source3/winbindd/winbindd_cm.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon connection manager
   5
   6    Copyright (C) Tim Potter                2001
   7    Copyright (C) Andrew Bartlett           2002
   8    Copyright (C) Gerald (Jerry) Carter     2003-2005.
   9    Copyright (C) Volker Lendecke           2004-2005
  10    Copyright (C) Jeremy Allison            2006
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 /*
  27    We need to manage connections to domain controllers without having to
  28    mess up the main winbindd code with other issues.  The aim of the
  29    connection manager is to:
  30
  31        - make connections to domain controllers and cache them
  32        - re-establish connections when networks or servers go down
  33        - centralise the policy on connection timeouts, domain controller
  34          selection etc
  35        - manage re-entrancy for when winbindd becomes able to handle
  36          multiple outstanding rpc requests
  37
  38    Why not have connection management as part of the rpc layer like tng?
  39    Good question.  This code may morph into libsmb/rpc_cache.c or something
  40    like that but at the moment it's simply staying as part of winbind.  I
  41    think the TNG architecture of forcing every user of the rpc layer to use
  42    the connection caching system is a bad idea.  It should be an optional
  43    method of using the routines.
  44
  45    The TNG design is quite good but I disagree with some aspects of the
  46    implementation. -tpot
  47
  48  */
  49
  50 /*
  51    TODO:
  52
  53      - I'm pretty annoyed by all the make_nmb_name() stuff.  It should be
  54        moved down into another function.
  55
  56      - Take care when destroying cli_structs as they can be shared between
  57        various sam handles.
  58
  59  */
  60
  61 #include "includes.h"
  62 #include "winbindd.h"
  63 #include "../libcli/auth/libcli_auth.h"
  64 #include "../librpc/gen_ndr/cli_netlogon.h"
  65 #include "rpc_client/cli_netlogon.h"
  66 #include "../librpc/gen_ndr/cli_samr.h"
  67 #include "../librpc/gen_ndr/cli_lsa.h"
  68 #include "rpc_client/cli_lsarpc.h"
  69 #include "../librpc/gen_ndr/cli_dssetup.h"
  70 #include "libads/sitename_cache.h"
  71 #include "librpc/gen_ndr/messaging.h"
  72 #include "libsmb/clidgram.h"
  73 #include "ads.h"
  74 #include "secrets.h"
  75 #include "../libcli/security/security.h"
  76
  77 #undef DBGC_CLASS
  78 #define DBGC_CLASS DBGC_WINBIND
  79
  80 struct dc_name_ip {
  81         fstring name;
  82         struct sockaddr_storage ss;
  83 };
  84
  85 extern struct winbindd_methods reconnect_methods;
  86 extern bool override_logfile;
  87
  88 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
  89 static void set_dc_type_and_flags( struct winbindd_domain *domain );
  90 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
  91                     struct dc_name_ip **dcs, int *num_dcs);
  92
  93 /****************************************************************
  94  Child failed to find DC's. Reschedule check.
  95 ****************************************************************/
  96
  97 static void msg_failed_to_go_online(struct messaging_context *msg,
  98                                     void *private_data,
  99                                     uint32_t msg_type,
 100                                     struct server_id server_id,
 101                                     DATA_BLOB *data)
 102 {
 103         struct winbindd_domain *domain;
 104         const char *domainname = (const char *)data->data;
 105
 106         if (data->data == NULL || data->length == 0) {
 107                 return;
 108         }
 109
 110         DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
 111
 112         for (domain = domain_list(); domain; domain = domain->next) {
 113                 if (domain->internal) {
 114                         continue;
 115                 }
 116
 117                 if (strequal(domain->name, domainname)) {
 118                         if (domain->online) {
 119                                 /* We're already online, ignore. */
 120                                 DEBUG(5,("msg_fail_to_go_online: domain %s "
 121                                         "already online.\n", domainname));
 122                                 continue;
 123                         }
 124
 125                         /* Reschedule the online check. */
 126                         set_domain_offline(domain);
 127                         break;
 128                 }
 129         }
 130 }
 131
 132 /****************************************************************
 133  Actually cause a reconnect from a message.
 134 ****************************************************************/
 135
 136 static void msg_try_to_go_online(struct messaging_context *msg,
 137                                  void *private_data,
 138                                  uint32_t msg_type,
 139                                  struct server_id server_id,
 140                                  DATA_BLOB *data)
 141 {
 142         struct winbindd_domain *domain;
 143         const char *domainname = (const char *)data->data;
 144
 145         if (data->data == NULL || data->length == 0) {
 146                 return;
 147         }
 148
 149         DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
 150
 151         for (domain = domain_list(); domain; domain = domain->next) {
 152                 if (domain->internal) {
 153                         continue;
 154                 }
 155
 156                 if (strequal(domain->name, domainname)) {
 157
 158                         if (domain->online) {
 159                                 /* We're already online, ignore. */
 160                                 DEBUG(5,("msg_try_to_go_online: domain %s "
 161                                         "already online.\n", domainname));
 162                                 continue;
 163                         }
 164
 165                         /* This call takes care of setting the online
 166                            flag to true if we connected, or re-adding
 167                            the offline handler if false. Bypasses online
 168                            check so always does network calls. */
 169
 170                         init_dc_connection_network(domain);
 171                         break;
 172                 }
 173         }
 174 }
 175
 176 /****************************************************************
 177  Fork a child to try and contact a DC. Do this as contacting a
 178  DC requires blocking lookups and we don't want to block our
 179  parent.
 180 ****************************************************************/
 181
 182 static bool fork_child_dc_connect(struct winbindd_domain *domain)
 183 {
 184         struct dc_name_ip *dcs = NULL;
 185         int num_dcs = 0;
 186         TALLOC_CTX *mem_ctx = NULL;
 187         pid_t parent_pid = sys_getpid();
 188         char *lfile = NULL;
 189
 190         if (domain->dc_probe_pid != (pid_t)-1) {
 191                 /*
 192                  * We might already have a DC probe
 193                  * child working, check.
 194                  */
 195                 if (process_exists_by_pid(domain->dc_probe_pid)) {
 196                         DEBUG(10,("fork_child_dc_connect: pid %u already "
 197                                 "checking for DC's.\n",
 198                                 (unsigned int)domain->dc_probe_pid));
 199                         return true;
 200                 }
 201                 domain->dc_probe_pid = (pid_t)-1;
 202         }
 203
 204         domain->dc_probe_pid = sys_fork();
 205
 206         if (domain->dc_probe_pid == (pid_t)-1) {
 207                 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
 208                 return False;
 209         }
 210
 211         if (domain->dc_probe_pid != (pid_t)0) {
 212                 /* Parent */
 213                 messaging_register(winbind_messaging_context(), NULL,
 214                                    MSG_WINBIND_TRY_TO_GO_ONLINE,
 215                                    msg_try_to_go_online);
 216                 messaging_register(winbind_messaging_context(), NULL,
 217                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 218                                    msg_failed_to_go_online);
 219                 return True;
 220         }
 221
 222         /* Child. */
 223
 224         /* Leave messages blocked - we will never process one. */
 225
 226         if (!override_logfile) {
 227                 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
 228                         DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
 229                         _exit(1);
 230                 }
 231         }
 232
 233         if (!winbindd_reinit_after_fork(lfile)) {
 234                 messaging_send_buf(winbind_messaging_context(),
 235                                    pid_to_procid(parent_pid),
 236                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 237                                    (uint8 *)domain->name,
 238                                    strlen(domain->name)+1);
 239                 _exit(1);
 240         }
 241         SAFE_FREE(lfile);
 242
 243         mem_ctx = talloc_init("fork_child_dc_connect");
 244         if (!mem_ctx) {
 245                 DEBUG(0,("talloc_init failed.\n"));
 246                 messaging_send_buf(winbind_messaging_context(),
 247                                    pid_to_procid(parent_pid),
 248                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 249                                    (uint8 *)domain->name,
 250                                    strlen(domain->name)+1);
 251                 _exit(1);
 252         }
 253
 254         if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
 255                 /* Still offline ? Can't find DC's. */
 256                 messaging_send_buf(winbind_messaging_context(),
 257                                    pid_to_procid(parent_pid),
 258                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 259                                    (uint8 *)domain->name,
 260                                    strlen(domain->name)+1);
 261                 _exit(0);
 262         }
 263
 264         /* We got a DC. Send a message to our parent to get it to
 265            try and do the same. */
 266
 267         messaging_send_buf(winbind_messaging_context(),
 268                            pid_to_procid(parent_pid),
 269                            MSG_WINBIND_TRY_TO_GO_ONLINE,
 270                            (uint8 *)domain->name,
 271                            strlen(domain->name)+1);
 272         _exit(0);
 273 }
 274
 275 /****************************************************************
 276  Handler triggered if we're offline to try and detect a DC.
 277 ****************************************************************/
 278
 279 static void check_domain_online_handler(struct event_context *ctx,
 280                                         struct timed_event *te,
 281                                         struct timeval now,
 282                                         void *private_data)
 283 {
 284         struct winbindd_domain *domain =
 285                 (struct winbindd_domain *)private_data;
 286
 287         DEBUG(10,("check_domain_online_handler: called for domain "
 288                   "%s (online = %s)\n", domain->name,
 289                   domain->online ? "True" : "False" ));
 290
 291         TALLOC_FREE(domain->check_online_event);
 292
 293         /* Are we still in "startup" mode ? */
 294
 295         if (domain->startup && (time_mono(NULL) > domain->startup_time + 30)) {
 296                 /* No longer in "startup" mode. */
 297                 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
 298                         domain->name ));
 299                 domain->startup = False;
 300         }
 301
 302         /* We've been told to stay offline, so stay
 303            that way. */
 304
 305         if (get_global_winbindd_state_offline()) {
 306                 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
 307                         domain->name ));
 308                 return;
 309         }
 310
 311         /* Fork a child to test if it can contact a DC.
 312            If it can then send ourselves a message to
 313            cause a reconnect. */
 314
 315         fork_child_dc_connect(domain);
 316 }
 317
 318 /****************************************************************
 319  If we're still offline setup the timeout check.
 320 ****************************************************************/
 321
 322 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
 323 {
 324         int wbr = lp_winbind_reconnect_delay();
 325
 326         if (domain->startup) {
 327                 domain->check_online_timeout = 10;
 328         } else if (domain->check_online_timeout < wbr) {
 329                 domain->check_online_timeout = wbr;
 330         }
 331 }
 332
 333 /****************************************************************
 334  Set domain offline and also add handler to put us back online
 335  if we detect a DC.
