_share_src,
3845 mask, &targetcli, &targetpath);
3846 if (!NT_STATUS_IS_OK(status)) {
3847 d_fprintf(stderr, _("cli_resolve_path %s failed with error: "
3848 "%s\n"),
3849 mask, nt_errstr(status));
3850 return status;
3851 }
3852
3853 status = cli_list(targetcli, targetpath, cp_clistate->attribute,
3854 copy_fn, cp_clistate);
3855 if (!NT_STATUS_IS_OK(status)) {
3856 d_fprintf(stderr, _("listing %s failed with error: %s\n"),
3857 mask, nt_errstr(status));
3858 }
3859
3860 return status;
3861 }
3862
3863
3864 /**
3865 * Set the top level directory permissions before we do any further copies.
3866 * Should set up ACL inheritance.
3867 **/
3868
3869 bool copy_top_level_perms(struct net_context *c,
3870 struct copy_clistate *cp_clistate,
3871 const char *sharename)
3872 {
3873 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3874
3875 switch (net_mode_share) {
3876 case NET_MODE_SHARE_MIGRATE:
3877 DEBUG(3,("calling net_copy_fileattr for '.' directory in share %s\n", sharename));
3878 nt_status = net_copy_fileattr(c,
3879 cp_clistate->mem_ctx,
3880 cp_clistate->cli_share_src,
3881 cp_clistate->cli_share_dst,
3882 "\\", "\\",
3883 c->opt_acls? true : false,
3884 c->opt_attrs? true : false,
3885 c->opt_timestamps? true: false,
3886 false);
3887 break;
3888 default:
3889 d_fprintf(stderr, _("Unsupported mode %d\n"), net_mode_share);
3890 break;
3891 }
3892
3893 if (!NT_STATUS_IS_OK(nt_status)) {
3894 printf(_("Could handle directory attributes for top level "
3895 "directory of share %s. Error %s\n"),
3896 sharename, nt_errstr(nt_status));
3897 return false;
3898 }
3899
3900 return true;
3901 }
3902
3903 /**
3904 * Sync all files inside a remote share to another share (over smb).
3905 *
3906 * All parameters are provided by the run_rpc_command function, except for
3907 * argc, argv which are passed through.
3908 *
3909 * @param domain_sid The domain sid acquired from the remote server.
3910 * @param cli A cli_state connected to the server.
3911 * @param mem_ctx Talloc context, destroyed on completion of the function.
3912 * @param argc Standard main() style argc.
3913 * @param argv Standard main() style argv. Initial components are already
3914 * stripped.
3915 *
3916 * @return Normal NTSTATUS return.
3917 **/
3918
3919 static NTSTATUS rpc_share_migrate_files_internals(struct net_context *c,
3920 const struct dom_sid *domain_sid,
3921 const char *domain_name,
3922 struct cli_state *cli,
3923 struct rpc_pipe_client *pipe_hnd,
3924 TALLOC_CTX *mem_ctx,
3925 int argc,
3926 const char **argv)
3927 {
3928 WERROR result;
3929 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
3930 struct srvsvc_NetShareInfoCtr ctr_src;
3931 uint32 i;
3932 uint32 level = 502;
3933 struct copy_clistate cp_clistate;
3934 bool got_src_share = false;
3935 bool got_dst_share = false;
3936 const char *mask = "\\*";
3937 char *dst = NULL;
3938
3939 dst = SMB_STRDUP(c->opt_destination?c->opt_destination:"127.0.0.1");
3940 if (dst == NULL) {
3941 nt_status = NT_STATUS_NO_MEMORY;
3942 goto done;
3943 }
3944
3945 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
3946 &ctr_src);
3947
3948 if (!W_ERROR_IS_OK(result))
3949 goto done;
3950
3951 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
3952
3953 struct srvsvc_NetShareInfo502 info502 =
3954 ctr_src.ctr.ctr502->array[i];
3955
3956 if (!check_share_sanity(c, cli, info502.name, info502.type))
3957 continue;
3958
3959 /* one might not want to mirror whole discs :) */
3960 if (strequal(info502.name, "print$") || info502.name[1] == '$') {
3961 d_printf(_("skipping [%s]: builtin/hidden share\n"),
3962 info502.name);
3963 continue;
3964 }
3965
3966 switch (net_mode_share)
3967 {
3968 case NET_MODE_SHARE_MIGRATE:
3969 printf("syncing");
3970 break;
3971 default:
3972 d_fprintf(stderr, _("Unsupported mode %d\n"),
3973 net_mode_share);
3974 break;
3975 }
3976 printf(_(" [%s] files and directories %s ACLs, %s DOS "
3977 "Attributes %s\n"),
3978 info502.name,
3979 c->opt_acls ? _("including") : _("without"),
3980 c->opt_attrs ? _("including") : _("without"),
3981 c->opt_timestamps ? _("(preserving timestamps)") : "");
3982
3983 cp_clistate.mem_ctx = mem_ctx;
3984 cp_clistate.cli_share_src = NULL;
3985 cp_clistate.cli_share_dst = NULL;
3986 cp_clistate.cwd = NULL;
3987 cp_clistate.attribute = FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
3988 cp_clistate.c = c;
3989
3990 /* open share source */
3991 nt_status = connect_to_service(c, &cp_clistate.cli_share_src,
3992 smbXcli_conn_remote_sockaddr(cli->conn),
3993 smbXcli_conn_remote_name(cli->conn),
3994 info502.name, "A:");
3995 if (!NT_STATUS_IS_OK(nt_status))
3996 goto done;
3997
3998 got_src_share = true;
3999
4000 if (net_mode_share == NET_MODE_SHARE_MIGRATE) {
4001 /* open share destination */
4002 nt_status = connect_to_service(c, &cp_clistate.cli_share_dst,
4003 NULL, dst, info502.name, "A:");
4004 if (!NT_STATUS_IS_OK(nt_status))
4005 goto done;
4006
4007 got_dst_share = true;
4008 }
4009
4010 if (!copy_top_level_perms(c, &cp_clistate, info502.name)) {
4011 d_fprintf(stderr, _("Could not handle the top level "
4012 "directory permissions for the "
4013 "share: %s\n"), info502.name);
4014 nt_status = NT_STATUS_UNSUCCESSFUL;
4015 goto done;
4016 }
4017
4018 nt_status = sync_files(&cp_clistate, mask);
4019 if (!NT_STATUS_IS_OK(nt_status)) {
4020 d_fprintf(stderr, _("could not handle files for share: "
4021 "%s\n"), info502.name);
4022 goto done;
4023 }
4024 }
4025
4026 nt_status = NT_STATUS_OK;
4027
4028 done:
4029
4030 if (got_src_share)
4031 cli_shutdown(cp_clistate.cli_share_src);
4032
4033 if (got_dst_share)
4034 cli_shutdown(cp_clistate.cli_share_dst);
4035
4036 SAFE_FREE(dst);
4037 return nt_status;
4038
4039 }
4040
4041 static int rpc_share_migrate_files(struct net_context *c, int argc, const char **argv)
4042 {
4043 if (c->display_usage) {
4044 d_printf( "%s\n"
4045 "net share migrate files\n"
4046 " %s\n",
4047 _("Usage:"),
4048 _("Migrate files to local server"));
4049 return 0;
4050 }
4051
4052 if (!c->opt_host) {
4053 d_printf(_("no server to migrate\n"));
4054 return -1;
4055 }
4056
4057 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4058 rpc_share_migrate_files_internals,
4059 argc, argv);
4060 }
4061
4062 /**
4063 * Migrate share-ACLs from a remote RPC server to the local RPC server.
4064 *
4065 * All parameters are provided by the run_rpc_command function, except for
4066 * argc, argv which are passed through.
4067 *
4068 * @param domain_sid The domain sid acquired from the remote server.
4069 * @param cli A cli_state connected to the server.
4070 * @param mem_ctx Talloc context, destroyed on completion of the function.
4071 * @param argc Standard main() style argc.
4072 * @param argv Standard main() style argv. Initial components are already
4073 * stripped.
4074 *
4075 * @return Normal NTSTATUS return.
4076 **/
4077
4078 static NTSTATUS rpc_share_migrate_security_internals(struct net_context *c,
4079 const struct dom_sid *domain_sid,
4080 const char *domain_name,
4081 struct cli_state *cli,
4082 struct rpc_pipe_client *pipe_hnd,
4083 TALLOC_CTX *mem_ctx,
4084 int argc,
4085 const char **argv)
4086 {
4087 WERROR result;
4088 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
4089 struct srvsvc_NetShareInfoCtr ctr_src;
4090 union srvsvc_NetShareInfo info;
4091 uint32 i;
4092 struct rpc_pipe_client *srvsvc_pipe = NULL;
4093 struct cli_state *cli_dst = NULL;
4094 uint32 level = 502; /* includes secdesc */
4095 uint32_t parm_error = 0;
4096 struct dcerpc_binding_handle *b;
4097
4098 result = get_share_info(c, pipe_hnd, mem_ctx, level, argc, argv,
4099 &ctr_src);
4100
4101 if (!W_ERROR_IS_OK(result))
4102 goto done;
4103
4104 /* connect destination PI_SRVSVC */
4105 nt_status = connect_dst_pipe(c, &cli_dst, &srvsvc_pipe,
4106 &ndr_table_srvsvc.syntax_id);
4107 if (!NT_STATUS_IS_OK(nt_status))
4108 return nt_status;
4109
4110 b = srvsvc_pipe->binding_handle;
4111
4112 for (i = 0; i < ctr_src.ctr.ctr502->count; i++) {
4113
4114 struct srvsvc_NetShareInfo502 info502 =
4115 ctr_src.ctr.ctr502->array[i];
4116
4117 /* reset error-code */
4118 nt_status = NT_STATUS_UNSUCCESSFUL;
4119
4120 if (!check_share_sanity(c, cli, info502.name, info502.type))
4121 continue;
4122
4123 printf(_("migrating: [%s], path: %s, comment: %s, including "
4124 "share-ACLs\n"),
4125 info502.name, info502.path, info502.comment);
4126
4127 if (c->opt_verbose)
4128 display_sec_desc(info502.sd_buf.sd);
4129
4130 /* FIXME: shouldn't we be able to just set the security descriptor ? */
4131 info.info502 = &info502;
4132
4133 /* finally modify the share on the dst server */
4134 nt_status = dcerpc_srvsvc_NetShareSetInfo(b, mem_ctx,
4135 srvsvc_pipe->desthost,
4136 info502.name,
4137 level,
4138 &info,
4139 &parm_error,
4140 &result);
4141 if (!NT_STATUS_IS_OK(nt_status)) {
4142 printf(_("cannot set share-acl: %s\n"),
4143 nt_errstr(nt_status));
4144 goto done;
4145 }
4146 if (!W_ERROR_IS_OK(result)) {
4147 nt_status = werror_to_ntstatus(result);
4148 printf(_("cannot set share-acl: %s\n"),
4149 win_errstr(result));
4150 goto done;
4151 }
4152
4153 }
4154
4155 nt_status = NT_STATUS_OK;
4156
4157 done:
4158 if (cli_dst) {
4159 cli_shutdown(cli_dst);
4160 }
4161
4162 return nt_status;
4163
4164 }
4165
4166 /**
4167 * Migrate share-acls from a RPC server to another.
4168 *
4169 * @param argc Standard main() style argc.
4170 * @param argv Standard main() style argv. Initial components are already
4171 * stripped.
4172 *
4173 * @return A shell status integer (0 for success).
4174 **/
4175 static int rpc_share_migrate_security(struct net_context *c, int argc,
4176 const char **argv)
4177 {
4178 if (c->display_usage) {
4179 d_printf( "%s\n"
4180 "net rpc share migrate security\n"
4181 " %s\n",
4182 _("Usage:"),
4183 _("Migrate share-acls to local server"));
4184 return 0;
4185 }
4186
4187 if (!c->opt_host) {
4188 d_printf(_("no server to migrate\n"));
4189 return -1;
4190 }
4191
4192 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4193 rpc_share_migrate_security_internals,
4194 argc, argv);
4195 }
4196
4197 /**
4198 * Migrate shares (including share-definitions, share-acls and files with acls/attrs)
4199 * from one server to another.
4200 *
4201 * @param argc Standard main() style argc.
4202 * @param argv Standard main() style argv. Initial components are already
4203 * stripped.
4204 *
4205 * @return A shell status integer (0 for success).
4206 *
4207 **/
4208 static int rpc_share_migrate_all(struct net_context *c, int argc,
4209 const char **argv)
4210 {
4211 int ret;
4212
4213 if (c->display_usage) {
4214 d_printf( "%s\n"
4215 "net rpc share migrate all\n"
4216 " %s\n",
4217 _("Usage:"),
4218 _("Migrates shares including all share settings"));
4219 return 0;
4220 }
4221
4222 if (!c->opt_host) {
4223 d_printf(_("no server to migrate\n"));
4224 return -1;
4225 }
4226
4227 /* order is important. we don't want to be locked out by the share-acl
4228 * before copying files - gd */
4229
4230 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4231 rpc_share_migrate_shares_internals, argc, argv);
4232 if (ret)
4233 return ret;
4234
4235 ret = run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4236 rpc_share_migrate_files_internals, argc, argv);
4237 if (ret)
4238 return ret;
4239
4240 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
4241 rpc_share_migrate_security_internals, argc,
4242 argv);
4243 }
4244
4245
4246 /**
4247 * 'net rpc share migrate' entrypoint.
4248 * @param argc Standard main() style argc.
4249 * @param argv Standard main() style argv. Initial components are already
4250 * stripped.
4251 **/
4252 static int rpc_share_migrate(struct net_context *c, int argc, const char **argv)
4253 {
4254
4255 struct functable func[] = {
4256 {
4257 "all",
4258 rpc_share_migrate_all,
4259 NET_TRANSPORT_RPC,
4260 N_("Migrate shares from remote to local server"),
4261 N_("net rpc share migrate all\n"
4262 " Migrate shares from remote to local server")
4263 },
4264 {
4265 "files",
4266 rpc_share_migrate_files,
4267 NET_TRANSPORT_RPC,
4268 N_("Migrate files from remote to local server"),
4269 N_("net rpc share migrate files\n"
4270 " Migrate files from remote to local server")
4271 },
4272 {
4273 "security",
4274 rpc_share_migrate_security,
4275 NET_TRANSPORT_RPC,
4276 N_("Migrate share-ACLs from remote to local server"),
4277 N_("net rpc share migrate security\n"
4278 " Migrate share-ACLs from remote to local server")
4279 },
4280 {
4281 "shares",
4282 rpc_share_migrate_shares,
4283 NET_TRANSPORT_RPC,
4284 N_("Migrate shares from remote to local server"),
4285 N_("net rpc share migrate shares\n"
4286 " Migrate shares from remote to local server")
4287 },
4288 {NULL, NULL, 0, NULL, NULL}
4289 };
4290
4291 net_mode_share = NET_MODE_SHARE_MIGRATE;
4292
4293 return net_run_function(c, argc, argv, "net rpc share migrate", func);
4294 }
4295
4296 struct full_alias {
4297 struct dom_sid sid;
4298 uint32 num_members;
4299 struct dom_sid *members;
4300 };
4301
4302 static int num_server_aliases;
4303 static struct full_alias *server_aliases;
4304
4305 /*
4306 * Add an alias to the static list.
4307 */
4308 static void push_alias(TALLOC_CTX *mem_ctx, struct full_alias *alias)
4309 {
4310 if (server_aliases == NULL)
4311 server_aliases = SMB_MALLOC_ARRAY(struct full_alias, 100);
4312
4313 server_aliases[num_server_aliases] = *alias;
4314 num_server_aliases += 1;
4315 }
4316
4317 /*
4318 * For a specific domain on the server, fetch all the aliases
4319 * and their members. Add all of them to the server_aliases.
