source3/winbindd/winbindd_cm.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon connection manager
   5
   6    Copyright (C) Tim Potter                2001
   7    Copyright (C) Andrew Bartlett           2002
   8    Copyright (C) Gerald (Jerry) Carter     2003-2005.
   9    Copyright (C) Volker Lendecke           2004-2005
  10    Copyright (C) Jeremy Allison            2006
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 /*
  27    We need to manage connections to domain controllers without having to
  28    mess up the main winbindd code with other issues.  The aim of the
  29    connection manager is to:
  30
  31        - make connections to domain controllers and cache them
  32        - re-establish connections when networks or servers go down
  33        - centralise the policy on connection timeouts, domain controller
  34          selection etc
  35        - manage re-entrancy for when winbindd becomes able to handle
  36          multiple outstanding rpc requests
  37
  38    Why not have connection management as part of the rpc layer like tng?
  39    Good question.  This code may morph into libsmb/rpc_cache.c or something
  40    like that but at the moment it's simply staying as part of winbind.  I
  41    think the TNG architecture of forcing every user of the rpc layer to use
  42    the connection caching system is a bad idea.  It should be an optional
  43    method of using the routines.
  44
  45    The TNG design is quite good but I disagree with some aspects of the
  46    implementation. -tpot
  47
  48  */
  49
  50 /*
  51    TODO:
  52
  53      - I'm pretty annoyed by all the make_nmb_name() stuff.  It should be
  54        moved down into another function.
  55
  56      - Take care when destroying cli_structs as they can be shared between
  57        various sam handles.
  58
  59  */
  60
  61 #include "includes.h"
  62 #include "winbindd.h"
  63 #include "../libcli/auth/libcli_auth.h"
  64 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
  65 #include "rpc_client/cli_pipe.h"
  66 #include "rpc_client/cli_netlogon.h"
  67 #include "../librpc/gen_ndr/ndr_samr_c.h"
  68 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  69 #include "rpc_client/cli_lsarpc.h"
  70 #include "../librpc/gen_ndr/ndr_dssetup_c.h"
  71 #include "libads/sitename_cache.h"
  72 #include "libsmb/libsmb.h"
  73 #include "libsmb/clidgram.h"
  74 #include "ads.h"
  75 #include "secrets.h"
  76 #include "../libcli/security/security.h"
  77 #include "passdb.h"
  78 #include "messages.h"
  79 #include "auth/gensec/gensec.h"
  80 #include "../libcli/smb/smbXcli_base.h"
  81 #include "libcli/auth/netlogon_creds_cli.h"
  82 #include "auth.h"
  83 #include "rpc_server/rpc_ncacn_np.h"
  84 #include "auth/credentials/credentials.h"
  85 #include "lib/param/param.h"
  86
  87 #undef DBGC_CLASS
  88 #define DBGC_CLASS DBGC_WINBIND
  89
  90 struct dc_name_ip {
  91         fstring name;
  92         struct sockaddr_storage ss;
  93 };
  94
  95 extern struct winbindd_methods reconnect_methods;
  96 extern bool override_logfile;
  97
  98 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain, bool need_rw_dc);
  99 static void set_dc_type_and_flags( struct winbindd_domain *domain );
 100 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain );
 101 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
 102                     struct dc_name_ip **dcs, int *num_dcs);
 103
 104 /****************************************************************
 105  Child failed to find DC's. Reschedule check.
 106 ****************************************************************/
 107
 108 static void msg_failed_to_go_online(struct messaging_context *msg,
 109                                     void *private_data,
 110                                     uint32_t msg_type,
 111                                     struct server_id server_id,
 112                                     DATA_BLOB *data)
 113 {
 114         struct winbindd_domain *domain;
 115         const char *domainname = (const char *)data->data;
 116
 117         if (data->data == NULL || data->length == 0) {
 118                 return;
 119         }
 120
 121         DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
 122
 123         for (domain = domain_list(); domain; domain = domain->next) {
 124                 if (domain->internal) {
 125                         continue;
 126                 }
 127
 128                 if (strequal(domain->name, domainname)) {
 129                         if (domain->online) {
 130                                 /* We're already online, ignore. */
 131                                 DEBUG(5,("msg_fail_to_go_online: domain %s "
 132                                         "already online.\n", domainname));
 133                                 continue;
 134                         }
 135
 136                         /* Reschedule the online check. */
 137                         set_domain_offline(domain);
 138                         break;
 139                 }
 140         }
 141 }
 142
 143 /****************************************************************
 144  Actually cause a reconnect from a message.
 145 ****************************************************************/
 146
 147 static void msg_try_to_go_online(struct messaging_context *msg,
 148                                  void *private_data,
 149                                  uint32_t msg_type,
 150                                  struct server_id server_id,
 151                                  DATA_BLOB *data)
 152 {
 153         struct winbindd_domain *domain;
 154         const char *domainname = (const char *)data->data;
 155
 156         if (data->data == NULL || data->length == 0) {
 157                 return;
 158         }
 159
 160         DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
 161
 162         for (domain = domain_list(); domain; domain = domain->next) {
 163                 if (domain->internal) {
 164                         continue;
 165                 }
 166
 167                 if (strequal(domain->name, domainname)) {
 168
 169                         if (domain->online) {
 170                                 /* We're already online, ignore. */
 171                                 DEBUG(5,("msg_try_to_go_online: domain %s "
 172                                         "already online.\n", domainname));
 173                                 continue;
 174                         }
 175
 176                         /* This call takes care of setting the online
 177                            flag to true if we connected, or re-adding
 178                            the offline handler if false. Bypasses online
 179                            check so always does network calls. */
 180
 181                         init_dc_connection_network(domain, true);
 182                         break;
 183                 }
 184         }
 185 }
 186
 187 /****************************************************************
 188  Fork a child to try and contact a DC. Do this as contacting a
 189  DC requires blocking lookups and we don't want to block our
 190  parent.
 191 ****************************************************************/
 192
 193 static bool fork_child_dc_connect(struct winbindd_domain *domain)
 194 {
 195         struct dc_name_ip *dcs = NULL;
 196         int num_dcs = 0;
 197         TALLOC_CTX *mem_ctx = NULL;
 198         pid_t parent_pid = getpid();
 199         char *lfile = NULL;
 200         NTSTATUS status;
 201
 202         if (domain->dc_probe_pid != (pid_t)-1) {
 203                 /*
 204                  * We might already have a DC probe
 205                  * child working, check.
 206                  */
 207                 if (process_exists_by_pid(domain->dc_probe_pid)) {
 208                         DEBUG(10,("fork_child_dc_connect: pid %u already "
 209                                 "checking for DC's.\n",
 210                                 (unsigned int)domain->dc_probe_pid));
 211                         return true;
 212                 }
 213                 domain->dc_probe_pid = (pid_t)-1;
 214         }
 215
 216         domain->dc_probe_pid = fork();
 217
 218         if (domain->dc_probe_pid == (pid_t)-1) {
 219                 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
 220                 return False;
 221         }
 222
 223         if (domain->dc_probe_pid != (pid_t)0) {
 224                 /* Parent */
 225                 messaging_register(winbind_messaging_context(), NULL,
 226                                    MSG_WINBIND_TRY_TO_GO_ONLINE,
 227                                    msg_try_to_go_online);
 228                 messaging_register(winbind_messaging_context(), NULL,
 229                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 230                                    msg_failed_to_go_online);
 231                 return True;
 232         }
 233
 234         /* Child. */
 235
 236         /* Leave messages blocked - we will never process one. */
 237
 238         if (!override_logfile) {
 239                 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
 240                         DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
 241                         _exit(1);
 242                 }
 243         }
 244
 245         status = winbindd_reinit_after_fork(NULL, lfile);
 246         if (!NT_STATUS_IS_OK(status)) {
 247                 DEBUG(1, ("winbindd_reinit_after_fork failed: %s\n",
 248                           nt_errstr(status)));
 249                 messaging_send_buf(winbind_messaging_context(),
 250                                    pid_to_procid(parent_pid),
 251                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 252                                    (const uint8_t *)domain->name,
 253                                    strlen(domain->name)+1);
 254                 _exit(1);
 255         }
 256         SAFE_FREE(lfile);
 257
 258         mem_ctx = talloc_init("fork_child_dc_connect");
 259         if (!mem_ctx) {
 260                 DEBUG(0,("talloc_init failed.\n"));
 261                 messaging_send_buf(winbind_messaging_context(),
 262                                    pid_to_procid(parent_pid),
 263                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 264                                    (const uint8_t *)domain->name,
 265                                    strlen(domain->name)+1);
 266                 _exit(1);
 267         }
 268
 269         if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
 270                 /* Still offline ? Can't find DC's. */
 271                 messaging_send_buf(winbind_messaging_context(),
 272                                    pid_to_procid(parent_pid),
 273                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 274                                    (const uint8_t *)domain->name,
 275                                    strlen(domain->name)+1);
 276                 _exit(0);
 277         }
 278
 279         /* We got a DC. Send a message to our parent to get it to
 280            try and do the same. */
 281
 282         messaging_send_buf(winbind_messaging_context(),
 283                            pid_to_procid(parent_pid),
 284                            MSG_WINBIND_TRY_TO_GO_ONLINE,
 285                            (const uint8_t *)domain->name,
 286                            strlen(domain->name)+1);
 287         _exit(0);
 288 }
 289
 290 /****************************************************************
 291  Handler triggered if we're offline to try and detect a DC.
 292 ****************************************************************/
 293
 294 static void check_domain_online_handler(struct tevent_context *ctx,
 295                                         struct tevent_timer *te,
 296                                         struct timeval now,
 297                                         void *private_data)
 298 {
 299         struct winbindd_domain *domain =
 300                 (struct winbindd_domain *)private_data;
 301
 302         DEBUG(10,("check_domain_online_handler: called for domain "
 303                   "%s (online = %s)\n", domain->name,
 304                   domain->online ? "True" : "False" ));
 305
 306         TALLOC_FREE(domain->check_online_event);
 307
 308         /* Are we still in "startup" mode ? */
 309
 310         if (domain->startup && (time_mono(NULL) > domain->startup_time + 30)) {
 311                 /* No longer in "startup" mode. */
 312                 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
 313                         domain->name ));
 314                 domain->startup = False;
 315         }
 316
 317         /* We've been told to stay offline, so stay
 318            that way. */
 319
 320         if (get_global_winbindd_state_offline()) {
 321                 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
 322                         domain->name ));
 323                 return;
 324         }
 325
 326         /* Fork a child to test if it can contact a DC.
 327            If it can then send ourselves a message to
 328            cause a reconnect. */
 329
 330         fork_child_dc_connect(domain);
 331 }
 332
 333 /****************************************************************
 334  If we're still offline setup the timeout check.
 335 ****************************************************************/
 336
 337 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
 338 {
 339         int wbr = lp_winbind_reconnect_delay();
 340
 341         if (domain->startup) {
 342                 domain->check_online_timeout = 10;
 343         } else if (domain->check_online_timeout < wbr) {
 344                 domain->check_online_timeout = wbr;
 345         }
 346 }
 347
 348 void winbind_msg_domain_offline(struct messaging_context *msg_ctx,
 349                                 void *private_data,
 350                                 uint32_t msg_type,
 351                                 struct server_id server_id,
 352                                 DATA_BLOB *data)
 353 {
 354         const char *domain_name = (const char *)data->data;
 355         struct winbindd_domain *domain;
 356
 357         domain = find_domain_from_name_noinit(domain_name);
 358         if (domain == NULL) {
 359                 return;
 360         }
 361
 362         domain->online = false;
 363
 364         DEBUG(10, ("Domain %s is marked as offline now.\n",
 365                    domain_name));
 366 }
 367
 368 void winbind_msg_domain_online(struct messaging_context *msg_ctx,
 369                                 void *private_data,
 370                                 uint32_t msg_type,
 371                                 struct server_id server_id,
 372                                 DATA_BLOB *data)
 373 {
 374         const char *domain_name = (const char *)data->data;
 375         struct winbindd_domain *domain;
 376
 377         domain = find_domain_from_name_noinit(domain_name);
 378         if (domain == NULL) {
 379                 return;
 380         }
 381
 382         domain->online = true;
 383
 384         DEBUG(10, ("Domain %s is marked as online now.\n",
 385                    domain_name));
 386 }
 387
 388 /****************************************************************
 389  Set domain offline and also add handler to put us back online
 390  if we detect a DC.