 336 ****************************************************************/
 337
 338 void set_domain_offline(struct winbindd_domain *domain)
 339 {
 340         DEBUG(10,("set_domain_offline: called for domain %s\n",
 341                 domain->name ));
 342
 343         TALLOC_FREE(domain->check_online_event);
 344
 345         if (domain->internal) {
 346                 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
 347                         domain->name ));
 348                 return;
 349         }
 350
 351         domain->online = False;
 352
 353         /* Offline domains are always initialized. They're
 354            re-initialized when they go back online. */
 355
 356         domain->initialized = True;
 357
 358         /* We only add the timeout handler that checks and
 359            allows us to go back online when we've not
 360            been told to remain offline. */
 361
 362         if (get_global_winbindd_state_offline()) {
 363                 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
 364                         domain->name ));
 365                 return;
 366         }
 367
 368         /* If we're in startup mode, check again in 10 seconds, not in
 369            lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
 370
 371         calc_new_online_timeout_check(domain);
 372
 373         domain->check_online_event = event_add_timed(winbind_event_context(),
 374                                                 NULL,
 375                                                 timeval_current_ofs(domain->check_online_timeout,0),
 376                                                 check_domain_online_handler,
 377                                                 domain);
 378
 379         /* The above *has* to succeed for winbindd to work. */
 380         if (!domain->check_online_event) {
 381                 smb_panic("set_domain_offline: failed to add online handler");
 382         }
 383
 384         DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
 385                 domain->name ));
 386
 387         /* Send an offline message to the idmap child when our
 388            primary domain goes offline */
 389
 390         if ( domain->primary ) {
 391                 struct winbindd_child *idmap = idmap_child();
 392
 393                 if ( idmap->pid != 0 ) {
 394                         messaging_send_buf(winbind_messaging_context(),
 395                                            pid_to_procid(idmap->pid),
 396                                            MSG_WINBIND_OFFLINE,
 397                                            (uint8 *)domain->name,
 398                                            strlen(domain->name)+1);
 399                 }
 400         }
 401
 402         return;
 403 }
 404
 405 /****************************************************************
 406  Set domain online - if allowed.
 407 ****************************************************************/
 408
 409 static void set_domain_online(struct winbindd_domain *domain)
 410 {
 411         DEBUG(10,("set_domain_online: called for domain %s\n",
 412                 domain->name ));
 413
 414         if (domain->internal) {
 415                 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
 416                         domain->name ));
 417                 return;
 418         }
 419
 420         if (get_global_winbindd_state_offline()) {
 421                 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
 422                         domain->name ));
 423                 return;
 424         }
 425
 426         winbindd_set_locator_kdc_envs(domain);
 427
 428         /* If we are waiting to get a krb5 ticket, trigger immediately. */
 429         ccache_regain_all_now();
 430
 431         /* Ok, we're out of any startup mode now... */
 432         domain->startup = False;
 433
 434         if (domain->online == False) {
 435                 /* We were offline - now we're online. We default to
 436                    using the MS-RPC backend if we started offline,
 437                    and if we're going online for the first time we
 438                    should really re-initialize the backends and the
 439                    checks to see if we're talking to an AD or NT domain.
 440                 */
 441
 442                 domain->initialized = False;
 443
 444                 /* 'reconnect_methods' is the MS-RPC backend. */
 445                 if (domain->backend == &reconnect_methods) {
 446                         domain->backend = NULL;
 447                 }
 448         }
 449
 450         /* Ensure we have no online timeout checks. */
 451         domain->check_online_timeout = 0;
 452         TALLOC_FREE(domain->check_online_event);
 453
 454         /* Ensure we ignore any pending child messages. */
 455         messaging_deregister(winbind_messaging_context(),
 456                              MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
 457         messaging_deregister(winbind_messaging_context(),
 458                              MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
 459
 460         domain->online = True;
 461
 462         /* Send an online message to the idmap child when our
 463            primary domain comes online */
 464
 465         if ( domain->primary ) {
 466                 struct winbindd_child *idmap = idmap_child();
 467
 468                 if ( idmap->pid != 0 ) {
 469                         messaging_send_buf(winbind_messaging_context(),
 470                                            pid_to_procid(idmap->pid),
 471                                            MSG_WINBIND_ONLINE,
 472                                            (uint8 *)domain->name,
 473                                            strlen(domain->name)+1);
 474                 }
 475         }
 476
 477         return;
 478 }
 479
 480 /****************************************************************
 481  Requested to set a domain online.
 482 ****************************************************************/
 483
 484 void set_domain_online_request(struct winbindd_domain *domain)
 485 {
 486         struct timeval tev;
 487
 488         DEBUG(10,("set_domain_online_request: called for domain %s\n",
 489                 domain->name ));
 490
 491         if (get_global_winbindd_state_offline()) {
 492                 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
 493                         domain->name ));
 494                 return;
 495         }
 496
 497         if (domain->internal) {
 498                 DEBUG(10, ("set_domain_online_request: Internal domains are "
 499                            "always online\n"));
 500                 return;
 501         }
 502
 503         /* We've been told it's safe to go online and
 504            try and connect to a DC. But I don't believe it
 505            because network manager seems to lie.
 506            Wait at least 5 seconds. Heuristics suck... */
 507
 508
 509         GetTimeOfDay(&tev);
 510
 511         /* Go into "startup" mode again. */
 512         domain->startup_time = time_mono(NULL);
 513         domain->startup = True;
 514
 515         tev.tv_sec += 5;
 516
 517         if (!domain->check_online_event) {
 518                 /* If we've come from being globally offline we
 519                    don't have a check online event handler set.
 520                    We need to add one now we're trying to go
 521                    back online. */
 522
 523                 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
 524                         domain->name ));
 525         }
 526
 527         TALLOC_FREE(domain->check_online_event);
 528
 529         domain->check_online_event = event_add_timed(winbind_event_context(),
 530                                                      NULL,
 531                                                      tev,
 532                                                      check_domain_online_handler,
 533                                                      domain);
 534
 535         /* The above *has* to succeed for winbindd to work. */
 536         if (!domain->check_online_event) {
 537                 smb_panic("set_domain_online_request: failed to add online handler");
 538         }
 539 }
 540
 541 /****************************************************************
 542  Add -ve connection cache entries for domain and realm.
 543 ****************************************************************/
 544
 545 static void winbind_add_failed_connection_entry(
 546         const struct winbindd_domain *domain,
 547         const char *server,
 548         NTSTATUS result)
 549 {
 550         add_failed_connection_entry(domain->name, server, result);
 551         /* If this was the saf name for the last thing we talked to,
 552            remove it. */
 553         saf_delete(domain->name);
 554         if (*domain->alt_name) {
 555                 add_failed_connection_entry(domain->alt_name, server, result);
 556                 saf_delete(domain->alt_name);
 557         }
 558         winbindd_unset_locator_kdc_env(domain);
 559 }
 560
 561 /* Choose between anonymous or authenticated connections.  We need to use
 562    an authenticated connection if DCs have the RestrictAnonymous registry
 563    entry set > 0, or the "Additional restrictions for anonymous
 564    connections" set in the win2k Local Security Policy.
 565
 566    Caller to free() result in domain, username, password
 567 */
 568
 569 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
 570 {
 571         *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
 572         *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 573         *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
 574
 575         if (*username && **username) {
 576
 577                 if (!*domain || !**domain)
 578                         *domain = smb_xstrdup(lp_workgroup());
 579
 580                 if (!*password || !**password)
 581                         *password = smb_xstrdup("");
 582
 583                 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
 584                           *domain, *username));
 585
 586         } else {
 587                 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
 588                 *username = smb_xstrdup("");
 589                 *domain = smb_xstrdup("");
 590                 *password = smb_xstrdup("");
 591         }
 592 }
 593
 594 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
 595                                      fstring dcname,
 596                                      struct sockaddr_storage *dc_ss)
 597 {
 598         struct winbindd_domain *our_domain = NULL;
 599         struct rpc_pipe_client *netlogon_pipe = NULL;
 600         NTSTATUS result;
 601         WERROR werr;
 602         TALLOC_CTX *mem_ctx;
 603         unsigned int orig_timeout;
 604         const char *tmp = NULL;
 605         const char *p;
 606
 607         /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
 608          * moment.... */
 609
 610         if (IS_DC) {
 611                 return False;
 612         }
 613
 614         if (domain->primary) {
 615                 return False;
 616         }
 617
 618         our_domain = find_our_domain();
 619
 620         if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
 621                 return False;
 622         }
 623
 624         result = cm_connect_netlogon(our_domain, &netlogon_pipe);
 625         if (!NT_STATUS_IS_OK(result)) {
 626                 talloc_destroy(mem_ctx);
 627                 return False;
 628         }
 629
 630         /* This call can take a long time - allow the server to time out.
