2 Unix SMB/CIFS implementation.
4 Winbind daemon connection manager
6 Copyright (C) Tim Potter 2001
7 Copyright (C) Andrew Bartlett 2002
8 Copyright (C) Gerald (Jerry) Carter 2003-2005.
9 Copyright (C) Volker Lendecke 2004-2005
10 Copyright (C) Jeremy Allison 2006
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 We need to manage connections to domain controllers without having to
28 mess up the main winbindd code with other issues. The aim of the
29 connection manager is to:
31 - make connections to domain controllers and cache them
32 - re-establish connections when networks or servers go down
33 - centralise the policy on connection timeouts, domain controller
35 - manage re-entrancy for when winbindd becomes able to handle
36 multiple outstanding rpc requests
38 Why not have connection management as part of the rpc layer like tng?
39 Good question. This code may morph into libsmb/rpc_cache.c or something
40 like that but at the moment it's simply staying as part of winbind. I
41 think the TNG architecture of forcing every user of the rpc layer to use
42 the connection caching system is a bad idea. It should be an optional
43 method of using the routines.
45 The TNG design is quite good but I disagree with some aspects of the
53 - I'm pretty annoyed by all the make_nmb_name() stuff. It should be
54 moved down into another function.
56 - Take care when destroying cli_structs as they can be shared between
63 #include "../libcli/auth/libcli_auth.h"
64 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
65 #include "rpc_client/cli_pipe.h"
66 #include "rpc_client/cli_netlogon.h"
67 #include "../librpc/gen_ndr/ndr_samr_c.h"
68 #include "../librpc/gen_ndr/ndr_lsa_c.h"
69 #include "rpc_client/cli_lsarpc.h"
70 #include "../librpc/gen_ndr/ndr_dssetup_c.h"
71 #include "libads/sitename_cache.h"
72 #include "libsmb/libsmb.h"
73 #include "libsmb/clidgram.h"
76 #include "../libcli/security/security.h"
79 #include "auth/gensec/gensec.h"
80 #include "../libcli/smb/smbXcli_base.h"
81 #include "lib/param/loadparm.h"
84 #define DBGC_CLASS DBGC_WINBIND
88 struct sockaddr_storage ss
;
91 extern struct winbindd_methods reconnect_methods
;
92 extern bool override_logfile
;
94 static NTSTATUS
init_dc_connection_network(struct winbindd_domain
*domain
);
95 static void set_dc_type_and_flags( struct winbindd_domain
*domain
);
96 static bool get_dcs(TALLOC_CTX
*mem_ctx
, struct winbindd_domain
*domain
,
97 struct dc_name_ip
**dcs
, int *num_dcs
);
99 /****************************************************************
100 Child failed to find DC's. Reschedule check.
101 ****************************************************************/
103 static void msg_failed_to_go_online(struct messaging_context
*msg
,
106 struct server_id server_id
,
109 struct winbindd_domain
*domain
;
110 const char *domainname
= (const char *)data
->data
;
112 if (data
->data
== NULL
|| data
->length
== 0) {
116 DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname
));
118 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
119 if (domain
->internal
) {
123 if (strequal(domain
->name
, domainname
)) {
124 if (domain
->online
) {
125 /* We're already online, ignore. */
126 DEBUG(5,("msg_fail_to_go_online: domain %s "
127 "already online.\n", domainname
));
131 /* Reschedule the online check. */
132 set_domain_offline(domain
);
138 /****************************************************************
139 Actually cause a reconnect from a message.
140 ****************************************************************/
142 static void msg_try_to_go_online(struct messaging_context
*msg
,
145 struct server_id server_id
,
148 struct winbindd_domain
*domain
;
149 const char *domainname
= (const char *)data
->data
;
151 if (data
->data
== NULL
|| data
->length
== 0) {
155 DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname
));
157 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
158 if (domain
->internal
) {
162 if (strequal(domain
->name
, domainname
)) {
164 if (domain
->online
) {
165 /* We're already online, ignore. */
166 DEBUG(5,("msg_try_to_go_online: domain %s "
167 "already online.\n", domainname
));
171 /* This call takes care of setting the online
172 flag to true if we connected, or re-adding
173 the offline handler if false. Bypasses online
174 check so always does network calls. */
176 init_dc_connection_network(domain
);
182 /****************************************************************
183 Fork a child to try and contact a DC. Do this as contacting a
184 DC requires blocking lookups and we don't want to block our
186 ****************************************************************/
188 static bool fork_child_dc_connect(struct winbindd_domain
*domain
)
190 struct dc_name_ip
*dcs
= NULL
;
192 TALLOC_CTX
*mem_ctx
= NULL
;
193 pid_t parent_pid
= getpid();
197 if (domain
->dc_probe_pid
!= (pid_t
)-1) {
199 * We might already have a DC probe
200 * child working, check.
202 if (process_exists_by_pid(domain
->dc_probe_pid
)) {
203 DEBUG(10,("fork_child_dc_connect: pid %u already "
204 "checking for DC's.\n",
205 (unsigned int)domain
->dc_probe_pid
));
208 domain
->dc_probe_pid
= (pid_t
)-1;
211 domain
->dc_probe_pid
= fork();
213 if (domain
->dc_probe_pid
== (pid_t
)-1) {
214 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno
)));
218 if (domain
->dc_probe_pid
!= (pid_t
)0) {
220 messaging_register(winbind_messaging_context(), NULL
,
221 MSG_WINBIND_TRY_TO_GO_ONLINE
,
222 msg_try_to_go_online
);
223 messaging_register(winbind_messaging_context(), NULL
,
224 MSG_WINBIND_FAILED_TO_GO_ONLINE
,
225 msg_failed_to_go_online
);
231 /* Leave messages blocked - we will never process one. */
233 if (!override_logfile
) {
234 if (asprintf(&lfile
, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
235 DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
240 status
= winbindd_reinit_after_fork(NULL
, lfile
);
241 if (!NT_STATUS_IS_OK(status
)) {
242 DEBUG(1, ("winbindd_reinit_after_fork failed: %s\n",
244 messaging_send_buf(winbind_messaging_context(),
245 pid_to_procid(parent_pid
),
246 MSG_WINBIND_FAILED_TO_GO_ONLINE
,
247 (const uint8_t *)domain
->name
,
248 strlen(domain
->name
)+1);
253 mem_ctx
= talloc_init("fork_child_dc_connect");
255 DEBUG(0,("talloc_init failed.\n"));
256 messaging_send_buf(winbind_messaging_context(),
257 pid_to_procid(parent_pid
),
258 MSG_WINBIND_FAILED_TO_GO_ONLINE
,
259 (const uint8_t *)domain
->name
,
260 strlen(domain
->name
)+1);
264 if ((!get_dcs(mem_ctx
, domain
, &dcs
, &num_dcs
)) || (num_dcs
== 0)) {
265 /* Still offline ? Can't find DC's. */
266 messaging_send_buf(winbind_messaging_context(),
267 pid_to_procid(parent_pid
),
268 MSG_WINBIND_FAILED_TO_GO_ONLINE
,
269 (const uint8_t *)domain
->name
,
270 strlen(domain
->name
)+1);
274 /* We got a DC. Send a message to our parent to get it to
275 try and do the same. */
277 messaging_send_buf(winbind_messaging_context(),
278 pid_to_procid(parent_pid
),
279 MSG_WINBIND_TRY_TO_GO_ONLINE
,
280 (const uint8_t *)domain
->name
,
281 strlen(domain
->name
)+1);
285 /****************************************************************
286 Handler triggered if we're offline to try and detect a DC.
287 ****************************************************************/
289 static void check_domain_online_handler(struct tevent_context
*ctx
,
290 struct tevent_timer
*te
,
294 struct winbindd_domain
*domain
=
295 (struct winbindd_domain
*)private_data
;
297 DEBUG(10,("check_domain_online_handler: called for domain "
298 "%s (online = %s)\n", domain
->name
,
299 domain
->online
? "True" : "False" ));
301 TALLOC_FREE(domain
->check_online_event
);
303 /* Are we still in "startup" mode ? */
305 if (domain
->startup
&& (time_mono(NULL
) > domain
->startup_time
+ 30)) {
306 /* No longer in "startup" mode. */
307 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
309 domain
->startup
= False
;
312 /* We've been told to stay offline, so stay
315 if (get_global_winbindd_state_offline()) {
316 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
321 /* Fork a child to test if it can contact a DC.
322 If it can then send ourselves a message to
323 cause a reconnect. */
325 fork_child_dc_connect(domain
);
328 /****************************************************************
329 If we're still offline setup the timeout check.
330 ****************************************************************/
332 static void calc_new_online_timeout_check(struct winbindd_domain
*domain
)
334 int wbr
= lp_winbind_reconnect_delay();
336 if (domain
->startup
) {
337 domain
->check_online_timeout
= 10;
338 } else if (domain
->check_online_timeout
< wbr
) {
339 domain
->check_online_timeout
= wbr
;
343 void winbind_msg_domain_offline(struct messaging_context
*msg_ctx
,
346 struct server_id server_id
,
349 const char *domain_name
= (const char *)data
->data
;
350 struct winbindd_domain
*domain
;
352 domain
= find_domain_from_name_noinit(domain_name
);
353 if (domain
== NULL
) {
357 domain
->online
= false;
359 DEBUG(10, ("Domain %s is marked as offline now.\n",
363 void winbind_msg_domain_online(struct messaging_context
*msg_ctx
,
366 struct server_id server_id
,
369 const char *domain_name
= (const char *)data
->data
;
370 struct winbindd_domain
*domain
;
372 domain
= find_domain_from_name_noinit(domain_name
);
373 if (domain
== NULL
) {
377 domain
->online
= true;
379 DEBUG(10, ("Domain %s is marked as online now.\n",
383 /****************************************************************
384 Set domain offline and also add handler to put us back online
386 ****************************************************************/
388 void set_domain_offline(struct winbindd_domain
*domain
)
390 pid_t parent_pid
= getppid();
392 DEBUG(10,("set_domain_offline: called for domain %s\n",
395 TALLOC_FREE(domain
->check_online_event
);
397 if (domain
->internal
) {
398 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
403 domain
->online
= False
;
405 /* Offline domains are always initialized. They're
406 re-initialized when they go back online. */
408 domain
->initialized
= True
;
410 /* We only add the timeout handler that checks and
411 allows us to go back online when we've not
412 been told to remain offline. */
414 if (get_global_winbindd_state_offline()) {
415 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
420 /* If we're in startup mode, check again in 10 seconds, not in
421 lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
423 calc_new_online_timeout_check(domain
);
425 domain
->check_online_event
= tevent_add_timer(winbind_event_context(),
427 timeval_current_ofs(domain
->check_online_timeout
,0),
428 check_domain_online_handler
,
431 /* The above *has* to succeed for winbindd to work. */
432 if (!domain
->check_online_event
) {
433 smb_panic("set_domain_offline: failed to add online handler");
436 DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
439 /* Send a message to the parent that the domain is offline. */
440 if (parent_pid
> 1 && !domain
->internal
) {
441 messaging_send_buf(winbind_messaging_context(),
442 pid_to_procid(parent_pid
),
443 MSG_WINBIND_DOMAIN_OFFLINE
,
444 (uint8
*)domain
->name
,
445 strlen(domain
->name
) + 1);
448 /* Send an offline message to the idmap child when our
449 primary domain goes offline */
451 if ( domain
->primary
) {
452 struct winbindd_child
*idmap
= idmap_child();
454 if ( idmap
->pid
!= 0 ) {
455 messaging_send_buf(winbind_messaging_context(),
456 pid_to_procid(idmap
->pid
),
458 (const uint8_t *)domain
->name
,
459 strlen(domain
->name
)+1);