 391 ****************************************************************/
 392
 393 void set_domain_offline(struct winbindd_domain *domain)
 394 {
 395         pid_t parent_pid = getppid();
 396
 397         DEBUG(10,("set_domain_offline: called for domain %s\n",
 398                 domain->name ));
 399
 400         TALLOC_FREE(domain->check_online_event);
 401
 402         if (domain->internal) {
 403                 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
 404                         domain->name ));
 405                 return;
 406         }
 407
 408         domain->online = False;
 409
 410         /* Offline domains are always initialized. They're
 411            re-initialized when they go back online. */
 412
 413         domain->initialized = True;
 414
 415         /* We only add the timeout handler that checks and
 416            allows us to go back online when we've not
 417            been told to remain offline. */
 418
 419         if (get_global_winbindd_state_offline()) {
 420                 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
 421                         domain->name ));
 422                 return;
 423         }
 424
 425         /* If we're in startup mode, check again in 10 seconds, not in
 426            lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
 427
 428         calc_new_online_timeout_check(domain);
 429
 430         domain->check_online_event = tevent_add_timer(winbind_event_context(),
 431                                                 NULL,
 432                                                 timeval_current_ofs(domain->check_online_timeout,0),
 433                                                 check_domain_online_handler,
 434                                                 domain);
 435
 436         /* The above *has* to succeed for winbindd to work. */
 437         if (!domain->check_online_event) {
 438                 smb_panic("set_domain_offline: failed to add online handler");
 439         }
 440
 441         DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
 442                 domain->name ));
 443
 444         /* Send a message to the parent that the domain is offline. */
 445         if (parent_pid > 1 && !domain->internal) {
 446                 messaging_send_buf(winbind_messaging_context(),
 447                                    pid_to_procid(parent_pid),
 448                                    MSG_WINBIND_DOMAIN_OFFLINE,
 449                                    (uint8 *)domain->name,
 450                                    strlen(domain->name) + 1);
 451         }
 452
 453         /* Send an offline message to the idmap child when our
 454            primary domain goes offline */
 455
 456         if ( domain->primary ) {
 457                 struct winbindd_child *idmap = idmap_child();
 458
 459                 if ( idmap->pid != 0 ) {
 460                         messaging_send_buf(winbind_messaging_context(),
 461                                            pid_to_procid(idmap->pid),
 462                                            MSG_WINBIND_OFFLINE,
 463                                            (const uint8_t *)domain->name,
 464                                            strlen(domain->name)+1);
 465                 }
 466         }
 467
 468         return;
 469 }
 470
 471 /****************************************************************
 472  Set domain online - if allowed.
 473 ****************************************************************/
 474
 475 static void set_domain_online(struct winbindd_domain *domain)
 476 {
 477         pid_t parent_pid = getppid();
 478
 479         DEBUG(10,("set_domain_online: called for domain %s\n",
 480                 domain->name ));
 481
 482         if (domain->internal) {
 483                 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
 484                         domain->name ));
 485                 return;
 486         }
 487
 488         if (get_global_winbindd_state_offline()) {
 489                 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
 490                         domain->name ));
 491                 return;
 492         }
 493
 494         winbindd_set_locator_kdc_envs(domain);
 495
 496         /* If we are waiting to get a krb5 ticket, trigger immediately. */
 497         ccache_regain_all_now();
 498
 499         /* Ok, we're out of any startup mode now... */
 500         domain->startup = False;
 501
 502         if (domain->online == False) {
 503                 /* We were offline - now we're online. We default to
 504                    using the MS-RPC backend if we started offline,
 505                    and if we're going online for the first time we
 506                    should really re-initialize the backends and the
 507                    checks to see if we're talking to an AD or NT domain.
 508                 */
 509
 510                 domain->initialized = False;
 511
 512                 /* 'reconnect_methods' is the MS-RPC backend. */
 513                 if (domain->backend == &reconnect_methods) {
 514                         domain->backend = NULL;
 515                 }
 516         }
 517
 518         /* Ensure we have no online timeout checks. */
 519         domain->check_online_timeout = 0;
 520         TALLOC_FREE(domain->check_online_event);
 521
 522         /* Ensure we ignore any pending child messages. */
 523         messaging_deregister(winbind_messaging_context(),
 524                              MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
 525         messaging_deregister(winbind_messaging_context(),
 526                              MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
 527
 528         domain->online = True;
 529
 530         /* Send a message to the parent that the domain is online. */
 531         if (parent_pid > 1 && !domain->internal) {
 532                 messaging_send_buf(winbind_messaging_context(),
 533                                    pid_to_procid(parent_pid),
 534                                    MSG_WINBIND_DOMAIN_ONLINE,
 535                                    (uint8 *)domain->name,
 536                                    strlen(domain->name) + 1);
 537         }
 538
 539         /* Send an online message to the idmap child when our
 540            primary domain comes online */
 541
 542         if ( domain->primary ) {
 543                 struct winbindd_child *idmap = idmap_child();
 544
 545                 if ( idmap->pid != 0 ) {
 546                         messaging_send_buf(winbind_messaging_context(),
 547                                            pid_to_procid(idmap->pid),
 548                                            MSG_WINBIND_ONLINE,
 549                                            (const uint8_t *)domain->name,
 550                                            strlen(domain->name)+1);
 551                 }
 552         }
 553
 554         return;
 555 }
 556
 557 /****************************************************************
 558  Requested to set a domain online.
 559 ****************************************************************/
 560
 561 void set_domain_online_request(struct winbindd_domain *domain)
 562 {
 563         struct timeval tev;
 564
 565         DEBUG(10,("set_domain_online_request: called for domain %s\n",
 566                 domain->name ));
 567
 568         if (get_global_winbindd_state_offline()) {
 569                 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
 570                         domain->name ));
 571                 return;
 572         }
 573
 574         if (domain->internal) {
 575                 DEBUG(10, ("set_domain_online_request: Internal domains are "
 576                            "always online\n"));
 577                 return;
 578         }
 579
 580         /* We've been told it's safe to go online and
 581            try and connect to a DC. But I don't believe it
 582            because network manager seems to lie.
 583            Wait at least 5 seconds. Heuristics suck... */
 584
 585
 586         GetTimeOfDay(&tev);
 587
 588         /* Go into "startup" mode again. */
 589         domain->startup_time = time_mono(NULL);
 590         domain->startup = True;
 591
 592         tev.tv_sec += 5;
 593
 594         if (!domain->check_online_event) {
 595                 /* If we've come from being globally offline we
 596                    don't have a check online event handler set.
 597                    We need to add one now we're trying to go
 598                    back online. */
 599
 600                 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
 601                         domain->name ));
 602         }
 603
 604         TALLOC_FREE(domain->check_online_event);
 605
 606         domain->check_online_event = tevent_add_timer(winbind_event_context(),
 607                                                      NULL,
 608                                                      tev,
 609                                                      check_domain_online_handler,
 610                                                      domain);
 611
 612         /* The above *has* to succeed for winbindd to work. */
 613         if (!domain->check_online_event) {
 614                 smb_panic("set_domain_online_request: failed to add online handler");
 615         }
 616 }
 617
 618 /****************************************************************
 619  Add -ve connection cache entries for domain and realm.
 620 ****************************************************************/
 621
 622 static void winbind_add_failed_connection_entry(
 623         const struct winbindd_domain *domain,
 624         const char *server,
 625         NTSTATUS result)
 626 {
 627         add_failed_connection_entry(domain->name, server, result);
 628         /* If this was the saf name for the last thing we talked to,
 629            remove it. */
 630         saf_delete(domain->name);
 631         if (domain->alt_name != NULL) {
 632                 add_failed_connection_entry(domain->alt_name, server, result);
 633                 saf_delete(domain->alt_name);
 634         }
 635         winbindd_unset_locator_kdc_env(domain);
 636 }
 637
 638 /* Choose between anonymous or authenticated connections.  We need to use
 639    an authenticated connection if DCs have the RestrictAnonymous registry
 640    entry set > 0, or the "Additional restrictions for anonymous
 641    connections" set in the win2k Local Security Policy.
 642
 643    Caller to free() result in domain, username, password
 644 */
 645
 646 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
 647 {
 648         *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
 649         *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 650         *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
 651
 652         if (*username && **username) {
 653
 654                 if (!*domain || !**domain)
 655                         *domain = smb_xstrdup(lp_workgroup());
 656
 657                 if (!*password || !**password)
 658                         *password = smb_xstrdup("");
 659
 660                 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
 661                           *domain, *username));
 662
 663         } else {
 664                 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
 665                 *username = smb_xstrdup("");
 666                 *domain = smb_xstrdup("");
 667                 *password = smb_xstrdup("");
 668         }
 669 }
 670
 671 static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx,
 672                                        struct cli_credentials **_creds)
 673 {
 674
 675         TALLOC_CTX *frame = talloc_stackframe();
 676         NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
 677         struct loadparm_context *lp_ctx;
 678         char *username = NULL;
 679         char *netbios_domain = NULL;
 680         char *password = NULL;
 681         struct cli_credentials *creds = NULL;
 682         bool ok;
 683
 684         cm_get_ipc_userpass(&username, &netbios_domain, &password);
 685
 686         lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());
 687         if (lp_ctx == NULL) {
 688                 DEBUG(1, ("loadparm_init_s3 failed\n"));
 689                 status = NT_STATUS_INTERNAL_ERROR;
 690                 goto fail;
 691         }
 692
 693         creds = cli_credentials_init(mem_ctx);
 694         if (creds == NULL) {
 695                 status = NT_STATUS_NO_MEMORY;
 696                 goto fail;
 697         }
 698
 699         cli_credentials_set_conf(creds, lp_ctx);
 700         cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS);
 701
 702         ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED);
 703         if (!ok) {
 704                 status = NT_STATUS_NO_MEMORY;
 705                 goto fail;
 706         }
 707
 708         ok = cli_credentials_set_username(creds, username, CRED_SPECIFIED);
 709         if (!ok) {
 710                 status = NT_STATUS_NO_MEMORY;
 711                 goto fail;
 712         }
 713
 714         ok = cli_credentials_set_password(creds, password, CRED_SPECIFIED);
 715         if (!ok) {
 716                 status = NT_STATUS_NO_MEMORY;
 717                 goto fail;
 718         }
 719
 720         *_creds = creds;
 721         creds = NULL;
 722         status = NT_STATUS_OK;
 723  fail:
 724         TALLOC_FREE(creds);
 725         SAFE_FREE(username);
 726         SAFE_FREE(netbios_domain);
 727         SAFE_FREE(password);
 728         TALLOC_FREE(frame);
 729         return status;
 730 }
 731
 732 static bool cm_is_ipc_credentials(struct cli_credentials *creds)
 733 {
 734         TALLOC_CTX *frame = talloc_stackframe();
 735         char *ipc_account = NULL;
 736         char *ipc_domain = NULL;
 737         char *ipc_password = NULL;
 738         const char *creds_account = NULL;
 739         const char *creds_domain = NULL;
 740         const char *creds_password = NULL;
 741         bool ret = false;
 742
 743         cm_get_ipc_userpass(&ipc_account, &ipc_domain, &ipc_password);
 744
 745         creds_account = cli_credentials_get_username(creds);
 746         creds_domain = cli_credentials_get_domain(creds);
 747         creds_password = cli_credentials_get_password(creds);
 748
 749         if (!strequal(ipc_domain, creds_domain)) {
 750                 goto done;
 751         }
 752
 753         if (!strequal(ipc_account, creds_account)) {
 754                 goto done;
 755         }
 756
 757         if (!strcsequal(ipc_password, creds_password)) {
 758                 goto done;
 759         }
 760
 761         ret = true;
 762  done:
 763         SAFE_FREE(ipc_account);
 764         SAFE_FREE(ipc_domain);
 765         SAFE_FREE(ipc_password);
 766         TALLOC_FREE(frame);
 767         return ret;
 768 }
 769
 770 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
 771                                      fstring dcname,
 772                                      struct sockaddr_storage *dc_ss)
 773 {
 774         struct winbindd_domain *our_domain = NULL;
 775         struct rpc_pipe_client *netlogon_pipe = NULL;
 776         NTSTATUS result;
 777         WERROR werr;
 778         TALLOC_CTX *mem_ctx;
 779         unsigned int orig_timeout;
 780         const char *tmp = NULL;
 781         const char *p;
 782         struct dcerpc_binding_handle *b;
 783
 784         /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
 785          * moment.... */
 786
 787         if (IS_DC) {
 788                 return False;
 789         }
 790
 791         if (domain->primary) {
 792                 return False;
 793         }
 794
 795         our_domain = find_our_domain();
 796
 797         if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
 798                 return False;
 799         }
 800
 801         result = cm_connect_netlogon(our_domain, &netlogon_pipe);
 802         if (!NT_STATUS_IS_OK(result)) {
 803                 talloc_destroy(mem_ctx);
 804                 return False;
 805         }
 806
 807         b = netlogon_pipe->binding_handle;
 808
 809         /* This call can take a long time - allow the server to time out.
 810            35 seconds should do it. */
 811
 812         orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
 813
 814         if (our_domain->active_directory) {
 815                 struct netr_DsRGetDCNameInfo *domain_info = NULL;
 816
 817                 result = dcerpc_netr_DsRGetDCName(b,
 818                                                   mem_ctx,
 819                                                   our_domain->dcname,
 820                                                   domain->name,
 821                                                   NULL,
 822                                                   NULL,
 823                                                   DS_RETURN_DNS_NAME,
 824                                                   &domain_info,
 825                                                   &werr);
 826                 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
 827                         tmp = talloc_strdup(
 828                                 mem_ctx, domain_info->dc_unc);
 829                         if (tmp == NULL) {
 830                                 DEBUG(0, ("talloc_strdup failed\n"));
 831                                 talloc_destroy(mem_ctx);
 832                                 return false;
 833                         }
 834                         if (domain->alt_name == NULL) {
 835                                 domain->alt_name = talloc_strdup(domain,
 836                                                                  domain_info->domain_name);
 837                                 if (domain->alt_name == NULL) {
 838                                         DEBUG(0, ("talloc_strdup failed\n"));
 839                                         talloc_destroy(mem_ctx);
 840                                         return false;
 841                                 }
 842                         }
 843                         if (domain->forest_name == NULL) {
 844                                 domain->forest_name = talloc_strdup(domain,
 845                                                                     domain_info->forest_name);
 846                                 if (domain->forest_name == NULL) {
 847                                         DEBUG(0, ("talloc_strdup failed\n"));
 848                                         talloc_destroy(mem_ctx);
 849                                         return false;
 850                                 }
 851                         }
 852                 }
 853         } else {
 854                 result = dcerpc_netr_GetAnyDCName(b, mem_ctx,
 855                                                   our_domain->dcname,
 856                                                   domain->name,
 857                                                   &tmp,
 858                                                   &werr);
 859         }
 860
 861         /* And restore our original timeout. */
 862         rpccli_set_timeout(netlogon_pipe, orig_timeout);
 863
 864         if (!NT_STATUS_IS_OK(result)) {
 865                 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
 866                         nt_errstr(result)));
 867                 talloc_destroy(mem_ctx);
 868                 return false;
 869         }
 870
 871         if (!W_ERROR_IS_OK(werr)) {
 872                 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
 873                            win_errstr(werr)));
 874                 talloc_destroy(mem_ctx);
 875                 return false;
 876         }
 877
 878         /* dcerpc_netr_GetAnyDCName gives us a name with \\ */
 879         p = strip_hostname(tmp);
 880
 881         fstrcpy(dcname, p);
 882
 883         talloc_destroy(mem_ctx);
 884
 885         DEBUG(10,("dcerpc_netr_GetAnyDCName returned %s\n", dcname));
 886
 887         if (!resolve_name(dcname, dc_ss, 0x20, true)) {
 888                 return False;
 889         }
 890
 891         return True;
 892 }
 893
 894 /**
 895  * Helper function to assemble trust password and account name
 896  */
 897 static NTSTATUS get_trust_credentials(struct winbindd_domain *domain,
 898                                       TALLOC_CTX *mem_ctx,
 899                                       bool netlogon,
 900                                       struct cli_credentials **_creds)
 901 {
 902         const struct winbindd_domain *creds_domain = NULL;
 903         struct cli_credentials *creds;
 904         NTSTATUS status;
 905
 906         /* If we are a DC and this is not our own domain */
 907
 908         if (IS_DC && netlogon) {
 909                 creds_domain = domain;
 910         } else {
 911                 creds_domain = find_our_domain();
 912                 if (creds_domain == NULL) {
 913                         return NT_STATUS_INVALID_SERVER_STATE;
 914                 }
 915         }
 916
 917         status = pdb_get_trust_credentials(creds_domain->name,
 918                                            creds_domain->alt_name,
 919                                            mem_ctx,
 920                                            &creds);
 921         if (!NT_STATUS_IS_OK(status)) {
 922                 goto ipc_fallback;
 923         }
 924
 925         if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
 926                 cli_credentials_set_kerberos_state(creds,
 927                                                    CRED_MUST_USE_KERBEROS);
 928         }
 929
 930         if (domain->primary && lp_security() == SEC_ADS) {
 931                 cli_credentials_set_kerberos_state(creds,
 932                                                    CRED_AUTO_USE_KERBEROS);
 933         } else if (!domain->active_directory) {
 934                 cli_credentials_set_kerberos_state(creds,
 935                                                    CRED_DONT_USE_KERBEROS);
 936         }
 937
 938         if (creds_domain != domain) {
 939                 /*
 940                  * We can only use schannel against a direct trust
 941                  */
 942                 cli_credentials_set_secure_channel_type(creds,
 943                                                         SEC_CHAN_NULL);
 944         }
 945
 946         *_creds = creds;
 947         return NT_STATUS_OK;
 948
 949  ipc_fallback:
 950         if (netlogon) {
 951                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 952         }
 953
 954         status = cm_get_ipc_credentials(mem_ctx, &creds);
 955         if (!NT_STATUS_IS_OK(status)) {
 956                 return status;
 957         }
 958
 959         *_creds = creds;
 960         return NT_STATUS_OK;
 961 }
 962
 963 /************************************************************************
 964  Given a fd with a just-connected TCP connection to a DC, open a connection
 965  to the pipe.