 631            35 seconds should do it. */
 632
 633         orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
 634
 635         if (our_domain->active_directory) {
 636                 struct netr_DsRGetDCNameInfo *domain_info = NULL;
 637
 638                 result = rpccli_netr_DsRGetDCName(netlogon_pipe,
 639                                                   mem_ctx,
 640                                                   our_domain->dcname,
 641                                                   domain->name,
 642                                                   NULL,
 643                                                   NULL,
 644                                                   DS_RETURN_DNS_NAME,
 645                                                   &domain_info,
 646                                                   &werr);
 647                 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
 648                         tmp = talloc_strdup(
 649                                 mem_ctx, domain_info->dc_unc);
 650                         if (tmp == NULL) {
 651                                 DEBUG(0, ("talloc_strdup failed\n"));
 652                                 talloc_destroy(mem_ctx);
 653                                 return false;
 654                         }
 655                         if (strlen(domain->alt_name) == 0) {
 656                                 fstrcpy(domain->alt_name,
 657                                         domain_info->domain_name);
 658                         }
 659                         if (strlen(domain->forest_name) == 0) {
 660                                 fstrcpy(domain->forest_name,
 661                                         domain_info->forest_name);
 662                         }
 663                 }
 664         } else {
 665                 result = rpccli_netr_GetAnyDCName(netlogon_pipe, mem_ctx,
 666                                                   our_domain->dcname,
 667                                                   domain->name,
 668                                                   &tmp,
 669                                                   &werr);
 670         }
 671
 672         /* And restore our original timeout. */
 673         rpccli_set_timeout(netlogon_pipe, orig_timeout);
 674
 675         if (!NT_STATUS_IS_OK(result)) {
 676                 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
 677                         nt_errstr(result)));
 678                 talloc_destroy(mem_ctx);
 679                 return false;
 680         }
 681
 682         if (!W_ERROR_IS_OK(werr)) {
 683                 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
 684                            win_errstr(werr)));
 685                 talloc_destroy(mem_ctx);
 686                 return false;
 687         }
 688
 689         /* rpccli_netr_GetAnyDCName gives us a name with \\ */
 690         p = strip_hostname(tmp);
 691
 692         fstrcpy(dcname, p);
 693
 694         talloc_destroy(mem_ctx);
 695
 696         DEBUG(10,("rpccli_netr_GetAnyDCName returned %s\n", dcname));
 697
 698         if (!resolve_name(dcname, dc_ss, 0x20, true)) {
 699                 return False;
 700         }
 701
 702         return True;
 703 }
 704
 705 /**
 706  * Helper function to assemble trust password and account name
 707  */
 708 static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
 709                                 char **machine_password,
 710                                 char **machine_account,
 711                                 char **machine_krb5_principal)
 712 {
 713         const char *account_name;
 714         const char *name = NULL;
 715
 716         /* If we are a DC and this is not our own domain */
 717
 718         if (IS_DC) {
 719                 name = domain->name;
 720         } else {
 721                 struct winbindd_domain *our_domain = find_our_domain();
 722
 723                 if (!our_domain)
 724                         return NT_STATUS_INVALID_SERVER_STATE;
 725
 726                 name = our_domain->name;
 727         }
 728
 729         if (!get_trust_pw_clear(name, machine_password,
 730                                 &account_name, NULL))
 731         {
 732                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 733         }
 734
 735         if ((machine_account != NULL) &&
 736             (asprintf(machine_account, "%s$", account_name) == -1))
 737         {
 738                 return NT_STATUS_NO_MEMORY;
 739         }
 740
 741         /* For now assume our machine account only exists in our domain */
 742
 743         if (machine_krb5_principal != NULL)
 744         {
 745                 struct winbindd_domain *our_domain = find_our_domain();
 746
 747                 if (!our_domain) {
 748                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 749                 }
 750
 751                 if (asprintf(machine_krb5_principal, "%s$@%s",
 752                              account_name, our_domain->alt_name) == -1)
 753                 {
 754                         return NT_STATUS_NO_MEMORY;
 755                 }
 756
 757                 strupper_m(*machine_krb5_principal);
 758         }
 759
 760         return NT_STATUS_OK;
 761 }
 762
 763 /************************************************************************
 764  Given a fd with a just-connected TCP connection to a DC, open a connection
 765  to the pipe.
 766 ************************************************************************/
 767
 768 static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
 769                                       const int sockfd,
 770                                       const char *controller,
 771                                       struct cli_state **cli,
 772                                       bool *retry)
 773 {
 774         char *machine_password = NULL;
 775         char *machine_krb5_principal = NULL;
 776         char *machine_account = NULL;
 777         char *ipc_username = NULL;
 778         char *ipc_domain = NULL;
 779         char *ipc_password = NULL;
 780
 781         struct named_mutex *mutex;
 782
 783         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 784
 785         struct sockaddr peeraddr;
 786         socklen_t peeraddr_len;
 787
 788         struct sockaddr_in *peeraddr_in =
 789                 (struct sockaddr_in *)(void *)&peeraddr;
 790
 791         DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
 792                 controller, domain->name ));
 793
 794         *retry = True;
 795
 796         mutex = grab_named_mutex(talloc_tos(), controller,
 797                                  WINBIND_SERVER_MUTEX_WAIT_TIME);
 798         if (mutex == NULL) {
 799                 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
 800                          controller));
 801                 result = NT_STATUS_POSSIBLE_DEADLOCK;
 802                 goto done;
 803         }
 804
 805         if ((*cli = cli_initialise()) == NULL) {
 806                 DEBUG(1, ("Could not cli_initialize\n"));
 807                 result = NT_STATUS_NO_MEMORY;
 808                 goto done;
 809         }
 810
 811         (*cli)->timeout = 10000;        /* 10 seconds */
 812         (*cli)->fd = sockfd;
 813         fstrcpy((*cli)->desthost, controller);
 814         (*cli)->use_kerberos = True;
 815
 816         peeraddr_len = sizeof(peeraddr);
 817
 818         if ((getpeername((*cli)->fd, &peeraddr, &peeraddr_len) != 0)) {
 819                 DEBUG(0,("cm_prepare_connection: getpeername failed with: %s\n",
 820                         strerror(errno)));
 821                 result = NT_STATUS_UNSUCCESSFUL;
 822                 goto done;
 823         }
 824
 825         if ((peeraddr_len != sizeof(struct sockaddr_in))
 826 #ifdef HAVE_IPV6
 827             && (peeraddr_len != sizeof(struct sockaddr_in6))
 828 #endif
 829             ) {
 830                 DEBUG(0,("cm_prepare_connection: got unexpected peeraddr len %d\n",
 831                         peeraddr_len));
 832                 result = NT_STATUS_UNSUCCESSFUL;
 833                 goto done;
 834         }
 835
 836         if ((peeraddr_in->sin_family != PF_INET)
 837 #ifdef HAVE_IPV6
 838             && (peeraddr_in->sin_family != PF_INET6)
 839 #endif
 840             ) {
 841                 DEBUG(0,("cm_prepare_connection: got unexpected family %d\n",
 842                         peeraddr_in->sin_family));
 843                 result = NT_STATUS_UNSUCCESSFUL;
 844                 goto done;
 845         }
 846
 847         result = cli_negprot(*cli);
 848
 849         if (!NT_STATUS_IS_OK(result)) {
 850                 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
 851                 goto done;
 852         }
 853
 854         if (!is_dc_trusted_domain_situation(domain->name) &&
 855             (*cli)->protocol >= PROTOCOL_NT1 &&
 856             (*cli)->capabilities & CAP_EXTENDED_SECURITY)
 857         {
 858                 ADS_STATUS ads_status;
 859
 860                 result = get_trust_creds(domain, &machine_password,
 861                                          &machine_account,
 862                                          &machine_krb5_principal);
 863                 if (!NT_STATUS_IS_OK(result)) {
 864                         goto anon_fallback;
 865                 }
 866
 867                 if (lp_security() == SEC_ADS) {
 868
 869                         /* Try a krb5 session */
 870
 871                         (*cli)->use_kerberos = True;
 872                         DEBUG(5, ("connecting to %s from %s with kerberos principal "
 873                                   "[%s] and realm [%s]\n", controller, global_myname(),
 874                                   machine_krb5_principal, domain->alt_name));
 875
 876                         winbindd_set_locator_kdc_envs(domain);
 877
 878                         ads_status = cli_session_setup_spnego(*cli,
 879                                                               machine_krb5_principal,
 880                                                               machine_password,
 881                                                               lp_workgroup(),
 882                                                               domain->alt_name);
 883
 884                         if (!ADS_ERR_OK(ads_status)) {
 885                                 DEBUG(4,("failed kerberos session setup with %s\n",
 886                                          ads_errstr(ads_status)));
 887                         }
 888
 889                         result = ads_ntstatus(ads_status);
 890                         if (NT_STATUS_IS_OK(result)) {
 891                                 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 892                                 result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 893                                 if (!NT_STATUS_IS_OK(result)) {
 894                                         goto done;
 895                                 }
 896                                 goto session_setup_done;
 897                         }
 898                 }
 899
 900                 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
 901                 (*cli)->use_kerberos = False;
 902
 903                 DEBUG(5, ("connecting to %s from %s with username "
 904                           "[%s]\\[%s]\n",  controller, global_myname(),
 905                           lp_workgroup(), machine_account));
 906
 907                 ads_status = cli_session_setup_spnego(*cli,
 908                                                       machine_account,
 909                                                       machine_password,
 910                                                       lp_workgroup(),
 911                                                       NULL);
 912                 if (!ADS_ERR_OK(ads_status)) {
 913                         DEBUG(4, ("authenticated session setup failed with %s\n",
 914                                 ads_errstr(ads_status)));
 915                 }
 916
 917                 result = ads_ntstatus(ads_status);
 918                 if (NT_STATUS_IS_OK(result)) {
 919                         /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
 920                         result = cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
 921                         if (!NT_STATUS_IS_OK(result)) {
 922                                 goto done;
 923                         }
 924                         goto session_setup_done;
 925                 }
 926         }
 927
 928         /* Fall back to non-kerberos session setup with auth_user */
 929
 930         (*cli)->use_kerberos = False;
 931
 932         cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
 933
 934         if ((((*cli)->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) != 0) &&
 935             (strlen(ipc_username) > 0)) {
 936
 937                 /* Only try authenticated if we have a username */
 938
 939                 DEBUG(5, ("connecting to %s from %s with username "
 940                           "[%s]\\[%s]\n",  controller, global_myname(),
 941                           ipc_domain, ipc_username));
 942
 943                 if (NT_STATUS_IS_OK(cli_session_setup(
 944                                             *cli, ipc_username,
 945                                             ipc_password, strlen(ipc_password)+1,
 946                                             ipc_password, strlen(ipc_password)+1,
 947                                             ipc_domain))) {
 948                         /* Successful logon with given username. */
 949                         result = cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
 950                         if (!NT_STATUS_IS_OK(result)) {
 951                                 goto done;
 952                         }
 953                         goto session_setup_done;
 954                 } else {
 955                         DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
 956                                 ipc_domain, ipc_username ));
 957                 }
 958         }
 959
 960  anon_fallback:
 961
 962         /* Fall back to anonymous connection, this might fail later */
 963         DEBUG(10,("cm_prepare_connection: falling back to anonymous "
 964                 "connection for DC %s\n",
 965                 controller ));
 966
 967         if (NT_STATUS_IS_OK(cli_session_setup(*cli, "", NULL, 0,
 968                                               NULL, 0, ""))) {
 969                 DEBUG(5, ("Connected anonymously\n"));
 970                 result = cli_init_creds(*cli, "", "", "");
 971                 if (!NT_STATUS_IS_OK(result)) {
 972                         goto done;
 973                 }
 974                 goto session_setup_done;
 975         }
 976
 977         result = cli_nt_error(*cli);
 978
 979         if (NT_STATUS_IS_OK(result))
 980                 result = NT_STATUS_UNSUCCESSFUL;
 981
 982         /* We can't session setup */
 983
 984         goto done;
 985
 986  session_setup_done:
 987
 988         /* cache the server name for later connections */
 989
 990         saf_store( domain->name, (*cli)->desthost );
 991         if (domain->alt_name && (*cli)->use_kerberos) {
 992                 saf_store( domain->alt_name, (*cli)->desthost );
 993         }
 994
 995         winbindd_set_locator_kdc_envs(domain);
 996
 997         result = cli_tcon_andx(*cli, "IPC$", "IPC", "", 0);
 998
 999         if (!NT_STATUS_IS_OK(result)) {
1000                 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
1001                 goto done;
1002         }
1003
1004         TALLOC_FREE(mutex);
1005         *retry = False;
1006
1007         /* set the domain if empty; needed for schannel connections */
1008         if ( !(*cli)->domain[0] ) {
1009                 result = cli_set_domain((*cli), domain->name);
1010                 if (!NT_STATUS_IS_OK(result)) {
1011                         return result;
1012                 }
1013         }
1014
1015         result = NT_STATUS_OK;
1016
1017  done:
1018         TALLOC_FREE(mutex);
1019         SAFE_FREE(machine_account);
1020         SAFE_FREE(machine_password);
1021         SAFE_FREE(machine_krb5_principal);
1022         SAFE_FREE(ipc_username);
1023         SAFE_FREE(ipc_domain);
1024         SAFE_FREE(ipc_password);
1025
1026         if (!NT_STATUS_IS_OK(result)) {
1027                 winbind_add_failed_connection_entry(domain, controller, result);
1028                 if ((*cli) != NULL) {
1029                         cli_shutdown(*cli);
1030                         *cli = NULL;
1031                 }
1032         }
1033
1034         return result;
1035 }
1036
1037 /*******************************************************************
1038  Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1039  array.