4320 */
4321
4322 static NTSTATUS rpc_fetch_domain_aliases(struct rpc_pipe_client *pipe_hnd,
4323 TALLOC_CTX *mem_ctx,
4324 struct policy_handle *connect_pol,
4325 const struct dom_sid *domain_sid)
4326 {
4327 uint32 start_idx, max_entries, num_entries, i;
4328 struct samr_SamArray *groups = NULL;
4329 NTSTATUS result, status;
4330 struct policy_handle domain_pol;
4331 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4332
4333 /* Get domain policy handle */
4334
4335 status = dcerpc_samr_OpenDomain(b, mem_ctx,
4336 connect_pol,
4337 MAXIMUM_ALLOWED_ACCESS,
4338 discard_const_p(struct dom_sid2, domain_sid),
4339 &domain_pol,
4340 &result);
4341 if (!NT_STATUS_IS_OK(status)) {
4342 return status;
4343 }
4344 if (!NT_STATUS_IS_OK(result)) {
4345 return result;
4346 }
4347
4348 start_idx = 0;
4349 max_entries = 250;
4350
4351 do {
4352 status = dcerpc_samr_EnumDomainAliases(b, mem_ctx,
4353 &domain_pol,
4354 &start_idx,
4355 &groups,
4356 max_entries,
4357 &num_entries,
4358 &result);
4359 if (!NT_STATUS_IS_OK(status)) {
4360 goto done;
4361 }
4362 for (i = 0; i < num_entries; i++) {
4363
4364 struct policy_handle alias_pol;
4365 struct full_alias alias;
4366 struct lsa_SidArray sid_array;
4367 int j;
4368 NTSTATUS _result;
4369
4370 status = dcerpc_samr_OpenAlias(b, mem_ctx,
4371 &domain_pol,
4372 MAXIMUM_ALLOWED_ACCESS,
4373 groups->entries[i].idx,
4374 &alias_pol,
4375 &_result);
4376 if (!NT_STATUS_IS_OK(status)) {
4377 goto done;
4378 }
4379 if (!NT_STATUS_IS_OK(_result)) {
4380 status = _result;
4381 goto done;
4382 }
4383
4384 status = dcerpc_samr_GetMembersInAlias(b, mem_ctx,
4385 &alias_pol,
4386 &sid_array,
4387 &_result);
4388 if (!NT_STATUS_IS_OK(status)) {
4389 goto done;
4390 }
4391 if (!NT_STATUS_IS_OK(_result)) {
4392 status = _result;
4393 goto done;
4394 }
4395
4396 alias.num_members = sid_array.num_sids;
4397
4398 status = dcerpc_samr_Close(b, mem_ctx, &alias_pol, &_result);
4399 if (!NT_STATUS_IS_OK(status)) {
4400 goto done;
4401 }
4402 if (!NT_STATUS_IS_OK(_result)) {
4403 status = _result;
4404 goto done;
4405 }
4406
4407 alias.members = NULL;
4408
4409 if (alias.num_members > 0) {
4410 alias.members = SMB_MALLOC_ARRAY(struct dom_sid, alias.num_members);
4411
4412 for (j = 0; j < alias.num_members; j++)
4413 sid_copy(&alias.members[j],
4414 sid_array.sids[j].sid);
4415 }
4416
4417 sid_compose(&alias.sid, domain_sid,
4418 groups->entries[i].idx);
4419
4420 push_alias(mem_ctx, &alias);
4421 }
4422 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
4423
4424 status = NT_STATUS_OK;
4425
4426 done:
4427 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
4428
4429 return status;
4430 }
4431
4432 /*
4433 * Dump server_aliases as names for debugging purposes.
4434 */
4435
4436 static NTSTATUS rpc_aliaslist_dump(struct net_context *c,
4437 const struct dom_sid *domain_sid,
4438 const char *domain_name,
4439 struct cli_state *cli,
4440 struct rpc_pipe_client *pipe_hnd,
4441 TALLOC_CTX *mem_ctx,
4442 int argc,
4443 const char **argv)
4444 {
4445 int i;
4446 NTSTATUS result;
4447 struct policy_handle lsa_pol;
4448 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4449
4450 result = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
4451 SEC_FLAG_MAXIMUM_ALLOWED,
4452 &lsa_pol);
4453 if (!NT_STATUS_IS_OK(result))
4454 return result;
4455
4456 for (i=0; i<num_server_aliases; i++) {
4457 char **names;
4458 char **domains;
4459 enum lsa_SidType *types;
4460 int j;
4461
4462 struct full_alias *alias = &server_aliases[i];
4463
4464 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol, 1,
4465 &alias->sid,
4466 &domains, &names, &types);
4467 if (!NT_STATUS_IS_OK(result))
4468 continue;
4469
4470 DEBUG(1, ("%s\\%s %d: ", domains[0], names[0], types[0]));
4471
4472 if (alias->num_members == 0) {
4473 DEBUG(1, ("\n"));
4474 continue;
4475 }
4476
4477 result = rpccli_lsa_lookup_sids(pipe_hnd, mem_ctx, &lsa_pol,
4478 alias->num_members,
4479 alias->members,
4480 &domains, &names, &types);
4481
4482 if (!NT_STATUS_IS_OK(result) &&
4483 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
4484 continue;
4485
4486 for (j=0; j<alias->num_members; j++)
4487 DEBUG(1, ("%s\\%s (%d); ",
4488 domains[j] ? domains[j] : "*unknown*",
4489 names[j] ? names[j] : "*unknown*",types[j]));
4490 DEBUG(1, ("\n"));
4491 }
4492
4493 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
4494
4495 return NT_STATUS_OK;
4496 }
4497
4498 /*
4499 * Fetch a list of all server aliases and their members into
4500 * server_aliases.
4501 */
4502
4503 static NTSTATUS rpc_aliaslist_internals(struct net_context *c,
4504 const struct dom_sid *domain_sid,
4505 const char *domain_name,
4506 struct cli_state *cli,
4507 struct rpc_pipe_client *pipe_hnd,
4508 TALLOC_CTX *mem_ctx,
4509 int argc,
4510 const char **argv)
4511 {
4512 NTSTATUS result, status;
4513 struct policy_handle connect_pol;
4514 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4515
4516 status = dcerpc_samr_Connect2(b, mem_ctx,
4517 pipe_hnd->desthost,
4518 MAXIMUM_ALLOWED_ACCESS,
4519 &connect_pol,
4520 &result);
4521 if (!NT_STATUS_IS_OK(status)) {
4522 goto done;
4523 }
4524 if (!NT_STATUS_IS_OK(result)) {
4525 status = result;
4526 goto done;
4527 }
4528
4529 status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4530 &global_sid_Builtin);
4531 if (!NT_STATUS_IS_OK(status)) {
4532 goto done;
4533 }
4534
4535 status = rpc_fetch_domain_aliases(pipe_hnd, mem_ctx, &connect_pol,
4536 domain_sid);
4537
4538 dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
4539 done:
4540 return status;
4541 }
4542
4543 static void init_user_token(struct security_token *token, struct dom_sid *user_sid)
4544 {
4545 token->num_sids = 4;
4546
4547 if (!(token->sids = SMB_MALLOC_ARRAY(struct dom_sid, 4))) {
4548 d_fprintf(stderr, "malloc %s\n",_("failed"));
4549 token->num_sids = 0;
4550 return;
4551 }
4552
4553 token->sids[0] = *user_sid;
4554 sid_copy(&token->sids[1], &global_sid_World);
4555 sid_copy(&token->sids[2], &global_sid_Network);
4556 sid_copy(&token->sids[3], &global_sid_Authenticated_Users);
4557 }
4558
4559 static void free_user_token(struct security_token *token)
4560 {
4561 SAFE_FREE(token->sids);
4562 }
4563
4564 static void add_sid_to_token(struct security_token *token, struct dom_sid *sid)
4565 {
4566 if (security_token_has_sid(token, sid))
4567 return;
4568
4569 token->sids = SMB_REALLOC_ARRAY(token->sids, struct dom_sid, token->num_sids+1);
4570 if (!token->sids) {
4571 return;
4572 }
4573
4574 sid_copy(&token->sids[token->num_sids], sid);
4575
4576 token->num_sids += 1;
4577 }
4578
4579 struct user_token {
4580 fstring name;
4581 struct security_token token;
4582 };
4583
4584 static void dump_user_token(struct user_token *token)
4585 {
4586 int i;
4587
4588 d_printf("%s\n", token->name);
4589
4590 for (i=0; i<token->token.num_sids; i++) {
4591 d_printf(" %s\n", sid_string_tos(&token->token.sids[i]));
4592 }
4593 }
4594
4595 static bool is_alias_member(struct dom_sid *sid, struct full_alias *alias)
4596 {
4597 int i;
4598
4599 for (i=0; i<alias->num_members; i++) {
4600 if (dom_sid_compare(sid, &alias->members[i]) == 0)
4601 return true;
4602 }
4603
4604 return false;
4605 }
4606
4607 static void collect_sid_memberships(struct security_token *token, struct dom_sid sid)
4608 {
4609 int i;
4610
4611 for (i=0; i<num_server_aliases; i++) {
4612 if (is_alias_member(&sid, &server_aliases[i]))
4613 add_sid_to_token(token, &server_aliases[i].sid);
4614 }
4615 }
4616
4617 /*
4618 * We got a user token with all the SIDs we can know about without asking the
4619 * server directly. These are the user and domain group sids. All of these can
4620 * be members of aliases. So scan the list of aliases for each of the SIDs and
4621 * add them to the token.
4622 */
4623
4624 static void collect_alias_memberships(struct security_token *token)
4625 {
4626 int num_global_sids = token->num_sids;
4627 int i;
4628
4629 for (i=0; i<num_global_sids; i++) {
4630 collect_sid_memberships(token, token->sids[i]);
4631 }
4632 }
4633
4634 static bool get_user_sids(const char *domain, const char *user, struct security_token *token)
4635 {
4636 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4637 enum wbcSidType type;
4638 fstring full_name;
4639 struct wbcDomainSid wsid;
4640 char sid_str[WBC_SID_STRING_BUFLEN];
4641 struct dom_sid user_sid;
4642 uint32_t num_groups;
4643 gid_t *groups = NULL;
4644 uint32_t i;
4645
4646 fstr_sprintf(full_name, "%s%c%s",
4647 domain, *lp_winbind_separator(), user);
4648
4649 /* First let's find out the user sid */
4650
4651 wbc_status = wbcLookupName(domain, user, &wsid, &type);
4652
4653 if (!WBC_ERROR_IS_OK(wbc_status)) {
4654 DEBUG(1, ("winbind could not find %s: %s\n",
4655 full_name, wbcErrorString(wbc_status)));
4656 return false;
4657 }
4658
4659 wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4660
4661 if (type != WBC_SID_NAME_USER) {
4662 DEBUG(1, ("%s is not a user\n", full_name));
4663 return false;
4664 }
4665
4666 if (!string_to_sid(&user_sid, sid_str)) {
4667 DEBUG(1,("Could not convert sid %s from string\n", sid_str));
4668 return false;
4669 }
4670
4671 init_user_token(token, &user_sid);
4672
4673 /* And now the groups winbind knows about */
4674
4675 wbc_status = wbcGetGroups(full_name, &num_groups, &groups);
4676 if (!WBC_ERROR_IS_OK(wbc_status)) {
4677 DEBUG(1, ("winbind could not get groups of %s: %s\n",
4678 full_name, wbcErrorString(wbc_status)));
4679 return false;
4680 }
4681
4682 for (i = 0; i < num_groups; i++) {
4683 gid_t gid = groups[i];
4684 struct dom_sid sid;
4685
4686 wbc_status = wbcGidToSid(gid, &wsid);
4687 if (!WBC_ERROR_IS_OK(wbc_status)) {
4688 DEBUG(1, ("winbind could not find SID of gid %u: %s\n",
4689 (unsigned int)gid, wbcErrorString(wbc_status)));
4690 wbcFreeMemory(groups);
4691 return false;
4692 }
4693
4694 wbcSidToStringBuf(&wsid, sid_str, sizeof(sid_str));
4695
4696 DEBUG(3, (" %s\n", sid_str));
4697
4698 string_to_sid(&sid, sid_str);
4699 add_sid_to_token(token, &sid);
4700 }
4701 wbcFreeMemory(groups);
4702
4703 return true;
4704 }
4705
4706 /**
4707 * Get a list of all user tokens we want to look at
4708 **/
4709
4710 static bool get_user_tokens(struct net_context *c, int *num_tokens,
4711 struct user_token **user_tokens)
4712 {
4713 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
4714 uint32_t i, num_users;
4715 const char **users;
4716 struct user_token *result;
4717 TALLOC_CTX *frame = NULL;
4718
4719 if (lp_winbind_use_default_domain() &&
4720 (c->opt_target_workgroup == NULL)) {
4721 d_fprintf(stderr, _("winbind use default domain = yes set, "
4722 "please specify a workgroup\n"));
4723 return false;
4724 }
4725
4726 /* Send request to winbind daemon */
4727
4728 wbc_status = wbcListUsers(NULL, &num_users, &users);
4729 if (!WBC_ERROR_IS_OK(wbc_status)) {
4730 DEBUG(1, (_("winbind could not list users: %s\n"),
4731 wbcErrorString(wbc_status)));
4732 return false;
4733 }
4734
4735 result = SMB_MALLOC_ARRAY(struct user_token, num_users);
4736
4737 if (result == NULL) {
4738 DEBUG(1, ("Could not malloc sid array\n"));
4739 wbcFreeMemory(users);
4740 return false;
4741 }
4742
4743 frame = talloc_stackframe();
4744 for (i=0; i < num_users; i++) {
4745 fstring domain, user;
4746 char *p;
4747
4748 fstrcpy(result[i].name, users[i]);
4749
4750 p = strchr(users[i], *lp_winbind_separator());
4751
4752 DEBUG(3, ("%s\n", users[i]));
4753
4754 if (p == NULL) {
4755 fstrcpy(domain, c->opt_target_workgroup);
4756 fstrcpy(user, users[i]);
4757 } else {
4758 *p++ = '\0';
4759 fstrcpy(domain, users[i]);
4760 if (!strupper_m(domain)) {
4761 DEBUG(1, ("strupper_m %s failed\n", domain));
4762 wbcFreeMemory(users);
4763 return false;
4764 }
4765 fstrcpy(user, p);
4766 }
4767
4768 get_user_sids(domain, user, &(result[i].token));
4769 }
4770 TALLOC_FREE(frame);
4771 wbcFreeMemory(users);
4772
4773 *num_tokens = num_users;
4774 *user_tokens = result;
4775
4776 return true;
4777 }
4778
4779 static bool get_user_tokens_from_file(FILE *f,
4780 int *num_tokens,
4781 struct user_token **tokens)
4782 {
4783 struct user_token *token = NULL;
4784
4785 while (!feof(f)) {
4786 fstring line;
4787
4788 if (fgets(line, sizeof(line)-1, f) == NULL) {
4789 return true;
4790 }
4791
4792 if ((strlen(line) > 0) && (line[strlen(line)-1] == '\n')) {
4793 line[strlen(line)-1] = '\0';
4794 }
4795
4796 if (line[0] == ' ') {
4797 /* We have a SID */
4798
4799 struct dom_sid sid;
4800 if(!string_to_sid(&sid, &line[1])) {
4801 DEBUG(1,("get_user_tokens_from_file: Could "
4802 "not convert sid %s \n",&line[1]));
4803 return false;
4804 }
4805
4806 if (token == NULL) {
4807 DEBUG(0, ("File does not begin with username"));
4808 return false;
4809 }
4810
4811 add_sid_to_token(&token->token, &sid);
4812 continue;
4813 }
4814
4815 /* And a new user... */
4816
4817 *num_tokens += 1;
4818 *tokens = SMB_REALLOC_ARRAY(*tokens, struct user_token, *num_tokens);
4819 if (*tokens == NULL) {
4820 DEBUG(0, ("Could not realloc tokens\n"));
4821 return false;
4822 }
4823
4824 token = &((*tokens)[*num_tokens-1]);
4825
4826 if (strlcpy(token->name, line, sizeof(token->name)) >= sizeof(token->name)) {
4827 return false;
4828 }
4829 token->token.num_sids = 0;
4830 token->token.sids = NULL;
4831 continue;
4832 }
4833
4834 return false;
4835 }
4836
4837
4838 /*
4839 * Show the list of all users that have access to a share
4840 */
4841
4842 static void show_userlist(struct rpc_pipe_client *pipe_hnd,
4843 TALLOC_CTX *mem_ctx,
4844 const char *netname,
4845 int num_tokens,
4846 struct user_token *tokens)
4847 {
4848 uint16_t fnum;
4849 struct security_descriptor *share_sd = NULL;
4850 struct security_descriptor *root_sd = NULL;
4851 struct cli_state *cli = rpc_pipe_np_smb_conn(pipe_hnd);
4852 int i;
4853 union srvsvc_NetShareInfo info;
4854 WERROR result;
4855 NTSTATUS status;
4856 uint16 cnum;
4857 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
4858
4859 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
4860 pipe_hnd->desthost,
4861 netname,
4862 502,
4863 &info,
4864 &result);
4865
4866 if (!NT_STATUS_IS_OK(status) || !W_ERROR_IS_OK(result)) {
4867 DEBUG(1, ("Coult not query secdesc for share %s\n",
4868 netname));
4869 return;
4870 }
4871
4872 share_sd = info.info502->sd_buf.sd;
4873 if (share_sd == NULL) {
4874 DEBUG(1, ("Got no secdesc for share %s\n",
4875 netname));
4876 }
4877
4878 cnum = cli_state_get_tid(cli);
4879
4880 if (!NT_STATUS_IS_OK(cli_tree_connect(cli, netname, "A:", "", 0))) {
4881 return;
4882 }
4883
4884 if (!NT_STATUS_IS_OK(cli_ntcreate(cli, "\\", 0, READ_CONTROL_ACCESS, 0,
4885 FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_OPEN, 0x0, 0x0, &fnum))) {
4886 cli_query_secdesc(cli, fnum, mem_ctx, &root_sd);
4887 }
4888
4889 for (i=0; i<num_tokens; i++) {
4890 uint32 acc_granted;
4891
4892 if (share_sd != NULL) {
4893 status = se_access_check(share_sd, &tokens[i].token,
4894 1, &acc_granted);
4895
4896 if (!NT_STATUS_IS_OK(status)) {
4897 DEBUG(1, ("Could not check share_sd for "
4898 "user %s\n",
4899 tokens[i].name));
4900 continue;
4901 }
4902 }
4903
4904 if (root_sd == NULL) {
4905 d_printf(" %s\n", tokens[i].name);
4906 continue;
4907 }
4908
4909 status = se_access_check(root_sd, &tokens[i].token,
4910 1, &acc_granted);
4911 if (!NT_STATUS_IS_OK(status)) {
4912 DEBUG(1, ("Could not check root_sd for user %s\n",
4913 tokens[i].name));
4914 continue;
4915 }
4916 d_printf(" %s\n", tokens[i].name);
4917 }
4918
4919 if (fnum != (uint16_t)-1)
4920 cli_close(cli, fnum);
4921 cli_tdis(cli);
4922 cli_state_set_tid(cli, cnum);
4923
4924 return;
4925 }
4926
4927 /**
4928 * List shares on a remote RPC server, including the security descriptors.
