source4/winbind/wb_init_domain.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    A composite API for initializing a domain
   5
   6    Copyright (C) Volker Lendecke 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/composite/composite.h"
  25 #include "libcli/smb_composite/smb_composite.h"
  26 #include "winbind/wb_async_helpers.h"
  27 #include "winbind/wb_server.h"
  28 #include "smbd/service_stream.h"
  29 #include "smbd/service_task.h"
  30 #include "dlinklist.h"
  31
  32 #include "librpc/gen_ndr/nbt.h"
  33 #include "librpc/gen_ndr/samr.h"
  34 #include "lib/messaging/irpc.h"
  35 #include "librpc/gen_ndr/irpc.h"
  36 #include "librpc/gen_ndr/ndr_irpc.h"
  37 #include "libcli/raw/libcliraw.h"
  38 #include "librpc/gen_ndr/ndr_netlogon.h"
  39 #include "librpc/gen_ndr/ndr_lsa.h"
  40 #include "libcli/auth/credentials.h"
  41
  42 #include "libcli/ldap/ldap_client.h"
  43
  44
  45 /*
  46  * Initialize a domain:
  47  *
  48  * - With schannel credentials, try to open the SMB connection with the
  49  *   machine creds. This works against W2k3SP1 with an NTLMSSP session
  50  *   setup. Fall back to anonymous.
  51  *
  52  * - If we have schannel creds, do the auth2 and open the schannel'ed netlogon
  53  *   pipe.
  54  *
  55  * - Open LSA. If we have machine creds, try to open with ntlmssp. Fall back
  56  *   to schannel and then to anon bind.
  57  *
  58  * - With queryinfopolicy, verify that we're talking to the right domain
  59  *
  60  * A bit complex, but with all the combinations I think it's the best we can
  61  * get. NT4, W2k3 and W2k all have different combinations, but in the end we
  62  * have a signed&sealed lsa connection on all of them.
  63  *
  64  * Not sure if it is overkill, but it seems to work.
  65  */
  66
  67 struct init_domain_state {
  68         struct composite_context *ctx;
  69         struct wbsrv_domain *domain;
  70         struct wbsrv_service *service;
  71
  72         struct smb_composite_connect conn;
  73
  74         struct lsa_QueryInfoPolicy queryinfo;
  75 };
  76
  77 static void init_domain_recv_tree(struct composite_context *ctx);
  78 static void init_domain_recv_netlogoncreds(struct composite_context *ctx);
  79 static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
  80 static void init_domain_recv_schannel(struct composite_context *ctx);
  81 static void init_domain_recv_lsa(struct composite_context *ctx);
  82 static void init_domain_recv_queryinfo(struct rpc_request *req);
  83 static void init_domain_recv_ldapconn(struct composite_context *ctx);
  84 static void init_domain_recv_samr(struct composite_context *ctx);
  85
  86 struct composite_context *wb_init_domain_send(TALLOC_CTX *mem_ctx,
  87                                               struct wbsrv_service *service,
  88                                               struct wb_dom_info *dom_info)
  89 {
  90         struct composite_context *result, *ctx;
  91         struct init_domain_state *state;
  92
  93         result = talloc(mem_ctx, struct composite_context);
  94         if (result == NULL) goto failed;
  95         result->state = COMPOSITE_STATE_IN_PROGRESS;
  96         result->async.fn = NULL;
  97         result->event_ctx = service->task->event_ctx;
  98
  99         state = talloc_zero(result, struct init_domain_state);
 100         if (state == NULL) goto failed;
 101         state->ctx = result;
 102         result->private_data = state;
 103
 104         state->service = service;
 105
 106         state->domain = talloc(state, struct wbsrv_domain);
 107         if (state->domain == NULL) goto failed;
 108
 109         state->domain->info = talloc_reference(state->domain, dom_info);
 110         if (state->domain->info == NULL) goto failed;
 111
 112         state->domain->schannel_creds = cli_credentials_init(state->domain);
 113         if (state->domain->schannel_creds == NULL) goto failed;
 114
 115         cli_credentials_set_conf(state->domain->schannel_creds);
 116         state->ctx->status =