 966 ************************************************************************/
 967
 968 static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
 969                                       const int sockfd,
 970                                       const char *controller,
 971                                       struct cli_state **cli,
 972                                       bool *retry)
 973 {
 974         bool try_ipc_auth = false;
 975         const char *machine_password = NULL;
 976         const char *machine_krb5_principal = NULL;
 977         const char *machine_account = NULL;
 978         const char *machine_domain = NULL;
 979         int flags = 0;
 980         struct cli_credentials *creds = NULL;
 981         enum credentials_use_kerberos krb5_state;
 982
 983         struct named_mutex *mutex;
 984
 985         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 986
 987         enum smb_signing_setting smb_sign_client_connections = lp_client_signing();
 988
 989         if (smb_sign_client_connections == SMB_SIGNING_DEFAULT) {
 990                 /*
 991                  * If we are connecting to our own AD domain, require
 992                  * smb signing to disrupt MITM attacks
 993                  */
 994                 if (domain->primary && lp_security() == SEC_ADS) {
 995                         smb_sign_client_connections = SMB_SIGNING_REQUIRED;
 996                 /*
 997                  * If we are in or are an AD domain and connecting to another
 998                  * AD domain in our forest
 999                  * then require smb signing to disrupt MITM attacks
1000                  */
1001                 } else if ((lp_security() == SEC_ADS ||
1002                             lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC)
1003                            && domain->active_directory
1004                            && (domain->domain_trust_attribs
1005                                & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)) {
1006                         smb_sign_client_connections = SMB_SIGNING_REQUIRED;
1007                 }
1008         }
1009
1010         DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
1011                 controller, domain->name ));
1012
1013         *retry = True;
1014
1015         mutex = grab_named_mutex(talloc_tos(), controller,
1016                                  WINBIND_SERVER_MUTEX_WAIT_TIME);
1017         if (mutex == NULL) {
1018                 close(sockfd);
1019                 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
1020                          controller));
1021                 result = NT_STATUS_POSSIBLE_DEADLOCK;
1022                 goto done;
1023         }
1024
1025         flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
1026
1027         *cli = cli_state_create(NULL, sockfd,
1028                                 controller, domain->alt_name,
1029                                 smb_sign_client_connections, flags);
1030         if (*cli == NULL) {
1031                 close(sockfd);
1032                 DEBUG(1, ("Could not cli_initialize\n"));
1033                 result = NT_STATUS_NO_MEMORY;
1034                 goto done;
1035         }
1036
1037         cli_set_timeout(*cli, 10000); /* 10 seconds */
1038
1039         result = smbXcli_negprot((*cli)->conn, (*cli)->timeout,
1040                                  lp_client_min_protocol(),
1041                                  lp_winbindd_max_protocol());
1042
1043         if (!NT_STATUS_IS_OK(result)) {
1044                 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
1045                 goto done;
1046         }
1047
1048         if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_NT1 &&
1049             smb1cli_conn_capabilities((*cli)->conn) & CAP_EXTENDED_SECURITY) {
1050                 try_ipc_auth = true;
1051         } else if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
1052                 try_ipc_auth = true;
1053         } else if (smb_sign_client_connections == SMB_SIGNING_REQUIRED) {
1054                 /*
1055                  * If we are forcing on SMB signing, then we must
1056                  * require authentication unless this is a one-way
1057                  * trust, and we have no stored user/password
1058                  */
1059                 try_ipc_auth = true;
1060         }
1061
1062         if (try_ipc_auth) {
1063                 result = get_trust_credentials(domain, talloc_tos(), false, &creds);
1064                 if (!NT_STATUS_IS_OK(result)) {
1065                         DEBUG(1, ("get_trust_credentials(%s) failed: %s\n",
1066                                   domain->name, nt_errstr(result)));
1067                         goto done;
1068                 }
1069         } else {
1070                 /*
1071                  * Without SPNEGO or NTLMSSP (perhaps via SMB2) we
1072                  * would try and authentication with our machine
1073                  * account password and fail.  This is very rare in
1074                  * the modern world however
1075                  */
1076                 creds = cli_credentials_init_anon(talloc_tos());
1077                 if (creds == NULL) {
1078                         result = NT_STATUS_NO_MEMORY;
1079                         DEBUG(1, ("cli_credentials_init_anon(%s) failed: %s\n",
1080                                   domain->name, nt_errstr(result)));
1081                         goto done;
1082                 }
1083         }
1084
1085         krb5_state = cli_credentials_get_kerberos_state(creds);
1086
1087         machine_krb5_principal = cli_credentials_get_principal(creds,
1088                                                         talloc_tos());
1089         if (machine_krb5_principal == NULL) {
1090                 krb5_state = CRED_DONT_USE_KERBEROS;
1091         }
1092
1093         machine_account = cli_credentials_get_username(creds);
1094         machine_password = cli_credentials_get_password(creds);
1095         machine_domain = cli_credentials_get_domain(creds);
1096
1097         if (krb5_state != CRED_DONT_USE_KERBEROS) {
1098
1099                 /* Try a krb5 session */
1100
1101                 (*cli)->use_kerberos = True;
1102                 DEBUG(5, ("connecting to %s from %s with kerberos principal "
1103                           "[%s] and realm [%s]\n", controller, lp_netbios_name(),
1104                           machine_krb5_principal, domain->alt_name));
1105
1106                 winbindd_set_locator_kdc_envs(domain);
1107
1108                 result = cli_session_setup(*cli,
1109                                            machine_krb5_principal,
1110                                            machine_password,
1111                                            strlen(machine_password)+1,
1112                                            machine_password,
1113                                            strlen(machine_password)+1,
1114                                            machine_domain);
1115
1116                 if (NT_STATUS_IS_OK(result)) {
1117                         goto session_setup_done;
1118                 }
1119
1120                 DEBUG(4,("failed kerberos session setup with %s\n",
1121                          nt_errstr(result)));
1122         }
1123
1124         if (krb5_state != CRED_MUST_USE_KERBEROS) {
1125                 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
1126                 (*cli)->use_kerberos = False;
1127
1128                 DEBUG(5, ("connecting to %s from %s using NTLMSSP with username "
1129                           "[%s]\\[%s]\n",  controller, lp_netbios_name(),
1130                           machine_domain, machine_account));
1131
1132                 result = cli_session_setup(*cli,
1133                                            machine_account,
1134                                            machine_password,
1135                                            strlen(machine_password)+1,
1136                                            machine_password,
1137                                            strlen(machine_password)+1,
1138                                            machine_domain);
1139         }
1140
1141         if (NT_STATUS_IS_OK(result)) {
1142                 goto session_setup_done;
1143         }
1144
1145         /*
1146          * If we are not going to validiate the conneciton
1147          * with SMB signing, then allow us to fall back to
1148          * anonymous
1149          */
1150         if (NT_STATUS_EQUAL(result, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT)
1151             || NT_STATUS_EQUAL(result, NT_STATUS_TRUSTED_DOMAIN_FAILURE)
1152             || NT_STATUS_EQUAL(result, NT_STATUS_INVALID_ACCOUNT_NAME)
1153             || NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE))
1154         {
1155                 if (cli_credentials_is_anonymous(creds)) {
1156                         goto done;
1157                 }
1158
1159                 if (!cm_is_ipc_credentials(creds)) {
1160                         goto ipc_fallback;
1161                 }
1162
1163                 if (smb_sign_client_connections == SMB_SIGNING_REQUIRED) {
1164                         goto done;
1165                 }
1166
1167                 goto anon_fallback;
1168         }
1169
1170         DEBUG(4, ("authenticated session setup failed with %s\n",
1171                 nt_errstr(result)));
1172
1173         goto done;
1174
1175  ipc_fallback:
1176         result = cm_get_ipc_credentials(talloc_tos(), &creds);
1177         if (!NT_STATUS_IS_OK(result)) {
1178                 goto done;
1179         }
1180
1181         if (cli_credentials_is_anonymous(creds)) {
1182                 TALLOC_FREE(creds);
1183                 goto anon_fallback;
1184         }
1185
1186         machine_account = cli_credentials_get_username(creds);
1187         machine_password = cli_credentials_get_password(creds);
1188         machine_domain = cli_credentials_get_domain(creds);
1189
1190         /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the ipc creds. */
1191         (*cli)->use_kerberos = False;
1192
1193         DEBUG(5, ("connecting to %s from %s using NTLMSSP with username "
1194                   "[%s]\\[%s]\n",  controller, lp_netbios_name(),
1195                   machine_domain, machine_account));
1196
1197         result = cli_session_setup(*cli,
1198                                    machine_account,
1199                                    machine_password,
1200                                    strlen(machine_password)+1,
1201                                    machine_password,
1202                                    strlen(machine_password)+1,
1203                                    machine_domain);
1204
1205         if (NT_STATUS_IS_OK(result)) {
1206                 goto session_setup_done;
1207         }
1208
1209         /*
1210          * If we are not going to validiate the conneciton
1211          * with SMB signing, then allow us to fall back to
1212          * anonymous
1213          */
1214         if (NT_STATUS_EQUAL(result, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT)
1215             || NT_STATUS_EQUAL(result, NT_STATUS_TRUSTED_DOMAIN_FAILURE)
1216             || NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE))
1217         {
1218                 goto anon_fallback;
1219         }
1220
1221         DEBUG(4, ("authenticated session setup failed with %s\n",
1222                 nt_errstr(result)));
1223
1224         goto done;
1225
1226  anon_fallback:
1227
1228         if (smb_sign_client_connections == SMB_SIGNING_REQUIRED) {
1229                 goto done;
1230         }
1231
1232         creds = cli_credentials_init_anon(talloc_tos());
1233         if (creds == NULL) {
1234                 result = NT_STATUS_NO_MEMORY;
1235                 goto done;
1236         }
1237
1238         machine_account = cli_credentials_get_username(creds);
1239         machine_password = cli_credentials_get_password(creds);
1240         machine_domain = cli_credentials_get_domain(creds);
1241
1242         /* Fall back to anonymous connection, this might fail later */
1243         DEBUG(10,("cm_prepare_connection: falling back to anonymous "
1244                 "connection for DC %s\n",
1245                 controller ));
1246
1247         (*cli)->use_kerberos = False;
1248
1249         result = cli_session_setup(*cli,
1250                                    machine_account,
1251                                    machine_password,
1252                                    strlen(machine_password)+1,
1253                                    machine_password,
1254                                    strlen(machine_password)+1,
1255                                    machine_domain);
1256
1257         if (NT_STATUS_IS_OK(result)) {
1258                 DEBUG(5, ("Connected anonymously\n"));
1259                 goto session_setup_done;
1260         }
1261
1262         /* We can't session setup */
1263         goto done;
1264
1265  session_setup_done:
1266
1267         /*
1268          * This should be a short term hack until
1269          * dynamic re-authentication is implemented.
1270          *
1271          * See Bug 9175 - winbindd doesn't recover from
1272          * NT_STATUS_NETWORK_SESSION_EXPIRED
1273          */
1274         if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
1275                 smbXcli_session_set_disconnect_expired((*cli)->smb2.session);
1276         }
1277
1278         result = cli_tree_connect(*cli, "IPC$", "IPC", "", 0);
1279
1280         if (!NT_STATUS_IS_OK(result)) {
1281                 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
1282                 goto done;
1283         }
1284
1285         /* cache the server name for later connections */
1286
1287         saf_store(domain->name, controller);
1288         if (domain->alt_name && (*cli)->use_kerberos) {
1289                 saf_store(domain->alt_name, controller);
1290         }
1291
1292         winbindd_set_locator_kdc_envs(domain);
1293
1294         TALLOC_FREE(mutex);
1295         *retry = False;
1296
1297         result = NT_STATUS_OK;
1298
1299  done:
1300         TALLOC_FREE(mutex);
1301
1302         if (!NT_STATUS_IS_OK(result)) {
1303                 winbind_add_failed_connection_entry(domain, controller, result);
1304                 if ((*cli) != NULL) {
1305                         cli_shutdown(*cli);
1306                         *cli = NULL;
1307                 }
1308         }
1309
1310         return result;
1311 }
1312
1313 /*******************************************************************
1314  Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1315  array.
