source4/winbind/wb_init_domain.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    A composite API for initializing a domain
   5
   6    Copyright (C) Volker Lendecke 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/composite/composite.h"
  25 #include "libcli/smb_composite/smb_composite.h"
  26 #include "winbind/wb_async_helpers.h"
  27 #include "winbind/wb_server.h"
  28 #include "smbd/service_stream.h"
  29 #include "dlinklist.h"
  30
  31 #include "librpc/gen_ndr/nbt.h"
  32 #include "librpc/gen_ndr/samr.h"
  33 #include "lib/messaging/irpc.h"
  34 #include "librpc/gen_ndr/irpc.h"
  35 #include "librpc/gen_ndr/ndr_irpc.h"
  36 #include "libcli/raw/libcliraw.h"
  37 #include "librpc/gen_ndr/ndr_netlogon.h"
  38 #include "librpc/gen_ndr/ndr_lsa.h"
  39 #include "libcli/auth/credentials.h"
  40
  41
  42 /*
  43  * Initialize a domain:
  44  *
  45  * - With schannel credentials, try to open the SMB connection with the
  46  *   machine creds. This works against W2k3SP1 with an NTLMSSP session
  47  *   setup. Fall back to anonymous.
  48  *
  49  * - If we have schannel creds, do the auth2 and open the schannel'ed netlogon
  50  *   pipe.
  51  *
  52  * - Open LSA. If we have machine creds, try to open with ntlmssp. Fall back
  53  *   to schannel and then to anon bind.
  54  *
  55  * - With queryinfopolicy, verify that we're talking to the right domain
  56  *
  57  * A bit complex, but with all the combinations I think it's the best we can
  58  * get. NT4, W2k3 and W2k all have different combinations, but in the end we
  59  * have a signed&sealed lsa connection on all of them.
  60  *
  61  * Not sure if it is overkill, but it seems to work.
  62  */
  63
  64 struct init_domain_state {
  65         struct composite_context *ctx;
  66         struct wbsrv_domain *domain;
  67
  68         int num_dcs;
  69         struct nbt_dc_name *dcs;
  70
  71         struct smb_composite_connect conn;
  72
  73         struct dcerpc_pipe *auth2_pipe;
  74         struct dcerpc_pipe *netlogon_pipe;
  75
  76         struct dcerpc_pipe *lsa_pipe;
  77         struct policy_handle *lsa_policy;
  78
  79         struct dcerpc_pipe *samr_pipe;
  80         struct policy_handle *samr_handle;
  81         struct policy_handle *domain_handle;
  82
  83         struct lsa_QueryInfoPolicy queryinfo;
  84 };
  85
  86 static void init_domain_recv_dcs(struct composite_context *ctx);
  87 static void init_domain_recv_tree(struct composite_context *ctx);
  88 static void init_domain_recv_netlogoncreds(struct composite_context *ctx);
  89 static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
  90 static void init_domain_recv_lsa(struct composite_context *ctx);
  91 static void init_domain_recv_queryinfo(struct rpc_request *req);
  92 static void init_domain_recv_samr(struct composite_context *ctx);
  93
  94 struct composite_context *wb_init_domain_send(struct wbsrv_domain *domain,
  95                                               struct event_context *event_ctx,
  96                                               struct messaging_context *msg_ctx)
  97 {
  98         struct composite_context *result, *ctx;
  99         struct init_domain_state *state;
 100
 101         result = talloc(domain, struct composite_context);
 102         if (result == NULL) goto failed;
 103         result->state = COMPOSITE_STATE_IN_PROGRESS;
 104         result->async.fn = NULL;
 105         result->event_ctx = event_ctx;
 106
 107         state = talloc_zero(result, struct init_domain_state);
 108         if (state == NULL) goto failed;
 109         state->ctx = result;
 110         result->private_data = state;
 111
 112         state->domain = domain;
 113
 114         if (state->domain->schannel_creds != NULL) {
 115                 talloc_free(state->domain->schannel_creds);
 116         }
 117
 118         state->domain->schannel_creds = cli_credentials_init(state->domain);
 119         if (state->domain->schannel_creds == NULL) goto failed;
 120         cli_credentials_set_conf(state->domain->schannel_creds);
 121         state->ctx->status =
 122                 cli_credentials_set_machine_account(state->domain->