 117                 cli_credentials_set_machine_account(state->domain->
 118                                                     schannel_creds);
 119         if (!NT_STATUS_IS_OK(state->ctx->status)) goto failed;
 120
 121         state->conn.in.dest_host = dom_info->dc_address;
 122         state->conn.in.port = 0;
 123         state->conn.in.called_name = dom_info->dc_name;
 124         state->conn.in.service = "IPC$";
 125         state->conn.in.service_type = "IPC";
 126         state->conn.in.workgroup = dom_info->name;
 127         state->conn.in.credentials = state->domain->schannel_creds;
 128
 129         state->conn.in.fallback_to_anonymous = True;
 130
 131         ctx = smb_composite_connect_send(&state->conn, state->domain,
 132                                          result->event_ctx);
 133         if (ctx == NULL) goto failed;
 134
 135         ctx->async.fn = init_domain_recv_tree;
 136         ctx->async.private_data = state;
 137         return result;
 138
 139  failed:
 140         talloc_free(result);
 141         return NULL;
 142 }
 143
 144 static void init_domain_recv_tree(struct composite_context *ctx)
 145 {
 146         struct init_domain_state *state =
 147                 talloc_get_type(ctx->async.private_data,
 148                                 struct init_domain_state);
 149         state->ctx->status = smb_composite_connect_recv(ctx, state);
 150         if (!composite_is_ok(state->ctx)) return;
 151
 152         if ((state->domain->schannel_creds != NULL) &&
 153             (!cli_credentials_is_anonymous(state->domain->schannel_creds)) &&
 154             ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
 155              (dom_sid_equal(state->domain->info->sid,
 156                             state->service->primary_sid)))) {
 157                 ctx = wb_get_schannel_creds_send(state,
 158                                                  state->domain->schannel_creds,
 159                                                  state->conn.out.tree,
 160                                                  state->ctx->event_ctx);
 161                 composite_continue(state->ctx, ctx,
 162                                    init_domain_recv_netlogoncreds, state);
 163                 return;
 164         }
 165
 166         ctx = wb_connect_lsa_send(state, state->conn.out.tree, NULL);
 167         composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
 168 }
 169
 170 static void init_domain_recv_netlogoncreds(struct composite_context *ctx)
 171 {
 172         struct init_domain_state *state =
 173                 talloc_get_type(ctx->async.private_data,
 174                                 struct init_domain_state);
 175         struct dcerpc_pipe *auth2_pipe;
 176         struct smbcli_tree *tree = NULL;
 177
 178         state->ctx->status =
 179                 wb_get_schannel_creds_recv(ctx, state, &auth2_pipe);
 180         if (!composite_is_ok(state->ctx)) return;
 181
 182         if (!lp_winbind_sealed_pipes()) {
 183                 state->domain->netlogon_pipe = talloc_reference(state->domain,
 184                                                                 auth2_pipe);
 185                 ctx = wb_connect_lsa_send(state, state->conn.out.tree, NULL);
 186                 composite_continue(state->ctx, ctx, init_domain_recv_lsa,
 187                                    state);
 188                 return;
 189         }
 190
 191         state->domain->netlogon_pipe =
 192                 dcerpc_pipe_init(state->domain, state->ctx->event_ctx);
 193         if (composite_nomem(state->domain->netlogon_pipe, state->ctx)) return;
 194
 195         tree = dcerpc_smb_tree(auth2_pipe->conn);
 196         if (tree == NULL) {
 197                 composite_error(state->ctx, NT_STATUS_INTERNAL_ERROR);
 198                 return;
 199         }
 200
 201         ctx = dcerpc_pipe_open_smb_send(state->domain->netlogon_pipe->conn,
 202                                         tree, "\\netlogon");
 203         composite_continue(state->ctx, ctx, init_domain_recv_netlogonpipe,
