release/src/router/samba3/source/nsswitch/wbinfo.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind status program.
   5
   6    Copyright (C) Tim Potter      2000-2003
   7    Copyright (C) Andrew Bartlett 2002
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26 #include "debug.h"
  27
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_WINBIND
  30
  31 extern int winbindd_fd;
  32
  33 static char winbind_separator_int(BOOL strict)
  34 {
  35         struct winbindd_response response;
  36         static BOOL got_sep;
  37         static char sep;
  38
  39         if (got_sep)
  40                 return sep;
  41
  42         ZERO_STRUCT(response);
  43
  44         /* Send off request */
  45
  46         if (winbindd_request_response(WINBINDD_INFO, NULL, &response) !=
  47             NSS_STATUS_SUCCESS) {
  48                 d_fprintf(stderr, "could not obtain winbind separator!\n");
  49                 if (strict) {
  50                         return 0;
  51                 }
  52                 /* HACK: (this module should not call lp_ funtions) */
  53                 return *lp_winbind_separator();
  54         }
  55
  56         sep = response.data.info.winbind_separator;
  57         got_sep = True;
  58
  59         if (!sep) {
  60                 d_fprintf(stderr, "winbind separator was NULL!\n");
  61                 if (strict) {
  62                         return 0;
  63                 }
  64                 /* HACK: (this module should not call lp_ funtions) */
  65                 sep = *lp_winbind_separator();
  66         }
  67
  68         return sep;
  69 }
  70
  71 static char winbind_separator(void)
  72 {
  73         return winbind_separator_int(False);
  74 }
  75
  76 static const char *get_winbind_domain(void)
  77 {
  78         struct winbindd_response response;
  79         static fstring winbind_domain;
  80
  81         ZERO_STRUCT(response);
  82
  83         /* Send off request */
  84
  85         if (winbindd_request_response(WINBINDD_DOMAIN_NAME, NULL, &response) !=
  86             NSS_STATUS_SUCCESS) {
  87                 d_fprintf(stderr, "could not obtain winbind domain name!\n");
  88
  89                 /* HACK: (this module should not call lp_ funtions) */
  90                 return lp_workgroup();
  91         }
  92
  93         fstrcpy(winbind_domain, response.data.domain_name);
  94
  95         return winbind_domain;
  96
  97 }
  98
  99 /* Copy of parse_domain_user from winbindd_util.c.  Parse a string of the
 100    form DOMAIN/user into a domain and a user */
 101
 102 static BOOL parse_wbinfo_domain_user(const char *domuser, fstring domain,
 103                                      fstring user)
 104 {
 105
 106         char *p = strchr(domuser,winbind_separator());
 107
 108         if (!p) {
 109                 fstrcpy(user, domuser);
 110                 fstrcpy(domain, get_winbind_domain());
 111                 return True;
 112         }
 113
 114         fstrcpy(user, p+1);
 115         fstrcpy(domain, domuser);
 116         domain[PTR_DIFF(p, domuser)] = 0;
 117         strupper_m(domain);
 118
 119         return True;
 120 }
 121
 122 /* pull pwent info for a given user */
 123
 124 static BOOL wbinfo_get_userinfo(char *user)
 125 {
 126         struct winbindd_request request;
 127         struct winbindd_response response;
 128         NSS_STATUS result;
 129
 130         ZERO_STRUCT(request);
 131         ZERO_STRUCT(response);
 132
 133         /* Send request */
 134
 135         fstrcpy(request.data.username, user);
 136
 137         result = winbindd_request_response(WINBINDD_GETPWNAM, &request, &response);
 138
 139         if (result != NSS_STATUS_SUCCESS)
 140                 return False;
 141
 142         d_printf( "%s:%s:%d:%d:%s:%s:%s\n",
 143                           response.data.pw.pw_name,
 144                           response.data.pw.pw_passwd,
 145                           response.data.pw.pw_uid,
 146                           response.data.pw.pw_gid,
 147                           response.data.pw.pw_gecos,
 148                           response.data.pw.pw_dir,
 149                           response.data.pw.pw_shell );
 150
 151         return True;
 152 }
 153
 154 /* List groups a user is a member of */
 155
 156 static BOOL wbinfo_get_usergroups(char *user)
 157 {
 158         struct winbindd_request request;
 159         struct winbindd_response response;
 160         NSS_STATUS result;
 161         int i;
 162
 163         ZERO_STRUCT(request);
 164         ZERO_STRUCT(response);
 165
 166         /* Send request */
 167
 168         fstrcpy(request.data.username, user);
 169
 170         result = winbindd_request_response(WINBINDD_GETGROUPS, &request, &response);
 171
 172         if (result != NSS_STATUS_SUCCESS)
 173                 return False;
 174
 175         for (i = 0; i < response.data.num_entries; i++)
 176                 d_printf("%d\n", (int)((gid_t *)response.extra_data.data)[i]);
 177
 178         SAFE_FREE(response.extra_data.data);
 179
 180         return True;
 181 }
 182
 183
 184 /* List group SIDs a user SID is a member of */
 185 static BOOL wbinfo_get_usersids(char *user_sid)
 186 {
 187         struct winbindd_request request;
 188         struct winbindd_response response;
 189         NSS_STATUS result;
 190         int i;
 191         const char *s;
 192
 193         ZERO_STRUCT(request);
 194         ZERO_STRUCT(response);
 195
 196         /* Send request */
 197         fstrcpy(request.data.sid, user_sid);
 198
 199         result = winbindd_request_response(WINBINDD_GETUSERSIDS, &request, &response);
 200
 201         if (result != NSS_STATUS_SUCCESS)
 202                 return False;
 203
 204         s = response.extra_data.data;
 205         for (i = 0; i < response.data.num_entries; i++) {
 206                 d_printf("%s\n", s);
 207                 s += strlen(s) + 1;
 208         }
 209
 210         SAFE_FREE(response.extra_data.data);
 211
 212         return True;
 213 }
 214
 215 static BOOL wbinfo_get_userdomgroups(const char *user_sid)
 216 {
 217         struct winbindd_request request;
 218         struct winbindd_response response;
 219         NSS_STATUS result;
 220
 221         ZERO_STRUCT(request);
 222         ZERO_STRUCT(response);
 223
 224         /* Send request */
 225         fstrcpy(request.data.sid, user_sid);
 226
 227         result = winbindd_request_response(WINBINDD_GETUSERDOMGROUPS, &request,
 228                                   &response);