1040
1041  Keeps the list unique by not adding duplicate entries.
1042
1043  @param[in] mem_ctx talloc memory context to allocate from
1044  @param[in] domain_name domain of the DC
1045  @param[in] dcname name of the DC to add to the list
1046  @param[in] pss Internet address and port pair to add to the list
1047  @param[in,out] dcs array of dc_name_ip structures to add to
1048  @param[in,out] num_dcs number of dcs returned in the dcs array
1049  @return true if the list was added to, false otherwise
1050 *******************************************************************/
1051
1052 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
1053                               const char *dcname, struct sockaddr_storage *pss,
1054                               struct dc_name_ip **dcs, int *num)
1055 {
1056         int i = 0;
1057
1058         if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1059                 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1060                 return False;
1061         }
1062
1063         /* Make sure there's no duplicates in the list */
1064         for (i=0; i<*num; i++)
1065                 if (sockaddr_equal(
1066                             (struct sockaddr *)(void *)&(*dcs)[i].ss,
1067                             (struct sockaddr *)(void *)pss))
1068                         return False;
1069
1070         *dcs = TALLOC_REALLOC_ARRAY(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1071
1072         if (*dcs == NULL)
1073                 return False;
1074
1075         fstrcpy((*dcs)[*num].name, dcname);
1076         (*dcs)[*num].ss = *pss;
1077         *num += 1;
1078         return True;
1079 }
1080
1081 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
1082                                   struct sockaddr_storage *pss, uint16 port,
1083                                   struct sockaddr_storage **addrs, int *num)
1084 {
1085         *addrs = TALLOC_REALLOC_ARRAY(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1086
1087         if (*addrs == NULL) {
1088                 *num = 0;
1089                 return False;
1090         }
1091
1092         (*addrs)[*num] = *pss;
1093         set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1094
1095         *num += 1;
1096         return True;
1097 }
1098
1099 /*******************************************************************
1100  convert an ip to a name
1101 *******************************************************************/
1102
1103 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
1104                 const struct winbindd_domain *domain,
1105                 struct sockaddr_storage *pss,
1106                 fstring name )
1107 {
1108         struct ip_service ip_list;
1109         uint32_t nt_version = NETLOGON_NT_VERSION_1;
1110         NTSTATUS status;
1111         const char *dc_name;
1112
1113         ip_list.ss = *pss;
1114         ip_list.port = 0;
1115
1116 #ifdef WITH_ADS
1117         /* For active directory servers, try to get the ldap server name.
1118            None of these failures should be considered critical for now */
1119
1120         if (lp_security() == SEC_ADS) {
1121                 ADS_STRUCT *ads;
1122                 ADS_STATUS ads_status;
1123                 char addr[INET6_ADDRSTRLEN];
1124
1125                 print_sockaddr(addr, sizeof(addr), pss);
1126
1127                 ads = ads_init(domain->alt_name, domain->name, addr);
1128                 ads->auth.flags |= ADS_AUTH_NO_BIND;
1129
1130                 ads_status = ads_connect(ads);
1131                 if (ADS_ERR_OK(ads_status)) {
1132                         /* We got a cldap packet. */
1133                         fstrcpy(name, ads->config.ldap_server_name);
1134                         namecache_store(name, 0x20, 1, &ip_list);
1135
1136                         DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1137
1138                         if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1139                                 if (ads_closest_dc(ads)) {
1140                                         char *sitename = sitename_fetch(ads->config.realm);
1141
1142                                         /* We're going to use this KDC for this realm/domain.
1143                                            If we are using sites, then force the krb5 libs
1144                                            to use this KDC. */
1145
1146                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1147                                                                         domain->name,
1148                                                                         sitename,
1149                                                                         pss,
1150                                                                         name);
1151
1152                                         SAFE_FREE(sitename);
1153                                 } else {
1154                                         /* use an off site KDC */
1155                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1156                                                                         domain->name,
1157                                                                         NULL,
1158                                                                         pss,
1159                                                                         name);
1160                                 }
1161                                 winbindd_set_locator_kdc_envs(domain);
1162
1163                                 /* Ensure we contact this DC also. */
1164                                 saf_store( domain->name, name);
1165                                 saf_store( domain->alt_name, name);
1166                         }
1167
1168                         ads_destroy( &ads );
1169                         return True;
1170                 }
1171
1172                 ads_destroy( &ads );
1173         }
1174 #endif
1175
1176         status = nbt_getdc(winbind_messaging_context(), pss, domain->name,
1177                            &domain->sid, nt_version, mem_ctx, &nt_version,
1178                            &dc_name, NULL);
1179         if (NT_STATUS_IS_OK(status)) {
1180                 fstrcpy(name, dc_name);
1181                 namecache_store(name, 0x20, 1, &ip_list);
1182                 return True;
1183         }
1184
1185         /* try node status request */
1186
1187         if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
1188                 namecache_store(name, 0x20, 1, &ip_list);
1189                 return True;
1190         }
1191         return False;
1192 }
1193
1194 /*******************************************************************
1195  Retrieve a list of IP addresses for domain controllers.
1196
1197  The array is sorted in the preferred connection order.
1198
1199  @param[in] mem_ctx talloc memory context to allocate from
1200  @param[in] domain domain to retrieve DCs for
1201  @param[out] dcs array of dcs that will be returned
1202  @param[out] num_dcs number of dcs returned in the dcs array
1203  @return always true
1204 *******************************************************************/
1205
1206 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
1207                     struct dc_name_ip **dcs, int *num_dcs)
1208 {
1209         fstring dcname;
1210         struct  sockaddr_storage ss;
1211         struct  ip_service *ip_list = NULL;
1212         int     iplist_size = 0;
1213         int     i;
1214         bool    is_our_domain;
1215         enum security_types sec = (enum security_types)lp_security();
1216
1217         is_our_domain = strequal(domain->name, lp_workgroup());
1218
1219         /* If not our domain, get the preferred DC, by asking our primary DC */
1220         if ( !is_our_domain
1221                 && get_dc_name_via_netlogon(domain, dcname, &ss)
1222                 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1223                        num_dcs) )
1224         {
1225                 char addr[INET6_ADDRSTRLEN];
1226                 print_sockaddr(addr, sizeof(addr), &ss);
1227                 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1228                            dcname, addr));
1229                 return True;
1230         }
1231
1232         if (sec == SEC_ADS) {
1233                 char *sitename = NULL;
1234
1235                 /* We need to make sure we know the local site before
1236                    doing any DNS queries, as this will restrict the
1237                    get_sorted_dc_list() call below to only fetching
1238                    DNS records for the correct site. */
1239
1240                 /* Find any DC to get the site record.
1241                    We deliberately don't care about the
1242                    return here. */
1243
1244                 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1245
1246                 sitename = sitename_fetch(domain->alt_name);
1247                 if (sitename) {
1248
1249                         /* Do the site-specific AD dns lookup first. */
1250                         get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1251                                &iplist_size, True);
1252
1253                         /* Add ips to the DC array.  We don't look up the name
1254                            of the DC in this function, but we fill in the char*
1255                            of the ip now to make the failed connection cache
1256                            work */
1257                         for ( i=0; i<iplist_size; i++ ) {
1258                                 char addr[INET6_ADDRSTRLEN];
1259                                 print_sockaddr(addr, sizeof(addr),
1260                                                 &ip_list[i].ss);
1261                                 add_one_dc_unique(mem_ctx,
1262                                                 domain->name,
1263                                                 addr,
1264                                                 &ip_list[i].ss,
1265                                                 dcs,
1266                                                 num_dcs);
1267                         }
1268
1269                         SAFE_FREE(ip_list);
1270                         SAFE_FREE(sitename);
1271                         iplist_size = 0;
1272                 }
1273
1274                 /* Now we add DCs from the main AD DNS lookup. */
1275                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1276                         &iplist_size, True);
1277
1278                 for ( i=0; i<iplist_size; i++ ) {
1279                         char addr[INET6_ADDRSTRLEN];
1280                         print_sockaddr(addr, sizeof(addr),
1281                                         &ip_list[i].ss);
1282                         add_one_dc_unique(mem_ctx,
1283                                         domain->name,
1284                                         addr,
1285                                         &ip_list[i].ss,
1286                                         dcs,
1287                                         num_dcs);
1288                 }
1289
1290                 SAFE_FREE(ip_list);
1291                 iplist_size = 0;
1292         }
1293
1294         /* Try standard netbios queries if no ADS */
1295         if (*num_dcs == 0) {
1296                 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1297                        False);
1298
1299                 for ( i=0; i<iplist_size; i++ ) {
1300                         char addr[INET6_ADDRSTRLEN];
1301                         print_sockaddr(addr, sizeof(addr),
1302                                         &ip_list[i].ss);
1303                         add_one_dc_unique(mem_ctx,
1304                                         domain->name,
1305                                         addr,
1306                                         &ip_list[i].ss,
1307                                         dcs,
1308                                         num_dcs);
1309                 }
1310
1311                 SAFE_FREE(ip_list);
1312                 iplist_size = 0;
1313         }
1314
1315         return True;
