2 Unix SMB/CIFS implementation.
4 A composite API for initializing a domain
6 Copyright (C) Volker Lendecke 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "libcli/composite/composite.h"
25 #include "libcli/smb_composite/smb_composite.h"
26 #include "winbind/wb_async_helpers.h"
27 #include "winbind/wb_server.h"
28 #include "smbd/service_stream.h"
29 #include "smbd/service_task.h"
30 #include "dlinklist.h"
32 #include "librpc/gen_ndr/nbt.h"
33 #include "librpc/gen_ndr/samr.h"
34 #include "lib/messaging/irpc.h"
35 #include "librpc/gen_ndr/irpc.h"
36 #include "librpc/gen_ndr/ndr_irpc.h"
37 #include "libcli/raw/libcliraw.h"
38 #include "librpc/gen_ndr/ndr_netlogon.h"
39 #include "librpc/gen_ndr/ndr_lsa.h"
40 #include "libcli/auth/credentials.h"
42 #include "libcli/ldap/ldap_client.h"
46 * Initialize a domain:
48 * - With schannel credentials, try to open the SMB connection with the
49 * machine creds. This works against W2k3SP1 with an NTLMSSP session
50 * setup. Fall back to anonymous.
52 * - If we have schannel creds, do the auth2 and open the schannel'ed netlogon
55 * - Open LSA. If we have machine creds, try to open with ntlmssp. Fall back
56 * to schannel and then to anon bind.
58 * - With queryinfopolicy, verify that we're talking to the right domain
60 * A bit complex, but with all the combinations I think it's the best we can
61 * get. NT4, W2k3 and W2k all have different combinations, but in the end we
62 * have a signed&sealed lsa connection on all of them.
64 * Not sure if it is overkill, but it seems to work.
67 struct init_domain_state {
68 struct composite_context *ctx;
69 struct wbsrv_domain *domain;
70 struct wbsrv_service *service;
72 struct smb_composite_connect conn;
74 struct lsa_QueryInfoPolicy queryinfo;
77 static void init_domain_recv_tree(struct composite_context *ctx);
78 static void init_domain_recv_netlogoncreds(struct composite_context *ctx);
79 static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
80 static void init_domain_recv_schannel(struct composite_context *ctx);
81 static void init_domain_recv_lsa(struct composite_context *ctx);
82 static void init_domain_recv_queryinfo(struct rpc_request *req);
83 static void init_domain_recv_ldapconn(struct composite_context *ctx);
84 static void init_domain_recv_samr(struct composite_context *ctx);
86 struct composite_context *wb_init_domain_send(TALLOC_CTX *mem_ctx,
87 struct wbsrv_service *service,
88 struct wb_dom_info *dom_info)
90 struct composite_context *result, *ctx;
91 struct init_domain_state *state;
93 result = talloc(mem_ctx, struct composite_context);
94 if (result == NULL) goto failed;
95 result->state = COMPOSITE_STATE_IN_PROGRESS;
96 result->async.fn = NULL;
97 result->event_ctx = service->task->event_ctx;
99 state = talloc_zero(result, struct init_domain_state);
100 if (state == NULL) goto failed;
102 result->private_data = state;
104 state->service = service;
106 state->domain = talloc(state, struct wbsrv_domain);
107 if (state->domain == NULL) goto failed;
109 state->domain->info = talloc_reference(state->domain, dom_info);
110 if (state->domain->info == NULL) goto failed;
112 state->domain->schannel_creds = cli_credentials_init(state->domain);
113 if (state->domain->schannel_creds == NULL) goto failed;
115 cli_credentials_set_conf(state->domain->schannel_creds);
117 cli_credentials_set_machine_account(state->domain->
119 if (!NT_STATUS_IS_OK(state->ctx->status)) goto failed;
121 state->conn.in.dest_host = dom_info->dc_address;
122 state->conn.in.port = 0;
123 state->conn.in.called_name = dom_info->dc_name;
124 state->conn.in.service = "IPC$";
125 state->conn.in.service_type = "IPC";
126 state->conn.in.workgroup = dom_info->name;
127 state->conn.in.credentials = state->domain->schannel_creds;
129 state->conn.in.fallback_to_anonymous = True;