4929 *
4930 * All parameters are provided by the run_rpc_command function, except for
4931 * argc, argv which are passed through.
4932 *
4933 * @param domain_sid The domain sid acquired from the remote server.
4934 * @param cli A cli_state connected to the server.
4935 * @param mem_ctx Talloc context, destroyed on completion of the function.
4936 * @param argc Standard main() style argc.
4937 * @param argv Standard main() style argv. Initial components are already
4938 * stripped.
4939 *
4940 * @return Normal NTSTATUS return.
4941 **/
4942
4943 static NTSTATUS rpc_share_allowedusers_internals(struct net_context *c,
4944 const struct dom_sid *domain_sid,
4945 const char *domain_name,
4946 struct cli_state *cli,
4947 struct rpc_pipe_client *pipe_hnd,
4948 TALLOC_CTX *mem_ctx,
4949 int argc,
4950 const char **argv)
4951 {
4952 bool r;
4953 FILE *f;
4954 NTSTATUS nt_status = NT_STATUS_OK;
4955 uint32_t total_entries = 0;
4956 uint32_t resume_handle = 0;
4957 uint32_t preferred_len = 0xffffffff;
4958 uint32_t i;
4959 struct dcerpc_binding_handle *b = NULL;
4960 struct srvsvc_NetShareInfoCtr info_ctr;
4961 struct srvsvc_NetShareCtr1 ctr1;
4962 WERROR result;
4963
4964 struct user_token *tokens = NULL;
4965 int num_tokens = 0;
4966
4967 if (argc == 0) {
4968 f = stdin;
4969 } else {
4970 f = fopen(argv[0], "r");
4971 }
4972
4973 if (f == NULL) {
4974 DEBUG(0, ("Could not open userlist: %s\n", strerror(errno)));
4975 return NT_STATUS_UNSUCCESSFUL;
4976 }
4977
4978 r = get_user_tokens_from_file(f, &num_tokens, &tokens);
4979
4980 if (f != stdin)
4981 fclose(f);
4982
4983 if (!r) {
4984 DEBUG(0, ("Could not read users from file\n"));
4985 return NT_STATUS_UNSUCCESSFUL;
4986 }
4987
4988 for (i=0; i<num_tokens; i++)
4989 collect_alias_memberships(&tokens[i].token);
4990
4991 ZERO_STRUCT(info_ctr);
4992 ZERO_STRUCT(ctr1);
4993
4994 info_ctr.level = 1;
4995 info_ctr.ctr.ctr1 = &ctr1;
4996
4997 b = pipe_hnd->binding_handle;
4998
4999 /* Issue the NetShareEnum RPC call and retrieve the response */
5000 nt_status = dcerpc_srvsvc_NetShareEnumAll(b,
5001 talloc_tos(),
5002 pipe_hnd->desthost,
5003 &info_ctr,
5004 preferred_len,
5005 &total_entries,
5006 &resume_handle,
5007 &result);
5008
5009 /* Was it successful? */
5010 if (!NT_STATUS_IS_OK(nt_status)) {
5011 /* Nope. Go clean up. */
5012 goto done;
5013 }
5014
5015 if (!W_ERROR_IS_OK(result)) {
5016 /* Nope. Go clean up. */
5017 nt_status = werror_to_ntstatus(result);
5018 goto done;
5019 }
5020
5021 if (total_entries == 0) {
5022 goto done;
5023 }
5024
5025 /* For each returned entry... */
5026 for (i = 0; i < info_ctr.ctr.ctr1->count; i++) {
5027 const char *netname = info_ctr.ctr.ctr1->array[i].name;
5028
5029 if (info_ctr.ctr.ctr1->array[i].type != STYPE_DISKTREE) {
5030 continue;
5031 }
5032
5033 d_printf("%s\n", netname);
5034
5035 show_userlist(pipe_hnd, mem_ctx, netname,
5036 num_tokens, tokens);
5037 }
5038 done:
5039 for (i=0; i<num_tokens; i++) {
5040 free_user_token(&tokens[i].token);
5041 }
5042 SAFE_FREE(tokens);
5043
5044 return nt_status;
5045 }
5046
5047 static int rpc_share_allowedusers(struct net_context *c, int argc,
5048 const char **argv)
5049 {
5050 int result;
5051
5052 if (c->display_usage) {
5053 d_printf( "%s\n"
5054 "net rpc share allowedusers\n"
5055 " %s\n",
5056 _("Usage:"),
5057 _("List allowed users"));
5058 return 0;
5059 }
5060
5061 result = run_rpc_command(c, NULL, &ndr_table_samr, 0,
5062 rpc_aliaslist_internals,
5063 argc, argv);
5064 if (result != 0)
5065 return result;
5066
5067 result = run_rpc_command(c, NULL, &ndr_table_lsarpc, 0,
5068 rpc_aliaslist_dump,
5069 argc, argv);
5070 if (result != 0)
5071 return result;
5072
5073 return run_rpc_command(c, NULL, &ndr_table_srvsvc, 0,
5074 rpc_share_allowedusers_internals,
5075 argc, argv);
5076 }
5077
5078 int net_usersidlist(struct net_context *c, int argc, const char **argv)
5079 {
5080 int num_tokens = 0;
5081 struct user_token *tokens = NULL;
5082 int i;
5083
5084 if (argc != 0) {
5085 net_usersidlist_usage(c, argc, argv);
5086 return 0;
5087 }
5088
5089 if (!get_user_tokens(c, &num_tokens, &tokens)) {
5090 DEBUG(0, ("Could not get the user/sid list\n"));
5091 return -1;
5092 }
5093
5094 for (i=0; i<num_tokens; i++) {
5095 dump_user_token(&tokens[i]);
5096 free_user_token(&tokens[i].token);
5097 }
5098
5099 SAFE_FREE(tokens);
5100 return 0;
5101 }
5102
5103 int net_usersidlist_usage(struct net_context *c, int argc, const char **argv)
5104 {
5105 d_printf(_("net usersidlist\n"
5106 "\tprints out a list of all users the running winbind knows\n"
5107 "\tabout, together with all their SIDs. This is used as\n"
5108 "\tinput to the 'net rpc share allowedusers' command.\n\n"));
5109
5110 net_common_flags_usage(c, argc, argv);
5111 return -1;
5112 }
5113
5114 /**
5115 * 'net rpc share' entrypoint.
5116 * @param argc Standard main() style argc.
5117 * @param argv Standard main() style argv. Initial components are already
5118 * stripped.
5119 **/
5120
5121 int net_rpc_share(struct net_context *c, int argc, const char **argv)
5122 {
5123 NET_API_STATUS status;
5124
5125 struct functable func[] = {
5126 {
5127 "add",
5128 rpc_share_add,
5129 NET_TRANSPORT_RPC,
5130 N_("Add share"),
5131 N_("net rpc share add\n"
5132 " Add share")
5133 },
5134 {
5135 "delete",
5136 rpc_share_delete,
5137 NET_TRANSPORT_RPC,
5138 N_("Remove share"),
5139 N_("net rpc share delete\n"
5140 " Remove share")
5141 },
5142 {
5143 "allowedusers",
5144 rpc_share_allowedusers,
5145 NET_TRANSPORT_RPC,
5146 N_("Modify allowed users"),
5147 N_("net rpc share allowedusers\n"
5148 " Modify allowed users")
5149 },
5150 {
5151 "migrate",
5152 rpc_share_migrate,
5153 NET_TRANSPORT_RPC,
5154 N_("Migrate share to local server"),
5155 N_("net rpc share migrate\n"
5156 " Migrate share to local server")
5157 },
5158 {
5159 "list",
5160 rpc_share_list,
5161 NET_TRANSPORT_RPC,
5162 N_("List shares"),
5163 N_("net rpc share list\n"
5164 " List shares")
5165 },
5166 {NULL, NULL, 0, NULL, NULL}
5167 };
5168
5169 status = libnetapi_net_init(&c->netapi_ctx);
5170 if (status != 0) {
5171 return -1;
5172 }
5173 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5174 libnetapi_set_password(c->netapi_ctx, c->opt_password);
5175 if (c->opt_kerberos) {
5176 libnetapi_set_use_kerberos(c->netapi_ctx);
5177 }
5178
5179 if (argc == 0) {
5180 if (c->display_usage) {
5181 d_printf("%s\n%s",
5182 _("Usage:"),
5183 _("net rpc share\n"
5184 " List shares\n"
5185 " Alias for net rpc share list\n"));
5186 net_display_usage_from_functable(func);
5187 return 0;
5188 }
5189
5190 return rpc_share_list(c, argc, argv);
5191 }
5192
5193 return net_run_function(c, argc, argv, "net rpc share", func);
5194 }
5195
5196 static NTSTATUS rpc_sh_share_list(struct net_context *c,
5197 TALLOC_CTX *mem_ctx,
5198 struct rpc_sh_ctx *ctx,
5199 struct rpc_pipe_client *pipe_hnd,
5200 int argc, const char **argv)
5201 {
5202
5203 return werror_to_ntstatus(W_ERROR(rpc_share_list(c, argc, argv)));
5204 }
5205
5206 static NTSTATUS rpc_sh_share_add(struct net_context *c,
5207 TALLOC_CTX *mem_ctx,
5208 struct rpc_sh_ctx *ctx,
5209 struct rpc_pipe_client *pipe_hnd,
5210 int argc, const char **argv)
5211 {
5212 NET_API_STATUS status;
5213 uint32_t parm_err = 0;
5214 struct SHARE_INFO_2 i2;
5215
5216 if ((argc < 2) || (argc > 3)) {
5217 d_fprintf(stderr, _("Usage: %s <share> <path> [comment]\n"),
5218 ctx->whoami);
5219 return NT_STATUS_INVALID_PARAMETER;
5220 }
5221
5222 i2.shi2_netname = argv[0];
5223 i2.shi2_type = STYPE_DISKTREE;
5224 i2.shi2_remark = (argc == 3) ? argv[2] : "";
5225 i2.shi2_permissions = 0;
5226 i2.shi2_max_uses = 0;
5227 i2.shi2_current_uses = 0;
5228 i2.shi2_path = argv[1];
5229 i2.shi2_passwd = NULL;
5230
5231 status = NetShareAdd(pipe_hnd->desthost,
5232 2,
5233 (uint8_t *)&i2,
5234 &parm_err);
5235
5236 return werror_to_ntstatus(W_ERROR(status));
5237 }
5238
5239 static NTSTATUS rpc_sh_share_delete(struct net_context *c,
5240 TALLOC_CTX *mem_ctx,
5241 struct rpc_sh_ctx *ctx,
5242 struct rpc_pipe_client *pipe_hnd,
5243 int argc, const char **argv)
5244 {
5245 if (argc != 1) {
5246 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5247 return NT_STATUS_INVALID_PARAMETER;
5248 }
5249
5250 return werror_to_ntstatus(W_ERROR(NetShareDel(pipe_hnd->desthost, argv[0], 0)));
5251 }
5252
5253 static NTSTATUS rpc_sh_share_info(struct net_context *c,
5254 TALLOC_CTX *mem_ctx,
5255 struct rpc_sh_ctx *ctx,
5256 struct rpc_pipe_client *pipe_hnd,
5257 int argc, const char **argv)
5258 {
5259 union srvsvc_NetShareInfo info;
5260 WERROR result;
5261 NTSTATUS status;
5262 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5263
5264 if (argc != 1) {
5265 d_fprintf(stderr, "%s %s <share>\n", _("Usage:"), ctx->whoami);
5266 return NT_STATUS_INVALID_PARAMETER;
5267 }
5268
5269 status = dcerpc_srvsvc_NetShareGetInfo(b, mem_ctx,
5270 pipe_hnd->desthost,
5271 argv[0],
5272 2,
5273 &info,
5274 &result);
5275 if (!NT_STATUS_IS_OK(status)) {
5276 result = ntstatus_to_werror(status);
5277 goto done;
5278 }
5279 if (!W_ERROR_IS_OK(result)) {
5280 goto done;
5281 }
5282
5283 d_printf(_("Name: %s\n"), info.info2->name);
5284 d_printf(_("Comment: %s\n"), info.info2->comment);
5285 d_printf(_("Path: %s\n"), info.info2->path);
5286 d_printf(_("Password: %s\n"), info.info2->password);
5287
5288 done:
5289 return werror_to_ntstatus(result);
5290 }
5291
5292 struct rpc_sh_cmd *net_rpc_share_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
5293 struct rpc_sh_ctx *ctx)
5294 {
5295 static struct rpc_sh_cmd cmds[] = {
5296
5297 { "list", NULL, &ndr_table_srvsvc, rpc_sh_share_list,
5298 N_("List available shares") },
5299
5300 { "add", NULL, &ndr_table_srvsvc, rpc_sh_share_add,
5301 N_("Add a share") },
5302
5303 { "delete", NULL, &ndr_table_srvsvc, rpc_sh_share_delete,
5304 N_("Delete a share") },
5305
5306 { "info", NULL, &ndr_table_srvsvc, rpc_sh_share_info,
5307 N_("Get information about a share") },
5308
5309 { NULL, NULL, 0, NULL, NULL }
5310 };
5311
5312 return cmds;
5313 }
5314
5315 /****************************************************************************/
5316
5317 static int rpc_file_usage(struct net_context *c, int argc, const char **argv)
5318 {
5319 return net_file_usage(c, argc, argv);
5320 }
5321
5322 /**
5323 * Close a file on a remote RPC server.
5324 *
5325 * @param argc Standard main() style argc.
5326 * @param argv Standard main() style argv. Initial components are already
5327 * stripped.
5328 *
5329 * @return A shell status integer (0 for success).
5330 **/
5331 static int rpc_file_close(struct net_context *c, int argc, const char **argv)
5332 {
5333 if (argc < 1 || c->display_usage) {
5334 return rpc_file_usage(c, argc, argv);
5335 }
5336
5337 return NetFileClose(c->opt_host, atoi(argv[0]));
5338 }
5339
5340 /**
5341 * Formatted print of open file info
5342 *
5343 * @param r struct FILE_INFO_3 contents
5344 **/
5345
5346 static void display_file_info_3(struct FILE_INFO_3 *r)
5347 {
5348 d_printf("%-7.1d %-20.20s 0x%-4.2x %-6.1d %s\n",
5349 r->fi3_id, r->fi3_username, r->fi3_permissions,
5350 r->fi3_num_locks, r->fi3_pathname);
5351 }
5352
5353 /**
5354 * List files for a user on a remote RPC server.
5355 *
5356 * @param argc Standard main() style argc.
5357 * @param argv Standard main() style argv. Initial components are already
5358 * stripped.
5359 *
5360 * @return A shell status integer (0 for success)..
5361 **/
5362
5363 static int rpc_file_user(struct net_context *c, int argc, const char **argv)
5364 {
5365 NET_API_STATUS status;
5366 uint32 preferred_len = 0xffffffff, i;
5367 const char *username=NULL;
5368 uint32_t total_entries = 0;
5369 uint32_t entries_read = 0;
5370 uint32_t resume_handle = 0;
5371 struct FILE_INFO_3 *i3 = NULL;
5372
5373 if (c->display_usage) {
5374 return rpc_file_usage(c, argc, argv);
5375 }
5376
5377 /* if argc > 0, must be user command */
5378 if (argc > 0) {
5379 username = smb_xstrdup(argv[0]);
5380 }
5381
5382 status = NetFileEnum(c->opt_host,
5383 NULL,
5384 username,
5385 3,
5386 (uint8_t **)(void *)&i3,
5387 preferred_len,
5388 &entries_read,
5389 &total_entries,
5390 &resume_handle);
5391
5392 if (status != 0) {
5393 goto done;
5394 }
5395
5396 /* Display results */
5397
5398 d_printf(_(
5399 "\nEnumerating open files on remote server:\n\n"
5400 "\nFileId Opened by Perms Locks Path"
5401 "\n------ --------- ----- ----- ---- \n"));
5402 for (i = 0; i < entries_read; i++) {
5403 display_file_info_3(&i3[i]);
5404 }
5405 done:
5406 return status;
5407 }
5408
5409 /**
5410 * 'net rpc file' entrypoint.
5411 * @param argc Standard main() style argc.
5412 * @param argv Standard main() style argv. Initial components are already
5413 * stripped.