1316 }
1317
1318 /*******************************************************************
1319  Find and make a connection to a DC in the given domain.
1320
1321  @param[in] mem_ctx talloc memory context to allocate from
1322  @param[in] domain domain to find a dc in
1323  @param[out] dcname NetBIOS or FQDN of DC that's connected to
1324  @param[out] pss DC Internet address and port
1325  @param[out] fd fd of the open socket connected to the newly found dc
1326  @return true when a DC connection is made, false otherwise
1327 *******************************************************************/
1328
1329 static bool find_new_dc(TALLOC_CTX *mem_ctx,
1330                         struct winbindd_domain *domain,
1331                         fstring dcname, struct sockaddr_storage *pss, int *fd)
1332 {
1333         struct dc_name_ip *dcs = NULL;
1334         int num_dcs = 0;
1335
1336         const char **dcnames = NULL;
1337         int num_dcnames = 0;
1338
1339         struct sockaddr_storage *addrs = NULL;
1340         int num_addrs = 0;
1341
1342         int i;
1343         size_t fd_index;
1344
1345         NTSTATUS status;
1346
1347         *fd = -1;
1348
1349  again:
1350         if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1351                 return False;
1352
1353         for (i=0; i<num_dcs; i++) {
1354
1355                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1356                                     &dcnames, &num_dcnames)) {
1357                         return False;
1358                 }
1359                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 445,
1360                                       &addrs, &num_addrs)) {
1361                         return False;
1362                 }
1363         }
1364
1365         if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1366                 return False;
1367
1368         if ((addrs == NULL) || (dcnames == NULL))
1369                 return False;
1370
1371         status = smbsock_any_connect(addrs, dcnames, NULL, NULL, NULL,
1372                                      num_addrs, 0, fd, &fd_index, NULL);
1373         if (!NT_STATUS_IS_OK(status)) {
1374                 for (i=0; i<num_dcs; i++) {
1375                         char ab[INET6_ADDRSTRLEN];
1376                         print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1377                         DEBUG(10, ("find_new_dc: smbsock_any_connect failed for "
1378                                 "domain %s address %s. Error was %s\n",
1379                                    domain->name, ab, nt_errstr(status) ));
1380                         winbind_add_failed_connection_entry(domain,
1381                                 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1382                 }
1383                 return False;
1384         }
1385
1386         *pss = addrs[fd_index];
1387
1388         if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1389                 /* Ok, we've got a name for the DC */
1390                 fstrcpy(dcname, dcnames[fd_index]);
1391                 return True;
1392         }
1393
1394         /* Try to figure out the name */
1395         if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1396                 return True;
1397         }
1398
1399         /* We can not continue without the DC's name */
1400         winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1401                                     NT_STATUS_UNSUCCESSFUL);
1402
1403         /* Throw away all arrays as we're doing this again. */
1404         TALLOC_FREE(dcs);
1405         num_dcs = 0;
1406
1407         TALLOC_FREE(dcnames);
1408         num_dcnames = 0;
1409
1410         TALLOC_FREE(addrs);
1411         num_addrs = 0;
1412
1413         close(*fd);
1414         *fd = -1;
1415
1416         goto again;
1417 }
1418
1419 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
1420                                    struct winbindd_cm_conn *new_conn)
1421 {
1422         TALLOC_CTX *mem_ctx;
1423         NTSTATUS result;
1424         char *saf_servername = saf_fetch( domain->name );
1425         int retries;
1426
1427         if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1428                 SAFE_FREE(saf_servername);
1429                 set_domain_offline(domain);
1430                 return NT_STATUS_NO_MEMORY;
1431         }
1432
1433         /* we have to check the server affinity cache here since
1434            later we select a DC based on response time and not preference */
1435
1436         /* Check the negative connection cache
1437            before talking to it. It going down may have
1438            triggered the reconnection. */
1439
1440         if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1441
1442                 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1443                         saf_servername, domain->name ));
1444
1445                 /* convert an ip address to a name */
1446                 if (is_ipaddress( saf_servername ) ) {
1447                         fstring saf_name;
1448                         struct sockaddr_storage ss;
1449
1450                         if (!interpret_string_addr(&ss, saf_servername,
1451                                                 AI_NUMERICHOST)) {
1452                                 return NT_STATUS_UNSUCCESSFUL;
1453                         }
1454                         if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
1455                                 fstrcpy( domain->dcname, saf_name );
1456                         } else {
1457                                 winbind_add_failed_connection_entry(
1458                                         domain, saf_servername,
1459                                         NT_STATUS_UNSUCCESSFUL);
1460                         }
1461                 } else {
1462                         fstrcpy( domain->dcname, saf_servername );
1463                 }
1464
1465                 SAFE_FREE( saf_servername );
1466         }
1467
1468         for (retries = 0; retries < 3; retries++) {
1469                 int fd = -1;
1470                 bool retry = False;
1471
1472                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1473
1474                 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1475                         domain->dcname, domain->name ));
1476
1477                 if (*domain->dcname
1478                         && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1479                         && (resolve_name(domain->dcname, &domain->dcaddr, 0x20, true)))
1480                 {
1481                         NTSTATUS status;
1482
1483                         status = smbsock_connect(&domain->dcaddr, 0,
1484                                                  NULL, -1, NULL, -1,
1485                                                  &fd, NULL);
1486                         if (!NT_STATUS_IS_OK(status)) {
1487                                 fd = -1;
1488                         }
1489                 }
1490
1491                 if ((fd == -1)
1492                         && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
1493                 {
1494                         /* This is the one place where we will
1495                            set the global winbindd offline state
1496                            to true, if a "WINBINDD_OFFLINE" entry
1497                            is found in the winbindd cache. */
1498                         set_global_winbindd_state_offline();
1499                         break;
1500                 }
1501
1502                 new_conn->cli = NULL;
1503
1504                 result = cm_prepare_connection(domain, fd, domain->dcname,
1505                         &new_conn->cli, &retry);
1506
1507                 if (!retry)
1508                         break;
1509         }
1510
1511         if (NT_STATUS_IS_OK(result)) {
1512
1513                 winbindd_set_locator_kdc_envs(domain);
1514
1515                 if (domain->online == False) {
1516                         /* We're changing state from offline to online. */
1517                         set_global_winbindd_state_online();
1518                 }
1519                 set_domain_online(domain);
1520         } else {
1521                 /* Ensure we setup the retry handler. */
1522                 set_domain_offline(domain);
1523         }
1524
1525         talloc_destroy(mem_ctx);
1526         return result;
1527 }
1528
1529 /* Close down all open pipes on a connection. */
1530
1531 void invalidate_cm_connection(struct winbindd_cm_conn *conn)
1532 {
1533         /* We're closing down a possibly dead
1534            connection. Don't have impossibly long (10s) timeouts. */
1535
1536         if (conn->cli) {
1537                 cli_set_timeout(conn->cli, 1000); /* 1 second. */
1538         }
1539
1540         if (conn->samr_pipe != NULL) {
1541                 if (is_valid_policy_hnd(&conn->sam_connect_handle)) {
1542                         rpccli_samr_Close(conn->samr_pipe, talloc_tos(),
1543                                           &conn->sam_connect_handle);
1544                 }
1545                 TALLOC_FREE(conn->samr_pipe);
1546                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1547                 if (conn->cli) {
1548                         cli_set_timeout(conn->cli, 500);
1549                 }
1550         }
1551
1552         if (conn->lsa_pipe != NULL) {
1553                 if (is_valid_policy_hnd(&conn->lsa_policy)) {
1554                         rpccli_lsa_Close(conn->lsa_pipe, talloc_tos(),
1555                                          &conn->lsa_policy);
1556                 }
1557                 TALLOC_FREE(conn->lsa_pipe);
1558                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1559                 if (conn->cli) {
1560                         cli_set_timeout(conn->cli, 500);
1561                 }
1562         }
1563
1564         if (conn->lsa_pipe_tcp != NULL) {
1565                 if (is_valid_policy_hnd(&conn->lsa_policy)) {
1566                         rpccli_lsa_Close(conn->lsa_pipe, talloc_tos(),
1567                                          &conn->lsa_policy);
1568                 }
1569                 TALLOC_FREE(conn->lsa_pipe_tcp);
1570                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1571                 if (conn->cli) {
1572                         cli_set_timeout(conn->cli, 500);
1573                 }
1574         }
1575
1576         if (conn->netlogon_pipe != NULL) {
1577                 TALLOC_FREE(conn->netlogon_pipe);
1578                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1579                 if (conn->cli) {
1580                         cli_set_timeout(conn->cli, 500);
1581                 }
1582         }
1583
1584         if (conn->cli) {
1585                 cli_shutdown(conn->cli);
1586         }
1587
1588         conn->cli = NULL;
1589 }
1590
1591 void close_conns_after_fork(void)
1592 {
1593         struct winbindd_domain *domain;
1594
1595         for (domain = domain_list(); domain; domain = domain->next) {
1596                 struct cli_state *cli = domain->conn.cli;
1597
1598                 /*
1599                  * first close the low level SMB TCP connection
1600                  * so that we don't generate any SMBclose
1601                  * requests in invalidate_cm_connection()
1602                  */
1603                 if (cli && cli->fd != -1) {
1604                         close(domain->conn.cli->fd);
1605                         domain->conn.cli->fd = -1;
1606                 }
1607
1608                 invalidate_cm_connection(&domain->conn);
1609         }
1610 }
1611
1612 static bool connection_ok(struct winbindd_domain *domain)
1613 {
1614         bool ok;
1615
1616         ok = cli_state_is_connected(domain->conn.cli);
1617         if (!ok) {
1618                 DEBUG(3, ("connection_ok: Connection to %s for domain %s is not connected\n",
1619                           domain->dcname, domain->name));
1620                 return False;
1621         }
1622
1623         if (domain->online == False) {
1624                 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
1625                 return False;
1626         }
1627
1628         return True;
1629 }
1630
1631 /* Initialize a new connection up to the RPC BIND.
