diff options
Diffstat (limited to 'source4/libnet')
45 files changed, 17356 insertions, 0 deletions
diff --git a/source4/libnet/composite.h b/source4/libnet/composite.h new file mode 100644 index 0000000..50bf1a7 --- /dev/null +++ b/source4/libnet/composite.h @@ -0,0 +1,56 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/* + * Monitor structure and message types definitions. Composite function monitoring + * allows client application to be notified on function progress. This enables + * eg. gui client to display progress bars, status messages, etc. + */ + + +#define mon_SamrCreateUser (0x00000001) +#define mon_SamrOpenUser (0x00000002) +#define mon_SamrQueryUser (0x00000003) +#define mon_SamrCloseUser (0x00000004) +#define mon_SamrLookupName (0x00000005) +#define mon_SamrDeleteUser (0x00000006) +#define mon_SamrSetUser (0x00000007) +#define mon_SamrClose (0x00000008) +#define mon_SamrConnect (0x00000009) +#define mon_SamrLookupDomain (0x0000000A) +#define mon_SamrOpenDomain (0x0000000B) +#define mon_SamrEnumDomains (0x0000000C) +#define mon_LsaOpenPolicy (0x0000000D) +#define mon_LsaQueryPolicy (0x0000000E) +#define mon_LsaClose (0x0000000F) +#define mon_SamrOpenGroup (0x00000010) +#define mon_SamrQueryGroup (0x00000011) + +#define mon_NetLookupDc (0x00000100) +#define mon_NetRpcConnect (0x00000200) + +#define mon_Mask_Rpc (0x000000FF) +#define mon_Mask_Net (0x0000FF00) + + +struct monitor_msg { + uint32_t type; + void *data; + size_t data_size; +}; diff --git a/source4/libnet/groupinfo.c b/source4/libnet/groupinfo.c new file mode 100644 index 0000000..3d2968b --- /dev/null +++ b/source4/libnet/groupinfo.c @@ -0,0 +1,384 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2007 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/* + a composite function for getting group information via samr pipe +*/ + + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "librpc/gen_ndr/security.h" +#include "libcli/security/security.h" +#include "libnet/libnet.h" +#include "librpc/gen_ndr/ndr_samr_c.h" + + +struct groupinfo_state { + struct dcerpc_binding_handle *binding_handle; + struct policy_handle domain_handle; + struct policy_handle group_handle; + uint16_t level; + struct samr_LookupNames lookup; + struct samr_OpenGroup opengroup; + struct samr_QueryGroupInfo querygroupinfo; + struct samr_Close samrclose; + union samr_GroupInfo *info; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_groupinfo_lookup(struct tevent_req *subreq); +static void continue_groupinfo_opengroup(struct tevent_req *subreq); +static void continue_groupinfo_getgroup(struct tevent_req *subreq); +static void continue_groupinfo_closegroup(struct tevent_req *subreq); + + +/** + * Stage 1 (optional): Look for a group name in SAM server. + */ +static void continue_groupinfo_lookup(struct tevent_req *subreq) +{ + struct composite_context *c; + struct groupinfo_state *s; + struct monitor_msg msg; + struct msg_rpc_lookup_name *msg_lookup; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct groupinfo_state); + + /* receive samr_Lookup reply */ + c->status = dcerpc_samr_LookupNames_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* there could be a problem with name resolving itself */ + if (!NT_STATUS_IS_OK(s->lookup.out.result)) { + composite_error(c, s->lookup.out.result); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + msg.type = mon_SamrLookupName; + msg_lookup = talloc(s, struct msg_rpc_lookup_name); + msg_lookup->rid = s->lookup.out.rids->ids; + msg_lookup->count = s->lookup.out.rids->count; + msg.data = (void*)msg_lookup; + msg.data_size = sizeof(*msg_lookup); + + s->monitor_fn(&msg); + } + + /* have we actually got name resolved + - we're looking for only one at the moment */ + if (s->lookup.out.rids->count != s->lookup.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + if (s->lookup.out.types->count != s->lookup.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + /* TODO: find proper status code for more than one rid found */ + + /* prepare parameters for LookupNames */ + s->opengroup.in.domain_handle = &s->domain_handle; + s->opengroup.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + s->opengroup.in.rid = s->lookup.out.rids->ids[0]; + s->opengroup.out.group_handle = &s->group_handle; + + /* send request */ + subreq = dcerpc_samr_OpenGroup_r_send(s, c->event_ctx, + s->binding_handle, + &s->opengroup); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_groupinfo_opengroup, c); +} + + +/** + * Stage 2: Open group policy handle. + */ +static void continue_groupinfo_opengroup(struct tevent_req *subreq) +{ + struct composite_context *c; + struct groupinfo_state *s; + struct monitor_msg msg; + struct msg_rpc_open_group *msg_open; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct groupinfo_state); + + /* receive samr_OpenGroup reply */ + c->status = dcerpc_samr_OpenGroup_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!NT_STATUS_IS_OK(s->opengroup.out.result)) { + composite_error(c, s->opengroup.out.result); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + msg.type = mon_SamrOpenGroup; + msg_open = talloc(s, struct msg_rpc_open_group); + msg_open->rid = s->opengroup.in.rid; + msg_open->access_mask = s->opengroup.in.access_mask; + msg.data = (void*)msg_open; + msg.data_size = sizeof(*msg_open); + + s->monitor_fn(&msg); + } + + /* prepare parameters for QueryGroupInfo call */ + s->querygroupinfo.in.group_handle = &s->group_handle; + s->querygroupinfo.in.level = s->level; + s->querygroupinfo.out.info = talloc(s, union samr_GroupInfo *); + if (composite_nomem(s->querygroupinfo.out.info, c)) return; + + /* queue rpc call, set event handling and new state */ + subreq = dcerpc_samr_QueryGroupInfo_r_send(s, + c->event_ctx, + s->binding_handle, + &s->querygroupinfo); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_groupinfo_getgroup, c); +} + + +/** + * Stage 3: Get requested group information. + */ +static void continue_groupinfo_getgroup(struct tevent_req *subreq) +{ + struct composite_context *c; + struct groupinfo_state *s; + struct monitor_msg msg; + struct msg_rpc_query_group *msg_query; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct groupinfo_state); + + /* receive samr_QueryGroupInfo reply */ + c->status = dcerpc_samr_QueryGroupInfo_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* check if querygroup itself went ok */ + if (!NT_STATUS_IS_OK(s->querygroupinfo.out.result)) { + composite_error(c, s->querygroupinfo.out.result); + return; + } + + s->info = talloc_steal(s, *s->querygroupinfo.out.info); + + /* issue a monitor message */ + if (s->monitor_fn) { + msg.type = mon_SamrQueryGroup; + msg_query = talloc(s, struct msg_rpc_query_group); + msg_query->level = s->querygroupinfo.in.level; + msg.data = (void*)msg_query; + msg.data_size = sizeof(*msg_query); + + s->monitor_fn(&msg); + } + + /* prepare arguments for Close call */ + s->samrclose.in.handle = &s->group_handle; + s->samrclose.out.handle = &s->group_handle; + + /* queue rpc call, set event handling and new state */ + subreq = dcerpc_samr_Close_r_send(s, c->event_ctx, + s->binding_handle, + &s->samrclose); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_groupinfo_closegroup, c); +} + + +/** + * Stage 4: Close policy handle associated with opened group. + */ +static void continue_groupinfo_closegroup(struct tevent_req *subreq) +{ + struct composite_context *c; + struct groupinfo_state *s; + struct monitor_msg msg; + struct msg_rpc_close_group *msg_close; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct groupinfo_state); + + /* receive samr_Close reply */ + c->status = dcerpc_samr_Close_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!NT_STATUS_IS_OK(s->samrclose.out.result)) { + composite_error(c, s->samrclose.out.result); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + msg.type = mon_SamrClose; + msg_close = talloc(s, struct msg_rpc_close_group); + msg_close->rid = s->opengroup.in.rid; + msg.data = (void*)msg_close; + msg.data_size = sizeof(*msg_close); + + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +/** + * Sends asynchronous groupinfo request + * + * @param p dce/rpc call pipe + * @param io arguments and results of the call + */ +struct composite_context *libnet_rpc_groupinfo_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct dcerpc_binding_handle *b, + struct libnet_rpc_groupinfo *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct groupinfo_state *s; + struct dom_sid *sid; + struct tevent_req *subreq; + + if (!b || !io) return NULL; + + c = composite_create(mem_ctx, ev); + if (c == NULL) return c; + + s = talloc_zero(c, struct groupinfo_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + s->level = io->in.level; + s->binding_handle= b; + s->domain_handle = io->in.domain_handle; + s->monitor_fn = monitor; + + if (io->in.sid) { + sid = dom_sid_parse_talloc(s, io->in.sid); + if (composite_nomem(sid, c)) return c; + + s->opengroup.in.domain_handle = &s->domain_handle; + s->opengroup.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + s->opengroup.in.rid = sid->sub_auths[sid->num_auths - 1]; + s->opengroup.out.group_handle = &s->group_handle; + + /* send request */ + subreq = dcerpc_samr_OpenGroup_r_send(s, c->event_ctx, + s->binding_handle, + &s->opengroup); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_groupinfo_opengroup, c); + + } else { + /* preparing parameters to send rpc request */ + s->lookup.in.domain_handle = &s->domain_handle; + s->lookup.in.num_names = 1; + s->lookup.in.names = talloc_array(s, struct lsa_String, 1); + if (composite_nomem(s->lookup.in.names, c)) return c; + + s->lookup.in.names[0].string = talloc_strdup(s, io->in.groupname); + if (composite_nomem(s->lookup.in.names[0].string, c)) return c; + s->lookup.out.rids = talloc_zero(s, struct samr_Ids); + s->lookup.out.types = talloc_zero(s, struct samr_Ids); + if (composite_nomem(s->lookup.out.rids, c)) return c; + if (composite_nomem(s->lookup.out.types, c)) return c; + + /* send request */ + subreq = dcerpc_samr_LookupNames_r_send(s, c->event_ctx, + s->binding_handle, + &s->lookup); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_groupinfo_lookup, c); + } + + return c; +} + + +/** + * Waits for and receives result of asynchronous groupinfo call + * + * @param c composite context returned by asynchronous groupinfo call + * @param mem_ctx memory context of the call + * @param io pointer to results (and arguments) of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_groupinfo_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_rpc_groupinfo *io) +{ + NTSTATUS status; + struct groupinfo_state *s; + + /* wait for results of sending request */ + status = composite_wait(c); + + if (NT_STATUS_IS_OK(status) && io) { + s = talloc_get_type(c->private_data, struct groupinfo_state); + talloc_steal(mem_ctx, s->info); + io->out.info = *s->info; + } + + /* memory context associated to composite context is no longer needed */ + talloc_free(c); + return status; +} + + +/** + * Synchronous version of groupinfo call + * + * @param pipe dce/rpc call pipe + * @param mem_ctx memory context for the call + * @param io arguments and results of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_groupinfo(struct tevent_context *ev, + struct dcerpc_binding_handle *b, + TALLOC_CTX *mem_ctx, + struct libnet_rpc_groupinfo *io) +{ + struct composite_context *c = libnet_rpc_groupinfo_send(mem_ctx, ev, b, + io, NULL); + return libnet_rpc_groupinfo_recv(c, mem_ctx, io); +} diff --git a/source4/libnet/groupinfo.h b/source4/libnet/groupinfo.h new file mode 100644 index 0000000..ad13840 --- /dev/null +++ b/source4/libnet/groupinfo.h @@ -0,0 +1,54 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2007 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +#include "librpc/gen_ndr/samr.h" + +/* + * IO structures for groupinfo.c functions + */ + +struct libnet_rpc_groupinfo { + struct { + struct policy_handle domain_handle; + const char *groupname; + const char *sid; + uint16_t level; + } in; + struct { + union samr_GroupInfo info; + } out; +}; + + +/* + * Monitor messages sent from groupinfo.c functions + */ + +struct msg_rpc_open_group { + uint32_t rid, access_mask; +}; + +struct msg_rpc_query_group { + uint16_t level; +}; + +struct msg_rpc_close_group { + uint32_t rid; +}; diff --git a/source4/libnet/groupman.c b/source4/libnet/groupman.c new file mode 100644 index 0000000..c91eff3 --- /dev/null +++ b/source4/libnet/groupman.c @@ -0,0 +1,139 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2007 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/* + a composite function for manipulating (add/edit/del) groups via samr pipe +*/ + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "libnet/libnet.h" +#include "librpc/gen_ndr/ndr_samr_c.h" + + +struct groupadd_state { + struct dcerpc_binding_handle *binding_handle; + struct policy_handle domain_handle; + struct samr_CreateDomainGroup creategroup; + struct policy_handle group_handle; + uint32_t group_rid; + + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_groupadd_created(struct tevent_req *subreq); + + +struct composite_context* libnet_rpc_groupadd_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct dcerpc_binding_handle *b, + struct libnet_rpc_groupadd *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct groupadd_state *s; + struct tevent_req *subreq; + + if (!b || !io) return NULL; + + c = composite_create(mem_ctx, ev); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct groupadd_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + s->domain_handle = io->in.domain_handle; + s->binding_handle= b; + s->monitor_fn = monitor; + + s->creategroup.in.domain_handle = &s->domain_handle; + + s->creategroup.in.name = talloc_zero(c, struct lsa_String); + if (composite_nomem(s->creategroup.in.name, c)) return c; + + s->creategroup.in.name->string = talloc_strdup(c, io->in.groupname); + if (composite_nomem(s->creategroup.in.name->string, c)) return c; + + s->creategroup.in.access_mask = 0; + + s->creategroup.out.group_handle = &s->group_handle; + s->creategroup.out.rid = &s->group_rid; + + subreq = dcerpc_samr_CreateDomainGroup_r_send(s, c->event_ctx, + s->binding_handle, + &s->creategroup); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_groupadd_created, c); + return c; +} + + +NTSTATUS libnet_rpc_groupadd_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_rpc_groupadd *io) +{ + NTSTATUS status; + struct groupadd_state *s; + + status = composite_wait(c); + if (NT_STATUS_IS_OK(status) && io) { + s = talloc_get_type(c->private_data, struct groupadd_state); + io->out.group_handle = s->group_handle; + } + + talloc_free(c); + return status; +} + + +static void continue_groupadd_created(struct tevent_req *subreq) +{ + struct composite_context *c; + struct groupadd_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct groupadd_state); + + c->status = dcerpc_samr_CreateDomainGroup_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + c->status = s->creategroup.out.result; + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + composite_done(c); +} + + +NTSTATUS libnet_rpc_groupadd(struct tevent_context *ev, + struct dcerpc_binding_handle *b, + TALLOC_CTX *mem_ctx, + struct libnet_rpc_groupadd *io) +{ + struct composite_context *c; + + c = libnet_rpc_groupadd_send(mem_ctx, ev, b, io, NULL); + return libnet_rpc_groupadd_recv(c, mem_ctx, io); +} diff --git a/source4/libnet/groupman.h b/source4/libnet/groupman.h new file mode 100644 index 0000000..0acb02d --- /dev/null +++ b/source4/libnet/groupman.h @@ -0,0 +1,35 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2007 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "librpc/gen_ndr/misc.h" + + +/* + * IO structures for groupman.c functions + */ + +struct libnet_rpc_groupadd { + struct { + struct policy_handle domain_handle; + const char *groupname; + } in; + struct { + struct policy_handle group_handle; + } out; +}; diff --git a/source4/libnet/libnet.c b/source4/libnet/libnet.c new file mode 100644 index 0000000..a590893 --- /dev/null +++ b/source4/libnet/libnet.c @@ -0,0 +1,55 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "lib/events/events.h" +#include "param/param.h" +#include "libcli/resolve/resolve.h" + +struct libnet_context *libnet_context_init(struct tevent_context *ev, + struct loadparm_context *lp_ctx) +{ + struct libnet_context *ctx; + + /* We require an event context here */ + if (!ev) { + return NULL; + } + + /* create brand new libnet context */ + ctx = talloc_zero(ev, struct libnet_context); + if (!ctx) { + return NULL; + } + + ctx->event_ctx = ev; + ctx->lp_ctx = lp_ctx; + + /* make sure dcerpc is initialized */ + dcerpc_init(); + + /* name resolution methods */ + ctx->resolve_ctx = lpcfg_resolve_context(lp_ctx); + + /* default buffer size for various operations requiring specifying a buffer */ + ctx->samr.buf_size = 128; + + return ctx; +} diff --git a/source4/libnet/libnet.h b/source4/libnet/libnet.h new file mode 100644 index 0000000..41ddbea --- /dev/null +++ b/source4/libnet/libnet.h @@ -0,0 +1,86 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + Copyright (C) Rafal Szczesniak 2005-2006 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ +#ifndef LIBNET_H +#define LIBNET_H + +#include "librpc/gen_ndr/misc.h" + +struct libnet_context { + /* here we need: + * a client env context + * a user env context + */ + struct cli_credentials *cred; + + /* samr connection parameters - opened handles and related properties */ + struct { + struct dcerpc_pipe *pipe; + struct dcerpc_binding_handle *samr_handle; + const char *name; + struct dom_sid *sid; + uint32_t access_mask; + struct policy_handle handle; + struct policy_handle connect_handle; + int buf_size; + } samr; + + /* lsa connection parameters - opened handles and related properties */ + struct { + struct dcerpc_pipe *pipe; + struct dcerpc_binding_handle *lsa_handle; + const char *name; + uint32_t access_mask; + struct policy_handle handle; + } lsa; + + /* name resolution methods */ + struct resolve_context *resolve_ctx; + + struct tevent_context *event_ctx; + + struct loadparm_context *lp_ctx; + + /* if non-null then override the server address */ + const char *server_address; +}; + + +#include <ldb.h> +#include "libnet/composite.h" +#include "libnet/userman.h" +#include "libnet/userinfo.h" +#include "libnet/groupinfo.h" +#include "libnet/groupman.h" +#include "libnet/libnet_passwd.h" +#include "libnet/libnet_time.h" +#include "libnet/libnet_rpc.h" +#include "libnet/libnet_join.h" +#include "libnet/libnet_site.h" +#include "libnet/libnet_become_dc.h" +#include "libnet/libnet_unbecome_dc.h" +#include "libnet/libnet_samsync.h" +#include "libnet/libnet_vampire.h" +#include "libnet/libnet_user.h" +#include "libnet/libnet_group.h" +#include "libnet/libnet_share.h" +#include "libnet/libnet_lookup.h" +#include "libnet/libnet_domain.h" +#include "libnet/libnet_proto.h" +#endif diff --git a/source4/libnet/libnet_become_dc.c b/source4/libnet/libnet_become_dc.c new file mode 100644 index 0000000..f40e4f9 --- /dev/null +++ b/source4/libnet/libnet_become_dc.c @@ -0,0 +1,3281 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher <metze@samba.org> 2006 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "libcli/composite/composite.h" +#include "libcli/cldap/cldap.h" +#include <ldb.h> +#include <ldb_errors.h> +#include "ldb_wrap.h" +#include "dsdb/samdb/samdb.h" +#include "../libds/common/flags.h" +#include "librpc/gen_ndr/ndr_drsuapi_c.h" +#include "libcli/security/security.h" +#include "librpc/gen_ndr/ndr_misc.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "librpc/gen_ndr/ndr_nbt.h" +#include "librpc/gen_ndr/ndr_drsuapi.h" +#include "auth/gensec/gensec.h" +#include "param/param.h" +#include "lib/tsocket/tsocket.h" + +/***************************************************************************** + * Windows 2003 (w2k3) does the following steps when changing the server role + * from domain member to domain controller + * + * We mostly do the same. + *****************************************************************************/ + +/* + * lookup DC: + * - using nbt name<1C> request and a samlogon mailslot request + * or + * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request + * + * see: becomeDC_recv_cldap() and becomeDC_send_cldap() + */ + +/* + * Open 1st LDAP connection to the DC using admin credentials + * + * see: becomeDC_connect_ldap1() and becomeDC_ldap_connect() + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_rootdse() + * + * Request: + * basedn: "" + * scope: base + * filter: (objectClass=*) + * attrs: * + * Result: + * "" + * currentTime: 20061202155100.0Z + * subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,<domain_partition> + * dsServiceName: CN=<netbios_name>,CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition> + * namingContexts: <domain_partition> + * CN=Configuration,<domain_partition> + * CN=Schema,CN=Configuration,<domain_partition> + * defaultNamingContext: <domain_partition> + * schemaNamingContext: CN=Schema,CN=Configuration,<domain_partition> + * configurationNamingContext:CN=Configuration,<domain_partition> + * rootDomainNamingContext:<domain_partition> + * supportedControl: ... + * supportedLDAPVersion: 3 + * 2 + * supportedLDAPPolicies: ... + * highestCommittedUSN: ... + * supportedSASLMechanisms:GSSAPI + * GSS-SPNEGO + * EXTERNAL + * DIGEST-MD5 + * dnsHostName: <dns_host_name> + * ldapServiceName: <domain_dns_name>:<netbios_name>$@<REALM> + * serverName: CN=Servers,CN=<site_name>,CN=Sites,CN=Configuration,<domain_partition> + * supportedCapabilities: ... + * isSyncronized: TRUE + * isGlobalCatalogReady: TRUE + * domainFunctionality: 0 + * forestFunctionality: 0 + * domainControllerFunctionality: 2 + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_crossref_behavior_version() + * + * Request: + * basedn: CN=Configuration,<domain_partition> + * scope: one + * filter: (cn=Partitions) + * attrs: msDS-Behavior-Version + * Result: + * CN=Partitions,CN=Configuration,<domain_partition> + * msDS-Behavior-Version: 0 + */ + +/* + * LDAP search 1st LDAP connection: + * + * NOTE: this seems to be a bug! as the messageID of the LDAP message is corrupted! + * + * not implemented here + * + * Request: + * basedn: CN=Schema,CN=Configuration,<domain_partition> + * scope: one + * filter: (cn=Partitions) + * attrs: msDS-Behavior-Version + * Result: + * <none> + * + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_domain_behavior_version() + * + * Request: + * basedn: <domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: msDS-Behavior-Version + * Result: + * <domain_partition> + * msDS-Behavior-Version: 0 + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_schema_object_version() + * + * Request: + * basedn: CN=Schema,CN=Configuration,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: objectVersion + * Result: + * CN=Schema,CN=Configuration,<domain_partition> + * objectVersion: 30 + */ + +/* + * LDAP search 1st LDAP connection: + * + * not implemented, because the information is already there + * + * Request: + * basedn: "" + * scope: base + * filter: (objectClass=*) + * attrs: defaultNamingContext + * dnsHostName + * Result: + * "" + * defaultNamingContext: <domain_partition> + * dnsHostName: <dns_host_name> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_infrastructure_fsmo() + * + * Request: + * basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: 1.1 + * Result: + * CN=Infrastructure,<domain_partition> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_w2k3_update_revision() + * + * Request: + * basedn: CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: revision + * Result: + * CN=Windows2003Update,CN=DomainUpdates,CN=System,<domain_partition> + * revision: 8 + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_infrastructure_fsmo() + * + * Request: + * basedn: CN=Infrastructure,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: fSMORoleOwner + * Result: + * CN=Infrastructure,<domain_partition> + * fSMORoleOwner: CN=NTDS Settings,<infrastructure_fsmo_server_object> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_infrastructure_fsmo() + * + * Request: + * basedn: <infrastructure_fsmo_server_object> + * scope: base + * filter: (objectClass=*) + * attrs: dnsHostName + * Result: + * <infrastructure_fsmo_server_object> + * dnsHostName: <dns_host_name> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_infrastructure_fsmo() + * + * Request: + * basedn: CN=NTDS Settings,<infrastructure_fsmo_server_object> + * scope: base + * filter: (objectClass=*) + * attrs: objectGUID + * Result: + * CN=NTDS Settings,<infrastructure_fsmo_server_object> + * objectGUID: <object_guid> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_rid_manager_fsmo() + * + * Request: + * basedn: <domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: rIDManagerReference + * Result: + * <domain_partition> + * rIDManagerReference: CN=RID Manager$,CN=System,<domain_partition> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_rid_manager_fsmo() + * + * Request: + * basedn: CN=RID Manager$,CN=System,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: fSMORoleOwner + * Result: + * CN=Infrastructure,<domain_partition> + * fSMORoleOwner: CN=NTDS Settings,<rid_manager_fsmo_server_object> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_rid_manager_fsmo() + * + * Request: + * basedn: <rid_manager_fsmo_server_object> + * scope: base + * filter: (objectClass=*) + * attrs: dnsHostName + * Result: + * <rid_manager_fsmo_server_object> + * dnsHostName: <dns_host_name> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_rid_manager_fsmo() + * + * Request: + * basedn: CN=NTDS Settings,<rid_manager_fsmo_server_object> + * scope: base + * filter: (objectClass=*) + * attrs: msDs-ReplicationEpoch + * Result: + * CN=NTDS Settings,<rid_manager_fsmo_server_object> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_site_object() + * + * Request: + * basedn: CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: + * Result: + * CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition> + * objectClass: top + * site + * cn: <new_dc_site_name> + * distinguishedName:CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition> + * instanceType: 4 + * whenCreated: ... + * whenChanged: ... + * uSNCreated: ... + * uSNChanged: ... + * showInAdvancedViewOnly: TRUE + * name: <new_dc_site_name> + * objectGUID: <object_guid> + * systemFlags: 1107296256 <0x42000000> + * objectCategory: CN=Site,CN=Schema,CN=Configuration,<domain_partition> + */ + +/*************************************************************** + * Add this stage we call the check_options() callback function + * of the caller, to see if he wants us to continue + * + * see: becomeDC_check_options() + ***************************************************************/ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_computer_object() + * + * Request: + * basedn: <domain_partition> + * scope: sub + * filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>)) + * attrs: distinguishedName + * userAccountControl + * Result: + * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * distinguishedName: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * userAccoountControl: 4096 <0x1000> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_server_object_1() + * + * Request: + * basedn: CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: + * Result: + * <noSuchObject> + * <matchedDN:CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: becomeDC_ldap1_server_object_2() + * + * Request: + * basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: serverReferenceBL + * typesOnly: TRUE!!! + * Result: + * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + */ + +/* + * LDAP add 1st LDAP connection: + * + * see: becomeDC_ldap1_server_object_add() + * + * Request: + * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * objectClass: server + * systemFlags: 50000000 <0x2FAF080> + * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * Result: + * <success> + */ + +/* + * LDAP search 1st LDAP connection: + * + * not implemented, maybe we can add that later + * + * Request: + * basedn: CN=NTDS Settings,CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: + * Result: + * <noSuchObject> + * <matchedDN:CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>> + */ + +/* + * LDAP search 1st LDAP connection: + * + * not implemented because it gives no new information + * + * Request: + * basedn: CN=Partitions,CN=Configuration,<domain_partition> + * scope: sub + * filter: (nCName=<domain_partition>) + * attrs: nCName + * dnsRoot + * controls: LDAP_SERVER_EXTENDED_DN_OID:critical=false + * Result: + * <GUID=<hex_guid>>;CN=<domain_netbios_name>,CN=Partitions,<domain_partition>> + * nCName: <GUID=<hex_guid>>;<SID=<hex_sid>>;<domain_partition>> + * dnsRoot: <domain_dns_name> + */ + +/* + * LDAP modify 1st LDAP connection: + * + * see: becomeDC_ldap1_server_object_modify() + * + * Request (add): + * CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>> + * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * Result: + * <attributeOrValueExist> + */ + +/* + * LDAP modify 1st LDAP connection: + * + * see: becomeDC_ldap1_server_object_modify() + * + * Request (replace): + * CN=<new_dc_netbios_name>,CN=Servers,CN=<new_dc_site_name>,CN=Sites,CN=Configuration,<domain_partition>> + * serverReference:CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * Result: + * <success> + */ + +/* + * Open 1st DRSUAPI connection to the DC using admin credentials + * DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc") + * (w2k3 does 2 DsBind() calls here..., where is first is unused and contains garbage at the end) + * + * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi1_connect_recv(), + * becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv() and becomeDC_drsuapi1_bind_recv() + */ + +/* + * DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ... + * on the 1st DRSUAPI connection + * + * see: becomeDC_drsuapi1_add_entry_send() and becomeDC_drsuapi1_add_entry_recv() + */ + +/*************************************************************** + * Add this stage we call the prepare_db() callback function + * of the caller, to see if he wants us to continue + * + * see: becomeDC_prepare_db() + ***************************************************************/ + +/* + * Open 2nd and 3rd DRSUAPI connection to the DC using admin credentials + * - a DsBind with DRSUAPI_DS_BIND_GUID_W2K3 ("6afab99c-6e26-464a-975f-f58f105218bc") + * on the 2nd connection + * + * see: becomeDC_drsuapi_connect_send(), becomeDC_drsuapi2_connect_recv(), + * becomeDC_drsuapi_bind_send(), becomeDC_drsuapi_bind_recv(), becomeDC_drsuapi2_bind_recv() + * and becomeDC_drsuapi3_connect_recv() + */ + +/* + * replicate CN=Schema,CN=Configuration,... + * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection + * + * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(), + * becomeDC_drsuapi3_pull_schema_send() and becomeDC_drsuapi3_pull_schema_recv() + * + *************************************************************** + * Add this stage we call the schema_chunk() callback function + * for each replication message + ***************************************************************/ + +/* + * replicate CN=Configuration,... + * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection + * + * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(), + * becomeDC_drsuapi3_pull_config_send() and becomeDC_drsuapi3_pull_config_recv() + * + *************************************************************** + * Add this stage we call the config_chunk() callback function + * for each replication message + ***************************************************************/ + +/* + * LDAP unbind on the 1st LDAP connection + * + * not implemented, because it's not needed... + */ + +/* + * Open 2nd LDAP connection to the DC using admin credentials + * + * see: becomeDC_connect_ldap2() and becomeDC_ldap_connect() + */ + +/* + * LDAP search 2nd LDAP connection: + * + * not implemented because it gives no new information + * same as becomeDC_ldap1_computer_object() + * + * Request: + * basedn: <domain_partition> + * scope: sub + * filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>)) + * attrs: distinguishedName + * userAccountControl + * Result: + * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * distinguishedName: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * userAccoountControl: 4096 <0x00001000> + */ + +/* + * LDAP search 2nd LDAP connection: + * + * not implemented because it gives no new information + * same as becomeDC_ldap1_computer_object() + * + * Request: + * basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: userAccountControl + * Result: + * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * userAccoountControl: 4096 <0x00001000> + */ + +/* + * LDAP modify 2nd LDAP connection: + * + * see: becomeDC_ldap2_modify_computer() + * + * Request (replace): + * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * userAccoountControl: 532480 <0x82000> + * Result: + * <success> + */ + +/* + * LDAP search 2nd LDAP connection: + * + * see: becomeDC_ldap2_move_computer() + * + * Request: + * basedn: <WKGUID=2fbac1870ade11d297c400c04fd8d5cd,<domain_partition>> + * scope: base + * filter: (objectClass=*) + * attrs: 1.1 + * Result: + * CN=Domain Controllers,<domain_partition> + */ + +/* + * LDAP search 2nd LDAP connection: + * + * not implemented because it gives no new information + * + * Request: + * basedn: CN=Domain Controllers,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: distinguishedName + * Result: + * CN=Domain Controller,<domain_partition> + * distinguishedName: CN=Domain Controllers,<domain_partition> + */ + +/* + * LDAP modifyRDN 2nd LDAP connection: + * + * see: becomeDC_ldap2_move_computer() + * + * Request: + * entry: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * newrdn: CN=<new_dc_netbios_name> + * deleteoldrdn: TRUE + * newparent: CN=Domain Controllers,<domain_partition> + * Result: + * <success> + */ + +/* + * LDAP unbind on the 2nd LDAP connection + * + * not implemented, because it's not needed... + */ + +/* + * replicate Domain Partition + * on the 3rd DRSUAPI connection and the bind_handle from the 2nd connection + * + * see: becomeDC_drsuapi_pull_partition_send(), becomeDC_drsuapi_pull_partition_recv(), + * becomeDC_drsuapi3_pull_domain_send() and becomeDC_drsuapi3_pull_domain_recv() + * + *************************************************************** + * Add this stage we call the domain_chunk() callback function + * for each replication message + ***************************************************************/ + +/* call DsReplicaUpdateRefs() for all partitions like this: + * req1: struct drsuapi_DsReplicaUpdateRefsRequest1 + * + * naming_context: struct drsuapi_DsReplicaObjectIdentifier + * __ndr_size : 0x000000ae (174) + * __ndr_size_sid : 0x00000000 (0) + * guid : 00000000-0000-0000-0000-000000000000 + * sid : S-0-0 + * dn : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base' + * + * dest_dsa_dns_name : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base' + * dest_dsa_guid : 4a0df188-a0b8-47ea-bbe5-e614723f16dd + * options : 0x0000001c (28) + * 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION + * 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE + * 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE + * 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE + * 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010 + * + * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the + * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ... + * on the 2nd!!! DRSUAPI connection + * + * see: becomeDC_drsuapi_update_refs_send(), becomeDC_drsuapi2_update_refs_schema_recv(), + * becomeDC_drsuapi2_update_refs_config_recv() and becomeDC_drsuapi2_update_refs_domain_recv() + */ + +/* + * Windows does opens the 4th and 5th DRSUAPI connection... + * and does a DsBind() with the objectGUID from DsAddEntry() as bind_guid + * on the 4th connection + * + * and then 2 full replications of the domain partition on the 5th connection + * with the bind_handle from the 4th connection + * + * not implemented because it gives no new information + */ + +struct libnet_BecomeDC_state { + struct composite_context *creq; + + struct libnet_context *libnet; + + struct dom_sid zero_sid; + + struct { + struct cldap_socket *sock; + struct cldap_netlogon io; + struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon; + } cldap; + + struct becomeDC_ldap { + struct ldb_context *ldb; + const struct ldb_message *rootdse; + } ldap1, ldap2; + + struct becomeDC_drsuapi { + struct libnet_BecomeDC_state *s; + struct dcerpc_binding *binding; + struct dcerpc_pipe *pipe; + struct dcerpc_binding_handle *drsuapi_handle; + DATA_BLOB gensec_skey; + struct drsuapi_DsBind bind_r; + struct GUID bind_guid; + struct drsuapi_DsBindInfoCtr bind_info_ctr; + struct drsuapi_DsBindInfo28 local_info28; + struct drsuapi_DsBindInfo28 remote_info28; + struct policy_handle bind_handle; + } drsuapi1, drsuapi2, drsuapi3; + + void *ndr_struct_ptr; + + struct libnet_BecomeDC_Domain domain; + struct libnet_BecomeDC_Forest forest; + struct libnet_BecomeDC_SourceDSA source_dsa; + struct libnet_BecomeDC_DestDSA dest_dsa; + + struct libnet_BecomeDC_Partition schema_part, config_part, domain_part; + + struct becomeDC_fsmo { + const char *dns_name; + const char *server_dn_str; + const char *ntds_dn_str; + struct GUID ntds_guid; + } infrastructure_fsmo; + + struct becomeDC_fsmo rid_manager_fsmo; + + struct libnet_BecomeDC_CheckOptions _co; + struct libnet_BecomeDC_PrepareDB _pp; + struct libnet_BecomeDC_StoreChunk _sc; + struct libnet_BecomeDC_Callbacks callbacks; + + bool rodc_join; + bool critical_only; +}; + +static int32_t get_dc_function_level(struct loadparm_context *lp_ctx) +{ + /* per default we are (Windows) 2008 R2 compatible */ + return lpcfg_parm_int(lp_ctx, NULL, "ads", "dc function level", + DS_DOMAIN_FUNCTION_2008_R2); +} + +static void becomeDC_recv_cldap(struct tevent_req *req); + +static void becomeDC_send_cldap(struct libnet_BecomeDC_state *s) +{ + struct composite_context *c = s->creq; + struct tevent_req *req; + struct tsocket_address *dest_address; + int ret; + + s->cldap.io.in.dest_address = NULL; + s->cldap.io.in.dest_port = 0; + s->cldap.io.in.realm = s->domain.dns_name; + s->cldap.io.in.host = s->dest_dsa.netbios_name; + s->cldap.io.in.user = NULL; + s->cldap.io.in.domain_guid = NULL; + s->cldap.io.in.domain_sid = NULL; + s->cldap.io.in.acct_control = -1; + s->cldap.io.in.version = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX; + s->cldap.io.in.map_response = true; + + ret = tsocket_address_inet_from_strings(s, "ip", + s->source_dsa.address, + lpcfg_cldap_port(s->libnet->lp_ctx), + &dest_address); + if (ret != 0) { + c->status = map_nt_error_from_unix_common(errno); + if (!composite_is_ok(c)) return; + } + + c->status = cldap_socket_init(s, NULL, dest_address, &s->cldap.sock); + if (!composite_is_ok(c)) return; + + req = cldap_netlogon_send(s, s->libnet->event_ctx, + s->cldap.sock, &s->cldap.io); + if (composite_nomem(req, c)) return; + tevent_req_set_callback(req, becomeDC_recv_cldap, s); +} + +static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s); + +static void becomeDC_recv_cldap(struct tevent_req *req) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(req, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + + c->status = cldap_netlogon_recv(req, s, &s->cldap.io); + talloc_free(req); + if (!composite_is_ok(c)) { + DEBUG(0,("Failed to send, receive or parse CLDAP reply from server %s for our host %s: %s\n", + s->cldap.io.in.dest_address, + s->cldap.io.in.host, + nt_errstr(c->status))); + return; + } + s->cldap.netlogon = s->cldap.io.out.netlogon.data.nt5_ex; + + s->domain.dns_name = s->cldap.netlogon.dns_domain; + s->domain.netbios_name = s->cldap.netlogon.domain_name; + s->domain.guid = s->cldap.netlogon.domain_uuid; + + s->forest.dns_name = s->cldap.netlogon.forest; + + s->source_dsa.dns_name = s->cldap.netlogon.pdc_dns_name; + s->source_dsa.netbios_name = s->cldap.netlogon.pdc_name; + s->source_dsa.site_name = s->cldap.netlogon.server_site; + + s->dest_dsa.site_name = s->cldap.netlogon.client_site; + + DEBUG(0,("CLDAP response: forest=%s dns=%s netbios=%s server_site=%s client_site=%s\n", + s->forest.dns_name, s->domain.dns_name, s->domain.netbios_name, + s->source_dsa.site_name, s->dest_dsa.site_name)); + if (!s->dest_dsa.site_name || strcmp(s->dest_dsa.site_name, "") == 0) { + DEBUG(0,("Got empty client site - using server site name %s\n", + s->source_dsa.site_name)); + s->dest_dsa.site_name = s->source_dsa.site_name; + } + + becomeDC_connect_ldap1(s); +} + +static NTSTATUS becomeDC_ldap_connect(struct libnet_BecomeDC_state *s, + struct becomeDC_ldap *ldap) +{ + char *url; + + url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name); + NT_STATUS_HAVE_NO_MEMORY(url); + + ldap->ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url, + NULL, + s->libnet->cred, + 0); + talloc_free(url); + if (ldap->ldb == NULL) { + return NT_STATUS_UNEXPECTED_NETWORK_ERROR; + } + + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_rootdse(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "*", + NULL + }; + + basedn = ldb_dn_new(s, s->ldap1.ldb, NULL); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs, + "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->ldap1.rootdse = r->msgs[0]; + + s->domain.dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "defaultNamingContext", NULL); + if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + + s->forest.root_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "rootDomainNamingContext", NULL); + if (!s->forest.root_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + s->forest.config_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "configurationNamingContext", NULL); + if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + s->forest.schema_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "schemaNamingContext", NULL); + if (!s->forest.schema_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + + s->source_dsa.server_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "serverName", NULL); + if (!s->source_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + s->source_dsa.ntds_dn_str = ldb_msg_find_attr_as_string(s->ldap1.rootdse, "dsServiceName", NULL); + if (!s->source_dsa.