1316
1317  Keeps the list unique by not adding duplicate entries.
1318
1319  @param[in] mem_ctx talloc memory context to allocate from
1320  @param[in] domain_name domain of the DC
1321  @param[in] dcname name of the DC to add to the list
1322  @param[in] pss Internet address and port pair to add to the list
1323  @param[in,out] dcs array of dc_name_ip structures to add to
1324  @param[in,out] num_dcs number of dcs returned in the dcs array
1325  @return true if the list was added to, false otherwise
1326 *******************************************************************/
1327
1328 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
1329                               const char *dcname, struct sockaddr_storage *pss,
1330                               struct dc_name_ip **dcs, int *num)
1331 {
1332         int i = 0;
1333
1334         if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1335                 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1336                 return False;
1337         }
1338
1339         /* Make sure there's no duplicates in the list */
1340         for (i=0; i<*num; i++)
1341                 if (sockaddr_equal(
1342                             (struct sockaddr *)(void *)&(*dcs)[i].ss,
1343                             (struct sockaddr *)(void *)pss))
1344                         return False;
1345
1346         *dcs = talloc_realloc(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1347
1348         if (*dcs == NULL)
1349                 return False;
1350
1351         fstrcpy((*dcs)[*num].name, dcname);
1352         (*dcs)[*num].ss = *pss;
1353         *num += 1;
1354         return True;
1355 }
1356
1357 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
1358                                   struct sockaddr_storage *pss, uint16 port,
1359                                   struct sockaddr_storage **addrs, int *num)
1360 {
1361         *addrs = talloc_realloc(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1362
1363         if (*addrs == NULL) {
1364                 *num = 0;
1365                 return False;
1366         }
1367
1368         (*addrs)[*num] = *pss;
1369         set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1370
1371         *num += 1;
1372         return True;
1373 }
1374
1375 /*******************************************************************
1376  convert an ip to a name
1377 *******************************************************************/
1378
1379 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
1380                 const struct winbindd_domain *domain,
1381                 struct sockaddr_storage *pss,
1382                 char **name)
1383 {
1384         struct ip_service ip_list;
1385         uint32_t nt_version = NETLOGON_NT_VERSION_1;
1386         NTSTATUS status;
1387         const char *dc_name;
1388         fstring nbtname;
1389
1390         ip_list.ss = *pss;
1391         ip_list.port = 0;
1392
1393 #ifdef HAVE_ADS
1394         /* For active directory servers, try to get the ldap server name.
1395            None of these failures should be considered critical for now */
1396
1397         if ((lp_security() == SEC_ADS) && (domain->alt_name != NULL)) {
1398                 ADS_STRUCT *ads;
1399                 ADS_STATUS ads_status;
1400                 char addr[INET6_ADDRSTRLEN];
1401
1402                 print_sockaddr(addr, sizeof(addr), pss);
1403
1404                 ads = ads_init(domain->alt_name, domain->name, addr);
1405                 ads->auth.flags |= ADS_AUTH_NO_BIND;
1406
1407                 ads_status = ads_connect(ads);
1408                 if (ADS_ERR_OK(ads_status)) {
1409                         /* We got a cldap packet. */
1410                         *name = talloc_strdup(mem_ctx,
1411                                              ads->config.ldap_server_name);
1412                         if (*name == NULL) {
1413                                 return false;
1414                         }
1415                         namecache_store(*name, 0x20, 1, &ip_list);
1416
1417                         DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1418
1419                         if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1420                                 if (ads_closest_dc(ads)) {
1421                                         char *sitename = sitename_fetch(mem_ctx, ads->config.realm);
1422
1423                                         /* We're going to use this KDC for this realm/domain.
1424                                            If we are using sites, then force the krb5 libs
1425                                            to use this KDC. */
1426
1427                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1428                                                                         domain->name,
1429                                                                         sitename,
1430                                                                         pss);
1431
1432                                         TALLOC_FREE(sitename);
1433                                 } else {
1434                                         /* use an off site KDC */
1435                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1436                                                                         domain->name,
1437                                                                         NULL,
1438                                                                         pss);
1439                                 }
1440                                 winbindd_set_locator_kdc_envs(domain);
1441
1442                                 /* Ensure we contact this DC also. */
1443                                 saf_store(domain->name, *name);
1444                                 saf_store(domain->alt_name, *name);
1445                         }
1446
1447                         ads_destroy( &ads );
1448                         return True;
1449                 }
1450
1451                 ads_destroy( &ads );
1452                 return false;
1453         }
1454 #endif
1455
1456         status = nbt_getdc(winbind_messaging_context(), 10, pss, domain->name,
1457                            &domain->sid, nt_version, mem_ctx, &nt_version,
1458                            &dc_name, NULL);
1459         if (NT_STATUS_IS_OK(status)) {
1460                 *name = talloc_strdup(mem_ctx, dc_name);
1461                 if (*name == NULL) {
1462                         return false;
1463                 }
1464                 namecache_store(*name, 0x20, 1, &ip_list);
1465                 return True;
1466         }
1467
1468         /* try node status request */
1469
1470         if (name_status_find(domain->name, 0x1c, 0x20, pss, nbtname) ) {
1471                 namecache_store(nbtname, 0x20, 1, &ip_list);
1472
1473                 if (name != NULL) {
1474                         *name = talloc_strdup(mem_ctx, nbtname);
1475                         if (*name == NULL) {
1476                                 return false;
1477                         }
1478                 }
1479
1480                 return true;
1481         }
1482         return False;
1483 }
1484
1485 /*******************************************************************
1486  Retrieve a list of IP addresses for domain controllers.
1487
1488  The array is sorted in the preferred connection order.
1489
1490  @param[in] mem_ctx talloc memory context to allocate from
1491  @param[in] domain domain to retrieve DCs for
1492  @param[out] dcs array of dcs that will be returned
1493  @param[out] num_dcs number of dcs returned in the dcs array
1494  @return always true
1495 *******************************************************************/
1496
1497 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
1498                     struct dc_name_ip **dcs, int *num_dcs)
1499 {
1500         fstring dcname;
1501         struct  sockaddr_storage ss;
1502         struct  ip_service *ip_list = NULL;
1503         int     iplist_size = 0;
1504         int     i;
1505         bool    is_our_domain;
1506         enum security_types sec = (enum security_types)lp_security();
1507
1508         is_our_domain = strequal(domain->name, lp_workgroup());
1509
1510         /* If not our domain, get the preferred DC, by asking our primary DC */
1511         if ( !is_our_domain
1512                 && get_dc_name_via_netlogon(domain, dcname, &ss)
1513                 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1514                        num_dcs) )
1515         {
1516                 char addr[INET6_ADDRSTRLEN];
1517                 print_sockaddr(addr, sizeof(addr), &ss);
1518                 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1519                            dcname, addr));
1520                 return True;
1521         }
1522
1523         if ((sec == SEC_ADS) && (domain->alt_name != NULL)) {
1524                 char *sitename = NULL;
1525
1526                 /* We need to make sure we know the local site before
1527                    doing any DNS queries, as this will restrict the
1528                    get_sorted_dc_list() call below to only fetching
1529                    DNS records for the correct site. */
1530
1531                 /* Find any DC to get the site record.
1532                    We deliberately don't care about the
1533                    return here. */
1534
1535                 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1536
1537                 sitename = sitename_fetch(mem_ctx, domain->alt_name);
1538                 if (sitename) {
1539
1540                         /* Do the site-specific AD dns lookup first. */
1541                         get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1542                                &iplist_size, True);
1543
1544                         /* Add ips to the DC array.  We don't look up the name
1545                            of the DC in this function, but we fill in the char*
1546                            of the ip now to make the failed connection cache
1547                            work */
1548                         for ( i=0; i<iplist_size; i++ ) {
1549                                 char addr[INET6_ADDRSTRLEN];
1550                                 print_sockaddr(addr, sizeof(addr),
1551                                                 &ip_list[i].ss);
1552                                 add_one_dc_unique(mem_ctx,
1553                                                 domain->name,
1554                                                 addr,
1555                                                 &ip_list[i].ss,
1556                                                 dcs,
1557                                                 num_dcs);
1558                         }
1559
1560                         SAFE_FREE(ip_list);
1561                         TALLOC_FREE(sitename);
1562                         iplist_size = 0;
1563                 }
1564
1565                 /* Now we add DCs from the main AD DNS lookup. */
1566                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1567                         &iplist_size, True);
1568
1569                 for ( i=0; i<iplist_size; i++ ) {
1570                         char addr[INET6_ADDRSTRLEN];
1571                         print_sockaddr(addr, sizeof(addr),
1572                                         &ip_list[i].ss);
1573                         add_one_dc_unique(mem_ctx,
1574                                         domain->name,
1575                                         addr,
1576                                         &ip_list[i].ss,
1577                                         dcs,
1578                                         num_dcs);
1579                 }
1580
1581                 SAFE_FREE(ip_list);
1582                 iplist_size = 0;
1583         }
1584
1585         /* Try standard netbios queries if no ADS and fall back to DNS queries
1586          * if alt_name is available */
1587         if (*num_dcs == 0) {
1588                 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1589                        false);
1590                 if (iplist_size == 0) {
1591                         if (domain->alt_name != NULL) {
1592                                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1593                                        &iplist_size, true);
1594                         }
1595                 }
1596
1597                 for ( i=0; i<iplist_size; i++ ) {
1598                         char addr[INET6_ADDRSTRLEN];
1599                         print_sockaddr(addr, sizeof(addr),
1600                                         &ip_list[i].ss);
1601                         add_one_dc_unique(mem_ctx,
1602                                         domain->name,
1603                                         addr,
1604                                         &ip_list[i].ss,
1605                                         dcs,
1606                                         num_dcs);
1607                 }
1608
1609                 SAFE_FREE(ip_list);
1610                 iplist_size = 0;
1611         }
1612
1613         return True;