1632    Bypass online status check so always does network calls. */
1633
1634 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
1635 {
1636         NTSTATUS result;
1637
1638         /* Internal connections never use the network. */
1639         if (domain->internal) {
1640                 domain->initialized = True;
1641                 return NT_STATUS_OK;
1642         }
1643
1644         if (!winbindd_can_contact_domain(domain)) {
1645                 invalidate_cm_connection(&domain->conn);
1646                 domain->initialized = True;
1647                 return NT_STATUS_OK;
1648         }
1649
1650         if (connection_ok(domain)) {
1651                 if (!domain->initialized) {
1652                         set_dc_type_and_flags(domain);
1653                 }
1654                 return NT_STATUS_OK;
1655         }
1656
1657         invalidate_cm_connection(&domain->conn);
1658
1659         result = cm_open_connection(domain, &domain->conn);
1660
1661         if (NT_STATUS_IS_OK(result) && !domain->initialized) {
1662                 set_dc_type_and_flags(domain);
1663         }
1664
1665         return result;
1666 }
1667
1668 NTSTATUS init_dc_connection(struct winbindd_domain *domain)
1669 {
1670         if (domain->internal) {
1671                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1672         }
1673
1674         if (domain->initialized && !domain->online) {
1675                 /* We check for online status elsewhere. */
1676                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1677         }
1678
1679         return init_dc_connection_network(domain);
1680 }
1681
1682 static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain)
1683 {
1684         NTSTATUS status;
1685
1686         status = init_dc_connection(domain);
1687         if (!NT_STATUS_IS_OK(status)) {
1688                 return status;
1689         }
1690
1691         if (!domain->internal && domain->conn.cli == NULL) {
1692                 /* happens for trusted domains without inbound trust */
1693                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
1694         }
1695
1696         return NT_STATUS_OK;
1697 }
1698
1699 /******************************************************************************
1700  Set the trust flags (direction and forest location) for a domain
1701 ******************************************************************************/
1702
1703 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
1704 {
1705         struct winbindd_domain *our_domain;
1706         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1707         struct netr_DomainTrustList trusts;
1708         int i;
1709         uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
1710                         NETR_TRUST_FLAG_OUTBOUND |
1711                         NETR_TRUST_FLAG_INBOUND);
1712         struct rpc_pipe_client *cli;
1713         TALLOC_CTX *mem_ctx = NULL;
1714
1715         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
1716
1717         /* Our primary domain doesn't need to worry about trust flags.
1718            Force it to go through the network setup */
1719         if ( domain->primary ) {
1720                 return False;
1721         }
1722
1723         our_domain = find_our_domain();
1724
1725         if ( !connection_ok(our_domain) ) {
1726                 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1727                 return False;
1728         }
1729
1730         /* This won't work unless our domain is AD */
1731
1732         if ( !our_domain->active_directory ) {
1733                 return False;
1734         }
1735
1736         /* Use DsEnumerateDomainTrusts to get us the trust direction
1737            and type */
1738
1739         result = cm_connect_netlogon(our_domain, &cli);
1740
1741         if (!NT_STATUS_IS_OK(result)) {
1742                 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1743                           "a connection to %s for PIPE_NETLOGON (%s)\n",
1744                           domain->name, nt_errstr(result)));
1745                 return False;
1746         }
1747
1748         if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
1749                 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1750                 return False;
1751         }
1752
1753         result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1754                                                       cli->desthost,
1755                                                       flags,
1756                                                       &trusts,
1757                                                       NULL);
1758         if (!NT_STATUS_IS_OK(result)) {
1759                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1760                         "failed to query trusted domain list: %s\n",
1761                         nt_errstr(result)));
1762                 talloc_destroy(mem_ctx);
1763                 return false;
1764         }
1765
1766         /* Now find the domain name and get the flags */
1767
1768         for ( i=0; i<trusts.count; i++ ) {
1769                 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
1770                         domain->domain_flags          = trusts.array[i].trust_flags;
1771                         domain->domain_type           = trusts.array[i].trust_type;
1772                         domain->domain_trust_attribs  = trusts.array[i].trust_attributes;
1773
1774                         if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
1775                                 domain->active_directory = True;
1776
1777                         /* This flag is only set if the domain is *our*
1778                            primary domain and the primary domain is in
1779                            native mode */
1780
1781                         domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
1782
1783                         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1784                                   "native mode.\n", domain->name,
1785                                   domain->native_mode ? "" : "NOT "));
1786
1787                         DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1788                                  "running active directory.\n", domain->name,
1789                                  domain->active_directory ? "" : "NOT "));
1790
1791
1792                         domain->initialized = True;
1793
1794                         break;
1795                 }
1796         }
1797
1798         talloc_destroy( mem_ctx );
1799
1800         return domain->initialized;
1801 }
1802
1803 /******************************************************************************
1804  We can 'sense' certain things about the DC by it's replies to certain
1805  questions.
1806
1807  This tells us if this particular remote server is Active Directory, and if it
1808  is native mode.
1809 ******************************************************************************/
1810
1811 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
1812 {
1813         NTSTATUS                result;
1814         WERROR werr;
1815         TALLOC_CTX              *mem_ctx = NULL;
1816         struct rpc_pipe_client  *cli = NULL;
1817         struct policy_handle pol;
1818         union dssetup_DsRoleInfo info;
1819         union lsa_PolicyInformation *lsa_info = NULL;
1820
1821         if (!connection_ok(domain)) {
1822                 return;
1823         }
1824
1825         mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
1826                               domain->name);
1827         if (!mem_ctx) {
1828                 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1829                 return;
1830         }
1831
1832         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
1833
1834         result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1835                                           &ndr_table_dssetup.syntax_id,
1836                                           &cli);
1837
1838         if (!NT_STATUS_IS_OK(result)) {
1839                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1840                           "PI_DSSETUP on domain %s: (%s)\n",
1841                           domain->name, nt_errstr(result)));
1842
1843                 /* if this is just a non-AD domain we need to continue
1844                  * identifying so that we can in the end return with
1845                  * domain->initialized = True - gd */
1846
1847                 goto no_dssetup;
1848         }
1849
1850         result = dcerpc_dssetup_DsRoleGetPrimaryDomainInformation(cli->binding_handle, mem_ctx,
1851                                                                   DS_ROLE_BASIC_INFORMATION,
1852                                                                   &info,
1853                                                                   &werr);
1854         TALLOC_FREE(cli);
1855
1856         if (NT_STATUS_IS_OK(result)) {
1857                 result = werror_to_ntstatus(werr);
1858         }
1859         if (!NT_STATUS_IS_OK(result)) {
1860                 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1861                           "on domain %s failed: (%s)\n",
1862                           domain->name, nt_errstr(result)));
1863
1864                 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1865                  * every opcode on the DSSETUP pipe, continue with
1866                  * no_dssetup mode here as well to get domain->initialized
1867                  * set - gd */
1868
1869                 if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
1870                         goto no_dssetup;
1871                 }
1872
1873                 TALLOC_FREE(mem_ctx);
1874                 return;
1875         }
1876
1877         if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
1878             !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
1879                 domain->native_mode = True;
1880         } else {
1881                 domain->native_mode = False;
1882         }
1883
1884 no_dssetup:
1885         result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1886                                           &ndr_table_lsarpc.syntax_id, &cli);
1887
1888         if (!NT_STATUS_IS_OK(result)) {
1889                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1890                           "PI_LSARPC on domain %s: (%s)\n",
1891                           domain->name, nt_errstr(result)));
1892                 TALLOC_FREE(cli);
1893                 TALLOC_FREE(mem_ctx);
1894                 return;
1895         }
1896
1897         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1898                                          SEC_FLAG_MAXIMUM_ALLOWED, &pol);
1899
1900         if (NT_STATUS_IS_OK(result)) {
1901                 /* This particular query is exactly what Win2k clients use
1902                    to determine that the DC is active directory */
1903                 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
1904                                                      &pol,
1905                                                      LSA_POLICY_INFO_DNS,
1906                                                      &lsa_info);
1907         }
1908
1909         if (NT_STATUS_IS_OK(result)) {
1910                 domain->active_directory = True;
1911
1912                 if (lsa_info->dns.name.string) {
1913                         fstrcpy(domain->name, lsa_info->dns.name.string);
1914                 }
1915
1916                 if (lsa_info->dns.dns_domain.string) {
1917                         fstrcpy(domain->alt_name,
1918                                 lsa_info->dns.dns_domain.string);
1919                 }
1920
1921                 /* See if we can set some domain trust flags about
1922                    ourself */
1923
1924                 if (lsa_info->dns.dns_forest.string) {
1925                         fstrcpy(domain->forest_name,
1926                                 lsa_info->dns.dns_forest.string);
1927
1928                         if (strequal(domain->forest_name, domain->alt_name)) {
1929                                 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
1930                         }
1931                 }
1932
1933                 if (lsa_info->dns.sid) {
1934                         sid_copy(&domain->sid, lsa_info->dns.sid);
1935                 }
1936         } else {
1937                 domain->active_directory = False;
1938
1939                 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
1940                                                 SEC_FLAG_MAXIMUM_ALLOWED,
1941                                                 &pol);
1942
1943                 if (!NT_STATUS_IS_OK(result)) {
1944                         goto done;
1945                 }
1946
1947                 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
1948                                                     &pol,
1949                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1950                                                     &lsa_info);
1951
1952                 if (NT_STATUS_IS_OK(result)) {
1953
1954                         if (lsa_info->account_domain.name.string) {
1955                                 fstrcpy(domain->name,
1956                                         lsa_info->account_domain.name.string);
1957                         }
1958
1959                         if (lsa_info->account_domain.sid) {
1960                                 sid_copy(&domain->sid, lsa_info->account_domain.sid);
1961                         }
1962                 }
1963         }
1964 done:
1965
1966         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
1967                   domain->name, domain->native_mode ? "" : "NOT "));
1968
1969         DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
1970                   domain->name, domain->active_directory ? "" : "NOT "));
1971
1972         domain->can_do_ncacn_ip_tcp = domain->active_directory;
1973
1974         TALLOC_FREE(cli);
1975
1976         TALLOC_FREE(mem_ctx);
1977
1978         domain->initialized = True;