466 /****************************************************************
467 Set domain online - if allowed.
468 ****************************************************************/
470 static void set_domain_online(struct winbindd_domain
*domain
)
472 pid_t parent_pid
= getppid();
474 DEBUG(10,("set_domain_online: called for domain %s\n",
477 if (domain
->internal
) {
478 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
483 if (get_global_winbindd_state_offline()) {
484 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
489 winbindd_set_locator_kdc_envs(domain
);
491 /* If we are waiting to get a krb5 ticket, trigger immediately. */
492 ccache_regain_all_now();
494 /* Ok, we're out of any startup mode now... */
495 domain
->startup
= False
;
497 if (domain
->online
== False
) {
498 /* We were offline - now we're online. We default to
499 using the MS-RPC backend if we started offline,
500 and if we're going online for the first time we
501 should really re-initialize the backends and the
502 checks to see if we're talking to an AD or NT domain.
505 domain
->initialized
= False
;
507 /* 'reconnect_methods' is the MS-RPC backend. */
508 if (domain
->backend
== &reconnect_methods
) {
509 domain
->backend
= NULL
;
513 /* Ensure we have no online timeout checks. */
514 domain
->check_online_timeout
= 0;
515 TALLOC_FREE(domain
->check_online_event
);
517 /* Ensure we ignore any pending child messages. */
518 messaging_deregister(winbind_messaging_context(),
519 MSG_WINBIND_TRY_TO_GO_ONLINE
, NULL
);
520 messaging_deregister(winbind_messaging_context(),
521 MSG_WINBIND_FAILED_TO_GO_ONLINE
, NULL
);
523 domain
->online
= True
;
525 /* Send a message to the parent that the domain is online. */
526 if (parent_pid
> 1 && !domain
->internal
) {
527 messaging_send_buf(winbind_messaging_context(),
528 pid_to_procid(parent_pid
),
529 MSG_WINBIND_DOMAIN_ONLINE
,
530 (uint8
*)domain
->name
,
531 strlen(domain
->name
) + 1);
534 /* Send an online message to the idmap child when our
535 primary domain comes online */
537 if ( domain
->primary
) {
538 struct winbindd_child
*idmap
= idmap_child();
540 if ( idmap
->pid
!= 0 ) {
541 messaging_send_buf(winbind_messaging_context(),
542 pid_to_procid(idmap
->pid
),
544 (const uint8_t *)domain
->name
,
545 strlen(domain
->name
)+1);
552 /****************************************************************
553 Requested to set a domain online.
554 ****************************************************************/
556 void set_domain_online_request(struct winbindd_domain
*domain
)
560 DEBUG(10,("set_domain_online_request: called for domain %s\n",
563 if (get_global_winbindd_state_offline()) {
564 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
569 if (domain
->internal
) {
570 DEBUG(10, ("set_domain_online_request: Internal domains are "
575 /* We've been told it's safe to go online and
576 try and connect to a DC. But I don't believe it
577 because network manager seems to lie.
578 Wait at least 5 seconds. Heuristics suck... */
583 /* Go into "startup" mode again. */
584 domain
->startup_time
= time_mono(NULL
);
585 domain
->startup
= True
;
589 if (!domain
->check_online_event
) {
590 /* If we've come from being globally offline we
591 don't have a check online event handler set.
592 We need to add one now we're trying to go
595 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
599 TALLOC_FREE(domain
->check_online_event
);
601 domain
->check_online_event
= tevent_add_timer(winbind_event_context(),
604 check_domain_online_handler
,
607 /* The above *has* to succeed for winbindd to work. */
608 if (!domain
->check_online_event
) {
609 smb_panic("set_domain_online_request: failed to add online handler");
613 /****************************************************************
614 Add -ve connection cache entries for domain and realm.
615 ****************************************************************/
617 static void winbind_add_failed_connection_entry(
618 const struct winbindd_domain
*domain
,
622 add_failed_connection_entry(domain
->name
, server
, result
);
623 /* If this was the saf name for the last thing we talked to,
625 saf_delete(domain
->name
);
626 if (domain
->alt_name
!= NULL
) {
627 add_failed_connection_entry(domain
->alt_name
, server
, result
);
628 saf_delete(domain
->alt_name
);
630 winbindd_unset_locator_kdc_env(domain
);
633 /* Choose between anonymous or authenticated connections. We need to use
634 an authenticated connection if DCs have the RestrictAnonymous registry
635 entry set > 0, or the "Additional restrictions for anonymous
636 connections" set in the win2k Local Security Policy.
638 Caller to free() result in domain, username, password
641 static void cm_get_ipc_userpass(char **username
, char **domain
, char **password
)
643 *username
= (char *)secrets_fetch(SECRETS_AUTH_USER
, NULL
);
644 *domain
= (char *)secrets_fetch(SECRETS_AUTH_DOMAIN
, NULL
);
645 *password
= (char *)secrets_fetch(SECRETS_AUTH_PASSWORD
, NULL
);
647 if (*username
&& **username
) {
649 if (!*domain
|| !**domain
)
650 *domain
= smb_xstrdup(lp_workgroup());
652 if (!*password
|| !**password
)
653 *password
= smb_xstrdup("");
655 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
656 *domain
, *username
));
659 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
660 *username
= smb_xstrdup("");
661 *domain
= smb_xstrdup("");
662 *password
= smb_xstrdup("");
666 static bool get_dc_name_via_netlogon(struct winbindd_domain
*domain
,
668 struct sockaddr_storage
*dc_ss
)
670 struct winbindd_domain
*our_domain
= NULL
;
671 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
675 unsigned int orig_timeout
;
676 const char *tmp
= NULL
;
678 struct dcerpc_binding_handle
*b
;
680 /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
687 if (domain
->primary
) {
691 our_domain
= find_our_domain();
693 if ((mem_ctx
= talloc_init("get_dc_name_via_netlogon")) == NULL
) {
697 result
= cm_connect_netlogon(our_domain
, &netlogon_pipe
);
698 if (!NT_STATUS_IS_OK(result
)) {
699 talloc_destroy(mem_ctx
);
703 b
= netlogon_pipe
->binding_handle
;
705 /* This call can take a long time - allow the server to time out.