1614 }
1615
1616 /*******************************************************************
1617  Find and make a connection to a DC in the given domain.
1618
1619  @param[in] mem_ctx talloc memory context to allocate from
1620  @param[in] domain domain to find a dc in
1621  @param[out] dcname NetBIOS or FQDN of DC that's connected to
1622  @param[out] pss DC Internet address and port
1623  @param[out] fd fd of the open socket connected to the newly found dc
1624  @return true when a DC connection is made, false otherwise
1625 *******************************************************************/
1626
1627 static bool find_new_dc(TALLOC_CTX *mem_ctx,
1628                         struct winbindd_domain *domain,
1629                         char **dcname, struct sockaddr_storage *pss, int *fd)
1630 {
1631         struct dc_name_ip *dcs = NULL;
1632         int num_dcs = 0;
1633
1634         const char **dcnames = NULL;
1635         size_t num_dcnames = 0;
1636
1637         struct sockaddr_storage *addrs = NULL;
1638         int num_addrs = 0;
1639
1640         int i;
1641         size_t fd_index;
1642
1643         NTSTATUS status;
1644
1645         *fd = -1;
1646
1647  again:
1648         if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1649                 return False;
1650
1651         for (i=0; i<num_dcs; i++) {
1652
1653                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1654                                     &dcnames, &num_dcnames)) {
1655                         return False;
1656                 }
1657                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, TCP_SMB_PORT,
1658                                       &addrs, &num_addrs)) {
1659                         return False;
1660                 }
1661         }
1662
1663         if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1664                 return False;
1665
1666         if ((addrs == NULL) || (dcnames == NULL))
1667                 return False;
1668
1669         status = smbsock_any_connect(addrs, dcnames, NULL, NULL, NULL,
1670                                      num_addrs, 0, 10, fd, &fd_index, NULL);
1671         if (!NT_STATUS_IS_OK(status)) {
1672                 for (i=0; i<num_dcs; i++) {
1673                         char ab[INET6_ADDRSTRLEN];
1674                         print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1675                         DEBUG(10, ("find_new_dc: smbsock_any_connect failed for "
1676                                 "domain %s address %s. Error was %s\n",
1677                                    domain->name, ab, nt_errstr(status) ));
1678                         winbind_add_failed_connection_entry(domain,
1679                                 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1680                 }
1681                 return False;
1682         }
1683
1684         *pss = addrs[fd_index];
1685
1686         if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1687                 /* Ok, we've got a name for the DC */
1688                 *dcname = talloc_strdup(mem_ctx, dcnames[fd_index]);
1689                 if (*dcname == NULL) {
1690                         return false;
1691                 }
1692                 return true;
1693         }
1694
1695         /* Try to figure out the name */
1696         if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1697                 return True;
1698         }
1699
1700         /* We can not continue without the DC's name */
1701         winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1702                                     NT_STATUS_UNSUCCESSFUL);
1703
1704         /* Throw away all arrays as we're doing this again. */
1705         TALLOC_FREE(dcs);
1706         num_dcs = 0;
1707
1708         TALLOC_FREE(dcnames);
1709         num_dcnames = 0;
1710
1711         TALLOC_FREE(addrs);
1712         num_addrs = 0;
1713
1714         close(*fd);
1715         *fd = -1;
1716
1717         goto again;
1718 }
1719
1720 static char *current_dc_key(TALLOC_CTX *mem_ctx, const char *domain_name)
1721 {
1722         return talloc_asprintf_strupper_m(mem_ctx, "CURRENT_DCNAME/%s",
1723                                           domain_name);
1724 }
1725
1726 static void store_current_dc_in_gencache(const char *domain_name,
1727                                          const char *dc_name,
1728                                          struct cli_state *cli)
1729 {
1730         char addr[INET6_ADDRSTRLEN];
1731         char *key = NULL;
1732         char *value = NULL;
1733
1734         if (!cli_state_is_connected(cli)) {
1735                 return;
1736         }
1737
1738         print_sockaddr(addr, sizeof(addr),
1739                        smbXcli_conn_remote_sockaddr(cli->conn));
1740
1741         key = current_dc_key(talloc_tos(), domain_name);
1742         if (key == NULL) {
1743                 goto done;
1744         }
1745
1746         value = talloc_asprintf(talloc_tos(), "%s %s", addr, dc_name);
1747         if (value == NULL) {
1748                 goto done;
1749         }
1750
1751         gencache_set(key, value, 0x7fffffff);
1752 done:
1753         TALLOC_FREE(value);
1754         TALLOC_FREE(key);
1755 }
1756
1757 bool fetch_current_dc_from_gencache(TALLOC_CTX *mem_ctx,
1758                                     const char *domain_name,
1759                                     char **p_dc_name, char **p_dc_ip)
1760 {
1761         char *key, *p;
1762         char *value = NULL;
1763         bool ret = false;
1764         char *dc_name = NULL;
1765         char *dc_ip = NULL;
1766
1767         key = current_dc_key(talloc_tos(), domain_name);
1768         if (key == NULL) {
1769                 goto done;
1770         }
1771         if (!gencache_get(key, mem_ctx, &value, NULL)) {
1772                 goto done;
1773         }
1774         p = strchr(value, ' ');
1775         if (p == NULL) {
1776                 goto done;
1777         }
1778         dc_ip = talloc_strndup(mem_ctx, value, p - value);
1779         if (dc_ip == NULL) {
1780                 goto done;
1781         }
1782         dc_name = talloc_strdup(mem_ctx, p+1);
1783         if (dc_name == NULL) {
1784                 goto done;
1785         }
1786
1787         if (p_dc_ip != NULL) {
1788                 *p_dc_ip = dc_ip;
1789                 dc_ip = NULL;
1790         }
1791         if (p_dc_name != NULL) {
1792                 *p_dc_name = dc_name;
1793                 dc_name = NULL;
1794         }
1795         ret = true;
1796 done:
1797         TALLOC_FREE(dc_name);
1798         TALLOC_FREE(dc_ip);
1799         TALLOC_FREE(key);
1800         TALLOC_FREE(value);
1801         return ret;
1802 }
1803
1804 NTSTATUS wb_open_internal_pipe(TALLOC_CTX *mem_ctx,
1805                                const struct ndr_interface_table *table,
1806                                struct rpc_pipe_client **ret_pipe)
1807 {
1808         struct rpc_pipe_client *cli = NULL;
1809         const struct auth_session_info *session_info;
1810         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1811
1812
1813         session_info = get_session_info_system();
1814         SMB_ASSERT(session_info != NULL);
1815
1816         /* create a connection to the specified pipe */
1817         if (lp_parm_bool(-1, "winbindd", "use external pipes", false)) {
1818                 status = rpc_pipe_open_interface(mem_ctx,
1819                                                  table,
1820                                                  session_info,
1821                                                  NULL,
1822                                                  winbind_messaging_context(),
1823                                                  &cli);
1824         } else {
1825                 status = rpc_pipe_open_internal(mem_ctx,
1826                                                 &table->syntax_id,
1827                                                 session_info,
1828                                                 NULL,
1829                                                 winbind_messaging_context(),
1830                                                 &cli);
1831         }
1832         if (!NT_STATUS_IS_OK(status)) {
1833                 DEBUG(0, ("open_internal_pipe: Could not connect to %s pipe: %s\n",
1834                           table->name, nt_errstr(status)));
1835                 return status;
1836         }
1837
1838         if (ret_pipe) {
1839                 *ret_pipe = cli;
1840         }
1841
1842         return NT_STATUS_OK;
1843 }
1844
1845 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
1846                                    struct winbindd_cm_conn *new_conn)
1847 {
1848         TALLOC_CTX *mem_ctx;
1849         NTSTATUS result;
1850         char *saf_servername;
1851         int retries;
1852
1853         if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1854                 set_domain_offline(domain);
1855                 return NT_STATUS_NO_MEMORY;
1856         }
1857
1858         saf_servername = saf_fetch(mem_ctx, domain->name );
1859
1860         /* we have to check the server affinity cache here since
1861            later we select a DC based on response time and not preference */
1862
1863         /* Check the negative connection cache
1864            before talking to it. It going down may have
1865            triggered the reconnection. */
1866
1867         if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1868
1869                 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1870                         saf_servername, domain->name ));
1871
1872                 /* convert an ip address to a name */
1873                 if (is_ipaddress( saf_servername ) ) {
1874                         char *dcname = NULL;
1875                         struct sockaddr_storage ss;
1876
1877                         if (!interpret_string_addr(&ss, saf_servername,
1878                                                 AI_NUMERICHOST)) {
1879                                 TALLOC_FREE(mem_ctx);
1880                                 return NT_STATUS_UNSUCCESSFUL;
1881                         }
1882                         if (dcip_to_name(mem_ctx, domain, &ss, &dcname)) {
1883                                 domain->dcname = talloc_strdup(domain,
1884                                                                dcname);
1885                                 if (domain->dcname == NULL) {
1886                                         TALLOC_FREE(mem_ctx);
1887                                         return NT_STATUS_NO_MEMORY;
1888                                 }
1889                         } else {
1890                                 winbind_add_failed_connection_entry(
1891                                         domain, saf_servername,
1892                                         NT_STATUS_UNSUCCESSFUL);
1893                         }
1894                 } else {
1895                         domain->dcname = talloc_strdup(domain, saf_servername);
1896                         if (domain->dcname == NULL) {
1897                                 TALLOC_FREE(mem_ctx);
1898                                 return NT_STATUS_NO_MEMORY;
1899                         }
1900                 }
1901         }
1902
1903         for (retries = 0; retries < 3; retries++) {
1904                 int fd = -1;
1905                 bool retry = False;
1906                 char *dcname = NULL;
1907
1908                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1909
1910                 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1911                         domain->dcname ? domain->dcname : "", domain->name ));
1912
1913                 if (domain->dcname != NULL
1914                         && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1915                         && (resolve_name(domain->dcname, &domain->dcaddr, 0x20, true)))
1916                 {
1917                         NTSTATUS status;
1918
1919                         status = smbsock_connect(&domain->dcaddr, 0,
1920                                                  NULL, -1, NULL, -1,
1921                                                  &fd, NULL, 10);
1922                         if (!NT_STATUS_IS_OK(status)) {
1923                                 fd = -1;
1924                         }
1925                 }
1926
1927                 if ((fd == -1) &&
1928                     !find_new_dc(mem_ctx, domain, &dcname, &domain->dcaddr, &fd))
1929                 {
1930                         /* This is the one place where we will
1931                            set the global winbindd offline state
1932                            to true, if a "WINBINDD_OFFLINE" entry
1933                            is found in the winbindd cache. */
1934                         set_global_winbindd_state_offline();
1935                         break;
1936                 }
1937                 if (dcname != NULL) {
1938                         talloc_free(domain->dcname);
1939
1940                         domain->dcname = talloc_move(domain, &dcname);
1941                         if (domain->dcname == NULL) {
1942                                 result = NT_STATUS_NO_MEMORY;
1943                                 break;
1944                         }
1945                 }
1946
1947                 new_conn->cli = NULL;
1948
1949                 result = cm_prepare_connection(domain, fd, domain->dcname,
1950                         &new_conn->cli, &retry);
1951                 if (!NT_STATUS_IS_OK(result)) {
1952                         /* Don't leak the smb connection socket */
1953                         close(fd);
1954                 }
1955
1956                 if (!retry)
1957                         break;
1958         }
1959
1960         if (NT_STATUS_IS_OK(result)) {
1961                 bool seal_pipes = true;
1962
1963                 winbindd_set_locator_kdc_envs(domain);
1964
1965                 if (domain->online == False) {
1966                         /* We're changing state from offline to online. */
1967                         set_global_winbindd_state_online();
1968                 }
1969                 set_domain_online(domain);
1970
1971                 /*
1972                  * Much as I hate global state, this seems to be the point
1973                  * where we can be certain that we have a proper connection to
1974                  * a DC. wbinfo --dc-info needs that information, store it in
1975                  * gencache with a looong timeout. This will need revisiting
1976                  * once we start to connect to multiple DCs, wbcDcInfo is
1977                  * already prepared for that.
1978                  */
1979                 store_current_dc_in_gencache(domain->name, domain->dcname,
1980                                              new_conn->cli);
1981
1982                 seal_pipes = lp_winbind_sealed_pipes();
1983                 seal_pipes = lp_parm_bool(-1, "winbind sealed pipes",
1984                                           domain->name,
1985                                           seal_pipes);
1986
1987                 if (seal_pipes) {
1988                         new_conn->auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1989                 } else {
1990                         new_conn->auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1991                 }
1992         } else {
1993                 /* Ensure we setup the retry handler. */
1994                 set_domain_offline(domain);
1995         }
1996
1997         talloc_destroy(mem_ctx);
1998         return result;
1999 }
2000
2001 /* Close down all open pipes on a connection. */
2002
2003 void invalidate_cm_connection(struct winbindd_domain *domain)
2004 {
2005         NTSTATUS result;
2006         struct winbindd_cm_conn *conn = &domain->conn;
2007
2008         /* We're closing down a possibly dead
2009            connection. Don't have impossibly long (10s) timeouts. */
2010
2011         if (conn->cli) {
2012                 cli_set_timeout(conn->cli, 1000); /* 1 second. */
2013         }
2014
2015         if (conn->samr_pipe != NULL) {
2016                 if (is_valid_policy_hnd(&conn->sam_connect_handle)) {
2017                         dcerpc_samr_Close(conn->samr_pipe->binding_handle,
2018                                           talloc_tos(),
2019                                           &conn->sam_connect_handle,
2020                                           &result);
2021                 }
2022                 TALLOC_FREE(conn->samr_pipe);
2023                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
2024                 if (conn->cli) {
2025                         cli_set_timeout(conn->cli, 500);
2026                 }
2027         }
2028
2029         if (conn->lsa_pipe != NULL) {
2030                 if (is_valid_policy_hnd(&conn->lsa_policy)) {
2031                         dcerpc_lsa_Close(conn->lsa_pipe->binding_handle,
2032                                          talloc_tos(),
2033                                          &conn->lsa_policy,
2034                                          &result);
2035                 }
2036                 TALLOC_FREE(conn->lsa_pipe);
2037                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
2038                 if (conn->cli) {
2039                         cli_set_timeout(conn->cli, 500);
2040                 }
2041         }
2042
2043         if (conn->lsa_pipe_tcp != NULL) {
2044                 if (is_valid_policy_hnd(&conn->lsa_policy)) {
2045                         dcerpc_lsa_Close(conn->lsa_pipe_tcp->binding_handle,
2046                                          talloc_tos(),
2047                                          &conn->lsa_policy,
2048                                          &result);
2049                 }
2050                 TALLOC_FREE(conn->lsa_pipe_tcp);
2051                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
2052                 if (conn->cli) {
2053                         cli_set_timeout(conn->cli, 500);
2054                 }
2055         }
2056
2057         if (conn->netlogon_pipe != NULL) {
2058                 TALLOC_FREE(conn->netlogon_pipe);
2059                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
2060                 if (conn->cli) {
2061                         cli_set_timeout(conn->cli, 500);
2062                 }
2063         }
2064
2065         conn->auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
2066         conn->netlogon_force_reauth = false;
2067         conn->netlogon_flags = 0;
2068         TALLOC_FREE(conn->netlogon_creds);
2069
2070         if (conn->cli) {
2071                 cli_shutdown(conn->cli);
2072         }
2073
2074         conn->cli = NULL;
2075 }
2076
2077 void close_conns_after_fork(void)
2078 {
2079         struct winbindd_domain *domain;
2080         struct winbindd_cli_state *cli_state;
2081
2082         for (domain = domain_list(); domain; domain = domain->next) {
2083                 /*
2084                  * first close the low level SMB TCP connection
2085                  * so that we don't generate any SMBclose
2086                  * requests in invalidate_cm_connection()
2087                  */
2088                 if (cli_state_is_connected(domain->conn.cli)) {
2089                         smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
2090                 }
2091
2092                 invalidate_cm_connection(domain);
2093         }
2094
2095         for (cli_state = winbindd_client_list();
2096              cli_state != NULL;
2097              cli_state = cli_state->next) {
2098                 if (cli_state->sock >= 0) {
2099                         close(cli_state->sock);
2100                         cli_state->sock = -1;
2101                 }
2102         }
2103 }
2104
2105 static bool connection_ok(struct winbindd_domain *domain)
2106 {
2107         bool ok;
2108
2109         ok = cli_state_is_connected(domain->conn.cli);
2110         if (!ok) {
2111                 DEBUG(3, ("connection_ok: Connection to %s for domain %s is not connected\n",
2112                           domain->dcname, domain->name));
2113                 return False;
2114         }
2115
2116         if (domain->online == False) {
2117                 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
2118                 return False;
2119         }
2120
2121         return True;
2122 }
2123
2124 /* Initialize a new connection up to the RPC BIND.
2125    Bypass online status check so always does network calls. */
2126
2127 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain, bool need_rw_dc)
2128 {
2129         NTSTATUS result;
2130         bool skip_connection = domain->internal;
2131         if (need_rw_dc && domain->rodc) {
2132                 skip_connection = false;
2133         }
2134
2135         /* Internal connections never use the network. */
2136         if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
2137                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2138         }
2139
2140         /* Still ask the internal LSA and SAMR server about the local domain */
2141         if (skip_connection || connection_ok(domain)) {
2142                 if (!domain->initialized) {
2143                         set_dc_type_and_flags(domain);
2144                 }
2145                 return NT_STATUS_OK;
2146         }
2147
2148         invalidate_cm_connection(domain);
2149
2150         if (!domain->primary && !domain->initialized) {
2151                 /*
2152                  * Before we connect to a trust, work out if it is an
2153                  * AD domain by asking our own domain.