 123                                                     schannel_creds);
 124         if (!NT_STATUS_IS_OK(state->ctx->status)) goto failed;
 125
 126         ctx = wb_finddcs_send(domain->name, domain->sid, event_ctx, msg_ctx);
 127         if (ctx == NULL) goto failed;
 128
 129         ctx->async.fn = init_domain_recv_dcs;
 130         ctx->async.private_data = state;
 131         return result;
 132
 133  failed:
 134         talloc_free(result);
 135         return NULL;
 136 }
 137
 138 static void init_domain_recv_dcs(struct composite_context *ctx)
 139 {
 140         struct init_domain_state *state =
 141                 talloc_get_type(ctx->async.private_data,
 142                                 struct init_domain_state);
 143
 144         state->ctx->status = wb_finddcs_recv(ctx, state, &state->num_dcs,
 145                                              &state->dcs);
 146         if (!composite_is_ok(state->ctx)) return;
 147
 148         if (state->num_dcs < 1) {
 149                 composite_error(state->ctx, NT_STATUS_NO_LOGON_SERVERS);
 150                 return;
 151         }
 152
 153         state->conn.in.dest_host = state->dcs[0].address;
 154         state->conn.in.port = 0;
 155         state->conn.in.called_name = state->dcs[0].name;
 156         state->conn.in.service = "IPC$";
 157         state->conn.in.service_type = "IPC";
 158         state->conn.in.workgroup = state->domain->name;
 159
 160         state->conn.in.credentials = state->domain->schannel_creds;
 161
 162         if (state->conn.in.credentials == NULL) {
 163                 state->conn.in.credentials = cli_credentials_init(state);
 164                 if (composite_nomem(state->conn.in.credentials, state->ctx)) {
 165                         return;
 166                 }
 167                 cli_credentials_set_conf(state->conn.in.credentials);
 168                 cli_credentials_set_anonymous(state->conn.in.credentials);
 169         }
 170
 171         state->conn.in.fallback_to_anonymous = True;
 172
 173         ctx = smb_composite_connect_send(&state->conn, state,
 174                                          state->ctx->event_ctx);
 175         composite_continue(state->ctx, ctx, init_domain_recv_tree, state);
 176 }
 177
 178 static void init_domain_recv_tree(struct composite_context *ctx)
 179 {
 180         struct init_domain_state *state =
 181                 talloc_get_type(ctx->async.private_data,
 182                                 struct init_domain_state);
 183
 184         state->ctx->status = smb_composite_connect_recv(ctx, state);
 185         if (!composite_is_ok(state->ctx)) return;
 186
 187         if (state->domain->schannel_creds == NULL) {
 188                 /* No chance to open netlogon */
 189                 ctx = wb_connect_lsa_send(state->conn.out.tree, NULL);
 190                 composite_continue(state->ctx, ctx,
 191                                    init_domain_recv_lsa, state);
 192                 return;
 193         }
 194
 195         ctx = wb_get_schannel_creds_send(state->domain->schannel_creds,
 196                                          state->conn.out.tree,
 197                                          state->ctx->event_ctx);
 198         composite_continue(state->ctx, ctx,
 199                            init_domain_recv_netlogoncreds, state);
 200 }
 201
 202 static void init_domain_recv_netlogoncreds(struct composite_context *ctx)
 203 {
 204         struct init_domain_state *state =
 205                 talloc_get_type(ctx->async.private_data,
 206                                 struct init_domain_state);
 207         struct smbcli_tree *tree = NULL;
 208
 209         state->ctx->status = wb_get_schannel_creds_recv(ctx, state,
 210                                                         &state->auth2_pipe);
 211         if (!composite_is_ok(state->ctx)) return;
 212
 213         talloc_unlink(state, state->conn.out.tree); /* The pipe owns it now */
 214
 215         state->netlogon_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx);
 216         if (composite_nomem(state->netlogon_pipe, state->ctx)) return;
 217
 218         if (state->auth2_pipe != NULL) {