706 35 seconds should do it. */
708 orig_timeout
= rpccli_set_timeout(netlogon_pipe
, 35000);
710 if (our_domain
->active_directory
) {
711 struct netr_DsRGetDCNameInfo
*domain_info
= NULL
;
713 result
= dcerpc_netr_DsRGetDCName(b
,
722 if (NT_STATUS_IS_OK(result
) && W_ERROR_IS_OK(werr
)) {
724 mem_ctx
, domain_info
->dc_unc
);
726 DEBUG(0, ("talloc_strdup failed\n"));
727 talloc_destroy(mem_ctx
);
730 if (domain
->alt_name
== NULL
) {
731 domain
->alt_name
= talloc_strdup(domain
,
732 domain_info
->domain_name
);
733 if (domain
->alt_name
== NULL
) {
734 DEBUG(0, ("talloc_strdup failed\n"));
735 talloc_destroy(mem_ctx
);
739 if (domain
->forest_name
== NULL
) {
740 domain
->forest_name
= talloc_strdup(domain
,
741 domain_info
->forest_name
);
742 if (domain
->forest_name
== NULL
) {
743 DEBUG(0, ("talloc_strdup failed\n"));
744 talloc_destroy(mem_ctx
);
750 result
= dcerpc_netr_GetAnyDCName(b
, mem_ctx
,
757 /* And restore our original timeout. */
758 rpccli_set_timeout(netlogon_pipe
, orig_timeout
);
760 if (!NT_STATUS_IS_OK(result
)) {
761 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
763 talloc_destroy(mem_ctx
);
767 if (!W_ERROR_IS_OK(werr
)) {
768 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
770 talloc_destroy(mem_ctx
);
774 /* dcerpc_netr_GetAnyDCName gives us a name with \\ */
775 p
= strip_hostname(tmp
);
779 talloc_destroy(mem_ctx
);
781 DEBUG(10,("dcerpc_netr_GetAnyDCName returned %s\n", dcname
));
783 if (!resolve_name(dcname
, dc_ss
, 0x20, true)) {
791 * Helper function to assemble trust password and account name
793 static NTSTATUS
get_trust_creds(const struct winbindd_domain
*domain
,
794 char **machine_password
,
795 char **machine_account
,
796 char **machine_krb5_principal
)
798 const char *account_name
;
799 const char *name
= NULL
;
801 /* If we are a DC and this is not our own domain */
806 struct winbindd_domain
*our_domain
= find_our_domain();
809 return NT_STATUS_INVALID_SERVER_STATE
;
811 name
= our_domain
->name
;
814 if (!get_trust_pw_clear(name
, machine_password
,
815 &account_name
, NULL
))
817 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
820 if ((machine_account
!= NULL
) &&
821 (asprintf(machine_account
, "%s$", account_name
) == -1))
823 return NT_STATUS_NO_MEMORY
;
826 /* For now assume our machine account only exists in our domain */
828 if (machine_krb5_principal
!= NULL
)
830 struct winbindd_domain
*our_domain
= find_our_domain();
833 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
836 if (asprintf(machine_krb5_principal
, "%s$@%s",
837 account_name
, our_domain
->alt_name
) == -1)
839 return NT_STATUS_NO_MEMORY
;
842 if (!strupper_m(*machine_krb5_principal
)) {
843 SAFE_FREE(*machine_krb5_principal
);
844 return NT_STATUS_INVALID_PARAMETER
;
851 /************************************************************************
852 Given a fd with a just-connected TCP connection to a DC, open a connection
854 ************************************************************************/
856 static NTSTATUS
cm_prepare_connection(const struct winbindd_domain
*domain
,
858 const char *controller
,
859 struct cli_state
**cli
,
862 bool try_spnego
= false;
863 bool try_ipc_auth
= false;
864 char *machine_password
= NULL
;
865 char *machine_krb5_principal
= NULL
;
866 char *machine_account
= NULL
;
867 char *ipc_username
= NULL
;
868 char *ipc_domain
= NULL
;
869 char *ipc_password
= NULL
;
871 uint16_t sec_mode
= 0;
873 struct named_mutex
*mutex
;
875 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
877 DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
878 controller
, domain
->name
));
882 mutex
= grab_named_mutex(talloc_tos(), controller
,
883 WINBIND_SERVER_MUTEX_WAIT_TIME
);
886 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
888 result
= NT_STATUS_POSSIBLE_DEADLOCK
;
892 flags
|= CLI_FULL_CONNECTION_USE_KERBEROS
;
894 *cli
= cli_state_create(NULL
, sockfd
,
895 controller
, domain
->alt_name
,
896 SMB_SIGNING_DEFAULT
, flags
);
899 DEBUG(1, ("Could not cli_initialize\n"));
900 result
= NT_STATUS_NO_MEMORY
;
904 cli_set_timeout(*cli
, 10000); /* 10 seconds */
906 result
= smbXcli_negprot((*cli
)->conn
, (*cli
)->timeout
,
907 lp_cli_minprotocol(),
908 lp_cli_maxprotocol());
910 if (!NT_STATUS_IS_OK(result
)) {
911 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result
)));
915 if (smbXcli_conn_protocol((*cli
)->conn
) >= PROTOCOL_NT1
&&
916 smb1cli_conn_capabilities((*cli
)->conn
) & CAP_EXTENDED_SECURITY
) {
918 } else if (smbXcli_conn_protocol((*cli
)->conn
) >= PROTOCOL_SMB2_02
) {
922 if (!is_dc_trusted_domain_situation(domain
->name
) && try_spnego
) {
923 result
= get_trust_creds(domain
, &machine_password
,
925 &machine_krb5_principal
);
926 if (!NT_STATUS_IS_OK(result
)) {
930 if (lp_security() == SEC_ADS
) {
932 /* Try a krb5 session */
934 (*cli
)->use_kerberos
= True
;
935 DEBUG(5, ("connecting to %s from %s with kerberos principal "
936 "[%s] and realm [%s]\n", controller
, lp_netbios_name(),
937 machine_krb5_principal
, domain
->alt_name
));
939 winbindd_set_locator_kdc_envs(domain
);
941 result
= cli_session_setup(*cli
,
942 machine_krb5_principal
,
944 strlen(machine_password
)+1,
946 strlen(machine_password
)+1,
949 if (!NT_STATUS_IS_OK(result
)) {
950 DEBUG(4,("failed kerberos session setup with %s\n",
954 if (NT_STATUS_IS_OK(result
)) {
955 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
956 result
= cli_init_creds(*cli
, machine_account
, lp_workgroup(), machine_password
);
957 if (!NT_STATUS_IS_OK(result
)) {
960 goto session_setup_done
;
964 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
965 (*cli
)->use_kerberos
= False
;
967 DEBUG(5, ("connecting to %s from %s with username "
968 "[%s]\\[%s]\n", controller
, lp_netbios_name(),
969 lp_workgroup(), machine_account
));
971 result
= cli_session_setup(*cli
,
974 strlen(machine_password
)+1,
976 strlen(machine_password
)+1,
978 if (!NT_STATUS_IS_OK(result
)) {
979 DEBUG(4, ("authenticated session setup failed with %s\n",
983 if (NT_STATUS_IS_OK(result
)) {
984 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
985 result
= cli_init_creds(*cli
, machine_account
, lp_workgroup(), machine_password
);
986 if (!NT_STATUS_IS_OK(result
)) {
989 goto session_setup_done
;
993 /* Fall back to non-kerberos session setup with auth_user */
995 (*cli
)->use_kerberos
= False
;
997 cm_get_ipc_userpass(&ipc_username
, &ipc_domain
, &ipc_password
);
999 sec_mode
= smb1cli_conn_server_security_mode((*cli
)->conn
);
1001 try_ipc_auth
= false;
1003 try_ipc_auth
= true;
1004 } else if (sec_mode
& NEGOTIATE_SECURITY_CHALLENGE_RESPONSE
) {
1005 try_ipc_auth
= true;
1008 if (try_ipc_auth
&& (strlen(ipc_username
) > 0)) {
1010 /* Only try authenticated if we have a username */
1012 DEBUG(5, ("connecting to %s from %s with username "
1013 "[%s]\\[%s]\n", controller
, lp_netbios_name(),
1014 ipc_domain
, ipc_username
));
1016 if (NT_STATUS_IS_OK(cli_session_setup(
1018 ipc_password
, strlen(ipc_password
)+1,
1019 ipc_password
, strlen(ipc_password
)+1,
1021 /* Successful logon with given username. */
1022 result
= cli_init_creds(*cli
, ipc_username
, ipc_domain
, ipc_password
);
1023 if (!NT_STATUS_IS_OK(result
)) {
1026 goto session_setup_done
;
1028 DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
1029 ipc_domain
, ipc_username
));
1035 /* Fall back to anonymous connection, this might fail later */
1036 DEBUG(10,("cm_prepare_connection: falling back to anonymous "
1037 "connection for DC %s\n",
1040 result
= cli_session_setup(*cli
, "", NULL
, 0, NULL
, 0, "");
1041 if (NT_STATUS_IS_OK(result
)) {
1042 DEBUG(5, ("Connected anonymously\n"));
1043 result
= cli_init_creds(*cli
, "", "", "");
1044 if (!NT_STATUS_IS_OK(result
)) {
1047 goto session_setup_done
;
1050 /* We can't session setup */
1056 * This should be a short term hack until
1057 * dynamic re-authentication is implemented.
1059 * See Bug 9175 - winbindd doesn't recover from
1060 * NT_STATUS_NETWORK_SESSION_EXPIRED
1062 if (smbXcli_conn_protocol((*cli
)->conn
) >= PROTOCOL_SMB2_02
) {
1063 smbXcli_session_set_disconnect_expired((*cli
)->smb2
.session
);
1066 /* cache the server name for later connections */
1068 saf_store(domain
->name
, controller
);
1069 if (domain
->alt_name
&& (*cli
)->use_kerberos
) {
1070 saf_store(domain
->alt_name
, controller
);
1073 winbindd_set_locator_kdc_envs(domain
);
1075 result
= cli_tree_connect(*cli
, "IPC$", "IPC", "", 0);
1077 if (!NT_STATUS_IS_OK(result
)) {
1078 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result
)));
1085 /* set the domain if empty; needed for schannel connections */
1086 if ( !(*cli
)->domain
[0] ) {
1087 result
= cli_set_domain((*cli
), domain
->name
);
1088 if (!NT_STATUS_IS_OK(result
)) {
1089 SAFE_FREE(ipc_username
);
1090 SAFE_FREE(ipc_domain
);
1091 SAFE_FREE(ipc_password
);
1096 result
= NT_STATUS_OK
;
1100 SAFE_FREE(machine_account
);
1101 SAFE_FREE(machine_password
);
1102 SAFE_FREE(machine_krb5_principal
);
1103 SAFE_FREE(ipc_username
);
1104 SAFE_FREE(ipc_domain
);
1105 SAFE_FREE(ipc_password
);
1107 if (!NT_STATUS_IS_OK(result
)) {
1108 winbind_add_failed_connection_entry(domain
, controller
, result
);
1109 if ((*cli
) != NULL
) {
1118 /*******************************************************************
1119 Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1122 Keeps the list unique by not adding duplicate entries.
1124 @param[in] mem_ctx talloc memory context to allocate from
1125 @param[in] domain_name domain of the DC
1126 @param[in] dcname name of the DC to add to the list
1127 @param[in] pss Internet address and port pair to add to the list
1128 @param[in,out] dcs array of dc_name_ip structures to add to
1129 @param[in,out] num_dcs number of dcs returned in the dcs array
1130 @return true if the list was added to, false otherwise
1131 *******************************************************************/
1133 static bool add_one_dc_unique(TALLOC_CTX
*mem_ctx
, const char *domain_name
,
1134 const char *dcname
, struct sockaddr_storage
*pss
,
1135 struct dc_name_ip
**dcs
, int *num
)
1139 if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name
, dcname
))) {
1140 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname
));
1144 /* Make sure there's no duplicates in the list */
1145 for (i
=0; i
<*num
; i
++)
1147 (struct sockaddr
*)(void *)&(*dcs
)[i
].ss
,
1148 (struct sockaddr
*)(void *)pss
))
1151 *dcs
= talloc_realloc(mem_ctx
, *dcs
, struct dc_name_ip
, (*num
)+1);
1156 fstrcpy((*dcs
)[*num
].name
, dcname
);
1157 (*dcs
)[*num
].ss
= *pss
;
1162 static bool add_sockaddr_to_array(TALLOC_CTX
*mem_ctx
,
1163 struct sockaddr_storage
*pss
, uint16 port
,
1164 struct sockaddr_storage
**addrs
, int *num
)
1166 *addrs
= talloc_realloc(mem_ctx
, *addrs
, struct sockaddr_storage
, (*num
)+1);
1168 if (*addrs
== NULL
) {
1173 (*addrs
)[*num
] = *pss
;
1174 set_sockaddr_port((struct sockaddr
*)&(*addrs
)[*num
], port
);
1180 /*******************************************************************
1181 convert an ip to a name
1182 *******************************************************************/
1184 static bool dcip_to_name(TALLOC_CTX
*mem_ctx
,
1185 const struct winbindd_domain
*domain
,
1186 struct sockaddr_storage
*pss
,
1189 struct ip_service ip_list
;
1190 uint32_t nt_version
= NETLOGON_NT_VERSION_1
;
1192 const char *dc_name
;
1199 /* For active directory servers, try to get the ldap server name.