1979 }
1980
1981 /**********************************************************************
1982  Set the domain_flags (trust attributes, domain operating modes, etc...
1983 ***********************************************************************/
1984
1985 static void set_dc_type_and_flags( struct winbindd_domain *domain )
1986 {
1987         /* we always have to contact our primary domain */
1988
1989         if ( domain->primary ) {
1990                 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
1991                           "primary domain\n"));
1992                 set_dc_type_and_flags_connect( domain );
1993                 return;
1994         }
1995
1996         /* Use our DC to get the information if possible */
1997
1998         if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
1999                 /* Otherwise, fallback to contacting the
2000                    domain directly */
2001                 set_dc_type_and_flags_connect( domain );
2002         }
2003
2004         return;
2005 }
2006
2007
2008
2009 /**********************************************************************
2010 ***********************************************************************/
2011
2012 static NTSTATUS cm_get_schannel_creds(struct winbindd_domain *domain,
2013                                    struct netlogon_creds_CredentialState **ppdc)
2014 {
2015         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2016         struct rpc_pipe_client *netlogon_pipe;
2017
2018         if (lp_client_schannel() == False) {
2019                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2020         }
2021
2022         result = cm_connect_netlogon(domain, &netlogon_pipe);
2023         if (!NT_STATUS_IS_OK(result)) {
2024                 return result;
2025         }
2026
2027         /* Return a pointer to the struct netlogon_creds_CredentialState from the
2028            netlogon pipe. */
2029
2030         if (!domain->conn.netlogon_pipe->dc) {
2031                 return NT_STATUS_INTERNAL_ERROR; /* This shouldn't happen. */
2032         }
2033
2034         *ppdc = domain->conn.netlogon_pipe->dc;
2035         return NT_STATUS_OK;
2036 }
2037
2038 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2039                         struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2040 {
2041         struct winbindd_cm_conn *conn;
2042         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2043         struct netlogon_creds_CredentialState *p_creds;
2044         char *machine_password = NULL;
2045         char *machine_account = NULL;
2046         char *domain_name = NULL;
2047
2048         if (sid_check_is_domain(&domain->sid)) {
2049                 return open_internal_samr_conn(mem_ctx, domain, cli, sam_handle);
2050         }
2051
2052         result = init_dc_connection_rpc(domain);
2053         if (!NT_STATUS_IS_OK(result)) {
2054                 return result;
2055         }
2056
2057         conn = &domain->conn;
2058
2059         if (rpccli_is_connected(conn->samr_pipe)) {
2060                 goto done;
2061         }
2062
2063         TALLOC_FREE(conn->samr_pipe);
2064
2065         /*
2066          * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2067          * sign and sealed pipe using the machine account password by
2068          * preference. If we can't - try schannel, if that fails, try
2069          * anonymous.
2070          */
2071
2072         if ((conn->cli->user_name[0] == '\0') ||
2073             (conn->cli->domain[0] == '\0') ||
2074             (conn->cli->password == NULL || conn->cli->password[0] == '\0'))
2075         {
2076                 result = get_trust_creds(domain, &machine_password,
2077                                          &machine_account, NULL);
2078                 if (!NT_STATUS_IS_OK(result)) {
2079                         DEBUG(10, ("cm_connect_sam: No no user available for "
2080                                    "domain %s, trying schannel\n", conn->cli->domain));
2081                         goto schannel;
2082                 }
2083                 domain_name = domain->name;
2084         } else {
2085                 machine_password = SMB_STRDUP(conn->cli->password);
2086                 machine_account = SMB_STRDUP(conn->cli->user_name);
2087                 domain_name = conn->cli->domain;
2088         }
2089
2090         if (!machine_password || !machine_account) {
2091                 result = NT_STATUS_NO_MEMORY;
2092                 goto done;
2093         }
2094
2095         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2096            authenticated SAMR pipe with sign & seal. */
2097         result = cli_rpc_pipe_open_spnego_ntlmssp(conn->cli,
2098                                                   &ndr_table_samr.syntax_id,
2099                                                   NCACN_NP,
2100                                                   DCERPC_AUTH_LEVEL_PRIVACY,
2101                                                   domain_name,
2102                                                   machine_account,
2103                                                   machine_password,
2104                                                   &conn->samr_pipe);
2105
2106         if (!NT_STATUS_IS_OK(result)) {
2107                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2108                           "pipe for domain %s using NTLMSSP "
2109                           "authenticated pipe: user %s\\%s. Error was "
2110                           "%s\n", domain->name, domain_name,
2111                           machine_account, nt_errstr(result)));
2112                 goto schannel;
2113         }
2114
2115         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2116                   "domain %s using NTLMSSP authenticated "
2117                   "pipe: user %s\\%s\n", domain->name,
2118                   domain_name, machine_account));
2119
2120         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2121                                       conn->samr_pipe->desthost,
2122                                       SEC_FLAG_MAXIMUM_ALLOWED,
2123                                       &conn->sam_connect_handle);
2124         if (NT_STATUS_IS_OK(result)) {
2125                 goto open_domain;
2126         }
2127         DEBUG(10,("cm_connect_sam: ntlmssp-sealed rpccli_samr_Connect2 "
2128                   "failed for domain %s, error was %s. Trying schannel\n",
2129                   domain->name, nt_errstr(result) ));
2130         TALLOC_FREE(conn->samr_pipe);
2131
2132  schannel:
2133
2134         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2135
2136         result = cm_get_schannel_creds(domain, &p_creds);
2137         if (!NT_STATUS_IS_OK(result)) {
2138                 /* If this call fails - conn->cli can now be NULL ! */
2139                 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2140                            "for domain %s (error %s), trying anon\n",
2141                         domain->name,
2142                         nt_errstr(result) ));
2143                 goto anonymous;
2144         }
2145         result = cli_rpc_pipe_open_schannel_with_key
2146                 (conn->cli, &ndr_table_samr.syntax_id, NCACN_NP,
2147                  DCERPC_AUTH_LEVEL_PRIVACY,
2148                  domain->name, &p_creds, &conn->samr_pipe);
2149
2150         if (!NT_STATUS_IS_OK(result)) {
2151                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2152                           "domain %s using schannel. Error was %s\n",
2153                           domain->name, nt_errstr(result) ));
2154                 goto anonymous;
2155         }
2156         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2157                   "schannel.\n", domain->name ));
2158
2159         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2160                                       conn->samr_pipe->desthost,
2161                                       SEC_FLAG_MAXIMUM_ALLOWED,
2162                                       &conn->sam_connect_handle);
2163         if (NT_STATUS_IS_OK(result)) {
2164                 goto open_domain;
2165         }
2166         DEBUG(10,("cm_connect_sam: schannel-sealed rpccli_samr_Connect2 failed "
2167                   "for domain %s, error was %s. Trying anonymous\n",
2168                   domain->name, nt_errstr(result) ));
2169         TALLOC_FREE(conn->samr_pipe);
2170
2171  anonymous:
2172
2173         /* Finally fall back to anonymous. */
2174         result = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
2175                                           &conn->samr_pipe);
2176
2177         if (!NT_STATUS_IS_OK(result)) {
2178                 goto done;
2179         }
2180
2181         result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2182                                       conn->samr_pipe->desthost,
2183                                       SEC_FLAG_MAXIMUM_ALLOWED,
2184                                       &conn->sam_connect_handle);
2185         if (!NT_STATUS_IS_OK(result)) {
2186                 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2187                           "for domain %s Error was %s\n",
2188                           domain->name, nt_errstr(result) ));
2189                 goto done;
2190         }
2191
2192  open_domain:
2193         result = rpccli_samr_OpenDomain(conn->samr_pipe,
2194                                         mem_ctx,
2195                                         &conn->sam_connect_handle,
2196                                         SEC_FLAG_MAXIMUM_ALLOWED,
2197                                         &domain->sid,
2198                                         &conn->sam_domain_handle);
2199
2200  done:
2201
2202         if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
2203                 /*
2204                  * if we got access denied, we might just have no access rights
2205                  * to talk to the remote samr server server (e.g. when we are a
2206                  * PDC and we are connecting a w2k8 pdc via an interdomain
2207                  * trust). In that case do not invalidate the whole connection
2208                  * stack
2209                  */
2210                 TALLOC_FREE(conn->samr_pipe);
2211                 ZERO_STRUCT(conn->sam_domain_handle);
2212                 return result;
2213         } else if (!NT_STATUS_IS_OK(result)) {
2214                 invalidate_cm_connection(conn);
2215                 return result;
2216         }
2217
2218         *cli = conn->samr_pipe;
2219         *sam_handle = conn->sam_domain_handle;
2220         SAFE_FREE(machine_password);
2221         SAFE_FREE(machine_account);
2222         return result;
2223 }
2224
2225 /**********************************************************************
2226  open an schanneld ncacn_ip_tcp connection to LSA
2227 ***********************************************************************/
2228
2229 NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
2230                             TALLOC_CTX *mem_ctx,
2231                             struct rpc_pipe_client **cli)
2232 {
2233         struct winbindd_cm_conn *conn;
2234         struct netlogon_creds_CredentialState *creds;
2235         NTSTATUS status;
2236
2237         DEBUG(10,("cm_connect_lsa_tcp\n"));
2238
2239         status = init_dc_connection_rpc(domain);
2240         if (!NT_STATUS_IS_OK(status)) {
2241                 return status;
2242         }
2243
2244         conn = &domain->conn;
2245
2246         if (conn->lsa_pipe_tcp &&
2247             conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2248             conn->lsa_pipe_tcp->auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY &&
2249             rpccli_is_connected(conn->lsa_pipe_tcp)) {
2250                 goto done;
2251         }
2252
2253         TALLOC_FREE(conn->lsa_pipe_tcp);
2254
2255         status = cm_get_schannel_creds(domain, &creds);
2256         if (!NT_STATUS_IS_OK(status)) {
2257                 goto done;
2258         }
2259
2260         status = cli_rpc_pipe_open_schannel_with_key(conn->cli,
2261                                                      &ndr_table_lsarpc.syntax_id,
2262                                                      NCACN_IP_TCP,
2263                                                      DCERPC_AUTH_LEVEL_PRIVACY,