 204                            state);
 205 }
 206
 207 static void init_domain_recv_netlogonpipe(struct composite_context *ctx)
 208 {
 209         struct init_domain_state *state =
 210                 talloc_get_type(ctx->async.private_data,
 211                                 struct init_domain_state);
 212
 213         state->ctx->status = dcerpc_pipe_open_smb_recv(ctx);
 214         if (!composite_is_ok(state->ctx)) return;
 215
 216         state->domain->netlogon_pipe->conn->flags |=
 217                 (DCERPC_SIGN | DCERPC_SEAL);
 218         ctx = dcerpc_bind_auth_send(state, state->domain->netlogon_pipe,
 219                                                                 &dcerpc_table_netlogon,
 220                                     state->domain->schannel_creds,
 221                                     DCERPC_AUTH_TYPE_SCHANNEL,
 222                                     NULL);
 223         composite_continue(state->ctx, ctx, init_domain_recv_schannel, state);
 224 }
 225
 226 static void init_domain_recv_schannel(struct composite_context *ctx)
 227 {
 228         struct init_domain_state *state =
 229                 talloc_get_type(ctx->async.private_data,
 230                                 struct init_domain_state);
 231
 232         state->ctx->status = dcerpc_bind_auth_recv(ctx);
 233         if (!composite_is_ok(state->ctx)) return;
 234
 235         ctx = wb_connect_lsa_send(state, state->conn.out.tree,
 236                                   state->domain->schannel_creds);
 237         composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
 238 }
 239
 240 static void init_domain_recv_lsa(struct composite_context *ctx)
 241 {
 242         struct init_domain_state *state =
 243                 talloc_get_type(ctx->async.private_data,
 244                                 struct init_domain_state);
 245
 246         struct rpc_request *req;
 247
 248         state->ctx->status = wb_connect_lsa_recv(ctx, state->domain,
 249                                                  &state->domain->lsa_auth_type,
 250                                                  &state->domain->lsa_pipe,
 251                                                  &state->domain->lsa_policy);
 252         if (!composite_is_ok(state->ctx)) return;
 253
 254         /* Give the tree to the pipes. */
 255         talloc_unlink(state, state->conn.out.tree);
 256
 257         state->queryinfo.in.handle = state->domain->lsa_policy;
 258         state->queryinfo.in.level = LSA_POLICY_INFO_ACCOUNT_DOMAIN;
 259
 260         req = dcerpc_lsa_QueryInfoPolicy_send(state->domain->lsa_pipe, state,
 261                                               &state->queryinfo);
 262         composite_continue_rpc(state->ctx, req,
 263                                init_domain_recv_queryinfo, state);
 264 }
 265
 266 static void init_domain_recv_queryinfo(struct rpc_request *req)
 267 {
 268         struct init_domain_state *state =
 269                 talloc_get_type(req->async.private, struct init_domain_state);
 270         struct lsa_DomainInfo *dominfo;
 271         struct composite_context *ctx;
 272         const char *ldap_url;
 273
 274         state->ctx->status = dcerpc_ndr_request_recv(req);
 275         if (!composite_is_ok(state->ctx)) return;
 276         state->ctx->status = state->queryinfo.out.result;
 277         if (!composite_is_ok(state->ctx)) return;
 278
 279         dominfo = &state->queryinfo.out.info->account_domain;
 280
 281         if (strcasecmp(state->domain->info->name, dominfo->name.string) != 0) {
 282                 DEBUG(2, ("Expected domain name %s, DC %s said %s\n",
 283                           state->domain->info->name,
 284                           dcerpc_server_name(state->domain->lsa_pipe),
 285                           dominfo->name.string));
 286                 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
 287                 return;
 288         }
 289
 290         if (!dom_sid_equal(state->domain->info->sid, dominfo->sid)) {