131 ctx = smb_composite_connect_send(&state->conn, state->domain,
133 if (ctx == NULL) goto failed;
135 ctx->async.fn = init_domain_recv_tree;
136 ctx->async.private_data = state;
144 static void init_domain_recv_tree(struct composite_context *ctx)
146 struct init_domain_state *state =
147 talloc_get_type(ctx->async.private_data,
148 struct init_domain_state);
149 state->ctx->status = smb_composite_connect_recv(ctx, state);
150 if (!composite_is_ok(state->ctx)) return;
152 if ((state->domain->schannel_creds != NULL) &&
153 (!cli_credentials_is_anonymous(state->domain->schannel_creds)) &&
154 ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
155 (dom_sid_equal(state->domain->info->sid,
156 state->service->primary_sid)))) {
157 ctx = wb_get_schannel_creds_send(state,
158 state->domain->schannel_creds,
159 state->conn.out.tree,
160 state->ctx->event_ctx);
161 composite_continue(state->ctx, ctx,
162 init_domain_recv_netlogoncreds, state);
166 ctx = wb_connect_lsa_send(state, state->conn.out.tree, NULL);
167 composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
170 static void init_domain_recv_netlogoncreds(struct composite_context *ctx)
172 struct init_domain_state *state =
173 talloc_get_type(ctx->async.private_data,
174 struct init_domain_state);
175 struct dcerpc_pipe *auth2_pipe;
176 struct smbcli_tree *tree = NULL;
179 wb_get_schannel_creds_recv(ctx, state, &auth2_pipe);
180 if (!composite_is_ok(state->ctx)) return;
182 if (!lp_winbind_sealed_pipes()) {
183 state->domain->netlogon_pipe = talloc_reference(state->domain,
185 ctx = wb_connect_lsa_send(state, state->conn.out.tree, NULL);
186 composite_continue(state->ctx, ctx, init_domain_recv_lsa,
191 state->domain->netlogon_pipe =
192 dcerpc_pipe_init(state->domain, state->ctx->event_ctx);
193 if (composite_nomem(state->domain->netlogon_pipe, state->ctx)) return;
195 tree = dcerpc_smb_tree(auth2_pipe->conn);
197 composite_error(state->ctx, NT_STATUS_INTERNAL_ERROR);
201 ctx = dcerpc_pipe_open_smb_send(state->domain->netlogon_pipe->conn,
203 composite_continue(state->ctx, ctx, init_domain_recv_netlogonpipe,
207 static void init_domain_recv_netlogonpipe(struct composite_context *ctx)
209 struct init_domain_state *state =
210 talloc_get_type(ctx->async.private_data,
211 struct init_domain_state);
213 state->ctx->status = dcerpc_pipe_open_smb_recv(ctx);
214 if (!composite_is_ok(state->ctx)) return;
216 state->domain->netlogon_pipe->conn->flags |=
217 (DCERPC_SIGN | DCERPC_SEAL);
218 ctx = dcerpc_bind_auth_send(state, state->domain->netlogon_pipe,
219 DCERPC_NETLOGON_UUID,
220 DCERPC_NETLOGON_VERSION,
221 state->domain->schannel_creds,
222 DCERPC_AUTH_TYPE_SCHANNEL,
224 composite_continue(state->ctx, ctx, init_domain_recv_schannel, state);
227 static void init_domain_recv_schannel(struct composite_context *ctx)
229 struct init_domain_state *state =
230 talloc_get_type(ctx->async.private_data,
231 struct init_domain_state);
233 state->ctx->status = dcerpc_bind_auth_recv(ctx);
234 if (!composite_is_ok(state->ctx)) return;
236 ctx = wb_connect_lsa_send(state, state->conn.out.tree,
237 state->domain->schannel_creds);
238 composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
241 static void init_domain_recv_lsa(struct composite_context *ctx)
243 struct init_domain_state *state =
244 talloc_get_type(ctx->async.private_data,
245 struct init_domain_state);
247 struct rpc_request *req;
249 state->ctx->status = wb_connect_lsa_recv(ctx, state->domain,
250 &state->domain->lsa_auth_type,
251 &state->domain->lsa_pipe,
252 &state->domain->lsa_policy);
253 if (!composite_is_ok(state->ctx)) return;
255 /* Give the tree to the pipes. */
256 talloc_unlink(state, state->conn.out.tree);
258 state->queryinfo.in.handle = state->domain->lsa_policy;