1200 None of these failures should be considered critical for now */
1202 if (lp_security() == SEC_ADS
) {
1204 ADS_STATUS ads_status
;
1205 char addr
[INET6_ADDRSTRLEN
];
1207 print_sockaddr(addr
, sizeof(addr
), pss
);
1209 ads
= ads_init(domain
->alt_name
, domain
->name
, addr
);
1210 ads
->auth
.flags
|= ADS_AUTH_NO_BIND
;
1212 ads_status
= ads_connect(ads
);
1213 if (ADS_ERR_OK(ads_status
)) {
1214 /* We got a cldap packet. */
1215 *name
= talloc_strdup(mem_ctx
,
1216 ads
->config
.ldap_server_name
);
1217 if (*name
== NULL
) {
1220 namecache_store(*name
, 0x20, 1, &ip_list
);
1222 DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads
->config
.flags
));
1224 if (domain
->primary
&& (ads
->config
.flags
& NBT_SERVER_KDC
)) {
1225 if (ads_closest_dc(ads
)) {
1226 char *sitename
= sitename_fetch(mem_ctx
, ads
->config
.realm
);
1228 /* We're going to use this KDC for this realm/domain.
1229 If we are using sites, then force the krb5 libs
1232 create_local_private_krb5_conf_for_domain(domain
->alt_name
,
1238 TALLOC_FREE(sitename
);
1240 /* use an off site KDC */
1241 create_local_private_krb5_conf_for_domain(domain
->alt_name
,
1247 winbindd_set_locator_kdc_envs(domain
);
1249 /* Ensure we contact this DC also. */
1250 saf_store(domain
->name
, *name
);
1251 saf_store(domain
->alt_name
, *name
);
1254 ads_destroy( &ads
);
1258 ads_destroy( &ads
);
1263 status
= nbt_getdc(winbind_messaging_context(), 10, pss
, domain
->name
,
1264 &domain
->sid
, nt_version
, mem_ctx
, &nt_version
,
1266 if (NT_STATUS_IS_OK(status
)) {
1267 *name
= talloc_strdup(mem_ctx
, dc_name
);
1268 if (*name
== NULL
) {
1271 namecache_store(*name
, 0x20, 1, &ip_list
);
1275 /* try node status request */
1277 if (name_status_find(domain
->name
, 0x1c, 0x20, pss
, nbtname
) ) {
1278 namecache_store(nbtname
, 0x20, 1, &ip_list
);
1281 *name
= talloc_strdup(mem_ctx
, nbtname
);
1282 if (*name
== NULL
) {
1292 /*******************************************************************
1293 Retrieve a list of IP addresses for domain controllers.
1295 The array is sorted in the preferred connection order.
1297 @param[in] mem_ctx talloc memory context to allocate from
1298 @param[in] domain domain to retrieve DCs for
1299 @param[out] dcs array of dcs that will be returned
1300 @param[out] num_dcs number of dcs returned in the dcs array
1302 *******************************************************************/
1304 static bool get_dcs(TALLOC_CTX
*mem_ctx
, struct winbindd_domain
*domain
,
1305 struct dc_name_ip
**dcs
, int *num_dcs
)
1308 struct sockaddr_storage ss
;
1309 struct ip_service
*ip_list
= NULL
;
1310 int iplist_size
= 0;
1313 enum security_types sec
= (enum security_types
)lp_security();
1315 is_our_domain
= strequal(domain
->name
, lp_workgroup());
1317 /* If not our domain, get the preferred DC, by asking our primary DC */
1319 && get_dc_name_via_netlogon(domain
, dcname
, &ss
)
1320 && add_one_dc_unique(mem_ctx
, domain
->name
, dcname
, &ss
, dcs
,
1323 char addr
[INET6_ADDRSTRLEN
];
1324 print_sockaddr(addr
, sizeof(addr
), &ss
);
1325 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1330 if (sec
== SEC_ADS
) {
1331 char *sitename
= NULL
;
1333 /* We need to make sure we know the local site before
1334 doing any DNS queries, as this will restrict the
1335 get_sorted_dc_list() call below to only fetching
1336 DNS records for the correct site. */
1338 /* Find any DC to get the site record.
1339 We deliberately don't care about the
1342 get_dc_name(domain
->name
, domain
->alt_name
, dcname
, &ss
);
1344 sitename
= sitename_fetch(mem_ctx
, domain
->alt_name
);
1347 /* Do the site-specific AD dns lookup first. */
1348 get_sorted_dc_list(domain
->alt_name
, sitename
, &ip_list
,
1349 &iplist_size
, True
);
1351 /* Add ips to the DC array. We don't look up the name
1352 of the DC in this function, but we fill in the char*
1353 of the ip now to make the failed connection cache
1355 for ( i
=0; i
<iplist_size
; i
++ ) {
1356 char addr
[INET6_ADDRSTRLEN
];
1357 print_sockaddr(addr
, sizeof(addr
),
1359 add_one_dc_unique(mem_ctx
,
1368 TALLOC_FREE(sitename
);
1372 /* Now we add DCs from the main AD DNS lookup. */
1373 get_sorted_dc_list(domain
->alt_name
, NULL
, &ip_list
,
1374 &iplist_size
, True
);
1376 for ( i
=0; i
<iplist_size
; i
++ ) {
1377 char addr
[INET6_ADDRSTRLEN
];
1378 print_sockaddr(addr
, sizeof(addr
),
1380 add_one_dc_unique(mem_ctx
,
1392 /* Try standard netbios queries if no ADS and fall back to DNS queries
1393 * if alt_name is available */
1394 if (*num_dcs
== 0) {
1395 get_sorted_dc_list(domain
->name
, NULL
, &ip_list
, &iplist_size
,
1397 if (iplist_size
== 0) {
1398 if (domain
->alt_name
!= NULL
) {
1399 get_sorted_dc_list(domain
->alt_name
, NULL
, &ip_list
,
1400 &iplist_size
, true);
1404 for ( i
=0; i
<iplist_size
; i
++ ) {
1405 char addr
[INET6_ADDRSTRLEN
];
1406 print_sockaddr(addr
, sizeof(addr
),
1408 add_one_dc_unique(mem_ctx
,
1423 /*******************************************************************
1424 Find and make a connection to a DC in the given domain.
1426 @param[in] mem_ctx talloc memory context to allocate from
1427 @param[in] domain domain to find a dc in
1428 @param[out] dcname NetBIOS or FQDN of DC that's connected to
1429 @param[out] pss DC Internet address and port
1430 @param[out] fd fd of the open socket connected to the newly found dc
1431 @return true when a DC connection is made, false otherwise
1432 *******************************************************************/
1434 static bool find_new_dc(TALLOC_CTX
*mem_ctx
,
1435 struct winbindd_domain
*domain
,
1436 char **dcname
, struct sockaddr_storage
*pss
, int *fd
)
1438 struct dc_name_ip
*dcs
= NULL
;
1441 const char **dcnames
= NULL
;
1442 int num_dcnames
= 0;
1444 struct sockaddr_storage
*addrs
= NULL
;
1455 if (!get_dcs(mem_ctx
, domain
, &dcs
, &num_dcs
) || (num_dcs
== 0))
1458 for (i
=0; i
<num_dcs
; i
++) {
1460 if (!add_string_to_array(mem_ctx
, dcs
[i
].name
,
1461 &dcnames
, &num_dcnames
)) {
1464 if (!add_sockaddr_to_array(mem_ctx
, &dcs
[i
].ss
, TCP_SMB_PORT
,
1465 &addrs
, &num_addrs
)) {
1470 if ((num_dcnames
== 0) || (num_dcnames
!= num_addrs
))
1473 if ((addrs
== NULL
) || (dcnames
== NULL
))
1476 status
= smbsock_any_connect(addrs
, dcnames
, NULL
, NULL
, NULL
,
1477 num_addrs
, 0, 10, fd
, &fd_index
, NULL
);
1478 if (!NT_STATUS_IS_OK(status
)) {
1479 for (i
=0; i
<num_dcs
; i
++) {
1480 char ab
[INET6_ADDRSTRLEN
];
1481 print_sockaddr(ab
, sizeof(ab
), &dcs
[i
].ss
);
1482 DEBUG(10, ("find_new_dc: smbsock_any_connect failed for "
1483 "domain %s address %s. Error was %s\n",
1484 domain
->name
, ab
, nt_errstr(status
) ));
1485 winbind_add_failed_connection_entry(domain
,
1486 dcs
[i
].name
, NT_STATUS_UNSUCCESSFUL
);
1491 *pss
= addrs
[fd_index
];
1493 if (*dcnames
[fd_index
] != '\0' && !is_ipaddress(dcnames
[fd_index
])) {
1494 /* Ok, we've got a name for the DC */
1495 *dcname
= talloc_strdup(mem_ctx
, dcnames
[fd_index
]);
1496 if (*dcname
== NULL
) {
1502 /* Try to figure out the name */
1503 if (dcip_to_name(mem_ctx
, domain
, pss
, dcname
)) {
1507 /* We can not continue without the DC's name */
1508 winbind_add_failed_connection_entry(domain
, dcs
[fd_index
].name
,
1509 NT_STATUS_UNSUCCESSFUL
);
1511 /* Throw away all arrays as we're doing this again. */
1515 TALLOC_FREE(dcnames
);
1527 static char *current_dc_key(TALLOC_CTX
*mem_ctx
, const char *domain_name
)
1529 return talloc_asprintf_strupper_m(mem_ctx
, "CURRENT_DCNAME/%s",
1533 static void store_current_dc_in_gencache(const char *domain_name
,
1534 const char *dc_name
,
1535 struct cli_state
*cli
)
1537 char addr
[INET6_ADDRSTRLEN
];
1541 if (!cli_state_is_connected(cli
)) {
1545 print_sockaddr(addr
, sizeof(addr
),
1546 smbXcli_conn_remote_sockaddr(cli
->conn
));
1548 key
= current_dc_key(talloc_tos(), domain_name
);
1553 value
= talloc_asprintf(talloc_tos(), "%s %s", addr
, dc_name
);
1554 if (value
== NULL
) {
1558 gencache_set(key
, value
, 0x7fffffff);
1564 bool fetch_current_dc_from_gencache(TALLOC_CTX
*mem_ctx
,
1565 const char *domain_name
,
1566 char **p_dc_name
, char **p_dc_ip
)
1568 char *key
, *value
, *p
;
1570 char *dc_name
= NULL
;
1573 key
= current_dc_key(talloc_tos(), domain_name
);
1577 if (!gencache_get(key
, mem_ctx
, &value
, NULL
)) {
1580 p
= strchr(value
, ' ');
1584 dc_ip
= talloc_strndup(mem_ctx
, value
, p
- value
);
1585 if (dc_ip
== NULL
) {
1588 dc_name