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_crossref_behavior_version(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "msDs-Behavior-Version", + NULL + }; + + basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.config_dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_ONELEVEL, attrs, + "(cn=Partitions)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->forest.crossref_behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0); + if (s->forest.crossref_behavior_version > + get_dc_function_level(s->libnet->lp_ctx)) { + talloc_free(r); + DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n", + s->forest.crossref_behavior_version, + get_dc_function_level(s->libnet->lp_ctx))); + return NT_STATUS_NOT_SUPPORTED; + } + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_domain_behavior_version(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "msDs-Behavior-Version", + NULL + }; + + basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs, + "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->domain.behavior_version = ldb_msg_find_attr_as_uint(r->msgs[0], "msDs-Behavior-Version", 0); + if (s->domain.behavior_version > + get_dc_function_level(s->libnet->lp_ctx)) { + talloc_free(r); + DEBUG(0,("The servers function level %u is above 'ads:dc function level' of %u\n", + s->forest.crossref_behavior_version, + get_dc_function_level(s->libnet->lp_ctx))); + return NT_STATUS_NOT_SUPPORTED; + } + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_schema_object_version(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "objectVersion", + NULL + }; + + basedn = ldb_dn_new(s, s->ldap1.ldb, s->forest.schema_dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs, + "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->forest.schema_object_version = ldb_msg_find_attr_as_uint(r->msgs[0], "objectVersion", 0); + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_w2k3_update_revision(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "revision", + NULL + }; + + basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=Windows2003Update,CN=DomainUpdates,CN=System,%s", + s->domain.dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs, + "(objectClass=*)"); + talloc_free(basedn); + if (ret == LDB_ERR_NO_SUCH_OBJECT) { + /* w2k doesn't have this object */ + s->domain.w2k3_update_revision = 0; + return NT_STATUS_OK; + } else if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->domain.w2k3_update_revision = ldb_msg_find_attr_as_uint(r->msgs[0], "revision", 0); + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_infrastructure_fsmo(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + struct ldb_dn *ntds_dn; + struct ldb_dn *server_dn; + static const char *dns_attrs[] = { + "dnsHostName", + NULL + }; + static const char *guid_attrs[] = { + "objectGUID", + NULL + }; + + ret = dsdb_wellknown_dn(s->ldap1.ldb, s, + ldb_get_default_basedn(s->ldap1.ldb), + DS_GUID_INFRASTRUCTURE_CONTAINER, + &basedn); + if (ret != LDB_SUCCESS) { + DEBUG(0,("Failed to get well known DN for DS_GUID_INFRASTRUCTURE_CONTAINER on %s: %s\n", + ldb_dn_get_linearized(ldb_get_default_basedn(s->ldap1.ldb)), + ldb_errstring(s->ldap1.ldb))); + return NT_STATUS_LDAP(ret); + } + + ret = samdb_reference_dn(s->ldap1.ldb, s, basedn, "fSMORoleOwner", &ntds_dn); + if (ret != LDB_SUCCESS) { + DEBUG(0,("Failed to get reference DN from fsmoRoleOwner on %s: %s\n", + ldb_dn_get_linearized(basedn), + ldb_errstring(s->ldap1.ldb))); + talloc_free(basedn); + return NT_STATUS_LDAP(ret); + } + + s->infrastructure_fsmo.ntds_dn_str = ldb_dn_get_linearized(ntds_dn); + NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.ntds_dn_str); + + server_dn = ldb_dn_get_parent(s, ntds_dn); + NT_STATUS_HAVE_NO_MEMORY(server_dn); + + s->infrastructure_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn); + NT_STATUS_HAVE_NO_MEMORY(s->infrastructure_fsmo.server_dn_str); + + ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE, + dns_attrs, "(objectClass=*)"); + if (ret != LDB_SUCCESS) { + DEBUG(0,("Failed to get server DN %s: %s\n", + ldb_dn_get_linearized(server_dn), + ldb_errstring(s->ldap1.ldb))); + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->infrastructure_fsmo.dns_name = ldb_msg_find_attr_as_string(r->msgs[0], "dnsHostName", NULL); + if (!s->infrastructure_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE; + talloc_steal(s, s->infrastructure_fsmo.dns_name); + + talloc_free(r); + + ldb_dn_remove_extended_components(ntds_dn); + ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE, + guid_attrs, "(objectClass=*)"); + if (ret != LDB_SUCCESS) { + DEBUG(0,("Failed to get NTDS Settings DN %s: %s\n", + ldb_dn_get_linearized(ntds_dn), + ldb_errstring(s->ldap1.ldb))); + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->infrastructure_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID"); + + talloc_free(r); + + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_rid_manager_fsmo(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + const char *reference_dn_str; + struct ldb_dn *ntds_dn; + struct ldb_dn *server_dn; + static const char *rid_attrs[] = { + "rIDManagerReference", + NULL + }; + static const char *fsmo_attrs[] = { + "fSMORoleOwner", + NULL + }; + static const char *dns_attrs[] = { + "dnsHostName", + NULL + }; + static const char *guid_attrs[] = { + "objectGUID", + NULL + }; + + basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, + rid_attrs, "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + reference_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "rIDManagerReference", NULL); + if (!reference_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + + basedn = ldb_dn_new(s, s->ldap1.ldb, reference_dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + talloc_free(r); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, + fsmo_attrs, "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->rid_manager_fsmo.ntds_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "fSMORoleOwner", NULL); + if (!s->rid_manager_fsmo.ntds_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + talloc_steal(s, s->rid_manager_fsmo.ntds_dn_str); + + talloc_free(r); + + ntds_dn = ldb_dn_new(s, s->ldap1.ldb, s->rid_manager_fsmo.ntds_dn_str); + NT_STATUS_HAVE_NO_MEMORY(ntds_dn); + + server_dn = ldb_dn_get_parent(s, ntds_dn); + NT_STATUS_HAVE_NO_MEMORY(server_dn); + + s->rid_manager_fsmo.server_dn_str = ldb_dn_alloc_linearized(s, server_dn); + NT_STATUS_HAVE_NO_MEMORY(s->rid_manager_fsmo.server_dn_str); + + ret = ldb_search(s->ldap1.ldb, s, &r, server_dn, LDB_SCOPE_BASE, + dns_attrs, "(objectClass=*)"); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->rid_manager_fsmo.dns_name = ldb_msg_find_attr_as_string(r->msgs[0], "dnsHostName", NULL); + if (!s->rid_manager_fsmo.dns_name) return NT_STATUS_INVALID_NETWORK_RESPONSE; + talloc_steal(s, s->rid_manager_fsmo.dns_name); + + talloc_free(r); + + ret = ldb_search(s->ldap1.ldb, s, &r, ntds_dn, LDB_SCOPE_BASE, + guid_attrs, "(objectClass=*)"); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->rid_manager_fsmo.ntds_guid = samdb_result_guid(r->msgs[0], "objectGUID"); + + talloc_free(r); + + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_site_object(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + + basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Sites,%s", + s->dest_dsa.site_name, + s->forest.config_dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, + NULL, "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->dest_dsa.site_guid = samdb_result_guid(r->msgs[0], "objectGUID"); + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_check_options(struct libnet_BecomeDC_state *s) +{ + if (!s->callbacks.check_options) return NT_STATUS_OK; + + s->_co.domain = &s->domain; + s->_co.forest = &s->forest; + s->_co.source_dsa = &s->source_dsa; + + return s->callbacks.check_options(s->callbacks.private_data, &s->_co); +} + +static NTSTATUS becomeDC_ldap1_computer_object(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "distinguishedName", + "userAccountControl", + NULL + }; + + basedn = ldb_dn_new(s, s->ldap1.ldb, s->domain.dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_SUBTREE, attrs, + "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))", + s->dest_dsa.netbios_name); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->dest_dsa.computer_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "distinguishedName", NULL); + if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + talloc_steal(s, s->dest_dsa.computer_dn_str); + + s->dest_dsa.user_account_control = ldb_msg_find_attr_as_uint(r->msgs[0], "userAccountControl", 0); + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_server_object_1(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + const char *server_reference_dn_str; + struct ldb_dn *server_reference_dn; + struct ldb_dn *computer_dn; + + basedn = ldb_dn_new_fmt(s, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s", + s->dest_dsa.netbios_name, + s->dest_dsa.site_name, + s->forest.config_dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, + NULL, "(objectClass=*)"); + talloc_free(basedn); + if (ret == LDB_ERR_NO_SUCH_OBJECT) { + /* if the object doesn't exist, we'll create it later */ + return NT_STATUS_OK; + } else if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + server_reference_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "serverReference", NULL); + if (server_reference_dn_str) { + server_reference_dn = ldb_dn_new(r, s->ldap1.ldb, server_reference_dn_str); + NT_STATUS_HAVE_NO_MEMORY(server_reference_dn); + + computer_dn = ldb_dn_new(r, s->ldap1.ldb, s->dest_dsa.computer_dn_str); + NT_STATUS_HAVE_NO_MEMORY(computer_dn); + + /* + * if the server object belongs to another DC in another domain + * in the forest, we should not touch this object! + */ + if (ldb_dn_compare(computer_dn, server_reference_dn) != 0) { + talloc_free(r); + return NT_STATUS_OBJECT_NAME_COLLISION; + } + } + + /* if the server object is already for the dest_dsa, then we don't need to create it */ + s->dest_dsa.server_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "distinguishedName", NULL); + if (!s->dest_dsa.server_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + talloc_steal(s, s->dest_dsa.server_dn_str); + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_server_object_2(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + const char *server_reference_bl_dn_str; + static const char *attrs[] = { + "serverReferenceBL", + NULL + }; + + /* if the server_dn_str has a valid value, we skip this lookup */ + if (s->dest_dsa.server_dn_str) return NT_STATUS_OK; + + basedn = ldb_dn_new(s, s->ldap1.ldb, s->dest_dsa.computer_dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap1.ldb, s, &r, basedn, LDB_SCOPE_BASE, + attrs, "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + server_reference_bl_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "serverReferenceBL", NULL); + if (!server_reference_bl_dn_str) { + /* if no back link is present, we're done for this function */ + talloc_free(r); + return NT_STATUS_OK; + } + + /* if the server object is already for the dest_dsa, then we don't need to create it */ + s->dest_dsa.server_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "serverReferenceBL", NULL); + if (s->dest_dsa.server_dn_str) { + /* if a back link is present, we know that the server object is present */ + talloc_steal(s, s->dest_dsa.server_dn_str); + } + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_server_object_add(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_message *msg; + char *server_dn_str; + + /* if the server_dn_str has a valid value, we skip this lookup */ + if (s->dest_dsa.server_dn_str) return NT_STATUS_OK; + + msg = ldb_msg_new(s); + NT_STATUS_HAVE_NO_MEMORY(msg); + + msg->dn = ldb_dn_new_fmt(msg, s->ldap1.ldb, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s", + s->dest_dsa.netbios_name, + s->dest_dsa.site_name, + s->forest.config_dn_str); + NT_STATUS_HAVE_NO_MEMORY(msg->dn); + + ret = ldb_msg_add_string(msg, "objectClass", "server"); + if (ret != 0) { + talloc_free(msg); + return NT_STATUS_NO_MEMORY; + } + ret = ldb_msg_add_string(msg, "systemFlags", "50000000"); + if (ret != 0) { + talloc_free(msg); + return NT_STATUS_NO_MEMORY; + } + ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str); + if (ret != 0) { + talloc_free(msg); + return NT_STATUS_NO_MEMORY; + } + + server_dn_str = ldb_dn_alloc_linearized(s, msg->dn); + NT_STATUS_HAVE_NO_MEMORY(server_dn_str); + + ret = ldb_add(s->ldap1.ldb, msg); + talloc_free(msg); + if (ret != LDB_SUCCESS) { + talloc_free(server_dn_str); + return NT_STATUS_LDAP(ret); + } + + s->dest_dsa.server_dn_str = server_dn_str; + + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap1_server_object_modify(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_message *msg; + unsigned int i; + + /* make a 'modify' msg, and only for serverReference */ + msg = ldb_msg_new(s); + NT_STATUS_HAVE_NO_MEMORY(msg); + msg->dn = ldb_dn_new(msg, s->ldap1.ldb, s->dest_dsa.server_dn_str); + NT_STATUS_HAVE_NO_MEMORY(msg->dn); + + ret = ldb_msg_add_string(msg, "serverReference", s->dest_dsa.computer_dn_str); + if (ret != 0) { + talloc_free(msg); + return NT_STATUS_NO_MEMORY; + } + + /* mark all the message elements (should be just one) + as LDB_FLAG_MOD_ADD */ + for (i=0;i<msg->num_elements;i++) { + msg->elements[i].flags = LDB_FLAG_MOD_ADD; + } + + ret = ldb_modify(s->ldap1.ldb, msg); + if (ret == LDB_SUCCESS) { + talloc_free(msg); + return NT_STATUS_OK; + } else if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) { + /* retry with LDB_FLAG_MOD_REPLACE */ + } else { + talloc_free(msg); + return NT_STATUS_LDAP(ret); + } + + /* mark all the message elements (should be just one) + as LDB_FLAG_MOD_REPLACE */ + for (i=0;i<msg->num_elements;i++) { + msg->elements[i].flags = LDB_FLAG_MOD_REPLACE; + } + + ret = ldb_modify(s->ldap1.ldb, msg); + talloc_free(msg); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } + + return NT_STATUS_OK; +} + +static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s, + struct becomeDC_drsuapi *drsuapi, + void (*recv_fn)(struct composite_context *req)); +static void becomeDC_drsuapi1_connect_recv(struct composite_context *req); +static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s); + +static void becomeDC_connect_ldap1(struct libnet_BecomeDC_state *s) +{ + struct composite_context *c = s->creq; + + c->status = becomeDC_ldap_connect(s, &s->ldap1); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_rootdse(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_crossref_behavior_version(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_domain_behavior_version(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_schema_object_version(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_w2k3_update_revision(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_infrastructure_fsmo(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_rid_manager_fsmo(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_site_object(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_check_options(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_computer_object(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_server_object_1(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_server_object_2(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_server_object_add(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap1_server_object_modify(s); + if (!composite_is_ok(c)) return; + + becomeDC_drsuapi_connect_send(s, &s->drsuapi1, becomeDC_drsuapi1_connect_recv); +} + +static void becomeDC_drsuapi_connect_send(struct libnet_BecomeDC_state *s, + struct becomeDC_drsuapi *drsuapi, + void (*recv_fn)(struct composite_context *req)) +{ + struct composite_context *c = s->creq; + struct composite_context *creq; + char *binding_str; + + drsuapi->s = s; + + if (!drsuapi->binding) { + const char *krb5_str = ""; + const char *print_str = ""; + /* + * Note: Replication only works with Windows 2000 when 'krb5' is + * passed as auth_type here. If NTLMSSP is used, Windows + * 2000 returns garbage in the DsGetNCChanges() response + * if encrypted password attributes would be in the + * response. That means the replication of the schema and + * configuration partition works fine, but it fails for + * the domain partition. + */ + if (lpcfg_parm_bool(s->libnet->lp_ctx, NULL, "become_dc", + "force krb5", true)) + { + krb5_str = "krb5,"; + } + if (lpcfg_parm_bool(s->libnet->lp_ctx, NULL, "become_dc", + "print", false)) + { + print_str = "print,"; + } + binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[%s%sseal,target_hostname=%s]", + s->source_dsa.address, + krb5_str, print_str, + s->source_dsa.dns_name); + if (composite_nomem(binding_str, c)) return; + c->status = dcerpc_parse_binding(s, binding_str, &drsuapi->binding); + talloc_free(binding_str); + if (!composite_is_ok(c)) return; + } + + if (DEBUGLEVEL >= 10) { + c->status = dcerpc_binding_set_flags(drsuapi->binding, + DCERPC_DEBUG_PRINT_BOTH, + 0); + if (!composite_is_ok(c)) return; + } + + creq = dcerpc_pipe_connect_b_send(s, drsuapi->binding, &ndr_table_drsuapi, + s->libnet->cred, s->libnet->event_ctx, + s->libnet->lp_ctx); + composite_continue(c, creq, recv_fn, s); +} + +static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s, + struct becomeDC_drsuapi *drsuapi, + void (*recv_fn)(struct tevent_req *subreq)); +static void becomeDC_drsuapi1_bind_recv(struct tevent_req *subreq); + +static void becomeDC_drsuapi1_connect_recv(struct composite_context *req) +{ + struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + + c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi1.pipe); + if (!composite_is_ok(c)) return; + + s->drsuapi1.drsuapi_handle = s->drsuapi1.pipe->binding_handle; + + c->status = gensec_session_key(s->drsuapi1.pipe->conn->security_state.generic_state, + s, + &s->drsuapi1.gensec_skey); + if (!composite_is_ok(c)) return; + + becomeDC_drsuapi_bind_send(s, &s->drsuapi1, becomeDC_drsuapi1_bind_recv); +} + +static void becomeDC_drsuapi_bind_send(struct libnet_BecomeDC_state *s, + struct becomeDC_drsuapi *drsuapi, + void (*recv_fn)(struct tevent_req *subreq)) +{ + struct composite_context *c = s->creq; + struct drsuapi_DsBindInfo28 *bind_info28; + struct tevent_req *subreq; + + GUID_from_string(DRSUAPI_DS_BIND_GUID_W2K3, &drsuapi->bind_guid); + + bind_info28 = &drsuapi->local_info28; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_BASE; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2; + if (s->domain.behavior_version >= DS_DOMAIN_FUNCTION_2003) { + /* TODO: find out how this is really triggered! */ + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION; + } + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7; + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT; +#if 0 /* we don't support XPRESS compression yet */ + bind_info28->supported_extensions |= DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS; +#endif + bind_info28->site_guid = s->dest_dsa.site_guid; + bind_info28->pid = 0; + bind_info28->repl_epoch = 0; + + drsuapi->bind_info_ctr.length = 28; + drsuapi->bind_info_ctr.info.info28 = *bind_info28; + + drsuapi->bind_r.in.bind_guid = &drsuapi->bind_guid; + drsuapi->bind_r.in.bind_info = &drsuapi->bind_info_ctr; + drsuapi->bind_r.out.bind_handle = &drsuapi->bind_handle; + + subreq = dcerpc_drsuapi_DsBind_r_send(s, c->event_ctx, + drsuapi->drsuapi_handle, + &drsuapi->bind_r); + if (composite_nomem(subreq, c)) return; + tevent_req_set_callback(subreq, recv_fn, s); +} + +static WERROR becomeDC_drsuapi_bind_recv(struct libnet_BecomeDC_state *s, + struct becomeDC_drsuapi *drsuapi) +{ + if (!W_ERROR_IS_OK(drsuapi->bind_r.out.result)) { + return drsuapi->bind_r.out.result; + } + + ZERO_STRUCT(drsuapi->remote_info28); + if (drsuapi->bind_r.out.bind_info) { + switch (drsuapi->bind_r.out.bind_info->length) { + case 24: { + struct drsuapi_DsBindInfo24 *info24; + info24 = &drsuapi->bind_r.out.bind_info->info.info24; + drsuapi->remote_info28.supported_extensions = info24->supported_extensions; + drsuapi->remote_info28.site_guid = info24->site_guid; + drsuapi->remote_info28.pid = info24->pid; + drsuapi->remote_info28.repl_epoch = 0; + break; + } + case 28: { + drsuapi->remote_info28 = drsuapi->bind_r.out.bind_info->info.info28; + break; + } + case 32: { + struct drsuapi_DsBindInfo32 *info32; + info32 = &drsuapi->bind_r.out.bind_info->info.info32; + drsuapi->remote_info28.supported_extensions = info32->supported_extensions; + drsuapi->remote_info28.site_guid = info32->site_guid; + drsuapi->remote_info28.pid = info32->pid; + drsuapi->remote_info28.repl_epoch = info32->repl_epoch; + break; + } + case 48: { + struct drsuapi_DsBindInfo48 *info48; + info48 = &drsuapi->bind_r.out.bind_info->info.info48; + drsuapi->remote_info28.supported_extensions = info48->supported_extensions; + drsuapi->remote_info28.site_guid = info48->site_guid; + drsuapi->remote_info28.pid = info48->pid; + drsuapi->remote_info28.repl_epoch = info48->repl_epoch; + break; + } + case 52: { + struct drsuapi_DsBindInfo52 *info52; + info52 = &drsuapi->bind_r.out.bind_info->info.info52; + drsuapi->remote_info28.supported_extensions = info52->supported_extensions; + drsuapi->remote_info28.site_guid = info52->site_guid; + drsuapi->remote_info28.pid = info52->pid; + drsuapi->remote_info28.repl_epoch = info52->repl_epoch; + break; + } + default: + DEBUG(1, ("Warning: invalid info length in bind info: %d\n", + drsuapi->bind_r.out.bind_info->length)); + break; + } + } + + return WERR_OK; +} + +static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s); + +static void becomeDC_drsuapi1_bind_recv(struct tevent_req *subreq) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + WERROR status; + + c->status = dcerpc_drsuapi_DsBind_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi1); + if (!W_ERROR_IS_OK(status)) { + composite_error(c, werror_to_ntstatus(status)); + return; + } + + becomeDC_drsuapi1_add_entry_send(s); +} + +static void becomeDC_drsuapi1_add_entry_recv(struct tevent_req *subreq); + +static void becomeDC_drsuapi1_add_entry_send(struct libnet_BecomeDC_state *s) +{ + struct composite_context *c = s->creq; + struct drsuapi_DsAddEntry *r; + struct drsuapi_DsReplicaObjectIdentifier *identifier; + uint32_t num_attrs, i = 0; + struct drsuapi_DsReplicaAttribute *attrs; + enum ndr_err_code ndr_err; + bool w2k3; + struct tevent_req *subreq; + + /* choose a random invocationId */ + s->dest_dsa.invocation_id = GUID_random(); + + /* + * if the schema version indicates w2k3, then also send some w2k3 + * specific attributes. + */ + if (s->forest.schema_object_version >= 30) { + w2k3 = true; + } else { + w2k3 = false; + } + + r = talloc_zero(s, struct drsuapi_DsAddEntry); + if (composite_nomem(r, c)) return; + + /* setup identifier */ + identifier = talloc(r, struct drsuapi_DsReplicaObjectIdentifier); + if (composite_nomem(identifier, c)) return; + identifier->guid = GUID_zero(); + identifier->sid = s->zero_sid; + identifier->dn = talloc_asprintf(identifier, "CN=NTDS Settings,%s", + s->dest_dsa.server_dn_str); + if (composite_nomem(identifier->dn, c)) return; + + /* allocate attribute array */ + num_attrs = 12; + attrs = talloc_array(r, struct drsuapi_DsReplicaAttribute, num_attrs); + if (composite_nomem(attrs, c)) return; + + /* ntSecurityDescriptor */ + { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + struct security_descriptor *v; + struct dom_sid *domain_admins_sid; + const char *domain_admins_sid_str; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + domain_admins_sid = dom_sid_add_rid(vs, s->domain.sid, DOMAIN_RID_ADMINS); + if (composite_nomem(domain_admins_sid, c)) return; + + domain_admins_sid_str = dom_sid_string(domain_admins_sid, domain_admins_sid); + if (composite_nomem(domain_admins_sid_str, c)) return; + + v = security_descriptor_dacl_create(vd, + 0, + /* owner: domain admins */ + domain_admins_sid_str, + /* owner group: domain admins */ + domain_admins_sid_str, + /* authenticated users */ + SID_NT_AUTHENTICATED_USERS, + SEC_ACE_TYPE_ACCESS_ALLOWED, + SEC_STD_READ_CONTROL | + SEC_ADS_LIST | + SEC_ADS_READ_PROP | + SEC_ADS_LIST_OBJECT, + 0, + /* domain admins */ + domain_admins_sid_str, + SEC_ACE_TYPE_ACCESS_ALLOWED, + SEC_STD_REQUIRED | + SEC_ADS_CREATE_CHILD | + SEC_ADS_LIST | + SEC_ADS_SELF_WRITE | + SEC_ADS_READ_PROP | + SEC_ADS_WRITE_PROP | + SEC_ADS_DELETE_TREE | + SEC_ADS_LIST_OBJECT | + SEC_ADS_CONTROL_ACCESS, + 0, + /* system */ + SID_NT_SYSTEM, + SEC_ACE_TYPE_ACCESS_ALLOWED, + SEC_STD_REQUIRED | + SEC_ADS_CREATE_CHILD | + SEC_ADS_DELETE_CHILD | + SEC_ADS_LIST | + SEC_ADS_SELF_WRITE | + SEC_ADS_READ_PROP | + SEC_ADS_WRITE_PROP | + SEC_ADS_DELETE_TREE | + SEC_ADS_LIST_OBJECT | + SEC_ADS_CONTROL_ACCESS, + 0, + /* end */ + NULL); + if (composite_nomem(v, c)) return; + + ndr_err = ndr_push_struct_blob(&vd[0], vd, v, + (ndr_push_flags_fn_t)ndr_push_security_descriptor); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_ntSecurityDescriptor; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* objectClass: nTDSDSA */ + { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + vd[0] = data_blob_talloc(vd, NULL, 4); + if (composite_nomem(vd[0].data, c)) return; + + /* value for nTDSDSA */ + SIVAL(vd[0].data, 0, 0x0017002F); + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_objectClass; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* objectCategory: CN=NTDS-DSA,CN=Schema,... or CN=NTDS-DSA-RO,CN=Schema,... */ + { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + struct drsuapi_DsReplicaObjectIdentifier3 v[1]; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + v[0].guid = GUID_zero(); + v[0].sid = s->zero_sid; + + if (s->rodc_join) { + v[0].dn = talloc_asprintf(vd, "CN=NTDS-DSA-RO,%s", + s->forest.schema_dn_str); + } else { + v[0].dn = talloc_asprintf(vd, "CN=NTDS-DSA,%s", + s->forest.schema_dn_str); + } + if (composite_nomem(v[0].dn, c)) return; + + ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_objectCategory; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* invocationId: random guid */ + { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + const struct GUID *v; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + v = &s->dest_dsa.invocation_id; + + c->status = GUID_to_ndr_blob(v, vd, &vd[0]); + if (!composite_is_ok(c)) return; + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_invocationId; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* hasMasterNCs: ... */ + { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + struct drsuapi_DsReplicaObjectIdentifier3 v[3]; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 3); + if (composite_nomem(vd, c)) return; + + v[0].guid = GUID_zero(); + v[0].sid = s->zero_sid; + v[0].dn = s->forest.config_dn_str; + + v[1].guid = GUID_zero(); + v[1].sid = s->zero_sid; + v[1].dn = s->domain.dn_str; + + v[2].guid = GUID_zero(); + v[2].sid = s->zero_sid; + v[2].dn = s->forest.schema_dn_str; + + ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + ndr_err = ndr_push_struct_blob(&vd[1], vd, &v[1], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + ndr_err = ndr_push_struct_blob(&vd[2], vd, &v[2], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + vs[0].blob = &vd[0]; + vs[1].blob = &vd[1]; + vs[2].blob = &vd[2]; + + attrs[i].attid = DRSUAPI_ATTID_hasMasterNCs; + attrs[i].value_ctr.num_values = 3; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* msDS-hasMasterNCs: ... */ + if (w2k3) { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + struct drsuapi_DsReplicaObjectIdentifier3 v[3]; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 3); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 3); + if (composite_nomem(vd, c)) return; + + v[0].guid = GUID_zero(); + v[0].sid = s->zero_sid; + v[0].dn = s->forest.config_dn_str; + + v[1].guid = GUID_zero(); + v[1].sid = s->zero_sid; + v[1].dn = s->domain.dn_str; + + v[2].guid = GUID_zero(); + v[2].sid = s->zero_sid; + v[2].dn = s->forest.schema_dn_str; + + ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + ndr_err = ndr_push_struct_blob(&vd[1], vd, &v[1], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + ndr_err = ndr_push_struct_blob(&vd[2], vd, &v[2], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + vs[0].blob = &vd[0]; + vs[1].blob = &vd[1]; + vs[2].blob = &vd[2]; + + attrs[i].attid = DRSUAPI_ATTID_msDS_hasMasterNCs; + attrs[i].value_ctr.num_values = 3; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* dMDLocation: CN=Schema,... */ + { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + struct drsuapi_DsReplicaObjectIdentifier3 v[1]; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + v[0].guid = GUID_zero(); + v[0].sid = s->zero_sid; + v[0].dn = s->forest.schema_dn_str; + + ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_dMDLocation; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* msDS-HasDomainNCs: <domain_partition> */ + if (w2k3) { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + struct drsuapi_DsReplicaObjectIdentifier3 v[1]; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + v[0].guid = GUID_zero(); + v[0].sid = s->zero_sid; + v[0].dn = s->domain.dn_str; + + ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_msDS_HasDomainNCs; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* msDS-Behavior-Version */ + if (w2k3) { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + vd[0] = data_blob_talloc(vd, NULL, 4); + if (composite_nomem(vd[0].data, c)) return; + + SIVAL(vd[0].data, 0, get_dc_function_level(s->libnet->lp_ctx)); + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_msDS_Behavior_Version; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* systemFlags */ + { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + vd[0] = data_blob_talloc(vd, NULL, 4); + if (composite_nomem(vd[0].data, c)) return; + + if (s->rodc_join) { + SIVAL(vd[0].data, 0, SYSTEM_FLAG_CONFIG_ALLOW_RENAME); + } else { + SIVAL(vd[0].data, 0, SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE); + } + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_systemFlags; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* serverReference: ... */ + { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + struct drsuapi_DsReplicaObjectIdentifier3 v[1]; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + v[0].guid = GUID_zero(); + v[0].sid = s->zero_sid; + v[0].dn = s->dest_dsa.computer_dn_str; + + ndr_err = ndr_push_struct_blob(&vd[0], vd, &v[0], + (ndr_push_flags_fn_t)ndr_push_drsuapi_DsReplicaObjectIdentifier3); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + c->status = ndr_map_error2ntstatus(ndr_err); + if (!composite_is_ok(c)) return; + } + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_serverReference; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* options:... */ + if (s->rodc_join) { + struct drsuapi_DsAttributeValue *vs; + DATA_BLOB *vd; + + vs = talloc_array(attrs, struct drsuapi_DsAttributeValue, 1); + if (composite_nomem(vs, c)) return; + + vd = talloc_array(vs, DATA_BLOB, 1); + if (composite_nomem(vd, c)) return; + + vd[0] = data_blob_talloc(vd, NULL, 4); + if (composite_nomem(vd[0].data, c)) return; + + SIVAL(vd[0].data, 0, DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL); + + vs[0].blob = &vd[0]; + + attrs[i].attid = DRSUAPI_ATTID_options; + attrs[i].value_ctr.num_values = 1; + attrs[i].value_ctr.values = vs; + + i++; + } + + /* truncate the attribute list to the attribute count we have filled in */ + num_attrs = i; + + /* setup request structure */ + r->in.bind_handle = &s->drsuapi1.bind_handle; + r->in.level = 2; + r->in.req = talloc(s, union drsuapi_DsAddEntryRequest); + r->in.req->req2.first_object.next_object = NULL; + r->in.req->req2.first_object.object.identifier = identifier; + r->in.req->req2.first_object.object.flags = 0x00000000; + r->in.req->req2.first_object.object.attribute_ctr.num_attributes= num_attrs; + r->in.req->req2.first_object.object.attribute_ctr.attributes = attrs; + + r->out.level_out = talloc(s, uint32_t); + r->out.ctr = talloc(s, union drsuapi_DsAddEntryCtr); + + s->ndr_struct_ptr = r; + subreq = dcerpc_drsuapi_DsAddEntry_r_send(s, c->event_ctx, + s->drsuapi1.drsuapi_handle, r); + if (composite_nomem(subreq, c)) return; + tevent_req_set_callback(subreq, becomeDC_drsuapi1_add_entry_recv, s); +} + +static void becomeDC_drsuapi2_connect_recv(struct composite_context *req); +static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s); + +static void becomeDC_drsuapi1_add_entry_recv(struct tevent_req *subreq) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + struct drsuapi_DsAddEntry *r = talloc_get_type_abort(s->ndr_struct_ptr, + struct drsuapi_DsAddEntry); + char *binding_str; + uint32_t assoc_group_id; + + s->ndr_struct_ptr = NULL; + + c->status = dcerpc_drsuapi_DsAddEntry_r_recv(subreq, r); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!W_ERROR_IS_OK(r->out.result)) { + composite_error(c, werror_to_ntstatus(r->out.result)); + return; + } + + if (*r->out.level_out == 3) { + WERROR status; + union drsuapi_DsAddEntry_ErrData *err_data = r->out.ctr->ctr3.err_data; + + /* check for errors */ + status = err_data ? err_data->v1.status : WERR_OK; + if (!W_ERROR_IS_OK(status)) { + struct drsuapi_DsAddEntryErrorInfo_Attr_V1 *attr_err; + struct drsuapi_DsAddEntry_AttrErrListItem_V1 *attr_err_li; + struct drsuapi_DsAddEntryErrorInfo_Name_V1 *name_err; + struct drsuapi_DsAddEntryErrorInfo_Referr_V1 *ref_err; + struct drsuapi_DsAddEntry_RefErrListItem_V1 *ref_li; + + if (r->out.ctr->ctr3.err_ver != 1) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + DEBUG(0,("DsAddEntry (R3) of '%s' failed: " + "Errors: dir_err = %d, status = %s;\n", + r->in.req->req3.first_object.object.identifier->dn, + err_data->v1.dir_err, + win_errstr(err_data->v1.status))); + + if (!err_data->v1.info) { + DEBUG(0, ("DsAddEntry (R3): no error info returned!\n")); + composite_error(c, werror_to_ntstatus(status)); + return; + } + + /* dump more detailed error */ + switch (err_data->v1.dir_err) { + case DRSUAPI_DIRERR_ATTRIBUTE: + /* Dump attribute errors */ + attr_err = &err_data->v1.info->attr_err; + DEBUGADD(0,(" Attribute Error: object = %s, count = %d;\n", + attr_err->id->dn, + attr_err->count)); + attr_err_li = &attr_err->first; + for (; attr_err_li; attr_err_li = attr_err_li->next) { + struct drsuapi_DsAddEntry_AttrErr_V1 *err = &attr_err_li->err_data; + DEBUGADD(0,(" Error: err = %s, problem = 0x%08X, attid = 0x%08X;\n", + win_errstr(err->extended_err), + err->problem, + err->attid)); + /* TODO: should we print attribute value here? */ + } + break; + case DRSUAPI_DIRERR_NAME: + /* Dump Name resolution error */ + name_err = &err_data->v1.info->name_err; + DEBUGADD(0,(" Name Error: err = %s, problem = 0x%08X, id_matched = %s;\n", + win_errstr(name_err->extended_err), + name_err->problem, + name_err->id_matched->dn)); + break; + case DRSUAPI_DIRERR_REFERRAL: + /* Dump Referral errors */ + ref_err = &err_data->v1.info->referral_err; + DEBUGADD(0,(" Referral Error: extended_err = %s\n", + win_errstr(ref_err->extended_err))); + ref_li = &ref_err->refer; + for (; ref_li; ref_li = ref_li->next) { + struct drsuapi_DsaAddressListItem_V1 *addr; + DEBUGADD(0,(" Referral: id_target = %s, ref_type = 0x%04X,", + ref_li->id_target->dn, + ref_li->ref_type)); + if (ref_li->is_choice_set) { + DEBUGADD(0,(" choice = 0x%02X, ", + ref_li->choice)); + } + DEBUGADD(0,(" add_list (")); + for (addr = ref_li->addr_list; addr; addr = addr->next) { + DEBUGADD(0,("%s", addr->address->string)); + if (addr->next) { + DEBUGADD(0,(", ")); + } + } + DEBUGADD(0,(");\n")); + } + break; + case DRSUAPI_DIRERR_SECURITY: + /* Dump Security error. */ + DEBUGADD(0,(" Security Error: extended_err = %s, problem = 0x%08X\n", + win_errstr(err_data->v1.info->security_err.extended_err), + err_data->v1.info->security_err.problem)); + break; + case DRSUAPI_DIRERR_SERVICE: + /* Dump Service error. */ + DEBUGADD(0,(" Service Error: extended_err = %s, problem = 0x%08X\n", + win_errstr(err_data->v1.info->service_err.extended_err), + err_data->v1.info->service_err.problem)); + break; + case DRSUAPI_DIRERR_UPDATE: + /* Dump Update error. */ + DEBUGADD(0,(" Update Error: extended_err = %s, problem = 0x%08X\n", + win_errstr(err_data->v1.info->update_err.extended_err), + err_data->v1.info->update_err.problem)); + break; + case DRSUAPI_DIRERR_SYSTEM: + /* System error. */ + DEBUGADD(0,(" System Error: extended_err = %s, problem = 0x%08X\n", + win_errstr(err_data->v1.info->system_err.extended_err), + err_data->v1.info->system_err.problem)); + break; + case DRSUAPI_DIRERR_OK: /* mute compiler warnings */ + default: + DEBUGADD(0,(" Unknown DIRERR error class returned!\n")); + break; + } + + composite_error(c, werror_to_ntstatus(status)); + return; + } + + if (1 != r->out.ctr->ctr3.count) { + DEBUG(0,("DsAddEntry - Ctr3: something very wrong had happened - " + "method succeeded but objects returned are %d (expected 1).