 229
 230         if (result != NSS_STATUS_SUCCESS)
 231                 return False;
 232
 233         if (response.data.num_entries != 0)
 234                 printf("%s", (char *)response.extra_data.data);
 235
 236         SAFE_FREE(response.extra_data.data);
 237
 238         return True;
 239 }
 240
 241 /* Convert NetBIOS name to IP */
 242
 243 static BOOL wbinfo_wins_byname(char *name)
 244 {
 245         struct winbindd_request request;
 246         struct winbindd_response response;
 247
 248         ZERO_STRUCT(request);
 249         ZERO_STRUCT(response);
 250
 251         /* Send request */
 252
 253         fstrcpy(request.data.winsreq, name);
 254
 255         if (winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response) !=
 256             NSS_STATUS_SUCCESS) {
 257                 return False;
 258         }
 259
 260         /* Display response */
 261
 262         d_printf("%s\n", response.data.winsresp);
 263
 264         return True;
 265 }
 266
 267 /* Convert IP to NetBIOS name */
 268
 269 static BOOL wbinfo_wins_byip(char *ip)
 270 {
 271         struct winbindd_request request;
 272         struct winbindd_response response;
 273
 274         ZERO_STRUCT(request);
 275         ZERO_STRUCT(response);
 276
 277         /* Send request */
 278
 279         fstrcpy(request.data.winsreq, ip);
 280
 281         if (winbindd_request_response(WINBINDD_WINS_BYIP, &request, &response) !=
 282             NSS_STATUS_SUCCESS) {
 283                 return False;
 284         }
 285
 286         /* Display response */
 287
 288         d_printf("%s\n", response.data.winsresp);
 289
 290         return True;
 291 }
 292
 293 /* List trusted domains */
 294
 295 static BOOL wbinfo_list_domains(BOOL list_all_domains)
 296 {
 297         struct winbindd_request request;
 298         struct winbindd_response response;
 299
 300         ZERO_STRUCT(request);
 301         ZERO_STRUCT(response);
 302
 303         /* Send request */
 304
 305         request.data.list_all_domains = list_all_domains;
 306
 307         if (winbindd_request_response(WINBINDD_LIST_TRUSTDOM, &request, &response) !=
 308             NSS_STATUS_SUCCESS)
 309                 return False;
 310
 311         /* Display response */
 312
 313         if (response.extra_data.data) {
 314                 const char *extra_data = (char *)response.extra_data.data;
 315                 fstring name;
 316                 char *p;
 317
 318                 while(next_token(&extra_data, name, "\n", sizeof(fstring))) {
 319                         p = strchr(name, '\\');
 320                         if (p == 0) {
 321                                 d_fprintf(stderr, "Got invalid response: %s\n",
 322                                          extra_data);
 323                                 return False;
 324                         }
 325                         *p = 0;
 326                         d_printf("%s\n", name);
 327                 }
 328
 329                 SAFE_FREE(response.extra_data.data);
 330         }
 331
 332         return True;
 333 }
 334
 335 /* List own domain */
 336
 337 static BOOL wbinfo_list_own_domain(void)
 338 {
 339         d_printf("%s\n", get_winbind_domain());
 340
 341         return True;
 342 }
 343
 344 /* show sequence numbers */
 345 static BOOL wbinfo_show_sequence(const char *domain)
 346 {
 347         struct winbindd_request  request;
 348         struct winbindd_response response;
 349
 350         ZERO_STRUCT(response);
 351         ZERO_STRUCT(request);
 352
 353         if ( domain )
 354                 fstrcpy( request.domain_name, domain );
 355
 356         /* Send request */
 357
 358         if (winbindd_request_response(WINBINDD_SHOW_SEQUENCE, &request, &response) !=
 359             NSS_STATUS_SUCCESS)
 360                 return False;
 361
 362         /* Display response */
 363
 364         if (response.extra_data.data) {
 365                 char *extra_data = (char *)response.extra_data.data;
 366                 d_printf("%s", extra_data);
 367                 SAFE_FREE(response.extra_data.data);
 368         }
 369
 370         return True;
 371 }
 372
 373 /* Show domain info */
 374
 375 static BOOL wbinfo_domain_info(const char *domain_name)
 376 {
 377         struct winbindd_request request;
 378         struct winbindd_response response;
 379
 380         ZERO_STRUCT(request);
 381         ZERO_STRUCT(response);
 382
 383         fstrcpy(request.domain_name, domain_name);
 384
 385         /* Send request */
 386
 387         if (winbindd_request_response(WINBINDD_DOMAIN_INFO, &request, &response) !=
 388             NSS_STATUS_SUCCESS)
 389                 return False;
 390
 391         /* Display response */
 392
 393         d_printf("Name              : %s\n", response.data.domain_info.name);
 394         d_printf("Alt_Name          : %s\n", response.data.domain_info.alt_name);
 395
 396         d_printf("SID               : %s\n", response.data.domain_info.sid);
 397
 398         d_printf("Active Directory  : %s\n",
 399                  response.data.domain_info.active_directory ? "Yes" : "No");
 400         d_printf("Native            : %s\n",
 401                  response.data.domain_info.native_mode ? "Yes" : "No");
 402
 403         d_printf("Primary           : %s\n",
 404                  response.data.domain_info.primary ? "Yes" : "No");
 405
 406         d_printf("Sequence          : %d\n", response.data.domain_info.sequence_number);
 407
 408         return True;
 409 }
 410
 411 /* Get a foreign DC's name */
 412 static BOOL wbinfo_getdcname(const char *domain_name)
 413 {
 414         struct winbindd_request request;
 415         struct winbindd_response response;
 416
 417         ZERO_STRUCT(request);
 418         ZERO_STRUCT(response);
 419
 420         fstrcpy(request.domain_name, domain_name);
 421
 422         /* Send request */
 423
 424         if (winbindd_request_response(WINBINDD_GETDCNAME, &request, &response) !=
 425             NSS_STATUS_SUCCESS) {
 426                 d_fprintf(stderr, "Could not get dc name for %s\n", domain_name);
 427                 return False;
 428         }
 429
 430         /* Display response */
 431
 432         d_printf("%s\n", response.data.dc_name);
 433
 434         return True;
 435 }
 436
 437 /* Check trust account password */
 438
 439 static BOOL wbinfo_check_secret(void)
 440 {
 441         struct winbindd_response response;
 442         NSS_STATUS result;
 443
 444         ZERO_STRUCT(response);
 445