259 state->queryinfo.in.level = LSA_POLICY_INFO_ACCOUNT_DOMAIN;
261 req = dcerpc_lsa_QueryInfoPolicy_send(state->domain->lsa_pipe, state,
263 composite_continue_rpc(state->ctx, req,
264 init_domain_recv_queryinfo, state);
267 static void init_domain_recv_queryinfo(struct rpc_request *req)
269 struct init_domain_state *state =
270 talloc_get_type(req->async.private, struct init_domain_state);
271 struct lsa_DomainInfo *dominfo;
272 struct composite_context *ctx;
273 const char *ldap_url;
275 state->ctx->status = dcerpc_ndr_request_recv(req);
276 if (!composite_is_ok(state->ctx)) return;
277 state->ctx->status = state->queryinfo.out.result;
278 if (!composite_is_ok(state->ctx)) return;
280 dominfo = &state->queryinfo.out.info->account_domain;
282 if (strcasecmp(state->domain->info->name, dominfo->name.string) != 0) {
283 DEBUG(2, ("Expected domain name %s, DC %s said %s\n",
284 state->domain->info->name,
285 dcerpc_server_name(state->domain->lsa_pipe),
286 dominfo->name.string));
287 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
291 if (!dom_sid_equal(state->domain->info->sid, dominfo->sid)) {
292 DEBUG(2, ("Expected domain sid %s, DC %s said %s\n",
293 dom_sid_string(state, state->domain->info->sid),
294 dcerpc_server_name(state->domain->lsa_pipe),
295 dom_sid_string(state, dominfo->sid)));
296 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
300 state->domain->ldap_conn =
301 ldap_new_connection(state->domain, state->ctx->event_ctx);
302 composite_nomem(state->domain->ldap_conn, state->ctx);
304 ldap_url = talloc_asprintf(state, "ldap://%s/",
305 state->domain->info->dc_address);
306 composite_nomem(ldap_url, state->ctx);
308 ctx = ldap_connect_send(state->domain->ldap_conn, ldap_url);
309 composite_continue(state->ctx, ctx, init_domain_recv_ldapconn, state);
312 static void init_domain_recv_ldapconn(struct composite_context *ctx)
314 struct init_domain_state *state =
315 talloc_get_type(ctx->async.private_data,
316 struct init_domain_state);
318 state->ctx->status = ldap_connect_recv(ctx);
319 if (NT_STATUS_IS_OK(state->ctx->status)) {
320 state->domain->ldap_conn->host =
321 talloc_strdup(state->domain->ldap_conn,
322 state->domain->info->dc_name);
324 ldap_bind_sasl(state->domain->ldap_conn,
325 state->domain->schannel_creds);
326 DEBUG(0, ("ldap_bind returned %s\n",
327 nt_errstr(state->ctx->status)));
330 state->domain->samr_pipe =
331 dcerpc_pipe_init(state->domain, state->ctx->event_ctx);
332 if (composite_nomem(state->domain->samr_pipe, state->ctx)) return;
334 ctx = wb_connect_sam_send(state, state->conn.out.tree,
335 state->domain->lsa_auth_type,
336 state->domain->schannel_creds,
337 state->domain->info->sid);
338 composite_continue(state->ctx, ctx, init_domain_recv_samr, state);
341 static void init_domain_recv_samr(struct composite_context *ctx)
343 struct init_domain_state *state =
344 talloc_get_type(ctx->async.private_data,
345 struct init_domain_state);
347 state->ctx->status = wb_connect_sam_recv(
348 ctx, state->domain, &state->domain->samr_pipe,
349 &state->domain->samr_handle, &state->domain->domain_handle);
350 if (!composite_is_ok(state->ctx)) return;
352 composite_done(state->ctx);
355 NTSTATUS wb_init_domain_recv(struct composite_context *c,
357 struct wbsrv_domain **result)
359 NTSTATUS status = composite_wait(c);
360 if (NT_STATUS_IS_OK(status)) {
361 struct init_domain_state *state =
362 talloc_get_type(c->private_data,
363 struct init_domain_state);
364 *result = talloc_steal(mem_ctx, state->domain);
370 NTSTATUS wb_init_domain(TALLOC_CTX *mem_ctx, struct wbsrv_service *service,
371 struct wb_dom_info *dom_info,
372 struct wbsrv_domain **result)
374 struct composite_context *c =
375 wb_init_domain_send(mem_ctx, service, dom_info);
376 return wb_init_domain_recv(c, mem_ctx, result);