 219                 tree = dcerpc_smb_tree(state->auth2_pipe->conn);
 220         }
 221
 222         if (tree == NULL) {
 223                 composite_error(state->ctx, NT_STATUS_INTERNAL_ERROR);
 224                 return;
 225         }
 226
 227         ctx = dcerpc_pipe_open_smb_send(state->netlogon_pipe->conn, tree,
 228                                         "\\netlogon");
 229         composite_continue(state->ctx, ctx,
 230                            init_domain_recv_netlogonpipe, state);
 231 }
 232
 233 static void init_domain_recv_netlogonpipe(struct composite_context *ctx)
 234 {
 235         struct init_domain_state *state =
 236                 talloc_get_type(ctx->async.private_data,
 237                                 struct init_domain_state);
 238
 239         state->ctx->status = dcerpc_pipe_open_smb_recv(ctx);
 240         if (!composite_is_ok(state->ctx)) return;
 241
 242         state->netlogon_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
 243         state->ctx->status =
 244                 dcerpc_bind_auth_password(state->netlogon_pipe,
 245                                           DCERPC_NETLOGON_UUID,
 246                                           DCERPC_NETLOGON_VERSION,
 247                                           state->domain->schannel_creds,
 248                                           DCERPC_AUTH_TYPE_SCHANNEL,
 249                                           NULL);
 250         if (!composite_is_ok(state->ctx)) return;
 251
 252         ctx = wb_connect_lsa_send(state->conn.out.tree,
 253                                   state->domain->schannel_creds);
 254         composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
 255 }
 256
 257 static void init_domain_recv_lsa(struct composite_context *ctx)
 258 {
 259         struct init_domain_state *state =
 260                 talloc_get_type(ctx->async.private_data,
 261                                 struct init_domain_state);
 262
 263         struct rpc_request *req;
 264
 265         state->ctx->status = wb_connect_lsa_recv(ctx, state,
 266                                                  &state->domain->lsa_auth_type,
 267                                                  &state->lsa_pipe,
 268                                                  &state->lsa_policy);
 269         if (!composite_is_ok(state->ctx)) return;
 270
 271         if (state->auth2_pipe == NULL) {
 272                 /* Give the tree to the LSA pipe. If auth2_pipe exists we have
 273                  * given it to that already */
 274                 talloc_unlink(state, state->conn.out.tree);
 275                 state->conn.out.tree = NULL;
 276         }
 277
 278         state->queryinfo.in.handle = state->lsa_policy;
 279         state->queryinfo.in.level = LSA_POLICY_INFO_ACCOUNT_DOMAIN;
 280
 281         req = dcerpc_lsa_QueryInfoPolicy_send(state->lsa_pipe, state,
 282                                               &state->queryinfo);
 283         composite_continue_rpc(state->ctx, req,
 284                                init_domain_recv_queryinfo, state);
 285 }
 286
 287 static void init_domain_recv_queryinfo(struct rpc_request *req)
 288 {
 289         struct init_domain_state *state =
 290                 talloc_get_type(req->async.private, struct init_domain_state);
 291         struct lsa_DomainInfo *dominfo;
 292         struct composite_context *ctx;
 293
 294         state->ctx->status = dcerpc_ndr_request_recv(req);
 295         if (!composite_is_ok(state->ctx)) return;
 296         state->ctx->status = state->queryinfo.out.result;
 297         if (!composite_is_ok(state->ctx)) return;
 298
 299         dominfo = &state->queryinfo.out.info->account_domain;
 300
 301         if (strcasecmp(state->domain->name, dominfo->name.string) != 0) {
 302                 DEBUG(2, ("Expected domain name %s, DC %s said %s\n",
 303                           state->domain->name,
 304                           dcerpc_server_name(state->lsa_pipe),
 305                           dominfo->name.string));
 306                 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
 307                 return;
 308         }