\n", + r->out.ctr->ctr3.count)); + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + s->dest_dsa.ntds_guid = r->out.ctr->ctr3.objects[0].guid; + + } else if (*r->out.level_out == 2) { + if (DRSUAPI_DIRERR_OK != r->out.ctr->ctr2.dir_err) { + DEBUG(0,("DsAddEntry failed with: dir_err = %d, extended_err = %s\n", + r->out.ctr->ctr2.dir_err, + win_errstr(r->out.ctr->ctr2.extended_err))); + composite_error(c, werror_to_ntstatus(r->out.ctr->ctr2.extended_err)); + return; + } + + if (1 != r->out.ctr->ctr2.count) { + DEBUG(0,("DsAddEntry: something very wrong had happened - " + "method succeeded but objects returned are %d (expected 1). " + "Errors: dir_err = %d, extended_err = %s\n", + r->out.ctr->ctr2.count, + r->out.ctr->ctr2.dir_err, + win_errstr(r->out.ctr->ctr2.extended_err))); + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + s->dest_dsa.ntds_guid = r->out.ctr->ctr2.objects[0].guid; + } else { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + talloc_free(r); + + s->dest_dsa.ntds_dn_str = talloc_asprintf(s, "CN=NTDS Settings,%s", + s->dest_dsa.server_dn_str); + if (composite_nomem(s->dest_dsa.ntds_dn_str, c)) return; + + c->status = becomeDC_prepare_db(s); + if (!composite_is_ok(c)) return; + + /* this avoids the epmapper lookup on the 2nd connection */ + binding_str = dcerpc_binding_string(s, s->drsuapi1.binding); + if (composite_nomem(binding_str, c)) return; + + c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi2.binding); + talloc_free(binding_str); + if (!composite_is_ok(c)) return; + + if (DEBUGLEVEL >= 10) { + c->status = dcerpc_binding_set_flags(s->drsuapi2.binding, + DCERPC_DEBUG_PRINT_BOTH, + 0); + if (!composite_is_ok(c)) return; + } + + /* w2k3 uses the same assoc_group_id as on the first connection, so we do */ + assoc_group_id = dcerpc_binding_get_assoc_group_id(s->drsuapi1.pipe->binding); + c->status = dcerpc_binding_set_assoc_group_id(s->drsuapi2.binding, assoc_group_id); + if (!composite_is_ok(c)) return; + + becomeDC_drsuapi_connect_send(s, &s->drsuapi2, becomeDC_drsuapi2_connect_recv); +} + +static NTSTATUS becomeDC_prepare_db(struct libnet_BecomeDC_state *s) +{ + if (!s->callbacks.prepare_db) return NT_STATUS_OK; + + s->_pp.domain = &s->domain; + s->_pp.forest = &s->forest; + s->_pp.source_dsa = &s->source_dsa; + s->_pp.dest_dsa = &s->dest_dsa; + + return s->callbacks.prepare_db(s->callbacks.private_data, &s->_pp); +} + +static void becomeDC_drsuapi2_bind_recv(struct tevent_req *subreq); + +static void becomeDC_drsuapi2_connect_recv(struct composite_context *req) +{ + struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + + c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi2.pipe); + if (!composite_is_ok(c)) return; + + s->drsuapi2.drsuapi_handle = s->drsuapi2.pipe->binding_handle; + + c->status = gensec_session_key(s->drsuapi2.pipe->conn->security_state.generic_state, + s, + &s->drsuapi2.gensec_skey); + if (!composite_is_ok(c)) return; + + becomeDC_drsuapi_bind_send(s, &s->drsuapi2, becomeDC_drsuapi2_bind_recv); +} + +static void becomeDC_drsuapi3_connect_recv(struct composite_context *req); + +static void becomeDC_drsuapi2_bind_recv(struct tevent_req *subreq) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + char *binding_str; + uint32_t assoc_group_id; + WERROR status; + + c->status = dcerpc_drsuapi_DsBind_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + status = becomeDC_drsuapi_bind_recv(s, &s->drsuapi2); + if (!W_ERROR_IS_OK(status)) { + composite_error(c, werror_to_ntstatus(status)); + return; + } + + /* this avoids the epmapper lookup on the 3rd connection */ + binding_str = dcerpc_binding_string(s, s->drsuapi1.binding); + if (composite_nomem(binding_str, c)) return; + + c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi3.binding); + talloc_free(binding_str); + if (!composite_is_ok(c)) return; + + if (DEBUGLEVEL >= 10) { + c->status = dcerpc_binding_set_flags(s->drsuapi3.binding, + DCERPC_DEBUG_PRINT_BOTH, + 0); + if (!composite_is_ok(c)) return; + } + + /* w2k3 uses the same assoc_group_id as on the first connection, so we do */ + assoc_group_id = dcerpc_binding_get_assoc_group_id(s->drsuapi1.pipe->binding); + c->status = dcerpc_binding_set_assoc_group_id(s->drsuapi3.binding, assoc_group_id); + if (!composite_is_ok(c)) return; + /* w2k3 uses the concurrent multiplex feature on the 3rd connection, so we do */ + c->status = dcerpc_binding_set_flags(s->drsuapi3.binding, + DCERPC_CONCURRENT_MULTIPLEX, + 0); + if (!composite_is_ok(c)) return; + + becomeDC_drsuapi_connect_send(s, &s->drsuapi3, becomeDC_drsuapi3_connect_recv); +} + +static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s); + +static void becomeDC_drsuapi3_connect_recv(struct composite_context *req) +{ + struct libnet_BecomeDC_state *s = talloc_get_type(req->async.private_data, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + + c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi3.pipe); + if (!composite_is_ok(c)) return; + + s->drsuapi3.drsuapi_handle = s->drsuapi3.pipe->binding_handle; + + c->status = gensec_session_key(s->drsuapi3.pipe->conn->security_state.generic_state, + s, + &s->drsuapi3.gensec_skey); + if (!composite_is_ok(c)) return; + + becomeDC_drsuapi3_pull_schema_send(s); +} + +static void becomeDC_drsuapi_pull_partition_send(struct libnet_BecomeDC_state *s, + struct becomeDC_drsuapi *drsuapi_h, + struct becomeDC_drsuapi *drsuapi_p, + struct libnet_BecomeDC_Partition *partition, + void (*recv_fn)(struct tevent_req *subreq)) +{ + struct composite_context *c = s->creq; + struct drsuapi_DsGetNCChanges *r; + struct tevent_req *subreq; + + r = talloc(s, struct drsuapi_DsGetNCChanges); + if (composite_nomem(r, c)) return; + + r->out.level_out = talloc(r, uint32_t); + if (composite_nomem(r->out.level_out, c)) return; + r->in.req = talloc(r, union drsuapi_DsGetNCChangesRequest); + if (composite_nomem(r->in.req, c)) return; + r->out.ctr = talloc(r, union drsuapi_DsGetNCChangesCtr); + if (composite_nomem(r->out.ctr, c)) return; + + r->in.bind_handle = &drsuapi_h->bind_handle; + if (drsuapi_h->remote_info28.supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8) { + r->in.level = 8; + r->in.req->req8.destination_dsa_guid = partition->destination_dsa_guid; + r->in.req->req8.source_dsa_invocation_id= partition->source_dsa_invocation_id; + r->in.req->req8.naming_context = &partition->nc; + r->in.req->req8.highwatermark = partition->highwatermark; + r->in.req->req8.uptodateness_vector = NULL; + r->in.req->req8.replica_flags = partition->replica_flags; + r->in.req->req8.max_object_count = 133; + r->in.req->req8.max_ndr_size = 1336811; + r->in.req->req8.extended_op = DRSUAPI_EXOP_NONE; + r->in.req->req8.fsmo_info = 0; + r->in.req->req8.partial_attribute_set = NULL; + r->in.req->req8.partial_attribute_set_ex= NULL; + r->in.req->req8.mapping_ctr.num_mappings= 0; + r->in.req->req8.mapping_ctr.mappings = NULL; + } else { + r->in.level = 5; + r->in.req->req5.destination_dsa_guid = partition->destination_dsa_guid; + r->in.req->req5.source_dsa_invocation_id= partition->source_dsa_invocation_id; + r->in.req->req5.naming_context = &partition->nc; + r->in.req->req5.highwatermark = partition->highwatermark; + r->in.req->req5.uptodateness_vector = NULL; + r->in.req->req5.replica_flags = partition->replica_flags; + r->in.req->req5.max_object_count = 133; + r->in.req->req5.max_ndr_size = 1336770; + r->in.req->req5.extended_op = DRSUAPI_EXOP_NONE; + r->in.req->req5.fsmo_info = 0; + } + + /* + * we should try to use the drsuapi_p->pipe here, as w2k3 does + * but it seems that some extra flags in the DCERPC Bind call + * are needed for it. Or the same KRB5 TGS is needed on both + * connections. + */ + s->ndr_struct_ptr = r; + subreq = dcerpc_drsuapi_DsGetNCChanges_r_send(s, c->event_ctx, + drsuapi_p->drsuapi_handle, + r); + if (composite_nomem(subreq, c)) return; + tevent_req_set_callback(subreq, recv_fn, s); +} + +static WERROR becomeDC_drsuapi_pull_partition_recv(struct libnet_BecomeDC_state *s, + struct becomeDC_drsuapi *drsuapi_h, + struct becomeDC_drsuapi *drsuapi_p, + struct libnet_BecomeDC_Partition *partition, + struct drsuapi_DsGetNCChanges *r) +{ + uint32_t req_level = r->in.level; + struct drsuapi_DsGetNCChangesRequest5 *req5 = NULL; + struct drsuapi_DsGetNCChangesRequest8 *req8 = NULL; + struct drsuapi_DsGetNCChangesRequest10 *req10 = NULL; + uint32_t ctr_level = 0; + struct drsuapi_DsGetNCChangesCtr1 *ctr1 = NULL; + struct drsuapi_DsGetNCChangesCtr6 *ctr6 = NULL; + struct GUID *source_dsa_guid = NULL; + struct GUID *source_dsa_invocation_id = NULL; + struct drsuapi_DsReplicaHighWaterMark *new_highwatermark = NULL; + bool more_data = false; + WERROR werr; + + if (!W_ERROR_IS_OK(r->out.result)) { + return r->out.result; + } + + switch (r->in.level) { + case 0: + /* none */ + break; + case 5: + req5 = &r->in.req->req5; + break; + case 8: + req8 = &r->in.req->req8; + break; + case 10: + req10 = &r->in.req->req10; + break; + default: + return WERR_INVALID_PARAMETER; + } + + if (*r->out.level_out == 1) { + ctr_level = 1; + ctr1 = &r->out.ctr->ctr1; + } else if (*r->out.level_out == 2 && + r->out.ctr->ctr2.mszip1.ts) { + ctr_level = 1; + ctr1 = &r->out.ctr->ctr2.mszip1.ts->ctr1; + } else if (*r->out.level_out == 6) { + ctr_level = 6; + ctr6 = &r->out.ctr->ctr6; + } else if (*r->out.level_out == 7 && + r->out.ctr->ctr7.level == 6 && + r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_MSZIP && + r->out.ctr->ctr7.ctr.mszip6.ts) { + ctr_level = 6; + ctr6 = &r->out.ctr->ctr7.ctr.mszip6.ts->ctr6; + } else if (*r->out.level_out == 7 && + r->out.ctr->ctr7.level == 6 && + r->out.ctr->ctr7.type == DRSUAPI_COMPRESSION_TYPE_WIN2K3_LZ77_DIRECT2 && + r->out.ctr->ctr7.ctr.xpress6.ts) { + ctr_level = 6; + ctr6 = &r->out.ctr->ctr7.ctr.xpress6.ts->ctr6; + } else { + return WERR_BAD_NET_RESP; + } + + if (!ctr1 && ! ctr6) { + return WERR_BAD_NET_RESP; + } + + if (ctr_level == 6) { + if (!W_ERROR_IS_OK(ctr6->drs_error)) { + return ctr6->drs_error; + } + } + + switch (ctr_level) { + case 1: + source_dsa_guid = &ctr1->source_dsa_guid; + source_dsa_invocation_id = &ctr1->source_dsa_invocation_id; + new_highwatermark = &ctr1->new_highwatermark; + more_data = ctr1->more_data; + break; + case 6: + source_dsa_guid = &ctr6->source_dsa_guid; + source_dsa_invocation_id = &ctr6->source_dsa_invocation_id; + new_highwatermark = &ctr6->new_highwatermark; + more_data = ctr6->more_data; + break; + } + + partition->highwatermark = *new_highwatermark; + partition->source_dsa_guid = *source_dsa_guid; + partition->source_dsa_invocation_id = *source_dsa_invocation_id; + partition->more_data = more_data; + + if (!partition->store_chunk) return WERR_OK; + + s->_sc.domain = &s->domain; + s->_sc.forest = &s->forest; + s->_sc.source_dsa = &s->source_dsa; + s->_sc.dest_dsa = &s->dest_dsa; + s->_sc.partition = partition; + s->_sc.req_level = req_level; + s->_sc.req5 = req5; + s->_sc.req8 = req8; + s->_sc.req10 = req10; + s->_sc.ctr_level = ctr_level; + s->_sc.ctr1 = ctr1; + s->_sc.ctr6 = ctr6; + /* + * we need to use the drsuapi_p->gensec_skey here, + * when we use drsuapi_p->pipe in the for this request + */ + s->_sc.gensec_skey = &drsuapi_p->gensec_skey; + + werr = partition->store_chunk(s->callbacks.private_data, &s->_sc); + if (!W_ERROR_IS_OK(werr)) { + return werr; + } + + return WERR_OK; +} + +static void becomeDC_drsuapi3_pull_schema_recv(struct tevent_req *subreq); + +static void becomeDC_drsuapi3_pull_schema_send(struct libnet_BecomeDC_state *s) +{ + s->schema_part.nc.guid = GUID_zero(); + s->schema_part.nc.sid = s->zero_sid; + s->schema_part.nc.dn = s->forest.schema_dn_str; + + s->schema_part.destination_dsa_guid = s->drsuapi2.bind_guid; + + s->schema_part.replica_flags = DRSUAPI_DRS_WRIT_REP + | DRSUAPI_DRS_INIT_SYNC + | DRSUAPI_DRS_PER_SYNC + | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS + | DRSUAPI_DRS_NEVER_SYNCED + | DRSUAPI_DRS_USE_COMPRESSION + | DRSUAPI_DRS_GET_ANC; + if (s->rodc_join) { + s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP; + } + + s->schema_part.store_chunk = s->callbacks.schema_chunk; + + becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, + becomeDC_drsuapi3_pull_schema_recv); +} + +static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s); + +static void becomeDC_drsuapi3_pull_schema_recv(struct tevent_req *subreq) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr, + struct drsuapi_DsGetNCChanges); + WERROR status; + + s->ndr_struct_ptr = NULL; + + c->status = dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq, r); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, r); + if (!W_ERROR_IS_OK(status)) { + composite_error(c, werror_to_ntstatus(status)); + return; + } + + talloc_free(r); + + if (s->schema_part.more_data) { + becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->schema_part, + becomeDC_drsuapi3_pull_schema_recv); + return; + } + + becomeDC_drsuapi3_pull_config_send(s); +} + +static void becomeDC_drsuapi3_pull_config_recv(struct tevent_req *subreq); + +static void becomeDC_drsuapi3_pull_config_send(struct libnet_BecomeDC_state *s) +{ + s->config_part.nc.guid = GUID_zero(); + s->config_part.nc.sid = s->zero_sid; + s->config_part.nc.dn = s->forest.config_dn_str; + + s->config_part.destination_dsa_guid = s->drsuapi2.bind_guid; + + s->config_part.replica_flags = DRSUAPI_DRS_WRIT_REP + | DRSUAPI_DRS_INIT_SYNC + | DRSUAPI_DRS_PER_SYNC + | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS + | DRSUAPI_DRS_NEVER_SYNCED + | DRSUAPI_DRS_USE_COMPRESSION + | DRSUAPI_DRS_GET_ANC; + if (s->rodc_join) { + s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP; + } + + s->config_part.store_chunk = s->callbacks.config_chunk; + + becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, + becomeDC_drsuapi3_pull_config_recv); +} + +static void becomeDC_drsuapi3_pull_config_recv(struct tevent_req *subreq) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr, + struct drsuapi_DsGetNCChanges); + WERROR status; + + s->ndr_struct_ptr = NULL; + + c->status = dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq, r); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, r); + if (!W_ERROR_IS_OK(status)) { + composite_error(c, werror_to_ntstatus(status)); + return; + } + + talloc_free(r); + + if (s->config_part.more_data) { + becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->config_part, + becomeDC_drsuapi3_pull_config_recv); + return; + } + + becomeDC_connect_ldap2(s); +} + +static void becomeDC_drsuapi3_pull_domain_recv(struct tevent_req *subreq); + +static void becomeDC_drsuapi3_pull_domain_send(struct libnet_BecomeDC_state *s) +{ + s->domain_part.nc.guid = GUID_zero(); + s->domain_part.nc.sid = s->zero_sid; + s->domain_part.nc.dn = s->domain.dn_str; + + s->domain_part.destination_dsa_guid = s->drsuapi2.bind_guid; + + s->domain_part.replica_flags = DRSUAPI_DRS_WRIT_REP + | DRSUAPI_DRS_INIT_SYNC + | DRSUAPI_DRS_PER_SYNC + | DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS + | DRSUAPI_DRS_NEVER_SYNCED + | DRSUAPI_DRS_USE_COMPRESSION + | DRSUAPI_DRS_GET_ANC; + if (s->critical_only) { + s->domain_part.replica_flags |= DRSUAPI_DRS_CRITICAL_ONLY; + } + if (s->rodc_join) { + s->schema_part.replica_flags &= ~DRSUAPI_DRS_WRIT_REP; + } + + s->domain_part.store_chunk = s->callbacks.domain_chunk; + + becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, + becomeDC_drsuapi3_pull_domain_recv); +} + +static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s, + struct becomeDC_drsuapi *drsuapi, + struct libnet_BecomeDC_Partition *partition, + void (*recv_fn)(struct tevent_req *subreq)); +static void becomeDC_drsuapi2_update_refs_schema_recv(struct tevent_req *subreq); + +static void becomeDC_drsuapi3_pull_domain_recv(struct tevent_req *subreq) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + struct drsuapi_DsGetNCChanges *r = talloc_get_type_abort(s->ndr_struct_ptr, + struct drsuapi_DsGetNCChanges); + WERROR status; + + s->ndr_struct_ptr = NULL; + + c->status = dcerpc_drsuapi_DsGetNCChanges_r_recv(subreq, r); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + status = becomeDC_drsuapi_pull_partition_recv(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, r); + if (!W_ERROR_IS_OK(status)) { + composite_error(c, werror_to_ntstatus(status)); + return; + } + + talloc_free(r); + + if (s->domain_part.more_data) { + becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, + becomeDC_drsuapi3_pull_domain_recv); + return; + } + + if (s->critical_only) { + /* Remove the critical and ANC */ + s->domain_part.replica_flags ^= DRSUAPI_DRS_CRITICAL_ONLY | DRSUAPI_DRS_GET_ANC; + s->critical_only = false; + becomeDC_drsuapi_pull_partition_send(s, &s->drsuapi2, &s->drsuapi3, &s->domain_part, + becomeDC_drsuapi3_pull_domain_recv); + return; + } + becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->schema_part, + becomeDC_drsuapi2_update_refs_schema_recv); +} + +static void becomeDC_drsuapi_update_refs_send(struct libnet_BecomeDC_state *s, + struct becomeDC_drsuapi *drsuapi, + struct libnet_BecomeDC_Partition *partition, + void (*recv_fn)(struct tevent_req *subreq)) +{ + struct composite_context *c = s->creq; + struct drsuapi_DsReplicaUpdateRefs *r; + const char *ntds_guid_str; + const char *ntds_dns_name; + struct tevent_req *subreq; + + r = talloc(s, struct drsuapi_DsReplicaUpdateRefs); + if (composite_nomem(r, c)) return; + + ntds_guid_str = GUID_string(r, &s->dest_dsa.ntds_guid); + if (composite_nomem(ntds_guid_str, c)) return; + + ntds_dns_name = talloc_asprintf(r, "%s._msdcs.%s", + ntds_guid_str, + s->forest.dns_name); + if (composite_nomem(ntds_dns_name, c)) return; + + r->in.bind_handle = &drsuapi->bind_handle; + r->in.level = 1; + r->in.req.req1.naming_context = &partition->nc; + r->in.req.req1.dest_dsa_dns_name= ntds_dns_name; + r->in.req.req1.dest_dsa_guid = s->dest_dsa.ntds_guid; + r->in.req.req1.options = DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_DEL_REF; + + /* I think this is how we mark ourselves as a RODC */ + if (!lpcfg_parm_bool(s->libnet->lp_ctx, NULL, "repl", "RODC", false)) { + r->in.req.req1.options |= DRSUAPI_DRS_WRIT_REP; + } + + s->ndr_struct_ptr = r; + subreq = dcerpc_drsuapi_DsReplicaUpdateRefs_r_send(s, c->event_ctx, + drsuapi->drsuapi_handle, + r); + if (composite_nomem(subreq, c)) return; + tevent_req_set_callback(subreq, recv_fn, s); +} + +static void becomeDC_drsuapi2_update_refs_config_recv(struct tevent_req *subreq); + +static void becomeDC_drsuapi2_update_refs_schema_recv(struct tevent_req *subreq) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type_abort(s->ndr_struct_ptr, + struct drsuapi_DsReplicaUpdateRefs); + + s->ndr_struct_ptr = NULL; + + c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq, r); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!W_ERROR_IS_OK(r->out.result)) { + composite_error(c, werror_to_ntstatus(r->out.result)); + return; + } + + talloc_free(r); + + becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->config_part, + becomeDC_drsuapi2_update_refs_config_recv); +} + +static void becomeDC_drsuapi2_update_refs_domain_recv(struct tevent_req *subreq); + +static void becomeDC_drsuapi2_update_refs_config_recv(struct tevent_req *subreq) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(s->ndr_struct_ptr, + struct drsuapi_DsReplicaUpdateRefs); + + s->ndr_struct_ptr = NULL; + + c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq, r); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!W_ERROR_IS_OK(r->out.result)) { + composite_error(c, werror_to_ntstatus(r->out.result)); + return; + } + + talloc_free(r); + + becomeDC_drsuapi_update_refs_send(s, &s->drsuapi2, &s->domain_part, + becomeDC_drsuapi2_update_refs_domain_recv); +} + +static void becomeDC_drsuapi2_update_refs_domain_recv(struct tevent_req *subreq) +{ + struct libnet_BecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_BecomeDC_state); + struct composite_context *c = s->creq; + struct drsuapi_DsReplicaUpdateRefs *r = talloc_get_type(s->ndr_struct_ptr, + struct drsuapi_DsReplicaUpdateRefs); + + s->ndr_struct_ptr = NULL; + + c->status = dcerpc_drsuapi_DsReplicaUpdateRefs_r_recv(subreq, r); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!W_ERROR_IS_OK(r->out.result)) { + composite_error(c, werror_to_ntstatus(r->out.result)); + return; + } + + talloc_free(r); + + /* TODO: use DDNS updates and register dns names */ + composite_done(c); +} + +static NTSTATUS becomeDC_ldap2_modify_computer(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_message *msg; + unsigned int i; + uint32_t user_account_control = UF_SERVER_TRUST_ACCOUNT | + UF_TRUSTED_FOR_DELEGATION; + + /* as the value is already as we want it to be, we're done */ + if (s->dest_dsa.user_account_control == user_account_control) { + return NT_STATUS_OK; + } + + /* make a 'modify' msg, and only for serverReference */ + msg = ldb_msg_new(s); + NT_STATUS_HAVE_NO_MEMORY(msg); + msg->dn = ldb_dn_new(msg, s->ldap2.ldb, s->dest_dsa.computer_dn_str); + NT_STATUS_HAVE_NO_MEMORY(msg->dn); + + ret = samdb_msg_add_uint(s->ldap2.ldb, msg, msg, "userAccountControl", + user_account_control); + if (ret != LDB_SUCCESS) { + talloc_free(msg); + return NT_STATUS_NO_MEMORY; + } + + /* mark all the message elements (should be just one) + as LDB_FLAG_MOD_REPLACE */ + for (i=0;i<msg->num_elements;i++) { + msg->elements[i].flags = LDB_FLAG_MOD_REPLACE; + } + + ret = ldb_modify(s->ldap2.ldb, msg); + talloc_free(msg); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } + + s->dest_dsa.user_account_control = user_account_control; + + return NT_STATUS_OK; +} + +static NTSTATUS becomeDC_ldap2_move_computer(struct libnet_BecomeDC_state *s) +{ + int ret; + struct ldb_dn *old_dn; + struct ldb_dn *new_dn; + + ret = dsdb_wellknown_dn(s->ldap2.ldb, s, + ldb_get_default_basedn(s->ldap2.ldb), + DS_GUID_DOMAIN_CONTROLLERS_CONTAINER, + &new_dn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } + + if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) { + talloc_free(new_dn); + return NT_STATUS_NO_MEMORY; + } + + old_dn = ldb_dn_new(new_dn, s->ldap2.ldb, s->dest_dsa.computer_dn_str); + NT_STATUS_HAVE_NO_MEMORY(old_dn); + + if (ldb_dn_compare(old_dn, new_dn) == 0) { + /* we don't need to rename if the old and new dn match */ + talloc_free(new_dn); + return NT_STATUS_OK; + } + + ret = ldb_rename(s->ldap2.ldb, old_dn, new_dn); + if (ret != LDB_SUCCESS) { + talloc_free(new_dn); + return NT_STATUS_LDAP(ret); + } + + s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn); + NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str); + + talloc_free(new_dn); + + return NT_STATUS_OK; +} + +static void becomeDC_connect_ldap2(struct libnet_BecomeDC_state *s) +{ + struct composite_context *c = s->creq; + + c->status = becomeDC_ldap_connect(s, &s->ldap2); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap2_modify_computer(s); + if (!composite_is_ok(c)) return; + + c->status = becomeDC_ldap2_move_computer(s); + if (!composite_is_ok(c)) return; + + s->critical_only = true; + becomeDC_drsuapi3_pull_domain_send(s); +} + +struct composite_context *libnet_BecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r) +{ + struct composite_context *c; + struct libnet_BecomeDC_state *s; + char *tmp_name; + + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct libnet_BecomeDC_state); + if (composite_nomem(s, c)) return c; + c->private_data = s; + s->creq = c; + s->libnet = ctx; + + /* Domain input */ + s->domain.dns_name = talloc_strdup(s, r->in.domain_dns_name); + if (composite_nomem(s->domain.dns_name, c)) return c; + s->domain.netbios_name = talloc_strdup(s, r->in.domain_netbios_name); + if (composite_nomem(s->domain.netbios_name, c)) return c; + s->domain.sid = dom_sid_dup(s, r->in.domain_sid); + if (composite_nomem(s->domain.sid, c)) return c; + + /* Source DSA input */ + s->source_dsa.address = talloc_strdup(s, r->in.source_dsa_address); + if (composite_nomem(s->source_dsa.address, c)) return c; + + /* Destination DSA input */ + s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name); + if (composite_nomem(s->dest_dsa.netbios_name, c)) return c; + + /* Destination DSA dns_name construction */ + tmp_name = strlower_talloc(s, s->dest_dsa.netbios_name); + if (composite_nomem(tmp_name, c)) return c; + tmp_name = talloc_asprintf_append_buffer(tmp_name, ".%s",s->domain.dns_name); + if (composite_nomem(tmp_name, c)) return c; + s->dest_dsa.dns_name = tmp_name; + + /* Callback function pointers */ + s->callbacks = r->in.callbacks; + + /* RODC join*/ + s->rodc_join = r->in.rodc_join; + + becomeDC_send_cldap(s); + return c; +} + +NTSTATUS libnet_BecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r) +{ + NTSTATUS status; + + status = composite_wait(c); + + ZERO_STRUCT(r->out); + + talloc_free(c); + return status; +} + +NTSTATUS libnet_BecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_BecomeDC *r) +{ + NTSTATUS status; + struct composite_context *c; + c = libnet_BecomeDC_send(ctx, mem_ctx, r); + status = libnet_BecomeDC_recv(c, mem_ctx, r); + return status; +} diff --git a/source4/libnet/libnet_become_dc.h b/source4/libnet/libnet_become_dc.h new file mode 100644 index 0000000..f050c22 --- /dev/null +++ b/source4/libnet/libnet_become_dc.h @@ -0,0 +1,152 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher <metze@samba.org> 2006 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _LIBNET_BECOME_DC_H +#define _LIBNET_BECOME_DC_H + +#include "librpc/gen_ndr/drsuapi.h" + +struct libnet_BecomeDC_Domain { + /* input */ + const char *dns_name; + const char *netbios_name; + const struct dom_sid *sid; + + /* constructed */ + struct GUID guid; + const char *dn_str; + uint32_t behavior_version; + uint32_t w2k3_update_revision; +}; + +struct libnet_BecomeDC_Forest { + /* constructed */ + const char *dns_name; + const char *root_dn_str; + const char *config_dn_str; + uint32_t crossref_behavior_version; + const char *schema_dn_str; + uint32_t schema_object_version; +}; + +struct libnet_BecomeDC_SourceDSA { + /* input */ + const char *address; + + /* constructed */ + const char *dns_name; + const char *netbios_name; + const char *site_name; + const char *server_dn_str; + const char *ntds_dn_str; +}; + +struct libnet_BecomeDC_CheckOptions { + const struct libnet_BecomeDC_Domain *domain; + const struct libnet_BecomeDC_Forest *forest; + const struct libnet_BecomeDC_SourceDSA *source_dsa; +}; + +struct libnet_BecomeDC_DestDSA { + /* input */ + const char *netbios_name; + + /* constructed */ + const char *dns_name; + const char *site_name; + struct GUID site_guid; + const char *computer_dn_str; + const char *server_dn_str; + const char *ntds_dn_str; + struct GUID ntds_guid; + struct GUID invocation_id; + uint32_t user_account_control; +}; + +struct libnet_BecomeDC_PrepareDB { + const struct libnet_BecomeDC_Domain *domain; + const struct libnet_BecomeDC_Forest *forest; + const struct libnet_BecomeDC_SourceDSA *source_dsa; + const struct libnet_BecomeDC_DestDSA *dest_dsa; +}; + +struct libnet_BecomeDC_StoreChunk; + +struct libnet_BecomeDC_Partition { + struct drsuapi_DsReplicaObjectIdentifier nc; + struct GUID destination_dsa_guid; + struct GUID source_dsa_guid; + struct GUID source_dsa_invocation_id; + struct drsuapi_DsReplicaHighWaterMark highwatermark; + bool more_data; + uint32_t replica_flags; + + WERROR (*store_chunk)(void *private_data, + const struct libnet_BecomeDC_StoreChunk *info); +}; + +struct libnet_BecomeDC_StoreChunk { + const struct libnet_BecomeDC_Domain *domain; + const struct libnet_BecomeDC_Forest *forest; + const struct libnet_BecomeDC_SourceDSA *source_dsa; + const struct libnet_BecomeDC_DestDSA *dest_dsa; + const struct libnet_BecomeDC_Partition *partition; + uint32_t req_level; + const struct drsuapi_DsGetNCChangesRequest5 *req5; + const struct drsuapi_DsGetNCChangesRequest8 *req8; + const struct drsuapi_DsGetNCChangesRequest10 *req10; + uint32_t ctr_level; + const struct drsuapi_DsGetNCChangesCtr1 *ctr1; + const struct drsuapi_DsGetNCChangesCtr6 *ctr6; + const DATA_BLOB *gensec_skey; +}; + +struct libnet_BecomeDC_Callbacks { + void *private_data; + NTSTATUS (*check_options)(void *private_data, + const struct libnet_BecomeDC_CheckOptions *info); + NTSTATUS (*prepare_db)(void *private_data, + const struct libnet_BecomeDC_PrepareDB *info); + WERROR (*schema_chunk)(void *private_data, + const struct libnet_BecomeDC_StoreChunk *info); + WERROR (*config_chunk)(void *private_data, + const struct libnet_BecomeDC_StoreChunk *info); + WERROR (*domain_chunk)(void *private_data, + const struct libnet_BecomeDC_StoreChunk *info); +}; + +struct libnet_BecomeDC { + struct { + const char *domain_dns_name; + const char *domain_netbios_name; + const struct dom_sid *domain_sid; + const char *source_dsa_address; + const char *dest_dsa_netbios_name; + + struct libnet_BecomeDC_Callbacks callbacks; + + bool rodc_join; + } in; + + struct { + const char *error_string; + } out; +}; + +#endif /* _LIBNET_BECOME_DC_H */ diff --git a/source4/libnet/libnet_domain.c b/source4/libnet/libnet_domain.c new file mode 100644 index 0000000..81cd0dc --- /dev/null +++ b/source4/libnet/libnet_domain.c @@ -0,0 +1,1304 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/* + a composite function for domain handling on samr and lsa pipes +*/ + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "libnet/libnet.h" +#include "librpc/gen_ndr/ndr_samr_c.h" +#include "librpc/gen_ndr/ndr_lsa_c.h" + + +struct domain_open_samr_state { + struct libnet_context *ctx; + struct dcerpc_pipe *pipe; + struct libnet_RpcConnect rpcconn; + struct samr_Connect connect; + struct samr_LookupDomain lookup; + struct samr_OpenDomain open; + struct samr_Close close; + struct lsa_String domain_name; + uint32_t access_mask; + struct policy_handle connect_handle; + struct policy_handle domain_handle; + struct dom_sid2 *domain_sid; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_domain_open_close(struct tevent_req *subreq); +static void continue_domain_open_connect(struct tevent_req *subreq); +static void continue_domain_open_lookup(struct tevent_req *subreq); +static void continue_domain_open_open(struct tevent_req *subreq); + + +/** + * Stage 0.5 (optional): Connect to samr rpc pipe + */ +static void continue_domain_open_rpc_connect(struct composite_context *ctx) +{ + struct composite_context *c; + struct domain_open_samr_state *s; + struct tevent_req *subreq; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_open_samr_state); + + c->status = libnet_RpcConnect_recv(ctx, s->ctx, c, &s->rpcconn); + if (!composite_is_ok(c)) return; + + s->pipe = s->rpcconn.out.dcerpc_pipe; + + /* preparing parameters for samr_Connect rpc call */ + s->connect.in.system_name = 0; + s->connect.in.access_mask = s->access_mask; + s->connect.out.connect_handle = &s->connect_handle; + + /* send request */ + subreq = dcerpc_samr_Connect_r_send(s, c->event_ctx, + s->pipe->binding_handle, + &s->connect); + if (composite_nomem(subreq, c)) return; + + /* callback handler */ + tevent_req_set_callback(subreq, continue_domain_open_connect, c); +} + + +/** + * Stage 0.5 (optional): Close existing (in libnet context) domain + * handle + */ +static void continue_domain_open_close(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_open_samr_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_open_samr_state); + + /* receive samr_Close reply */ + c->status = dcerpc_samr_Close_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_SamrClose; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + /* reset domain handle and associated data in libnet_context */ + s->ctx->samr.name = NULL; + s->ctx->samr.access_mask = 0; + ZERO_STRUCT(s->ctx->samr.handle); + + /* preparing parameters for samr_Connect rpc call */ + s->connect.in.system_name = 0; + s->connect.in.access_mask = s->access_mask; + s->connect.out.connect_handle = &s->connect_handle; + + /* send request */ + subreq = dcerpc_samr_Connect_r_send(s, c->event_ctx, + s->pipe->binding_handle, + &s->connect); + if (composite_nomem(subreq, c)) return; + + /* callback handler */ + tevent_req_set_callback(subreq, continue_domain_open_connect, c); +} + + +/** + * Stage 1: Connect to SAM server. + */ +static void continue_domain_open_connect(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_open_samr_state *s; + struct samr_LookupDomain *r; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_open_samr_state); + + /* receive samr_Connect reply */ + c->status = dcerpc_samr_Connect_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_SamrConnect; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + r = &s->lookup; + + /* prepare for samr_LookupDomain call */ + r->in.connect_handle = &s->connect_handle; + r->in.domain_name = &s->domain_name; + r->out.sid = talloc(s, struct dom_sid2 *); + if (composite_nomem(r->out.sid, c)) return; + + subreq = dcerpc_samr_LookupDomain_r_send(s, c->event_ctx, + s->pipe->binding_handle, + r); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_domain_open_lookup, c); +} + + +/** + * Stage 2: Lookup domain by name. + */ +static void continue_domain_open_lookup(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_open_samr_state *s; + struct samr_OpenDomain *r; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_open_samr_state); + + /* receive samr_LookupDomain reply */ + c->status = dcerpc_samr_LookupDomain_r_recv(subreq, s); + TALLOC_FREE(subreq); + + if (s->monitor_fn) { + struct monitor_msg msg; + struct msg_rpc_lookup_domain data; + + data.domain_name = s->domain_name.string; + + msg.type = mon_SamrLookupDomain; + msg.data = (void*)&data; + msg.data_size = sizeof(data); + s->monitor_fn(&msg); + } + + r = &s->open; + + /* check the rpc layer status */ + if (!composite_is_ok(c)) return; + + /* check the rpc call itself status */ + if (!NT_STATUS_IS_OK(s->lookup.out.result)) { + composite_error(c, s->lookup.out.result); + return; + } + + /* prepare for samr_OpenDomain call */ + r->in.connect_handle = &s->connect_handle; + r->in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + r->in.sid = *s->lookup.out.sid; + r->out.domain_handle = &s->domain_handle; + + subreq = dcerpc_samr_OpenDomain_r_send(s, c->event_ctx, + s->pipe->binding_handle, + r); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_domain_open_open, c); +} + + +/* + * Stage 3: Open domain. + */ +static void continue_domain_open_open(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_open_samr_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_open_samr_state); + + /* receive samr_OpenDomain reply */ + c->status = dcerpc_samr_OpenDomain_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_SamrOpenDomain; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +/** + * Sends asynchronous DomainOpenSamr request + * + * @param ctx initialised libnet context + * @param io arguments and results of the call + * @param monitor pointer to monitor function that is passed monitor message + */ + +struct composite_context *libnet_DomainOpenSamr_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_DomainOpen *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct domain_open_samr_state *s; + struct composite_context *rpcconn_req; + struct tevent_req *subreq; + + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct domain_open_samr_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + s->monitor_fn = monitor; + + s->ctx = ctx; + s->pipe = ctx->samr.pipe; + s->access_mask = io->in.access_mask; + s->domain_name.string = talloc_strdup(c, io->in.domain_name); + + /* check, if there's samr pipe opened already, before opening a domain */ + if (ctx->samr.pipe == NULL) { + + /* attempting to connect a domain controller */ + s->rpcconn.level = LIBNET_RPC_CONNECT_DC; + s->rpcconn.in.name = io->in.domain_name; + s->rpcconn.in.dcerpc_iface = &ndr_table_samr; + + /* send rpc pipe connect request */ + rpcconn_req = libnet_RpcConnect_send(ctx, c, &s->rpcconn, s->monitor_fn); + if (composite_nomem(rpcconn_req, c)) return c; + + composite_continue(c, rpcconn_req, continue_domain_open_rpc_connect, c); + return c; + } + + /* libnet context's domain handle is not empty, so check out what + was opened first, before doing anything */ + if (!ndr_policy_handle_empty(&ctx->samr.handle)) { + if (strequal(ctx->samr.name, io->in.domain_name) && + ctx->samr.access_mask == io->in.access_mask) { + + /* this domain is already opened */ + composite_done(c); + return c; + + } else { + /* another domain or access rights have been + requested - close the existing handle first */ + s->close.in.handle = &ctx->samr.handle; + + /* send request to close domain handle */ + subreq = dcerpc_samr_Close_r_send(s, c->event_ctx, + s->pipe->binding_handle, + &s->close); + if (composite_nomem(subreq, c)) return c; + + /* callback handler */ + tevent_req_set_callback(subreq, continue_domain_open_close, c); + return c; + } + } + + /* preparing parameters for samr_Connect rpc call */ + s->connect.in.system_name = 0; + s->connect.in.access_mask = s->access_mask; + s->connect.out.connect_handle = &s->connect_handle; + + /* send request */ + subreq = dcerpc_samr_Connect_r_send(s, c->event_ctx, + s->pipe->binding_handle, + &s->connect); + if (composite_nomem(subreq, c)) return c; + + /* callback handler */ + tevent_req_set_callback(subreq, continue_domain_open_connect, c); + return c; +} + + +/** + * Waits for and receives result of asynchronous DomainOpenSamr call + * + * @param c composite context returned by asynchronous DomainOpen call + * @param ctx initialised libnet context + * @param mem_ctx memory context of the call + * @param io pointer to results (and arguments) of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_DomainOpenSamr_recv(struct composite_context *c, struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_DomainOpen *io) +{ + NTSTATUS status; + struct domain_open_samr_state *s; + + /* wait for results of sending request */ + status = composite_wait(c); + + if (NT_STATUS_IS_OK(status) && io) { + s = talloc_get_type_abort(c->private_data, struct domain_open_samr_state); + io->out.domain_handle = s->domain_handle; + + /* store the resulting handle and related data for use by other + libnet functions */ + ctx->samr.connect_handle = s->connect_handle; + ctx->samr.handle = s->domain_handle; + ctx->samr.sid = talloc_steal(ctx, *s->lookup.out.sid); + ctx->samr.name = talloc_steal(ctx, s->domain_name.string); + ctx->samr.access_mask = s->access_mask; + } + + talloc_free(c); + return status; +} + + +struct domain_open_lsa_state { + const char *name; + uint32_t access_mask; + struct libnet_context *ctx; + struct libnet_RpcConnect rpcconn; + struct lsa_OpenPolicy2 openpol; + struct policy_handle handle; + struct dcerpc_pipe *pipe; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_rpc_connect_lsa(struct composite_context *ctx); +static void continue_lsa_policy_open(struct tevent_req *subreq); + + +/** + * Sends asynchronous DomainOpenLsa request + * + * @param ctx initialised libnet context + * @param io arguments and results of the call + * @param monitor pointer to monitor function that is passed monitor message + */ + +struct composite_context* libnet_DomainOpenLsa_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_DomainOpen *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct domain_open_lsa_state *s; + struct composite_context *rpcconn_req; + struct tevent_req *subreq; + struct lsa_QosInfo *qos; + + /* create composite context and state */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return c; + + s = talloc_zero(c, struct domain_open_lsa_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* store arguments in the state structure */ + s->name = talloc_strdup(c, io->in.domain_name); + s->access_mask = io->in.access_mask; + s->ctx = ctx; + + /* check, if there's lsa pipe opened already, before opening a handle */ + if (ctx->lsa.pipe == NULL) { + + ZERO_STRUCT(s->rpcconn); + + /* attempting to connect a domain controller */ + s->rpcconn.level = LIBNET_RPC_CONNECT_DC; + s->rpcconn.in.name = talloc_strdup(c, io->in.domain_name); + s->rpcconn.in.dcerpc_iface = &ndr_table_lsarpc; + + /* send rpc pipe connect request */ + rpcconn_req = libnet_RpcConnect_send(ctx, c, &s->rpcconn, s->monitor_fn); + if (composite_nomem(rpcconn_req, c)) return c; + + composite_continue(c, rpcconn_req, continue_rpc_connect_lsa, c); + return c; + } + + s->pipe = ctx->lsa.pipe; + + /* preparing parameters for lsa_OpenPolicy2 rpc call */ + s->openpol.in.system_name = s->name; + s->openpol.in.access_mask = s->access_mask; + s->openpol.in.attr = talloc_zero(c, struct lsa_ObjectAttribute); + + qos = talloc_zero(c, struct lsa_QosInfo); + qos->len = 0; + qos->impersonation_level = 2; + qos->context_mode = 1; + qos->effective_only = 0; + + s->openpol.in.attr->sec_qos = qos; + s->openpol.out.handle = &s->handle; + + /* send rpc request */ + subreq = dcerpc_lsa_OpenPolicy2_r_send(s, c->event_ctx, + s->pipe->binding_handle, + &s->openpol); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_lsa_policy_open, c); + return c; +} + + +/* + Stage 0.5 (optional): Rpc pipe connected, send lsa open policy request + */ +static void continue_rpc_connect_lsa(struct composite_context *ctx) +{ + struct composite_context *c; + struct domain_open_lsa_state *s; + struct lsa_QosInfo *qos; + struct tevent_req *subreq; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_open_lsa_state); + + /* receive rpc connection */ + c->status = libnet_RpcConnect_recv(ctx, s->ctx, c, &s->rpcconn); + if (!composite_is_ok(c)) return; + + /* RpcConnect function leaves the pipe in