= talloc_strdup(mem_ctx
, p
+1);
1589 if (dc_name
== NULL
) {
1593 if (p_dc_ip
!= NULL
) {
1597 if (p_dc_name
!= NULL
) {
1598 *p_dc_name
= dc_name
;
1603 TALLOC_FREE(dc_name
);
1610 static NTSTATUS
cm_open_connection(struct winbindd_domain
*domain
,
1611 struct winbindd_cm_conn
*new_conn
)
1613 TALLOC_CTX
*mem_ctx
;
1615 char *saf_servername
;
1618 if ((mem_ctx
= talloc_init("cm_open_connection")) == NULL
) {
1619 set_domain_offline(domain
);
1620 return NT_STATUS_NO_MEMORY
;
1623 saf_servername
= saf_fetch(mem_ctx
, domain
->name
);
1625 /* we have to check the server affinity cache here since
1626 later we select a DC based on response time and not preference */
1628 /* Check the negative connection cache
1629 before talking to it. It going down may have
1630 triggered the reconnection. */
1632 if ( saf_servername
&& NT_STATUS_IS_OK(check_negative_conn_cache( domain
->name
, saf_servername
))) {
1634 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1635 saf_servername
, domain
->name
));
1637 /* convert an ip address to a name */
1638 if (is_ipaddress( saf_servername
) ) {
1639 char *dcname
= NULL
;
1640 struct sockaddr_storage ss
;
1642 if (!interpret_string_addr(&ss
, saf_servername
,
1644 TALLOC_FREE(mem_ctx
);
1645 return NT_STATUS_UNSUCCESSFUL
;
1647 if (dcip_to_name(mem_ctx
, domain
, &ss
, &dcname
)) {
1648 domain
->dcname
= talloc_strdup(domain
,
1650 if (domain
->dcname
== NULL
) {
1651 TALLOC_FREE(mem_ctx
);
1652 return NT_STATUS_NO_MEMORY
;
1655 winbind_add_failed_connection_entry(
1656 domain
, saf_servername
,
1657 NT_STATUS_UNSUCCESSFUL
);
1660 domain
->dcname
= talloc_strdup(domain
, saf_servername
);
1661 if (domain
->dcname
== NULL
) {
1662 TALLOC_FREE(mem_ctx
);
1663 return NT_STATUS_NO_MEMORY
;
1668 for (retries
= 0; retries
< 3; retries
++) {
1671 char *dcname
= NULL
;
1673 result
= NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1675 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1676 domain
->dcname
? domain
->dcname
: "", domain
->name
));
1678 if (domain
->dcname
!= NULL
1679 && NT_STATUS_IS_OK(check_negative_conn_cache( domain
->name
, domain
->dcname
))
1680 && (resolve_name(domain
->dcname
, &domain
->dcaddr
, 0x20, true)))
1684 status
= smbsock_connect(&domain
->dcaddr
, 0,
1687 if (!NT_STATUS_IS_OK(status
)) {
1693 !find_new_dc(mem_ctx
, domain
, &dcname
, &domain
->dcaddr
, &fd
))
1695 /* This is the one place where we will
1696 set the global winbindd offline state
1697 to true, if a "WINBINDD_OFFLINE" entry
1698 is found in the winbindd cache. */
1699 set_global_winbindd_state_offline();
1702 if (dcname
!= NULL
) {
1703 talloc_free(domain
->dcname
);
1705 domain
->dcname
= talloc_move(domain
, &dcname
);
1706 if (domain
->dcname
== NULL
) {
1707 result
= NT_STATUS_NO_MEMORY
;
1712 new_conn
->cli
= NULL
;
1714 result
= cm_prepare_connection(domain
, fd
, domain
->dcname
,
1715 &new_conn
->cli
, &retry
);
1716 if (!NT_STATUS_IS_OK(result
)) {
1717 /* Don't leak the smb connection socket */
1725 if (NT_STATUS_IS_OK(result
)) {
1727 winbindd_set_locator_kdc_envs(domain
);
1729 if (domain
->online
== False
) {
1730 /* We're changing state from offline to online. */
1731 set_global_winbindd_state_online();
1733 set_domain_online(domain
);
1736 * Much as I hate global state, this seems to be the point
1737 * where we can be certain that we have a proper connection to
1738 * a DC. wbinfo --dc-info needs that information, store it in
1739 * gencache with a looong timeout. This will need revisiting
1740 * once we start to connect to multiple DCs, wbcDcInfo is
1741 * already prepared for that.
1743 store_current_dc_in_gencache(domain
->name
, domain
->dcname
,
1746 /* Ensure we setup the retry handler. */
1747 set_domain_offline(domain
);
1750 talloc_destroy(mem_ctx
);
1754 /* Close down all open pipes on a connection. */
1756 void invalidate_cm_connection(struct winbindd_cm_conn
*conn
)
1760 /* We're closing down a possibly dead
1761 connection. Don't have impossibly long (10s) timeouts. */
1764 cli_set_timeout(conn
->cli
, 1000); /* 1 second. */
1767 if (conn
->samr_pipe
!= NULL
) {
1768 if (is_valid_policy_hnd(&conn
->sam_connect_handle
)) {
1769 dcerpc_samr_Close(conn
->samr_pipe
->binding_handle
,
1771 &conn
->sam_connect_handle
,
1774 TALLOC_FREE(conn
->samr_pipe
);
1775 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1777 cli_set_timeout(conn
->cli
, 500);
1781 if (conn
->lsa_pipe
!= NULL
) {
1782 if (is_valid_policy_hnd(&conn
->lsa_policy
)) {
1783 dcerpc_lsa_Close(conn
->lsa_pipe
->binding_handle
,
1788 TALLOC_FREE(conn
->lsa_pipe
);
1789 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1791 cli_set_timeout(conn
->cli
, 500);
1795 if (conn
->lsa_pipe_tcp
!= NULL
) {
1796 if (is_valid_policy_hnd(&conn
->lsa_policy
)) {
1797 dcerpc_lsa_Close(conn
->lsa_pipe_tcp
->binding_handle
,
1802 TALLOC_FREE(conn
->lsa_pipe_tcp
);
1803 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1805 cli_set_timeout(conn
->cli
, 500);
1809 if (conn
->netlogon_pipe
!= NULL
) {
1810 TALLOC_FREE(conn
->netlogon_pipe
);
1811 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1813 cli_set_timeout(conn
->cli
, 500);
1818 cli_shutdown(conn
->cli
);
1824 void close_conns_after_fork(void)
1826 struct winbindd_domain
*domain
;
1827 struct winbindd_cli_state
*cli_state
;
1829 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
1831 * first close the low level SMB TCP connection
1832 * so that we don't generate any SMBclose
1833 * requests in invalidate_cm_connection()
1835 if (cli_state_is_connected(domain
->conn
.cli
)) {
1836 smbXcli_conn_disconnect(domain
->conn
.cli
->conn
, NT_STATUS_OK
);
1839 invalidate_cm_connection(&domain
->conn
);
1842 for (cli_state
= winbindd_client_list();
1844 cli_state
= cli_state
->next
) {
1845 if (cli_state
->sock
>= 0) {
1846 close(cli_state
->sock
);
1847 cli_state
->sock
= -1;
1852 static bool connection_ok(struct winbindd_domain
*domain
)
1856 ok
= cli_state_is_connected(domain
->conn
.cli
);
1858 DEBUG(3, ("connection_ok: Connection to %s for domain %s is not connected\n",
1859 domain
->dcname
, domain
->name
));
1863 if (domain
->online
== False
) {
1864 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain
->name
));
1871 /* Initialize a new connection up to the RPC BIND.
1872 Bypass online status check so always does network calls. */
1874 static NTSTATUS
init_dc_connection_network(struct winbindd_domain
*domain
)
1878 /* Internal connections never use the network. */
1879 if (domain
->internal
) {
1880 domain
->initialized
= True
;
1881 return NT_STATUS_OK
;
1884 if (connection_ok(domain
)) {
1885 if (!domain
->initialized
) {
1886 set_dc_type_and_flags(domain
);
1888 return NT_STATUS_OK
;
1891 invalidate_cm_connection(&domain
->conn
);
1893 result
= cm_open_connection(domain
, &domain
->conn
);
1895 if (NT_STATUS_IS_OK(result
) && !domain
->initialized
) {
1896 set_dc_type_and_flags(domain
);
1902 NTSTATUS
init_dc_connection(struct winbindd_domain
*domain
)
1904 if (domain
->internal
) {
1905 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1908 if (domain
->initialized
&& !domain
->online
) {
1909 /* We check for online status elsewhere. */
1910 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1913 return init_dc_connection_network(domain
);
1916 static NTSTATUS
init_dc_connection_rpc(struct winbindd_domain
*domain
)
1920 status
= init_dc_connection(domain
);
1921 if (!NT_STATUS_IS_OK(status
)) {
1925 if (!domain
->internal
&& domain
->conn
.cli
== NULL
) {
1926 /* happens for trusted domains without inbound trust */
1927 return NT_STATUS_TRUSTED_DOMAIN_FAILURE
;
1930 return NT_STATUS_OK
;
1933 /******************************************************************************
1934 Set the trust flags (direction and forest location) for a domain
1935 ******************************************************************************/
1937 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain
*domain
)
1939 struct winbindd_domain
*our_domain
;
1940 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1942 struct netr_DomainTrustList trusts
;
1944 uint32 flags
= (NETR_TRUST_FLAG_IN_FOREST
|
1945 NETR_TRUST_FLAG_OUTBOUND
|
1946 NETR_TRUST_FLAG_INBOUND
);
1947 struct rpc_pipe_client
*cli
;
1948 TALLOC_CTX
*mem_ctx
= NULL
;
1949 struct dcerpc_binding_handle
*b
;
1951 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain
->name
));
1953 /* Our primary domain doesn't need to worry about trust flags.