5414 **/
5415
5416 int net_rpc_file(struct net_context *c, int argc, const char **argv)
5417 {
5418 NET_API_STATUS status;
5419
5420 struct functable func[] = {
5421 {
5422 "close",
5423 rpc_file_close,
5424 NET_TRANSPORT_RPC,
5425 N_("Close opened file"),
5426 N_("net rpc file close\n"
5427 " Close opened file")
5428 },
5429 {
5430 "user",
5431 rpc_file_user,
5432 NET_TRANSPORT_RPC,
5433 N_("List files opened by user"),
5434 N_("net rpc file user\n"
5435 " List files opened by user")
5436 },
5437 #if 0
5438 {
5439 "info",
5440 rpc_file_info,
5441 NET_TRANSPORT_RPC,
5442 N_("Display information about opened file"),
5443 N_("net rpc file info\n"
5444 " Display information about opened file")
5445 },
5446 #endif
5447 {NULL, NULL, 0, NULL, NULL}
5448 };
5449
5450 status = libnetapi_net_init(&c->netapi_ctx);
5451 if (status != 0) {
5452 return -1;
5453 }
5454 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
5455 libnetapi_set_password(c->netapi_ctx, c->opt_password);
5456 if (c->opt_kerberos) {
5457 libnetapi_set_use_kerberos(c->netapi_ctx);
5458 }
5459
5460 if (argc == 0) {
5461 if (c->display_usage) {
5462 d_printf(_("Usage:\n"));
5463 d_printf(_("net rpc file\n"
5464 " List opened files\n"));
5465 net_display_usage_from_functable(func);
5466 return 0;
5467 }
5468
5469 return rpc_file_user(c, argc, argv);
5470 }
5471
5472 return net_run_function(c, argc, argv, "net rpc file", func);
5473 }
5474
5475 /**
5476 * ABORT the shutdown of a remote RPC Server, over initshutdown pipe.
5477 *
5478 * All parameters are provided by the run_rpc_command function, except for
5479 * argc, argv which are passed through.
5480 *
5481 * @param c A net_context structure.
5482 * @param domain_sid The domain sid acquired from the remote server.
5483 * @param cli A cli_state connected to the server.
5484 * @param mem_ctx Talloc context, destroyed on completion of the function.
5485 * @param argc Standard main() style argc.
5486 * @param argv Standard main() style argv. Initial components are already
5487 * stripped.
5488 *
5489 * @return Normal NTSTATUS return.
5490 **/
5491
5492 static NTSTATUS rpc_shutdown_abort_internals(struct net_context *c,
5493 const struct dom_sid *domain_sid,
5494 const char *domain_name,
5495 struct cli_state *cli,
5496 struct rpc_pipe_client *pipe_hnd,
5497 TALLOC_CTX *mem_ctx,
5498 int argc,
5499 const char **argv)
5500 {
5501 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5502 WERROR result;
5503 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5504
5505 status = dcerpc_initshutdown_Abort(b, mem_ctx, NULL, &result);
5506 if (!NT_STATUS_IS_OK(status)) {
5507 return status;
5508 }
5509 if (W_ERROR_IS_OK(result)) {
5510 d_printf(_("\nShutdown successfully aborted\n"));
5511 DEBUG(5,("cmd_shutdown_abort: query succeeded\n"));
5512 } else
5513 DEBUG(5,("cmd_shutdown_abort: query failed\n"));
5514
5515 return werror_to_ntstatus(result);
5516 }
5517
5518 /**
5519 * ABORT the shutdown of a remote RPC Server, over winreg pipe.
5520 *
5521 * All parameters are provided by the run_rpc_command function, except for
5522 * argc, argv which are passed through.
5523 *
5524 * @param c A net_context structure.
5525 * @param domain_sid The domain sid acquired from the remote server.
5526 * @param cli A cli_state connected to the server.
5527 * @param mem_ctx Talloc context, destroyed on completion of the function.
5528 * @param argc Standard main() style argc.
5529 * @param argv Standard main() style argv. Initial components are already
5530 * stripped.
5531 *
5532 * @return Normal NTSTATUS return.
5533 **/
5534
5535 static NTSTATUS rpc_reg_shutdown_abort_internals(struct net_context *c,
5536 const struct dom_sid *domain_sid,
5537 const char *domain_name,
5538 struct cli_state *cli,
5539 struct rpc_pipe_client *pipe_hnd,
5540 TALLOC_CTX *mem_ctx,
5541 int argc,
5542 const char **argv)
5543 {
5544 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
5545 WERROR werr;
5546 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5547
5548 result = dcerpc_winreg_AbortSystemShutdown(b, mem_ctx, NULL, &werr);
5549
5550 if (!NT_STATUS_IS_OK(result)) {
5551 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5552 return result;
5553 }
5554 if (W_ERROR_IS_OK(werr)) {
5555 d_printf(_("\nShutdown successfully aborted\n"));
5556 DEBUG(5,("cmd_reg_abort_shutdown: query succeeded\n"));
5557 } else
5558 DEBUG(5,("cmd_reg_abort_shutdown: query failed\n"));
5559
5560 return werror_to_ntstatus(werr);
5561 }
5562
5563 /**
5564 * ABORT the shutdown of a remote RPC server.
5565 *
5566 * @param argc Standard main() style argc.
5567 * @param argv Standard main() style argv. Initial components are already
5568 * stripped.
5569 *
5570 * @return A shell status integer (0 for success).
5571 **/
5572
5573 static int rpc_shutdown_abort(struct net_context *c, int argc,
5574 const char **argv)
5575 {
5576 int rc = -1;
5577
5578 if (c->display_usage) {
5579 d_printf( "%s\n"
5580 "net rpc abortshutdown\n"
5581 " %s\n",
5582 _("Usage:"),
5583 _("Abort a scheduled shutdown"));
5584 return 0;
5585 }
5586
5587 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5588 rpc_shutdown_abort_internals, argc, argv);
5589
5590 if (rc == 0)
5591 return rc;
5592
5593 DEBUG(1, ("initshutdown pipe didn't work, trying winreg pipe\n"));
5594
5595 return run_rpc_command(c, NULL, &ndr_table_winreg, 0,
5596 rpc_reg_shutdown_abort_internals,
5597 argc, argv);
5598 }
5599
5600 /**
5601 * Shut down a remote RPC Server via initshutdown pipe.
5602 *
5603 * All parameters are provided by the run_rpc_command function, except for
5604 * argc, argv which are passed through.
5605 *
5606 * @param c A net_context structure.
5607 * @param domain_sid The domain sid acquired from the remote server.
5608 * @param cli A cli_state connected to the server.
5609 * @param mem_ctx Talloc context, destroyed on completion of the function.
5610 * @param argc Standard main() style argc.
5611 * @param argv Standard main() style argv. Initial components are already
5612 * stripped.
5613 *
5614 * @return Normal NTSTATUS return.
5615 **/
5616
5617 NTSTATUS rpc_init_shutdown_internals(struct net_context *c,
5618 const struct dom_sid *domain_sid,
5619 const char *domain_name,
5620 struct cli_state *cli,
5621 struct rpc_pipe_client *pipe_hnd,
5622 TALLOC_CTX *mem_ctx,
5623 int argc,
5624 const char **argv)
5625 {
5626 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
5627 WERROR result;
5628 const char *msg = N_("This machine will be shutdown shortly");
5629 uint32 timeout = 20;
5630 struct lsa_StringLarge msg_string;
5631 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5632
5633 if (c->opt_comment) {
5634 msg = c->opt_comment;
5635 }
5636 if (c->opt_timeout) {
5637 timeout = c->opt_timeout;
5638 }
5639
5640 msg_string.string = msg;
5641
5642 /* create an entry */
5643 status = dcerpc_initshutdown_Init(b, mem_ctx, NULL,
5644 &msg_string, timeout, c->opt_force, c->opt_reboot,
5645 &result);
5646 if (!NT_STATUS_IS_OK(status)) {
5647 return status;
5648 }
5649 if (W_ERROR_IS_OK(result)) {
5650 d_printf(_("\nShutdown of remote machine succeeded\n"));
5651 DEBUG(5,("Shutdown of remote machine succeeded\n"));
5652 } else {
5653 DEBUG(1,("Shutdown of remote machine failed!\n"));
5654 }
5655 return werror_to_ntstatus(result);
5656 }
5657
5658 /**
5659 * Shut down a remote RPC Server via winreg pipe.
5660 *
5661 * All parameters are provided by the run_rpc_command function, except for
5662 * argc, argv which are passed through.
5663 *
5664 * @param c A net_context structure.
5665 * @param domain_sid The domain sid acquired from the remote server.
5666 * @param cli A cli_state connected to the server.
5667 * @param mem_ctx Talloc context, destroyed on completion of the function.
5668 * @param argc Standard main() style argc.
5669 * @param argv Standard main() style argv. Initial components are already
5670 * stripped.
5671 *
5672 * @return Normal NTSTATUS return.
5673 **/
5674
5675 NTSTATUS rpc_reg_shutdown_internals(struct net_context *c,
5676 const struct dom_sid *domain_sid,
5677 const char *domain_name,
5678 struct cli_state *cli,
5679 struct rpc_pipe_client *pipe_hnd,
5680 TALLOC_CTX *mem_ctx,
5681 int argc,
5682 const char **argv)
5683 {
5684 const char *msg = N_("This machine will be shutdown shortly");
5685 uint32 timeout = 20;
5686 struct lsa_StringLarge msg_string;
5687 NTSTATUS result;
5688 WERROR werr;
5689 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5690
5691 if (c->opt_comment) {
5692 msg = c->opt_comment;
5693 }
5694 msg_string.string = msg;
5695
5696 if (c->opt_timeout) {
5697 timeout = c->opt_timeout;
5698 }
5699
5700 /* create an entry */
5701 result = dcerpc_winreg_InitiateSystemShutdown(b, mem_ctx, NULL,
5702 &msg_string, timeout, c->opt_force, c->opt_reboot,
5703 &werr);
5704 if (!NT_STATUS_IS_OK(result)) {
5705 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5706 return result;
5707 }
5708
5709 if (W_ERROR_IS_OK(werr)) {
5710 d_printf(_("\nShutdown of remote machine succeeded\n"));
5711 } else {
5712 d_fprintf(stderr, "\nShutdown of remote machine failed\n");
5713 if ( W_ERROR_EQUAL(werr, WERR_MACHINE_LOCKED) )
5714 d_fprintf(stderr, "\nMachine locked, use -f switch to force\n");
5715 else
5716 d_fprintf(stderr, "\nresult was: %s\n", win_errstr(werr));
5717 }
5718
5719 return werror_to_ntstatus(werr);
5720 }
5721
5722 /**
5723 * Shut down a remote RPC server.
5724 *
5725 * @param argc Standard main() style argc.
5726 * @param argv Standard main() style argv. Initial components are already
5727 * stripped.
5728 *
5729 * @return A shell status integer (0 for success).
5730 **/
5731
5732 static int rpc_shutdown(struct net_context *c, int argc, const char **argv)
5733 {
5734 int rc = -1;
5735
5736 if (c->display_usage) {
5737 d_printf( "%s\n"
5738 "net rpc shutdown\n"
5739 " %s\n",
5740 _("Usage:"),
5741 _("Shut down a remote RPC server"));
5742 return 0;
5743 }
5744
5745 rc = run_rpc_command(c, NULL, &ndr_table_initshutdown, 0,
5746 rpc_init_shutdown_internals, argc, argv);
5747
5748 if (rc) {
5749 DEBUG(1, ("initshutdown pipe failed, trying winreg pipe\n"));
5750 rc = run_rpc_command(c, NULL, &ndr_table_winreg, 0,
5751 rpc_reg_shutdown_internals, argc, argv);
5752 }
5753
5754 return rc;
5755 }
5756
5757 /***************************************************************************
5758 NT Domain trusts code (i.e. 'net rpc trustdom' functionality)
5759 ***************************************************************************/
5760
5761 /**
5762 * Add interdomain trust account to the RPC server.
5763 * All parameters (except for argc and argv) are passed by run_rpc_command
5764 * function.
5765 *
5766 * @param c A net_context structure.
5767 * @param domain_sid The domain sid acquired from the server.
5768 * @param cli A cli_state connected to the server.
5769 * @param mem_ctx Talloc context, destroyed on completion of the function.
5770 * @param argc Standard main() style argc.
5771 * @param argv Standard main() style argv. Initial components are already
5772 * stripped.
5773 *
5774 * @return normal NTSTATUS return code.
5775 */
5776
5777 static NTSTATUS rpc_trustdom_add_internals(struct net_context *c,
5778 const struct dom_sid *domain_sid,
5779 const char *domain_name,
5780 struct cli_state *cli,
5781 struct rpc_pipe_client *pipe_hnd,
5782 TALLOC_CTX *mem_ctx,
5783 int argc,
5784 const char **argv)
5785 {
5786 struct policy_handle connect_pol, domain_pol, user_pol;
5787 NTSTATUS status, result;
5788 char *acct_name;
5789 struct lsa_String lsa_acct_name;
5790 uint32 acb_info;
5791 uint32 acct_flags=0;
5792 uint32 user_rid;
5793 uint32_t access_granted = 0;
5794 union samr_UserInfo info;
5795 unsigned int orig_timeout;
5796 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5797 DATA_BLOB session_key = data_blob_null;
5798
5799 if (argc != 2) {
5800 d_printf("%s\n%s",
5801 _("Usage:"),
5802 _(" net rpc trustdom add <domain_name> "
5803 "<trust password>\n"));
5804 return NT_STATUS_INVALID_PARAMETER;
5805 }
5806
5807 /*
5808 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5809 */
5810
5811 if (asprintf(&acct_name, "%s$", argv[0]) < 0) {
5812 return NT_STATUS_NO_MEMORY;
5813 }
5814
5815 if (!strupper_m(acct_name)) {
5816 SAFE_FREE(acct_name);
5817 return NT_STATUS_INVALID_PARAMETER;
5818 }
5819
5820 init_lsa_String(&lsa_acct_name, acct_name);
5821
5822 status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
5823 if (!NT_STATUS_IS_OK(status)) {
5824 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
5825 nt_errstr(status)));
5826 goto done;
5827 }
5828
5829 /* Get samr policy handle */
5830 status = dcerpc_samr_Connect2(b, mem_ctx,
5831 pipe_hnd->desthost,
5832 MAXIMUM_ALLOWED_ACCESS,
5833 &connect_pol,
5834 &result);
5835 if (!NT_STATUS_IS_OK(status)) {
5836 goto done;
5837 }
5838 if (!NT_STATUS_IS_OK(result)) {
5839 status = result;
5840 goto done;
5841 }
5842
5843 /* Get domain policy handle */
5844 status = dcerpc_samr_OpenDomain(b, mem_ctx,
5845 &connect_pol,
5846 MAXIMUM_ALLOWED_ACCESS,
5847 discard_const_p(struct dom_sid2, domain_sid),
5848 &domain_pol,
5849 &result);
5850 if (!NT_STATUS_IS_OK(status)) {
5851 goto done;
5852 }
5853 if (!NT_STATUS_IS_OK(result)) {
5854 status = result;
5855 goto done;
5856 }
5857
5858 /* This call can take a long time - allow the server to time out.
5859 * 35 seconds should do it. */
5860
5861 orig_timeout = rpccli_set_timeout(pipe_hnd, 35000);
5862
5863 /* Create trusting domain's account */
5864 acb_info = ACB_NORMAL;
5865 acct_flags = SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
5866 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
5867 SAMR_USER_ACCESS_SET_PASSWORD |
5868 SAMR_USER_ACCESS_GET_ATTRIBUTES |
5869 SAMR_USER_ACCESS_SET_ATTRIBUTES;
5870
5871 status = dcerpc_samr_CreateUser2(b, mem_ctx,
5872 &domain_pol,
5873 &lsa_acct_name,
5874 acb_info,
5875 acct_flags,
5876 &user_pol,
5877 &access_granted,
5878 &user_rid,
5879 &result);
5880 if (!NT_STATUS_IS_OK(status)) {
5881 goto done;
5882 }
5883 /* And restore our original timeout. */
5884 rpccli_set_timeout(pipe_hnd, orig_timeout);
5885
5886 if (!NT_STATUS_IS_OK(result)) {
5887 status = result;
5888 d_printf(_("net rpc trustdom add: create user %s failed %s\n"),
5889 acct_name, nt_errstr(result));
5890 goto done;
5891 }
5892
5893 {
5894 struct samr_CryptPassword crypt_pwd;
5895
5896 ZERO_STRUCT(info.info23);
5897
5898 init_samr_CryptPassword(argv[1],
5899 &session_key,
5900 &crypt_pwd);
5901
5902 info.info23.info.fields_present = SAMR_FIELD_ACCT_FLAGS |
5903 SAMR_FIELD_NT_PASSWORD_PRESENT;
5904 info.info23.info.acct_flags = ACB_DOMTRUST;
5905 info.info23.password = crypt_pwd;
5906
5907 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
5908 &user_pol,
5909 23,
5910 &info,
5911 &result);
5912 if (!NT_STATUS_IS_OK(status)) {
5913 goto done;
5914 }
5915
5916 if (!NT_STATUS_IS_OK(result)) {
5917 status = result;
5918 DEBUG(0,("Could not set trust account password: %s\n",
5919 nt_errstr(result)));
5920 goto done;
5921 }
5922 }
5923
5924 done:
5925 SAFE_FREE(acct_name);
5926 data_blob_clear_free(&session_key);
5927 return status;
5928 }
5929
5930 /**
5931 * Create interdomain trust account for a remote domain.
5932 *
5933 * @param argc Standard argc.
5934 * @param argv Standard argv without initial components.
5935 *
5936 * @return Integer status (0 means success).
5937 **/
5938
5939 static int rpc_trustdom_add(struct net_context *c, int argc, const char **argv)
5940 {
5941 if (argc > 0 && !c->display_usage) {
5942 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
5943 rpc_trustdom_add_internals, argc, argv);
5944 } else {
5945 d_printf("%s\n%s",
5946 _("Usage:"),
5947 _("net rpc trustdom add <domain_name> <trust "
5948 "password>\n"));
5949 return -1;
5950 }
5951 }
5952
5953
5954 /**
5955 * Remove interdomain trust account from the RPC server.