 446         result = winbindd_request_response(WINBINDD_CHECK_MACHACC, NULL, &response);
 447
 448         d_printf("checking the trust secret via RPC calls %s\n",
 449                  (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
 450
 451         if (result != NSS_STATUS_SUCCESS)
 452                 d_fprintf(stderr, "error code was %s (0x%x)\n",
 453                          response.data.auth.nt_status_string,
 454                          response.data.auth.nt_status);
 455
 456         return result == NSS_STATUS_SUCCESS;
 457 }
 458
 459 /* Convert uid to sid */
 460
 461 static BOOL wbinfo_uid_to_sid(uid_t uid)
 462 {
 463         struct winbindd_request request;
 464         struct winbindd_response response;
 465
 466         ZERO_STRUCT(request);
 467         ZERO_STRUCT(response);
 468
 469         /* Send request */
 470
 471         request.data.uid = uid;
 472
 473         if (winbindd_request_response(WINBINDD_UID_TO_SID, &request, &response) !=
 474             NSS_STATUS_SUCCESS)
 475                 return False;
 476
 477         /* Display response */
 478
 479         d_printf("%s\n", response.data.sid.sid);
 480
 481         return True;
 482 }
 483
 484 /* Convert gid to sid */
 485
 486 static BOOL wbinfo_gid_to_sid(gid_t gid)
 487 {
 488         struct winbindd_request request;
 489         struct winbindd_response response;
 490
 491         ZERO_STRUCT(request);
 492         ZERO_STRUCT(response);
 493
 494         /* Send request */
 495
 496         request.data.gid = gid;
 497
 498         if (winbindd_request_response(WINBINDD_GID_TO_SID, &request, &response) !=
 499             NSS_STATUS_SUCCESS)
 500                 return False;
 501
 502         /* Display response */
 503
 504         d_printf("%s\n", response.data.sid.sid);
 505
 506         return True;
 507 }
 508
 509 /* Convert sid to uid */
 510
 511 static BOOL wbinfo_sid_to_uid(char *sid)
 512 {
 513         struct winbindd_request request;
 514         struct winbindd_response response;
 515
 516         ZERO_STRUCT(request);
 517         ZERO_STRUCT(response);
 518
 519         /* Send request */
 520
 521         fstrcpy(request.data.sid, sid);
 522
 523         if (winbindd_request_response(WINBINDD_SID_TO_UID, &request, &response) !=
 524             NSS_STATUS_SUCCESS)
 525                 return False;
 526
 527         /* Display response */
 528
 529         d_printf("%d\n", (int)response.data.uid);
 530
 531         return True;
 532 }
 533
 534 static BOOL wbinfo_sid_to_gid(char *sid)
 535 {
 536         struct winbindd_request request;
 537         struct winbindd_response response;
 538
 539         ZERO_STRUCT(request);
 540         ZERO_STRUCT(response);
 541
 542         /* Send request */
 543
 544         fstrcpy(request.data.sid, sid);
 545
 546         if (winbindd_request_response(WINBINDD_SID_TO_GID, &request, &response) !=
 547             NSS_STATUS_SUCCESS)
 548                 return False;
 549
 550         /* Display response */
 551
 552         d_printf("%d\n", (int)response.data.gid);
 553
 554         return True;
 555 }
 556
 557 static BOOL wbinfo_allocate_uid(void)
 558 {
 559         uid_t uid;
 560
 561         if (!winbind_allocate_uid(&uid))
 562                 return False;
 563
 564         d_printf("New uid: %d\n", uid);
 565
 566         return True;
 567 }
 568
 569 static BOOL wbinfo_allocate_gid(void)
 570 {
 571         gid_t gid;
 572
 573         if (!winbind_allocate_gid(&gid))
 574                 return False;
 575
 576         d_printf("New gid: %d\n", gid);
 577
 578         return True;
 579 }
 580
 581 /* Convert sid to string */
 582
 583 static BOOL wbinfo_lookupsid(char *sid)
 584 {
 585         struct winbindd_request request;
 586         struct winbindd_response response;
 587
 588         ZERO_STRUCT(request);
 589         ZERO_STRUCT(response);
 590
 591         /* Send off request */
 592
 593         fstrcpy(request.data.sid, sid);
 594
 595         if (winbindd_request_response(WINBINDD_LOOKUPSID, &request, &response) !=
 596             NSS_STATUS_SUCCESS)
 597                 return False;
 598
 599         /* Display response */
 600
 601         d_printf("%s%c%s %d\n", response.data.name.dom_name,
 602                  winbind_separator(), response.data.name.name,
 603                  response.data.name.type);
 604
 605         return True;
 606 }
 607
 608 /* Convert string to sid */
 609
 610 static BOOL wbinfo_lookupname(char *name)
 611 {
 612         struct winbindd_request request;
 613         struct winbindd_response response;
 614
 615         /* Send off request */
 616
 617         ZERO_STRUCT(request);
 618         ZERO_STRUCT(response);
 619
 620         parse_wbinfo_domain_user(name, request.data.name.dom_name,
 621                                  request.data.name.name);
 622
 623         if (winbindd_request_response(WINBINDD_LOOKUPNAME, &request, &response) !=
 624             NSS_STATUS_SUCCESS)
 625                 return False;
 626
 627         /* Display response */
 628
 629         d_printf("%s %s (%d)\n", response.data.sid.sid, sid_type_lookup(response.data.sid.type), response.data.sid.type);
 630
 631         return True;
 632 }
 633
 634 /* Authenticate a user with a plaintext password */
 635
 636 static BOOL wbinfo_auth_krb5(char *username, const char *cctype, uint32 flags)
 637 {
 638         struct winbindd_request request;
 639         struct winbindd_response response;
 640         NSS_STATUS result;
 641         char *p;
 642
 643         /* Send off request */
 644
 645         ZERO_STRUCT(request);
 646         ZERO_STRUCT(response);
 647
 648         p = strchr(username, '%');
 649
 650         if (p) {
 651                 *p = 0;
 652                 fstrcpy(request.data.auth.user, username);
 653                 fstrcpy(request.data.auth.pass, p + 1);
 654                 *p = '%';
 655         } else
 656                 fstrcpy(request.data.auth.user, username);
 657
 658         request.flags = flags;
 659
 660         fstrcpy(request.data.auth.krb5_cc_type, cctype);
 661
 662         request.data.auth.uid = geteuid();
 663
 664         result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
 665
 666         /* Display response */
 667
 668         d_printf("plaintext kerberos password authentication for [%s] %s (requesting cctype: %s)\n",
 669                 username, (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed", cctype);
 670
 671         if (response.data.auth.nt_status)