1954 Force it to go through the network setup */
1955 if ( domain
->primary
) {
1959 our_domain
= find_our_domain();
1961 if ( !connection_ok(our_domain
) ) {
1962 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1966 /* This won't work unless our domain is AD */
1968 if ( !our_domain
->active_directory
) {
1972 /* Use DsEnumerateDomainTrusts to get us the trust direction
1975 result
= cm_connect_netlogon(our_domain
, &cli
);
1977 if (!NT_STATUS_IS_OK(result
)) {
1978 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1979 "a connection to %s for PIPE_NETLOGON (%s)\n",
1980 domain
->name
, nt_errstr(result
)));
1984 b
= cli
->binding_handle
;
1986 if ( (mem_ctx
= talloc_init("set_dc_type_and_flags_trustinfo")) == NULL
) {
1987 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1991 result
= dcerpc_netr_DsrEnumerateDomainTrusts(b
, mem_ctx
,
1996 if (!NT_STATUS_IS_OK(result
)) {
1997 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1998 "failed to query trusted domain list: %s\n",
1999 nt_errstr(result
)));
2000 talloc_destroy(mem_ctx
);
2003 if (!W_ERROR_IS_OK(werr
)) {
2004 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
2005 "failed to query trusted domain list: %s\n",
2007 talloc_destroy(mem_ctx
);
2011 /* Now find the domain name and get the flags */
2013 for ( i
=0; i
<trusts
.count
; i
++ ) {
2014 if ( strequal( domain
->name
, trusts
.array
[i
].netbios_name
) ) {
2015 domain
->domain_flags
= trusts
.array
[i
].trust_flags
;
2016 domain
->domain_type
= trusts
.array
[i
].trust_type
;
2017 domain
->domain_trust_attribs
= trusts
.array
[i
].trust_attributes
;
2019 if ( domain
->domain_type
== NETR_TRUST_TYPE_UPLEVEL
)
2020 domain
->active_directory
= True
;
2022 /* This flag is only set if the domain is *our*
2023 primary domain and the primary domain is in
2026 domain
->native_mode
= (domain
->domain_flags
& NETR_TRUST_FLAG_NATIVE
);
2028 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
2029 "native mode.\n", domain
->name
,
2030 domain
->native_mode
? "" : "NOT "));
2032 DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
2033 "running active directory.\n", domain
->name
,
2034 domain
->active_directory
? "" : "NOT "));
2036 domain
->can_do_ncacn_ip_tcp
= domain
->active_directory
;
2037 domain
->can_do_validation6
= domain
->active_directory
;
2039 domain
->initialized
= True
;
2045 talloc_destroy( mem_ctx
);
2047 return domain
->initialized
;
2050 /******************************************************************************
2051 We can 'sense' certain things about the DC by it's replies to certain
2054 This tells us if this particular remote server is Active Directory, and if it
2056 ******************************************************************************/
2058 static void set_dc_type_and_flags_connect( struct winbindd_domain
*domain
)
2060 NTSTATUS status
, result
;
2062 TALLOC_CTX
*mem_ctx
= NULL
;
2063 struct rpc_pipe_client
*cli
= NULL
;
2064 struct policy_handle pol
;
2065 union dssetup_DsRoleInfo info
;
2066 union lsa_PolicyInformation
*lsa_info
= NULL
;
2068 if (!connection_ok(domain
)) {
2072 mem_ctx
= talloc_init("set_dc_type_and_flags on domain %s\n",
2075 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
2079 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain
->name
));
2081 status
= cli_rpc_pipe_open_noauth(domain
->conn
.cli
,
2085 if (!NT_STATUS_IS_OK(status
)) {
2086 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
2087 "PI_DSSETUP on domain %s: (%s)\n",
2088 domain
->name
, nt_errstr(status
)));
2090 /* if this is just a non-AD domain we need to continue
2091 * identifying so that we can in the end return with
2092 * domain->initialized = True - gd */
2097 status
= dcerpc_dssetup_DsRoleGetPrimaryDomainInformation(cli
->binding_handle
, mem_ctx
,
2098 DS_ROLE_BASIC_INFORMATION
,
2103 if (NT_STATUS_IS_OK(status
)) {
2104 result
= werror_to_ntstatus(werr
);
2106 if (!NT_STATUS_IS_OK(status
)) {
2107 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
2108 "on domain %s failed: (%s)\n",
2109 domain
->name
, nt_errstr(status
)));
2111 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
2112 * every opcode on the DSSETUP pipe, continue with
2113 * no_dssetup mode here as well to get domain->initialized
2116 if (NT_STATUS_EQUAL(status
, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE
)) {
2120 TALLOC_FREE(mem_ctx
);
2124 if ((info
.basic
.flags
& DS_ROLE_PRIMARY_DS_RUNNING
) &&
2125 !(info
.basic
.flags
& DS_ROLE_PRIMARY_DS_MIXED_MODE
)) {
2126 domain
->native_mode
= True
;
2128 domain
->native_mode
= False
;
2132 status
= cli_rpc_pipe_open_noauth(domain
->conn
.cli
,
2133 &ndr_table_lsarpc
, &cli
);
2135 if (!NT_STATUS_IS_OK(status
)) {
2136 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
2137 "PI_LSARPC on domain %s: (%s)\n",
2138 domain
->name
, nt_errstr(status
)));
2140 TALLOC_FREE(mem_ctx
);
2144 status
= rpccli_lsa_open_policy2(cli
, mem_ctx
, True
,
2145 SEC_FLAG_MAXIMUM_ALLOWED
, &pol
);
2147 if (NT_STATUS_IS_OK(status
)) {
2148 /* This particular query is exactly what Win2k clients use
2149 to determine that the DC is active directory */
2150 status
= dcerpc_lsa_QueryInfoPolicy2(cli
->binding_handle
, mem_ctx
,
2152 LSA_POLICY_INFO_DNS
,
2157 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(result
)) {
2158 domain
->active_directory
= True
;
2160 if (lsa_info
->dns
.name
.string
) {
2161 talloc_free(domain
->name
);
2162 domain
->name
= talloc_strdup(domain
,
2163 lsa_info
->dns
.name
.string
);
2164 if (domain
->name
== NULL
) {
2169 if (lsa_info
->dns
.dns_domain
.string
) {
2170 talloc_free(domain
->alt_name
);
2172 talloc_strdup(domain
,
2173 lsa_info
->dns
.dns_domain
.string
);
2174 if (domain
->alt_name
== NULL
) {
2179 /* See if we can set some domain trust flags about
2182 if (lsa_info
->dns
.dns_forest
.string
) {
2183 talloc_free(domain
->forest_name
);
2184 domain
->forest_name
=
2185 talloc_strdup(domain
,
2186 lsa_info
->dns
.dns_forest
.string
);
2187 if (domain
->forest_name
== NULL
) {
2191 if (strequal(domain
->forest_name
, domain
->alt_name
)) {
2192 domain
->domain_flags
|= NETR_TRUST_FLAG_TREEROOT
;
2196 if (lsa_info
->dns
.sid
) {
2197 sid_copy(&domain
->sid
, lsa_info
->dns
.sid
);
2200 domain
->active_directory
= False
;
2202 status
= rpccli_lsa_open_policy(cli
, mem_ctx
, True
,
2203 SEC_FLAG_MAXIMUM_ALLOWED
,
2206 if (!NT_STATUS_IS_OK(status
)) {
2210 status
= dcerpc_lsa_QueryInfoPolicy(cli
->binding_handle
, mem_ctx
,
2212 LSA_POLICY_INFO_ACCOUNT_DOMAIN
,
2215 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(result
)) {
2217 if (lsa_info
->account_domain
.name
.string
) {
2218 talloc_free(domain
->name
);
2220 talloc_strdup(domain
,
2221 lsa_info
->account_domain
.name
.string
);
2224 if (lsa_info
->account_domain
.sid
) {
2225 sid_copy(&domain
->sid
, lsa_info
->account_domain
.sid
);
2231 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
2232 domain
->name
, domain
->native_mode
? "" : "NOT "));
2234 DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
2235 domain
->name
, domain
->active_directory
? "" : "NOT "));
2237 domain
->can_do_ncacn_ip_tcp
= domain
->active_directory
;
2238 domain
->can_do_validation6
= domain
->active_directory
;
2242 TALLOC_FREE(mem_ctx
);
2244 domain
->initialized
= True
;