 309
 310         if (!dom_sid_equal(state->domain->sid, dominfo->sid)) {
 311                 DEBUG(2, ("Expected domain sid %s, DC %s said %s\n",
 312                           dom_sid_string(state, state->domain->sid),
 313                           dcerpc_server_name(state->lsa_pipe),
 314                           dom_sid_string(state, dominfo->sid)));
 315                 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
 316                 return;
 317         }
 318
 319         state->samr_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx);
 320         if (composite_nomem(state->samr_pipe, state->ctx)) return;
 321
 322         ctx = wb_connect_sam_send(state->conn.out.tree,
 323                                   state->domain->lsa_auth_type,
 324                                   state->domain->schannel_creds,
 325                                   state->domain->sid);
 326         composite_continue(state->ctx, ctx,
 327                            init_domain_recv_samr, state);
 328 }
 329
 330 static void init_domain_recv_samr(struct composite_context *ctx)
 331 {
 332         struct init_domain_state *state =
 333                 talloc_get_type(ctx->async.private_data,
 334                                 struct init_domain_state);
 335
 336         state->ctx->status = wb_connect_sam_recv(ctx, state, &state->samr_pipe,
 337                                                  &state->samr_handle,
 338                                                  &state->domain_handle);
 339         if (!composite_is_ok(state->ctx)) return;
 340
 341         composite_done(state->ctx);
 342 }
 343
 344 NTSTATUS wb_init_domain_recv(struct composite_context *c)
 345 {
 346         NTSTATUS status = composite_wait(c);
 347         if (NT_STATUS_IS_OK(status)) {
 348                 struct init_domain_state *state =
 349                         talloc_get_type(c->private_data,
 350                                         struct init_domain_state);
 351                 struct wbsrv_domain *domain = state->domain;
 352
 353                 talloc_free(domain->netlogon_auth2_pipe);
 354                 domain->netlogon_auth2_pipe =
 355                         talloc_steal(domain, state->auth2_pipe);
 356
 357                 talloc_free(domain->netlogon_pipe);
 358                 domain->netlogon_pipe =
 359                         talloc_steal(domain, state->netlogon_pipe);
 360
 361                 talloc_free(domain->lsa_pipe);
 362                 domain->lsa_pipe =
 363                         talloc_steal(domain, state->lsa_pipe);
 364
 365                 talloc_free(domain->lsa_policy);
 366                 domain->lsa_policy =
 367                         talloc_steal(domain, state->lsa_policy);
 368
 369                 talloc_free(domain->samr_pipe);
 370                 domain->samr_pipe =
 371                         talloc_steal(domain, state->samr_pipe);
 372
 373                 talloc_free(domain->samr_handle);
 374                 domain->samr_handle =
 375                         talloc_steal(domain, state->samr_handle);
 376
 377                 talloc_free(domain->domain_handle);
 378                 domain->domain_handle =
 379                         talloc_steal(domain, state->domain_handle);
 380
 381                 domain->initialized = True;
 382         }
 383         talloc_free(c);
 384         return status;
 385 }
 386
 387 NTSTATUS wb_init_domain(struct wbsrv_domain *domain,
 388                         struct event_context *event_ctx,
 389                         struct messaging_context *messaging_ctx)
 390 {
 391         struct composite_context *c =
 392                 wb_init_domain_send(domain, event_ctx, messaging_ctx);
 393         return wb_init_domain_recv(c);
 394 }
 395
 396 struct queue_domain_state {
 397         struct queue_domain_state *prev, *next;
 398         struct composite_context *ctx;
 399         struct wbsrv_domain *domain;
 400         struct composite_context *(*send_fn)(void *p);
 401         NTSTATUS (*recv_fn)(struct composite_context *c,
 402                             void *p);
 403         void *private_data;
 404 };
 405