libnet context, + so get it from there */ + s->pipe = s->ctx->lsa.pipe; + + /* prepare lsa_OpenPolicy2 call */ + s->openpol.in.system_name = s->name; + s->openpol.in.access_mask = s->access_mask; + s->openpol.in.attr = talloc_zero(c, struct lsa_ObjectAttribute); + + qos = talloc_zero(c, struct lsa_QosInfo); + qos->len = 0; + qos->impersonation_level = 2; + qos->context_mode = 1; + qos->effective_only = 0; + + s->openpol.in.attr->sec_qos = qos; + s->openpol.out.handle = &s->handle; + + /* send rpc request */ + subreq = dcerpc_lsa_OpenPolicy2_r_send(s, c->event_ctx, + s->pipe->binding_handle, + &s->openpol); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_lsa_policy_open, c); +} + + +/* + Stage 1: Lsa policy opened - we're done, if successfully + */ +static void continue_lsa_policy_open(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_open_lsa_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_open_lsa_state); + + c->status = dcerpc_lsa_OpenPolicy2_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_LsaOpenPolicy; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +/** + * Receives result of asynchronous DomainOpenLsa call + * + * @param c composite context returned by asynchronous DomainOpenLsa call + * @param ctx initialised libnet context + * @param mem_ctx memory context of the call + * @param io pointer to results (and arguments) of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_DomainOpenLsa_recv(struct composite_context *c, struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_DomainOpen *io) +{ + NTSTATUS status; + struct domain_open_lsa_state *s; + + status = composite_wait(c); + + if (NT_STATUS_IS_OK(status) && io) { + /* everything went fine - get the results and + return the error string */ + s = talloc_get_type_abort(c->private_data, struct domain_open_lsa_state); + io->out.domain_handle = s->handle; + + ctx->lsa.handle = s->handle; + ctx->lsa.name = talloc_steal(ctx, s->name); + ctx->lsa.access_mask = s->access_mask; + + io->out.error_string = talloc_strdup(mem_ctx, "Success"); + + } else if (!NT_STATUS_IS_OK(status)) { + /* there was an error, so provide nt status code description */ + io->out.error_string = talloc_asprintf(mem_ctx, + "Failed to open domain: %s", + nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +/** + * Sends a request to open a domain in desired service + * + * @param ctx initialised libnet context + * @param io arguments and results of the call + * @param monitor pointer to monitor function that is passed monitor message + */ + +struct composite_context* libnet_DomainOpen_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_DomainOpen *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + + switch (io->in.type) { + case DOMAIN_LSA: + /* request to open a policy handle on \pipe\lsarpc */ + c = libnet_DomainOpenLsa_send(ctx, mem_ctx, io, monitor); + break; + + case DOMAIN_SAMR: + default: + /* request to open a domain policy handle on \pipe\samr */ + c = libnet_DomainOpenSamr_send(ctx, mem_ctx, io, monitor); + break; + } + + return c; +} + + +/** + * Receive result of domain open request + * + * @param c composite context returned by DomainOpen_send function + * @param ctx initialised libnet context + * @param mem_ctx memory context of the call + * @param io results and arguments of the call + */ + +NTSTATUS libnet_DomainOpen_recv(struct composite_context *c, struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_DomainOpen *io) +{ + NTSTATUS status; + + switch (io->in.type) { + case DOMAIN_LSA: + status = libnet_DomainOpenLsa_recv(c, ctx, mem_ctx, io); + break; + + case DOMAIN_SAMR: + default: + status = libnet_DomainOpenSamr_recv(c, ctx, mem_ctx, io); + break; + } + + return status; +} + + +/** + * Synchronous version of DomainOpen call + * + * @param ctx initialised libnet context + * @param mem_ctx memory context for the call + * @param io arguments and results of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_DomainOpen(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_DomainOpen *io) +{ + struct composite_context *c = libnet_DomainOpen_send(ctx, mem_ctx, io, NULL); + return libnet_DomainOpen_recv(c, ctx, mem_ctx, io); +} + + +struct domain_close_lsa_state { + struct dcerpc_pipe *pipe; + struct lsa_Close close; + struct policy_handle handle; + + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_lsa_close(struct tevent_req *subreq); + + +struct composite_context* libnet_DomainCloseLsa_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_DomainClose *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct domain_close_lsa_state *s; + struct tevent_req *subreq; + + /* composite context and state structure allocation */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return c; + + s = talloc_zero(c, struct domain_close_lsa_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + s->monitor_fn = monitor; + + /* TODO: check if lsa pipe pointer is non-null */ + + if (!strequal(ctx->lsa.name, io->in.domain_name)) { + composite_error(c, NT_STATUS_INVALID_PARAMETER); + return c; + } + + /* get opened lsarpc pipe pointer */ + s->pipe = ctx->lsa.pipe; + + /* prepare close handle call arguments */ + s->close.in.handle = &ctx->lsa.handle; + s->close.out.handle = &s->handle; + + /* send the request */ + subreq = dcerpc_lsa_Close_r_send(s, c->event_ctx, + s->pipe->binding_handle, + &s->close); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_lsa_close, c); + return c; +} + + +/* + Stage 1: Receive result of lsa close call +*/ +static void continue_lsa_close(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_close_lsa_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_close_lsa_state); + + c->status = dcerpc_lsa_Close_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_LsaClose; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +NTSTATUS libnet_DomainCloseLsa_recv(struct composite_context *c, struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_DomainClose *io) +{ + NTSTATUS status; + + status = composite_wait(c); + + if (NT_STATUS_IS_OK(status) && io) { + /* policy handle closed successfully */ + + ctx->lsa.name = NULL; + ZERO_STRUCT(ctx->lsa.handle); + + io->out.error_string = talloc_asprintf(mem_ctx, "Success"); + + } else if (!NT_STATUS_IS_OK(status)) { + /* there was an error, so return description of the status code */ + io->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +struct domain_close_samr_state { + struct samr_Close close; + struct policy_handle handle; + + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_samr_close(struct tevent_req *subreq); + + +struct composite_context* libnet_DomainCloseSamr_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_DomainClose *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct domain_close_samr_state *s; + struct tevent_req *subreq; + + /* composite context and state structure allocation */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return c; + + s = talloc_zero(c, struct domain_close_samr_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + s->monitor_fn = monitor; + + /* TODO: check if samr pipe pointer is non-null */ + + if (!strequal(ctx->samr.name, io->in.domain_name)) { + composite_error(c, NT_STATUS_INVALID_PARAMETER); + return c; + } + + /* prepare close domain handle call arguments */ + ZERO_STRUCT(s->close); + s->close.in.handle = &ctx->samr.handle; + s->close.out.handle = &s->handle; + + /* send the request */ + subreq = dcerpc_samr_Close_r_send(s, c->event_ctx, + ctx->samr.pipe->binding_handle, + &s->close); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_samr_close, c); + return c; +} + + +/* + Stage 1: Receive result of samr close call +*/ +static void continue_samr_close(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_close_samr_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_close_samr_state); + + c->status = dcerpc_samr_Close_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_SamrClose; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +NTSTATUS libnet_DomainCloseSamr_recv(struct composite_context *c, struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_DomainClose *io) +{ + NTSTATUS status; + + status = composite_wait(c); + + if (NT_STATUS_IS_OK(status) && io) { + /* domain policy handle closed successfully */ + + ZERO_STRUCT(ctx->samr.handle); + talloc_free(discard_const_p(char, ctx->samr.name)); + talloc_free(ctx->samr.sid); + ctx->samr.name = NULL; + ctx->samr.sid = NULL; + + io->out.error_string = talloc_asprintf(mem_ctx, "Success"); + + } else if (!NT_STATUS_IS_OK(status)) { + /* there was an error, so return description of the status code */ + io->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +struct composite_context* libnet_DomainClose_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_DomainClose *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + + switch (io->in.type) { + case DOMAIN_LSA: + /* request to close policy handle on \pipe\lsarpc */ + c = libnet_DomainCloseLsa_send(ctx, mem_ctx, io, monitor); + break; + + case DOMAIN_SAMR: + default: + /* request to close domain policy handle on \pipe\samr */ + c = libnet_DomainCloseSamr_send(ctx, mem_ctx, io, monitor); + break; + } + + return c; +} + + +NTSTATUS libnet_DomainClose_recv(struct composite_context *c, struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_DomainClose *io) +{ + NTSTATUS status; + + switch (io->in.type) { + case DOMAIN_LSA: + /* receive result of closing lsa policy handle */ + status = libnet_DomainCloseLsa_recv(c, ctx, mem_ctx, io); + break; + + case DOMAIN_SAMR: + default: + /* receive result of closing samr domain policy handle */ + status = libnet_DomainCloseSamr_recv(c, ctx, mem_ctx, io); + break; + } + + return status; +} + + +NTSTATUS libnet_DomainClose(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_DomainClose *io) +{ + struct composite_context *c; + + c = libnet_DomainClose_send(ctx, mem_ctx, io, NULL); + return libnet_DomainClose_recv(c, ctx, mem_ctx, io); +} + + +struct domain_list_state { + struct libnet_context *ctx; + struct libnet_RpcConnect rpcconn; + struct samr_Connect samrconn; + struct samr_EnumDomains enumdom; + struct samr_Close samrclose; + const char *hostname; + struct policy_handle connect_handle; + int buf_size; + struct domainlist *domains; + uint32_t resume_handle; + uint32_t count; + + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_rpc_connect(struct composite_context *c); +static void continue_samr_connect(struct tevent_req *subreq); +static void continue_samr_enum_domains(struct tevent_req *subreq); +static void continue_samr_close_handle(struct tevent_req *subreq); + +static struct domainlist* get_domain_list(TALLOC_CTX *mem_ctx, struct domain_list_state *s); + + +/* + Stage 1: Receive connected rpc pipe and send connection + request to SAMR service +*/ +static void continue_rpc_connect(struct composite_context *ctx) +{ + struct composite_context *c; + struct domain_list_state *s; + struct tevent_req *subreq; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_list_state); + + c->status = libnet_RpcConnect_recv(ctx, s->ctx, c, &s->rpcconn); + if (!composite_is_ok(c)) return; + + s->samrconn.in.system_name = 0; + s->samrconn.in.access_mask = SEC_GENERIC_READ; /* should be enough */ + s->samrconn.out.connect_handle = &s->connect_handle; + + subreq = dcerpc_samr_Connect_r_send(s, c->event_ctx, + s->ctx->samr.pipe->binding_handle, + &s->samrconn); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_samr_connect, c); +} + + +/* + Stage 2: Receive policy handle to the connected SAMR service and issue + a request to enumerate domain databases available +*/ +static void continue_samr_connect(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_list_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_list_state); + + c->status = dcerpc_samr_Connect_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_SamrConnect; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + s->enumdom.in.connect_handle = &s->connect_handle; + s->enumdom.in.resume_handle = &s->resume_handle; + s->enumdom.in.buf_size = s->buf_size; + s->enumdom.out.resume_handle = &s->resume_handle; + s->enumdom.out.num_entries = talloc(s, uint32_t); + if (composite_nomem(s->enumdom.out.num_entries, c)) return; + s->enumdom.out.sam = talloc(s, struct samr_SamArray *); + if (composite_nomem(s->enumdom.out.sam, c)) return; + + subreq = dcerpc_samr_EnumDomains_r_send(s, c->event_ctx, + s->ctx->samr.pipe->binding_handle, + &s->enumdom); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_samr_enum_domains, c); +} + + +/* + Stage 3: Receive domain names available and repeat the request + enumeration is not complete yet. Close samr connection handle + upon completion. +*/ +static void continue_samr_enum_domains(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_list_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_list_state); + + c->status = dcerpc_samr_EnumDomains_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_SamrEnumDomains; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + if (NT_STATUS_IS_OK(s->enumdom.out.result)) { + + s->domains = get_domain_list(c, s); + + } else if (NT_STATUS_EQUAL(s->enumdom.out.result, STATUS_MORE_ENTRIES)) { + + s->domains = get_domain_list(c, s); + + /* prepare next round of enumeration */ + s->enumdom.in.connect_handle = &s->connect_handle; + s->enumdom.in.resume_handle = &s->resume_handle; + s->enumdom.in.buf_size = s->ctx->samr.buf_size; + s->enumdom.out.resume_handle = &s->resume_handle; + + /* send the request */ + subreq = dcerpc_samr_EnumDomains_r_send(s, c->event_ctx, + s->ctx->samr.pipe->binding_handle, + &s->enumdom); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_samr_enum_domains, c); + + } else { + composite_error(c, s->enumdom.out.result); + return; + } + + /* close samr connection handle */ + s->samrclose.in.handle = &s->connect_handle; + s->samrclose.out.handle = &s->connect_handle; + + /* send the request */ + subreq = dcerpc_samr_Close_r_send(s, c->event_ctx, + s->ctx->samr.pipe->binding_handle, + &s->samrclose); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_samr_close_handle, c); +} + + +/* + Stage 4: Receive result of closing samr connection handle. +*/ +static void continue_samr_close_handle(struct tevent_req *subreq) +{ + struct composite_context *c; + struct domain_list_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct domain_list_state); + + c->status = dcerpc_samr_Close_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_SamrClose; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + /* did everything go fine ? */ + if (!NT_STATUS_IS_OK(s->samrclose.out.result)) { + composite_error(c, s->samrclose.out.result); + return; + } + + composite_done(c); +} + + +/* + Utility function to copy domain names from result of samr_EnumDomains call +*/ +static struct domainlist* get_domain_list(TALLOC_CTX *mem_ctx, struct domain_list_state *s) +{ + uint32_t i; + if (mem_ctx == NULL || s == NULL) return NULL; + + /* prepare domains array */ + if (s->domains == NULL) { + s->domains = talloc_array(mem_ctx, struct domainlist, + *s->enumdom.out.num_entries); + } else { + s->domains = talloc_realloc(mem_ctx, s->domains, struct domainlist, + s->count + *s->enumdom.out.num_entries); + } + + /* copy domain names returned from samr_EnumDomains call */ + for (i = s->count; i < s->count + *s->enumdom.out.num_entries; i++) + { + struct lsa_String *domain_name = &(*s->enumdom.out.sam)->entries[i - s->count].name; + + /* strdup name as a child of allocated array to make it follow the array + in case of talloc_steal or talloc_free */ + s->domains[i].name = talloc_strdup(s->domains, domain_name->string); + s->domains[i].sid = NULL; /* this is to be filled out later */ + } + + /* number of entries returned (domains enumerated) */ + s->count += *s->enumdom.out.num_entries; + + return s->domains; +} + + +/** + * Sends a request to list domains on given host + * + * @param ctx initialised libnet context + * @param mem_ctx memory context + * @param io arguments and results of the call + * @param monitor pointer to monitor function that is passed monitor messages + */ + +struct composite_context* libnet_DomainList_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_DomainList *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct domain_list_state *s; + struct composite_context *rpcconn_req; + struct tevent_req *subreq; + + /* composite context and state structure allocation */ + c = composite_create(ctx, ctx->event_ctx); + if (c == NULL) return c; + + s = talloc_zero(c, struct domain_list_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + s->monitor_fn = monitor; + + s->ctx = ctx; + s->hostname = talloc_strdup(c, io->in.hostname); + if (composite_nomem(s->hostname, c)) return c; + + /* check whether samr pipe has already been opened */ + if (ctx->samr.pipe == NULL) { + ZERO_STRUCT(s->rpcconn); + + /* prepare rpc connect call */ + s->rpcconn.level = LIBNET_RPC_CONNECT_SERVER; + s->rpcconn.in.name = s->hostname; + s->rpcconn.in.dcerpc_iface = &ndr_table_samr; + + rpcconn_req = libnet_RpcConnect_send(ctx, c, &s->rpcconn, s->monitor_fn); + if (composite_nomem(rpcconn_req, c)) return c; + + composite_continue(c, rpcconn_req, continue_rpc_connect, c); + + } else { + /* prepare samr_Connect call */ + s->samrconn.in.system_name = 0; + s->samrconn.in.access_mask = SEC_GENERIC_READ; + s->samrconn.out.connect_handle = &s->connect_handle; + + subreq = dcerpc_samr_Connect_r_send(s, c->event_ctx, + s->ctx->samr.pipe->binding_handle, + &s->samrconn); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_samr_connect, c); + } + + return c; +} + + +/** + * Receive result of domain list request + * + * @param c composite context returned by DomainList_send function + * @param ctx initialised libnet context + * @param mem_ctx memory context of the call + * @param io results and arguments of the call + */ + +NTSTATUS libnet_DomainList_recv(struct composite_context *c, struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_DomainList *io) +{ + NTSTATUS status; + struct domain_list_state *s; + + status = composite_wait(c); + + s = talloc_get_type_abort(c->private_data, struct domain_list_state); + + if (NT_STATUS_IS_OK(status) && ctx && mem_ctx && io) { + /* fetch the results to be returned by io structure */ + io->out.count = s->count; + io->out.domains = talloc_steal(mem_ctx, s->domains); + io->out.error_string = talloc_asprintf(mem_ctx, "Success"); + + } else if (!NT_STATUS_IS_OK(status)) { + /* there was an error, so return description of the status code */ + io->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of DomainList call + * + * @param ctx initialised libnet context + * @param mem_ctx memory context for the call + * @param io arguments and results of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_DomainList(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_DomainList *io) +{ + struct composite_context *c; + + c = libnet_DomainList_send(ctx, mem_ctx, io, NULL); + return libnet_DomainList_recv(c, ctx, mem_ctx, io); +} diff --git a/source4/libnet/libnet_domain.h b/source4/libnet/libnet_domain.h new file mode 100644 index 0000000..ae698e3 --- /dev/null +++ b/source4/libnet/libnet_domain.h @@ -0,0 +1,70 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +enum service_type { DOMAIN_SAMR, DOMAIN_LSA }; + +/* + * struct definition for opening a domain + */ + +struct libnet_DomainOpen { + struct { + enum service_type type; + const char *domain_name; + uint32_t access_mask; + } in; + struct { + struct policy_handle domain_handle; + const char *error_string; + } out; +}; + + +struct libnet_DomainClose { + struct { + enum service_type type; + const char *domain_name; + } in; + struct { + const char *error_string; + } out; +}; + + +struct libnet_DomainList { + struct { + const char *hostname; + } in; + struct { + int count; + + struct domainlist { + const char *sid; + const char *name; + } *domains; + + const char *error_string; + } out; +}; + + +struct msg_rpc_lookup_domain { + const char *domain_name; +}; diff --git a/source4/libnet/libnet_export_keytab.c b/source4/libnet/libnet_export_keytab.c new file mode 100644 index 0000000..8f548e1 --- /dev/null +++ b/source4/libnet/libnet_export_keytab.c @@ -0,0 +1,206 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009 + Copyright (C) Andreas Schneider <asn@samba.org> 2016 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "system/kerberos.h" +#include "auth/kerberos/kerberos.h" +#include "kdc/samba_kdc.h" +#include "libnet/libnet_export_keytab.h" + +#include "kdc/db-glue.h" +#include "kdc/sdb.h" + +static NTSTATUS sdb_kt_copy(TALLOC_CTX *mem_ctx, + krb5_context context, + struct samba_kdc_db_context *db_ctx, + const char *keytab_name, + const char *principal, + const char **error_string) +{ + struct sdb_entry sentry = {}; + krb5_keytab keytab; + krb5_error_code code = 0; + NTSTATUS status = NT_STATUS_UNSUCCESSFUL; + char *entry_principal = NULL; + bool copy_one_principal = (principal != NULL); + krb5_data password; + + code = smb_krb5_kt_open_relative(context, + keytab_name, + true, /* write_access */ + &keytab); + if (code != 0) { + *error_string = talloc_asprintf(mem_ctx, + "Failed to open keytab: %s", + keytab_name); + status = NT_STATUS_NO_SUCH_FILE; + goto done; + } + + if (copy_one_principal) { + krb5_principal k5_princ; + + code = smb_krb5_parse_name(context, principal, &k5_princ); + if (code != 0) { + *error_string = smb_get_krb5_error_message(context, + code, + mem_ctx); + status = NT_STATUS_UNSUCCESSFUL; + goto done; + } + + code = samba_kdc_fetch(context, db_ctx, k5_princ, + SDB_F_GET_ANY | SDB_F_ADMIN_DATA, + 0, &sentry); + + krb5_free_principal(context, k5_princ); + } else { + code = samba_kdc_firstkey(context, db_ctx, &sentry); + } + + for (; code == 0; code = samba_kdc_nextkey(context, db_ctx, &sentry)) { + int i; + + code = krb5_unparse_name(context, + sentry.principal, + &entry_principal); + if (code != 0) { + *error_string = smb_get_krb5_error_message(context, + code, + mem_ctx); + status = NT_STATUS_UNSUCCESSFUL; + goto done; + } + + if (sentry.keys.len == 0) { + SAFE_FREE(entry_principal); + sdb_entry_free(&sentry); + + continue; + } + + for (i = 0; i < sentry.keys.len; i++) { + struct sdb_key *s = &(sentry.keys.val[i]); + krb5_enctype enctype; + + enctype = KRB5_KEY_TYPE(&(s->key)); + password.length = KRB5_KEY_LENGTH(&s->key); + password.data = (char *)KRB5_KEY_DATA(&s->key); + + DBG_INFO("smb_krb5_kt_add_entry for enctype=0x%04x\n", + (int)enctype); + code = smb_krb5_kt_add_entry(context, + keytab, + sentry.kvno, + entry_principal, + NULL, + enctype, + &password, + true); /* no_salt */ + if (code != 0) { + status = NT_STATUS_UNSUCCESSFUL; + *error_string = smb_get_krb5_error_message(context, + code, + mem_ctx); + DEBUG(0, ("smb_krb5_kt_add_entry failed code=%d, error = %s\n", + code, *error_string)); + goto done; + } + } + + if (copy_one_principal) { + break; + } + + SAFE_FREE(entry_principal); + sdb_entry_free(&sentry); + } + + if (code != 0 && code != SDB_ERR_NOENTRY) { + *error_string = smb_get_krb5_error_message(context, + code, + mem_ctx); + status = NT_STATUS_NO_SUCH_USER; + goto done; + } + + status = NT_STATUS_OK; +done: + SAFE_FREE(entry_principal); + sdb_entry_free(&sentry); + + return status; +} + +NTSTATUS libnet_export_keytab(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_export_keytab *r) +{ + krb5_error_code ret; + struct smb_krb5_context *smb_krb5_context; + struct samba_kdc_base_context *base_ctx; + struct samba_kdc_db_context *db_ctx = NULL; + const char *error_string = NULL; + NTSTATUS status; + + ret = smb_krb5_init_context(ctx, ctx->lp_ctx, &smb_krb5_context); + if (ret) { + return NT_STATUS_NO_MEMORY; + } + + base_ctx = talloc_zero(mem_ctx, struct samba_kdc_base_context); + if (base_ctx == NULL) { + return NT_STATUS_NO_MEMORY; + } + + base_ctx->ev_ctx = ctx->event_ctx; + base_ctx->lp_ctx = ctx->lp_ctx; + + status = samba_kdc_setup_db_ctx(mem_ctx, base_ctx, &db_ctx); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + if (r->in.principal != NULL) { + DEBUG(0, ("Export one principal to %s\n", r->in.keytab_name)); + status = sdb_kt_copy(mem_ctx, + smb_krb5_context->krb5_context, + db_ctx, + r->in.keytab_name, + r->in.principal, + &error_string); + } else { + unlink(r->in.keytab_name); + DEBUG(0, ("Export complete keytab to %s\n", r->in.keytab_name)); + status = sdb_kt_copy(mem_ctx, + smb_krb5_context->krb5_context, + db_ctx, + r->in.keytab_name, + NULL, + &error_string); + } + + talloc_free(db_ctx); + talloc_free(base_ctx); + + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = error_string; + } + + return status; +} diff --git a/source4/libnet/libnet_export_keytab.h b/source4/libnet/libnet_export_keytab.h new file mode 100644 index 0000000..2b4bdcd --- /dev/null +++ b/source4/libnet/libnet_export_keytab.h @@ -0,0 +1,32 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ +#include "includes.h" +#include "libnet/libnet.h" + +struct libnet_export_keytab { + struct { + const char *keytab_name; + const char *principal; + } in; + struct { + const char *error_string; + } out; +}; + +NTSTATUS libnet_export_keytab(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_export_keytab *r); diff --git a/source4/libnet/libnet_group.c b/source4/libnet/libnet_group.c new file mode 100644 index 0000000..73dcacf --- /dev/null +++ b/source4/libnet/libnet_group.c @@ -0,0 +1,764 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2007 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +#include "includes.h" +#include "libnet/libnet.h" +#include "libcli/composite/composite.h" +#include "librpc/gen_ndr/lsa.h" +#include "librpc/gen_ndr/ndr_lsa_c.h" +#include "librpc/gen_ndr/samr.h" +#include "librpc/gen_ndr/ndr_samr_c.h" +#include "libcli/security/security.h" + + +struct create_group_state { + struct libnet_context *ctx; + struct libnet_CreateGroup r; + struct libnet_DomainOpen domain_open; + struct libnet_rpc_groupadd group_add; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_domain_opened(struct composite_context *ctx); +static void continue_rpc_group_added(struct composite_context *ctx); + + +struct composite_context* libnet_CreateGroup_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_CreateGroup *r, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct create_group_state *s; + struct composite_context *create_req; + bool prereq_met = false; + + /* composite context allocation and setup */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct create_group_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + s->ctx = ctx; + s->r = *r; + ZERO_STRUCT(s->r.out); + + /* prerequisite: make sure we have a valid samr domain handle */ + prereq_met = samr_domain_opened(ctx, c, s->r.in.domain_name, &c, &s->domain_open, + continue_domain_opened, monitor); + if (!prereq_met) return c; + + /* prepare arguments of rpc group add call */ + s->group_add.in.groupname = r->in.group_name; + s->group_add.in.domain_handle = ctx->samr.handle; + + /* send the request */ + create_req = libnet_rpc_groupadd_send(s, s->ctx->event_ctx, + ctx->samr.samr_handle, + &s->group_add, monitor); + if (composite_nomem(create_req, c)) return c; + + composite_continue(c, create_req, continue_rpc_group_added, c); + return c; +} + + +static void continue_domain_opened(struct composite_context *ctx) +{ + struct composite_context *c; + struct create_group_state *s; + struct composite_context *create_req; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct create_group_state); + + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domain_open); + if (!composite_is_ok(c)) return; + + /* prepare arguments of groupadd call */ + s->group_add.in.groupname = s->r.in.group_name; + s->group_add.in.domain_handle = s->ctx->samr.handle; + + /* send the request */ + create_req = libnet_rpc_groupadd_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->group_add, s->monitor_fn); + if (composite_nomem(create_req, c)) return; + + composite_continue(c, create_req, continue_rpc_group_added, c); +} + + +static void continue_rpc_group_added(struct composite_context *ctx) +{ + struct composite_context *c; + struct create_group_state *s; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct create_group_state); + + /* receive result of group add call */ + c->status = libnet_rpc_groupadd_recv(ctx, c, &s->group_add); + if (!composite_is_ok(c)) return; + + /* we're done */ + composite_done(c); +} + + +/** + * Receive result of CreateGroup call + * + * @param c composite context returned by send request routine + * @param mem_ctx memory context of this call + * @param r pointer to a structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_CreateGroup_recv(struct composite_context *c, + TALLOC_CTX *mem_ctx, + struct libnet_CreateGroup *r) +{ + NTSTATUS status; + + status = composite_wait(c); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_strdup(mem_ctx, nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +/** + * Create domain group + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param io pointer to structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_CreateGroup(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_CreateGroup *io) +{ + struct composite_context *c; + + c = libnet_CreateGroup_send(ctx, mem_ctx, io, NULL); + return libnet_CreateGroup_recv(c, mem_ctx, io); +} + + +struct group_info_state { + struct libnet_context *ctx; + const char *domain_name; + enum libnet_GroupInfo_level level; + const char *group_name; + const char *sid_string; + struct libnet_LookupName lookup; + struct libnet_DomainOpen domopen; + struct libnet_rpc_groupinfo info; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_domain_open_info(struct composite_context *ctx); +static void continue_name_found(struct composite_context *ctx); +static void continue_group_info(struct composite_context *ctx); + +/** + * Sends request to get group information + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param io pointer to structure containing arguments the call + * @param monitor function pointer for receiving monitor messages + * @return composite context of this request + */ +struct composite_context* libnet_GroupInfo_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_GroupInfo *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct group_info_state *s; + bool prereq_met = false; + struct composite_context *lookup_req, *info_req; + + /* composite context allocation and setup */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct group_info_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* store arguments in the state structure */ + s->monitor_fn = monitor; + s->ctx = ctx; + s->domain_name = talloc_strdup(c, io->in.domain_name); + s->level = io->in.level; + switch(s->level) { + case GROUP_INFO_BY_NAME: + s->group_name = talloc_strdup(c, io->in.data.group_name); + s->sid_string = NULL; + break; + case GROUP_INFO_BY_SID: + s->group_name = NULL; + s->sid_string = dom_sid_string(c, io->in.data.group_sid); + break; + } + + /* prerequisite: make sure the domain is opened */ + prereq_met = samr_domain_opened(ctx, c, s->domain_name, &c, &s->domopen, + continue_domain_open_info, monitor); + if (!prereq_met) return c; + + switch(s->level) { + case GROUP_INFO_BY_NAME: + /* prepare arguments for LookupName call */ + s->lookup.in.name = s->group_name; + s->lookup.in.domain_name = s->domain_name; + + /* send the request */ + lookup_req = libnet_LookupName_send(s->ctx, c, &s->lookup, s->monitor_fn); + if (composite_nomem(lookup_req, c)) return c; + + /* set the next stage */ + composite_continue(c, lookup_req, continue_name_found, c); + break; + case GROUP_INFO_BY_SID: + /* prepare arguments for groupinfo call */ + s->info.in.domain_handle = s->ctx->samr.handle; + s->info.in.sid = s->sid_string; + /* we're looking for all information available */ + s->info.in.level = GROUPINFOALL; + + /* send the request */ + info_req = libnet_rpc_groupinfo_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->info, s->monitor_fn); + if (composite_nomem(info_req, c)) return c; + + /* set the next stage */ + composite_continue(c, info_req, continue_group_info, c); + break; + } + + return c; +} + + +/* + * Stage 0.5 (optional): receive opened domain and send lookup name request + */ +static void continue_domain_open_info(struct composite_context *ctx) +{ + struct composite_context *c; + struct group_info_state *s; + struct composite_context *lookup_req, *info_req; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct group_info_state); + + /* receive domain handle */ + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domopen); + if (!composite_is_ok(c)) return; + + switch(s->level) { + case GROUP_INFO_BY_NAME: + /* prepare arguments for LookupName call */ + s->lookup.in.name = s->group_name; + s->lookup.in.domain_name = s->domain_name; + + /* send the request */ + lookup_req = libnet_LookupName_send(s->ctx, c, &s->lookup, s->monitor_fn); + if (composite_nomem(lookup_req, c)) return; + + /* set the next stage */ + composite_continue(c, lookup_req, continue_name_found, c); + break; + case GROUP_INFO_BY_SID: + /* prepare arguments for groupinfo call */ + s->info.in.domain_handle = s->ctx->samr.handle; + s->info.in.sid = s->sid_string; + /* we're looking for all information available */ + s->info.in.level = GROUPINFOALL; + + /* send the request */ + info_req = libnet_rpc_groupinfo_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->info, s->monitor_fn); + if (composite_nomem(info_req, c)) return; + + /* set the next stage */ + composite_continue(c, info_req, continue_group_info, c); + break; + + } +} + + +/* + * Stage 1: Receive SID found and send request for group info + */ +static void continue_name_found(struct composite_context *ctx) +{ + struct composite_context *c; + struct group_info_state *s; + struct composite_context *info_req; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct group_info_state); + + /* receive SID associated with name found */ + c->status = libnet_LookupName_recv(ctx, c, &s->lookup); + if (!composite_is_ok(c)) return; + + /* Is it a group SID actually ? */ + if (s->lookup.out.sid_type != SID_NAME_DOM_GRP && + s->lookup.out.sid_type != SID_NAME_ALIAS) { + composite_error(c, NT_STATUS_NO_SUCH_GROUP); + return; + } + + /* prepare arguments for groupinfo call */ + s->info.in.domain_handle = s->ctx->samr.handle; + s->info.in.groupname = s->group_name; + s->info.in.sid = s->lookup.out.sidstr; + /* we're looking for all information available */ + s->info.in.level = GROUPINFOALL; + + /* send the request */ + info_req = libnet_rpc_groupinfo_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->info, s->monitor_fn); + if (composite_nomem(info_req, c)) return; + + /* set the next stage */ + composite_continue(c, info_req, continue_group_info, c); +} + + +/* + * Stage 2: Receive group information + */ +static void continue_group_info(struct composite_context *ctx) +{ + struct composite_context *c; + struct group_info_state *s; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct group_info_state); + + /* receive group information */ + c->status = libnet_rpc_groupinfo_recv(ctx, c, &s->info); + if (!composite_is_ok(c)) return; + + /* we're done */ + composite_done(c); +} + + +/* + * Receive group information + * + * @param c composite context returned by libnet_GroupInfo_send + * @param mem_ctx memory context of this call + * @param io pointer to structure receiving results of the call + * @result nt status + */ +NTSTATUS libnet_GroupInfo_recv(struct composite_context* c, TALLOC_CTX *mem_ctx, + struct libnet_GroupInfo *io) +{ + NTSTATUS status; + struct group_info_state *s; + + status = composite_wait(c); + if (NT_STATUS_IS_OK(status)) { + /* put the results into io structure if everything went fine */ + s = talloc_get_type_abort(c->private_data, struct group_info_state); + + io->out.group_name = talloc_steal(mem_ctx, + s->info.out.info.all.name.string); + io->out.group_sid = talloc_steal(mem_ctx, s->lookup.out.sid); + io->out.num_members = s->info.out.info.all.num_members; + io->out.description = talloc_steal(mem_ctx, s->info.out.info.all.description.string); + + io->out.error_string = talloc_strdup(mem_ctx, "Success"); + + } else { + io->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +/** + * Obtains specified group information + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of the call + * @param io pointer to a structure containing arguments and results of the call + */ +NTSTATUS libnet_GroupInfo(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_GroupInfo *io) +{ + struct composite_context *c = libnet_GroupInfo_send(ctx, mem_ctx, + io, NULL); + return libnet_GroupInfo_recv(c, mem_ctx, io); +} + + +struct grouplist_state { + struct libnet_context *ctx; + const char *domain_name; + struct lsa_DomainInfo dominfo; + int page_size; + uint32_t resume_index; + struct grouplist *groups; + uint32_t count; + + struct libnet_DomainOpen domain_open; + struct lsa_QueryInfoPolicy query_domain; + struct samr_EnumDomainGroups group_list; + + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_lsa_domain_opened(struct composite_context *ctx); +static void continue_domain_queried(struct tevent_req *subreq); +static void continue_samr_domain_opened(struct composite_context *ctx); +static void continue_groups_enumerated(struct tevent_req *subreq); + + +/** + * Sends request to list (enumerate) group accounts + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param io pointer to structure containing arguments and results of this call + * @param monitor function pointer for receiving monitor messages + * @return compostite context of this request + */ +struct composite_context *libnet_GroupList_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_GroupList *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct grouplist_state *s; + struct tevent_req *subreq; + bool prereq_met = false; + + /* composite context allocation and setup */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct grouplist_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* store the arguments in the state structure */ + s->ctx = ctx; + s->page_size = io->in.page_size; + s->resume_index = io->in.resume_index; + s->domain_name = talloc_strdup(c, io->in.domain_name); + s->monitor_fn = monitor; + + /* make sure we have lsa domain handle before doing anything */ + prereq_met = lsa_domain_opened(ctx, c, s->domain_name, &c, &s->domain_open, + continue_lsa_domain_opened, monitor); + if (!prereq_met) return c; + + /* prepare arguments of QueryDomainInfo call */ + s->query_domain.in.handle = &ctx->lsa.handle; + s->query_domain.in.level = LSA_POLICY_INFO_DOMAIN; + s->query_domain.out.info = talloc_zero(c, union lsa_PolicyInformation *); + if (composite_nomem(s->query_domain.out.info, c)) return c; + + /* send the request */ + subreq = dcerpc_lsa_QueryInfoPolicy_r_send(s, c->event_ctx, + ctx->lsa.pipe->binding_handle, + &s->query_domain); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_domain_queried, c); + return c; +} + + +/* + * Stage 0.5 (optional): receive lsa domain handle and send + * request to query domain info + */ +static void continue_lsa_domain_opened(struct composite_context *ctx) +{ + struct composite_context *c; + struct grouplist_state *s; + struct tevent_req *subreq; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct grouplist_state); + + /* receive lsa domain handle */ + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domain_open); + if (!composite_is_ok(c)) return; + + /* prepare arguments of QueryDomainInfo call */ + s->query_domain.in.handle = &s->ctx->lsa.handle; + s->query_domain.in.level = LSA_POLICY_INFO_DOMAIN; + s->query_domain.out.info = talloc_zero(c, union lsa_PolicyInformation *); + if (composite_nomem(s->query_domain.out.info, c)) return; + + /* send the request */ + subreq = dcerpc_lsa_QueryInfoPolicy_r_send(s, c->event_ctx, + s->ctx->lsa.pipe->binding_handle, + &s->query_domain); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_domain_queried, c); +} + + +/* + * Stage 1: receive domain info and request to enum groups + * provided a valid samr handle is opened + */ +static void continue_domain_queried(struct tevent_req *subreq) +{ + struct composite_context *c; + struct grouplist_state *s; + bool prereq_met = false; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct grouplist_state); + + /* receive result of rpc request */ + c->status = dcerpc_lsa_QueryInfoPolicy_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* get the returned domain info */ + s->dominfo = (*s->query_domain.out.info)->domain; + + /* make sure we have samr domain handle before continuing */ + prereq_met = samr_domain_opened(s->ctx, c, s->domain_name, &c, &s->domain_open, + continue_samr_domain_opened, s->monitor_fn); + if (!prereq_met) return; + + /* prepare arguments od EnumDomainGroups call */ + s->group_list.in.domain_handle = &s->ctx->samr.handle; + s->group_list.in.max_size = s->page_size; + s->group_list.in.resume_handle = &s->resume_index; + s->group_list.out.resume_handle = &s->resume_index; + s->group_list.out.num_entries = talloc(s, uint32_t); + if (composite_nomem(s->group_list.out.num_entries, c)) return; + s->group_list.out.sam = talloc(s, struct samr_SamArray *); + if (composite_nomem(s->group_list.out.sam, c)) return; + + /* send the request */ + subreq = dcerpc_samr_EnumDomainGroups_r_send(s, c->event_ctx, + s->ctx->samr.pipe->binding_handle, + &s->group_list); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_groups_enumerated, c); +} + + +/* + * Stage 1.5 (optional): receive samr domain handle + * and request to enumerate accounts + */ +static void continue_samr_domain_opened(struct composite_context *ctx) +{ + struct composite_context *c; + struct grouplist_state *s; + struct tevent_req *subreq; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct grouplist_state); + + /* receive samr domain handle */ + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domain_open); + if (!composite_is_ok(c)) return; + + /* prepare arguments of EnumDomainGroups call */ + s->group_list.in.domain_handle = &s->ctx->samr.handle; + s->group_list.in.max_size = s->page_size; + s->group_list.in.resume_handle = &s->resume_index; + s->group_list.out.resume_handle = &s->resume_index; + s->group_list.out.num_entries = talloc(s, uint32_t); + if (composite_nomem(s->group_list.out.num_entries, c)) return; + s->group_list.out.sam = talloc(s, struct samr_SamArray *); + if (composite_nomem(s->group_list.out.sam, c)) return; + + /* send the request */ + subreq = dcerpc_samr_EnumDomainGroups_r_send(s, c->event_ctx, + s->ctx->samr.pipe->binding_handle, + &s->group_list); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_groups_enumerated, c); +} + + +/* + * Stage 2: receive enumerated groups and their rids + */ +static void continue_groups_enumerated(struct tevent_req *subreq) +{ + struct composite_context *c; + struct grouplist_state *s; + uint32_t i; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct grouplist_state); + + /* receive result of rpc request */ + c->status = dcerpc_samr_EnumDomainGroups_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* get the actual status of the rpc call result + (instead of rpc layer) */ + c->status = s->group_list.out.result; + + /* we're interested in status "ok" as well as two + enum-specific status codes */ + if (NT_STATUS_IS_OK(c->status) || + NT_STATUS_EQUAL(c->status, STATUS_MORE_ENTRIES) || + NT_STATUS_EQUAL(c->status, NT_STATUS_NO_MORE_ENTRIES)) { + + /* get enumerated accounts counter and resume handle (the latter allows + making subsequent call to continue enumeration) */ + s->resume_index = *s->group_list.out.resume_handle; + s->count = *s->group_list.out.num_entries; + + /* prepare returned group accounts array */ + s->groups = talloc_array(c, struct grouplist, (*s->group_list.out.sam)->count); + if (composite_nomem(s->groups, c)) return; + + for (i = 0; i < (*s->group_list.out.sam)->count; i++) { + struct dom_sid *group_sid; + struct samr_SamEntry *entry = &(*s->group_list.out.sam)->entries[i]; + struct dom_sid *domain_sid = (*s->query_domain.out.info)->domain.sid; + + /* construct group sid from returned rid and queried domain sid */ + group_sid = dom_sid_add_rid(c, domain_sid, entry->idx); + if (composite_nomem(group_sid, c)) return; + + /* groupname */ + s->groups[i].groupname = talloc_strdup(s->groups, entry->name.string); + if (composite_nomem(s->groups[i].groupname, c)) return; + + /* sid string */ + s->groups[i].sid = dom_sid_string(s->groups, group_sid); + if (composite_nomem(s->groups[i].sid, c)) return; + } + + /* that's it */ + composite_done(c); + return; + } else { + /* something went wrong */ + composite_error(c, c->status); + return; + } +} + + +/** + * Receive result of GroupList call + * + * @param c composite context returned by send request routine + * @param mem_ctx memory context of this call + * @param io pointer to structure containing arguments and result of this call + * @param nt status + */ +NTSTATUS libnet_GroupList_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_GroupList *io) +{ + NTSTATUS status; + struct grouplist_state *s; + + if (c == NULL || mem_ctx == NULL || io == NULL) { + talloc_free(c); + return NT_STATUS_INVALID_PARAMETER; + } + + status = composite_wait(c); + if (NT_STATUS_IS_OK(status) || + NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) || + NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) { + + s = talloc_get_type_abort(c->private_data, struct grouplist_state); + + /* get results from composite context */ + io->out.count = s->count; + io->out.resume_index = s->resume_index; + io->out.groups = talloc_steal(mem_ctx, s->groups); + + if (NT_STATUS_IS_OK(status)) { + io->out.error_string = talloc_asprintf(mem_ctx, "Success"); + } else { + /* success, but we're not done yet */ + io->out.error_string = talloc_asprintf(mem_ctx, "Success (status: %s)", + nt_errstr(status)); + } + + } else { + io->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +/** + * Enumerate domain groups + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param io pointer to structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_GroupList(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_GroupList *io) +{ + struct composite_context *c; + + c = libnet_GroupList_send(ctx, mem_ctx, io, NULL); + return libnet_GroupList_recv(c, mem_ctx, io); +} diff --git a/source4/libnet/libnet_group.h b/source4/libnet/libnet_group.h new file mode 100644 index 0000000..8ac4743 --- /dev/null +++ b/source4/libnet/libnet_group.h @@ -0,0 +1,74 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2007 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + + +struct libnet_CreateGroup { + struct { + const char *group_name; + const char *domain_name; + } in; + struct { + const char *error_string; + } out; +}; + +enum libnet_GroupInfo_level { + GROUP_INFO_BY_NAME=0, + GROUP_INFO_BY_SID +}; + +struct libnet_GroupInfo { + struct { + const char *domain_name; + enum libnet_GroupInfo_level level; + union { + const char *group_name; + const struct dom_sid *group_sid; + } data; + } in; + struct { + const char *group_name; + struct dom_sid *group_sid; + uint32_t num_members; + const char *description; + + const char *error_string; + } out; +}; + + +struct libnet_GroupList { + struct { + const char *domain_name; + int page_size; + uint32_t resume_index; + } in; + struct { + int count; + uint32_t resume_index; + + struct grouplist { + const char *sid; + const char *groupname; + } *groups; + + const char *error_string; + } out; +}; diff --git a/source4/libnet/libnet_join.c b/source4/libnet/libnet_join.c new file mode 100644 index 0000000..d1afb4f --- /dev/null +++ b/source4/libnet/libnet_join.c @@ -0,0 +1,1021 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + Copyright (C) Brad Henry 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "librpc/gen_ndr/ndr_drsuapi_c.h" +#include <ldb.h> +#include <ldb_errors.h> +#include "dsdb/samdb/samdb.h" +#include "ldb_wrap.h" +#include "libcli/security/security.h" +#include "auth/credentials/credentials.h" +#include "auth/credentials/credentials_krb5.h" +#include "librpc/gen_ndr/ndr_samr_c.h" +#include "param/param.h" +#include "param/provision.h" +#include "system/kerberos.h" +#include "auth/kerberos/kerberos.h" + +/* + * complete a domain join, when joining to a AD domain: + * 1.) connect and bind to the DRSUAPI pipe + * 2.) do a DsCrackNames() to find the machine account dn + * 3.) connect to LDAP + * 4.) do an ldap search to find the "msDS-KeyVersionNumber" of the machine account + * 5.) set the servicePrincipalName's of the machine account via LDAP, (maybe we should use DsWriteAccountSpn()...) + * 6.) do a DsCrackNames() to find the domain dn + * 7.) find out Site specific stuff, look at libnet_JoinSite() for details + */ +static NTSTATUS libnet_JoinADSDomain(struct libnet_context *ctx, struct libnet_JoinDomain *r) +{ + NTSTATUS status; + + TALLOC_CTX *tmp_ctx; + + const char *realm = r->out.realm; + + const struct dcerpc_binding *samr_binding = r->out.samr_binding; + + struct dcerpc_pipe *drsuapi_pipe; + struct dcerpc_binding *drsuapi_binding; + enum dcerpc_transport_t transport; + struct drsuapi_DsBind r_drsuapi_bind; + struct drsuapi_DsCrackNames r_crack_names; + struct drsuapi_DsNameString names[1]; + struct policy_handle drsuapi_bind_handle; + struct GUID drsuapi_bind_guid; + + struct ldb_context *remote_ldb; + struct ldb_dn *account_dn; + const char *account_dn_str; + const char *remote_ldb_url; + struct ldb_result *res; + struct ldb_message *msg; + + int ret, rtn; + + const char * const attrs[] = { + "msDS-KeyVersionNumber", + "servicePrincipalName", + "dNSHostName", + "objectGUID", + NULL, + }; + + r->out.error_string = NULL; + + /* We need to convert between a samAccountName and domain to a + * DN in the directory. The correct way to do this is with + * DRSUAPI CrackNames */ + + /* Fiddle with the bindings, so get to DRSUAPI on + * NCACN_IP_TCP, sealed */ + tmp_ctx = talloc_named(r, 0, "libnet_JoinADSDomain temp context"); + if (!tmp_ctx) { + r->out.error_string = NULL; + return NT_STATUS_NO_MEMORY; + } + + drsuapi_binding = dcerpc_binding_dup(tmp_ctx, samr_binding); + if (!drsuapi_binding) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + transport = dcerpc_binding_get_transport(drsuapi_binding); + + /* DRSUAPI is only available on IP_TCP, and locally on NCALRPC */ + if (transport != NCALRPC) { + status = dcerpc_binding_set_transport(drsuapi_binding, NCACN_IP_TCP); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(r, + "dcerpc_binding_set_transport failed: %s", + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + } + + status = dcerpc_binding_set_string_option(drsuapi_binding, "endpoint", NULL); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(r, + "dcerpc_binding_set_string_option failed: %s", + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + status = dcerpc_binding_set_flags(drsuapi_binding, DCERPC_SEAL, 0); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(r, + "dcerpc_binding_set_flags failed: %s", + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + status = dcerpc_pipe_connect_b(tmp_ctx, + &drsuapi_pipe, + drsuapi_binding, + &ndr_table_drsuapi, + ctx->cred, + ctx->event_ctx, + ctx->lp_ctx); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(r, + "Connection to DRSUAPI pipe of PDC of domain '%s' failed: %s", + r->out.domain_name, + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + /* get a DRSUAPI pipe handle */ + GUID_from_string(DRSUAPI_DS_BIND_GUID, &drsuapi_bind_guid); + + r_drsuapi_bind.in.bind_guid = &drsuapi_bind_guid; + r_drsuapi_bind.in.bind_info = NULL; + r_drsuapi_bind.out.bind_handle = &drsuapi_bind_handle; + + status = dcerpc_drsuapi_DsBind_r(drsuapi_pipe->binding_handle, tmp_ctx, &r_drsuapi_bind); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string + = talloc_asprintf(r, + "dcerpc_drsuapi_DsBind failed - %s", + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } else if (!W_ERROR_IS_OK(r_drsuapi_bind.out.result)) { + r->out.error_string + = talloc_asprintf(r, + "DsBind failed - %s", + win_errstr(r_drsuapi_bind.out.result)); + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } + + /* Actually 'crack' the names */ + ZERO_STRUCT(r_crack_names); + r_crack_names.in.bind_handle = &drsuapi_bind_handle; + r_crack_names.in.level = 1; + r_crack_names.in.req = talloc(r, union drsuapi_DsNameRequest); + if (!r_crack_names.in.req) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + r_crack_names.in.req->req1.codepage = 1252; /* western european */ + r_crack_names.in.req->req1.language = 0x00000407; /* german */ + r_crack_names.in.req->req1.count = 1; + r_crack_names.in.req->req1.names = names; + r_crack_names.in.req->req1.format_flags = DRSUAPI_DS_NAME_FLAG_NO_FLAGS; + r_crack_names.in.req->req1.format_offered = DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY; + r_crack_names.in.req->req1.format_desired = DRSUAPI_DS_NAME_FORMAT_FQDN_1779; + names[0].str = dom_sid_string(tmp_ctx, r->out.account_sid); + if (!names[0].str) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + r_crack_names.out.ctr = talloc(r, union drsuapi_DsNameCtr); + r_crack_names.out.level_out = talloc(r, uint32_t); + if (!r_crack_names.out.ctr || !r_crack_names.out.level_out) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + status = dcerpc_drsuapi_DsCrackNames_r(drsuapi_pipe->binding_handle, tmp_ctx, &r_crack_names); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string + = talloc_asprintf(r, + "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s", + names[0].str, + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } else if (!W_ERROR_IS_OK(r_crack_names.out.result)) { + r->out.error_string + = talloc_asprintf(r, + "DsCrackNames failed - %s", win_errstr(r_crack_names.out.result)); + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } else if (*r_crack_names.out.level_out != 1 + || !r_crack_names.out.ctr->ctr1 + || r_crack_names.out.ctr->ctr1->count != 1) { + r->out.error_string = talloc_asprintf(r, "DsCrackNames failed"); + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_PARAMETER; + } else if (r_crack_names.out.ctr->ctr1->array[0].status != DRSUAPI_DS_NAME_STATUS_OK) { + r->out.error_string = talloc_asprintf(r, "DsCrackNames failed: %d", r_crack_names.out.ctr->ctr1->array[0].status); + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } else if (r_crack_names.out.ctr->ctr1->array[0].result_name == NULL) { + r->out.error_string = talloc_asprintf(r, "DsCrackNames failed: no result name"); + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_PARAMETER; + } + + /* Store the DN of our machine account. */ + account_dn_str = r_crack_names.out.ctr->ctr1->array[0].result_name; + + /* Now we know the user's DN, open with LDAP, read and modify a few things */ + + remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", + dcerpc_binding_get_string_option(drsuapi_binding, "target_hostname")); + if (!remote_ldb_url) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + remote_ldb = ldb_wrap_connect(tmp_ctx, ctx->event_ctx, ctx->lp_ctx, + remote_ldb_url, + NULL, ctx->cred, 0); + if (!remote_ldb) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } + + account_dn = ldb_dn_new(tmp_ctx, remote_ldb, account_dn_str); + if (account_dn == NULL) { + r->out.error_string = talloc_asprintf(r, "Invalid account dn: %s", + account_dn_str); + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } + + /* search for the user's record */ + ret = ldb_search(remote_ldb, tmp_ctx, &res, + account_dn, LDB_SCOPE_BASE, attrs, NULL); + if (ret != LDB_SUCCESS) { + r->out.error_string = talloc_asprintf(r, "ldb_search for %s failed - %s", + account_dn_str, ldb_errstring(remote_ldb)); + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } + + if (res->count != 1) { + r->out.error_string = talloc_asprintf(r, "ldb_search for %s failed - found %d entries", + account_dn_str, res->count); + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } + + /* Prepare a new message, for the modify */ + msg = ldb_msg_new(tmp_ctx); + if (!msg) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + msg->dn = res->msgs[0]->dn; + + { + unsigned int i; + const char *service_principal_name[2]; + const char *dns_host_name = strlower_talloc(msg, + talloc_asprintf(msg, + "%s.%s", + r->in.netbios_name, + realm)); + + if (!dns_host_name) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + service_principal_name[0] = talloc_asprintf(msg, "HOST/%s", + dns_host_name); + service_principal_name[1] = talloc_asprintf(msg, "HOST/%s", + r->in.netbios_name); + + for (i=0; i < ARRAY_SIZE(service_principal_name); i++) { + if (!service_principal_name[i]) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + rtn = ldb_msg_add_string(msg, "servicePrincipalName", + service_principal_name[i]); + if (rtn != LDB_SUCCESS) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + } + + rtn = ldb_msg_add_string(msg, "dNSHostName", dns_host_name); + if (rtn != LDB_SUCCESS) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + rtn = dsdb_replace(remote_ldb, msg, 0); + if (rtn != LDB_SUCCESS) { + r->out.error_string + = talloc_asprintf(r, + "Failed to replace entries on %s", + ldb_dn_get_linearized(msg->dn)); + talloc_free(tmp_ctx); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + } + + msg = ldb_msg_new(tmp_ctx); + if (!msg) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + msg->dn = res->msgs[0]->dn; + + rtn = samdb_msg_add_uint(remote_ldb, msg, msg, + "msDS-SupportedEncryptionTypes", ENC_ALL_TYPES); + if (rtn != LDB_SUCCESS) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + rtn = dsdb_replace(remote_ldb, msg, 0); + /* The remote server may not support this attribute, if it + * isn't a modern schema */ + if (rtn != LDB_SUCCESS && rtn != LDB_ERR_NO_SUCH_ATTRIBUTE) { + r->out.error_string + = talloc_asprintf(r, + "Failed to replace msDS-SupportedEncryptionTypes on %s", + ldb_dn_get_linearized(msg->dn)); + talloc_free(tmp_ctx); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + /* DsCrackNames to find out the DN of the domain. */ + r_crack_names.in.req->req1.format_offered = DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT; + r_crack_names.in.req->req1.format_desired = DRSUAPI_DS_NAME_FORMAT_FQDN_1779; + names[0].str = talloc_asprintf(tmp_ctx, "%s\\", r->out.domain_name); + if (!names[0].str) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + status = dcerpc_drsuapi_DsCrackNames_r(drsuapi_pipe->binding_handle, tmp_ctx, &r_crack_names); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string + = talloc_asprintf(r, + "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s", + r->in.domain_name, + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } else if (!W_ERROR_IS_OK(r_crack_names.out.result)) { + r->out.error_string + = talloc_asprintf(r, + "DsCrackNames failed - %s", win_errstr(r_crack_names.out.result)); + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } else if (*r_crack_names.out.level_out != 1 + || !r_crack_names.out.ctr->ctr1 + || r_crack_names.out.ctr->ctr1->count != 1 + || !r_crack_names.out.ctr->ctr1->array[0].result_name + || r_crack_names.out.ctr->ctr1->array[0].status != DRSUAPI_DS_NAME_STATUS_OK) { + r->out.error_string = talloc_asprintf(r, "DsCrackNames failed"); + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } + + /* Store the account DN. */ + r->out.account_dn_str = account_dn_str; + talloc_steal(r, account_dn_str); + + /* Store the domain DN. */ + r->out.domain_dn_str = r_crack_names.out.ctr->ctr1->array[0].result_name; + talloc_steal(r, r_crack_names.out.ctr->ctr1->array[0].result_name); + + /* Store the KVNO of the account, critical for some kerberos + * operations */ + r->out.kvno = ldb_msg_find_attr_as_uint(res->msgs[0], "msDS-KeyVersionNumber", 0); + + /* Store the account GUID. */ + r->out.account_guid = samdb_result_guid(res->msgs[0], "objectGUID"); + + if (r->in.acct_type == ACB_SVRTRUST) { + status = libnet_JoinSite(ctx, remote_ldb, r); + } + talloc_free(tmp_ctx); + + return status; +} + +/* + * do a domain join using DCERPC/SAMR calls + * - connect to the LSA pipe, to try and find out information about the domain + * - create a secondary connection to SAMR pipe + * - do a samr_Connect to get a policy handle + * - do a samr_LookupDomain to get the domain sid + * - do a samr_OpenDomain to get a domain handle + * - do a samr_CreateAccount to try and get a new account + * + * If that fails, do: + * - do a samr_LookupNames to get the users rid + * - do a samr_OpenUser to get a user handle + * - potentially delete and recreate the user + * - assert the account is of the right type with samrQueryUserInfo + * + * - call libnet_SetPassword_samr_handle to set the password, + * and pass a samr_UserInfo21 struct to set full_name and the account flags + * + * - do some ADS specific things when we join as Domain Controller, + * look at libnet_joinADSDomain() for the details + */ +NTSTATUS libnet_JoinDomain(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *r) +{ + TALLOC_CTX *tmp_ctx; + + NTSTATUS status, cu_status; + + struct libnet_RpcConnect *connect_with_info; + struct dcerpc_pipe *samr_pipe; + + struct samr_Connect sc; + struct policy_handle p_handle; + struct samr_OpenDomain od; + struct policy_handle d_handle; + struct samr_LookupNames ln; + struct samr_Ids rids, types; + struct samr_OpenUser ou; + struct samr_CreateUser2 cu; + struct policy_handle *u_handle = NULL; + struct samr_QueryUserInfo qui; + union samr_UserInfo *uinfo; + struct samr_UserInfo21 u_info21; + union libnet_SetPassword r2; + struct samr_GetUserPwInfo pwp; + struct samr_PwInfo info; + struct lsa_String samr_account_name; + + uint32_t acct_flags, old_acct_flags; + uint32_t rid, access_granted; + int policy_min_pw_len = 0; + + struct dom_sid *account_sid = NULL; + const char *password_str = NULL; + + r->out.error_string = NULL; + ZERO_STRUCT(r2); + + tmp_ctx = talloc_named(mem_ctx, 0, "libnet_Join temp context"); + if (!tmp_ctx) { + r->out.error_string = NULL; + return NT_STATUS_NO_MEMORY; + } + + u_handle = talloc(tmp_ctx, struct policy_handle); + if (!u_handle) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + connect_with_info = talloc_zero(tmp_ctx, struct libnet_RpcConnect); + if (!connect_with_info) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + /* prepare connect to the SAMR pipe of PDC */ + if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) { + connect_with_info->in.binding = NULL; + connect_with_info->in.name = r->in.domain_name; + } else { + connect_with_info->in.binding = r->in.binding; + connect_with_info->in.name = NULL; + } + + /* This level makes a connection to the LSA pipe on the way, + * to get some useful bits of information about the domain */ + connect_with_info->level = LIBNET_RPC_CONNECT_DC_INFO; + connect_with_info->in.dcerpc_iface = &ndr_table_samr; + + /* + establish the SAMR connection + */ + status = libnet_RpcConnect(ctx, tmp_ctx, connect_with_info); + if (!NT_STATUS_IS_OK(status)) { + if (r->in.binding) { + r->out.error_string = talloc_asprintf(mem_ctx, + "Connection to SAMR pipe of DC %s failed: %s", + r->in.binding, connect_with_info->out.error_string); + } else { + r->out.error_string = talloc_asprintf(mem_ctx, + "Connection to SAMR pipe of PDC for %s failed: %s", + r->in.domain_name, connect_with_info->out.error_string); + } + talloc_free(tmp_ctx); + return status; + } + + samr_pipe = connect_with_info->out.dcerpc_pipe; + + /* prepare samr_Connect */ + ZERO_STRUCT(p_handle); + sc.in.system_name = NULL; + sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + sc.out.connect_handle = &p_handle; + + /* 2. do a samr_Connect to get a policy handle */ + status = dcerpc_samr_Connect_r(samr_pipe->binding_handle, tmp_ctx, &sc); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sc.out.result)) { + status = sc.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "samr_Connect failed: %s", + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + /* If this is a connection on ncacn_ip_tcp to Win2k3 SP1, we don't get back this useful info */ + if (!connect_with_info->out.domain_name) { + if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) { + connect_with_info->out.domain_name = talloc_strdup(tmp_ctx, r->in.domain_name); + } else { + /* Bugger, we just lost our way to automatically find the domain name */ + connect_with_info->out.domain_name = talloc_strdup(tmp_ctx, lpcfg_workgroup(ctx->lp_ctx)); + connect_with_info->out.realm = talloc_strdup(tmp_ctx, lpcfg_realm(ctx->lp_ctx)); + } + } + + /* Perhaps we didn't get a SID above, because we are against ncacn_ip_tcp */ + if (!connect_with_info->out.domain_sid) { + struct lsa_String name; + struct samr_LookupDomain l; + struct dom_sid2 *sid = NULL; + name.string = connect_with_info->out.domain_name; + l.in.connect_handle = &p_handle; + l.in.domain_name = &name; + l.out.sid = &sid; + + status = dcerpc_samr_LookupDomain_r(samr_pipe->binding_handle, tmp_ctx, &l); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(l.out.result)) { + status = l.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "SAMR LookupDomain failed: %s", + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + connect_with_info->out.domain_sid = *l.out.sid; + } + + /* prepare samr_OpenDomain */ + ZERO_STRUCT(d_handle); + od.in.connect_handle = &p_handle; + od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + od.in.sid = connect_with_info->out.domain_sid; + od.out.domain_handle = &d_handle; + + /* do a samr_OpenDomain to get a domain handle */ + status = dcerpc_samr_OpenDomain_r(samr_pipe->binding_handle, tmp_ctx, &od); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(od.out.result)) { + status = od.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + struct dom_sid_buf buf; + r->out.error_string = talloc_asprintf( + mem_ctx, + "samr_OpenDomain for [%s] failed: %s", + dom_sid_str_buf(connect_with_info->out.domain_sid, + &buf), + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + /* prepare samr_CreateUser2 */ + ZERO_STRUCTP(u_handle); + cu.in.domain_handle = &d_handle; + cu.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + samr_account_name.string = r->in.account_name; + cu.in.account_name = &samr_account_name; + cu.in.acct_flags = r->in.acct_type; + cu.out.user_handle = u_handle; + cu.out.rid = &rid; + cu.out.access_granted = &access_granted; + + /* do a samr_CreateUser2 to get an account handle, or an error */ + cu_status = dcerpc_samr_CreateUser2_r(samr_pipe->binding_handle, tmp_ctx, &cu); + if (NT_STATUS_IS_OK(cu_status) && !NT_STATUS_IS_OK(cu.out.result)) { + cu_status = cu.out.result; + } + status = cu_status; + if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) { + /* prepare samr_LookupNames */ + ln.in.domain_handle = &d_handle; + ln.in.num_names = 1; + ln.in.names = talloc_array(tmp_ctx, struct lsa_String, 1); + ln.out.rids = &rids; + ln.out.types = &types; + if (!ln.in.names) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + ln.in.names[0].string = r->in.account_name; + + /* 5. do a samr_LookupNames to get the users rid */ + status = dcerpc_samr_LookupNames_r(samr_pipe->binding_handle, tmp_ctx, &ln); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ln.out.result)) { + status = ln.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "samr_LookupNames for [%s] failed: %s", + r->in.account_name, + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + /* check if we got one RID for the user */ + if (ln.out.rids->count != 1) { + r->out.error_string = talloc_asprintf(mem_ctx, + "samr_LookupNames for [%s] returns %d RIDs", + r->in.account_name, ln.out.rids->count); + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + if (ln.out.types->count != 1) { + r->out.error_string = talloc_asprintf(mem_ctx, + "samr_LookupNames for [%s] returns %d RID TYPEs", + r->in.account_name, ln.out.types->count); + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + /* prepare samr_OpenUser */ + ZERO_STRUCTP(u_handle); + ou.in.domain_handle = &d_handle; + ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + ou.in.rid = ln.out.rids->ids[0]; + rid = ou.in.rid; + ou.out.user_handle = u_handle; + + /* 6. do a samr_OpenUser to get a user handle */ + status = dcerpc_samr_OpenUser_r(samr_pipe->binding_handle, tmp_ctx, &ou); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ou.out.result)) { + status = ou.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "samr_OpenUser for [%s] failed: %s", + r->in.account_name, + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + if (r->in.recreate_account) { + struct samr_DeleteUser d; + d.in.user_handle = u_handle; + d.out.user_handle = u_handle; + status = dcerpc_samr_DeleteUser_r(samr_pipe->binding_handle, mem_ctx, &d); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(d.out.result)) { + status = d.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "samr_DeleteUser (for recreate) of [%s] failed: %s", + r->in.account_name, + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + /* We want to recreate, so delete and another samr_CreateUser2 */ + + /* &cu filled in above */ + status = dcerpc_samr_CreateUser2_r(samr_pipe->binding_handle, tmp_ctx, &cu); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(cu.out.result)) { + status = cu.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "samr_CreateUser2 (recreate) for [%s] failed: %s", + r->in.account_name, nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + } + } else if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "samr_CreateUser2 for [%s] failed: %s", + r->in.account_name, nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + /* prepare samr_QueryUserInfo (get flags) */ + qui.in.user_handle = u_handle; + qui.in.level = 16; + qui.out.info = &uinfo; + + status = dcerpc_samr_QueryUserInfo_r(samr_pipe->binding_handle, tmp_ctx, &qui); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(qui.out.result)) { + status = qui.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "samr_QueryUserInfo for [%s] failed: %s", + r->in.account_name, + nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + if (!uinfo) { + status = NT_STATUS_INVALID_PARAMETER; + r->out.error_string + = talloc_asprintf(mem_ctx, + "samr_QueryUserInfo failed to return qui.out.info for [%s]: %s", + r->in.account_name, nt_errstr(status)); + talloc_free(tmp_ctx); + return status; + } + + old_acct_flags = (uinfo->info16.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST | ACB_DOMTRUST)); + /* Possibly bail if the account is of the wrong type */ + if (old_acct_flags + != r->in.acct_type) { + const char *old_account_type, *new_account_type; + switch (old_acct_flags) { + case ACB_WSTRUST: + old_account_type = "domain member (member)"; + break; + case ACB_SVRTRUST: + old_account_type = "domain controller (bdc)"; + break; + case ACB_DOMTRUST: + old_account_type = "trusted domain"; + break; + default: + return NT_STATUS_INVALID_PARAMETER; + } + switch (r->in.acct_type) { + case ACB_WSTRUST: + new_account_type = "domain member (member)"; + break; + case ACB_SVRTRUST: + new_account_type = "domain controller (bdc)"; + break; + case ACB_DOMTRUST: + new_account_type = "trusted domain"; + break; + default: + return NT_STATUS_INVALID_PARAMETER; + } + + if (!NT_STATUS_EQUAL(cu_status, NT_STATUS_USER_EXISTS)) { + /* We created a new user, but they didn't come out the right type?!? */ + r->out.error_string + = talloc_asprintf(mem_ctx, + "We asked to create a new machine account (%s) of type %s, " + "but we got an account of type %s. This is unexpected. " + "Perhaps delete the account and try again.", + r->in.account_name, new_account_type, old_account_type); + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_PARAMETER; + } else { + /* The account is of the wrong type, so bail */ + + /* TODO: We should allow a --force option to override, and redo this from the top setting r.in.recreate_account */ + r->out.error_string + = talloc_asprintf(mem_ctx, + "The machine account (%s) already exists in the domain %s, " + "but is a %s. You asked to join as a %s. Please delete " + "the account and try again.", + r->in.account_name, connect_with_info->out.domain_name, old_account_type, new_account_type); + talloc_free(tmp_ctx); + return NT_STATUS_USER_EXISTS; + } + } else { + acct_flags = uinfo->info16.acct_flags; + } + + acct_flags = (acct_flags & ~(ACB_DISABLED|ACB_PWNOTREQ)); + + /* Find out what password policy this user has */ + pwp.in.user_handle = u_handle; + pwp.out.info = &info; + + status = dcerpc_samr_GetUserPwInfo_r(samr_pipe->binding_handle, tmp_ctx, &pwp); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pwp.out.result)) { + status = pwp.out.result; + } + if (NT_STATUS_IS_OK(status)) { + policy_min_pw_len = pwp.out.info->min_password_length; + } + + if (r->in.account_pass != NULL) { + password_str = talloc_strdup(tmp_ctx, r->in.account_pass); + } else { + /* Grab a password of that minimum length */ + password_str = generate_random_password(tmp_ctx, + MAX(8, policy_min_pw_len), 255); + } + if (!password_str) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + /* set full_name and reset flags */ + ZERO_STRUCT(u_info21); + u_info21.full_name.string = r->in.account_name; + u_info21.acct_flags = acct_flags; + u_info21.fields_present = SAMR_FIELD_FULL_NAME | SAMR_FIELD_ACCT_FLAGS; + + r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE; + r2.samr_handle.in.account_name = r->in.account_name; + r2.samr_handle.in.newpassword = password_str; + r2.samr_handle.in.user_handle = u_handle; + r2.samr_handle.in.dcerpc_pipe = samr_pipe; + r2.samr_handle.in.info21 = &u_info21; + + status = libnet_SetPassword(ctx, tmp_ctx, &r2); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_steal(mem_ctx, r2.samr_handle.out.error_string); + talloc_free(tmp_ctx); + return status; + } + + account_sid = dom_sid_add_rid(mem_ctx, connect_with_info->out.domain_sid, rid); + if (!account_sid) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + /* Finish out by pushing various bits of status data out for the caller to use */ + r->out.join_password = password_str; + talloc_steal(mem_ctx, r->out.join_password); + + r->out.domain_sid = connect_with_info->out.domain_sid; + talloc_steal(mem_ctx, r->out.domain_sid); + + r->out.account_sid = account_sid; + talloc_steal(mem_ctx, r->out.account_sid); + + r->out.domain_name = connect_with_info->out.domain_name; + talloc_steal(mem_ctx, r->out.domain_name); + r->out.realm = connect_with_info->out.realm; + talloc_steal(mem_ctx, r->out.realm); + r->out.samr_pipe = samr_pipe; + talloc_reparent(tmp_ctx, mem_ctx, samr_pipe); + r->out.samr_binding = samr_pipe->binding; + r->out.user_handle = u_handle; + talloc_steal(mem_ctx, u_handle); + r->out.error_string = r2.samr_handle.out.error_string; + talloc_steal(mem_ctx, r2.samr_handle.out.error_string); + r->out.kvno = 0; + r->out.server_dn_str = NULL; + talloc_free(tmp_ctx); + + /* Now, if it was AD, then we want to start looking changing a + * few more things. Otherwise, we are done. */ + if (r->out.realm) { + status = libnet_JoinADSDomain(ctx, r); + return status; + } + + return status; +} + +NTSTATUS libnet_Join_member(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_Join_member *r) +{ + NTSTATUS status; + TALLOC_CTX *tmp_mem; + struct libnet_JoinDomain *r2; + struct provision_store_self_join_settings *set_secrets; + uint32_t acct_type = 0; + const char *account_name; + const char *netbios_name; + const char *error_string = NULL; + + r->out.error_string = NULL; + + tmp_mem = talloc_new(mem_ctx); + if (!tmp_mem) { + return NT_STATUS_NO_MEMORY; + } + + r2 = talloc_zero(tmp_mem, struct libnet_JoinDomain); + if (!r2) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + acct_type = ACB_WSTRUST; + + if (r->in.netbios_name != NULL) { + netbios_name = r->in.netbios_name; + } else { + netbios_name = talloc_strdup(tmp_mem, lpcfg_netbios_name(ctx->lp_ctx)); + if (!netbios_name) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + } + + account_name = talloc_asprintf(tmp_mem, "%s$", netbios_name); + if (!account_name) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + /* + * join the domain + */ + r2->in.domain_name = r->in.domain_name; + r2->in.account_name = account_name; + r2->in.netbios_name = netbios_name; + r2->in.level = LIBNET_JOINDOMAIN_AUTOMATIC; + r2->in.acct_type = acct_type; + r2->in.recreate_account = false; + r2->in.account_pass = r->in.account_pass; + status = libnet_JoinDomain(ctx, r2, r2); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_steal(mem_ctx, r2->out.error_string); + goto out; + } + + set_secrets = talloc_zero(tmp_mem, + struct provision_store_self_join_settings); + if (!set_secrets) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + set_secrets->domain_name = r2->out.domain_name; + set_secrets->realm = r2->out.realm; + set_secrets->netbios_name = netbios_name; + set_secrets->secure_channel_type = SEC_CHAN_WKSTA; + set_secrets->machine_password = r2->out.join_password; + set_secrets->key_version_number = r2->out.kvno; + set_secrets->domain_sid = r2->out.domain_sid; + + status = provision_store_self_join(ctx, ctx->lp_ctx, ctx->event_ctx, set_secrets, &error_string); + if (!NT_STATUS_IS_OK(status)) { + if (error_string) { + r->out.error_string = talloc_steal(mem_ctx, error_string); + } else { + r->out.error_string + = talloc_asprintf(mem_ctx, + "provision_store_self_join failed with %s", + nt_errstr(status)); + } + goto out; + } + + /* move all out parameter to the callers TALLOC_CTX */ + r->out.join_password = talloc_move(mem_ctx, &r2->out.join_password); + r->out.domain_sid = talloc_move(mem_ctx, &r2->out.domain_sid); + r->out.domain_name = talloc_move(mem_ctx, &r2->out.domain_name); + status = NT_STATUS_OK; +out: + talloc_free(tmp_mem); + return status; +} + diff --git a/source4/libnet/libnet_join.h b/source4/libnet/libnet_join.h new file mode 100644 index 0000000..c8a4a40 --- /dev/null +++ b/source4/libnet/libnet_join.h @@ -0,0 +1,101 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + Copyright (C) Brad Henry 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef __LIBNET_JOIN_H__ +#define __LIBNET_JOIN_H__ + +#include "librpc/gen_ndr/netlogon.h" + +enum libnet_Join_level { + LIBNET_JOIN_AUTOMATIC, + LIBNET_JOIN_SPECIFIED, +}; + +enum libnet_JoinDomain_level { + LIBNET_JOINDOMAIN_AUTOMATIC, + LIBNET_JOINDOMAIN_SPECIFIED, +}; + +struct libnet_JoinDomain { + struct { + const char *domain_name; + const char *account_name; + const char *netbios_name; + const char *binding; + enum libnet_JoinDomain_level level; + uint32_t acct_type; + bool recreate_account; + const char *account_pass; + } in; + + struct { + const char *error_string; + const char *join_password; + struct dom_sid *domain_sid; + const char *domain_name; + const char *realm; + const char *domain_dn_str; + const char *account_dn_str; + const char *server_dn_str; + uint32_t kvno; /* msDS-KeyVersionNumber */ + struct dcerpc_pipe *samr_pipe; + const struct dcerpc_binding *samr_binding; + struct policy_handle *user_handle; + struct dom_sid *account_sid; + struct GUID account_guid; + } out; +}; + +struct libnet_Join_member { + struct { + const char *domain_name; + const char *netbios_name; + enum libnet_Join_level level; + const char *account_pass; + } in; + + struct { + const char *error_string; + const char *join_password; + struct dom_sid *domain_sid; + const char *domain_name; + } out; +}; + +struct libnet_set_join_secrets { + struct { + const char *domain_name; + const char *realm; + const char *netbios_name; + const char *account_name; + enum netr_SchannelType join_type; + const char *join_password; + int kvno; + struct dom_sid *domain_sid; + } in; + + struct { + const char *error_string; + } out; +}; + + +#endif /* __LIBNET_JOIN_H__ */ diff --git a/source4/libnet/libnet_lookup.c b/source4/libnet/libnet_lookup.c new file mode 100644 index 0000000..63ce601 --- /dev/null +++ b/source4/libnet/libnet_lookup.c @@ -0,0 +1,448 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/* + a composite function for name resolving +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "libcli/composite/composite.h" +#include "auth/credentials/credentials.h" +#include "libcli/resolve/resolve.h" +#include "libcli/finddc.h" +#include "libcli/security/security.h" +#include "librpc/gen_ndr/ndr_lsa_c.h" +#include "param/param.h" + +struct lookup_state { + struct nbt_name hostname; + const char *address; +}; + + +static void continue_name_resolved(struct composite_context *ctx); + + +/** + * Sends asynchronous Lookup request + * + * @param io arguments and result of the call + */ + +struct composite_context *libnet_Lookup_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_Lookup *io) +{ + struct composite_context *c; + struct lookup_state *s; + struct composite_context *cresolve_req; + struct resolve_context *resolve_ctx; + + /* allocate context and state structures */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct lookup_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + if (io == NULL || io->in.hostname == NULL) { + composite_error(c, NT_STATUS_INVALID_PARAMETER); + return c; + } + + /* parameters */ + s->hostname.name = talloc_strdup(s, io->in.hostname); + if (composite_nomem(s->hostname.name, c)) return c; + + s->hostname.type = io->in.type; + s->hostname.scope = NULL; + + /* name resolution methods */ + if (io->in.resolve_ctx) { + resolve_ctx = io->in.resolve_ctx; + } else { + resolve_ctx = ctx->resolve_ctx; + } + + /* send resolve request */ + cresolve_req = resolve_name_send(resolve_ctx, s, &s->hostname, c->event_ctx); + if (composite_nomem(cresolve_req, c)) return c; + + composite_continue(c, cresolve_req, continue_name_resolved, c); + return c; +} + + +static void continue_name_resolved(struct composite_context *ctx) +{ + struct composite_context *c; + struct lookup_state *s; + + c = talloc_get_type(ctx->async.private_data, struct composite_context); + s = talloc_get_type(c->private_data, struct lookup_state); + + c->status = resolve_name_recv(ctx, s, &s->address); + + composite_done(c); +} + + +/** + * Waits for and receives results of asynchronous Lookup call + * + * @param c composite context returned by asynchronous Lookup call + * @param mem_ctx memory context of the call + * @param io pointer to results (and arguments) of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_Lookup_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_Lookup *io) +{ + NTSTATUS status; + struct lookup_state *s; + + status = composite_wait(c); + if (NT_STATUS_IS_OK(status)) { + char **address; + + s = talloc_get_type(c->private_data, struct lookup_state); + + address = str_list_make_single(mem_ctx, s->address); + NT_STATUS_HAVE_NO_MEMORY(address); + io->out.address = discard_const_p(const char *, address); + } + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of Lookup call + * + * @param mem_ctx memory context for the call + * @param io arguments and results of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_Lookup(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_Lookup *io) +{ + struct composite_context *c = libnet_Lookup_send(ctx, mem_ctx, io); + return libnet_Lookup_recv(c, mem_ctx, io); +} + + +/* + * Shortcut functions to find common types of name + * (and skip nbt name type argument) + */ + + +/** + * Sends asynchronous LookupHost request + */ +struct composite_context* libnet_LookupHost_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_Lookup *io) +{ + io->in.type = NBT_NAME_SERVER; + return libnet_Lookup_send(ctx, mem_ctx, io); +} + + + +/** + * Synchronous version of LookupHost call + */ +NTSTATUS libnet_LookupHost(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_Lookup *io) +{ + struct composite_context *c = libnet_LookupHost_send(ctx, mem_ctx, io); + return libnet_Lookup_recv(c, mem_ctx, io); +} + + +/** + * Sends asynchronous LookupDCs request + */ +struct tevent_req *libnet_LookupDCs_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_LookupDCs *io) +{ + struct tevent_req *req; + struct finddcs finddcs_io; + + ZERO_STRUCT(finddcs_io); + + if (strcasecmp_m(io->in.domain_name, lpcfg_workgroup(ctx->lp_ctx)) == 0) { + finddcs_io.in.domain_name = lpcfg_dnsdomain(ctx->lp_ctx); + } else { + finddcs_io.in.domain_name = io->in.domain_name; + } + finddcs_io.in.minimum_dc_flags = NBT_SERVER_LDAP | NBT_SERVER_DS | NBT_SERVER_WRITABLE; + finddcs_io.in.server_address = ctx->server_address; + + req = finddcs_cldap_send(mem_ctx, &finddcs_io, ctx->resolve_ctx, ctx->event_ctx); + return req; +} + +/** + * Waits for and receives results of asynchronous Lookup call + * + * @param c composite context returned by asynchronous Lookup call + * @param mem_ctx memory context of the call + * @param io pointer to results (and arguments) of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_LookupDCs_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx, + struct libnet_LookupDCs *io) +{ + NTSTATUS status; + struct finddcs finddcs_io; + status = finddcs_cldap_recv(req, mem_ctx, &finddcs_io); + talloc_free(req); + io->out.num_dcs = 1; + io->out.dcs = talloc(mem_ctx, struct nbt_dc_name); + NT_STATUS_HAVE_NO_MEMORY(io->out.dcs); + io->out.dcs[0].address = finddcs_io.out.address; + io->out.dcs[0].name = finddcs_io.out.netlogon.data.nt5_ex.pdc_dns_name; + return status; +} + + +/** + * Synchronous version of LookupDCs + */ +NTSTATUS libnet_LookupDCs(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_LookupDCs *io) +{ + struct tevent_req *req = libnet_LookupDCs_send(ctx, mem_ctx, io); + return libnet_LookupDCs_recv(req, mem_ctx, io); +} + + +struct lookup_name_state { + struct libnet_context *ctx; + const char *name; + uint32_t count; + struct libnet_DomainOpen domopen; + struct lsa_LookupNames lookup; + struct lsa_TransSidArray sids; + struct lsa_String *names; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static bool prepare_lookup_params(struct libnet_context *ctx, + struct composite_context *c, + struct lookup_name_state *s); +static void continue_lookup_name(struct composite_context *ctx); +static void continue_name_found(struct tevent_req *subreq); + + +struct composite_context* libnet_LookupName_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_LookupName *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct lookup_name_state *s; + struct tevent_req *subreq; + bool prereq_met = false; + + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct lookup_name_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + s->name = talloc_strdup(c, io->in.name); + s->monitor_fn = monitor; + s->ctx = ctx; + + prereq_met = lsa_domain_opened(ctx, c, io->in.domain_name, &c, &s->domopen, + continue_lookup_name, monitor); + if (!prereq_met) return c; + + if (!prepare_lookup_params(ctx, c, s)) return c; + + subreq = dcerpc_lsa_LookupNames_r_send(s, c->event_ctx, + ctx->lsa.pipe->binding_handle, + &s->lookup); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_name_found, c); + return c; +} + + +static bool prepare_lookup_params(struct libnet_context *ctx, + struct composite_context *c, + struct lookup_name_state *s) +{ + const int single_name = 1; + + s->sids.count = 0; + s->sids.sids = NULL; + + s->names = talloc_array(s, struct lsa_String, single_name); + if (composite_nomem(s->names, c)) return false; + s->names[0].string = s->name; + + s->lookup.in.handle = &ctx->lsa.handle; + s->lookup.in.num_names = single_name; + s->lookup.in.names = s->names; + s->lookup.in.sids = &s->sids; + s->lookup.in.level = 1; + s->lookup.in.count = &s->count; + s->lookup.out.count = &s->count; + s->lookup.out.sids = &s->sids; + s->lookup.out.domains = talloc_zero(s, struct lsa_RefDomainList *); + if (composite_nomem(s->lookup.out.domains, c)) return false; + + return true; +} + + +static void continue_lookup_name(struct composite_context *ctx) +{ + struct composite_context *c; + struct lookup_name_state *s; + struct tevent_req *subreq; + + c = talloc_get_type(ctx->async.private_data, struct composite_context); + s = talloc_get_type(c->private_data, struct lookup_name_state); + + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domopen); + if (!composite_is_ok(c)) return; + + if (!prepare_lookup_params(s->ctx, c, s)) return; + + subreq = dcerpc_lsa_LookupNames_r_send(s, c->event_ctx, + s->ctx->lsa.pipe->binding_handle, + &s->lookup); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_name_found, c); +} + + +static void continue_name_found(struct tevent_req *subreq) +{ + struct composite_context *c; + struct lookup_name_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct lookup_name_state); + + c->status = dcerpc_lsa_LookupNames_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + c->status = s->lookup.out.result; + if (!composite_is_ok(c)) return; + + if (s->lookup.out.sids->count != s->lookup.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + composite_done(c); +} + + +NTSTATUS libnet_LookupName_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_LookupName *io) +{ + NTSTATUS status; + struct lookup_name_state *s = NULL; + struct lsa_RefDomainList *domains = NULL; + struct lsa_TransSidArray *sids = NULL; + + status = composite_wait(c); + ZERO_STRUCT(io->out); + + if (!NT_STATUS_IS_OK(status)) { + io->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", + nt_errstr(status)); + goto done; + } + + s = talloc_get_type(c->private_data, struct lookup_name_state); + + if (*s->lookup.out.count == 0) { + goto success; + } + + domains = *s->lookup.out.domains; + sids = s->lookup.out.sids; + + if (domains == NULL || sids == NULL) { + status = NT_STATUS_UNSUCCESSFUL; + io->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", + nt_errstr(status)); + goto done; + } + + if (sids->count == 0) { + goto success; + } + + io->out.rid = sids->sids[0].rid; + io->out.sid_type = sids->sids[0].sid_type; + if (domains->count > 0) { + io->out.sid = dom_sid_add_rid(mem_ctx, domains->domains[0].sid, + io->out.rid); + if (io->out.sid == NULL) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + io->out.sidstr = dom_sid_string(mem_ctx, io->out.sid); + if (io->out.sidstr == NULL) { + status = NT_STATUS_NO_MEMORY; + goto done; + } + } + +success: + io->out.error_string = talloc_strdup(mem_ctx, "Success"); +done: + talloc_free(c); + return status; +} + + +NTSTATUS libnet_LookupName(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_LookupName *io) +{ + struct composite_context *c; + + c = libnet_LookupName_send(ctx, mem_ctx, io, NULL); + return libnet_LookupName_recv(c, mem_ctx, io); +} diff --git a/source4/libnet/libnet_lookup.h b/source4/libnet/libnet_lookup.h new file mode 100644 index 0000000..189ae58 --- /dev/null +++ b/source4/libnet/libnet_lookup.h @@ -0,0 +1,69 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +struct libnet_Lookup { + struct { + const char *hostname; + int type; + struct resolve_context *resolve_ctx; + } in; + struct { + const char **address; + } out; +}; + + +struct libnet_LookupDCs { + struct { + const char *domain_name; + int name_type; + } in; + struct { + int num_dcs; + struct nbt_dc_name *dcs; + } out; +}; + + +struct libnet_LookupName { + struct { + const char *name; + const char *domain_name; + } in; + struct { + struct dom_sid *sid; + int rid; + enum lsa_SidType sid_type; + const char *sidstr; + const char *error_string; + } out; +}; + + +/* + * Monitor messages sent from libnet_lookup.c functions + */ + +struct msg_net_lookup_dc { + const char *domain_name; + const char *hostname; + const char *address; +}; + diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c new file mode 100644 index 0000000..e24ebe2 --- /dev/null +++ b/source4/libnet/libnet_passwd.c @@ -0,0 +1,1108 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "libcli/auth/libcli_auth.h" +#include "librpc/gen_ndr/ndr_samr_c.h" +#include "source4/librpc/rpc/dcerpc.h" +#include "auth/credentials/credentials.h" +#include "libcli/smb/smb_constants.h" +#include "librpc/rpc/dcerpc_samr.h" +#include "source3/rpc_client/init_samr.h" +#include "lib/param/loadparm.h" +#include "lib/param/param.h" + +#include "lib/crypto/gnutls_helpers.h" +#include <gnutls/gnutls.h> +#include <gnutls/crypto.h> + +static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + struct dcerpc_binding_handle *h, + struct lsa_String *server, + struct lsa_String *account, + const char *old_password, + const char *new_password, + const char **error_string) +{ + struct samr_ChangePasswordUser4 r; + uint8_t old_nt_key_data[16] = {0}; + gnutls_datum_t old_nt_key = { + .data = old_nt_key_data, + .size = sizeof(old_nt_key_data), + }; + uint8_t cek_data[16] = {0}; + DATA_BLOB cek = { + .data = cek_data, + .length = sizeof(cek_data), + }; + struct samr_EncryptedPasswordAES pwd_buf = { + .cipher_len = 0 + }; + DATA_BLOB salt = { + .data = pwd_buf.salt, + .length = sizeof(pwd_buf.salt), + }; + gnutls_datum_t salt_datum = { + .data = pwd_buf.salt, + .size = sizeof(pwd_buf.salt), + }; + uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000); + NTSTATUS status; + int rc; + + E_md4hash(old_password, old_nt_key_data); + + generate_nonce_buffer(salt.data, salt.length); + + rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512, + &old_nt_key, + &salt_datum, + pbkdf2_iterations, + cek.data, + cek.length); + BURN_DATA(old_nt_key_data); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + } + + status = init_samr_CryptPasswordAES(mem_ctx, + new_password, + &salt, + &cek, + &pwd_buf); + data_blob_clear(&cek); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + pwd_buf.PBKDF2Iterations = pbkdf2_iterations; + + r.in.server = server; + r.in.account = account; + r.in.password = &pwd_buf; + + status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + if (!NT_STATUS_IS_OK(r.out.result)) { + status = r.out.result; + *error_string = talloc_asprintf(mem_ctx, + "samr_ChangePasswordUser4 for " + "'%s\\%s' failed: %s", + server->string, + account->string, + nt_errstr(status)); + goto done; + } + +done: + BURN_DATA(pwd_buf); + + return status; +} + +static NTSTATUS libnet_ChangePassword_samr_rc4(TALLOC_CTX *mem_ctx, + struct dcerpc_binding_handle *h, + struct lsa_String *server, + struct lsa_String *account, + const char *old_password, + const char *new_password, + const char **error_string) +{ + struct samr_OemChangePasswordUser2 oe2; + struct samr_ChangePasswordUser2 pw2; + struct samr_ChangePasswordUser3 pw3; + struct samr_CryptPassword nt_pass, lm_pass; + uint8_t old_nt_hash[16], new_nt_hash[16]; + uint8_t old_lm_hash[16], new_lm_hash[16]; + struct samr_Password nt_verifier, lm_verifier; + struct lsa_AsciiString a_server, a_account; + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t nt_session_key = { + .data = old_nt_hash, + .size = sizeof(old_nt_hash), + }; + gnutls_datum_t lm_session_key = { + .data = old_lm_hash, + .size = sizeof(old_lm_hash), + }; + struct samr_DomInfo1 *dominfo = NULL; + struct userPwdChangeFailureInformation *reject = NULL; + NTSTATUS status; + int rc; + + E_md4hash(old_password, old_nt_hash); + E_md4hash(new_password, new_nt_hash); + + E_deshash(old_password, old_lm_hash); + E_deshash(new_password, new_lm_hash); + + /* prepare samr_ChangePasswordUser3 */ + encode_pw_buffer(lm_pass.data, new_password, STR_UNICODE); + + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &nt_session_key, + NULL); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + + rc = gnutls_cipher_encrypt(cipher_hnd, + lm_pass.data, + 516); + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + + rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash); + if (rc != 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER); + goto done; + } + + encode_pw_buffer(nt_pass.data, new_password, STR_UNICODE); + + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &nt_session_key, + NULL); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + + rc = gnutls_cipher_encrypt(cipher_hnd, + nt_pass.data, + 516); + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + + rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash); + if (rc != 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER); + goto done; + } + + pw3.in.server = server; + pw3.in.account = account; + pw3.in.nt_password = &nt_pass; + pw3.in.nt_verifier = &nt_verifier; + pw3.in.lm_change = 1; + pw3.in.lm_password = &lm_pass; + pw3.in.lm_verifier = &lm_verifier; + pw3.in.password3 = NULL; + pw3.out.dominfo = &dominfo; + pw3.out.reject = &reject; + + /* 2. try samr_ChangePasswordUser3 */ + status = dcerpc_samr_ChangePasswordUser3_r(h, mem_ctx, &pw3); + if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) { + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw3.out.result)) { + status = pw3.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + *error_string = talloc_asprintf( + mem_ctx, + "samr_ChangePasswordUser3 failed: %s", + nt_errstr(status)); + *error_string = + talloc_asprintf(mem_ctx, + "samr_ChangePasswordUser3 for " + "'%s\\%s' failed: %s", + server->string, + account->string, + nt_errstr(status)); + } + goto done; + } + + /* prepare samr_ChangePasswordUser2 */ + encode_pw_buffer(lm_pass.data, new_password, STR_ASCII | STR_TERMINATE); + + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &lm_session_key, + NULL); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + + rc = gnutls_cipher_encrypt(cipher_hnd, + lm_pass.data, + 516); + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + + rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash); + if (rc != 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER); + goto done; + } + + encode_pw_buffer(nt_pass.data, new_password, STR_UNICODE); + + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &nt_session_key, + NULL); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + rc = gnutls_cipher_encrypt(cipher_hnd, + nt_pass.data, + 516); + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + + rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash); + if (rc != 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER); + goto done; + } + + pw2.in.server = server; + pw2.in.account = account; + pw2.in.nt_password = &nt_pass; + pw2.in.nt_verifier = &nt_verifier; + pw2.in.lm_change = 1; + pw2.in.lm_password = &lm_pass; + pw2.in.lm_verifier = &lm_verifier; + + /* 3. try samr_ChangePasswordUser2 */ + status = dcerpc_samr_ChangePasswordUser2_r(h, mem_ctx, &pw2); + if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) { + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw2.out.result)) { + status = pw2.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + *error_string = + talloc_asprintf(mem_ctx, + "samr_ChangePasswordUser2 for " + "'%s\\%s' failed: %s", + server->string, + account->string, + nt_errstr(status)); + } + goto done; + } + + + /* prepare samr_OemChangePasswordUser2 */ + a_server.string = server->string; + a_account.string = account->string; + + encode_pw_buffer(lm_pass.data, new_password, STR_ASCII); + + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &lm_session_key, + NULL); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + + rc = gnutls_cipher_encrypt(cipher_hnd, + lm_pass.data, + 516); + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto done; + } + + rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash); + if (rc != 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER); + goto done; + } + + oe2.in.server = &a_server; + oe2.in.account = &a_account; + oe2.in.password = &lm_pass; + oe2.in.hash = &lm_verifier; + + /* 4. try samr_OemChangePasswordUser2 */ + status = dcerpc_samr_OemChangePasswordUser2_r(h, mem_ctx, &oe2); + if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) { + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(oe2.out.result)) { + status = oe2.out.result; + } + if (!NT_STATUS_IS_OK(oe2.out.result)) { + *error_string = + talloc_asprintf(mem_ctx, + "samr_OemChangePasswordUser2 " + "for '%s\\%s' failed: %s", + server->string, + account->string, + nt_errstr(status)); + } + goto done; + } + + status = NT_STATUS_OK; +done: + return status; +} + +/* + * do a password change using DCERPC/SAMR calls + * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) + * 2. try samr_ChangePasswordUser3 + * 3. try samr_ChangePasswordUser2 + * 4. try samr_OemChangePasswordUser2 + */ +static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r) +{ + NTSTATUS status; + struct libnet_RpcConnect c; + struct lsa_String server, account; + + ZERO_STRUCT(c); + + /* prepare connect to the SAMR pipe of the users domain PDC */ + c.level = LIBNET_RPC_CONNECT_PDC; + c.in.name = r->samr.in.domain_name; + c.in.dcerpc_iface = &ndr_table_samr; + c.in.dcerpc_flags = DCERPC_ANON_FALLBACK; + + /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */ + status = libnet_RpcConnect(ctx, mem_ctx, &c); + if (!NT_STATUS_IS_OK(status)) { + r->samr.out.error_string = talloc_asprintf(mem_ctx, + "Connection to SAMR pipe of PDC of domain '%s' failed: %s", + r->samr.in.domain_name, nt_errstr(status)); + return status; + } + + /* prepare password change for account */ + server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe)); + account.string = r->samr.in.account_name; + + status = libnet_ChangePassword_samr_aes( + mem_ctx, + c.out.dcerpc_pipe->binding_handle, + &server, + &account, + r->samr.in.oldpassword, + r->samr.in.newpassword, + &(r->samr.out.error_string)); + if (NT_STATUS_IS_OK(status)) { + goto disconnect; + } else if (NT_STATUS_EQUAL(status, + NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || + NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || + NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { + /* + * Don't fallback to RC4 based SAMR if weak crypto is not + * allowed. + */ + if (lpcfg_weak_crypto(ctx->lp_ctx) == + SAMBA_WEAK_CRYPTO_DISALLOWED) { + goto disconnect; + } + } else { + /* libnet_ChangePassword_samr_aes is implemented and failed */ + goto disconnect; + } + + status = libnet_ChangePassword_samr_rc4( + mem_ctx, + c.out.dcerpc_pipe->binding_handle, + &server, + &account, + r->samr.in.oldpassword, + r->samr.in.newpassword, + &(r->samr.out.error_string)); + if (!NT_STATUS_IS_OK(status)) { + goto disconnect; + } + +disconnect: + /* close connection */ + talloc_unlink(ctx, c.out.dcerpc_pipe); + + return status; +} + +static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r) +{ + NTSTATUS status; + union libnet_ChangePassword r2; + + r2.samr.level = LIBNET_CHANGE_PASSWORD_SAMR; + r2.samr.in.account_name = r->generic.in.account_name; + r2.samr.in.domain_name = r->generic.in.domain_name; + r2.samr.in.oldpassword = r->generic.in.oldpassword; + r2.samr.in.newpassword = r->generic.in.newpassword; + + status = libnet_ChangePassword(ctx, mem_ctx, &r2); + + r->generic.out.error_string = r2.samr.out.error_string; + + return status; +} + +NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r) +{ + switch (r->generic.level) { + case LIBNET_CHANGE_PASSWORD_GENERIC: + return libnet_ChangePassword_generic(ctx, mem_ctx, r); + case LIBNET_CHANGE_PASSWORD_SAMR: + return libnet_ChangePassword_samr(ctx, mem_ctx, r); + case LIBNET_CHANGE_PASSWORD_KRB5: + return NT_STATUS_NOT_IMPLEMENTED; + case LIBNET_CHANGE_PASSWORD_LDAP: + return NT_STATUS_NOT_IMPLEMENTED; + case LIBNET_CHANGE_PASSWORD_RAP: + return NT_STATUS_NOT_IMPLEMENTED; + } + + return NT_STATUS_INVALID_LEVEL; +} + +static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r) +{ + NTSTATUS status; + struct samr_SetUserInfo2 sui; + union samr_UserInfo u_info; + DATA_BLOB session_key; + + if (r->samr_handle.in.info21) { + return NT_STATUS_INVALID_PARAMETER_MIX; + } + + /* prepare samr_SetUserInfo2 level 26 */ + ZERO_STRUCT(u_info); + u_info.info26.password_expired = 0; + + status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key); + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string = talloc_asprintf(mem_ctx, + "dcerpc_fetch_session_key failed: %s", + nt_errstr(status)); + return status; + } + + status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword, + &session_key, + &u_info.info26.password); + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string = + talloc_asprintf(mem_ctx, + "encode_rc4_passwd_buffer failed: %s", + nt_errstr(status)); + return status; + } + + sui.in.user_handle = r->samr_handle.in.user_handle; + sui.in.info = &u_info; + sui.in.level = 26; + + /* 7. try samr_SetUserInfo2 level 26 to set the password */ + status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui); + /* check result of samr_SetUserInfo2 level 26 */ + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) { + status = sui.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string + = talloc_asprintf(mem_ctx, + "SetUserInfo2 level 26 for [%s] failed: %s", + r->samr_handle.in.account_name, nt_errstr(status)); + } + + return status; +} + +static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r) +{ + NTSTATUS status; + struct samr_SetUserInfo2 sui; + union samr_UserInfo u_info; + DATA_BLOB session_key; + + if (!r->samr_handle.in.info21) { + return NT_STATUS_INVALID_PARAMETER_MIX; + } + + /* prepare samr_SetUserInfo2 level 25 */ + ZERO_STRUCT(u_info); + u_info.info25.info = *r->samr_handle.in.info21; + u_info.info25.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT; + + status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key); + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string = talloc_asprintf(mem_ctx, + "dcerpc_fetch_session_key failed: %s", + nt_errstr(status)); + return status; + } + + status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword, + &session_key, + &u_info.info25.password); + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string = + talloc_asprintf(mem_ctx, + "encode_rc4_passwd_buffer failed: %s", + nt_errstr(status)); + return status; + } + + + sui.in.user_handle = r->samr_handle.in.user_handle; + sui.in.info = &u_info; + sui.in.level = 25; + + /* 8. try samr_SetUserInfo2 level 25 to set the password */ + status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) { + status = sui.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string + = talloc_asprintf(mem_ctx, + "SetUserInfo2 level 25 for [%s] failed: %s", + r->samr_handle.in.account_name, nt_errstr(status)); + } + + return status; +} + +static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r) +{ + NTSTATUS status; + struct samr_SetUserInfo2 sui; + union samr_UserInfo u_info; + DATA_BLOB session_key; + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t enc_session_key; + int rc; + + if (r->samr_handle.in.info21) { + return NT_STATUS_INVALID_PARAMETER_MIX; + } + + /* prepare samr_SetUserInfo2 level 24 */ + ZERO_STRUCT(u_info); + encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE); + u_info.info24.password_expired = 0; + + status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key); + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string = talloc_asprintf(mem_ctx, + "dcerpc_fetch_session_key failed: %s", + nt_errstr(status)); + return status; + } + + enc_session_key = (gnutls_datum_t) { + .data = session_key.data, + .size = session_key.length, + }; + + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &enc_session_key, + NULL); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } + + rc = gnutls_cipher_encrypt(cipher_hnd, + u_info.info24.password.data, + 516); + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } + + sui.in.user_handle = r->samr_handle.in.user_handle; + sui.in.info = &u_info; + sui.in.level = 24; + + /* 9. try samr_SetUserInfo2 level 24 to set the password */ + status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) { + status = sui.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string + = talloc_asprintf(mem_ctx, + "SetUserInfo2 level 24 for [%s] failed: %s", + r->samr_handle.in.account_name, nt_errstr(status)); + } + +out: + data_blob_clear(&session_key); + return status; +} + +static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r) +{ + NTSTATUS status; + struct samr_SetUserInfo2 sui; + union samr_UserInfo u_info; + DATA_BLOB session_key; + gnutls_cipher_hd_t cipher_hnd = NULL; + gnutls_datum_t _session_key; + int rc; + + if (!r->samr_handle.in.info21) { + return NT_STATUS_INVALID_PARAMETER_MIX; + } + + /* prepare samr_SetUserInfo2 level 23 */ + ZERO_STRUCT(u_info); + u_info.info23.info = *r->samr_handle.in.info21; + u_info.info23.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT; + encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE); + + status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key); + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string + = talloc_asprintf(mem_ctx, + "dcerpc_fetch_session_key failed: %s", + nt_errstr(status)); + return status; + } + + _session_key = (gnutls_datum_t) { + .data = session_key.data, + .size = session_key.length, + }; + + rc = gnutls_cipher_init(&cipher_hnd, + GNUTLS_CIPHER_ARCFOUR_128, + &_session_key, + NULL); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } + + rc = gnutls_cipher_encrypt(cipher_hnd, + u_info.info23.password.data, + 516); + data_blob_clear_free(&session_key); + gnutls_cipher_deinit(cipher_hnd); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } + + sui.in.user_handle = r->samr_handle.in.user_handle; + sui.in.info = &u_info; + sui.in.level = 23; + + /* 10. try samr_SetUserInfo2 level 23 to set the password */ + status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) { + status = sui.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string + = talloc_asprintf(mem_ctx, + "SetUserInfo2 level 23 for [%s] failed: %s", + r->samr_handle.in.account_name, nt_errstr(status)); + } + +out: + return status; +} + +static NTSTATUS libnet_SetPassword_samr_handle_18(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r) +{ + NTSTATUS status; + struct samr_SetUserInfo2 sui; + union samr_UserInfo u_info; + struct samr_Password ntpwd; + DATA_BLOB ntpwd_in; + DATA_BLOB ntpwd_out; + DATA_BLOB session_key; + int rc; + + if (r->samr_handle.in.info21) { + return NT_STATUS_INVALID_PARAMETER_MIX; + } + + /* prepare samr_SetUserInfo2 level 18 (nt_hash) */ + ZERO_STRUCT(u_info); + E_md4hash(r->samr_handle.in.newpassword, ntpwd.hash); + ntpwd_in = data_blob_const(ntpwd.hash, sizeof(ntpwd.hash)); + ntpwd_out = data_blob_const(u_info.info18.nt_pwd.hash, + sizeof(u_info.info18.nt_pwd.hash)); + u_info.info18.nt_pwd_active = 1; + u_info.info18.password_expired = 0; + + status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key); + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string = talloc_asprintf(mem_ctx, + "dcerpc_fetch_session_key failed: %s", + nt_errstr(status)); + return status; + } + + rc = sess_crypt_blob(&ntpwd_out, &ntpwd_in, + &session_key, SAMBA_GNUTLS_ENCRYPT); + if (rc < 0) { + status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID); + goto out; + } + + sui.in.user_handle = r->samr_handle.in.user_handle; + sui.in.info = &u_info; + sui.in.level = 18; + + /* 9. try samr_SetUserInfo2 level 18 to set the password */ + status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) { + status = sui.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr_handle.out.error_string + = talloc_asprintf(mem_ctx, + "SetUserInfo2 level 18 for [%s] failed: %s", + r->samr_handle.in.account_name, nt_errstr(status)); + } + +out: + data_blob_clear(&session_key); + return status; +} + +/* + * 1. try samr_SetUserInfo2 level 26 to set the password + * 2. try samr_SetUserInfo2 level 25 to set the password + * 3. try samr_SetUserInfo2 level 24 to set the password + * 4. try samr_SetUserInfo2 level 23 to set the password +*/ +static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r) +{ + + NTSTATUS status; + enum libnet_SetPassword_level levels[] = { + LIBNET_SET_PASSWORD_SAMR_HANDLE_26, + LIBNET_SET_PASSWORD_SAMR_HANDLE_25, + LIBNET_SET_PASSWORD_SAMR_HANDLE_24, + LIBNET_SET_PASSWORD_SAMR_HANDLE_23, + }; + unsigned int i; + + if (r->samr_handle.samr_level != 0) { + r->generic.level = r->samr_handle.samr_level; + return libnet_SetPassword(ctx, mem_ctx, r); + } + + for (i=0; i < ARRAY_SIZE(levels); i++) { + r->generic.level = levels[i]; + status = libnet_SetPassword(ctx, mem_ctx, r); + if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS) + || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER_MIX) + || NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) { + /* Try another password set mechanism */ + continue; + } + break; + } + + return status; +} +/* + * set a password with DCERPC/SAMR calls + * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) + * is it correct to contact the the pdc of the domain of the user who's password should be set? + * 2. do a samr_Connect to get a policy handle + * 3. do a samr_LookupDomain to get the domain sid + * 4. do a samr_OpenDomain to get a domain handle + * 5. do a samr_LookupNames to get the users rid + * 6. do a samr_OpenUser to get a user handle + * 7 call libnet_SetPassword_samr_handle to set the password + */ +static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r) +{ + NTSTATUS status; + struct libnet_RpcConnect c; + struct samr_Connect sc; + struct policy_handle p_handle; + struct samr_LookupDomain ld; + struct dom_sid2 *sid = NULL; + struct lsa_String d_name; + struct samr_OpenDomain od; + struct policy_handle d_handle; + struct samr_LookupNames ln; + struct samr_Ids rids, types; + struct samr_OpenUser ou; + struct policy_handle u_handle; + union libnet_SetPassword r2; + + ZERO_STRUCT(c); + /* prepare connect to the SAMR pipe of users domain PDC */ + c.level = LIBNET_RPC_CONNECT_PDC; + c.in.name = r->samr.in.domain_name; + c.in.dcerpc_iface = &ndr_table_samr; + + /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */ + status = libnet_RpcConnect(ctx, mem_ctx, &c); + if (!NT_STATUS_IS_OK(status)) { + r->samr.out.error_string = talloc_asprintf(mem_ctx, + "Connection to SAMR pipe of PDC of domain '%s' failed: %s", + r->samr.in.domain_name, nt_errstr(status)); + return status; + } + + /* prepare samr_Connect */ + ZERO_STRUCT(p_handle); + sc.in.system_name = NULL; + sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + sc.out.connect_handle = &p_handle; + + /* 2. do a samr_Connect to get a policy handle */ + status = dcerpc_samr_Connect_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &sc); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sc.out.result)) { + status = sc.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr.out.error_string = talloc_asprintf(mem_ctx, + "samr_Connect failed: %s", + nt_errstr(status)); + goto disconnect; + } + + /* prepare samr_LookupDomain */ + d_name.string = r->samr.in.domain_name; + ld.in.connect_handle = &p_handle; + ld.in.domain_name = &d_name; + ld.out.sid = &sid; + + /* 3. do a samr_LookupDomain to get the domain sid */ + status = dcerpc_samr_LookupDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ld); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ld.out.result)) { + status = ld.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr.out.error_string = talloc_asprintf(mem_ctx, + "samr_LookupDomain for [%s] failed: %s", + r->samr.in.domain_name, nt_errstr(status)); + goto disconnect; + } + + /* prepare samr_OpenDomain */ + ZERO_STRUCT(d_handle); + od.in.connect_handle = &p_handle; + od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + od.in.sid = *ld.out.sid; + od.out.domain_handle = &d_handle; + + /* 4. do a samr_OpenDomain to get a domain handle */ + status = dcerpc_samr_OpenDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &od); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(od.out.result)) { + status = od.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr.out.error_string = talloc_asprintf(mem_ctx, + "samr_OpenDomain for [%s] failed: %s", + r->samr.in.domain_name, nt_errstr(status)); + goto disconnect; + } + + /* prepare samr_LookupNames */ + ln.in.domain_handle = &d_handle; + ln.in.num_names = 1; + ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1); + ln.out.rids = &rids; + ln.out.types = &types; + if (!ln.in.names) { + r->samr.out.error_string = "Out of Memory"; + return NT_STATUS_NO_MEMORY; + } + ln.in.names[0].string = r->samr.in.account_name; + + /* 5. do a samr_LookupNames to get the users rid */ + status = dcerpc_samr_LookupNames_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ln); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ln.out.result)) { + status = ln.