5956 * All parameters (except for argc and argv) are passed by run_rpc_command
5957 * function.
5958 *
5959 * @param c A net_context structure.
5960 * @param domain_sid The domain sid acquired from the server.
5961 * @param cli A cli_state connected to the server.
5962 * @param mem_ctx Talloc context, destroyed on completion of the function.
5963 * @param argc Standard main() style argc.
5964 * @param argv Standard main() style argv. Initial components are already
5965 * stripped.
5966 *
5967 * @return normal NTSTATUS return code.
5968 */
5969
5970 static NTSTATUS rpc_trustdom_del_internals(struct net_context *c,
5971 const struct dom_sid *domain_sid,
5972 const char *domain_name,
5973 struct cli_state *cli,
5974 struct rpc_pipe_client *pipe_hnd,
5975 TALLOC_CTX *mem_ctx,
5976 int argc,
5977 const char **argv)
5978 {
5979 struct policy_handle connect_pol, domain_pol, user_pol;
5980 NTSTATUS status, result;
5981 char *acct_name;
5982 struct dom_sid trust_acct_sid;
5983 struct samr_Ids user_rids, name_types;
5984 struct lsa_String lsa_acct_name;
5985 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
5986
5987 if (argc != 1) {
5988 d_printf("%s\n%s",
5989 _("Usage:"),
5990 _(" net rpc trustdom del <domain_name>\n"));
5991 return NT_STATUS_INVALID_PARAMETER;
5992 }
5993
5994 /*
5995 * Make valid trusting domain account (ie. uppercased and with '$' appended)
5996 */
5997 acct_name = talloc_asprintf(mem_ctx, "%s$", argv[0]);
5998
5999 if (acct_name == NULL)
6000 return NT_STATUS_NO_MEMORY;
6001
6002 if (!strupper_m(acct_name)) {
6003 TALLOC_FREE(acct_name);
6004 return NT_STATUS_INVALID_PARAMETER;
6005 }
6006
6007 /* Get samr policy handle */
6008 status = dcerpc_samr_Connect2(b, mem_ctx,
6009 pipe_hnd->desthost,
6010 MAXIMUM_ALLOWED_ACCESS,
6011 &connect_pol,
6012 &result);
6013 if (!NT_STATUS_IS_OK(status)) {
6014 goto done;
6015 }
6016 if (!NT_STATUS_IS_OK(result)) {
6017 status = result;
6018 goto done;
6019 }
6020
6021 /* Get domain policy handle */
6022 status = dcerpc_samr_OpenDomain(b, mem_ctx,
6023 &connect_pol,
6024 MAXIMUM_ALLOWED_ACCESS,
6025 discard_const_p(struct dom_sid2, domain_sid),
6026 &domain_pol,
6027 &result);
6028 if (!NT_STATUS_IS_OK(status)) {
6029 goto done;
6030 }
6031 if (!NT_STATUS_IS_OK(result)) {
6032 status = result;
6033 goto done;
6034 }
6035
6036 init_lsa_String(&lsa_acct_name, acct_name);
6037
6038 status = dcerpc_samr_LookupNames(b, mem_ctx,
6039 &domain_pol,
6040 1,
6041 &lsa_acct_name,
6042 &user_rids,
6043 &name_types,
6044 &result);
6045 if (!NT_STATUS_IS_OK(status)) {
6046 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6047 "failed %s\n"),
6048 acct_name, nt_errstr(status));
6049 goto done;
6050 }
6051 if (!NT_STATUS_IS_OK(result)) {
6052 status = result;
6053 d_printf(_("net rpc trustdom del: LookupNames on user %s "
6054 "failed %s\n"),
6055 acct_name, nt_errstr(result) );
6056 goto done;
6057 }
6058
6059 status = dcerpc_samr_OpenUser(b, mem_ctx,
6060 &domain_pol,
6061 MAXIMUM_ALLOWED_ACCESS,
6062 user_rids.ids[0],
6063 &user_pol,
6064 &result);
6065 if (!NT_STATUS_IS_OK(status)) {
6066 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6067 "%s\n"),
6068 acct_name, nt_errstr(status) );
6069 goto done;
6070 }
6071
6072 if (!NT_STATUS_IS_OK(result)) {
6073 status = result;
6074 d_printf(_("net rpc trustdom del: OpenUser on user %s failed "
6075 "%s\n"),
6076 acct_name, nt_errstr(result) );
6077 goto done;
6078 }
6079
6080 /* append the rid to the domain sid */
6081 if (!sid_compose(&trust_acct_sid, domain_sid, user_rids.ids[0])) {
6082 goto done;
6083 }
6084
6085 /* remove the sid */
6086
6087 status = dcerpc_samr_RemoveMemberFromForeignDomain(b, mem_ctx,
6088 &user_pol,
6089 &trust_acct_sid,
6090 &result);
6091 if (!NT_STATUS_IS_OK(status)) {
6092 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6093 " on user %s failed %s\n"),
6094 acct_name, nt_errstr(status));
6095 goto done;
6096 }
6097 if (!NT_STATUS_IS_OK(result)) {
6098 status = result;
6099 d_printf(_("net rpc trustdom del: RemoveMemberFromForeignDomain"
6100 " on user %s failed %s\n"),
6101 acct_name, nt_errstr(result) );
6102 goto done;
6103 }
6104
6105
6106 /* Delete user */
6107
6108 status = dcerpc_samr_DeleteUser(b, mem_ctx,
6109 &user_pol,
6110 &result);
6111 if (!NT_STATUS_IS_OK(status)) {
6112 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6113 "%s\n"),
6114 acct_name, nt_errstr(status));
6115 goto done;
6116 }
6117
6118 if (!NT_STATUS_IS_OK(result)) {
6119 result = status;
6120 d_printf(_("net rpc trustdom del: DeleteUser on user %s failed "
6121 "%s\n"),
6122 acct_name, nt_errstr(result) );
6123 goto done;
6124 }
6125
6126 if (!NT_STATUS_IS_OK(result)) {
6127 d_printf(_("Could not set trust account password: %s\n"),
6128 nt_errstr(result));
6129 goto done;
6130 }
6131
6132 done:
6133 return status;
6134 }
6135
6136 /**
6137 * Delete interdomain trust account for a remote domain.
6138 *
6139 * @param argc Standard argc.
6140 * @param argv Standard argv without initial components.
6141 *
6142 * @return Integer status (0 means success).
6143 **/
6144
6145 static int rpc_trustdom_del(struct net_context *c, int argc, const char **argv)
6146 {
6147 if (argc > 0 && !c->display_usage) {
6148 return run_rpc_command(c, NULL, &ndr_table_samr, 0,
6149 rpc_trustdom_del_internals, argc, argv);
6150 } else {
6151 d_printf("%s\n%s",
6152 _("Usage:"),
6153 _("net rpc trustdom del <domain>\n"));
6154 return -1;
6155 }
6156 }
6157
6158 static NTSTATUS rpc_trustdom_get_pdc(struct net_context *c,
6159 struct cli_state *cli,
6160 TALLOC_CTX *mem_ctx,
6161 const char *domain_name)
6162 {
6163 char *dc_name = NULL;
6164 const char *buffer = NULL;
6165 struct rpc_pipe_client *netr;
6166 NTSTATUS status;
6167 WERROR result;
6168 struct dcerpc_binding_handle *b;
6169
6170 /* Use NetServerEnum2 */
6171
6172 if (cli_get_pdc_name(cli, domain_name, &dc_name)) {
6173 SAFE_FREE(dc_name);
6174 return NT_STATUS_OK;
6175 }
6176
6177 DEBUG(1,("NetServerEnum2 error: Couldn't find primary domain controller\
6178 for domain %s\n", domain_name));
6179
6180 /* Try netr_GetDcName */
6181
6182 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
6183 &netr);
6184 if (!NT_STATUS_IS_OK(status)) {
6185 return status;
6186 }
6187
6188 b = netr->binding_handle;
6189
6190 status = dcerpc_netr_GetDcName(b, mem_ctx,
6191 netr->desthost,
6192 domain_name,
6193 &buffer,
6194 &result);
6195 TALLOC_FREE(netr);
6196
6197 if (NT_STATUS_IS_OK(status) && W_ERROR_IS_OK(result)) {
6198 return status;
6199 }
6200
6201 DEBUG(1,("netr_GetDcName error: Couldn't find primary domain controller\
6202 for domain %s\n", domain_name));
6203
6204 if (!NT_STATUS_IS_OK(status)) {
6205 return status;
6206 }
6207
6208 return werror_to_ntstatus(result);
6209 }
6210
6211 /**
6212 * Establish trust relationship to a trusting domain.
6213 * Interdomain account must already be created on remote PDC.
6214 *
6215 * @param c A net_context structure.
6216 * @param argc Standard argc.
6217 * @param argv Standard argv without initial components.
6218 *
6219 * @return Integer status (0 means success).
6220 **/
6221
6222 static int rpc_trustdom_establish(struct net_context *c, int argc,
6223 const char **argv)
6224 {
6225 struct cli_state *cli = NULL;
6226 struct sockaddr_storage server_ss;
6227 struct rpc_pipe_client *pipe_hnd = NULL;
6228 struct policy_handle connect_hnd;
6229 TALLOC_CTX *mem_ctx;
6230 NTSTATUS nt_status, result;
6231 struct dom_sid *domain_sid;
6232
6233 char* domain_name;
6234 char* acct_name;
6235 fstring pdc_name;
6236 union lsa_PolicyInformation *info = NULL;
6237 struct dcerpc_binding_handle *b;
6238
6239 /*
6240 * Connect to \\server\ipc$ as 'our domain' account with password
6241 */
6242
6243 if (argc != 1 || c->display_usage) {
6244 d_printf("%s\n%s",
6245 _("Usage:"),
6246 _("net rpc trustdom establish <domain_name>\n"));
6247 return -1;
6248 }
6249
6250 domain_name = smb_xstrdup(argv[0]);
6251 if (!strupper_m(domain_name)) {
6252 SAFE_FREE(domain_name);
6253 return -1;
6254 }
6255
6256 /* account name used at first is our domain's name with '$' */
6257 if (asprintf(&acct_name, "%s$", lp_workgroup()) == -1) {
6258 return -1;
6259 }
6260 if (!strupper_m(acct_name)) {
6261 SAFE_FREE(domain_name);
6262 SAFE_FREE(acct_name);
6263 return -1;
6264 }
6265
6266 /*
6267 * opt_workgroup will be used by connection functions further,
6268 * hence it should be set to remote domain name instead of ours
6269 */
6270 if (c->opt_workgroup) {
6271 c->opt_workgroup = smb_xstrdup(domain_name);
6272 };
6273
6274 c->opt_user_name = acct_name;
6275
6276 /* find the domain controller */
6277 if (!net_find_pdc(&server_ss, pdc_name, domain_name)) {
6278 DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name));
6279 return -1;
6280 }
6281
6282 /* connect to ipc$ as username/password */
6283 nt_status = connect_to_ipc(c, &cli, &server_ss, pdc_name);
6284 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT)) {
6285
6286 /* Is it trusting domain account for sure ? */
6287 DEBUG(0, ("Couldn't verify trusting domain account. Error was %s\n",
6288 nt_errstr(nt_status)));
6289 return -1;
6290 }
6291
6292 /* store who we connected to */
6293
6294 saf_store( domain_name, pdc_name );
6295
6296 /*
6297 * Connect to \\server\ipc$ again (this time anonymously)
6298 */
6299
6300 nt_status = connect_to_ipc_anonymous(c, &cli, &server_ss,
6301 (char*)pdc_name);
6302
6303 if (NT_STATUS_IS_ERR(nt_status)) {
6304 DEBUG(0, ("Couldn't connect to domain %s controller. Error was %s.\n",
6305 domain_name, nt_errstr(nt_status)));
6306 return -1;
6307 }
6308
6309 if (!(mem_ctx = talloc_init("establishing trust relationship to "
6310 "domain %s", domain_name))) {
6311 DEBUG(0, ("talloc_init() failed\n"));
6312 cli_shutdown(cli);
6313 return -1;
6314 }
6315
6316 /* Make sure we're talking to a proper server */
6317
6318 nt_status = rpc_trustdom_get_pdc(c, cli, mem_ctx, domain_name);
6319 if (!NT_STATUS_IS_OK(nt_status)) {
6320 cli_shutdown(cli);
6321 talloc_destroy(mem_ctx);
6322 return -1;
6323 }
6324
6325 /*
6326 * Call LsaOpenPolicy and LsaQueryInfo
6327 */
6328
6329 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6330 &pipe_hnd);
6331 if (!NT_STATUS_IS_OK(nt_status)) {
6332 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n", nt_errstr(nt_status) ));
6333 cli_shutdown(cli);
6334 talloc_destroy(mem_ctx);
6335 return -1;
6336 }
6337
6338 b = pipe_hnd->binding_handle;
6339
6340 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, true, KEY_QUERY_VALUE,
6341 &connect_hnd);
6342 if (NT_STATUS_IS_ERR(nt_status)) {
6343 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6344 nt_errstr(nt_status)));
6345 cli_shutdown(cli);
6346 talloc_destroy(mem_ctx);
6347 return -1;
6348 }
6349
6350 /* Querying info level 5 */
6351
6352 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6353 &connect_hnd,
6354 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6355 &info,
6356 &result);
6357 if (NT_STATUS_IS_ERR(nt_status)) {
6358 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6359 nt_errstr(nt_status)));
6360 cli_shutdown(cli);
6361 talloc_destroy(mem_ctx);
6362 return -1;
6363 }
6364 if (NT_STATUS_IS_ERR(result)) {
6365 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6366 nt_errstr(result)));
6367 cli_shutdown(cli);
6368 talloc_destroy(mem_ctx);
6369 return -1;
6370 }
6371
6372 domain_sid = info->account_domain.sid;
6373
6374 /* There should be actually query info level 3 (following nt serv behaviour),
6375 but I still don't know if it's _really_ necessary */
6376
6377 /*
6378 * Store the password in secrets db
6379 */
6380
6381 if (!pdb_set_trusteddom_pw(domain_name, c->opt_password, domain_sid)) {
6382 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6383 cli_shutdown(cli);
6384 talloc_destroy(mem_ctx);
6385 return -1;
6386 }
6387
6388 /*
6389 * Close the pipes and clean up
6390 */
6391
6392 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6393 if (NT_STATUS_IS_ERR(nt_status)) {
6394 DEBUG(0, ("Couldn't close LSA pipe. Error was %s\n",
6395 nt_errstr(nt_status)));
6396 cli_shutdown(cli);
6397 talloc_destroy(mem_ctx);
6398 return -1;
6399 }
6400
6401 cli_shutdown(cli);
6402
6403 talloc_destroy(mem_ctx);
6404
6405 d_printf(_("Trust to domain %s established\n"), domain_name);
6406 return 0;
6407 }
6408
6409 /**
6410 * Revoke trust relationship to the remote domain.
6411 *
6412 * @param c A net_context structure.
6413 * @param argc Standard argc.
6414 * @param argv Standard argv without initial components.
6415 *
6416 * @return Integer status (0 means success).