 406 static void queue_domain_recv_init(struct composite_context *ctx);
 407 static void queue_domain_recv_sub(struct composite_context *ctx);
 408
 409 struct composite_context *wb_queue_domain_send(TALLOC_CTX *mem_ctx,
 410                                                struct wbsrv_domain *domain,
 411                                                struct event_context *event_ctx,
 412                                                struct messaging_context *msg_ctx,
 413                                                struct composite_context *(*send_fn)(void *p),
 414                                                NTSTATUS (*recv_fn)(struct composite_context *c,
 415                                                                    void *p),
 416                                                void *private_data)
 417 {
 418         struct composite_context *result, *ctx;
 419         struct queue_domain_state *state;
 420
 421         result = talloc(mem_ctx, struct composite_context);
 422         if (result == NULL) goto failed;
 423         result->state = COMPOSITE_STATE_IN_PROGRESS;
 424         result->async.fn = NULL;
 425         result->event_ctx = event_ctx;
 426
 427         state = talloc(result, struct queue_domain_state);
 428         if (state == NULL) goto failed;
 429         state->ctx = result;
 430         result->private_data = state;
 431
 432         state->send_fn = send_fn;
 433         state->recv_fn = recv_fn;
 434         state->private_data = private_data;
 435         state->domain = domain;
 436
 437         if (domain->busy) {
 438                 DEBUG(0, ("Domain %s busy\n", domain->name));
 439                 DLIST_ADD_END(domain->request_queue, state,
 440                               struct queue_domain_state *);
 441                 return result;
 442         }
 443
 444         domain->busy = True;
 445
 446         if (!domain->initialized) {
 447                 ctx = wb_init_domain_send(domain, result->event_ctx, msg_ctx);
 448                 if (ctx == NULL) goto failed;
 449                 ctx->async.fn = queue_domain_recv_init;
 450                 ctx->async.private_data = state;
 451                 return result;
 452         }
 453
 454         ctx = state->send_fn(state->private_data);
 455         if (ctx == NULL) goto failed;
 456         ctx->async.fn = queue_domain_recv_sub;
 457         ctx->async.private_data = state;
 458         return result;
 459
 460  failed:
 461         talloc_free(result);
 462         return NULL;
 463 }
 464
 465 static void queue_domain_recv_init(struct composite_context *ctx)
 466 {
 467         struct queue_domain_state *state =
 468                 talloc_get_type(ctx->async.private_data,
 469                                 struct queue_domain_state);
 470
 471         state->ctx->status = wb_init_domain_recv(ctx);
 472         if (!composite_is_ok(state->ctx)) return;
 473
 474         ctx = state->send_fn(state->private_data);
 475         composite_continue(state->ctx, ctx, queue_domain_recv_sub, state);
 476 }
 477
 478 static void queue_domain_recv_sub(struct composite_context *ctx)
 479 {
 480         struct queue_domain_state *state =
 481                 talloc_get_type(ctx->async.private_data,
 482                                 struct queue_domain_state);
 483
 484         state->ctx->status = state->recv_fn(ctx, state->private_data);
 485         state->domain->busy = False;
 486
 487         if (state->domain->request_queue != NULL) {
 488                 struct queue_domain_state *s2;
 489                 s2 = state->domain->request_queue;
 490                 DLIST_REMOVE(state->domain->request_queue, s2);
 491                 ctx = s2->send_fn(s2->private_data);
 492                 composite_continue(s2->ctx, ctx, queue_domain_recv_sub, s2);
 493                 state->domain->busy = True;
 494         }
 495
 496         if (!composite_is_ok(state->ctx)) return;
 497         composite_done(state->ctx);
 498 }
 499
 500 NTSTATUS wb_queue_domain_recv(struct composite_context *ctx)
 501 {
 502         NTSTATUS status = composite_wait(ctx);
 503         talloc_free(ctx);
 504         return status;
 505 }