 672                 d_fprintf(stderr, "error code was %s (0x%x)\nerror messsage was: %s\n",
 673                          response.data.auth.nt_status_string,
 674                          response.data.auth.nt_status,
 675                          response.data.auth.error_string);
 676
 677         if (result == NSS_STATUS_SUCCESS) {
 678
 679                 if (request.flags & WBFLAG_PAM_INFO3_TEXT) {
 680                         if (response.data.auth.info3.user_flgs & LOGON_CACHED_ACCOUNT) {
 681                                 d_printf("user_flgs: LOGON_CACHED_ACCOUNT\n");
 682                         }
 683                 }
 684
 685                 if (response.data.auth.krb5ccname[0] != '\0') {
 686                         d_printf("credentials were put in: %s\n", response.data.auth.krb5ccname);
 687                 } else {
 688                         d_printf("no credentials cached\n");
 689                 }
 690         }
 691
 692         return result == NSS_STATUS_SUCCESS;
 693 }
 694
 695 /* Authenticate a user with a plaintext password */
 696
 697 static BOOL wbinfo_auth(char *username)
 698 {
 699         struct winbindd_request request;
 700         struct winbindd_response response;
 701         NSS_STATUS result;
 702         char *p;
 703
 704         /* Send off request */
 705
 706         ZERO_STRUCT(request);
 707         ZERO_STRUCT(response);
 708
 709         p = strchr(username, '%');
 710
 711         if (p) {
 712                 *p = 0;
 713                 fstrcpy(request.data.auth.user, username);
 714                 fstrcpy(request.data.auth.pass, p + 1);
 715                 *p = '%';
 716         } else
 717                 fstrcpy(request.data.auth.user, username);
 718
 719         result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
 720
 721         /* Display response */
 722
 723         d_printf("plaintext password authentication %s\n",
 724                (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
 725
 726         if (response.data.auth.nt_status)
 727                 d_fprintf(stderr, "error code was %s (0x%x)\nerror messsage was: %s\n",
 728                          response.data.auth.nt_status_string,
 729                          response.data.auth.nt_status,
 730                          response.data.auth.error_string);
 731
 732         return result == NSS_STATUS_SUCCESS;
 733 }
 734
 735 /* Authenticate a user with a challenge/response */
 736
 737 static BOOL wbinfo_auth_crap(char *username)
 738 {
 739         struct winbindd_request request;
 740         struct winbindd_response response;
 741         NSS_STATUS result;
 742         fstring name_user;
 743         fstring name_domain;
 744         fstring pass;
 745         char *p;
 746
 747         /* Send off request */
 748
 749         ZERO_STRUCT(request);
 750         ZERO_STRUCT(response);
 751
 752         p = strchr(username, '%');
 753
 754         if (p) {
 755                 *p = 0;
 756                 fstrcpy(pass, p + 1);
 757         }
 758
 759         parse_wbinfo_domain_user(username, name_domain, name_user);
 760
 761         request.data.auth_crap.logon_parameters = MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT;
 762
 763         fstrcpy(request.data.auth_crap.user, name_user);
 764
 765         fstrcpy(request.data.auth_crap.domain,
 766                               name_domain);
 767
 768         generate_random_buffer(request.data.auth_crap.chal, 8);
 769
 770         if (lp_client_ntlmv2_auth()) {
 771                 DATA_BLOB server_chal;
 772                 DATA_BLOB names_blob;
 773
 774                 DATA_BLOB lm_response;
 775                 DATA_BLOB nt_response;
 776
 777                 server_chal = data_blob(request.data.auth_crap.chal, 8);
 778
 779                 /* Pretend this is a login to 'us', for blob purposes */
 780                 names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
 781
 782                 if (!SMBNTLMv2encrypt(name_user, name_domain, pass, &server_chal,
 783                                       &names_blob,
 784                                       &lm_response, &nt_response, NULL)) {
 785                         data_blob_free(&names_blob);
 786                         data_blob_free(&server_chal);
 787                         return False;
 788                 }
 789                 data_blob_free(&names_blob);
 790                 data_blob_free(&server_chal);
 791
 792                 memcpy(request.data.auth_crap.nt_resp, nt_response.data,
 793                        MIN(nt_response.length,
 794                            sizeof(request.data.auth_crap.nt_resp)));
 795                 request.data.auth_crap.nt_resp_len = nt_response.length;
 796
 797                 memcpy(request.data.auth_crap.lm_resp, lm_response.data,
 798                        MIN(lm_response.length,
 799                            sizeof(request.data.auth_crap.lm_resp)));
 800                 request.data.auth_crap.lm_resp_len = lm_response.length;
 801
 802                 data_blob_free(&nt_response);
 803                 data_blob_free(&lm_response);
 804
 805         } else {
 806                 if (lp_client_lanman_auth()
 807                     && SMBencrypt(pass, request.data.auth_crap.chal,
 808                                (uchar *)request.data.auth_crap.lm_resp)) {
 809                         request.data.auth_crap.lm_resp_len = 24;
 810                 } else {
 811                         request.data.auth_crap.lm_resp_len = 0;
 812                 }
 813                 SMBNTencrypt(pass, request.data.auth_crap.chal,
 814                              (uchar *)request.data.auth_crap.nt_resp);
 815
 816                 request.data.auth_crap.nt_resp_len = 24;
 817         }
 818
 819         result = winbindd_request_response(WINBINDD_PAM_AUTH_CRAP, &request, &response);
 820
 821         /* Display response */
 822
 823         d_printf("challenge/response password authentication %s\n",
 824                (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
 825
 826         if (response.data.auth.nt_status)
 827                 d_fprintf(stderr, "error code was %s (0x%x)\nerror messsage was: %s\n",
 828                          response.data.auth.nt_status_string,
 829                          response.data.auth.nt_status,
 830                          response.data.auth.error_string);
 831
 832         return result == NSS_STATUS_SUCCESS;
 833 }
 834
 835 /* Authenticate a user with a plaintext password and set a token */
 836
 837 static BOOL wbinfo_klog(char *username)