2264                                                      domain->name,
2265                                                      &creds,
2266                                                      &conn->lsa_pipe_tcp);
2267         if (!NT_STATUS_IS_OK(status)) {
2268                 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
2269                         nt_errstr(status)));
2270                 goto done;
2271         }
2272
2273  done:
2274         if (!NT_STATUS_IS_OK(status)) {
2275                 TALLOC_FREE(conn->lsa_pipe_tcp);
2276                 return status;
2277         }
2278
2279         *cli = conn->lsa_pipe_tcp;
2280
2281         return status;
2282 }
2283
2284 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2285                         struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2286 {
2287         struct winbindd_cm_conn *conn;
2288         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2289         struct netlogon_creds_CredentialState *p_creds;
2290
2291         result = init_dc_connection_rpc(domain);
2292         if (!NT_STATUS_IS_OK(result))
2293                 return result;
2294
2295         conn = &domain->conn;
2296
2297         if (rpccli_is_connected(conn->lsa_pipe)) {
2298                 goto done;
2299         }
2300
2301         TALLOC_FREE(conn->lsa_pipe);
2302
2303         if ((conn->cli->user_name[0] == '\0') ||
2304             (conn->cli->domain[0] == '\0') ||
2305             (conn->cli->password == NULL || conn->cli->password[0] == '\0')) {
2306                 DEBUG(10, ("cm_connect_lsa: No no user available for "
2307                            "domain %s, trying schannel\n", conn->cli->domain));
2308                 goto schannel;
2309         }
2310
2311         /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2312          * authenticated LSA pipe with sign & seal. */
2313         result = cli_rpc_pipe_open_spnego_ntlmssp
2314                 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2315                  DCERPC_AUTH_LEVEL_PRIVACY,
2316                  conn->cli->domain, conn->cli->user_name, conn->cli->password,
2317                  &conn->lsa_pipe);
2318
2319         if (!NT_STATUS_IS_OK(result)) {
2320                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2321                           "domain %s using NTLMSSP authenticated pipe: user "
2322                           "%s\\%s. Error was %s. Trying schannel.\n",
2323                           domain->name, conn->cli->domain,
2324                           conn->cli->user_name, nt_errstr(result)));
2325                 goto schannel;
2326         }
2327
2328         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2329                   "NTLMSSP authenticated pipe: user %s\\%s\n",
2330                   domain->name, conn->cli->domain, conn->cli->user_name ));
2331
2332         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2333                                         SEC_FLAG_MAXIMUM_ALLOWED,
2334                                         &conn->lsa_policy);
2335         if (NT_STATUS_IS_OK(result)) {
2336                 goto done;
2337         }
2338
2339         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2340                   "schannel\n"));
2341
2342         TALLOC_FREE(conn->lsa_pipe);
2343
2344  schannel:
2345
2346         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2347
2348         result = cm_get_schannel_creds(domain, &p_creds);
2349         if (!NT_STATUS_IS_OK(result)) {
2350                 /* If this call fails - conn->cli can now be NULL ! */
2351                 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2352                            "for domain %s (error %s), trying anon\n",
2353                         domain->name,
2354                         nt_errstr(result) ));
2355                 goto anonymous;
2356         }
2357         result = cli_rpc_pipe_open_schannel_with_key
2358                 (conn->cli, &ndr_table_lsarpc.syntax_id, NCACN_NP,
2359                  DCERPC_AUTH_LEVEL_PRIVACY,
2360                  domain->name, &p_creds, &conn->lsa_pipe);
2361
2362         if (!NT_STATUS_IS_OK(result)) {
2363                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2364                           "domain %s using schannel. Error was %s\n",
2365                           domain->name, nt_errstr(result) ));
2366                 goto anonymous;
2367         }
2368         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2369                   "schannel.\n", domain->name ));
2370
2371         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2372                                         SEC_FLAG_MAXIMUM_ALLOWED,
2373                                         &conn->lsa_policy);
2374         if (NT_STATUS_IS_OK(result)) {
2375                 goto done;
2376         }
2377
2378         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2379                   "anonymous\n"));
2380
2381         TALLOC_FREE(conn->lsa_pipe);
2382
2383  anonymous:
2384
2385         result = cli_rpc_pipe_open_noauth(conn->cli,
2386                                           &ndr_table_lsarpc.syntax_id,
2387                                           &conn->lsa_pipe);
2388         if (!NT_STATUS_IS_OK(result)) {
2389                 result = NT_STATUS_PIPE_NOT_AVAILABLE;
2390                 goto done;
2391         }
2392
2393         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2394                                         SEC_FLAG_MAXIMUM_ALLOWED,
2395                                         &conn->lsa_policy);
2396  done:
2397         if (!NT_STATUS_IS_OK(result)) {
2398                 invalidate_cm_connection(conn);
2399                 return result;
2400         }
2401
2402         *cli = conn->lsa_pipe;
2403         *lsa_policy = conn->lsa_policy;
2404         return result;
2405 }
2406
2407 /****************************************************************************
2408  Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2409  session key stored in conn->netlogon_pipe->dc->sess_key.
2410 ****************************************************************************/
2411
2412 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
2413                              struct rpc_pipe_client **cli)
2414 {
2415         struct winbindd_cm_conn *conn;
2416         NTSTATUS result;
2417
2418         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
2419         uint8  mach_pwd[16];
2420         enum netr_SchannelType sec_chan_type;
2421         const char *account_name;
2422         struct rpc_pipe_client *netlogon_pipe = NULL;
2423
2424         *cli = NULL;
2425
2426         result = init_dc_connection_rpc(domain);
2427         if (!NT_STATUS_IS_OK(result)) {
2428                 return result;
2429         }
2430
2431         conn = &domain->conn;
2432
2433         if (rpccli_is_connected(conn->netlogon_pipe)) {
2434                 *cli = conn->netlogon_pipe;
2435                 return NT_STATUS_OK;
2436         }
2437
2438         TALLOC_FREE(conn->netlogon_pipe);
2439
2440         result = cli_rpc_pipe_open_noauth(conn->cli,
2441                                           &ndr_table_netlogon.syntax_id,
2442                                           &netlogon_pipe);
2443         if (!NT_STATUS_IS_OK(result)) {
2444                 return result;
2445         }
2446
2447         if ((!IS_DC) && (!domain->primary)) {
2448                 /* Clear the schannel request bit and drop down */
2449                 neg_flags &= ~NETLOGON_NEG_SCHANNEL;
2450                 goto no_schannel;
2451         }
2452
2453         if (lp_client_schannel() != False) {
2454                 neg_flags |= NETLOGON_NEG_SCHANNEL;
2455         }
2456
2457         if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
2458                                &sec_chan_type))
2459         {
2460                 TALLOC_FREE(netlogon_pipe);
2461                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2462         }
2463
2464         result = rpccli_netlogon_setup_creds(
2465                  netlogon_pipe,
2466                  domain->dcname, /* server name. */
2467                  domain->name,   /* domain name */
2468                  global_myname(), /* client name */
2469                  account_name,   /* machine account */
2470                  mach_pwd,       /* machine password */
2471                  sec_chan_type,  /* from get_trust_pw */
2472                  &neg_flags);
2473
2474         if (!NT_STATUS_IS_OK(result)) {
2475                 TALLOC_FREE(netlogon_pipe);
2476                 return result;
2477         }
2478
2479         if ((lp_client_schannel() == True) &&
2480                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2481                 DEBUG(3, ("Server did not offer schannel\n"));
2482                 TALLOC_FREE(netlogon_pipe);
2483                 return NT_STATUS_ACCESS_DENIED;
2484         }
2485
2486  no_schannel:
2487         if ((lp_client_schannel() == False) ||
2488                         ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2489                 /*
2490                  * NetSamLogonEx only works for schannel
2491                  */
2492                 domain->can_do_samlogon_ex = False;
2493
2494                 /* We're done - just keep the existing connection to NETLOGON
2495                  * open */
2496                 conn->netlogon_pipe = netlogon_pipe;
2497                 *cli = conn->netlogon_pipe;
2498                 return NT_STATUS_OK;
2499         }
2500
2501         /* Using the credentials from the first pipe, open a signed and sealed
2502            second netlogon pipe. The session key is stored in the schannel
2503            part of the new pipe auth struct.
2504         */
2505
2506         result = cli_rpc_pipe_open_schannel_with_key(
2507                 conn->cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
2508                 DCERPC_AUTH_LEVEL_PRIVACY, domain->name, &netlogon_pipe->dc,
2509                 &conn->netlogon_pipe);
2510
2511         /* We can now close the initial netlogon pipe. */
2512         TALLOC_FREE(netlogon_pipe);
2513
2514         if (!NT_STATUS_IS_OK(result)) {
2515                 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2516                           "was %s\n", nt_errstr(result)));
2517
2518                 invalidate_cm_connection(conn);
2519                 return result;
2520         }
2521
2522         /*
2523          * Always try netr_LogonSamLogonEx. We will fall back for NT4
2524          * which gives DCERPC_FAULT_OP_RNG_ERROR (function not
2525          * supported). We used to only try SamLogonEx for AD, but
2526          * Samba DCs can also do it. And because we don't distinguish
2527          * between Samba and NT4, always try it once.
2528          */
2529         domain->can_do_samlogon_ex = true;
2530
2531         *cli = conn->netlogon_pipe;
2532         return NT_STATUS_OK;
2533 }
2534
2535 void winbind_msg_ip_dropped(struct messaging_context *msg_ctx,
2536                             void *private_data,
2537                             uint32_t msg_type,
2538                             struct server_id server_id,
2539                             DATA_BLOB *data)
2540 {
2541         struct winbindd_domain *domain;
2542
2543         if ((data == NULL)
2544             || (data->data == NULL)
2545             || (data->length == 0)
2546             || (data->data[data->length-1] != '\0')
2547             || !is_ipaddress((char *)data->data)) {
2548                 DEBUG(1, ("invalid msg_ip_dropped message\n"));
2549                 return;
2550         }
2551         for (domain = domain_list(); domain != NULL; domain = domain->next) {
2552                 char sockaddr[INET6_ADDRSTRLEN];
2553                 if (domain->conn.cli == NULL) {
2554                         continue;
2555                 }
2556                 if (domain->conn.cli->fd == -1) {
2557                         continue;
2558                 }
2559                 client_socket_addr(domain->conn.cli->fd, sockaddr,
2560                                    sizeof(sockaddr));
2561                 if (strequal(sockaddr, (char *)data->data)) {
2562                         close(domain->conn.cli->fd);
2563                         domain->conn.cli->fd = -1;
2564                 }
2565         }
2566 }