2247 /**********************************************************************
2248 Set the domain_flags (trust attributes, domain operating modes, etc...
2249 ***********************************************************************/
2251 static void set_dc_type_and_flags( struct winbindd_domain
*domain
)
2253 /* we always have to contact our primary domain */
2255 if ( domain
->primary
) {
2256 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
2257 "primary domain\n"));
2258 set_dc_type_and_flags_connect( domain
);
2262 /* Use our DC to get the information if possible */
2264 if ( !set_dc_type_and_flags_trustinfo( domain
) ) {
2265 /* Otherwise, fallback to contacting the
2267 set_dc_type_and_flags_connect( domain
);
2275 /**********************************************************************
2276 ***********************************************************************/
2278 static NTSTATUS
cm_get_schannel_creds(struct winbindd_domain
*domain
,
2279 struct netlogon_creds_CredentialState
**ppdc
)
2281 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
2282 struct rpc_pipe_client
*netlogon_pipe
;
2284 if (lp_client_schannel() == False
) {
2285 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
2288 result
= cm_connect_netlogon(domain
, &netlogon_pipe
);
2289 if (!NT_STATUS_IS_OK(result
)) {
2293 /* Return a pointer to the struct netlogon_creds_CredentialState from the
2296 if (!domain
->conn
.netlogon_pipe
->dc
) {
2297 return NT_STATUS_INTERNAL_ERROR
; /* This shouldn't happen. */
2300 *ppdc
= domain
->conn
.netlogon_pipe
->dc
;
2301 return NT_STATUS_OK
;
2304 NTSTATUS
cm_connect_sam(struct winbindd_domain
*domain
, TALLOC_CTX
*mem_ctx
,
2305 struct rpc_pipe_client
**cli
, struct policy_handle
*sam_handle
)
2307 struct winbindd_cm_conn
*conn
;
2308 NTSTATUS status
, result
;
2309 struct netlogon_creds_CredentialState
*p_creds
;
2310 char *machine_password
= NULL
;
2311 char *machine_account
= NULL
;
2312 const char *domain_name
= NULL
;
2314 if (sid_check_is_our_sam(&domain
->sid
)) {
2315 return open_internal_samr_conn(mem_ctx
, domain
, cli
, sam_handle
);
2318 status
= init_dc_connection_rpc(domain
);
2319 if (!NT_STATUS_IS_OK(status
)) {
2323 conn
= &domain
->conn
;
2325 if (rpccli_is_connected(conn
->samr_pipe
)) {
2329 TALLOC_FREE(conn
->samr_pipe
);
2332 * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2333 * sign and sealed pipe using the machine account password by
2334 * preference. If we can't - try schannel, if that fails, try
2338 if ((conn
->cli
->user_name
[0] == '\0') ||
2339 (conn
->cli
->domain
[0] == '\0') ||
2340 (conn
->cli
->password
== NULL
|| conn
->cli
->password
[0] == '\0'))
2342 status
= get_trust_creds(domain
, &machine_password
,
2343 &machine_account
, NULL
);
2344 if (!NT_STATUS_IS_OK(status
)) {
2345 DEBUG(10, ("cm_connect_sam: No no user available for "
2346 "domain %s, trying schannel\n", conn
->cli
->domain
));
2349 domain_name
= domain
->name
;
2351 machine_password
= SMB_STRDUP(conn
->cli
->password
);
2352 machine_account
= SMB_STRDUP(conn
->cli
->user_name
);
2353 domain_name
= conn
->cli
->domain
;
2356 if (!machine_password
|| !machine_account
) {
2357 status
= NT_STATUS_NO_MEMORY
;
2361 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2362 authenticated SAMR pipe with sign & seal. */
2363 status
= cli_rpc_pipe_open_spnego(conn
->cli
,
2367 DCERPC_AUTH_LEVEL_PRIVACY
,
2368 smbXcli_conn_remote_name(conn
->cli
->conn
),
2374 if (!NT_STATUS_IS_OK(status
)) {
2375 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2376 "pipe for domain %s using NTLMSSP "
2377 "authenticated pipe: user %s\\%s. Error was "
2378 "%s\n", domain
->name
, domain_name
,
2379 machine_account
, nt_errstr(status
)));
2383 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2384 "domain %s using NTLMSSP authenticated "
2385 "pipe: user %s\\%s\n", domain
->name
,
2386 domain_name
, machine_account
));
2388 status
= dcerpc_samr_Connect2(conn
->samr_pipe
->binding_handle
, mem_ctx
,
2389 conn
->samr_pipe
->desthost
,
2390 SEC_FLAG_MAXIMUM_ALLOWED
,
2391 &conn
->sam_connect_handle
,
2393 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(result
)) {
2396 if (NT_STATUS_IS_OK(status
)) {
2400 DEBUG(10,("cm_connect_sam: ntlmssp-sealed dcerpc_samr_Connect2 "
2401 "failed for domain %s, error was %s. Trying schannel\n",
2402 domain
->name
, nt_errstr(status
) ));
2403 TALLOC_FREE(conn
->samr_pipe
);
2407 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2409 status
= cm_get_schannel_creds(domain
, &p_creds
);
2410 if (!NT_STATUS_IS_OK(status
)) {
2411 /* If this call fails - conn->cli can now be NULL ! */
2412 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2413 "for domain %s (error %s), trying anon\n",
2415 nt_errstr(status
) ));
2418 status
= cli_rpc_pipe_open_schannel_with_key
2419 (conn
->cli
, &ndr_table_samr
, NCACN_NP
,
2420 DCERPC_AUTH_LEVEL_PRIVACY
,
2421 domain
->name
, &p_creds
, &conn
->samr_pipe
);
2423 if (!NT_STATUS_IS_OK(status
)) {
2424 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2425 "domain %s using schannel. Error was %s\n",
2426 domain
->name
, nt_errstr(status
) ));
2429 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2430 "schannel.\n", domain
->name
));
2432 status
= dcerpc_samr_Connect2(conn
->samr_pipe
->binding_handle
, mem_ctx
,
2433 conn
->samr_pipe
->desthost
,
2434 SEC_FLAG_MAXIMUM_ALLOWED
,
2435 &conn
->sam_connect_handle
,
2437 if (NT_STATUS_IS_OK(status
) && NT_STATUS_IS_OK(result
)) {
2440 if (NT_STATUS_IS_OK(status
)) {
2443 DEBUG(10,("cm_connect_sam: schannel-sealed dcerpc_samr_Connect2 failed "
2444 "for domain %s, error was %s. Trying anonymous\n",
2445 domain
->name
, nt_errstr(status
) ));
2446 TALLOC_FREE(conn
->samr_pipe
);
2450 /* Finally fall back to anonymous. */
2451 status
= cli_rpc_pipe_open_noauth(conn
->cli
, &ndr_table_samr
,
2454 if (!NT_STATUS_IS_OK(status
)) {
2458 status
= dcerpc_samr_Connect2(conn
->samr_pipe
->binding_handle
, mem_ctx
,
2459 conn
->samr_pipe
->desthost
,
2460 SEC_FLAG_MAXIMUM_ALLOWED
,
2461 &conn
->sam_connect_handle
,
2463 if (!NT_STATUS_IS_OK(status
)) {
2464 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2465 "for domain %s Error was %s\n",
2466 domain
->name
, nt_errstr(status
) ));
2469 if (!NT_STATUS_IS_OK(result
)) {
2471 DEBUG(10,("cm_connect_sam: dcerpc_samr_Connect2 failed "
2472 "for domain %s Error was %s\n",
2473 domain
->name
, nt_errstr(result
)));
2478 status
= dcerpc_samr_OpenDomain(conn
->samr_pipe
->binding_handle
,
2480 &conn
->sam_connect_handle
,
2481 SEC_FLAG_MAXIMUM_ALLOWED
,
2483 &conn
->sam_domain_handle
,
2485 if (!NT_STATUS_IS_OK(status
)) {
2492 if (NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
)) {
2494 * if we got access denied, we might just have no access rights
2495 * to talk to the remote samr server server (e.g. when we are a
2496 * PDC and we are connecting a w2k8 pdc via an interdomain
2497 * trust). In that case do not invalidate the whole connection
2500 TALLOC_FREE(conn
->samr_pipe
);
2501 ZERO_STRUCT(conn
->sam_domain_handle
);
2503 } else if (!NT_STATUS_IS_OK(status
)) {
2504 invalidate_cm_connection(conn
);
2508 *cli
= conn
->samr_pipe
;
2509 *sam_handle
= conn
->sam_domain_handle
;
2510 SAFE_FREE(machine_password
);
2511 SAFE_FREE(machine_account
);
2515 /**********************************************************************
2516 open an schanneld ncacn_ip_tcp connection to LSA
2517 ***********************************************************************/
2519 NTSTATUS
cm_connect_lsa_tcp(struct winbindd_domain
*domain
,
2520 TALLOC_CTX
*mem_ctx
,
2521 struct rpc_pipe_client
**cli
)
2523 struct winbindd_cm_conn
*conn
;
2524 struct netlogon_creds_CredentialState
*creds
;
2527 DEBUG(10,("cm_connect_lsa_tcp\n"));
2529 status
= init_dc_connection_rpc(domain
);
2530 if (!NT_STATUS_IS_OK(status
)) {
2534 conn
= &domain
->conn
;
2536 if (conn
->lsa_pipe_tcp
&&
2537 conn
->lsa_pipe_tcp
->transport
->transport
== NCACN_IP_TCP
&&
2538 conn
->lsa_pipe_tcp
->auth
->auth_level
== DCERPC_AUTH_LEVEL_PRIVACY
&&
2539 rpccli_is_connected(conn
->lsa_pipe_tcp
)) {
2543 TALLOC_FREE(conn
->lsa_pipe_tcp
);
2545 status
= cm_get_schannel_creds(domain
, &creds
);
2546 if (!NT_STATUS_IS_OK(status
)) {
2550 status
= cli_rpc_pipe_open_schannel_with_key(conn
->cli
,
2553 DCERPC_AUTH_LEVEL_PRIVACY
,
2556 &conn
->lsa_pipe_tcp
);
2557 if (!NT_STATUS_IS_OK(status
)) {
2558 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
2559 nt_errstr(status
)));
2564 if (!NT_STATUS_IS_OK(status
)) {
2565 TALLOC_FREE(conn
->lsa_pipe_tcp
);
2569 *cli
= conn
->lsa_pipe_tcp
;
2574 NTSTATUS
cm_connect_lsa(struct winbindd_domain
*domain
, TALLOC_CTX
*mem_ctx
,
2575 struct rpc_pipe_client
**cli
, struct policy_handle
*lsa_policy
)
2577 struct winbindd_cm_conn
*conn
;
2578 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
2579 struct netlogon_creds_CredentialState
*p_creds
;
2581 result
= init_dc_connection_rpc(domain
);
2582 if (!NT_STATUS_IS_OK(result
))
2585 conn
= &domain
->conn
;
2587 if (rpccli_is_connected(conn
->lsa_pipe
)) {
2591 TALLOC_FREE(conn
->lsa_pipe
);
2593 if ((conn
->cli
->user_name
[0] == '\0') ||
2594 (conn
->cli
->domain
[0] == '\0') ||
2595 (conn
->cli
->password
== NULL
|| conn
->cli
->password
[0] == '\0')) {
2596 DEBUG(10, ("cm_connect_lsa: No no user available for "
2597 "domain %s, trying schannel\n", conn
->cli
->domain
));
2601 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2602 * authenticated LSA pipe with sign & seal. */
2603 result
= cli_rpc_pipe_open_spnego
2604 (conn
->cli
, &ndr_table_lsarpc
, NCACN_NP
,
2606 DCERPC_AUTH_LEVEL_PRIVACY
,
2607 smbXcli_conn_remote_name(conn
->cli
->conn
),
2608 conn
->cli
->domain
, conn
->cli
->user_name
, conn
->cli
->password
,
2611 if (!NT_STATUS_IS_OK(result
)) {
2612 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2613 "domain %s using NTLMSSP authenticated pipe: user "
2614 "%s\\%s. Error was %s. Trying schannel.\n",
2615 domain
->name
, conn
->cli
->domain
,
2616 conn
->cli
->user_name
, nt_errstr(result
)));
2620 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2621 "NTLMSSP authenticated pipe: user %s\\%s\n",
2622 domain
->name
, conn
->cli
->domain
, conn
->cli
->user_name
));
2624 result
= rpccli_lsa_open_policy(conn
->lsa_pipe
, mem_ctx
, True
,
2625 SEC_FLAG_MAXIMUM_ALLOWED
,
2627 if (NT_STATUS_IS_OK(result
)) {
2631 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2634 TALLOC_FREE(conn
->lsa_pipe
);
2638 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2640 result
= cm_get_schannel_creds(domain
, &p_creds
);
2641 if (!NT_STATUS_IS_OK(result
)) {
2642 /* If this call fails - conn->cli can now be NULL ! */
2643 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2644 "for domain %s (error %s), trying anon\n",
2646 nt_errstr(result
) ));
2649 result
= cli_rpc_pipe_open_schannel_with_key
2650 (conn
->cli
, &ndr_table_lsarpc
, NCACN_NP
,
2651 DCERPC_AUTH_LEVEL_PRIVACY
,
2652 domain
->name
, &p_creds
, &conn
->lsa_pipe
);
2654 if (!NT_STATUS_IS_OK(result
)) {
2655 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2656 "domain %s using schannel. Error was %s\n",
2657 domain
->name
, nt_errstr(result
) ));
2660 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2661 "schannel.\n", domain
->name
));
2663 result
= rpccli_lsa_open_policy(conn
->lsa_pipe
, mem_ctx
, True
,
2664 SEC_FLAG_MAXIMUM_ALLOWED
,
2666 if (NT_STATUS_IS_OK(result
)) {
2670 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2673 TALLOC_FREE(conn
->lsa_pipe
);
2677 result
= cli_rpc_pipe_open_noauth(conn
->cli
,
2680 if (!NT_STATUS_IS_OK(result
)) {
2681 result
= NT_STATUS_PIPE_NOT_AVAILABLE
;
2685 result
= rpccli_lsa_open_policy(conn
->lsa_pipe
, mem_ctx
, True
,
2686 SEC_FLAG_MAXIMUM_ALLOWED
,
2689 if (!NT_STATUS_IS_OK(result
)) {
2690 invalidate_cm_connection(conn
);
2694 *cli
= conn
->lsa_pipe
;
2695 *lsa_policy
= conn
->lsa_policy
;
2699 /****************************************************************************