2154                  */
2155                 set_dc_type_and_flags_trustinfo(domain);
2156         }
2157
2158         result = cm_open_connection(domain, &domain->conn);
2159
2160         if (NT_STATUS_IS_OK(result) && !domain->initialized) {
2161                 set_dc_type_and_flags(domain);
2162         }
2163
2164         return result;
2165 }
2166
2167 NTSTATUS init_dc_connection(struct winbindd_domain *domain, bool need_rw_dc)
2168 {
2169         if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
2170                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2171         }
2172
2173         if (domain->initialized && !domain->online) {
2174                 /* We check for online status elsewhere. */
2175                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
2176         }
2177
2178         return init_dc_connection_network(domain, need_rw_dc);
2179 }
2180
2181 static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain, bool need_rw_dc)
2182 {
2183         NTSTATUS status;
2184
2185         status = init_dc_connection(domain, need_rw_dc);
2186         if (!NT_STATUS_IS_OK(status)) {
2187                 return status;
2188         }
2189
2190         if (!domain->internal && domain->conn.cli == NULL) {
2191                 /* happens for trusted domains without inbound trust */
2192                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2193         }
2194
2195         return NT_STATUS_OK;
2196 }
2197
2198 /******************************************************************************
2199  Set the trust flags (direction and forest location) for a domain
2200 ******************************************************************************/
2201
2202 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
2203 {
2204         struct winbindd_domain *our_domain;
2205         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2206         WERROR werr;
2207         struct netr_DomainTrustList trusts;
2208         int i;
2209         uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
2210                         NETR_TRUST_FLAG_OUTBOUND |
2211                         NETR_TRUST_FLAG_INBOUND);
2212         struct rpc_pipe_client *cli;
2213         TALLOC_CTX *mem_ctx = NULL;
2214         struct dcerpc_binding_handle *b;
2215
2216         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
2217
2218         /* Our primary domain doesn't need to worry about trust flags.
2219            Force it to go through the network setup */
2220         if ( domain->primary ) {
2221                 return False;
2222         }
2223
2224         mem_ctx = talloc_stackframe();
2225         our_domain = find_our_domain();
2226         if (our_domain->internal) {
2227                 result = init_dc_connection(our_domain, false);
2228                 if (!NT_STATUS_IS_OK(result)) {
2229                         DEBUG(3,("set_dc_type_and_flags_trustinfo: "
2230                                  "Not able to make a connection to our domain: %s\n",
2231                                   nt_errstr(result)));
2232                         TALLOC_FREE(mem_ctx);
2233                         return false;
2234                 }
2235         }
2236
2237         /* This won't work unless our domain is AD */
2238         if ( !our_domain->active_directory ) {
2239                 TALLOC_FREE(mem_ctx);
2240                 return False;
2241         }
2242
2243         if (our_domain->internal) {
2244                 result = wb_open_internal_pipe(mem_ctx, &ndr_table_netlogon, &cli);
2245         } else if (!connection_ok(our_domain)) {
2246                 DEBUG(3,("set_dc_type_and_flags_trustinfo: "
2247                          "No connection to our domain!\n"));
2248                 TALLOC_FREE(mem_ctx);
2249                 return False;
2250         } else {
2251                 result = cm_connect_netlogon(our_domain, &cli);
2252         }
2253
2254         if (!NT_STATUS_IS_OK(result)) {
2255                 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
2256                           "a connection to %s for PIPE_NETLOGON (%s)\n",
2257                           domain->name, nt_errstr(result)));
2258                 TALLOC_FREE(mem_ctx);
2259                 return False;
2260         }
2261         b = cli->binding_handle;
2262
2263         /* Use DsEnumerateDomainTrusts to get us the trust direction and type. */
2264         result = dcerpc_netr_DsrEnumerateDomainTrusts(b, mem_ctx,
2265                                                       cli->desthost,
2266                                                       flags,
2267                                                       &trusts,
2268                                                       &werr);
2269         if (!NT_STATUS_IS_OK(result)) {
2270                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
2271                         "failed to query trusted domain list: %s\n",
2272                         nt_errstr(result)));
2273                 TALLOC_FREE(mem_ctx);
2274                 return false;
2275         }
2276         if (!W_ERROR_IS_OK(werr)) {
2277                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
2278                         "failed to query trusted domain list: %s\n",
2279                         win_errstr(werr)));
2280                 TALLOC_FREE(mem_ctx);
2281                 return false;
2282         }
2283
2284         /* Now find the domain name and get the flags */
2285
2286         for ( i=0; i<trusts.count; i++ ) {
2287                 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
2288                         domain->domain_flags          = trusts.array[i].trust_flags;
2289                         domain->domain_type           = trusts.array[i].trust_type;
2290                         domain->domain_trust_attribs  = trusts.array[i].trust_attributes;
2291
2292                         if ( domain->domain_type == LSA_TRUST_TYPE_UPLEVEL )
2293                                 domain->active_directory = True;
2294
2295                         /* This flag is only set if the domain is *our*
2296                            primary domain and the primary domain is in
2297                            native mode */
2298
2299                         domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
2300
2301                         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
2302                                   "native mode.\n", domain->name,
2303                                   domain->native_mode ? "" : "NOT "));
2304
2305                         DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
2306                                  "running active directory.\n", domain->name,
2307                                  domain->active_directory ? "" : "NOT "));
2308
2309                         domain->can_do_ncacn_ip_tcp = domain->active_directory;
2310
2311                         domain->initialized = True;
2312
2313                         break;
2314                 }
2315         }
2316
2317         TALLOC_FREE(mem_ctx);
2318
2319         return domain->initialized;
2320 }
2321
2322 /******************************************************************************
2323  We can 'sense' certain things about the DC by it's replies to certain
2324  questions.
2325
2326  This tells us if this particular remote server is Active Directory, and if it
2327  is native mode.
2328 ******************************************************************************/
2329
2330 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
2331 {
2332         NTSTATUS status, result;
2333         WERROR werr;
2334         TALLOC_CTX              *mem_ctx = NULL;
2335         struct rpc_pipe_client  *cli = NULL;
2336         struct policy_handle pol;
2337         union dssetup_DsRoleInfo info;
2338         union lsa_PolicyInformation *lsa_info = NULL;
2339
2340         if (!domain->internal && !connection_ok(domain)) {
2341                 return;
2342         }
2343
2344         mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
2345                               domain->name);
2346         if (!mem_ctx) {
2347                 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
2348                 return;
2349         }
2350
2351         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
2352
2353         if (domain->internal) {
2354                 status = wb_open_internal_pipe(mem_ctx,
2355                                                &ndr_table_dssetup,
2356                                                &cli);
2357         } else {
2358                 status = cli_rpc_pipe_open_noauth(domain->conn.cli,
2359                                                   &ndr_table_dssetup,
2360                                                   &cli);
2361         }
2362
2363         if (!NT_STATUS_IS_OK(status)) {
2364                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
2365                           "PI_DSSETUP on domain %s: (%s)\n",
2366                           domain->name, nt_errstr(status)));
2367
2368                 /* if this is just a non-AD domain we need to continue
2369                  * identifying so that we can in the end return with
2370                  * domain->initialized = True - gd */
2371
2372                 goto no_dssetup;
2373         }
2374
2375         status = dcerpc_dssetup_DsRoleGetPrimaryDomainInformation(cli->binding_handle, mem_ctx,
2376                                                                   DS_ROLE_BASIC_INFORMATION,
2377                                                                   &info,
2378                                                                   &werr);
2379         TALLOC_FREE(cli);
2380
2381         if (NT_STATUS_IS_OK(status)) {
2382                 result = werror_to_ntstatus(werr);
2383         }
2384         if (!NT_STATUS_IS_OK(status)) {
2385                 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
2386                           "on domain %s failed: (%s)\n",
2387                           domain->name, nt_errstr(status)));
2388
2389                 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
2390                  * every opcode on the DSSETUP pipe, continue with
2391                  * no_dssetup mode here as well to get domain->initialized
2392                  * set - gd */
2393
2394                 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
2395                         goto no_dssetup;
2396                 }
2397
2398                 TALLOC_FREE(mem_ctx);
2399                 return;
2400         }
2401
2402         if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
2403             !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
2404                 domain->native_mode = True;
2405         } else {
2406                 domain->native_mode = False;
2407         }
2408
2409 no_dssetup:
2410         if (domain->internal) {
2411                 status = wb_open_internal_pipe(mem_ctx,
2412                                                &ndr_table_lsarpc,
2413                                                &cli);
2414         } else {
2415                 status = cli_rpc_pipe_open_noauth(domain->conn.cli,
2416                                                   &ndr_table_lsarpc, &cli);
2417         }
2418         if (!NT_STATUS_IS_OK(status)) {
2419                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
2420                           "PI_LSARPC on domain %s: (%s)\n",
2421                           domain->name, nt_errstr(status)));
2422                 TALLOC_FREE(cli);
2423                 TALLOC_FREE(mem_ctx);
2424                 return;
2425         }
2426
2427         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
2428                                          SEC_FLAG_MAXIMUM_ALLOWED, &pol);
2429
2430         if (NT_STATUS_IS_OK(status)) {
2431                 /* This particular query is exactly what Win2k clients use
2432                    to determine that the DC is active directory */
2433                 status = dcerpc_lsa_QueryInfoPolicy2(cli->binding_handle, mem_ctx,
2434                                                      &pol,
2435                                                      LSA_POLICY_INFO_DNS,
2436                                                      &lsa_info,
2437                                                      &result);
2438         }
2439
2440         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2441                 domain->active_directory = True;
2442
2443                 if (lsa_info->dns.name.string) {
2444                         if (!strequal(domain->name, lsa_info->dns.name.string))
2445                         {
2446                                 DEBUG(1, ("set_dc_type_and_flags_connect: DC "
2447                                           "for domain %s claimed it was a DC "
2448                                           "for domain %s, refusing to "
2449                                           "initialize\n",
2450                                           domain->name,
2451                                           lsa_info->dns.name.string));
2452                                 TALLOC_FREE(cli);
2453                                 TALLOC_FREE(mem_ctx);
2454                                 return;
2455                         }
2456                         talloc_free(domain->name);
2457                         domain->name = talloc_strdup(domain,
2458                                                      lsa_info->dns.name.string);
2459                         if (domain->name == NULL) {
2460                                 goto done;
2461                         }
2462                 }
2463
2464                 if (lsa_info->dns.dns_domain.string) {
2465                         if (domain->alt_name != NULL &&
2466                             !strequal(domain->alt_name,
2467                                       lsa_info->dns.dns_domain.string))
2468                         {
2469                                 DEBUG(1, ("set_dc_type_and_flags_connect: DC "
2470                                           "for domain %s (%s) claimed it was "
2471                                           "a DC for domain %s, refusing to "
2472                                           "initialize\n",
2473                                           domain->alt_name, domain->name,
2474                                           lsa_info->dns.dns_domain.string));
2475                                 TALLOC_FREE(cli);
2476                                 TALLOC_FREE(mem_ctx);
2477                                 return;
2478                         }
2479                         talloc_free(domain->alt_name);
2480                         domain->alt_name =
2481                                 talloc_strdup(domain,
2482                                               lsa_info->dns.dns_domain.string);
2483                         if (domain->alt_name == NULL) {
2484                                 goto done;
2485                         }
2486                 }
2487
2488                 /* See if we can set some domain trust flags about
2489                    ourself */
2490
2491                 if (lsa_info->dns.dns_forest.string) {
2492                         talloc_free(domain->forest_name);
2493                         domain->forest_name =
2494                                 talloc_strdup(domain,
2495                                               lsa_info->dns.dns_forest.string);
2496                         if (domain->forest_name == NULL) {
2497                                 goto done;
2498                         }
2499
2500                         if (strequal(domain->forest_name, domain->alt_name)) {
2501                                 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
2502                         }
2503                 }
2504
2505                 if (lsa_info->dns.sid) {
2506                         if (!is_null_sid(&domain->sid) &&
2507                             !dom_sid_equal(&domain->sid,
2508                                            lsa_info->dns.sid))
2509                         {
2510                                 DEBUG(1, ("set_dc_type_and_flags_connect: DC "
2511                                           "for domain %s (%s) claimed it was "
2512                                           "a DC for domain %s, refusing to "
2513                                           "initialize\n",
2514                                           dom_sid_string(talloc_tos(),
2515                                                          &domain->sid),
2516                                           domain->name,
2517                                           dom_sid_string(talloc_tos(),
2518                                                          lsa_info->dns.sid)));
2519                                 TALLOC_FREE(cli);
2520                                 TALLOC_FREE(mem_ctx);
2521                                 return;
2522                         }
2523                         sid_copy(&domain->sid, lsa_info->dns.sid);
2524                 }
2525         } else {
2526                 domain->active_directory = False;
2527
2528                 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
2529                                                 SEC_FLAG_MAXIMUM_ALLOWED,
2530                                                 &pol);
2531
2532                 if (!NT_STATUS_IS_OK(status)) {
2533                         goto done;
2534                 }
2535
2536                 status = dcerpc_lsa_QueryInfoPolicy(cli->binding_handle, mem_ctx,
2537                                                     &pol,
2538                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
2539                                                     &lsa_info,
2540                                                     &result);
2541                 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2542
2543                         if (lsa_info->account_domain.name.string) {
2544                                 if (!strequal(domain->name,
2545                                         lsa_info->account_domain.name.string))
2546                                 {
2547                                         DEBUG(1,
2548                                               ("set_dc_type_and_flags_connect: "
2549                                                "DC for domain %s claimed it was"
2550                                                " a DC for domain %s, refusing "
2551                                                "to initialize\n", domain->name,
2552                                                lsa_info->
2553                                                 account_domain.name.string));
2554                                         TALLOC_FREE(cli);
2555                                         TALLOC_FREE(mem_ctx);
2556                                         return;
2557                                 }
2558                                 talloc_free(domain->name);
2559                                 domain->name =
2560                                         talloc_strdup(domain,
2561                                                       lsa_info->account_domain.name.string);
2562                         }
2563
2564                         if (lsa_info->account_domain.sid) {
2565                                 if (!is_null_sid(&domain->sid) &&
2566                                     !dom_sid_equal(&domain->sid,
2567                                                 lsa_info->account_domain.sid))
2568                                 {
2569                                         DEBUG(1,
2570                                               ("set_dc_type_and_flags_connect: "
2571                                                "DC for domain %s (%s) claimed "
2572                                                "it was a DC for domain %s, "
2573                                                "refusing to initialize\n",
2574                                                dom_sid_string(talloc_tos(),
2575                                                               &domain->sid),
2576                                                domain->name,
2577                                                dom_sid_string(talloc_tos(),
2578                                                 lsa_info->account_domain.sid)));
2579                                         TALLOC_FREE(cli);
2580                                         TALLOC_FREE(mem_ctx);
2581                                         return;
2582                                 }
2583                                 sid_copy(&domain->sid, lsa_info->account_domain.sid);
2584                         }
2585                 }
2586         }
2587 done:
2588
2589         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
2590                   domain->name, domain->native_mode ? "" : "NOT "));
2591
2592         DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
2593                   domain->name, domain->active_directory ? "" : "NOT "));
2594
2595         domain->can_do_ncacn_ip_tcp = domain->active_directory;
2596
2597         TALLOC_FREE(cli);
2598
2599         TALLOC_FREE(mem_ctx);
2600
2601         domain->initialized = True;