6417 **/
6418
6419 static int rpc_trustdom_revoke(struct net_context *c, int argc,
6420 const char **argv)
6421 {
6422 char* domain_name;
6423 int rc = -1;
6424
6425 if (argc < 1 || c->display_usage) {
6426 d_printf("%s\n%s",
6427 _("Usage:"),
6428 _("net rpc trustdom revoke <domain_name>\n"
6429 " Revoke trust relationship\n"
6430 " domain_name\tName of domain to revoke trust\n"));
6431 return -1;
6432 }
6433
6434 /* generate upper cased domain name */
6435 domain_name = smb_xstrdup(argv[0]);
6436 if (!strupper_m(domain_name)) {
6437 SAFE_FREE(domain_name);
6438 return -1;
6439 }
6440
6441 /* delete password of the trust */
6442 if (!pdb_del_trusteddom_pw(domain_name)) {
6443 DEBUG(0, ("Failed to revoke relationship to the trusted domain %s\n",
6444 domain_name));
6445 goto done;
6446 };
6447
6448 rc = 0;
6449 done:
6450 SAFE_FREE(domain_name);
6451 return rc;
6452 }
6453
6454 static NTSTATUS rpc_query_domain_sid(struct net_context *c,
6455 const struct dom_sid *domain_sid,
6456 const char *domain_name,
6457 struct cli_state *cli,
6458 struct rpc_pipe_client *pipe_hnd,
6459 TALLOC_CTX *mem_ctx,
6460 int argc,
6461 const char **argv)
6462 {
6463 fstring str_sid;
6464 if (!sid_to_fstring(str_sid, domain_sid)) {
6465 return NT_STATUS_UNSUCCESSFUL;
6466 }
6467 d_printf("%s\n", str_sid);
6468 return NT_STATUS_OK;
6469 }
6470
6471 static void print_trusted_domain(struct dom_sid *dom_sid, const char *trusted_dom_name)
6472 {
6473 fstring ascii_sid;
6474
6475 /* convert sid into ascii string */
6476 sid_to_fstring(ascii_sid, dom_sid);
6477
6478 d_printf("%-20s%s\n", trusted_dom_name, ascii_sid);
6479 }
6480
6481 static NTSTATUS vampire_trusted_domain(struct rpc_pipe_client *pipe_hnd,
6482 TALLOC_CTX *mem_ctx,
6483 struct policy_handle *pol,
6484 struct dom_sid dom_sid,
6485 const char *trusted_dom_name)
6486 {
6487 NTSTATUS nt_status, result;
6488 union lsa_TrustedDomainInfo *info = NULL;
6489 char *cleartextpwd = NULL;
6490 DATA_BLOB session_key;
6491 DATA_BLOB data = data_blob_null;
6492 struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
6493
6494 nt_status = dcerpc_lsa_QueryTrustedDomainInfoBySid(b, mem_ctx,
6495 pol,
6496 &dom_sid,
6497 LSA_TRUSTED_DOMAIN_INFO_PASSWORD,
6498 &info,
6499 &result);
6500 if (NT_STATUS_IS_ERR(nt_status)) {
6501 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6502 nt_errstr(nt_status)));
6503 goto done;
6504 }
6505 if (NT_STATUS_IS_ERR(result)) {
6506 nt_status = result;
6507 DEBUG(0,("Could not query trusted domain info. Error was %s\n",
6508 nt_errstr(result)));
6509 goto done;
6510 }
6511
6512 data = data_blob(info->password.password->data,
6513 info->password.password->length);
6514
6515 nt_status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
6516 if (!NT_STATUS_IS_OK(nt_status)) {
6517 DEBUG(0, ("Could not retrieve session key: %s\n", nt_errstr(nt_status)));
6518 goto done;
6519 }
6520
6521 cleartextpwd = sess_decrypt_string(mem_ctx, &data, &session_key);
6522 data_blob_free(&session_key);
6523
6524 if (cleartextpwd == NULL) {
6525 DEBUG(0,("retrieved NULL password\n"));
6526 nt_status = NT_STATUS_UNSUCCESSFUL;
6527 goto done;
6528 }
6529
6530 if (!pdb_set_trusteddom_pw(trusted_dom_name, cleartextpwd, &dom_sid)) {
6531 DEBUG(0, ("Storing password for trusted domain failed.\n"));
6532 nt_status = NT_STATUS_UNSUCCESSFUL;
6533 goto done;
6534 }
6535
6536 #ifdef DEBUG_PASSWORD
6537 DEBUG(100,("successfully vampired trusted domain [%s], sid: [%s], "
6538 "password: [%s]\n", trusted_dom_name,
6539 sid_string_dbg(&dom_sid), cleartextpwd));
6540 #endif
6541
6542 done:
6543 SAFE_FREE(cleartextpwd);
6544 data_blob_free(&data);
6545
6546 return nt_status;
6547 }
6548
6549 static int rpc_trustdom_vampire(struct net_context *c, int argc,
6550 const char **argv)
6551 {
6552 /* common variables */
6553 TALLOC_CTX* mem_ctx;
6554 struct cli_state *cli = NULL;
6555 struct rpc_pipe_client *pipe_hnd = NULL;
6556 NTSTATUS nt_status, result;
6557 const char *domain_name = NULL;
6558 struct policy_handle connect_hnd;
6559 union lsa_PolicyInformation *info = NULL;
6560
6561 /* trusted domains listing variables */
6562 unsigned int enum_ctx = 0;
6563 int i;
6564 struct lsa_DomainList dom_list;
6565 fstring pdc_name;
6566 struct dcerpc_binding_handle *b;
6567
6568 if (c->display_usage) {
6569 d_printf( "%s\n"
6570 "net rpc trustdom vampire\n"
6571 " %s\n",
6572 _("Usage:"),
6573 _("Vampire trust relationship from remote server"));
6574 return 0;
6575 }
6576
6577 /*
6578 * Listing trusted domains (stored in secrets.tdb, if local)
6579 */
6580
6581 mem_ctx = talloc_init("trust relationships vampire");
6582
6583 /*
6584 * set domain and pdc name to local samba server (default)
6585 * or to remote one given in command line
6586 */
6587
6588 if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
6589 domain_name = c->opt_workgroup;
6590 c->opt_target_workgroup = c->opt_workgroup;
6591 } else {
6592 fstrcpy(pdc_name, lp_netbios_name());
6593 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6594 c->opt_target_workgroup = domain_name;
6595 };
6596
6597 /* open \PIPE\lsarpc and open policy handle */
6598 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6599 if (!NT_STATUS_IS_OK(nt_status)) {
6600 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6601 nt_errstr(nt_status)));
6602 talloc_destroy(mem_ctx);
6603 return -1;
6604 };
6605
6606 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6607 &pipe_hnd);
6608 if (!NT_STATUS_IS_OK(nt_status)) {
6609 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6610 nt_errstr(nt_status) ));
6611 cli_shutdown(cli);
6612 talloc_destroy(mem_ctx);
6613 return -1;
6614 };
6615
6616 b = pipe_hnd->binding_handle;
6617
6618 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6619 &connect_hnd);
6620 if (NT_STATUS_IS_ERR(nt_status)) {
6621 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6622 nt_errstr(nt_status)));
6623 cli_shutdown(cli);
6624 talloc_destroy(mem_ctx);
6625 return -1;
6626 };
6627
6628 /* query info level 5 to obtain sid of a domain being queried */
6629 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6630 &connect_hnd,
6631 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6632 &info,
6633 &result);
6634
6635 if (NT_STATUS_IS_ERR(nt_status)) {
6636 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6637 nt_errstr(nt_status)));
6638 cli_shutdown(cli);
6639 talloc_destroy(mem_ctx);
6640 return -1;
6641 }
6642 if (NT_STATUS_IS_ERR(result)) {
6643 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6644 nt_errstr(result)));
6645 cli_shutdown(cli);
6646 talloc_destroy(mem_ctx);
6647 return -1;
6648 }
6649
6650 /*
6651 * Keep calling LsaEnumTrustdom over opened pipe until
6652 * the end of enumeration is reached
6653 */
6654
6655 d_printf(_("Vampire trusted domains:\n\n"));
6656
6657 do {
6658 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
6659 &connect_hnd,
6660 &enum_ctx,
6661 &dom_list,
6662 (uint32_t)-1,
6663 &result);
6664 if (NT_STATUS_IS_ERR(nt_status)) {
6665 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6666 nt_errstr(nt_status)));
6667 cli_shutdown(cli);
6668 talloc_destroy(mem_ctx);
6669 return -1;
6670 };
6671 if (NT_STATUS_IS_ERR(result)) {
6672 nt_status = result;
6673 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6674 nt_errstr(result)));
6675 cli_shutdown(cli);
6676 talloc_destroy(mem_ctx);
6677 return -1;
6678 };
6679
6680
6681 for (i = 0; i < dom_list.count; i++) {
6682
6683 print_trusted_domain(dom_list.domains[i].sid,
6684 dom_list.domains[i].name.string);
6685
6686 nt_status = vampire_trusted_domain(pipe_hnd, mem_ctx, &connect_hnd,
6687 *dom_list.domains[i].sid,
6688 dom_list.domains[i].name.string);
6689 if (!NT_STATUS_IS_OK(nt_status)) {
6690 cli_shutdown(cli);
6691 talloc_destroy(mem_ctx);
6692 return -1;
6693 }
6694 };
6695
6696 /*
6697 * in case of no trusted domains say something rather
6698 * than just display blank line
6699 */
6700 if (!dom_list.count) d_printf(_("none\n"));
6701
6702 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6703
6704 /* close this connection before doing next one */
6705 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6706 if (NT_STATUS_IS_ERR(nt_status)) {
6707 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6708 nt_errstr(nt_status)));
6709 cli_shutdown(cli);
6710 talloc_destroy(mem_ctx);
6711 return -1;
6712 };
6713
6714 /* close lsarpc pipe and connection to IPC$ */
6715 cli_shutdown(cli);
6716
6717 talloc_destroy(mem_ctx);
6718 return 0;
6719 }
6720
6721 static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
6722 {
6723 /* common variables */
6724 TALLOC_CTX* mem_ctx;
6725 struct cli_state *cli = NULL, *remote_cli = NULL;
6726 struct rpc_pipe_client *pipe_hnd = NULL;
6727 NTSTATUS nt_status, result;
6728 const char *domain_name = NULL;
6729 struct dom_sid *queried_dom_sid;
6730 int ascii_dom_name_len;
6731 struct policy_handle connect_hnd;
6732 union lsa_PolicyInformation *info = NULL;
6733 struct dcerpc_binding_handle *b = NULL;
6734
6735 /* trusted domains listing variables */
6736 unsigned int num_domains, enum_ctx = 0;
6737 int i;
6738 struct lsa_DomainList dom_list;
6739 fstring pdc_name;
6740 bool found_domain;
6741
6742 /* trusting domains listing variables */
6743 struct policy_handle domain_hnd;
6744 struct samr_SamArray *trusts = NULL;
6745
6746 if (c->display_usage) {
6747 d_printf( "%s\n"
6748 "net rpc trustdom list\n"
6749 " %s\n",
6750 _("Usage:"),
6751 _("List incoming and outgoing trust relationships"));
6752 return 0;
6753 }
6754
6755 /*
6756 * Listing trusted domains (stored in secrets.tdb, if local)
6757 */
6758
6759 mem_ctx = talloc_init("trust relationships listing");
6760
6761 /*
6762 * set domain and pdc name to local samba server (default)
6763 * or to remote one given in command line
6764 */
6765
6766 if (strcasecmp_m(c->opt_workgroup, lp_workgroup())) {
6767 domain_name = c->opt_workgroup;
6768 c->opt_target_workgroup = c->opt_workgroup;
6769 } else {
6770 fstrcpy(pdc_name, lp_netbios_name());
6771 domain_name = talloc_strdup(mem_ctx, lp_workgroup());
6772 c->opt_target_workgroup = domain_name;
6773 };
6774
6775 /* open \PIPE\lsarpc and open policy handle */
6776 nt_status = net_make_ipc_connection(c, NET_FLAGS_PDC, &cli);
6777 if (!NT_STATUS_IS_OK(nt_status)) {
6778 DEBUG(0, ("Couldn't connect to domain controller: %s\n",
6779 nt_errstr(nt_status)));
6780 talloc_destroy(mem_ctx);
6781 return -1;
6782 };
6783
6784 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
6785 &pipe_hnd);
6786 if (!NT_STATUS_IS_OK(nt_status)) {
6787 DEBUG(0, ("Could not initialise lsa pipe. Error was %s\n",
6788 nt_errstr(nt_status) ));
6789 cli_shutdown(cli);
6790 talloc_destroy(mem_ctx);
6791 return -1;
6792 };
6793
6794 b = pipe_hnd->binding_handle;
6795
6796 nt_status = rpccli_lsa_open_policy2(pipe_hnd, mem_ctx, false, KEY_QUERY_VALUE,
6797 &connect_hnd);
6798 if (NT_STATUS_IS_ERR(nt_status)) {
6799 DEBUG(0, ("Couldn't open policy handle. Error was %s\n",
6800 nt_errstr(nt_status)));
6801 cli_shutdown(cli);
6802 talloc_destroy(mem_ctx);
6803 return -1;
6804 };
6805
6806 /* query info level 5 to obtain sid of a domain being queried */
6807 nt_status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
6808 &connect_hnd,
6809 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
6810 &info,
6811 &result);
6812
6813 if (NT_STATUS_IS_ERR(nt_status)) {
6814 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6815 nt_errstr(nt_status)));
6816 cli_shutdown(cli);
6817 talloc_destroy(mem_ctx);
6818 return -1;
6819 }
6820 if (NT_STATUS_IS_ERR(result)) {
6821 DEBUG(0, ("LSA Query Info failed. Returned error was %s\n",
6822 nt_errstr(result)));
6823 cli_shutdown(cli);
6824 talloc_destroy(mem_ctx);
6825 return -1;
6826 }
6827
6828 queried_dom_sid = info->account_domain.sid;
6829
6830 /*
6831 * Keep calling LsaEnumTrustdom over opened pipe until
6832 * the end of enumeration is reached
6833 */
6834
6835 d_printf(_("Trusted domains list:\n\n"));
6836
6837 found_domain = false;
6838
6839 do {
6840 nt_status = dcerpc_lsa_EnumTrustDom(b, mem_ctx,
6841 &connect_hnd,
6842 &enum_ctx,
6843 &dom_list,
6844 (uint32_t)-1,
6845 &result);
6846 if (NT_STATUS_IS_ERR(nt_status)) {
6847 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6848 nt_errstr(nt_status)));
6849 cli_shutdown(cli);
6850 talloc_destroy(mem_ctx);
6851 return -1;
6852 };
6853 if (NT_STATUS_IS_ERR(result)) {
6854 DEBUG(0, ("Couldn't enumerate trusted domains. Error was %s\n",
6855 nt_errstr(result)));
6856 cli_shutdown(cli);
6857 talloc_destroy(mem_ctx);
6858 return -1;
6859 };
6860
6861
6862 for (i = 0; i < dom_list.count; i++) {
6863 print_trusted_domain(dom_list.domains[i].sid,
6864 dom_list.domains[i].name.string);
6865 found_domain = true;
6866 };
6867
6868
6869 } while (NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES));
6870
6871 /*
6872 * in case of no trusted domains say something rather
6873 * than just display blank line
6874 */
6875 if (!found_domain) {
6876 d_printf(_("none\n"));
6877 }
6878
6879 /* close this connection before doing next one */
6880 nt_status = dcerpc_lsa_Close(b, mem_ctx, &connect_hnd, &result);
6881 if (NT_STATUS_IS_ERR(nt_status)) {
6882 DEBUG(0, ("Couldn't properly close lsa policy handle. Error was %s\n",
6883 nt_errstr(nt_status)));
6884 cli_shutdown(cli);
6885 talloc_destroy(mem_ctx);
6886 return -1;
6887 };
6888
6889 TALLOC_FREE(pipe_hnd);
6890
6891 /*
6892 * Listing trusting domains (stored in passdb backend, if local)
6893 */
6894
6895 d_printf(_("\nTrusting domains list:\n\n"));
6896
6897 /*
6898 * Open \PIPE\samr and get needed policy handles
6899 */
6900 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
6901 &pipe_hnd);
6902 if (!NT_STATUS_IS_OK(nt_status)) {
6903 DEBUG(0, ("Could not initialise samr pipe. Error was %s\n", nt_errstr(nt_status)));
6904 cli_shutdown(cli);
6905 talloc_destroy(mem_ctx);
6906 return -1;
6907 };
6908
6909 b = pipe_hnd->binding_handle;
6910
6911 /* SamrConnect2 */
6912 nt_status = dcerpc_samr_Connect2(b, mem_ctx,
6913 pipe_hnd->desthost,
6914 SAMR_ACCESS_LOOKUP_DOMAIN,
6915 &connect_hnd,
6916 &result);
6917 if (!NT_STATUS_IS_OK(nt_status)) {
6918 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6919 nt_errstr(nt_status)));
6920 cli_shutdown(cli);
6921 talloc_destroy(mem_ctx);
6922 return -1;
6923 };
6924 if (!NT_STATUS_IS_OK(result)) {
6925 nt_status = result;
6926 DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
6927 nt_errstr(result)));
6928 cli_shutdown(cli);
6929 talloc_destroy(mem_ctx);
6930 return -1;
6931 };
6932
6933 /* SamrOpenDomain - we have to open domain policy handle in order to be
6934 able to enumerate accounts*/
6935 nt_status = dcerpc_samr_OpenDomain(b, mem_ctx,
6936 &connect_hnd,
6937 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
6938 queried_dom_sid,
6939 &domain_hnd,
6940 &result);
6941 if (!NT_STATUS_IS_OK(nt_status)) {
6942 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6943 nt_errstr(nt_status)));
6944 cli_shutdown(cli);
6945 talloc_destroy(mem_ctx);
6946 return -1;
6947 };
6948 if (!NT_STATUS_IS_OK(result)) {
6949 nt_status = result;
6950 DEBUG(0, ("Couldn't open domain object. Error was %s\n",
6951 nt_errstr(result)));
6952 cli_shutdown(cli);
6953 talloc_destroy(mem_ctx);
6954 return -1;
6955 };
6956
6957 /*
6958 * perform actual enumeration
6959 */
6960
6961 found_domain = false;
6962
6963 enum_ctx = 0; /* reset enumeration context from last enumeration */
6964 do {
6965
6966 nt_status = dcerpc_samr_EnumDomainUsers(b, mem_ctx,
6967 &domain_hnd,
6968 &enum_ctx,
6969 ACB_DOMTRUST,
6970 &trusts,
6971 0xffff,
6972 &num_domains,
6973 &result);
6974 if (NT_STATUS_IS_ERR(nt_status)) {
6975 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6976 nt_errstr(nt_status)));
6977 cli_shutdown(cli);
6978 talloc_destroy(mem_ctx);
6979 return -1;
6980 };
6981 if (NT_STATUS_IS_ERR(result)) {
6982 nt_status = result;
6983 DEBUG(0, ("Couldn't enumerate accounts. Error was: %s\n",
6984 nt_errstr(result)));
6985 cli_shutdown(cli);
6986 talloc_destroy(mem_ctx);
6987 return -1;
6988 };
6989
6990 for (i = 0; i < num_domains; i++) {
6991
6992 char *str = discard_const_p(char, trusts->entries[i].name.string);
6993
6994 found_domain = true;
6995
6996 /*
6997 * get each single domain's sid (do we _really_ need this ?):
6998 * 1) connect to domain's pdc
6999 * 2) query the pdc for domain's sid
7000 */
7001
7002 /* get rid of '$' tail */
7003 ascii_dom_name_len = strlen(str);
7004 if (ascii_dom_name_len && ascii_dom_name_len < FSTRING_LEN)
7005 str[ascii_dom_name_len - 1] = '\0';
7006
7007 /* set opt_* variables to remote domain */
7008 if (!strupper_m(str)) {
7009 cli_shutdown(cli);
7010 talloc_destroy(mem_ctx);
7011 return -1;
7012 }
7013 c->opt_workgroup = talloc_strdup(mem_ctx, str);
7014 c->opt_target_workgroup = c->opt_workgroup;
7015
7016 d_printf("%-20s", str);
7017
7018 /* connect to remote domain controller */
7019 nt_status = net_make_ipc_connection(c,
7020 NET_FLAGS_PDC | NET_FLAGS_ANONYMOUS,
7021 &remote_cli);
7022 if (NT_STATUS_IS_OK(nt_status)) {
7023 /* query for domain's sid */
7024 if (run_rpc_command(
7025 c, remote_cli,
7026 &ndr_table_lsarpc, 0,
7027 rpc_query_domain_sid, argc,
7028 argv))
7029 d_printf(_("strange - couldn't get domain's sid\n"));
7030
7031 cli_shutdown(remote_cli);
7032
7033 } else {
7034 d_fprintf(stderr, _("domain controller is not "
7035 "responding: %s\n"),
7036 nt_errstr(nt_status));
7037 d_printf(_("couldn't get domain's sid\n"));
7038 }
7039 }
7040
7041 } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
7042
7043 if (!found_domain) {
7044 d_printf("none\n");
7045 }
7046
7047 /* close opened samr and domain policy handles */
7048 nt_status = dcerpc_samr_Close(b, mem_ctx, &domain_hnd, &result);
7049 if (!NT_STATUS_IS_OK(nt_status)) {
7050 DEBUG(0, ("Couldn't properly close domain policy handle for domain %s\n", domain_name));
7051 };
7052
7053 nt_status = dcerpc_samr_Close(b, mem_ctx, &connect_hnd, &result);
7054 if (!NT_STATUS_IS_OK(nt_status)) {
7055 DEBUG(0, ("Couldn't properly close samr policy handle for domain %s\n", domain_name));
7056 };
7057
7058 /* close samr pipe and connection to IPC$ */
7059 cli_shutdown(cli);
7060
7061 talloc_destroy(mem_ctx);
7062 return 0;
7063 }
7064
7065 /**
7066 * Entrypoint for 'net rpc trustdom' code.