 838 {
 839         struct winbindd_request request;
 840         struct winbindd_response response;
 841         NSS_STATUS result;
 842         char *p;
 843
 844         /* Send off request */
 845
 846         ZERO_STRUCT(request);
 847         ZERO_STRUCT(response);
 848
 849         p = strchr(username, '%');
 850
 851         if (p) {
 852                 *p = 0;
 853                 fstrcpy(request.data.auth.user, username);
 854                 fstrcpy(request.data.auth.pass, p + 1);
 855                 *p = '%';
 856         } else {
 857                 fstrcpy(request.data.auth.user, username);
 858                 fstrcpy(request.data.auth.pass, getpass("Password: "));
 859         }
 860
 861         request.flags |= WBFLAG_PAM_AFS_TOKEN;
 862
 863         result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
 864
 865         /* Display response */
 866
 867         d_printf("plaintext password authentication %s\n",
 868                (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
 869
 870         if (response.data.auth.nt_status)
 871                 d_fprintf(stderr, "error code was %s (0x%x)\nerror messsage was: %s\n",
 872                          response.data.auth.nt_status_string,
 873                          response.data.auth.nt_status,
 874                          response.data.auth.error_string);
 875
 876         if (result != NSS_STATUS_SUCCESS)
 877                 return False;
 878
 879         if (response.extra_data.data == NULL) {
 880                 d_fprintf(stderr, "Did not get token data\n");
 881                 return False;
 882         }
 883
 884         if (!afs_settoken_str((char *)response.extra_data.data)) {
 885                 d_fprintf(stderr, "Could not set token\n");
 886                 return False;
 887         }
 888
 889         d_printf("Successfully created AFS token\n");
 890         return True;
 891 }
 892
 893 /* Print domain users */
 894
 895 static BOOL print_domain_users(const char *domain)
 896 {
 897         struct winbindd_request request;
 898         struct winbindd_response response;
 899         const char *extra_data;
 900         fstring name;
 901
 902         /* Send request to winbind daemon */
 903
 904         ZERO_STRUCT(request);
 905         ZERO_STRUCT(response);
 906
 907         if (domain) {
 908                 /* '.' is the special sign for our own domwin */
 909                 if ( strequal(domain, ".") )
 910                         fstrcpy( request.domain_name, lp_workgroup() );
 911                 else
 912                         fstrcpy( request.domain_name, domain );
 913         }
 914
 915         if (winbindd_request_response(WINBINDD_LIST_USERS, &request, &response) !=
 916             NSS_STATUS_SUCCESS)
 917                 return False;
 918
 919         /* Look through extra data */
 920
 921         if (!response.extra_data.data)
 922                 return False;
 923
 924         extra_data = (const char *)response.extra_data.data;
 925
 926         while(next_token(&extra_data, name, ",", sizeof(fstring)))
 927                 d_printf("%s\n", name);
 928
 929         SAFE_FREE(response.extra_data.data);
 930
 931         return True;
 932 }
 933
 934 /* Print domain groups */
 935
 936 static BOOL print_domain_groups(const char *domain)
 937 {
 938         struct winbindd_request  request;
 939         struct winbindd_response response;
 940         const char *extra_data;
 941         fstring name;
 942
 943         ZERO_STRUCT(request);
 944         ZERO_STRUCT(response);
 945
 946         if (domain) {
 947                 if ( strequal(domain, ".") )
 948                         fstrcpy( request.domain_name, lp_workgroup() );
 949                 else
 950                         fstrcpy( request.domain_name, domain );
 951         }
 952
 953         if (winbindd_request_response(WINBINDD_LIST_GROUPS, &request, &response) !=
 954             NSS_STATUS_SUCCESS)
 955                 return False;
 956
 957         /* Look through extra data */
 958
 959         if (!response.extra_data.data)
 960                 return False;
 961
 962         extra_data = (const char *)response.extra_data.data;
 963
 964         while(next_token(&extra_data, name, ",", sizeof(fstring)))
 965                 d_printf("%s\n", name);
 966
 967         SAFE_FREE(response.extra_data.data);
 968
 969         return True;
 970 }
 971
 972 /* Set the authorised user for winbindd access in secrets.tdb */
 973
 974 static BOOL wbinfo_set_auth_user(char *username)
 975 {
 976         const char *password;
 977         char *p;
 978         fstring user, domain;
 979
 980         /* Separate into user and password */
 981
 982         parse_wbinfo_domain_user(username, domain, user);
 983
 984         p = strchr(user, '%');
 985
 986         if (p != NULL) {
 987                 *p = 0;
 988                 password = p+1;
 989         } else {
 990                 char *thepass = getpass("Password: ");
 991                 if (thepass) {
 992                         password = thepass;
 993                 } else
 994                         password = "";
 995         }
 996
 997         /* Store or remove DOMAIN\username%password in secrets.tdb */
 998
 999         secrets_init();
1000
1001         if (user[0]) {
1002
1003                 if (!secrets_store(SECRETS_AUTH_USER, user,
1004                                    strlen(user) + 1)) {
1005                         d_fprintf(stderr, "error storing username\n");
1006                         return False;
1007                 }
1008
1009                 /* We always have a domain name added by the
1010                    parse_wbinfo_domain_user() function. */
1011
1012                 if (!secrets_store(SECRETS_AUTH_DOMAIN, domain,
1013                                    strlen(domain) + 1)) {
1014                         d_fprintf(stderr, "error storing domain name\n");
1015                         return False;
1016                 }
1017
1018         } else {
1019                 secrets_delete(SECRETS_AUTH_USER);
1020                 secrets_delete(SECRETS_AUTH_DOMAIN);
1021         }
1022
1023         if (password[0]) {
1024
1025                 if (!secrets_store(SECRETS_AUTH_PASSWORD, password,
1026                                    strlen(password) + 1)) {
1027                         d_fprintf(stderr, "error storing password\n");
1028                         return False;
1029                 }
1030
1031         } else
1032                 secrets_delete(SECRETS_AUTH_PASSWORD);