 291                 DEBUG(2, ("Expected domain sid %s, DC %s said %s\n",
 292                           dom_sid_string(state, state->domain->info->sid),
 293                           dcerpc_server_name(state->domain->lsa_pipe),
 294                           dom_sid_string(state, dominfo->sid)));
 295                 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
 296                 return;
 297         }
 298
 299         state->domain->ldap_conn =
 300                 ldap_new_connection(state->domain, state->ctx->event_ctx);
 301         composite_nomem(state->domain->ldap_conn, state->ctx);
 302
 303         ldap_url = talloc_asprintf(state, "ldap://%s/",
 304                                    state->domain->info->dc_address);
 305         composite_nomem(ldap_url, state->ctx);
 306
 307         ctx = ldap_connect_send(state->domain->ldap_conn, ldap_url);
 308         composite_continue(state->ctx, ctx, init_domain_recv_ldapconn, state);
 309 }
 310
 311 static void init_domain_recv_ldapconn(struct composite_context *ctx)
 312 {
 313         struct init_domain_state *state =
 314                 talloc_get_type(ctx->async.private_data,
 315                                 struct init_domain_state);
 316
 317         state->ctx->status = ldap_connect_recv(ctx);
 318         if (NT_STATUS_IS_OK(state->ctx->status)) {
 319                 state->domain->ldap_conn->host =
 320                         talloc_strdup(state->domain->ldap_conn,
 321                                       state->domain->info->dc_name);
 322                 state->ctx->status =
 323                         ldap_bind_sasl(state->domain->ldap_conn,
 324                                        state->domain->schannel_creds);
 325                 DEBUG(0, ("ldap_bind returned %s\n",
 326                           nt_errstr(state->ctx->status)));
 327         }
 328
 329         state->domain->samr_pipe =
 330                 dcerpc_pipe_init(state->domain, state->ctx->event_ctx);
 331         if (composite_nomem(state->domain->samr_pipe, state->ctx)) return;
 332
 333         ctx = wb_connect_sam_send(state, state->conn.out.tree,
 334                                   state->domain->lsa_auth_type,
 335                                   state->domain->schannel_creds,
 336                                   state->domain->info->sid);
 337         composite_continue(state->ctx, ctx, init_domain_recv_samr, state);
 338 }
 339
 340 static void init_domain_recv_samr(struct composite_context *ctx)
 341 {
 342         struct init_domain_state *state =
 343                 talloc_get_type(ctx->async.private_data,
 344                                 struct init_domain_state);
 345
 346         state->ctx->status = wb_connect_sam_recv(
 347                 ctx, state->domain, &state->domain->samr_pipe,
 348                 &state->domain->samr_handle, &state->domain->domain_handle);
 349         if (!composite_is_ok(state->ctx)) return;
 350
 351         composite_done(state->ctx);
 352 }
 353
 354 NTSTATUS wb_init_domain_recv(struct composite_context *c,
 355                              TALLOC_CTX *mem_ctx,
 356                              struct wbsrv_domain **result)
 357 {
 358         NTSTATUS status = composite_wait(c);
 359         if (NT_STATUS_IS_OK(status)) {
 360                 struct init_domain_state *state =
 361                         talloc_get_type(c->private_data,
 362                                         struct init_domain_state);
 363                 *result = talloc_steal(mem_ctx, state->domain);
 364         }
 365         talloc_free(c);
 366         return status;
 367 }
 368
 369 NTSTATUS wb_init_domain(TALLOC_CTX *mem_ctx, struct wbsrv_service *service,
 370                         struct wb_dom_info *dom_info,
 371                         struct wbsrv_domain **result)
 372 {
 373         struct composite_context *c =
 374                 wb_init_domain_send(mem_ctx, service, dom_info);
 375         return wb_init_domain_recv(c, mem_ctx, result);
 376 }