7067 *
7068 * @param argc Standard argc.
7069 * @param argv Standard argv without initial components.
7070 *
7071 * @return Integer status (0 means success).
7072 */
7073
7074 static int rpc_trustdom(struct net_context *c, int argc, const char **argv)
7075 {
7076 struct functable func[] = {
7077 {
7078 "add",
7079 rpc_trustdom_add,
7080 NET_TRANSPORT_RPC,
7081 N_("Add trusting domain's account"),
7082 N_("net rpc trustdom add\n"
7083 " Add trusting domain's account")
7084 },
7085 {
7086 "del",
7087 rpc_trustdom_del,
7088 NET_TRANSPORT_RPC,
7089 N_("Remove trusting domain's account"),
7090 N_("net rpc trustdom del\n"
7091 " Remove trusting domain's account")
7092 },
7093 {
7094 "establish",
7095 rpc_trustdom_establish,
7096 NET_TRANSPORT_RPC,
7097 N_("Establish outgoing trust relationship"),
7098 N_("net rpc trustdom establish\n"
7099 " Establish outgoing trust relationship")
7100 },
7101 {
7102 "revoke",
7103 rpc_trustdom_revoke,
7104 NET_TRANSPORT_RPC,
7105 N_("Revoke outgoing trust relationship"),
7106 N_("net rpc trustdom revoke\n"
7107 " Revoke outgoing trust relationship")
7108 },
7109 {
7110 "list",
7111 rpc_trustdom_list,
7112 NET_TRANSPORT_RPC,
7113 N_("List in- and outgoing domain trusts"),
7114 N_("net rpc trustdom list\n"
7115 " List in- and outgoing domain trusts")
7116 },
7117 {
7118 "vampire",
7119 rpc_trustdom_vampire,
7120 NET_TRANSPORT_RPC,
7121 N_("Vampire trusts from remote server"),
7122 N_("net rpc trustdom vampire\n"
7123 " Vampire trusts from remote server")
7124 },
7125 {NULL, NULL, 0, NULL, NULL}
7126 };
7127
7128 return net_run_function(c, argc, argv, "net rpc trustdom", func);
7129 }
7130
7131 /**
7132 * Check if a server will take rpc commands
7133 * @param flags Type of server to connect to (PDC, DMB, localhost)
7134 * if the host is not explicitly specified
7135 * @return bool (true means rpc supported)
7136 */
7137 bool net_rpc_check(struct net_context *c, unsigned flags)
7138 {
7139 struct cli_state *cli;
7140 bool ret = false;
7141 struct sockaddr_storage server_ss;
7142 char *server_name = NULL;
7143 NTSTATUS status;
7144
7145 /* flags (i.e. server type) may depend on command */
7146 if (!net_find_server(c, NULL, flags, &server_ss, &server_name))
7147 return false;
7148
7149 status = cli_connect_nb(server_name, &server_ss, 0, 0x20,
7150 lp_netbios_name(), SMB_SIGNING_DEFAULT,
7151 0, &cli);
7152 if (!NT_STATUS_IS_OK(status)) {
7153 return false;
7154 }
7155 status = smbXcli_negprot(cli->conn, cli->timeout, PROTOCOL_CORE,
7156 PROTOCOL_NT1);
7157 if (!NT_STATUS_IS_OK(status))
7158 goto done;
7159 if (smbXcli_conn_protocol(cli->conn) < PROTOCOL_NT1)
7160 goto done;
7161
7162 ret = true;
7163 done:
7164 cli_shutdown(cli);
7165 return ret;
7166 }
7167
7168 /* dump sam database via samsync rpc calls */
7169 static int rpc_samdump(struct net_context *c, int argc, const char **argv) {
7170 if (c->display_usage) {
7171 d_printf( "%s\n"
7172 "net rpc samdump\n"
7173 " %s\n",
7174 _("Usage:"),
7175 _("Dump remote SAM database"));
7176 return 0;
7177 }
7178
7179 return run_rpc_command(c, NULL, &ndr_table_netlogon,
7180 NET_FLAGS_ANONYMOUS,
7181 rpc_samdump_internals, argc, argv);
7182 }
7183
7184 /* syncronise sam database via samsync rpc calls */
7185 static int rpc_vampire(struct net_context *c, int argc, const char **argv)
7186 {
7187 struct functable func[] = {
7188 {
7189 "ldif",
7190 rpc_vampire_ldif,
7191 NET_TRANSPORT_RPC,
7192 N_("Dump remote SAM database to ldif"),
7193 N_("net rpc vampire ldif\n"
7194 " Dump remote SAM database to LDIF file or "
7195 "stdout")
7196 },
7197 {
7198 "keytab",
7199 rpc_vampire_keytab,
7200 NET_TRANSPORT_RPC,
7201 N_("Dump remote SAM database to Kerberos Keytab"),
7202 N_("net rpc vampire keytab\n"
7203 " Dump remote SAM database to Kerberos keytab "
7204 "file")
7205 },
7206 {
7207 "passdb",
7208 rpc_vampire_passdb,
7209 NET_TRANSPORT_RPC,
7210 N_("Dump remote SAM database to passdb"),
7211 N_("net rpc vampire passdb\n"
7212 " Dump remote SAM database to passdb")
7213 },
7214
7215 {NULL, NULL, 0, NULL, NULL}
7216 };
7217
7218 if (argc == 0) {
7219 if (c->display_usage) {
7220 d_printf( "%s\n"
7221 "net rpc vampire\n"
7222 " %s\n",
7223 _("Usage:"),
7224 _("Vampire remote SAM database"));
7225 return 0;
7226 }
7227
7228 return rpc_vampire_passdb(c, argc, argv);
7229 }
7230
7231 return net_run_function(c, argc, argv, "net rpc vampire", func);
7232 }
7233
7234 /**
7235 * Migrate everything from a print server.
7236 *
7237 * @param c A net_context structure.
7238 * @param argc Standard main() style argc.
7239 * @param argv Standard main() style argv. Initial components are already
7240 * stripped.
7241 *
7242 * @return A shell status integer (0 for success).
7243 *
7244 * The order is important !
7245 * To successfully add drivers the print queues have to exist !
7246 * Applying ACLs should be the last step, because you're easily locked out.
7247 *
7248 **/
7249 static int rpc_printer_migrate_all(struct net_context *c, int argc,
7250 const char **argv)
7251 {
7252 int ret;
7253
7254 if (c->display_usage) {
7255 d_printf( "%s\n"
7256 "net rpc printer migrate all\n"
7257 " %s\n",
7258 _("Usage:"),
7259 _("Migrate everything from a print server"));
7260 return 0;
7261 }
7262
7263 if (!c->opt_host) {
7264 d_printf(_("no server to migrate\n"));
7265 return -1;
7266 }
7267
7268 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7269 rpc_printer_migrate_printers_internals, argc,
7270 argv);
7271 if (ret)
7272 return ret;
7273
7274 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7275 rpc_printer_migrate_drivers_internals, argc,
7276 argv);
7277 if (ret)
7278 return ret;
7279
7280 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7281 rpc_printer_migrate_forms_internals, argc, argv);
7282 if (ret)
7283 return ret;
7284
7285 ret = run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7286 rpc_printer_migrate_settings_internals, argc,
7287 argv);
7288 if (ret)
7289 return ret;
7290
7291 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7292 rpc_printer_migrate_security_internals, argc,
7293 argv);
7294
7295 }
7296
7297 /**
7298 * Migrate print drivers from a print server.
7299 *
7300 * @param c A net_context structure.
7301 * @param argc Standard main() style argc.
7302 * @param argv Standard main() style argv. Initial components are already
7303 * stripped.
7304 *
7305 * @return A shell status integer (0 for success).
7306 **/
7307 static int rpc_printer_migrate_drivers(struct net_context *c, int argc,
7308 const char **argv)
7309 {
7310 if (c->display_usage) {
7311 d_printf( "%s\n"
7312 "net rpc printer migrate drivers\n"
7313 " %s\n",
7314 _("Usage:"),
7315 _("Migrate print-drivers from a print-server"));
7316 return 0;
7317 }
7318
7319 if (!c->opt_host) {
7320 d_printf(_("no server to migrate\n"));
7321 return -1;
7322 }
7323
7324 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7325 rpc_printer_migrate_drivers_internals,
7326 argc, argv);
7327 }
7328
7329 /**
7330 * Migrate print-forms from a print-server.
7331 *
7332 * @param c A net_context structure.
7333 * @param argc Standard main() style argc.
7334 * @param argv Standard main() style argv. Initial components are already
7335 * stripped.
7336 *
7337 * @return A shell status integer (0 for success).
7338 **/
7339 static int rpc_printer_migrate_forms(struct net_context *c, int argc,
7340 const char **argv)
7341 {
7342 if (c->display_usage) {
7343 d_printf( "%s\n"
7344 "net rpc printer migrate forms\n"
7345 " %s\n",
7346 _("Usage:"),
7347 _("Migrate print-forms from a print-server"));
7348 return 0;
7349 }
7350
7351 if (!c->opt_host) {
7352 d_printf(_("no server to migrate\n"));
7353 return -1;
7354 }
7355
7356 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7357 rpc_printer_migrate_forms_internals,
7358 argc, argv);
7359 }
7360
7361 /**
7362 * Migrate printers from a print-server.
7363 *
7364 * @param c A net_context structure.
7365 * @param argc Standard main() style argc.
7366 * @param argv Standard main() style argv. Initial components are already
7367 * stripped.
7368 *
7369 * @return A shell status integer (0 for success).
7370 **/
7371 static int rpc_printer_migrate_printers(struct net_context *c, int argc,
7372 const char **argv)
7373 {
7374 if (c->display_usage) {
7375 d_printf( "%s\n"
7376 "net rpc printer migrate printers\n"
7377 " %s\n",
7378 _("Usage:"),
7379 _("Migrate printers from a print-server"));
7380 return 0;
7381 }
7382
7383 if (!c->opt_host) {
7384 d_printf(_("no server to migrate\n"));
7385 return -1;
7386 }
7387
7388 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7389 rpc_printer_migrate_printers_internals,
7390 argc, argv);
7391 }
7392
7393 /**
7394 * Migrate printer-ACLs from a print-server
7395 *
7396 * @param c A net_context structure.
7397 * @param argc Standard main() style argc.
7398 * @param argv Standard main() style argv. Initial components are already
7399 * stripped.
7400 *
7401 * @return A shell status integer (0 for success).
7402 **/
7403 static int rpc_printer_migrate_security(struct net_context *c, int argc,
7404 const char **argv)
7405 {
7406 if (c->display_usage) {
7407 d_printf( "%s\n"
7408 "net rpc printer migrate security\n"
7409 " %s\n",
7410 _("Usage:"),
7411 _("Migrate printer-ACLs from a print-server"));
7412 return 0;
7413 }
7414
7415 if (!c->opt_host) {
7416 d_printf(_("no server to migrate\n"));
7417 return -1;
7418 }
7419
7420 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7421 rpc_printer_migrate_security_internals,
7422 argc, argv);
7423 }
7424
7425 /**
7426 * Migrate printer-settings from a print-server.
7427 *
7428 * @param c A net_context structure.
7429 * @param argc Standard main() style argc.
7430 * @param argv Standard main() style argv. Initial components are already
7431 * stripped.
7432 *
7433 * @return A shell status integer (0 for success).
7434 **/
7435 static int rpc_printer_migrate_settings(struct net_context *c, int argc,
7436 const char **argv)
7437 {
7438 if (c->display_usage) {
7439 d_printf( "%s\n"
7440 "net rpc printer migrate settings\n"
7441 " %s\n",
7442 _("Usage:"),
7443 _("Migrate printer-settings from a "
7444 "print-server"));
7445 return 0;
7446 }
7447
7448 if (!c->opt_host) {
7449 d_printf(_("no server to migrate\n"));
7450 return -1;
7451 }
7452
7453 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7454 rpc_printer_migrate_settings_internals,
7455 argc, argv);
7456 }
7457
7458 /**
7459 * 'net rpc printer' entrypoint.
7460 *
7461 * @param c A net_context structure.
7462 * @param argc Standard main() style argc.
7463 * @param argv Standard main() style argv. Initial components are already
7464 * stripped.
7465 **/
7466
7467 int rpc_printer_migrate(struct net_context *c, int argc, const char **argv)
7468 {
7469
7470 /* ouch: when addriver and setdriver are called from within
7471 rpc_printer_migrate_drivers_internals, the printer-queue already
7472 *has* to exist */
7473
7474 struct functable func[] = {
7475 {
7476 "all",
7477 rpc_printer_migrate_all,
7478 NET_TRANSPORT_RPC,
7479 N_("Migrate all from remote to local print server"),
7480 N_("net rpc printer migrate all\n"
7481 " Migrate all from remote to local print server")
7482 },
7483 {
7484 "drivers",
7485 rpc_printer_migrate_drivers,
7486 NET_TRANSPORT_RPC,
7487 N_("Migrate drivers to local server"),
7488 N_("net rpc printer migrate drivers\n"
7489 " Migrate drivers to local server")
7490 },
7491 {
7492 "forms",
7493 rpc_printer_migrate_forms,
7494 NET_TRANSPORT_RPC,
7495 N_("Migrate froms to local server"),
7496 N_("net rpc printer migrate forms\n"
7497 " Migrate froms to local server")
7498 },
7499 {
7500 "printers",
7501 rpc_printer_migrate_printers,
7502 NET_TRANSPORT_RPC,
7503 N_("Migrate printers to local server"),
7504 N_("net rpc printer migrate printers\n"
7505 " Migrate printers to local server")
7506 },
7507 {
7508 "security",
7509 rpc_printer_migrate_security,
7510 NET_TRANSPORT_RPC,
7511 N_("Mirgate printer ACLs to local server"),
7512 N_("net rpc printer migrate security\n"
7513 " Mirgate printer ACLs to local server")
7514 },
7515 {
7516 "settings",
7517 rpc_printer_migrate_settings,
7518 NET_TRANSPORT_RPC,
7519 N_("Migrate printer settings to local server"),
7520 N_("net rpc printer migrate settings\n"
7521 " Migrate printer settings to local server")
7522 },
7523 {NULL, NULL, 0, NULL, NULL}
7524 };
7525
7526 return net_run_function(c, argc, argv, "net rpc printer migrate",func);
7527 }
7528
7529
7530 /**
7531 * List printers on a remote RPC server.
7532 *
7533 * @param c A net_context structure.
7534 * @param argc Standard main() style argc.
7535 * @param argv Standard main() style argv. Initial components are already
7536 * stripped.
7537 *
7538 * @return A shell status integer (0 for success).