1033
1034         return True;
1035 }
1036
1037 static void wbinfo_get_auth_user(void)
1038 {
1039         char *user, *domain, *password;
1040
1041         /* Lift data from secrets file */
1042
1043         secrets_fetch_ipc_userpass(&user, &domain, &password);
1044
1045         if ((!user || !*user) && (!domain || !*domain ) && (!password || !*password)){
1046
1047                 SAFE_FREE(user);
1048                 SAFE_FREE(domain);
1049                 SAFE_FREE(password);
1050                 d_printf("No authorised user configured\n");
1051                 return;
1052         }
1053
1054         /* Pretty print authorised user info */
1055
1056         d_printf("%s%s%s%s%s\n", domain ? domain : "", domain ? lp_winbind_separator(): "",
1057                  user, password ? "%" : "", password ? password : "");
1058
1059         SAFE_FREE(user);
1060         SAFE_FREE(domain);
1061         SAFE_FREE(password);
1062 }
1063
1064 static BOOL wbinfo_ping(void)
1065 {
1066         NSS_STATUS result;
1067
1068         result = winbindd_request_response(WINBINDD_PING, NULL, NULL);
1069
1070         /* Display response */
1071
1072         d_printf("Ping to winbindd %s on fd %d\n",
1073                (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed", winbindd_fd);
1074
1075         return result == NSS_STATUS_SUCCESS;
1076 }
1077
1078 /* Main program */
1079
1080 enum {
1081         OPT_SET_AUTH_USER = 1000,
1082         OPT_GET_AUTH_USER,
1083         OPT_DOMAIN_NAME,
1084         OPT_SEQUENCE,
1085         OPT_GETDCNAME,
1086         OPT_USERDOMGROUPS,
1087         OPT_USERSIDS,
1088         OPT_ALLOCATE_UID,
1089         OPT_ALLOCATE_GID,
1090         OPT_SEPARATOR,
1091         OPT_LIST_ALL_DOMAINS,
1092         OPT_LIST_OWN_DOMAIN
1093 };
1094
1095 int main(int argc, char **argv)
1096 {
1097         int opt;
1098
1099         poptContext pc;
1100         static char *string_arg;
1101         static char *opt_domain_name;
1102         static int int_arg;
1103         int result = 1;
1104
1105         struct poptOption long_options[] = {
1106                 POPT_AUTOHELP
1107
1108                 /* longName, shortName, argInfo, argPtr, value, descrip,
1109                    argDesc */
1110
1111                 { "domain-users", 'u', POPT_ARG_NONE, 0, 'u', "Lists all domain users", "domain"},
1112                 { "domain-groups", 'g', POPT_ARG_NONE, 0, 'g', "Lists all domain groups", "domain" },
1113                 { "WINS-by-name", 'N', POPT_ARG_STRING, &string_arg, 'N', "Converts NetBIOS name to IP", "NETBIOS-NAME" },
1114                 { "WINS-by-ip", 'I', POPT_ARG_STRING, &string_arg, 'I', "Converts IP address to NetBIOS name", "IP" },
1115                 { "name-to-sid", 'n', POPT_ARG_STRING, &string_arg, 'n', "Converts name to sid", "NAME" },
1116                 { "sid-to-name", 's', POPT_ARG_STRING, &string_arg, 's', "Converts sid to name", "SID" },
1117                 { "uid-to-sid", 'U', POPT_ARG_INT, &int_arg, 'U', "Converts uid to sid" , "UID" },
1118                 { "gid-to-sid", 'G', POPT_ARG_INT, &int_arg, 'G', "Converts gid to sid", "GID" },
1119                 { "sid-to-uid", 'S', POPT_ARG_STRING, &string_arg, 'S', "Converts sid to uid", "SID" },
1120                 { "sid-to-gid", 'Y', POPT_ARG_STRING, &string_arg, 'Y', "Converts sid to gid", "SID" },
1121                 { "allocate-uid", 0, POPT_ARG_NONE, 0, OPT_ALLOCATE_UID,
1122                   "Get a new UID out of idmap" },
1123                 { "allocate-gid", 0, POPT_ARG_NONE, 0, OPT_ALLOCATE_GID,
1124                   "Get a new GID out of idmap" },
1125                 { "check-secret", 't', POPT_ARG_NONE, 0, 't', "Check shared secret" },
1126                 { "trusted-domains", 'm', POPT_ARG_NONE, 0, 'm', "List trusted domains" },
1127                 { "all-domains", 0, POPT_ARG_NONE, 0, OPT_LIST_ALL_DOMAINS, "List all domains (trusted and own domain)" },
1128                 { "own-domain", 0, POPT_ARG_NONE, 0, OPT_LIST_OWN_DOMAIN, "List own domain" },
1129                 { "sequence", 0, POPT_ARG_NONE, 0, OPT_SEQUENCE, "Show sequence numbers of all domains" },
1130                 { "domain-info", 'D', POPT_ARG_STRING, &string_arg, 'D', "Show most of the info we have about the domain" },
1131                 { "user-info", 'i', POPT_ARG_STRING, &string_arg, 'i', "Get user info", "USER" },
1132                 { "user-groups", 'r', POPT_ARG_STRING, &string_arg, 'r', "Get user groups", "USER" },
1133                 { "user-domgroups", 0, POPT_ARG_STRING, &string_arg,
1134                   OPT_USERDOMGROUPS, "Get user domain groups", "SID" },
1135                 { "user-sids", 0, POPT_ARG_STRING, &string_arg, OPT_USERSIDS, "Get user group sids for user SID", "SID" },
1136                 { "authenticate", 'a', POPT_ARG_STRING, &string_arg, 'a', "authenticate user", "user%password" },
1137                 { "set-auth-user", 0, POPT_ARG_STRING, &string_arg, OPT_SET_AUTH_USER, "Store user and password used by winbindd (root only)", "user%password" },
1138                 { "getdcname", 0, POPT_ARG_STRING, &string_arg, OPT_GETDCNAME,
1139                   "Get a DC name for a foreign domain", "domainname" },
1140                 { "get-auth-user", 0, POPT_ARG_NONE, NULL, OPT_GET_AUTH_USER, "Retrieve user and password used by winbindd (root only)", NULL },
1141                 { "ping", 'p', POPT_ARG_NONE, 0, 'p', "Ping winbindd to see if it is alive" },
1142                 { "domain", 0, POPT_ARG_STRING, &opt_domain_name, OPT_DOMAIN_NAME, "Define to the domain to restrict operation", "domain" },
1143 #ifdef WITH_FAKE_KASERVER
1144                 { "klog", 'k', POPT_ARG_STRING, &string_arg, 'k', "set an AFS token from winbind", "user%password" },
1145 #endif
1146 #ifdef HAVE_KRB5
1147                 { "krb5auth", 'K', POPT_ARG_STRING, &string_arg, 'K', "authenticate user using Kerberos", "user%password" },
1148                         /* destroys wbinfo --help output */
1149                         /* "user%password,DOM\\user%password,user@EXAMPLE.COM,EXAMPLE.COM\\user%password" }, */
1150 #endif
1151                 { "separator", 0, POPT_ARG_NONE, 0, OPT_SEPARATOR, "Get the active winbind separator", NULL },
1152                 POPT_COMMON_VERSION
1153                 POPT_TABLEEND
1154         };
1155
1156         /* Samba client initialisation */
1157         load_case_tables();
1158
1159         if (!lp_load(dyn_CONFIGFILE, True, False, False, True)) {
1160                 d_fprintf(stderr, "wbinfo: error opening config file %s. Error was %s\n",