2602 }
2603
2604 /**********************************************************************
2605  Set the domain_flags (trust attributes, domain operating modes, etc...
2606 ***********************************************************************/
2607
2608 static void set_dc_type_and_flags( struct winbindd_domain *domain )
2609 {
2610         /* we always have to contact our primary domain */
2611
2612         if ( domain->primary || domain->internal) {
2613                 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
2614                           "primary or internal domain\n"));
2615                 set_dc_type_and_flags_connect( domain );
2616                 return;
2617         }
2618
2619         /* Use our DC to get the information if possible */
2620
2621         if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
2622                 /* Otherwise, fallback to contacting the
2623                    domain directly */
2624                 set_dc_type_and_flags_connect( domain );
2625         }
2626
2627         return;
2628 }
2629
2630
2631
2632 /**********************************************************************
2633 ***********************************************************************/
2634
2635 static NTSTATUS cm_get_schannel_creds(struct winbindd_domain *domain,
2636                                    struct netlogon_creds_cli_context **ppdc)
2637 {
2638         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2639         struct rpc_pipe_client *netlogon_pipe;
2640
2641         *ppdc = NULL;
2642
2643         if ((!IS_DC) && (!domain->primary)) {
2644                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2645         }
2646
2647         if (domain->conn.netlogon_creds != NULL) {
2648                 if (!(domain->conn.netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
2649                         return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2650                 }
2651                 *ppdc = domain->conn.netlogon_creds;
2652                 return NT_STATUS_OK;
2653         }
2654
2655         result = cm_connect_netlogon(domain, &netlogon_pipe);
2656         if (!NT_STATUS_IS_OK(result)) {
2657                 return result;
2658         }
2659
2660         if (domain->conn.netlogon_creds == NULL) {
2661                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2662         }
2663
2664         if (!(domain->conn.netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
2665                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2666         }
2667
2668         *ppdc = domain->conn.netlogon_creds;
2669         return NT_STATUS_OK;
2670 }
2671
2672 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2673                         bool need_rw_dc,
2674                         struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2675 {
2676         struct winbindd_cm_conn *conn;
2677         NTSTATUS status, result;
2678         struct netlogon_creds_cli_context *p_creds;
2679         struct cli_credentials *creds = NULL;
2680
2681         if (sid_check_is_our_sam(&domain->sid)) {
2682                 if (domain->rodc == false || need_rw_dc == false) {
2683                         return open_internal_samr_conn(mem_ctx, domain, cli, sam_handle);
2684                 }
2685         }
2686
2687         status = init_dc_connection_rpc(domain, need_rw_dc);
2688         if (!NT_STATUS_IS_OK(status)) {
2689                 return status;
2690         }
2691
2692         conn = &domain->conn;
2693
2694         if (rpccli_is_connected(conn->samr_pipe)) {
2695                 goto done;
2696         }
2697
2698         TALLOC_FREE(conn->samr_pipe);
2699
2700         /*
2701          * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2702          * sign and sealed pipe using the machine account password by
2703          * preference. If we can't - try schannel, if that fails, try
2704          * anonymous.
2705          */
2706
2707         result = get_trust_credentials(domain, talloc_tos(), false, &creds);
2708         if (!NT_STATUS_IS_OK(result)) {
2709                 DEBUG(10, ("cm_connect_sam: No no user available for "
2710                            "domain %s, trying schannel\n", domain->name));
2711                 goto schannel;
2712         }
2713
2714         if (cli_credentials_is_anonymous(creds)) {
2715                 goto anonymous;
2716         }
2717
2718         /*
2719          * We have an authenticated connection. Use a SPNEGO
2720          * authenticated SAMR pipe with sign & seal.
2721          */
2722         status = cli_rpc_pipe_open_with_creds(conn->cli,
2723                                               &ndr_table_samr,
2724                                               NCACN_NP,
2725                                               DCERPC_AUTH_TYPE_SPNEGO,
2726                                               conn->auth_level,
2727                                               smbXcli_conn_remote_name(conn->cli->conn),
2728                                               creds,
2729                                               &conn->samr_pipe);
2730         if (!NT_STATUS_IS_OK(status)) {
2731                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2732                           "pipe for domain %s using NTLMSSP "
2733                           "authenticated pipe: user %s. Error was "
2734                           "%s\n", domain->name,
2735                           cli_credentials_get_unparsed_name(creds, talloc_tos()),
2736                           nt_errstr(status)));
2737                 goto schannel;
2738         }
2739
2740         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2741                   "domain %s using NTLMSSP authenticated "
2742                   "pipe: user %s\n", domain->name,
2743                   cli_credentials_get_unparsed_name(creds, talloc_tos())));
2744
2745         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2746                                       conn->samr_pipe->desthost,
2747                                       SEC_FLAG_MAXIMUM_ALLOWED,
2748                                       &conn->sam_connect_handle,
2749                                       &result);
2750         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2751                 goto open_domain;
2752         }
2753         if (NT_STATUS_IS_OK(status)) {
2754                 status = result;
2755         }
2756
2757         DEBUG(10,("cm_connect_sam: ntlmssp-sealed dcerpc_samr_Connect2 "
2758                   "failed for domain %s, error was %s. Trying schannel\n",
2759                   domain->name, nt_errstr(status) ));
2760         TALLOC_FREE(conn->samr_pipe);
2761
2762  schannel:
2763
2764         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2765
2766         status = cm_get_schannel_creds(domain, &p_creds);
2767         if (!NT_STATUS_IS_OK(status)) {
2768                 /* If this call fails - conn->cli can now be NULL ! */
2769                 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2770                            "for domain %s (error %s), trying anon\n",
2771                         domain->name,
2772                         nt_errstr(status) ));
2773                 goto anonymous;
2774         }
2775         status = cli_rpc_pipe_open_schannel_with_key
2776                 (conn->cli, &ndr_table_samr, NCACN_NP,
2777                  domain->name, p_creds, &conn->samr_pipe);
2778
2779         if (!NT_STATUS_IS_OK(status)) {
2780                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2781                           "domain %s using schannel. Error was %s\n",
2782                           domain->name, nt_errstr(status) ));
2783                 goto anonymous;
2784         }
2785         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2786                   "schannel.\n", domain->name ));
2787
2788         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2789                                       conn->samr_pipe->desthost,
2790                                       SEC_FLAG_MAXIMUM_ALLOWED,
2791                                       &conn->sam_connect_handle,
2792                                       &result);
2793         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2794                 goto open_domain;
2795         }
2796         if (NT_STATUS_IS_OK(status)) {
2797                 status = result;
2798         }
2799         DEBUG(10,("cm_connect_sam: schannel-sealed dcerpc_samr_Connect2 failed "
2800                   "for domain %s, error was %s. Trying anonymous\n",
2801                   domain->name, nt_errstr(status) ));
2802         TALLOC_FREE(conn->samr_pipe);
2803
2804  anonymous:
2805
2806         /* Finally fall back to anonymous. */
2807         if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
2808                 status = NT_STATUS_DOWNGRADE_DETECTED;
2809                 DEBUG(1, ("Unwilling to make SAMR connection to domain %s"
2810                           "without connection level security, "
2811                           "must set 'winbind sealed pipes = false' and "
2812                           "'require strong key = false' to proceed: %s\n",
2813                           domain->name, nt_errstr(status)));
2814                 goto done;
2815         }
2816         status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr,
2817                                           &conn->samr_pipe);
2818
2819         if (!NT_STATUS_IS_OK(status)) {
2820                 goto done;
2821         }
2822
2823         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2824                                       conn->samr_pipe->desthost,
2825                                       SEC_FLAG_MAXIMUM_ALLOWED,
2826                                       &conn->sam_connect_handle,
2827                                       &result);
2828         if (!NT_STATUS_IS_OK(status)) {
2829                 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2830                           "for domain %s Error was %s\n",
2831                           domain->name, nt_errstr(status) ));
2832                 goto done;
2833         }
2834         if (!NT_STATUS_IS_OK(result)) {
2835                 status = result;
2836                 DEBUG(10,("cm_connect_sam: dcerpc_samr_Connect2 failed "
2837                           "for domain %s Error was %s\n",
2838                           domain->name, nt_errstr(result)));
2839                 goto done;
2840         }
2841
2842  open_domain:
2843         status = dcerpc_samr_OpenDomain(conn->samr_pipe->binding_handle,
2844                                         mem_ctx,
2845                                         &conn->sam_connect_handle,
2846                                         SEC_FLAG_MAXIMUM_ALLOWED,
2847                                         &domain->sid,
2848                                         &conn->sam_domain_handle,
2849                                         &result);
2850         if (!NT_STATUS_IS_OK(status)) {
2851                 goto done;
2852         }
2853
2854         status = result;
2855  done:
2856
2857         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
2858                 /*
2859                  * if we got access denied, we might just have no access rights
2860                  * to talk to the remote samr server server (e.g. when we are a
2861                  * PDC and we are connecting a w2k8 pdc via an interdomain
2862                  * trust). In that case do not invalidate the whole connection
2863                  * stack
2864                  */
2865                 TALLOC_FREE(conn->samr_pipe);
2866                 ZERO_STRUCT(conn->sam_domain_handle);
2867                 return status;
2868         } else if (!NT_STATUS_IS_OK(status)) {
2869                 invalidate_cm_connection(domain);
2870                 return status;
2871         }
2872
2873         *cli = conn->samr_pipe;
2874         *sam_handle = conn->sam_domain_handle;
2875         return status;
2876 }
2877
2878 /**********************************************************************
2879  open an schanneld ncacn_ip_tcp connection to LSA
2880 ***********************************************************************/
2881
2882 static NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
2883                                    TALLOC_CTX *mem_ctx,
2884                                    struct rpc_pipe_client **cli)
2885 {
2886         struct winbindd_cm_conn *conn;
2887         struct netlogon_creds_cli_context *creds;
2888         NTSTATUS status;
2889
2890         DEBUG(10,("cm_connect_lsa_tcp\n"));
2891
2892         status = init_dc_connection_rpc(domain, false);
2893         if (!NT_STATUS_IS_OK(status)) {
2894                 return status;
2895         }
2896
2897         conn = &domain->conn;
2898
2899         if (conn->lsa_pipe_tcp &&
2900             conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2901             conn->lsa_pipe_tcp->auth->auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY &&
2902             rpccli_is_connected(conn->lsa_pipe_tcp)) {
2903                 goto done;
2904         }
2905
2906         TALLOC_FREE(conn->lsa_pipe_tcp);
2907
2908         status = cm_get_schannel_creds(domain, &creds);
2909         if (!NT_STATUS_IS_OK(status)) {
2910                 goto done;
2911         }
2912
2913         status = cli_rpc_pipe_open_schannel_with_key(conn->cli,
2914                                                      &ndr_table_lsarpc,
2915                                                      NCACN_IP_TCP,
2916                                                      domain->name,
2917                                                      creds,
2918                                                      &conn->lsa_pipe_tcp);
2919         if (!NT_STATUS_IS_OK(status)) {
2920                 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
2921                         nt_errstr(status)));
2922                 goto done;
2923         }
2924
2925  done:
2926         if (!NT_STATUS_IS_OK(status)) {
2927                 TALLOC_FREE(conn->lsa_pipe_tcp);
2928                 return status;
2929         }
2930
2931         *cli = conn->lsa_pipe_tcp;
2932
2933         return status;
2934 }
2935
2936 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2937                         struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2938 {
2939         struct winbindd_cm_conn *conn;
2940         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2941         struct netlogon_creds_cli_context *p_creds;
2942         struct cli_credentials *creds = NULL;
2943
2944         result = init_dc_connection_rpc(domain, false);
2945         if (!NT_STATUS_IS_OK(result))
2946                 return result;
2947
2948         conn = &domain->conn;
2949
2950         if (rpccli_is_connected(conn->lsa_pipe)) {
2951                 goto done;
2952         }
2953
2954         TALLOC_FREE(conn->lsa_pipe);
2955
2956         result = get_trust_credentials(domain, talloc_tos(), false, &creds);
2957         if (!NT_STATUS_IS_OK(result)) {
2958                 DEBUG(10, ("cm_connect_sam: No no user available for "
2959                            "domain %s, trying schannel\n", domain->name));
2960                 goto schannel;
2961         }
2962
2963         if (cli_credentials_is_anonymous(creds)) {
2964                 goto anonymous;
2965         }
2966
2967         /*
2968          * We have an authenticated connection. Use a SPNEGO
2969          * authenticated LSA pipe with sign & seal.