7539 **/
7540 static int rpc_printer_list(struct net_context *c, int argc, const char **argv)
7541 {
7542 if (c->display_usage) {
7543 d_printf( "%s\n"
7544 "net rpc printer list\n"
7545 " %s\n",
7546 _("Usage:"),
7547 _("List printers on a remote RPC server"));
7548 return 0;
7549 }
7550
7551 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7552 rpc_printer_list_internals,
7553 argc, argv);
7554 }
7555
7556 /**
7557 * List printer-drivers on a remote RPC server.
7558 *
7559 * @param c A net_context structure.
7560 * @param argc Standard main() style argc.
7561 * @param argv Standard main() style argv. Initial components are already
7562 * stripped.
7563 *
7564 * @return A shell status integer (0 for success).
7565 **/
7566 static int rpc_printer_driver_list(struct net_context *c, int argc,
7567 const char **argv)
7568 {
7569 if (c->display_usage) {
7570 d_printf( "%s\n"
7571 "net rpc printer driver\n"
7572 " %s\n",
7573 _("Usage:"),
7574 _("List printer-drivers on a remote RPC server"));
7575 return 0;
7576 }
7577
7578 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7579 rpc_printer_driver_list_internals,
7580 argc, argv);
7581 }
7582
7583 /**
7584 * Publish printer in ADS via MSRPC.
7585 *
7586 * @param c A net_context structure.
7587 * @param argc Standard main() style argc.
7588 * @param argv Standard main() style argv. Initial components are already
7589 * stripped.
7590 *
7591 * @return A shell status integer (0 for success).
7592 **/
7593 static int rpc_printer_publish_publish(struct net_context *c, int argc,
7594 const char **argv)
7595 {
7596 if (c->display_usage) {
7597 d_printf( "%s\n"
7598 "net rpc printer publish publish\n"
7599 " %s\n",
7600 _("Usage:"),
7601 _("Publish printer in ADS via MSRPC"));
7602 return 0;
7603 }
7604
7605 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7606 rpc_printer_publish_publish_internals,
7607 argc, argv);
7608 }
7609
7610 /**
7611 * Update printer in ADS via MSRPC.
7612 *
7613 * @param c A net_context structure.
7614 * @param argc Standard main() style argc.
7615 * @param argv Standard main() style argv. Initial components are already
7616 * stripped.
7617 *
7618 * @return A shell status integer (0 for success).
7619 **/
7620 static int rpc_printer_publish_update(struct net_context *c, int argc, const char **argv)
7621 {
7622 if (c->display_usage) {
7623 d_printf( "%s\n"
7624 "net rpc printer publish update\n"
7625 " %s\n",
7626 _("Usage:"),
7627 _("Update printer in ADS via MSRPC"));
7628 return 0;
7629 }
7630
7631 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7632 rpc_printer_publish_update_internals,
7633 argc, argv);
7634 }
7635
7636 /**
7637 * UnPublish printer in ADS via MSRPC.
7638 *
7639 * @param c A net_context structure.
7640 * @param argc Standard main() style argc.
7641 * @param argv Standard main() style argv. Initial components are already
7642 * stripped.
7643 *
7644 * @return A shell status integer (0 for success).
7645 **/
7646 static int rpc_printer_publish_unpublish(struct net_context *c, int argc,
7647 const char **argv)
7648 {
7649 if (c->display_usage) {
7650 d_printf( "%s\n"
7651 "net rpc printer publish unpublish\n"
7652 " %s\n",
7653 _("Usage:\n"),
7654 _("UnPublish printer in ADS via MSRPC"));
7655 return 0;
7656 }
7657
7658 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7659 rpc_printer_publish_unpublish_internals,
7660 argc, argv);
7661 }
7662
7663 /**
7664 * List published printers via MSRPC.
7665 *
7666 * @param c A net_context structure.
7667 * @param argc Standard main() style argc.
7668 * @param argv Standard main() style argv. Initial components are already
7669 * stripped.
7670 *
7671 * @return A shell status integer (0 for success).
7672 **/
7673 static int rpc_printer_publish_list(struct net_context *c, int argc,
7674 const char **argv)
7675 {
7676 if (c->display_usage) {
7677 d_printf( "%s\n"
7678 "net rpc printer publish list\n"
7679 " %s\n",
7680 _("Usage:"),
7681 _("List published printers via MSRPC"));
7682 return 0;
7683 }
7684
7685 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7686 rpc_printer_publish_list_internals,
7687 argc, argv);
7688 }
7689
7690
7691 /**
7692 * Publish printer in ADS.
7693 *
7694 * @param c A net_context structure.
7695 * @param argc Standard main() style argc.
7696 * @param argv Standard main() style argv. Initial components are already
7697 * stripped.
7698 *
7699 * @return A shell status integer (0 for success).
7700 **/
7701 static int rpc_printer_publish(struct net_context *c, int argc,
7702 const char **argv)
7703 {
7704
7705 struct functable func[] = {
7706 {
7707 "publish",
7708 rpc_printer_publish_publish,
7709 NET_TRANSPORT_RPC,
7710 N_("Publish printer in AD"),
7711 N_("net rpc printer publish publish\n"
7712 " Publish printer in AD")
7713 },
7714 {
7715 "update",
7716 rpc_printer_publish_update,
7717 NET_TRANSPORT_RPC,
7718 N_("Update printer in AD"),
7719 N_("net rpc printer publish update\n"
7720 " Update printer in AD")
7721 },
7722 {
7723 "unpublish",
7724 rpc_printer_publish_unpublish,
7725 NET_TRANSPORT_RPC,
7726 N_("Unpublish printer"),
7727 N_("net rpc printer publish unpublish\n"
7728 " Unpublish printer")
7729 },
7730 {
7731 "list",
7732 rpc_printer_publish_list,
7733 NET_TRANSPORT_RPC,
7734 N_("List published printers"),
7735 N_("net rpc printer publish list\n"
7736 " List published printers")
7737 },
7738 {NULL, NULL, 0, NULL, NULL}
7739 };
7740
7741 if (argc == 0) {
7742 if (c->display_usage) {
7743 d_printf(_("Usage:\n"));
7744 d_printf(_("net rpc printer publish\n"
7745 " List published printers\n"
7746 " Alias of net rpc printer publish "
7747 "list\n"));
7748 net_display_usage_from_functable(func);
7749 return 0;
7750 }
7751 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7752 rpc_printer_publish_list_internals,
7753 argc, argv);
7754 }
7755
7756 return net_run_function(c, argc, argv, "net rpc printer publish",func);
7757
7758 }
7759
7760
7761 /**
7762 * Display rpc printer help page.
7763 *
7764 * @param c A net_context structure.
7765 * @param argc Standard main() style argc.
7766 * @param argv Standard main() style argv. Initial components are already
7767 * stripped.
7768 **/
7769 int rpc_printer_usage(struct net_context *c, int argc, const char **argv)
7770 {
7771 d_printf(_("net rpc printer LIST [printer] [misc. options] [targets]\n"
7772 "\tlists all printers on print-server\n\n"));
7773 d_printf(_("net rpc printer DRIVER [printer] [misc. options] [targets]\n"
7774 "\tlists all printer-drivers on print-server\n\n"));
7775 d_printf(_("net rpc printer PUBLISH action [printer] [misc. options] [targets]\n"
7776 "\tpublishes printer settings in Active Directory\n"
7777 "\taction can be one of PUBLISH, UPDATE, UNPUBLISH or LIST\n\n"));
7778 d_printf(_("net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets]"
7779 "\n\tmigrates printers from remote to local server\n\n"));
7780 d_printf(_("net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets]"
7781 "\n\tmigrates printer-settings from remote to local server\n\n"));
7782 d_printf(_("net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets]"
7783 "\n\tmigrates printer-drivers from remote to local server\n\n"));
7784 d_printf(_("net rpc printer MIGRATE FORMS [printer] [misc. options] [targets]"
7785 "\n\tmigrates printer-forms from remote to local server\n\n"));
7786 d_printf(_("net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets]"
7787 "\n\tmigrates printer-ACLs from remote to local server\n\n"));
7788 d_printf(_("net rpc printer MIGRATE ALL [printer] [misc. options] [targets]"
7789 "\n\tmigrates drivers, forms, queues, settings and acls from\n"
7790 "\tremote to local print-server\n\n"));
7791 net_common_methods_usage(c, argc, argv);
7792 net_common_flags_usage(c, argc, argv);
7793 d_printf(_(
7794 "\t-v or --verbose\t\t\tgive verbose output\n"
7795 "\t --destination\t\tmigration target server (default: localhost)\n"));
7796
7797 return -1;
7798 }
7799
7800 /**
7801 * 'net rpc printer' entrypoint.
7802 *
7803 * @param c A net_context structure.
7804 * @param argc Standard main() style argc.
7805 * @param argv Standard main() style argv. Initial components are already
7806 * stripped.
7807 **/
7808 int net_rpc_printer(struct net_context *c, int argc, const char **argv)
7809 {
7810 struct functable func[] = {
7811 {
7812 "list",
7813 rpc_printer_list,
7814 NET_TRANSPORT_RPC,
7815 N_("List all printers on print server"),
7816 N_("net rpc printer list\n"
7817 " List all printers on print server")
7818 },
7819 {
7820 "migrate",
7821 rpc_printer_migrate,
7822 NET_TRANSPORT_RPC,
7823 N_("Migrate printer to local server"),
7824 N_("net rpc printer migrate\n"
7825 " Migrate printer to local server")
7826 },
7827 {
7828 "driver",
7829 rpc_printer_driver_list,
7830 NET_TRANSPORT_RPC,
7831 N_("List printer drivers"),
7832 N_("net rpc printer driver\n"
7833 " List printer drivers")
7834 },
7835 {
7836 "publish",
7837 rpc_printer_publish,
7838 NET_TRANSPORT_RPC,
7839 N_("Publish printer in AD"),
7840 N_("net rpc printer publish\n"
7841 " Publish printer in AD")
7842 },
7843 {NULL, NULL, 0, NULL, NULL}
7844 };
7845
7846 if (argc == 0) {
7847 if (c->display_usage) {
7848 d_printf(_("Usage:\n"));
7849 d_printf(_("net rpc printer\n"
7850 " List printers\n"));
7851 net_display_usage_from_functable(func);
7852 return 0;
7853 }
7854 return run_rpc_command(c, NULL, &ndr_table_spoolss, 0,
7855 rpc_printer_list_internals,
7856 argc, argv);
7857 }
7858
7859 return net_run_function(c, argc, argv, "net rpc printer", func);
7860 }
7861
7862 /**
7863 * 'net rpc' entrypoint.
7864 *
7865 * @param c A net_context structure.
7866 * @param argc Standard main() style argc.
7867 * @param argv Standard main() style argv. Initial components are already
7868 * stripped.
7869 **/
7870
7871 int net_rpc(struct net_context *c, int argc, const char **argv)
7872 {
7873 NET_API_STATUS status;
7874
7875 struct functable func[] = {
7876 {
7877 "audit",
7878 net_rpc_audit,
7879 NET_TRANSPORT_RPC,
7880 N_("Modify global audit settings"),
7881 N_("net rpc audit\n"
7882 " Modify global audit settings")
7883 },
7884 {
7885 "info",
7886 net_rpc_info,
7887 NET_TRANSPORT_RPC,
7888 N_("Show basic info about a domain"),
7889 N_("net rpc info\n"
7890 " Show basic info about a domain")
7891 },
7892 {
7893 "join",
7894 net_rpc_join,
7895 NET_TRANSPORT_RPC,
7896 N_("Join a domain"),
7897 N_("net rpc join\n"
7898 " Join a domain")
7899 },
7900 {
7901 "oldjoin",
7902 net_rpc_oldjoin,
7903 NET_TRANSPORT_RPC,
7904 N_("Join a domain created in server manager"),
7905 N_("net rpc oldjoin\n"
7906 " Join a domain created in server manager")
7907 },
7908 {
7909 "testjoin",
7910 net_rpc_testjoin,
7911 NET_TRANSPORT_RPC,
7912 N_("Test that a join is valid"),
7913 N_("net rpc testjoin\n"
7914 " Test that a join is valid")
7915 },
7916 {
7917 "user",
7918 net_rpc_user,
7919 NET_TRANSPORT_RPC,
7920 N_("List/modify users"),
7921 N_("net rpc user\n"
7922 " List/modify users")
7923 },
7924 {
7925 "password",
7926 rpc_user_password,
7927 NET_TRANSPORT_RPC,
7928 N_("Change a user password"),
7929 N_("net rpc password\n"
7930 " Change a user password\n"
7931 " Alias for net rpc user password")
7932 },
7933 {
7934 "group",
7935 net_rpc_group,
7936 NET_TRANSPORT_RPC,
7937 N_("List/modify groups"),
7938 N_("net rpc group\n"
7939 " List/modify groups")
7940 },
7941 {
7942 "share",
7943 net_rpc_share,
7944 NET_TRANSPORT_RPC,
7945 N_("List/modify shares"),
7946 N_("net rpc share\n"
7947 " List/modify shares")
7948 },
7949 {
7950 "file",
7951 net_rpc_file,
7952 NET_TRANSPORT_RPC,
7953 N_("List open files"),
7954 N_("net rpc file\n"
7955 " List open files")
7956 },
7957 {
7958 "printer",
7959 net_rpc_printer,
7960 NET_TRANSPORT_RPC,
7961 N_("List/modify printers"),
7962 N_("net rpc printer\n"
7963 " List/modify printers")
7964 },
7965 {
7966 "changetrustpw",
7967 net_rpc_changetrustpw,
7968 NET_TRANSPORT_RPC,
7969 N_("Change trust account password"),
7970 N_("net rpc changetrustpw\n"
7971 " Change trust account password")
7972 },
7973 {
7974 "trustdom",
7975 rpc_trustdom,
7976 NET_TRANSPORT_RPC,
7977 N_("Modify domain trusts"),
7978 N_("net rpc trustdom\n"
7979 " Modify domain trusts")
7980 },
7981 {
7982 "abortshutdown",
7983 rpc_shutdown_abort,
7984 NET_TRANSPORT_RPC,
7985 N_("Abort a remote shutdown"),
7986 N_("net rpc abortshutdown\n"
7987 " Abort a remote shutdown")
7988 },
7989 {
7990 "shutdown",
7991 rpc_shutdown,
7992 NET_TRANSPORT_RPC,
7993 N_("Shutdown a remote server"),
7994 N_("net rpc shutdown\n"
7995 " Shutdown a remote server")
7996 },
7997 {
7998 "samdump",
7999 rpc_samdump,
8000 NET_TRANSPORT_RPC,
8001 N_("Dump SAM data of remote NT PDC"),
8002 N_("net rpc samdump\n"
8003 " Dump SAM data of remote NT PDC")
8004 },
8005 {
8006 "vampire",
8007 rpc_vampire,
8008 NET_TRANSPORT_RPC,
8009 N_("Sync a remote NT PDC's data into local passdb"),
8010 N_("net rpc vampire\n"
8011 " Sync a remote NT PDC's data into local passdb")
8012 },
8013 {
8014 "getsid",
8015 net_rpc_getsid,
8016 NET_TRANSPORT_RPC,
8017 N_("Fetch the domain sid into local secrets.tdb"),
8018 N_("net rpc getsid\n"
8019 " Fetch the domain sid into local secrets.tdb")
8020 },
8021 {
8022 "rights",
8023 net_rpc_rights,
8024 NET_TRANSPORT_RPC,
8025 N_("Manage privileges assigned to SID"),
8026 N_("net rpc rights\n"
8027 " Manage privileges assigned to SID")
8028 },
8029 {
8030 "service",
8031 net_rpc_service,
8032 NET_TRANSPORT_RPC,
8033 N_("Start/stop/query remote services"),
8034 N_("net rpc service\n"
8035 " Start/stop/query remote services")
8036 },
8037 {
8038 "registry",
8039 net_rpc_registry,
8040 NET_TRANSPORT_RPC,
8041 N_("Manage registry hives"),
8042 N_("net rpc registry\n"
8043 " Manage registry hives")
8044 },
8045 {
8046 "shell",
8047 net_rpc_shell,
8048 NET_TRANSPORT_RPC,
8049 N_("Open interactive shell on remote server"),
8050 N_("net rpc shell\n"
8051 " Open interactive shell on remote server")
8052 },
8053 {
8054 "trust",
8055 net_rpc_trust,
8056 NET_TRANSPORT_RPC,
8057 N_("Manage trusts"),
8058 N_("net rpc trust\n"
8059 " Manage trusts")
8060 },
8061 {
8062 "conf",
8063 net_rpc_conf,
8064 NET_TRANSPORT_RPC,
8065 N_("Configure a remote samba server"),
8066 N_("net rpc conf\n"
8067 " Configure a remote samba server")
8068 },
8069 {NULL, NULL, 0, NULL, NULL}
8070 };
8071
8072 status = libnetapi_net_init(&c->netapi_ctx);
8073 if (status != 0) {
8074 return -1;
8075 }
8076 libnetapi_set_username(c->netapi_ctx, c->opt_user_name);
8077 libnetapi_set_password(c->netapi_ctx, c->opt_password);
8078 if (c->opt_kerberos) {
8079 libnetapi_set_use_kerberos(c->netapi_ctx);
8080 }
8081 if (c->opt_ccache) {
8082 libnetapi_set_use_ccache(c->netapi_ctx);
8083 }
8084
8085 return net_run_function(c, argc, argv, "net rpc", func);
8086 }