2700 Open a LSA connection to a DC, suiteable for LSA lookup calls.
2701 ****************************************************************************/
2703 NTSTATUS
cm_connect_lsat(struct winbindd_domain
*domain
,
2704 TALLOC_CTX
*mem_ctx
,
2705 struct rpc_pipe_client
**cli
,
2706 struct policy_handle
*lsa_policy
)
2710 if (domain
->can_do_ncacn_ip_tcp
) {
2711 status
= cm_connect_lsa_tcp(domain
, mem_ctx
, cli
);
2712 if (NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
) ||
2713 NT_STATUS_EQUAL(status
, NT_STATUS_RPC_SEC_PKG_ERROR
) ||
2714 NT_STATUS_EQUAL(status
, NT_STATUS_NETWORK_ACCESS_DENIED
)) {
2715 invalidate_cm_connection(&domain
->conn
);
2716 status
= cm_connect_lsa_tcp(domain
, mem_ctx
, cli
);
2718 if (NT_STATUS_IS_OK(status
)) {
2723 * we tried twice to connect via ncan_ip_tcp and schannel and
2724 * failed - maybe it is a trusted domain we can't connect to ?
2725 * do not try tcp next time - gd
2727 domain
->can_do_ncacn_ip_tcp
= false;
2730 status
= cm_connect_lsa(domain
, mem_ctx
, cli
, lsa_policy
);
2735 /****************************************************************************
2736 Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2737 session key stored in conn->netlogon_pipe->dc->sess_key.
2738 ****************************************************************************/
2740 NTSTATUS
cm_connect_netlogon(struct winbindd_domain
*domain
,
2741 struct rpc_pipe_client
**cli
)
2743 struct winbindd_cm_conn
*conn
;
2746 uint32_t neg_flags
= NETLOGON_NEG_AUTH2_ADS_FLAGS
| NETLOGON_NEG_SUPPORTS_AES
;
2747 uint8_t mach_pwd
[16];
2748 enum netr_SchannelType sec_chan_type
;
2749 const char *account_name
;
2750 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
2754 result
= init_dc_connection_rpc(domain
);
2755 if (!NT_STATUS_IS_OK(result
)) {
2759 conn
= &domain
->conn
;
2761 if (rpccli_is_connected(conn
->netlogon_pipe
)) {
2762 *cli
= conn
->netlogon_pipe
;
2763 return NT_STATUS_OK
;
2766 TALLOC_FREE(conn
->netlogon_pipe
);
2768 result
= cli_rpc_pipe_open_noauth(conn
->cli
,
2769 &ndr_table_netlogon
,
2771 if (!NT_STATUS_IS_OK(result
)) {
2775 if ((!IS_DC
) && (!domain
->primary
)) {
2776 /* Clear the schannel request bit and drop down */
2777 neg_flags
&= ~NETLOGON_NEG_SCHANNEL
;
2781 if (lp_client_schannel() != False
) {
2782 neg_flags
|= NETLOGON_NEG_SCHANNEL
;
2785 if (!get_trust_pw_hash(domain
->name
, mach_pwd
, &account_name
,
2788 TALLOC_FREE(netlogon_pipe
);
2789 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
2792 result
= rpccli_netlogon_setup_creds(
2794 domain
->dcname
, /* server name. */
2795 domain
->name
, /* domain name */
2796 lp_netbios_name(), /* client name */
2797 account_name
, /* machine account */
2798 mach_pwd
, /* machine password */
2799 sec_chan_type
, /* from get_trust_pw */
2802 if (!NT_STATUS_IS_OK(result
)) {
2803 TALLOC_FREE(netlogon_pipe
);
2807 if ((lp_client_schannel() == True
) &&
2808 ((neg_flags
& NETLOGON_NEG_SCHANNEL
) == 0)) {
2809 DEBUG(3, ("Server did not offer schannel\n"));
2810 TALLOC_FREE(netlogon_pipe
);
2811 return NT_STATUS_ACCESS_DENIED
;
2815 if ((lp_client_schannel() == False
) ||
2816 ((neg_flags
& NETLOGON_NEG_SCHANNEL
) == 0)) {
2818 * NetSamLogonEx only works for schannel
2820 domain
->can_do_samlogon_ex
= False
;
2822 /* We're done - just keep the existing connection to NETLOGON
2824 conn
->netlogon_pipe
= netlogon_pipe
;
2825 *cli
= conn
->netlogon_pipe
;
2826 return NT_STATUS_OK
;
2829 /* Using the credentials from the first pipe, open a signed and sealed
2830 second netlogon pipe. The session key is stored in the schannel
2831 part of the new pipe auth struct.
2834 result
= cli_rpc_pipe_open_schannel_with_key(
2835 conn
->cli
, &ndr_table_netlogon
, NCACN_NP
,
2836 DCERPC_AUTH_LEVEL_PRIVACY
, domain
->name
, &netlogon_pipe
->dc
,
2837 &conn
->netlogon_pipe
);
2839 /* We can now close the initial netlogon pipe. */
2840 TALLOC_FREE(netlogon_pipe
);
2842 if (!NT_STATUS_IS_OK(result
)) {
2843 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2844 "was %s\n", nt_errstr(result
)));
2846 invalidate_cm_connection(conn
);
2851 * Always try netr_LogonSamLogonEx. We will fall back for NT4
2852 * which gives DCERPC_FAULT_OP_RNG_ERROR (function not
2853 * supported). We used to only try SamLogonEx for AD, but
2854 * Samba DCs can also do it. And because we don't distinguish
2855 * between Samba and NT4, always try it once.
2857 domain
->can_do_samlogon_ex
= true;
2859 *cli
= conn
->netlogon_pipe
;
2860 return NT_STATUS_OK
;
2863 void winbind_msg_ip_dropped(struct messaging_context
*msg_ctx
,
2866 struct server_id server_id
,
2869 struct winbindd_domain
*domain
;
2870 char *freeit
= NULL
;
2874 || (data
->data
== NULL
)
2875 || (data
->length
== 0)
2876 || (data
->data
[data
->length
-1] != '\0')) {
2877 DEBUG(1, ("invalid msg_ip_dropped message: not a valid "
2882 addr
= (char *)data
->data
;
2883 DEBUG(10, ("IP %s dropped\n", addr
));
2885 if (!is_ipaddress(addr
)) {
2888 * Some code sends us ip addresses with the /netmask
2891 slash
= strchr(addr
, '/');
2892 if (slash
== NULL
) {
2893 DEBUG(1, ("invalid msg_ip_dropped message: %s",
2897 freeit
= talloc_strndup(talloc_tos(), addr
, slash
-addr
);
2898 if (freeit
== NULL
) {
2899 DEBUG(1, ("talloc failed\n"));
2903 DEBUG(10, ("Stripped /netmask to IP %s\n", addr
));
2906 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
2907 char sockaddr
[INET6_ADDRSTRLEN
];
2909 if (!cli_state_is_connected(domain
->conn
.cli
)) {
2913 print_sockaddr(sockaddr
, sizeof(sockaddr
),
2914 smbXcli_conn_local_sockaddr(domain
->conn
.cli
->conn
));
2916 if (strequal(sockaddr
, addr
)) {
2917 smbXcli_conn_disconnect(domain
->conn
.cli
->conn
, NT_STATUS_OK
);
2920 TALLOC_FREE(freeit
);