1161                         dyn_CONFIGFILE, strerror(errno));
1162                 exit(1);
1163         }
1164
1165         if (!init_names())
1166                 return 1;
1167
1168         load_interfaces();
1169
1170         /* Parse options */
1171
1172         pc = poptGetContext("wbinfo", argc, (const char **)argv, long_options, 0);
1173
1174         /* Parse command line options */
1175
1176         if (argc == 1) {
1177                 poptPrintHelp(pc, stderr, 0);
1178                 return 1;
1179         }
1180
1181         while((opt = poptGetNextOpt(pc)) != -1) {
1182                 /* get the generic configuration parameters like --domain */
1183         }
1184
1185         poptFreeContext(pc);
1186
1187         pc = poptGetContext(NULL, argc, (const char **)argv, long_options,
1188                             POPT_CONTEXT_KEEP_FIRST);
1189
1190         while((opt = poptGetNextOpt(pc)) != -1) {
1191                 switch (opt) {
1192                 case 'u':
1193                         if (!print_domain_users(opt_domain_name)) {
1194                                 d_fprintf(stderr, "Error looking up domain users\n");
1195                                 goto done;
1196                         }
1197                         break;
1198                 case 'g':
1199                         if (!print_domain_groups(opt_domain_name)) {
1200                                 d_fprintf(stderr, "Error looking up domain groups\n");
1201                                 goto done;
1202                         }
1203                         break;
1204                 case 's':
1205                         if (!wbinfo_lookupsid(string_arg)) {
1206                                 d_fprintf(stderr, "Could not lookup sid %s\n", string_arg);
1207                                 goto done;
1208                         }
1209                         break;
1210                 case 'n':
1211                         if (!wbinfo_lookupname(string_arg)) {
1212                                 d_fprintf(stderr, "Could not lookup name %s\n", string_arg);
1213                                 goto done;
1214                         }
1215                         break;
1216                 case 'N':
1217                         if (!wbinfo_wins_byname(string_arg)) {
1218                                 d_fprintf(stderr, "Could not lookup WINS by name %s\n", string_arg);
1219                                 goto done;
1220                         }
1221                         break;
1222                 case 'I':
1223                         if (!wbinfo_wins_byip(string_arg)) {
1224                                 d_fprintf(stderr, "Could not lookup WINS by IP %s\n", string_arg);
1225                                 goto done;
1226                         }
1227                         break;
1228                 case 'U':
1229                         if (!wbinfo_uid_to_sid(int_arg)) {
1230                                 d_fprintf(stderr, "Could not convert uid %d to sid\n", int_arg);
1231                                 goto done;
1232                         }
1233                         break;
1234                 case 'G':
1235                         if (!wbinfo_gid_to_sid(int_arg)) {
1236                                 d_fprintf(stderr, "Could not convert gid %d to sid\n",
1237                                        int_arg);
1238                                 goto done;
1239                         }
1240                         break;
1241                 case 'S':
1242                         if (!wbinfo_sid_to_uid(string_arg)) {
1243                                 d_fprintf(stderr, "Could not convert sid %s to uid\n",
1244                                        string_arg);
1245                                 goto done;
1246                         }
1247                         break;
1248                 case 'Y':
1249                         if (!wbinfo_sid_to_gid(string_arg)) {
1250                                 d_fprintf(stderr, "Could not convert sid %s to gid\n",
1251                                        string_arg);
1252                                 goto done;
1253                         }
1254                         break;
1255                 case OPT_ALLOCATE_UID:
1256                         if (!wbinfo_allocate_uid()) {
1257                                 d_fprintf(stderr, "Could not allocate a uid\n");
1258                                 goto done;
1259                         }
1260                         break;
1261                 case OPT_ALLOCATE_GID:
1262                         if (!wbinfo_allocate_gid()) {
1263                                 d_fprintf(stderr, "Could not allocate a gid\n");
1264                                 goto done;
1265                         }
1266                         break;
1267                 case 't':
1268                         if (!wbinfo_check_secret()) {
1269                                 d_fprintf(stderr, "Could not check secret\n");
1270                                 goto done;
1271                         }
1272                         break;
1273                 case 'm':
1274                         if (!wbinfo_list_domains(False)) {
1275                                 d_fprintf(stderr, "Could not list trusted domains\n");
1276                                 goto done;
1277                         }
1278                         break;
1279                 case OPT_SEQUENCE:
1280                         if (!wbinfo_show_sequence(opt_domain_name)) {
1281                                 d_fprintf(stderr, "Could not show sequence numbers\n");
1282                                 goto done;
1283                         }
1284                         break;
1285                 case 'D':
1286                         if (!wbinfo_domain_info(string_arg)) {
1287                                 d_fprintf(stderr, "Could not get domain info\n");
1288                                 goto done;
1289                         }
1290                         break;
1291                 case 'i':
1292                         if (!wbinfo_get_userinfo(string_arg)) {
1293                                 d_fprintf(stderr, "Could not get info for user %s\n",
1294                                                   string_arg);
1295                                 goto done;
1296                         }
1297                         break;
1298                 case 'r':
1299                         if (!wbinfo_get_usergroups(string_arg)) {