2970          */
2971         result = cli_rpc_pipe_open_with_creds
2972                 (conn->cli, &ndr_table_lsarpc, NCACN_NP,
2973                  DCERPC_AUTH_TYPE_SPNEGO,
2974                  conn->auth_level,
2975                  smbXcli_conn_remote_name(conn->cli->conn),
2976                  creds,
2977                  &conn->lsa_pipe);
2978         if (!NT_STATUS_IS_OK(result)) {
2979                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2980                           "domain %s using NTLMSSP authenticated pipe: user "
2981                           "%s. Error was %s. Trying schannel.\n",
2982                           domain->name,
2983                           cli_credentials_get_unparsed_name(creds, talloc_tos()),
2984                           nt_errstr(result)));
2985                 goto schannel;
2986         }
2987
2988         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2989                   "NTLMSSP authenticated pipe: user %s\n",
2990                   domain->name, cli_credentials_get_unparsed_name(creds, talloc_tos())));
2991
2992         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2993                                         SEC_FLAG_MAXIMUM_ALLOWED,
2994                                         &conn->lsa_policy);
2995         if (NT_STATUS_IS_OK(result)) {
2996                 goto done;
2997         }
2998
2999         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
3000                   "schannel\n"));
3001
3002         TALLOC_FREE(conn->lsa_pipe);
3003
3004  schannel:
3005
3006         /* Fall back to schannel if it's a W2K pre-SP1 box. */
3007
3008         result = cm_get_schannel_creds(domain, &p_creds);
3009         if (!NT_STATUS_IS_OK(result)) {
3010                 /* If this call fails - conn->cli can now be NULL ! */
3011                 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
3012                            "for domain %s (error %s), trying anon\n",
3013                         domain->name,
3014                         nt_errstr(result) ));
3015                 goto anonymous;
3016         }
3017         result = cli_rpc_pipe_open_schannel_with_key
3018                 (conn->cli, &ndr_table_lsarpc, NCACN_NP,
3019                  domain->name, p_creds, &conn->lsa_pipe);
3020
3021         if (!NT_STATUS_IS_OK(result)) {
3022                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
3023                           "domain %s using schannel. Error was %s\n",
3024                           domain->name, nt_errstr(result) ));
3025                 goto anonymous;
3026         }
3027         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
3028                   "schannel.\n", domain->name ));
3029
3030         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
3031                                         SEC_FLAG_MAXIMUM_ALLOWED,
3032                                         &conn->lsa_policy);
3033         if (NT_STATUS_IS_OK(result)) {
3034                 goto done;
3035         }
3036
3037         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
3038                   "anonymous\n"));
3039
3040         TALLOC_FREE(conn->lsa_pipe);
3041
3042  anonymous:
3043
3044         if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
3045                 result = NT_STATUS_DOWNGRADE_DETECTED;
3046                 DEBUG(1, ("Unwilling to make LSA connection to domain %s"
3047                           "without connection level security, "
3048                           "must set 'winbind sealed pipes = false' and "
3049                           "'require strong key = false' to proceed: %s\n",
3050                           domain->name, nt_errstr(result)));
3051                 goto done;
3052         }
3053
3054         result = cli_rpc_pipe_open_noauth(conn->cli,
3055                                           &ndr_table_lsarpc,
3056                                           &conn->lsa_pipe);
3057         if (!NT_STATUS_IS_OK(result)) {
3058                 goto done;
3059         }
3060
3061         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
3062                                         SEC_FLAG_MAXIMUM_ALLOWED,
3063                                         &conn->lsa_policy);
3064  done:
3065         if (!NT_STATUS_IS_OK(result)) {
3066                 invalidate_cm_connection(domain);
3067                 return result;
3068         }
3069
3070         *cli = conn->lsa_pipe;
3071         *lsa_policy = conn->lsa_policy;
3072         return result;
3073 }
3074
3075 /****************************************************************************
3076 Open a LSA connection to a DC, suiteable for LSA lookup calls.
3077 ****************************************************************************/
3078
3079 NTSTATUS cm_connect_lsat(struct winbindd_domain *domain,
3080                          TALLOC_CTX *mem_ctx,
3081                          struct rpc_pipe_client **cli,
3082                          struct policy_handle *lsa_policy)
3083 {
3084         NTSTATUS status;
3085
3086         if (domain->can_do_ncacn_ip_tcp) {
3087                 status = cm_connect_lsa_tcp(domain, mem_ctx, cli);
3088                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
3089                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
3090                     NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3091                         invalidate_cm_connection(domain);
3092                         status = cm_connect_lsa_tcp(domain, mem_ctx, cli);
3093                 }
3094                 if (NT_STATUS_IS_OK(status)) {
3095                         return status;
3096                 }
3097
3098                 /*
3099                  * we tried twice to connect via ncan_ip_tcp and schannel and
3100                  * failed - maybe it is a trusted domain we can't connect to ?
3101                  * do not try tcp next time - gd
3102                  *
3103                  * This also prevents NETLOGON over TCP
3104                  */
3105                 domain->can_do_ncacn_ip_tcp = false;
3106         }
3107
3108         status = cm_connect_lsa(domain, mem_ctx, cli, lsa_policy);
3109
3110         return status;
3111 }
3112
3113 /****************************************************************************
3114  Open the netlogon pipe to this DC. Use schannel if specified in client conf.
3115  session key stored in conn->netlogon_pipe->dc->sess_key.
3116 ****************************************************************************/
3117
3118 static NTSTATUS cm_connect_netlogon_transport(struct winbindd_domain *domain,
3119                                               enum dcerpc_transport_t transport,
3120                                               struct rpc_pipe_client **cli)
3121 {
3122         struct messaging_context *msg_ctx = winbind_messaging_context();
3123         struct winbindd_cm_conn *conn;
3124         NTSTATUS result;
3125         enum netr_SchannelType sec_chan_type;
3126         const char *account_name;
3127         const char *domain_name;
3128         const struct samr_Password *current_nt_hash = NULL;
3129         const struct samr_Password *previous_nt_hash = NULL;
3130         struct netlogon_creds_CredentialState *netlogon_creds = NULL;
3131         struct cli_credentials *creds = NULL;
3132
3133         *cli = NULL;
3134
3135         result = init_dc_connection_rpc(domain, true);
3136         if (!NT_STATUS_IS_OK(result)) {
3137                 return result;
3138         }
3139
3140         conn = &domain->conn;
3141
3142         if (rpccli_is_connected(conn->netlogon_pipe)) {
3143                 *cli = conn->netlogon_pipe;
3144                 return NT_STATUS_OK;
3145         }
3146
3147         TALLOC_FREE(conn->netlogon_pipe);
3148         conn->netlogon_flags = 0;
3149         TALLOC_FREE(conn->netlogon_creds);
3150
3151         result = get_trust_credentials(domain, talloc_tos(), true, &creds);
3152         if (!NT_STATUS_IS_OK(result)) {
3153                 DEBUG(10, ("cm_connect_sam: No no user available for "
3154                            "domain %s when trying schannel\n", domain->name));
3155                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3156         }
3157
3158         if (cli_credentials_is_anonymous(creds)) {
3159                 DEBUG(1, ("get_trust_credential only gave anonymous for %s, unable to make get NETLOGON credentials\n",
3160                           domain->name));
3161                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3162         }
3163
3164         sec_chan_type = cli_credentials_get_secure_channel_type(creds);
3165         if (sec_chan_type == SEC_CHAN_NULL) {
3166                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3167                 goto no_schannel;
3168         }
3169
3170         account_name = cli_credentials_get_username(creds);
3171         domain_name = cli_credentials_get_domain(creds);
3172         current_nt_hash = cli_credentials_get_nt_hash(creds, talloc_tos());
3173         if (current_nt_hash == NULL) {
3174                 return NT_STATUS_NO_MEMORY;
3175         }
3176
3177         result = rpccli_create_netlogon_creds(domain->dcname,
3178                                               domain_name,
3179                                               account_name,
3180                                               sec_chan_type,
3181                                               msg_ctx,
3182                                               domain,
3183                                               &conn->netlogon_creds);
3184         if (!NT_STATUS_IS_OK(result)) {
3185                 DEBUG(1, ("rpccli_create_netlogon_creds failed for %s, "
3186                           "unable to create NETLOGON credentials: %s\n",
3187                           domain->name, nt_errstr(result)));
3188                 return result;
3189         }
3190
3191         result = rpccli_setup_netlogon_creds(conn->cli, transport,
3192                                              conn->netlogon_creds,
3193                                              conn->netlogon_force_reauth,
3194                                              *current_nt_hash,
3195                                              previous_nt_hash);
3196         conn->netlogon_force_reauth = false;
3197         if (!NT_STATUS_IS_OK(result)) {
3198                 DEBUG(1, ("rpccli_setup_netlogon_creds failed for %s, "
3199                           "unable to setup NETLOGON credentials: %s\n",
3200                           domain->name, nt_errstr(result)));
3201                 return result;
3202         }
3203
3204         result = netlogon_creds_cli_get(conn->netlogon_creds,
3205                                         talloc_tos(),
3206                                         &netlogon_creds);
3207         if (!NT_STATUS_IS_OK(result)) {
3208                 DEBUG(1, ("netlogon_creds_cli_get failed for %s, "
3209                           "unable to get NETLOGON credentials: %s\n",
3210                           domain->name, nt_errstr(result)));
3211                 return result;
3212         }
3213         conn->netlogon_flags = netlogon_creds->negotiate_flags;
3214         TALLOC_FREE(netlogon_creds);
3215
3216  no_schannel:
3217         if (!(conn->netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
3218                 if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
3219                         result = NT_STATUS_DOWNGRADE_DETECTED;
3220                         DEBUG(1, ("Unwilling to make connection to domain %s"
3221                                   "without connection level security, "
3222                                   "must set 'winbind sealed pipes = false' and "
3223                                   "'require strong key = false' to proceed: %s\n",
3224                                   domain->name, nt_errstr(result)));
3225                         invalidate_cm_connection(domain);
3226                         return result;
3227                 }
3228                 result = cli_rpc_pipe_open_noauth_transport(conn->cli,
3229                                                             transport,
3230                                                             &ndr_table_netlogon,
3231                                                             &conn->netlogon_pipe);
3232                 if (!NT_STATUS_IS_OK(result)) {
3233                         invalidate_cm_connection(domain);
3234                         return result;
3235                 }
3236
3237                 *cli = conn->netlogon_pipe;
3238                 return NT_STATUS_OK;
3239         }
3240
3241         /* Using the credentials from the first pipe, open a signed and sealed
3242            second netlogon pipe. The session key is stored in the schannel
3243            part of the new pipe auth struct.
3244         */
3245
3246         result = cli_rpc_pipe_open_schannel_with_key(
3247                 conn->cli, &ndr_table_netlogon, transport,
3248                 domain->name,
3249                 conn->netlogon_creds,
3250                 &conn->netlogon_pipe);
3251         if (!NT_STATUS_IS_OK(result)) {
3252                 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
3253                           "was %s\n", nt_errstr(result)));
3254
3255                 invalidate_cm_connection(domain);
3256                 return result;
3257         }
3258
3259         *cli = conn->netlogon_pipe;
3260         return NT_STATUS_OK;
3261 }
3262
3263 /****************************************************************************
3264 Open a LSA connection to a DC, suiteable for LSA lookup calls.
3265 ****************************************************************************/
3266
3267 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
3268                              struct rpc_pipe_client **cli)
3269 {
3270         NTSTATUS status;
3271
3272         if (domain->active_directory && domain->can_do_ncacn_ip_tcp) {
3273                 status = cm_connect_netlogon_transport(domain, NCACN_IP_TCP, cli);
3274                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
3275                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
3276                     NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3277                         invalidate_cm_connection(domain);
3278                         status = cm_connect_netlogon_transport(domain, NCACN_IP_TCP, cli);
3279                 }
3280                 if (NT_STATUS_IS_OK(status)) {
3281                         return status;
3282                 }
3283
3284                 /*
3285                  * we tried twice to connect via ncan_ip_tcp and schannel and
3286                  * failed - maybe it is a trusted domain we can't connect to ?
3287                  * do not try tcp next time - gd
3288                  *
3289                  * This also prevents LSA over TCP
3290                  */
3291                 domain->can_do_ncacn_ip_tcp = false;
3292         }
3293
3294         status = cm_connect_netlogon_transport(domain, NCACN_NP, cli);
3295
3296         return status;
3297 }
3298
3299 void winbind_msg_ip_dropped(struct messaging_context *msg_ctx,
3300                             void *private_data,
3301                             uint32_t msg_type,
3302                             struct server_id server_id,
3303                             DATA_BLOB *data)
3304 {
3305         struct winbindd_domain *domain;
3306         char *freeit = NULL;
3307         char *addr;
3308
3309         if ((data == NULL)
3310             || (data->data == NULL)
3311             || (data->length == 0)
3312             || (data->data[data->length-1] != '\0')) {
3313                 DEBUG(1, ("invalid msg_ip_dropped message: not a valid "
3314                           "string\n"));
3315                 return;
3316         }
3317
3318         addr = (char *)data->data;
3319         DEBUG(10, ("IP %s dropped\n", addr));
3320
3321         if (!is_ipaddress(addr)) {
3322                 char *slash;
3323                 /*
3324                  * Some code sends us ip addresses with the /netmask
3325                  * suffix
3326                  */
3327                 slash = strchr(addr, '/');
3328                 if (slash == NULL) {
3329                         DEBUG(1, ("invalid msg_ip_dropped message: %s",
3330                                   addr));
3331                         return;
3332                 }
3333                 freeit = talloc_strndup(talloc_tos(), addr, slash-addr);
3334                 if (freeit == NULL) {
3335                         DEBUG(1, ("talloc failed\n"));
3336                         return;
3337                 }
3338                 addr = freeit;
3339                 DEBUG(10, ("Stripped /netmask to IP %s\n", addr));
3340         }
3341
3342         for (domain = domain_list(); domain != NULL; domain = domain->next) {
3343                 char sockaddr[INET6_ADDRSTRLEN];
3344
3345                 if (!cli_state_is_connected(domain->conn.cli)) {
3346                         continue;
3347                 }
3348
3349                 print_sockaddr(sockaddr, sizeof(sockaddr),
3350                                smbXcli_conn_local_sockaddr(domain->conn.cli->conn));
3351
3352                 if (strequal(sockaddr, addr)) {
3353                         smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
3354                 }
3355         }
3356         TALLOC_FREE(freeit);
3357 }