1300                                 d_fprintf(stderr, "Could not get groups for user %s\n",
1301                                        string_arg);
1302                                 goto done;
1303                         }
1304                         break;
1305                 case OPT_USERSIDS:
1306                         if (!wbinfo_get_usersids(string_arg)) {
1307                                 d_fprintf(stderr, "Could not get group SIDs for user SID %s\n",
1308                                        string_arg);
1309                                 goto done;
1310                         }
1311                         break;
1312                 case OPT_USERDOMGROUPS:
1313                         if (!wbinfo_get_userdomgroups(string_arg)) {
1314                                 d_fprintf(stderr, "Could not get user's domain groups "
1315                                          "for user SID %s\n", string_arg);
1316                                 goto done;
1317                         }
1318                         break;
1319                 case 'a': {
1320                                 BOOL got_error = False;
1321
1322                                 if (!wbinfo_auth(string_arg)) {
1323                                         d_fprintf(stderr, "Could not authenticate user %s with "
1324                                                 "plaintext password\n", string_arg);
1325                                         got_error = True;
1326                                 }
1327
1328                                 if (!wbinfo_auth_crap(string_arg)) {
1329                                         d_fprintf(stderr, "Could not authenticate user %s with "
1330                                                 "challenge/response\n", string_arg);
1331                                         got_error = True;
1332                                 }
1333
1334                                 if (got_error)
1335                                         goto done;
1336                                 break;
1337                         }
1338                 case 'K': {
1339                                 BOOL got_error = False;
1340                                 uint32 flags =  WBFLAG_PAM_KRB5 |
1341                                                 WBFLAG_PAM_CACHED_LOGIN |
1342                                                 WBFLAG_PAM_FALLBACK_AFTER_KRB5 |
1343                                                 WBFLAG_PAM_INFO3_TEXT;
1344                                 fstring tok;
1345                                 int i;
1346                                 const char *arg[] = { NULL, NULL };
1347                                 const char *cctypes[] = { "FILE",
1348                                                           "KCM",
1349                                                           "KCM:0",
1350                                                           "Garbage",
1351                                                           NULL,
1352                                                           "0"};
1353
1354                                 arg[0] = string_arg;
1355
1356                                 while (next_token(arg, tok, LIST_SEP, sizeof(tok))) {
1357
1358                                         for (i=0; i < ARRAY_SIZE(cctypes); i++) {
1359                                                 if (!wbinfo_auth_krb5(tok, cctypes[i], flags)) {
1360                                                         d_fprintf(stderr, "Could not authenticate user [%s] with "
1361                                                                 "Kerberos (ccache: %s)\n", tok, cctypes[i]);
1362                                                         got_error = True;
1363                                                 }
1364                                         }
1365                                 }
1366
1367                                 if (got_error)
1368                                         goto done;
1369
1370                                 break;
1371                         }
1372                 case 'k':
1373                         if (!wbinfo_klog(string_arg)) {
1374                                 d_fprintf(stderr, "Could not klog user\n");
1375                                 goto done;
1376                         }
1377                         break;
1378                 case 'p':
1379                         if (!wbinfo_ping()) {
1380                                 d_fprintf(stderr, "could not ping winbindd!\n");
1381                                 goto done;
1382                         }
1383                         break;
1384                 case OPT_SET_AUTH_USER:
1385                         if (!wbinfo_set_auth_user(string_arg)) {
1386                                 goto done;
1387                         }
1388                         break;
1389                 case OPT_GET_AUTH_USER:
1390                         wbinfo_get_auth_user();
1391                         break;
1392                 case OPT_GETDCNAME:
1393                         if (!wbinfo_getdcname(string_arg)) {
1394                                 goto done;
1395                         }
1396                         break;
1397                 case OPT_SEPARATOR: {
1398                         const char sep = winbind_separator_int(True);
1399                         if ( !sep ) {
1400                                 goto done;
1401                         }
1402                         d_printf("%c\n", sep);
1403                         break;
1404                 }
1405                 case OPT_LIST_ALL_DOMAINS:
1406                         if (!wbinfo_list_domains(True)) {
1407                                 goto done;
1408                         }
1409                         break;
1410                 case OPT_LIST_OWN_DOMAIN:
1411                         if (!wbinfo_list_own_domain()) {
1412                                 goto done;
1413                         }
1414                         break;
1415                 /* generic configuration options */
1416                 case OPT_DOMAIN_NAME:
1417                         break;
1418                 default:
1419                         d_fprintf(stderr, "Invalid option\n");
1420                         poptPrintHelp(pc, stderr, 0);
1421                         goto done;
1422                 }
1423         }
1424
1425         result = 0;
1426
1427         /* Exit code */
1428
1429  done:
1430         poptFreeContext(pc);
1431         return result;
1432 }