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr.out.error_string = talloc_asprintf(mem_ctx, + "samr_LookupNames for [%s] failed: %s", + r->samr.in.account_name, nt_errstr(status)); + goto disconnect; + } + + /* check if we got one RID for the user */ + if (ln.out.rids->count != 1) { + r->samr.out.error_string = talloc_asprintf(mem_ctx, + "samr_LookupNames for [%s] returns %d RIDs", + r->samr.in.account_name, ln.out.rids->count); + status = NT_STATUS_INVALID_NETWORK_RESPONSE; + goto disconnect; + } + + if (ln.out.types->count != 1) { + r->samr.out.error_string = talloc_asprintf(mem_ctx, + "samr_LookupNames for [%s] returns %d RID TYPEs", + r->samr.in.account_name, ln.out.types->count); + status = NT_STATUS_INVALID_NETWORK_RESPONSE; + goto disconnect; + } + + /* prepare samr_OpenUser */ + ZERO_STRUCT(u_handle); + ou.in.domain_handle = &d_handle; + ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + ou.in.rid = ln.out.rids->ids[0]; + ou.out.user_handle = &u_handle; + + /* 6. do a samr_OpenUser to get a user handle */ + status = dcerpc_samr_OpenUser_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ou); + if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ou.out.result)) { + status = ou.out.result; + } + if (!NT_STATUS_IS_OK(status)) { + r->samr.out.error_string = talloc_asprintf(mem_ctx, + "samr_OpenUser for [%s] failed: %s", + r->samr.in.account_name, nt_errstr(status)); + goto disconnect; + } + + ZERO_STRUCT(r2); + r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE; + r2.samr_handle.samr_level = r->samr.samr_level; + r2.samr_handle.in.account_name = r->samr.in.account_name; + r2.samr_handle.in.newpassword = r->samr.in.newpassword; + r2.samr_handle.in.user_handle = &u_handle; + r2.samr_handle.in.dcerpc_pipe = c.out.dcerpc_pipe; + r2.samr_handle.in.info21 = NULL; + + status = libnet_SetPassword(ctx, mem_ctx, &r2); + + r->generic.out.error_string = r2.samr_handle.out.error_string; + +disconnect: + /* close connection */ + talloc_unlink(ctx, c.out.dcerpc_pipe); + + return status; +} + +static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r) +{ + NTSTATUS status; + union libnet_SetPassword r2; + + ZERO_STRUCT(r2); + r2.samr.level = LIBNET_SET_PASSWORD_SAMR; + r2.samr.samr_level = r->generic.samr_level; + r2.samr.in.account_name = r->generic.in.account_name; + r2.samr.in.domain_name = r->generic.in.domain_name; + r2.samr.in.newpassword = r->generic.in.newpassword; + + r->generic.out.error_string = "Unknown Error"; + status = libnet_SetPassword(ctx, mem_ctx, &r2); + + r->generic.out.error_string = r2.samr.out.error_string; + + return status; +} + +NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r) +{ + enum smb_encryption_setting encryption_state = + cli_credentials_get_smb_encryption(ctx->cred); + NTSTATUS status = NT_STATUS_INVALID_LEVEL; + + switch (r->generic.level) { + case LIBNET_SET_PASSWORD_GENERIC: + status = libnet_SetPassword_generic(ctx, mem_ctx, r); + break; + case LIBNET_SET_PASSWORD_SAMR: + status = libnet_SetPassword_samr(ctx, mem_ctx, r); + break; + case LIBNET_SET_PASSWORD_SAMR_HANDLE: + status = libnet_SetPassword_samr_handle(ctx, mem_ctx, r); + break; + case LIBNET_SET_PASSWORD_SAMR_HANDLE_26: + if (encryption_state == SMB_ENCRYPTION_REQUIRED) { + GNUTLS_FIPS140_SET_LAX_MODE(); + } + status = libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r); + break; + case LIBNET_SET_PASSWORD_SAMR_HANDLE_25: + if (encryption_state == SMB_ENCRYPTION_REQUIRED) { + GNUTLS_FIPS140_SET_LAX_MODE(); + } + status = libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r); + break; + case LIBNET_SET_PASSWORD_SAMR_HANDLE_24: + if (encryption_state == SMB_ENCRYPTION_REQUIRED) { + GNUTLS_FIPS140_SET_LAX_MODE(); + } + status = libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r); + break; + case LIBNET_SET_PASSWORD_SAMR_HANDLE_23: + if (encryption_state == SMB_ENCRYPTION_REQUIRED) { + GNUTLS_FIPS140_SET_LAX_MODE(); + } + status = libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r); + break; + case LIBNET_SET_PASSWORD_SAMR_HANDLE_18: + if (encryption_state == SMB_ENCRYPTION_REQUIRED) { + GNUTLS_FIPS140_SET_LAX_MODE(); + } + status = libnet_SetPassword_samr_handle_18(ctx, mem_ctx, r); + break; + case LIBNET_SET_PASSWORD_KRB5: + status = NT_STATUS_NOT_IMPLEMENTED; + break; + case LIBNET_SET_PASSWORD_LDAP: + status = NT_STATUS_NOT_IMPLEMENTED; + break; + case LIBNET_SET_PASSWORD_RAP: + status = NT_STATUS_NOT_IMPLEMENTED; + break; + } + + GNUTLS_FIPS140_SET_STRICT_MODE(); + return status; +} diff --git a/source4/libnet/libnet_passwd.h b/source4/libnet/libnet_passwd.h new file mode 100644 index 0000000..17e6aab --- /dev/null +++ b/source4/libnet/libnet_passwd.h @@ -0,0 +1,144 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/* struct and enum for doing a remote password change */ +enum libnet_ChangePassword_level { + LIBNET_CHANGE_PASSWORD_GENERIC, + LIBNET_CHANGE_PASSWORD_SAMR, + LIBNET_CHANGE_PASSWORD_KRB5, + LIBNET_CHANGE_PASSWORD_LDAP, + LIBNET_CHANGE_PASSWORD_RAP +}; + +union libnet_ChangePassword { + struct { + enum libnet_ChangePassword_level level; + + struct _libnet_ChangePassword_in { + const char *account_name; + const char *domain_name; + const char *oldpassword; + const char *newpassword; + } in; + + struct _libnet_ChangePassword_out { + const char *error_string; + } out; + } generic; + + struct { + enum libnet_ChangePassword_level level; + struct _libnet_ChangePassword_in in; + struct _libnet_ChangePassword_out out; + } samr; + + struct { + enum libnet_ChangePassword_level level; + struct _libnet_ChangePassword_in in; + struct _libnet_ChangePassword_out out; + } krb5; + + struct { + enum libnet_ChangePassword_level level; + struct _libnet_ChangePassword_in in; + struct _libnet_ChangePassword_out out; + } ldap; + + struct { + enum libnet_ChangePassword_level level; + struct _libnet_ChangePassword_in in; + struct _libnet_ChangePassword_out out; + } rap; +}; + +/* struct and enum for doing a remote password set */ +enum libnet_SetPassword_level { + LIBNET_SET_PASSWORD_GENERIC, + LIBNET_SET_PASSWORD_SAMR, + LIBNET_SET_PASSWORD_SAMR_HANDLE, + LIBNET_SET_PASSWORD_SAMR_HANDLE_26, + LIBNET_SET_PASSWORD_SAMR_HANDLE_25, + LIBNET_SET_PASSWORD_SAMR_HANDLE_24, + LIBNET_SET_PASSWORD_SAMR_HANDLE_23, + LIBNET_SET_PASSWORD_SAMR_HANDLE_18, + LIBNET_SET_PASSWORD_KRB5, + LIBNET_SET_PASSWORD_LDAP, + LIBNET_SET_PASSWORD_RAP +}; + +union libnet_SetPassword { + struct { + enum libnet_SetPassword_level level; + enum libnet_SetPassword_level samr_level; + + struct _libnet_SetPassword_in { + const char *account_name; + const char *domain_name; + const char *newpassword; + } in; + + struct _libnet_SetPassword_out { + const char *error_string; + } out; + } generic; + + struct { + enum libnet_SetPassword_level level; + enum libnet_SetPassword_level samr_level; + struct _libnet_SetPassword_samr_handle_in { + const char *account_name; /* for debug only */ + struct policy_handle *user_handle; + struct dcerpc_pipe *dcerpc_pipe; + const char *newpassword; + struct samr_UserInfo21 *info21; /* can be NULL, + * for level 26,24 it must be NULL + * for level 25,23 it must be non-NULL + */ + } in; + struct _libnet_SetPassword_out out; + } samr_handle; + + struct { + enum libnet_SetPassword_level level; + enum libnet_SetPassword_level samr_level; + struct _libnet_SetPassword_in in; + struct _libnet_SetPassword_out out; + } samr; + + struct { + enum libnet_SetPassword_level level; + enum libnet_SetPassword_level samr_level; + struct _libnet_SetPassword_in in; + struct _libnet_SetPassword_out out; + } krb5; + + struct { + enum libnet_SetPassword_level level; + enum libnet_SetPassword_level samr_level; + struct _libnet_SetPassword_in in; + struct _libnet_SetPassword_out out; + } ldap; + + struct { + enum libnet_ChangePassword_level level; + enum libnet_SetPassword_level samr_level; + struct _libnet_SetPassword_in in; + struct _libnet_SetPassword_out out; + } rap; +}; diff --git a/source4/libnet/libnet_rpc.c b/source4/libnet/libnet_rpc.c new file mode 100644 index 0000000..91c538f --- /dev/null +++ b/source4/libnet/libnet_rpc.c @@ -0,0 +1,1037 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "libcli/libcli.h" +#include "libcli/composite/composite.h" +#include "librpc/rpc/dcerpc_proto.h" +#include "librpc/gen_ndr/ndr_lsa_c.h" +#include "librpc/gen_ndr/ndr_samr.h" +#include "auth/credentials/credentials.h" + +struct rpc_connect_srv_state { + struct libnet_context *ctx; + struct libnet_RpcConnect r; + const char *binding; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_pipe_connect(struct composite_context *ctx); + + +/** + * Initiates connection to rpc pipe on remote server + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r data structure containing necessary parameters and return values + * @return composite context of this call + **/ + +static struct composite_context* libnet_RpcConnectSrv_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_RpcConnect *r, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct rpc_connect_srv_state *s; + struct dcerpc_binding *b; + struct composite_context *pipe_connect_req; + + /* composite context allocation and setup */ + c = composite_create(ctx, ctx->event_ctx); + if (c == NULL) return c; + + s = talloc_zero(c, struct rpc_connect_srv_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + s->monitor_fn = monitor; + + s->ctx = ctx; + s->r = *r; + ZERO_STRUCT(s->r.out); + + /* prepare binding string */ + switch (r->level) { + case LIBNET_RPC_CONNECT_SERVER: + s->binding = talloc_asprintf(s, "ncacn_np:%s", r->in.name); + break; + case LIBNET_RPC_CONNECT_SERVER_ADDRESS: + s->binding = talloc_asprintf(s, "ncacn_np:%s[target_hostname=%s]", + r->in.address, r->in.name); + break; + + case LIBNET_RPC_CONNECT_BINDING: + s->binding = talloc_strdup(s, r->in.binding); + break; + + case LIBNET_RPC_CONNECT_DC: + case LIBNET_RPC_CONNECT_PDC: + /* this should never happen - DC and PDC level has a separate + composite function */ + case LIBNET_RPC_CONNECT_DC_INFO: + /* this should never happen - DC_INFO level has a separate + composite function */ + composite_error(c, NT_STATUS_INVALID_LEVEL); + return c; + } + + /* parse binding string to the structure */ + c->status = dcerpc_parse_binding(c, s->binding, &b); + if (!NT_STATUS_IS_OK(c->status)) { + DEBUG(0, ("Failed to parse dcerpc binding '%s'\n", s->binding)); + composite_error(c, c->status); + return c; + } + + switch (r->level) { + case LIBNET_RPC_CONNECT_SERVER: + case LIBNET_RPC_CONNECT_SERVER_ADDRESS: + c->status = dcerpc_binding_set_flags(b, r->in.dcerpc_flags, 0); + if (!composite_is_ok(c)) return c; + break; + default: + /* other types have already been checked before */ + break; + } + + if (DEBUGLEVEL >= 10) { + c->status = dcerpc_binding_set_flags(b, DCERPC_DEBUG_PRINT_BOTH, 0); + if (!composite_is_ok(c)) return c; + } + + /* connect to remote dcerpc pipe */ + pipe_connect_req = dcerpc_pipe_connect_b_send(c, b, r->in.dcerpc_iface, + ctx->cred, c->event_ctx, + ctx->lp_ctx); + if (composite_nomem(pipe_connect_req, c)) return c; + + composite_continue(c, pipe_connect_req, continue_pipe_connect, c); + return c; +} + + +/* + Step 2 of RpcConnectSrv - get rpc connection +*/ +static void continue_pipe_connect(struct composite_context *ctx) +{ + struct composite_context *c; + struct rpc_connect_srv_state *s; + + c = talloc_get_type(ctx->async.private_data, struct composite_context); + s = talloc_get_type(c->private_data, struct rpc_connect_srv_state); + + /* receive result of rpc pipe connection */ + c->status = dcerpc_pipe_connect_b_recv(ctx, c, &s->r.out.dcerpc_pipe); + + /* post monitor message */ + if (s->monitor_fn) { + struct monitor_msg msg; + struct msg_net_rpc_connect data; + const struct dcerpc_binding *b = s->r.out.dcerpc_pipe->binding; + + /* prepare monitor message and post it */ + data.host = dcerpc_binding_get_string_option(b, "host"); + data.endpoint = dcerpc_binding_get_string_option(b, "endpoint"); + data.transport = dcerpc_binding_get_transport(b); + data.domain_name = dcerpc_binding_get_string_option(b, "target_hostname"); + + msg.type = mon_NetRpcConnect; + msg.data = (void*)&data; + msg.data_size = sizeof(data); + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +/** + * Receives result of connection to rpc pipe on remote server + * + * @param c composite context + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r data structure containing necessary parameters and return values + * @return nt status of rpc connection + **/ + +static NTSTATUS libnet_RpcConnectSrv_recv(struct composite_context *c, + struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_RpcConnect *r) +{ + NTSTATUS status; + + status = composite_wait(c); + if (NT_STATUS_IS_OK(status)) { + struct rpc_connect_srv_state *s; + + /* move the returned rpc pipe between memory contexts */ + s = talloc_get_type(c->private_data, struct rpc_connect_srv_state); + r->out.dcerpc_pipe = talloc_steal(mem_ctx, s->r.out.dcerpc_pipe); + + /* reference created pipe structure to long-term libnet_context + so that it can be used by other api functions even after short-term + mem_ctx is freed */ + if (r->in.dcerpc_iface == &ndr_table_samr) { + ctx->samr.pipe = talloc_reference(ctx, r->out.dcerpc_pipe); + ctx->samr.samr_handle = ctx->samr.pipe->binding_handle; + + } else if (r->in.dcerpc_iface == &ndr_table_lsarpc) { + ctx->lsa.pipe = talloc_reference(ctx, r->out.dcerpc_pipe); + ctx->lsa.lsa_handle = ctx->lsa.pipe->binding_handle; + } + + r->out.error_string = talloc_strdup(mem_ctx, "Success"); + + } else { + r->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +struct rpc_connect_dc_state { + struct libnet_context *ctx; + struct libnet_RpcConnect r; + struct libnet_RpcConnect r2; + struct libnet_LookupDCs f; + const char *connect_name; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_lookup_dc(struct tevent_req *req); +static void continue_rpc_connect(struct composite_context *ctx); + + +/** + * Initiates connection to rpc pipe on domain pdc + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r data structure containing necessary parameters and return values + * @return composite context of this call + **/ + +static struct composite_context* libnet_RpcConnectDC_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_RpcConnect *r, + void (*monitor)(struct monitor_msg *msg)) +{ + struct composite_context *c; + struct rpc_connect_dc_state *s; + struct tevent_req *lookup_dc_req; + + /* composite context allocation and setup */ + c = composite_create(ctx, ctx->event_ctx); + if (c == NULL) return c; + + s = talloc_zero(c, struct rpc_connect_dc_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + s->monitor_fn = monitor; + + s->ctx = ctx; + s->r = *r; + ZERO_STRUCT(s->r.out); + + switch (r->level) { + case LIBNET_RPC_CONNECT_PDC: + s->f.in.name_type = NBT_NAME_PDC; + break; + + case LIBNET_RPC_CONNECT_DC: + s->f.in.name_type = NBT_NAME_LOGON; + break; + + default: + break; + } + + s->f.in.domain_name = r->in.name; + s->f.out.num_dcs = 0; + s->f.out.dcs = NULL; + + /* find the domain pdc first */ + lookup_dc_req = libnet_LookupDCs_send(ctx, c, &s->f); + if (composite_nomem(lookup_dc_req, c)) return c; + + tevent_req_set_callback(lookup_dc_req, continue_lookup_dc, c); + return c; +} + + +/* + Step 2 of RpcConnectDC: get domain controller name and + initiate RpcConnect to it +*/ +static void continue_lookup_dc(struct tevent_req *req) +{ + struct composite_context *c; + struct rpc_connect_dc_state *s; + struct composite_context *rpc_connect_req; + struct monitor_msg msg; + struct msg_net_lookup_dc data; + + c = tevent_req_callback_data(req, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct rpc_connect_dc_state); + + /* receive result of domain controller lookup */ + c->status = libnet_LookupDCs_recv(req, c, &s->f); + if (!composite_is_ok(c)) return; + + /* decide on preferred address type depending on DC type */ + s->connect_name = s->f.out.dcs[0].name; + + /* post monitor message */ + if (s->monitor_fn) { + /* prepare a monitor message and post it */ + data.domain_name = s->f.in.domain_name; + data.hostname = s->f.out.dcs[0].name; + data.address = s->f.out.dcs[0].address; + + msg.type = mon_NetLookupDc; + msg.data = &data; + msg.data_size = sizeof(data); + s->monitor_fn(&msg); + } + + /* ok, pdc has been found so do attempt to rpc connect */ + s->r2.level = LIBNET_RPC_CONNECT_SERVER_ADDRESS; + + /* this will cause yet another name resolution, but at least + * we pass the right name down the stack now */ + s->r2.in.name = talloc_strdup(s, s->connect_name); + s->r2.in.address = talloc_steal(s, s->f.out.dcs[0].address); + s->r2.in.dcerpc_iface = s->r.in.dcerpc_iface; + s->r2.in.dcerpc_flags = s->r.in.dcerpc_flags; + + /* send rpc connect request to the server */ + rpc_connect_req = libnet_RpcConnectSrv_send(s->ctx, c, &s->r2, s->monitor_fn); + if (composite_nomem(rpc_connect_req, c)) return; + + composite_continue(c, rpc_connect_req, continue_rpc_connect, c); +} + + +/* + Step 3 of RpcConnectDC: get rpc connection to the server +*/ +static void continue_rpc_connect(struct composite_context *ctx) +{ + struct composite_context *c; + struct rpc_connect_dc_state *s; + + c = talloc_get_type(ctx->async.private_data, struct composite_context); + s = talloc_get_type(c->private_data, struct rpc_connect_dc_state); + + c->status = libnet_RpcConnectSrv_recv(ctx, s->ctx, c, &s->r2); + + /* error string is to be passed anyway */ + s->r.out.error_string = s->r2.out.error_string; + if (!composite_is_ok(c)) return; + + s->r.out.dcerpc_pipe = s->r2.out.dcerpc_pipe; + + /* post monitor message */ + if (s->monitor_fn) { + struct monitor_msg msg; + struct msg_net_rpc_connect data; + const struct dcerpc_binding *b = s->r.out.dcerpc_pipe->binding; + + data.host = dcerpc_binding_get_string_option(b, "host"); + data.endpoint = dcerpc_binding_get_string_option(b, "endpoint"); + data.transport = dcerpc_binding_get_transport(b); + data.domain_name = dcerpc_binding_get_string_option(b, "target_hostname"); + + msg.type = mon_NetRpcConnect; + msg.data = (void*)&data; + msg.data_size = sizeof(data); + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +/** + * Receives result of connection to rpc pipe on domain pdc + * + * @param c composite context + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r data structure containing necessary parameters and return values + * @return nt status of rpc connection + **/ + +static NTSTATUS libnet_RpcConnectDC_recv(struct composite_context *c, + struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_RpcConnect *r) +{ + NTSTATUS status; + struct rpc_connect_dc_state *s = talloc_get_type(c->private_data, + struct rpc_connect_dc_state); + + status = composite_wait(c); + if (NT_STATUS_IS_OK(status)) { + /* move connected rpc pipe between memory contexts + + The use of talloc_reparent(talloc_parent(), ...) is + bizarre, but it is needed because of the absolutely + atrocious use of talloc in this code. We need to + force the original parent to change, but finding + the original parent is well nigh impossible at this + point in the code (yes, I tried). + */ + r->out.dcerpc_pipe = talloc_reparent(talloc_parent(s->r.out.dcerpc_pipe), + mem_ctx, s->r.out.dcerpc_pipe); + + /* reference created pipe structure to long-term libnet_context + so that it can be used by other api functions even after short-term + mem_ctx is freed */ + if (r->in.dcerpc_iface == &ndr_table_samr) { + ctx->samr.pipe = talloc_reference(ctx, r->out.dcerpc_pipe); + ctx->samr.samr_handle = ctx->samr.pipe->binding_handle; + } else if (r->in.dcerpc_iface == &ndr_table_lsarpc) { + ctx->lsa.pipe = talloc_reference(ctx, r->out.dcerpc_pipe); + ctx->lsa.lsa_handle = ctx->lsa.pipe->binding_handle; + } + + } else { + r->out.error_string = talloc_asprintf(mem_ctx, + "Failed to rpc connect: %s", + nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + + +struct rpc_connect_dci_state { + struct libnet_context *ctx; + struct libnet_RpcConnect r; + struct libnet_RpcConnect rpc_conn; + struct policy_handle lsa_handle; + struct lsa_QosInfo qos; + struct lsa_ObjectAttribute attr; + struct lsa_OpenPolicy2 lsa_open_policy; + struct dcerpc_pipe *lsa_pipe; + struct lsa_QueryInfoPolicy2 lsa_query_info2; + struct lsa_QueryInfoPolicy lsa_query_info; + struct dcerpc_binding *final_binding; + struct dcerpc_pipe *final_pipe; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_dci_rpc_connect(struct composite_context *ctx); +static void continue_lsa_policy(struct tevent_req *subreq); +static void continue_lsa_query_info(struct tevent_req *subreq); +static void continue_lsa_query_info2(struct tevent_req *subreq); +static void continue_epm_map_binding(struct composite_context *ctx); +static void continue_secondary_conn(struct composite_context *ctx); +static void continue_epm_map_binding_send(struct composite_context *c); + + +/** + * Initiates connection to rpc pipe on remote server or pdc. Received result + * contains info on the domain name, domain sid and realm. + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r data structure containing necessary parameters and return values. Must be a talloc context + * @return composite context of this call + **/ + +static struct composite_context* libnet_RpcConnectDCInfo_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_RpcConnect *r, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c, *conn_req; + struct rpc_connect_dci_state *s; + + /* composite context allocation and setup */ + c = composite_create(ctx, ctx->event_ctx); + if (c == NULL) return c; + + s = talloc_zero(c, struct rpc_connect_dci_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + s->monitor_fn = monitor; + + s->ctx = ctx; + s->r = *r; + ZERO_STRUCT(s->r.out); + + + /* proceed to pure rpc connection if the binding string is provided, + otherwise try to connect domain controller */ + if (r->in.binding == NULL) { + /* Pass on any binding flags (such as anonymous fallback) that have been set */ + s->rpc_conn.in.dcerpc_flags = r->in.dcerpc_flags; + + s->rpc_conn.in.name = r->in.name; + s->rpc_conn.level = LIBNET_RPC_CONNECT_DC; + } else { + s->rpc_conn.in.binding = r->in.binding; + s->rpc_conn.level = LIBNET_RPC_CONNECT_BINDING; + } + + /* we need to query information on lsarpc interface first */ + s->rpc_conn.in.dcerpc_iface = &ndr_table_lsarpc; + + /* request connection to the lsa pipe on the pdc */ + conn_req = libnet_RpcConnect_send(ctx, c, &s->rpc_conn, s->monitor_fn); + if (composite_nomem(c, conn_req)) return c; + + composite_continue(c, conn_req, continue_dci_rpc_connect, c); + return c; +} + + +/* + Step 2 of RpcConnectDCInfo: receive opened rpc pipe and open + lsa policy handle +*/ +static void continue_dci_rpc_connect(struct composite_context *ctx) +{ + struct composite_context *c; + struct rpc_connect_dci_state *s; + struct tevent_req *subreq; + enum dcerpc_transport_t transport; + + c = talloc_get_type(ctx->async.private_data, struct composite_context); + s = talloc_get_type(c->private_data, struct rpc_connect_dci_state); + + c->status = libnet_RpcConnect_recv(ctx, s->ctx, c, &s->rpc_conn); + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + /* post monitor message */ + if (s->monitor_fn) { + struct monitor_msg msg; + struct msg_net_rpc_connect data; + const struct dcerpc_binding *b = s->r.out.dcerpc_pipe->binding; + + data.host = dcerpc_binding_get_string_option(b, "host"); + data.endpoint = dcerpc_binding_get_string_option(b, "endpoint"); + data.transport = dcerpc_binding_get_transport(b); + data.domain_name = dcerpc_binding_get_string_option(b, "target_hostname"); + + msg.type = mon_NetRpcConnect; + msg.data = (void*)&data; + msg.data_size = sizeof(data); + s->monitor_fn(&msg); + } + + /* prepare to open a policy handle on lsa pipe */ + s->lsa_pipe = s->ctx->lsa.pipe; + + s->qos.len = 0; + s->qos.impersonation_level = 2; + s->qos.context_mode = 1; + s->qos.effective_only = 0; + + s->attr.sec_qos = &s->qos; + + transport = dcerpc_binding_get_transport(s->lsa_pipe->binding); + if (transport == NCACN_IP_TCP) { + /* + * Skip to creating the actual connection. We can't open a + * policy handle over tcpip. + */ + continue_epm_map_binding_send(c); + return; + } + + s->lsa_open_policy.in.attr = &s->attr; + s->lsa_open_policy.in.system_name = talloc_asprintf(c, "\\"); + if (composite_nomem(s->lsa_open_policy.in.system_name, c)) return; + + s->lsa_open_policy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + s->lsa_open_policy.out.handle = &s->lsa_handle; + + subreq = dcerpc_lsa_OpenPolicy2_r_send(s, c->event_ctx, + s->lsa_pipe->binding_handle, + &s->lsa_open_policy); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_lsa_policy, c); +} + + +/* + Step 3 of RpcConnectDCInfo: Get policy handle and query lsa info + for kerberos realm (dns name) and guid. The query may fail. +*/ +static void continue_lsa_policy(struct tevent_req *subreq) +{ + struct composite_context *c; + struct rpc_connect_dci_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct rpc_connect_dci_state); + + c->status = dcerpc_lsa_OpenPolicy2_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + if (NT_STATUS_EQUAL(s->lsa_open_policy.out.result, NT_STATUS_RPC_PROTSEQ_NOT_SUPPORTED)) { + s->r.out.realm = NULL; + s->r.out.guid = NULL; + s->r.out.domain_name = NULL; + s->r.out.domain_sid = NULL; + + /* Skip to the creating the actual connection, no info available on this transport */ + continue_epm_map_binding_send(c); + return; + + } else if (!NT_STATUS_IS_OK(s->lsa_open_policy.out.result)) { + composite_error(c, s->lsa_open_policy.out.result); + return; + } + + /* post monitor message */ + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_LsaOpenPolicy; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + /* query lsa info for dns domain name and guid */ + s->lsa_query_info2.in.handle = &s->lsa_handle; + s->lsa_query_info2.in.level = LSA_POLICY_INFO_DNS; + s->lsa_query_info2.out.info = talloc_zero(c, union lsa_PolicyInformation *); + if (composite_nomem(s->lsa_query_info2.out.info, c)) return; + + subreq = dcerpc_lsa_QueryInfoPolicy2_r_send(s, c->event_ctx, + s->lsa_pipe->binding_handle, + &s->lsa_query_info2); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_lsa_query_info2, c); +} + + +/* + Step 4 of RpcConnectDCInfo: Get realm and guid if provided (rpc call + may result in failure) and query lsa info for domain name and sid. +*/ +static void continue_lsa_query_info2(struct tevent_req *subreq) +{ + struct composite_context *c; + struct rpc_connect_dci_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct rpc_connect_dci_state); + + c->status = dcerpc_lsa_QueryInfoPolicy2_r_recv(subreq, s); + TALLOC_FREE(subreq); + + /* In case of error just null the realm and guid and proceed + to the next step. After all, it doesn't have to be AD domain + controller we talking to - NT-style PDC also counts */ + + if (NT_STATUS_EQUAL(c->status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) { + s->r.out.realm = NULL; + s->r.out.guid = NULL; + + } else { + if (!NT_STATUS_IS_OK(c->status)) { + s->r.out.error_string = talloc_asprintf(c, + "lsa_QueryInfoPolicy2 failed: %s", + nt_errstr(c->status)); + composite_error(c, c->status); + return; + } + + if (!NT_STATUS_IS_OK(s->lsa_query_info2.out.result)) { + s->r.out.error_string = talloc_asprintf(c, + "lsa_QueryInfoPolicy2 failed: %s", + nt_errstr(s->lsa_query_info2.out.result)); + composite_error(c, s->lsa_query_info2.out.result); + return; + } + + /* Copy the dns domain name and guid from the query result */ + + /* this should actually be a conversion from lsa_StringLarge */ + s->r.out.realm = (*s->lsa_query_info2.out.info)->dns.dns_domain.string; + s->r.out.guid = talloc(c, struct GUID); + if (composite_nomem(s->r.out.guid, c)) { + s->r.out.error_string = NULL; + return; + } + *s->r.out.guid = (*s->lsa_query_info2.out.info)->dns.domain_guid; + } + + /* post monitor message */ + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_LsaQueryPolicy; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + /* query lsa info for domain name and sid */ + s->lsa_query_info.in.handle = &s->lsa_handle; + s->lsa_query_info.in.level = LSA_POLICY_INFO_DOMAIN; + s->lsa_query_info.out.info = talloc_zero(c, union lsa_PolicyInformation *); + if (composite_nomem(s->lsa_query_info.out.info, c)) return; + + subreq = dcerpc_lsa_QueryInfoPolicy_r_send(s, c->event_ctx, + s->lsa_pipe->binding_handle, + &s->lsa_query_info); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_lsa_query_info, c); +} + + +/* + Step 5 of RpcConnectDCInfo: Get domain name and sid +*/ +static void continue_lsa_query_info(struct tevent_req *subreq) +{ + struct composite_context *c; + struct rpc_connect_dci_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct rpc_connect_dci_state); + + c->status = dcerpc_lsa_QueryInfoPolicy_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!NT_STATUS_IS_OK(c->status)) { + s->r.out.error_string = talloc_asprintf(c, + "lsa_QueryInfoPolicy failed: %s", + nt_errstr(c->status)); + composite_error(c, c->status); + return; + } + + /* post monitor message */ + if (s->monitor_fn) { + struct monitor_msg msg; + + msg.type = mon_LsaQueryPolicy; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + /* Copy the domain name and sid from the query result */ + s->r.out.domain_sid = (*s->lsa_query_info.out.info)->domain.sid; + s->r.out.domain_name = (*s->lsa_query_info.out.info)->domain.name.string; + + continue_epm_map_binding_send(c); +} + +/* + Step 5 (continued) of RpcConnectDCInfo: request endpoint + map binding. + + We may short-cut to this step if we don't support LSA OpenPolicy on this transport +*/ +static void continue_epm_map_binding_send(struct composite_context *c) +{ + struct rpc_connect_dci_state *s; + struct composite_context *epm_map_req; + struct cli_credentials *epm_creds = NULL; + + s = talloc_get_type(c->private_data, struct rpc_connect_dci_state); + + /* prepare to get endpoint mapping for the requested interface */ + s->final_binding = dcerpc_binding_dup(s, s->lsa_pipe->binding); + if (composite_nomem(s->final_binding, c)) return; + + /* + * We don't want to inherit the assoc_group_id from the + * lsa_pipe here! + */ + dcerpc_binding_set_assoc_group_id(s->final_binding, 0); + + epm_creds = cli_credentials_init_anon(s); + if (composite_nomem(epm_creds, c)) return; + + epm_map_req = dcerpc_epm_map_binding_send(c, s->final_binding, s->r.in.dcerpc_iface, + epm_creds, + s->ctx->event_ctx, s->ctx->lp_ctx); + if (composite_nomem(epm_map_req, c)) return; + + composite_continue(c, epm_map_req, continue_epm_map_binding, c); +} + +/* + Step 6 of RpcConnectDCInfo: Receive endpoint mapping and create secondary + rpc connection derived from already used pipe but connected to the requested + one (as specified in libnet_RpcConnect structure) +*/ +static void continue_epm_map_binding(struct composite_context *ctx) +{ + struct composite_context *c, *sec_conn_req; + struct rpc_connect_dci_state *s; + + c = talloc_get_type(ctx->async.private_data, struct composite_context); + s = talloc_get_type(c->private_data, struct rpc_connect_dci_state); + + c->status = dcerpc_epm_map_binding_recv(ctx); + if (!NT_STATUS_IS_OK(c->status)) { + s->r.out.error_string = talloc_asprintf(c, + "failed to map pipe with endpoint mapper - %s", + nt_errstr(c->status)); + composite_error(c, c->status); + return; + } + + /* create secondary connection derived from lsa pipe */ + sec_conn_req = dcerpc_secondary_auth_connection_send(s->lsa_pipe, + s->final_binding, + s->r.in.dcerpc_iface, + s->ctx->cred, + s->ctx->lp_ctx); + if (composite_nomem(sec_conn_req, c)) return; + + composite_continue(c, sec_conn_req, continue_secondary_conn, c); +} + + +/* + Step 7 of RpcConnectDCInfo: Get actual pipe to be returned + and complete this composite call +*/ +static void continue_secondary_conn(struct composite_context *ctx) +{ + struct composite_context *c; + struct rpc_connect_dci_state *s; + + c = talloc_get_type(ctx->async.private_data, struct composite_context); + s = talloc_get_type(c->private_data, struct rpc_connect_dci_state); + + c->status = dcerpc_secondary_auth_connection_recv(ctx, s->lsa_pipe, + &s->final_pipe); + if (!NT_STATUS_IS_OK(c->status)) { + s->r.out.error_string = talloc_asprintf(c, + "secondary connection failed: %s", + nt_errstr(c->status)); + + composite_error(c, c->status); + return; + } + + s->r.out.dcerpc_pipe = s->final_pipe; + + /* post monitor message */ + if (s->monitor_fn) { + struct monitor_msg msg; + struct msg_net_rpc_connect data; + const struct dcerpc_binding *b = s->r.out.dcerpc_pipe->binding; + + /* prepare monitor message and post it */ + data.host = dcerpc_binding_get_string_option(b, "host"); + data.endpoint = dcerpc_binding_get_string_option(b, "endpoint"); + data.transport = dcerpc_binding_get_transport(b); + data.domain_name = dcerpc_binding_get_string_option(b, "target_hostname"); + + msg.type = mon_NetRpcConnect; + msg.data = (void*)&data; + msg.data_size = sizeof(data); + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +/** + * Receives result of connection to rpc pipe and gets basic + * domain info (name, sid, realm, guid) + * + * @param c composite context + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r data structure containing return values + * @return nt status of rpc connection + **/ + +static NTSTATUS libnet_RpcConnectDCInfo_recv(struct composite_context *c, struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r) +{ + NTSTATUS status; + struct rpc_connect_dci_state *s = talloc_get_type(c->private_data, + struct rpc_connect_dci_state); + + status = composite_wait(c); + if (NT_STATUS_IS_OK(status)) { + r->out.realm = talloc_steal(mem_ctx, s->r.out.realm); + r->out.guid = talloc_steal(mem_ctx, s->r.out.guid); + r->out.domain_name = talloc_steal(mem_ctx, s->r.out.domain_name); + r->out.domain_sid = talloc_steal(mem_ctx, s->r.out.domain_sid); + + r->out.dcerpc_pipe = talloc_steal(mem_ctx, s->r.out.dcerpc_pipe); + + /* reference created pipe structure to long-term libnet_context + so that it can be used by other api functions even after short-term + mem_ctx is freed */ + if (r->in.dcerpc_iface == &ndr_table_samr) { + ctx->samr.pipe = talloc_reference(ctx, r->out.dcerpc_pipe); + ctx->samr.samr_handle = ctx->samr.pipe->binding_handle; + + } else if (r->in.dcerpc_iface == &ndr_table_lsarpc) { + ctx->lsa.pipe = talloc_reference(ctx, r->out.dcerpc_pipe); + ctx->lsa.lsa_handle = ctx->lsa.pipe->binding_handle; + } + + } else { + if (s->r.out.error_string) { + r->out.error_string = talloc_steal(mem_ctx, s->r.out.error_string); + } else if (r->in.binding == NULL) { + r->out.error_string = talloc_asprintf(mem_ctx, "Connection to DC failed: %s", nt_errstr(status)); + } else { + r->out.error_string = talloc_asprintf(mem_ctx, "Connection to DC %s failed: %s", + r->in.binding, nt_errstr(status)); + } + } + + talloc_free(c); + return status; +} + + +/** + * Initiates connection to rpc pipe on remote server or pdc, optionally + * providing domain info + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r data structure containing necessary parameters and return values + * @return composite context of this call + **/ + +struct composite_context* libnet_RpcConnect_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_RpcConnect *r, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + + switch (r->level) { + case LIBNET_RPC_CONNECT_SERVER: + case LIBNET_RPC_CONNECT_SERVER_ADDRESS: + case LIBNET_RPC_CONNECT_BINDING: + c = libnet_RpcConnectSrv_send(ctx, mem_ctx, r, monitor); + break; + + case LIBNET_RPC_CONNECT_PDC: + case LIBNET_RPC_CONNECT_DC: + c = libnet_RpcConnectDC_send(ctx, mem_ctx, r, monitor); + break; + + case LIBNET_RPC_CONNECT_DC_INFO: + c = libnet_RpcConnectDCInfo_send(ctx, mem_ctx, r, monitor); + break; + + default: + c = talloc_zero(mem_ctx, struct composite_context); + composite_error(c, NT_STATUS_INVALID_LEVEL); + } + + return c; +} + + +/** + * Receives result of connection to rpc pipe on remote server or pdc + * + * @param c composite context + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r data structure containing necessary parameters and return values + * @return nt status of rpc connection + **/ + +NTSTATUS libnet_RpcConnect_recv(struct composite_context *c, struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r) +{ + switch (r->level) { + case LIBNET_RPC_CONNECT_SERVER: + case LIBNET_RPC_CONNECT_BINDING: + return libnet_RpcConnectSrv_recv(c, ctx, mem_ctx, r); + + case LIBNET_RPC_CONNECT_PDC: + case LIBNET_RPC_CONNECT_DC: + return libnet_RpcConnectDC_recv(c, ctx, mem_ctx, r); + + case LIBNET_RPC_CONNECT_DC_INFO: + return libnet_RpcConnectDCInfo_recv(c, ctx, mem_ctx, r); + + default: + ZERO_STRUCT(r->out); + return NT_STATUS_INVALID_LEVEL; + } +} + + +/** + * Connect to a rpc pipe on a remote server - sync version + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r data structure containing necessary parameters and return values + * @return nt status of rpc connection + **/ + +NTSTATUS libnet_RpcConnect(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_RpcConnect *r) +{ + struct composite_context *c; + + c = libnet_RpcConnect_send(ctx, mem_ctx, r, NULL); + return libnet_RpcConnect_recv(c, ctx, mem_ctx, r); +} diff --git a/source4/libnet/libnet_rpc.h b/source4/libnet/libnet_rpc.h new file mode 100644 index 0000000..e057c6d --- /dev/null +++ b/source4/libnet/libnet_rpc.h @@ -0,0 +1,73 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +#include "librpc/rpc/dcerpc.h" + +/* + * struct definition for connecting to a dcerpc interface + */ + +enum libnet_RpcConnect_level { + LIBNET_RPC_CONNECT_SERVER, /* connect to a standalone rpc server */ + LIBNET_RPC_CONNECT_SERVER_ADDRESS, /* connect to a standalone rpc server, + knowing both name and address */ + LIBNET_RPC_CONNECT_PDC, /* connect to a domain pdc (resolves domain + name to a pdc address before connecting) */ + LIBNET_RPC_CONNECT_DC, /* connect to any DC (resolves domain + name to a DC address before connecting) */ + LIBNET_RPC_CONNECT_BINDING, /* specified binding string */ + LIBNET_RPC_CONNECT_DC_INFO /* connect to a DC and provide basic domain + information (name, realm, sid, guid) */ +}; + +struct libnet_RpcConnect { + enum libnet_RpcConnect_level level; + + struct { + const char *name; + const char *address; + const char *binding; + const struct ndr_interface_table *dcerpc_iface; + int dcerpc_flags; + } in; + struct { + struct dcerpc_pipe *dcerpc_pipe; + + /* parameters provided in LIBNET_RPC_CONNECT_DC_INFO level, null otherwise */ + const char *domain_name; + struct dom_sid *domain_sid; + const char *realm; /* these parameters are only present if */ + struct GUID *guid; /* the remote server is known to be AD */ + + const char *error_string; + } out; +}; + + +/* + * Monitor messages sent from libnet_rpc.c functions + */ + +struct msg_net_rpc_connect { + const char *host; + const char *domain_name; + const char *endpoint; + enum dcerpc_transport_t transport; +}; diff --git a/source4/libnet/libnet_samsync.h b/source4/libnet/libnet_samsync.h new file mode 100644 index 0000000..fb938d0 --- /dev/null +++ b/source4/libnet/libnet_samsync.h @@ -0,0 +1,32 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "librpc/gen_ndr/netlogon.h" + +struct libnet_SamDump_keytab { + struct { + const char *binding_string; + const char *keytab_name; + struct cli_credentials *machine_account; + } in; + struct { + const char *error_string; + } out; +}; + diff --git a/source4/libnet/libnet_share.c b/source4/libnet/libnet_share.c new file mode 100644 index 0000000..d8e8240 --- /dev/null +++ b/source4/libnet/libnet_share.c @@ -0,0 +1,215 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Grégory LEOCADIE <gleocadie@idealx.com> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "librpc/gen_ndr/ndr_srvsvc_c.h" + + +NTSTATUS libnet_ListShares(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_ListShares *r) +{ + NTSTATUS status; + struct libnet_RpcConnect c; + struct srvsvc_NetShareEnumAll s; + struct srvsvc_NetShareInfoCtr info_ctr; + uint32_t resume_handle = 0; + uint32_t totalentries = 0; + struct srvsvc_NetShareCtr0 ctr0; + struct srvsvc_NetShareCtr1 ctr1; + struct srvsvc_NetShareCtr2 ctr2; + struct srvsvc_NetShareCtr501 ctr501; + struct srvsvc_NetShareCtr502 ctr502; + + ZERO_STRUCT(c); + + c.level = LIBNET_RPC_CONNECT_SERVER; + c.in.name = r->in.server_name; + c.in.dcerpc_iface = &ndr_table_srvsvc; + + s.in.server_unc = talloc_asprintf(mem_ctx, "\\\\%s", c.in.name); + + status = libnet_RpcConnect(ctx, mem_ctx, &c); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "Connection to SRVSVC pipe of server %s " + "failed: %s", + r->in.server_name, + nt_errstr(status)); + return status; + } + + info_ctr.level = r->in.level; + switch (info_ctr.level) { + case 0: + info_ctr.ctr.ctr0 = &ctr0; + ZERO_STRUCT(ctr0); + break; + case 1: + info_ctr.ctr.ctr1 = &ctr1; + ZERO_STRUCT(ctr1); + break; + case 2: + info_ctr.ctr.ctr2 = &ctr2; + ZERO_STRUCT(ctr2); + break; + case 501: + info_ctr.ctr.ctr501 = &ctr501; + ZERO_STRUCT(ctr501); + break; + case 502: + info_ctr.ctr.ctr502 = &ctr502; + ZERO_STRUCT(ctr502); + break; + default: + r->out.error_string = talloc_asprintf(mem_ctx, + "libnet_ListShares: Invalid info level requested: %d", + info_ctr.level); + return NT_STATUS_INVALID_PARAMETER; + } + s.in.max_buffer = ~0; + s.in.resume_handle = &resume_handle; + s.in.info_ctr = &info_ctr; + s.out.info_ctr = &info_ctr; + s.out.totalentries = &totalentries; + + status = dcerpc_srvsvc_NetShareEnumAll_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &s); + + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "srvsvc_NetShareEnumAll on server '%s' failed" + ": %s", + r->in.server_name, nt_errstr(status)); + goto disconnect; + } + + if (!W_ERROR_IS_OK(s.out.result) && !W_ERROR_EQUAL(s.out.result, WERR_MORE_DATA)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "srvsvc_NetShareEnumAll on server '%s' failed: %s", + r->in.server_name, win_errstr(s.out.result)); + goto disconnect; + } + + r->out.ctr = s.out.info_ctr->ctr; + +disconnect: + talloc_free(c.out.dcerpc_pipe); + + return status; +} + + +NTSTATUS libnet_AddShare(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_AddShare *r) +{ + NTSTATUS status; + struct libnet_RpcConnect c; + struct srvsvc_NetShareAdd s; + union srvsvc_NetShareInfo info; + + ZERO_STRUCT(c); + + c.level = LIBNET_RPC_CONNECT_SERVER; + c.in.name = r->in.server_name; + c.in.dcerpc_iface = &ndr_table_srvsvc; + + status = libnet_RpcConnect(ctx, mem_ctx, &c); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "Connection to SRVSVC pipe of server %s " + "failed: %s", + r->in.server_name, nt_errstr(status)); + return status; + } + + info.info2 = &r->in.share; + + s.in.level = 2; + s.in.info = &info; + s.in.server_unc = talloc_asprintf(mem_ctx, "\\\\%s", r->in.server_name); + + status = dcerpc_srvsvc_NetShareAdd_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &s); + + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "srvsvc_NetShareAdd '%s' on server '%s' failed" + ": %s", + r->in.share.name, r->in.server_name, + nt_errstr(status)); + } else if (!W_ERROR_IS_OK(s.out.result)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "srvsvc_NetShareAdd '%s' on server '%s' failed" + ": %s", + r->in.share.name, r->in.server_name, + win_errstr(s.out.result)); + status = werror_to_ntstatus(s.out.result); + } + + talloc_free(c.out.dcerpc_pipe); + + return status; +} + + +NTSTATUS libnet_DelShare(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, struct libnet_DelShare *r) +{ + NTSTATUS status; + struct libnet_RpcConnect c; + struct srvsvc_NetShareDel s; + + ZERO_STRUCT(c); + ZERO_STRUCT(s); + + c.level = LIBNET_RPC_CONNECT_SERVER; + c.in.name = r->in.server_name; + c.in.dcerpc_iface = &ndr_table_srvsvc; + + status = libnet_RpcConnect(ctx, mem_ctx, &c); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "Connection to SRVSVC pipe of server %s " + "failed: %s", + r->in.server_name, nt_errstr(status)); + return status; + } + + s.in.server_unc = talloc_asprintf(mem_ctx, "\\\\%s", r->in.server_name); + s.in.share_name = r->in.share_name; + + status = dcerpc_srvsvc_NetShareDel_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &s); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "srvsvc_NetShareDel '%s' on server '%s' failed" + ": %s", + r->in.share_name, r->in.server_name, + nt_errstr(status)); + } else if (!W_ERROR_IS_OK(s.out.result)) { + r->out.error_string = talloc_asprintf(mem_ctx, + "srvsvc_NetShareDel '%s' on server '%s' failed" + ": %s", + r->in.share_name, r->in.server_name, + win_errstr(s.out.result)); + status = werror_to_ntstatus(s.out.result); + } + + talloc_free(c.out.dcerpc_pipe); + + return status; +} diff --git a/source4/libnet/libnet_share.h b/source4/libnet/libnet_share.h new file mode 100644 index 0000000..3a9bd72 --- /dev/null +++ b/source4/libnet/libnet_share.h @@ -0,0 +1,70 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Grégory LEOCADIE <gleocadie@idealx.com> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "librpc/gen_ndr/srvsvc.h" + +enum libnet_ListShares_level { + LIBNET_LIST_SHARES_GENERIC, + LIBNET_LIST_SHARES_SRVSVC +}; + +struct libnet_ListShares { + struct { + const char *server_name; + uint32_t *resume_handle; + uint32_t level; + } in; + struct { + const char *error_string; + union srvsvc_NetShareCtr ctr; + uint32_t *resume_handle; + } out; +}; + +enum libnet_AddShare_level { + LIBNET_ADD_SHARE_GENERIC, + LIBNET_ADD_SHARE_SRVSVC +}; + +struct libnet_AddShare { + enum libnet_AddShare_level level; + struct { + const char * server_name; + struct srvsvc_NetShareInfo2 share; + } in; + struct { + const char* error_string; + } out; +}; + +enum libnet_DelShare_level { + LIBNET_DEL_SHARE_GENERIC, + LIBNET_DEL_SHARE_SRVSVC +}; + +struct libnet_DelShare { + enum libnet_DelShare_level level; + struct { + const char *server_name; + const char *share_name; + } in; + struct { + const char *error_string; + } out; +}; diff --git a/source4/libnet/libnet_site.c b/source4/libnet/libnet_site.c new file mode 100644 index 0000000..691e4b2 --- /dev/null +++ b/source4/libnet/libnet_site.c @@ -0,0 +1,292 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Brad Henry 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "libcli/cldap/cldap.h" +#include <ldb.h> +#include <ldb_errors.h> +#include "libcli/resolve/resolve.h" +#include "param/param.h" +#include "lib/tsocket/tsocket.h" + +/** + * 1. Setup a CLDAP socket. + * 2. Lookup the default Site-Name. + */ +NTSTATUS libnet_FindSite(TALLOC_CTX *ctx, struct libnet_context *lctx, struct libnet_JoinSite *r) +{ + NTSTATUS status; + TALLOC_CTX *tmp_ctx; + + char *site_name_str; + char *config_dn_str; + char *server_dn_str; + + struct cldap_socket *cldap = NULL; + struct cldap_netlogon search; + int ret; + struct tsocket_address *dest_address; + + tmp_ctx = talloc_named(ctx, 0, "libnet_FindSite temp context"); + if (!tmp_ctx) { + r->out.error_string = NULL; + return NT_STATUS_NO_MEMORY; + } + + /* Resolve the site name. */ + ZERO_STRUCT(search); + search.in.dest_address = NULL; + search.in.dest_port = 0; + search.in.acct_control = -1; + search.in.version = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX; + search.in.map_response = true; + + ret = tsocket_address_inet_from_strings(tmp_ctx, "ip", + r->in.dest_address, + r->in.cldap_port, + &dest_address); + if (ret != 0) { + r->out.error_string = NULL; + status = map_nt_error_from_unix_common(errno); + talloc_free(tmp_ctx); + return status; + } + + /* we want to use non async calls, so we're not passing an event context */ + status = cldap_socket_init(tmp_ctx, NULL, dest_address, &cldap); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(tmp_ctx); + r->out.error_string = NULL; + return status; + } + status = cldap_netlogon(cldap, tmp_ctx, &search); + if (!NT_STATUS_IS_OK(status) + || search.out.netlogon.data.nt5_ex.client_site == NULL + || search.out.netlogon.data.nt5_ex.client_site[0] == '\0') { + /* + If cldap_netlogon() returns in error, + default to using Default-First-Site-Name. + */ + site_name_str = talloc_asprintf(tmp_ctx, "%s", + "Default-First-Site-Name"); + if (!site_name_str) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + } else { + site_name_str = talloc_asprintf(tmp_ctx, "%s", + search.out.netlogon.data.nt5_ex.client_site); + if (!site_name_str) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + } + + /* Generate the CN=Configuration,... DN. */ +/* TODO: look it up! */ + config_dn_str = talloc_asprintf(tmp_ctx, "CN=Configuration,%s", r->in.domain_dn_str); + if (!config_dn_str) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + /* Generate the CN=Servers,... DN. */ + server_dn_str = talloc_asprintf(tmp_ctx, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s", + r->in.netbios_name, site_name_str, config_dn_str); + if (!server_dn_str) { + r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + r->out.site_name_str = site_name_str; + talloc_steal(r, site_name_str); + + r->out.config_dn_str = config_dn_str; + talloc_steal(r, config_dn_str); + + r->out.server_dn_str = server_dn_str; + talloc_steal(r, server_dn_str); + + talloc_free(tmp_ctx); + return NT_STATUS_OK; +} + +/* + * find out Site specific stuff: + * 1. Lookup the Site name. + * 2. Add entry CN=<netbios name>,CN=Servers,CN=<site name>,CN=Sites,CN=Configuration,<domain dn>. + * TODO: 3.) use DsAddEntry() to create CN=NTDS Settings,CN=<netbios name>,CN=Servers,CN=<site name>,... + */ +NTSTATUS libnet_JoinSite(struct libnet_context *ctx, + struct ldb_context *remote_ldb, + struct libnet_JoinDomain *libnet_r) +{ + NTSTATUS status; + TALLOC_CTX *tmp_ctx; + + struct libnet_JoinSite *r; + + struct ldb_dn *server_dn; + struct ldb_message *msg; + int rtn; + + const char *server_dn_str; + const char *host; + struct nbt_name name; + const char *dest_addr = NULL; + + tmp_ctx = talloc_named(libnet_r, 0, "libnet_JoinSite temp context"); + if (!tmp_ctx) { + libnet_r->out.error_string = NULL; + return NT_STATUS_NO_MEMORY; + } + + r = talloc(tmp_ctx, struct libnet_JoinSite); + if (!r) { + libnet_r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + host = dcerpc_binding_get_string_option(libnet_r->out.samr_binding, "host"); + make_nbt_name_client(&name, host); + status = resolve_name_ex(lpcfg_resolve_context(ctx->lp_ctx), + 0, 0, + &name, r, &dest_addr, ctx->event_ctx); + if (!NT_STATUS_IS_OK(status)) { + libnet_r->out.error_string = NULL; + talloc_free(tmp_ctx); + return status; + } + + /* Resolve the site name and AD DN's. */ + r->in.dest_address = dest_addr; + r->in.netbios_name = libnet_r->in.netbios_name; + r->in.domain_dn_str = libnet_r->out.domain_dn_str; + r->in.cldap_port = lpcfg_cldap_port(ctx->lp_ctx); + + status = libnet_FindSite(tmp_ctx, ctx, r); + if (!NT_STATUS_IS_OK(status)) { + libnet_r->out.error_string = + talloc_steal(libnet_r, r->out.error_string); + talloc_free(tmp_ctx); + return status; + } + + server_dn_str = r->out.server_dn_str; + + /* + Add entry CN=<netbios name>,CN=Servers,CN=<site name>,CN=Sites,CN=Configuration,<domain dn>. + */ + msg = ldb_msg_new(tmp_ctx); + if (!msg) { + libnet_r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + rtn = ldb_msg_add_string(msg, "objectClass", "server"); + if (rtn != LDB_SUCCESS) { + libnet_r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + rtn = ldb_msg_add_string(msg, "systemFlags", "50000000"); + if (rtn != LDB_SUCCESS) { + libnet_r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + rtn = ldb_msg_add_string(msg, "serverReference", libnet_r->out.account_dn_str); + if (rtn != LDB_SUCCESS) { + libnet_r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + server_dn = ldb_dn_new(tmp_ctx, remote_ldb, server_dn_str); + if ( ! ldb_dn_validate(server_dn)) { + libnet_r->out.error_string = talloc_asprintf(libnet_r, + "Invalid server dn: %s", + server_dn_str); + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } + + msg->dn = server_dn; + + rtn = ldb_add(remote_ldb, msg); + if (rtn == LDB_ERR_ENTRY_ALREADY_EXISTS) { + unsigned int i; + + /* make a 'modify' msg, and only for serverReference */ + msg = ldb_msg_new(tmp_ctx); + if (!msg) { + libnet_r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + msg->dn = server_dn; + + rtn = ldb_msg_add_string(msg, "serverReference",libnet_r->out.account_dn_str); + if (rtn != LDB_SUCCESS) { + libnet_r->out.error_string = NULL; + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + /* mark all the message elements (should be just one) + as LDB_FLAG_MOD_REPLACE */ + for (i=0;i<msg->num_elements;i++) { + msg->elements[i].flags = LDB_FLAG_MOD_REPLACE; + } + + rtn = ldb_modify(remote_ldb, msg); + if (rtn != LDB_SUCCESS) { + libnet_r->out.error_string + = talloc_asprintf(libnet_r, + "Failed to modify server entry %s: %s: %d", + server_dn_str, + ldb_errstring(remote_ldb), rtn); + talloc_free(tmp_ctx); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + } else if (rtn != LDB_SUCCESS) { + libnet_r->out.error_string + = talloc_asprintf(libnet_r, + "Failed to add server entry %s: %s: %d", + server_dn_str, ldb_errstring(remote_ldb), + rtn); + talloc_free(tmp_ctx); + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + DEBUG(0, ("We still need to perform a DsAddEntry() so that we can create the CN=NTDS Settings container.\n")); + + /* Store the server DN in libnet_r */ + libnet_r->out.server_dn_str = server_dn_str; + talloc_steal(libnet_r, server_dn_str); + + talloc_free(tmp_ctx); + return NT_STATUS_OK; +} diff --git a/source4/libnet/libnet_site.h b/source4/libnet/libnet_site.h new file mode 100644 index 0000000..8e607c5 --- /dev/null +++ b/source4/libnet/libnet_site.h @@ -0,0 +1,35 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Brad Henry 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +struct libnet_JoinSite { + struct { + const char *dest_address; + const char *netbios_name; + const char *domain_dn_str; + uint16_t cldap_port; + } in; + + struct { + const char *error_string; + const char *site_name_str; + const char *config_dn_str; + const char *server_dn_str; + } out; +}; + diff --git a/source4/libnet/libnet_time.c b/source4/libnet/libnet_time.c new file mode 100644 index 0000000..e3b6275 --- /dev/null +++ b/source4/libnet/libnet_time.c @@ -0,0 +1,125 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "system/time.h" +#include "librpc/gen_ndr/ndr_srvsvc_c.h" + +/* + * get the remote time of a server via srvsvc_NetRemoteTOD + */ +static NTSTATUS libnet_RemoteTOD_srvsvc(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_RemoteTOD *r) +{ + NTSTATUS status; + struct libnet_RpcConnect c; + struct srvsvc_NetRemoteTOD tod; + struct srvsvc_NetRemoteTODInfo *info = NULL; + struct tm tm; + + ZERO_STRUCT(c); + + /* prepare connect to the SRVSVC pipe of a timeserver */ + c.level = LIBNET_RPC_CONNECT_SERVER; + c.in.name = r->srvsvc.in.server_name; + c.in.dcerpc_iface = &ndr_table_srvsvc; + + /* 1. connect to the SRVSVC pipe of a timeserver */ + status = libnet_RpcConnect(ctx, mem_ctx, &c); + if (!NT_STATUS_IS_OK(status)) { + r->srvsvc.out.error_string = talloc_asprintf(mem_ctx, + "Connection to SRVSVC pipe of server '%s' failed: %s", + r->srvsvc.in.server_name, nt_errstr(status)); + return status; + } + + /* prepare srvsvc_NetrRemoteTOD */ + tod.in.server_unc = talloc_asprintf(mem_ctx, "\\%s", c.in.name); + tod.out.info = &info; + + /* 2. try srvsvc_NetRemoteTOD */ + status = dcerpc_srvsvc_NetRemoteTOD_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &tod); + if (!NT_STATUS_IS_OK(status)) { + r->srvsvc.out.error_string = talloc_asprintf(mem_ctx, + "srvsvc_NetrRemoteTOD on server '%s' failed: %s", + r->srvsvc.in.server_name, nt_errstr(status)); + goto disconnect; + } + + /* check result of srvsvc_NetrRemoteTOD */ + if (!W_ERROR_IS_OK(tod.out.result)) { + r->srvsvc.out.error_string = talloc_asprintf(mem_ctx, + "srvsvc_NetrRemoteTOD on server '%s' failed: %s", + r->srvsvc.in.server_name, win_errstr(tod.out.result)); + status = werror_to_ntstatus(tod.out.result); + goto disconnect; + } + + /* need to set the out parameters */ + tm.tm_sec = (int)info->secs; + tm.tm_min = (int)info->mins; + tm.tm_hour = (int)info->hours; + tm.tm_mday = (int)info->day; + tm.tm_mon = (int)info->month -1; + tm.tm_year = (int)info->year - 1900; + tm.tm_wday = -1; + tm.tm_yday = -1; + tm.tm_isdst = -1; + + r->srvsvc.out.time = timegm(&tm); + r->srvsvc.out.time_zone = info->timezone * 60; + + goto disconnect; + +disconnect: + /* close connection */ + talloc_free(c.out.dcerpc_pipe); + + return status; +} + +static NTSTATUS libnet_RemoteTOD_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_RemoteTOD *r) +{ + NTSTATUS status; + union libnet_RemoteTOD r2; + + r2.srvsvc.level = LIBNET_REMOTE_TOD_SRVSVC; + r2.srvsvc.in.server_name = r->generic.in.server_name; + + status = libnet_RemoteTOD(ctx, mem_ctx, &r2); + + r->generic.out.time = r2.srvsvc.out.time; + r->generic.out.time_zone = r2.srvsvc.out.time_zone; + + r->generic.out.error_string = r2.srvsvc.out.error_string; + + return status; +} + +NTSTATUS libnet_RemoteTOD(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_RemoteTOD *r) +{ + switch (r->generic.level) { + case LIBNET_REMOTE_TOD_GENERIC: + return libnet_RemoteTOD_generic(ctx, mem_ctx, r); + case LIBNET_REMOTE_TOD_SRVSVC: + return libnet_RemoteTOD_srvsvc(ctx, mem_ctx, r); + } + + return NT_STATUS_INVALID_LEVEL; +} diff --git a/source4/libnet/libnet_time.h b/source4/libnet/libnet_time.h new file mode 100644 index 0000000..4382d72 --- /dev/null +++ b/source4/libnet/libnet_time.h @@ -0,0 +1,46 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/* struct and enum for getting the time of a remote system */ +enum libnet_RemoteTOD_level { + LIBNET_REMOTE_TOD_GENERIC, + LIBNET_REMOTE_TOD_SRVSVC +}; + +union libnet_RemoteTOD { + struct { + enum libnet_RemoteTOD_level level; + + struct _libnet_RemoteTOD_in { + const char *server_name; + } in; + + struct _libnet_RemoteTOD_out { + time_t time; + int time_zone; + const char *error_string; + } out; + } generic; + + struct { + enum libnet_RemoteTOD_level level; + struct _libnet_RemoteTOD_in in; + struct _libnet_RemoteTOD_out out; + } srvsvc; +}; diff --git a/source4/libnet/libnet_unbecome_dc.c b/source4/libnet/libnet_unbecome_dc.c new file mode 100644 index 0000000..38d6a94 --- /dev/null +++ b/source4/libnet/libnet_unbecome_dc.c @@ -0,0 +1,792 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher <metze@samba.org> 2006 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libnet/libnet.h" +#include "libcli/composite/composite.h" +#include "libcli/cldap/cldap.h" +#include <ldb.h> +#include <ldb_errors.h> +#include "ldb_wrap.h" +#include "dsdb/samdb/samdb.h" +#include "../libds/common/flags.h" +#include "librpc/gen_ndr/ndr_drsuapi_c.h" +#include "param/param.h" +#include "lib/tsocket/tsocket.h" + +/***************************************************************************** + * Windows 2003 (w2k3) does the following steps when changing the server role + * from domain controller back to domain member + * + * We mostly do the same. + *****************************************************************************/ + +/* + * lookup DC: + * - using nbt name<1C> request and a samlogon mailslot request + * or + * - using a DNS SRV _ldap._tcp.dc._msdcs. request and a CLDAP netlogon request + * + * see: unbecomeDC_send_cldap() and unbecomeDC_recv_cldap() + */ + +/* + * Open 1st LDAP connection to the DC using admin credentials + * + * see: unbecomeDC_ldap_connect() + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: unbecomeDC_ldap_rootdse() + * + * Request: + * basedn: "" + * scope: base + * filter: (objectClass=*) + * attrs: defaultNamingContext + * configurationNamingContext + * Result: + * "" + * defaultNamingContext: <domain_partition> + * configurationNamingContext:CN=Configuration,<domain_partition> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: unbecomeDC_ldap_computer_object() + * + * Request: + * basedn: <domain_partition> + * scope: sub + * filter: (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<new_dc_account_name>)) + * attrs: distinguishedName + * userAccountControl + * Result: + * CN=<new_dc_netbios_name>,CN=Domain Controllers,<domain_partition> + * distinguishedName: CN=<new_dc_netbios_name>,CN=Domain Controllers,<domain_partition> + * userAccoountControl: 532480 <0x82000> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: unbecomeDC_ldap_modify_computer() + * + * Request: + * basedn: CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: userAccountControl + * Result: + * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * userAccoountControl: 532480 <0x82000> + */ + +/* + * LDAP modify 1st LDAP connection: + * + * see: unbecomeDC_ldap_modify_computer() + * + * Request (replace): + * CN=<new_dc_netbios_name>,CN=Computers,<domain_partition> + * userAccoountControl: 4096 <0x1000> + * Result: + * <success> + */ + +/* + * LDAP search 1st LDAP connection: + * + * see: unbecomeDC_ldap_move_computer() + * + * Request: + * basedn: <WKGUID=aa312825768811d1aded00c04fd8d5cd,<domain_partition>> + * scope: base + * filter: (objectClass=*) + * attrs: 1.1 + * Result: + * CN=Computers,<domain_partition> + */ + +/* + * LDAP search 1st LDAP connection: + * + * not implemented because it doesn't give any new information + * + * Request: + * basedn: CN=Computers,<domain_partition> + * scope: base + * filter: (objectClass=*) + * attrs: distinguishedName + * Result: + * CN=Computers,<domain_partition> + * distinguishedName: CN=Computers,<domain_partition> + */ + +/* + * LDAP modifyRDN 1st LDAP connection: + * + * see: unbecomeDC_ldap_move_computer() + * + * Request: + * entry: CN=<new_dc_netbios_name>,CN=Domain Controllers,<domain_partition> + * newrdn: CN=<new_dc_netbios_name> + * deleteoldrdn: TRUE + * newparent: CN=Computers,<domain_partition> + * Result: + * <success> + */ + +/* + * LDAP unbind on the 1st LDAP connection + * + * not implemented, because it's not needed... + */ + +/* + * Open 1st DRSUAPI connection to the DC using admin credentials + * DsBind with DRSUAPI_DS_BIND_GUID ("e24d201a-4fd6-11d1-a3da-0000f875ae0d") + * + * see: unbecomeDC_drsuapi_connect_send(), unbecomeDC_drsuapi_connect_recv(), + * unbecomeDC_drsuapi_bind_send() and unbecomeDC_drsuapi_bind_recv() + */ + +/* + * DsRemoveDsServer to remove the + * CN=<machine_name>,CN=Servers,CN=<site_name>,CN=Configuration,<domain_partition> + * and CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=<site_name>,CN=Configuration,<domain_partition> + * on the 1st DRSUAPI connection + * + * see: unbecomeDC_drsuapi_remove_ds_server_send() and unbecomeDC_drsuapi_remove_ds_server_recv() + */ + +/* + * DsUnbind on the 1st DRSUAPI connection + * + * not implemented, because it's not needed... + */ + + +struct libnet_UnbecomeDC_state { + struct composite_context *creq; + + struct libnet_context *libnet; + + struct { + struct cldap_socket *sock; + struct cldap_netlogon io; + struct NETLOGON_SAM_LOGON_RESPONSE_EX netlogon; + } cldap; + + struct { + struct ldb_context *ldb; + } ldap; + + struct { + struct dcerpc_binding *binding; + struct dcerpc_pipe *pipe; + struct dcerpc_binding_handle *drsuapi_handle; + struct drsuapi_DsBind bind_r; + struct GUID bind_guid; + struct drsuapi_DsBindInfoCtr bind_info_ctr; + struct drsuapi_DsBindInfo28 local_info28; + struct drsuapi_DsBindInfo28 remote_info28; + struct policy_handle bind_handle; + struct drsuapi_DsRemoveDSServer rm_ds_srv_r; + } drsuapi; + + struct { + /* input */ + const char *dns_name; + const char *netbios_name; + + /* constructed */ + struct GUID guid; + const char *dn_str; + } domain; + + struct { + /* constructed */ + const char *config_dn_str; + } forest; + + struct { + /* input */ + const char *address; + + /* constructed */ + const char *dns_name; + const char *netbios_name; + const char *site_name; + } source_dsa; + + struct { + /* input */ + const char *netbios_name; + + /* constructed */ + const char *dns_name; + const char *site_name; + const char *computer_dn_str; + const char *server_dn_str; + uint32_t user_account_control; + } dest_dsa; +}; + +static void unbecomeDC_recv_cldap(struct tevent_req *req); + +static void unbecomeDC_send_cldap(struct libnet_UnbecomeDC_state *s) +{ + struct composite_context *c = s->creq; + struct tevent_req *req; + struct tsocket_address *dest_address; + int ret; + + s->cldap.io.in.dest_address = NULL; + s->cldap.io.in.dest_port = 0; + s->cldap.io.in.realm = s->domain.dns_name; + s->cldap.io.in.host = s->dest_dsa.netbios_name; + s->cldap.io.in.user = NULL; + s->cldap.io.in.domain_guid = NULL; + s->cldap.io.in.domain_sid = NULL; + s->cldap.io.in.acct_control = -1; + s->cldap.io.in.version = NETLOGON_NT_VERSION_5 | NETLOGON_NT_VERSION_5EX; + s->cldap.io.in.map_response = true; + + ret = tsocket_address_inet_from_strings(s, "ip", + s->source_dsa.address, + lpcfg_cldap_port(s->libnet->lp_ctx), + &dest_address); + if (ret != 0) { + c->status = map_nt_error_from_unix_common(errno); + if (!composite_is_ok(c)) return; + } + + c->status = cldap_socket_init(s, NULL, dest_address, &s->cldap.sock); + if (!composite_is_ok(c)) return; + + req = cldap_netlogon_send(s, s->libnet->event_ctx, + s->cldap.sock, &s->cldap.io); + if (composite_nomem(req, c)) return; + tevent_req_set_callback(req, unbecomeDC_recv_cldap, s); +} + +static void unbecomeDC_connect_ldap(struct libnet_UnbecomeDC_state *s); + +static void unbecomeDC_recv_cldap(struct tevent_req *req) +{ + struct libnet_UnbecomeDC_state *s = tevent_req_callback_data(req, + struct libnet_UnbecomeDC_state); + struct composite_context *c = s->creq; + + c->status = cldap_netlogon_recv(req, s, &s->cldap.io); + talloc_free(req); + if (!composite_is_ok(c)) return; + + s->cldap.netlogon = s->cldap.io.out.netlogon.data.nt5_ex; + + s->domain.dns_name = s->cldap.netlogon.dns_domain; + s->domain.netbios_name = s->cldap.netlogon.domain_name; + s->domain.guid = s->cldap.netlogon.domain_uuid; + + s->source_dsa.dns_name = s->cldap.netlogon.pdc_dns_name; + s->source_dsa.netbios_name = s->cldap.netlogon.pdc_name; + s->source_dsa.site_name = s->cldap.netlogon.server_site; + + s->dest_dsa.site_name = s->cldap.netlogon.client_site; + + unbecomeDC_connect_ldap(s); +} + +static NTSTATUS unbecomeDC_ldap_connect(struct libnet_UnbecomeDC_state *s) +{ + char *url; + + url = talloc_asprintf(s, "ldap://%s/", s->source_dsa.dns_name); + NT_STATUS_HAVE_NO_MEMORY(url); + + s->ldap.ldb = ldb_wrap_connect(s, s->libnet->event_ctx, s->libnet->lp_ctx, url, + NULL, + s->libnet->cred, + 0); + talloc_free(url); + if (s->ldap.ldb == NULL) { + return NT_STATUS_UNEXPECTED_NETWORK_ERROR; + } + + return NT_STATUS_OK; +} + +static NTSTATUS unbecomeDC_ldap_rootdse(struct libnet_UnbecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "defaultNamingContext", + "configurationNamingContext", + NULL + }; + + basedn = ldb_dn_new(s, s->ldap.ldb, NULL); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap.ldb, s, &r, basedn, LDB_SCOPE_BASE, attrs, + "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->domain.dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "defaultNamingContext", NULL); + if (!s->domain.dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + talloc_steal(s, s->domain.dn_str); + + s->forest.config_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "configurationNamingContext", NULL); + if (!s->forest.config_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + talloc_steal(s, s->forest.config_dn_str); + + s->dest_dsa.server_dn_str = talloc_asprintf(s, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s", + s->dest_dsa.netbios_name, + s->dest_dsa.site_name, + s->forest.config_dn_str); + NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.server_dn_str); + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS unbecomeDC_ldap_computer_object(struct libnet_UnbecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "distinguishedName", + "userAccountControl", + NULL + }; + + basedn = ldb_dn_new(s, s->ldap.ldb, s->domain.dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap.ldb, s, &r, basedn, LDB_SCOPE_SUBTREE, attrs, + "(&(|(objectClass=user)(objectClass=computer))(sAMAccountName=%s$))", + s->dest_dsa.netbios_name); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + s->dest_dsa.computer_dn_str = ldb_msg_find_attr_as_string(r->msgs[0], "distinguishedName", NULL); + if (!s->dest_dsa.computer_dn_str) return NT_STATUS_INVALID_NETWORK_RESPONSE; + talloc_steal(s, s->dest_dsa.computer_dn_str); + + s->dest_dsa.user_account_control = ldb_msg_find_attr_as_uint(r->msgs[0], "userAccountControl", 0); + + talloc_free(r); + return NT_STATUS_OK; +} + +static NTSTATUS unbecomeDC_ldap_modify_computer(struct libnet_UnbecomeDC_state *s) +{ + int ret; + struct ldb_message *msg; + uint32_t user_account_control = UF_WORKSTATION_TRUST_ACCOUNT; + unsigned int i; + + /* as the value is already as we want it to be, we're done */ + if (s->dest_dsa.user_account_control == user_account_control) { + return NT_STATUS_OK; + } + + /* make a 'modify' msg, and only for serverReference */ + msg = ldb_msg_new(s); + NT_STATUS_HAVE_NO_MEMORY(msg); + msg->dn = ldb_dn_new(msg, s->ldap.ldb, s->dest_dsa.computer_dn_str); + NT_STATUS_HAVE_NO_MEMORY(msg->dn); + + ret = samdb_msg_add_uint(s->ldap.ldb, msg, msg, "userAccountControl", + user_account_control); + if (ret != LDB_SUCCESS) { + talloc_free(msg); + return NT_STATUS_NO_MEMORY; + } + + /* mark all the message elements (should be just one) + as LDB_FLAG_MOD_REPLACE */ + for (i=0;i<msg->num_elements;i++) { + msg->elements[i].flags = LDB_FLAG_MOD_REPLACE; + } + + ret = ldb_modify(s->ldap.ldb, msg); + talloc_free(msg); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } + + s->dest_dsa.user_account_control = user_account_control; + + return NT_STATUS_OK; +} + +static NTSTATUS unbecomeDC_ldap_move_computer(struct libnet_UnbecomeDC_state *s) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + struct ldb_dn *old_dn; + struct ldb_dn *new_dn; + static const char *_1_1_attrs[] = { + "1.1", + NULL + }; + + basedn = ldb_dn_new_fmt(s, s->ldap.ldb, "<WKGUID=aa312825768811d1aded00c04fd8d5cd,%s>", + s->domain.dn_str); + NT_STATUS_HAVE_NO_MEMORY(basedn); + + ret = ldb_search(s->ldap.ldb, s, &r, basedn, LDB_SCOPE_BASE, + _1_1_attrs, "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + return NT_STATUS_LDAP(ret); + } else if (r->count != 1) { + talloc_free(r); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + old_dn = ldb_dn_new(r, s->ldap.ldb, s->dest_dsa.computer_dn_str); + NT_STATUS_HAVE_NO_MEMORY(old_dn); + + new_dn = r->msgs[0]->dn; + + if (!ldb_dn_add_child_fmt(new_dn, "CN=%s", s->dest_dsa.netbios_name)) { + talloc_free(r); + return NT_STATUS_NO_MEMORY; + } + + if (ldb_dn_compare(old_dn, new_dn) == 0) { + /* we don't need to rename if the old and new dn match */ + talloc_free(r); + return NT_STATUS_OK; + } + + ret = ldb_rename(s->ldap.ldb, old_dn, new_dn); + if (ret != LDB_SUCCESS) { + talloc_free(r); + return NT_STATUS_LDAP(ret); + } + + s->dest_dsa.computer_dn_str = ldb_dn_alloc_linearized(s, new_dn); + NT_STATUS_HAVE_NO_MEMORY(s->dest_dsa.computer_dn_str); + + talloc_free(r); + + return NT_STATUS_OK; +} + +static void unbecomeDC_drsuapi_connect_send(struct libnet_UnbecomeDC_state *s); + +static void unbecomeDC_connect_ldap(struct libnet_UnbecomeDC_state *s) +{ + struct composite_context *c = s->creq; + + c->status = unbecomeDC_ldap_connect(s); + if (!composite_is_ok(c)) return; + + c->status = unbecomeDC_ldap_rootdse(s); + if (!composite_is_ok(c)) return; + + c->status = unbecomeDC_ldap_computer_object(s); + if (!composite_is_ok(c)) return; + + c->status = unbecomeDC_ldap_modify_computer(s); + if (!composite_is_ok(c)) return; + + c->status = unbecomeDC_ldap_move_computer(s); + if (!composite_is_ok(c)) return; + + unbecomeDC_drsuapi_connect_send(s); +} + +static void unbecomeDC_drsuapi_connect_recv(struct composite_context *creq); + +static void unbecomeDC_drsuapi_connect_send(struct libnet_UnbecomeDC_state *s) +{ + struct composite_context *c = s->creq; + struct composite_context *creq; + char *binding_str; + + binding_str = talloc_asprintf(s, "ncacn_ip_tcp:%s[seal,target_hostname=%s]", + s->source_dsa.address, + s->source_dsa.dns_name); + if (composite_nomem(binding_str, c)) return; + + c->status = dcerpc_parse_binding(s, binding_str, &s->drsuapi.binding); + talloc_free(binding_str); + if (!composite_is_ok(c)) return; + + if (DEBUGLEVEL >= 10) { + c->status = dcerpc_binding_set_flags(s->drsuapi.binding, + DCERPC_DEBUG_PRINT_BOTH, + 0); + if (!composite_is_ok(c)) return; + } + + creq = dcerpc_pipe_connect_b_send(s, s->drsuapi.binding, &ndr_table_drsuapi, + s->libnet->cred, s->libnet->event_ctx, + s->libnet->lp_ctx); + composite_continue(c, creq, unbecomeDC_drsuapi_connect_recv, s); +} + +static void unbecomeDC_drsuapi_bind_send(struct libnet_UnbecomeDC_state *s); + +static void unbecomeDC_drsuapi_connect_recv(struct composite_context *req) +{ + struct libnet_UnbecomeDC_state *s = talloc_get_type(req->async.private_data, + struct libnet_UnbecomeDC_state); + struct composite_context *c = s->creq; + + c->status = dcerpc_pipe_connect_b_recv(req, s, &s->drsuapi.pipe); + if (!composite_is_ok(c)) return; + + s->drsuapi.drsuapi_handle = s->drsuapi.pipe->binding_handle; + + unbecomeDC_drsuapi_bind_send(s); +} + +static void unbecomeDC_drsuapi_bind_recv(struct tevent_req *subreq); + +static void unbecomeDC_drsuapi_bind_send(struct libnet_UnbecomeDC_state *s) +{ + struct composite_context *c = s->creq; + struct drsuapi_DsBindInfo28 *bind_info28; + struct tevent_req *subreq; + + GUID_from_string(DRSUAPI_DS_BIND_GUID, &s->drsuapi.bind_guid); + + bind_info28 = &s->drsuapi.local_info28; + bind_info28->supported_extensions = 0; + bind_info28->site_guid = GUID_zero(); + bind_info28->pid = 0; + bind_info28->repl_epoch = 0; + + s->drsuapi.bind_info_ctr.length = 28; + s->drsuapi.bind_info_ctr.info.info28 = *bind_info28; + + s->drsuapi.bind_r.in.bind_guid = &s->drsuapi.bind_guid; + s->drsuapi.bind_r.in.bind_info = &s->drsuapi.bind_info_ctr; + s->drsuapi.bind_r.out.bind_handle = &s->drsuapi.bind_handle; + + subreq = dcerpc_drsuapi_DsBind_r_send(s, c->event_ctx, + s->drsuapi.drsuapi_handle, + &s->drsuapi.bind_r); + if (composite_nomem(subreq, c)) return; + tevent_req_set_callback(subreq, unbecomeDC_drsuapi_bind_recv, s); +} + +static void unbecomeDC_drsuapi_remove_ds_server_send(struct libnet_UnbecomeDC_state *s); + +static void unbecomeDC_drsuapi_bind_recv(struct tevent_req *subreq) +{ + struct libnet_UnbecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_UnbecomeDC_state); + struct composite_context *c = s->creq; + + c->status = dcerpc_drsuapi_DsBind_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!W_ERROR_IS_OK(s->drsuapi.bind_r.out.result)) { + composite_error(c, werror_to_ntstatus(s->drsuapi.bind_r.out.result)); + return; + } + + ZERO_STRUCT(s->drsuapi.remote_info28); + if (s->drsuapi.bind_r.out.bind_info) { + switch (s->drsuapi.bind_r.out.bind_info->length) { + case 24: { + struct drsuapi_DsBindInfo24 *info24; + info24 = &s->drsuapi.bind_r.out.bind_info->info.info24; + s->drsuapi.remote_info28.supported_extensions = info24->supported_extensions; + s->drsuapi.remote_info28.site_guid = info24->site_guid; + s->drsuapi.remote_info28.pid = info24->pid; + s->drsuapi.remote_info28.repl_epoch = 0; + break; + } + case 28: { + s->drsuapi.remote_info28 = s->drsuapi.bind_r.out.bind_info->info.info28; + break; + } + case 32: { + struct drsuapi_DsBindInfo32 *info32; + info32 = &s->drsuapi.bind_r.out.bind_info->info.info32; + s->drsuapi.remote_info28.supported_extensions = info32->supported_extensions; + s->drsuapi.remote_info28.site_guid = info32->site_guid; + s->drsuapi.remote_info28.pid = info32->pid; + s->drsuapi.remote_info28.repl_epoch = info32->repl_epoch; + break; + } + case 48: { + struct drsuapi_DsBindInfo48 *info48; + info48 = &s->drsuapi.bind_r.out.bind_info->info.info48; + s->drsuapi.remote_info28.supported_extensions = info48->supported_extensions; + s->drsuapi.remote_info28.site_guid = info48->site_guid; + s->drsuapi.remote_info28.pid = info48->pid; + s->drsuapi.remote_info28.repl_epoch = info48->repl_epoch; + break; + } + case 52: { + struct drsuapi_DsBindInfo52 *info52; + info52 = &s->drsuapi.bind_r.out.bind_info->info.info52; + s->drsuapi.remote_info28.supported_extensions = info52->supported_extensions; + s->drsuapi.remote_info28.site_guid = info52->site_guid; + s->drsuapi.remote_info28.pid = info52->pid; + s->drsuapi.remote_info28.repl_epoch = info52->repl_epoch; + break; + } + default: + DEBUG(1, ("Warning: invalid info length in bind info: %d\n", + s->drsuapi.bind_r.out.bind_info->length)); + break; + } + } + + unbecomeDC_drsuapi_remove_ds_server_send(s); +} + +static void unbecomeDC_drsuapi_remove_ds_server_recv(struct tevent_req *subreq); + +static void unbecomeDC_drsuapi_remove_ds_server_send(struct libnet_UnbecomeDC_state *s) +{ + struct composite_context *c = s->creq; + struct drsuapi_DsRemoveDSServer *r = &s->drsuapi.rm_ds_srv_r; + struct tevent_req *subreq; + + r->in.bind_handle = &s->drsuapi.bind_handle; + r->in.level = 1; + r->in.req = talloc(s, union drsuapi_DsRemoveDSServerRequest); + r->in.req->req1.server_dn = s->dest_dsa.server_dn_str; + r->in.req->req1.domain_dn = s->domain.dn_str; + r->in.req->req1.commit = true; + + r->out.level_out = talloc(s, uint32_t); + r->out.res = talloc(s, union drsuapi_DsRemoveDSServerResult); + + subreq = dcerpc_drsuapi_DsRemoveDSServer_r_send(s, c->event_ctx, + s->drsuapi.drsuapi_handle, + r); + if (composite_nomem(subreq, c)) return; + tevent_req_set_callback(subreq, unbecomeDC_drsuapi_remove_ds_server_recv, s); +} + +static void unbecomeDC_drsuapi_remove_ds_server_recv(struct tevent_req *subreq) +{ + struct libnet_UnbecomeDC_state *s = tevent_req_callback_data(subreq, + struct libnet_UnbecomeDC_state); + struct composite_context *c = s->creq; + struct drsuapi_DsRemoveDSServer *r = &s->drsuapi.rm_ds_srv_r; + + c->status = dcerpc_drsuapi_DsRemoveDSServer_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!W_ERROR_IS_OK(r->out.result)) { + composite_error(c, werror_to_ntstatus(r->out.result)); + return; + } + + if (*r->out.level_out != 1) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + composite_done(c); +} + +struct composite_context *libnet_UnbecomeDC_send(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_UnbecomeDC *r) +{ + struct composite_context *c; + struct libnet_UnbecomeDC_state *s; + char *tmp_name; + + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct libnet_UnbecomeDC_state); + if (composite_nomem(s, c)) return c; + c->private_data = s; + s->creq = c; + s->libnet = ctx; + + /* Domain input */ + s->domain.dns_name = talloc_strdup(s, r->in.domain_dns_name); + if (composite_nomem(s->domain.dns_name, c)) return c; + s->domain.netbios_name = talloc_strdup(s, r->in.domain_netbios_name); + if (composite_nomem(s->domain.netbios_name, c)) return c; + + /* Source DSA input */ + s->source_dsa.address = talloc_strdup(s, r->in.source_dsa_address); + if (composite_nomem(s->source_dsa.address, c)) return c; + + /* Destination DSA input */ + s->dest_dsa.netbios_name= talloc_strdup(s, r->in.dest_dsa_netbios_name); + if (composite_nomem(s->dest_dsa.netbios_name, c)) return c; + + /* Destination DSA dns_name construction */ + tmp_name = strlower_talloc(s, s->dest_dsa.netbios_name); + if (composite_nomem(tmp_name, c)) return c; + s->dest_dsa.dns_name = talloc_asprintf_append_buffer(tmp_name, ".%s", + s->domain.dns_name); + if (composite_nomem(s->dest_dsa.dns_name, c)) return c; + + unbecomeDC_send_cldap(s); + return c; +} + +NTSTATUS libnet_UnbecomeDC_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, struct libnet_UnbecomeDC *r) +{ + NTSTATUS status; + + status = composite_wait(c); + + ZERO_STRUCT(r->out); + + talloc_free(c); + return status; +} + +NTSTATUS libnet_UnbecomeDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_UnbecomeDC *r) +{ + NTSTATUS status; + struct composite_context *c; + c = libnet_UnbecomeDC_send(ctx, mem_ctx, r); + status = libnet_UnbecomeDC_recv(c, mem_ctx, r); + return status; +} diff --git a/source4/libnet/libnet_unbecome_dc.h b/source4/libnet/libnet_unbecome_dc.h new file mode 100644 index 0000000..30a412f --- /dev/null +++ b/source4/libnet/libnet_unbecome_dc.h @@ -0,0 +1,31 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher <metze@samba.org> 2006 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +struct libnet_UnbecomeDC { + struct { + const char *domain_dns_name; + const char *domain_netbios_name; + const char *source_dsa_address; + const char *dest_dsa_netbios_name; + } in; + + struct { + const char *error_string; + } out; +}; diff --git a/source4/libnet/libnet_user.c b/source4/libnet/libnet_user.c new file mode 100644 index 0000000..f4b90d9 --- /dev/null +++ b/source4/libnet/libnet_user.c @@ -0,0 +1,1241 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +#include "includes.h" +#include "libnet/libnet.h" +#include "libcli/composite/composite.h" +#include "auth/credentials/credentials.h" +#include "librpc/ndr/libndr.h" +#include "librpc/gen_ndr/samr.h" +#include "librpc/gen_ndr/ndr_samr_c.h" +#include "librpc/gen_ndr/lsa.h" +#include "librpc/gen_ndr/ndr_lsa_c.h" +#include "libcli/security/security.h" + + +struct create_user_state { + struct libnet_CreateUser r; + struct libnet_DomainOpen domain_open; + struct libnet_rpc_useradd user_add; + struct libnet_context *ctx; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_rpc_useradd(struct composite_context *ctx); +static void continue_domain_open_create(struct composite_context *ctx); + + +/** + * Sends request to create user account + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to a structure containing arguments and results of this call + * @param monitor function pointer for receiving monitor messages + * @return compostite context of this request + */ +struct composite_context* libnet_CreateUser_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_CreateUser *r, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct create_user_state *s; + struct composite_context *create_req; + bool prereq_met = false; + + /* composite context allocation and setup */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct create_user_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* store arguments in the state structure */ + s->ctx = ctx; + s->r = *r; + ZERO_STRUCT(s->r.out); + + /* prerequisite: make sure the domain is opened */ + prereq_met = samr_domain_opened(ctx, c, s->r.in.domain_name, &c, &s->domain_open, + continue_domain_open_create, monitor); + if (!prereq_met) return c; + + /* prepare arguments for useradd call */ + s->user_add.in.username = r->in.user_name; + s->user_add.in.domain_handle = ctx->samr.handle; + + /* send the request */ + create_req = libnet_rpc_useradd_send(s, s->ctx->event_ctx, + ctx->samr.samr_handle, + &s->user_add, monitor); + if (composite_nomem(create_req, c)) return c; + + /* set the next stage */ + composite_continue(c, create_req, continue_rpc_useradd, c); + return c; +} + + +/* + * Stage 0.5 (optional): receive result of domain open request + * and send useradd request + */ +static void continue_domain_open_create(struct composite_context *ctx) +{ + struct composite_context *c; + struct create_user_state *s; + struct composite_context *create_req; + struct monitor_msg msg; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct create_user_state); + + /* receive result of DomainOpen call */ + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domain_open); + if (!composite_is_ok(c)) return; + + /* send monitor message */ + if (s->monitor_fn) s->monitor_fn(&msg); + + /* prepare arguments for useradd call */ + s->user_add.in.username = s->r.in.user_name; + s->user_add.in.domain_handle = s->ctx->samr.handle; + + /* send the request */ + create_req = libnet_rpc_useradd_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->user_add, s->monitor_fn); + if (composite_nomem(create_req, c)) return; + + /* set the next stage */ + composite_continue(c, create_req, continue_rpc_useradd, c); +} + + +/* + * Stage 1: receive result of useradd call + */ +static void continue_rpc_useradd(struct composite_context *ctx) +{ + struct composite_context *c; + struct create_user_state *s; + struct monitor_msg msg; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct create_user_state); + + /* receive result of the call */ + c->status = libnet_rpc_useradd_recv(ctx, c, &s->user_add); + if (!composite_is_ok(c)) return; + + /* send monitor message */ + if (s->monitor_fn) s->monitor_fn(&msg); + + /* we're done */ + composite_done(c); +} + + +/** + * Receive result of CreateUser call + * + * @param c composite context returned by send request routine + * @param mem_ctx memory context of this call + * @param r pointer to a structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_CreateUser_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_CreateUser *r) +{ + NTSTATUS status; + + r->out.error_string = NULL; + + /* wait for result of async request and check status code */ + status = composite_wait(c); + if (!NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_strdup(mem_ctx, nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of CreateUser call + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to a structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_CreateUser(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_CreateUser *r) +{ + struct composite_context *c; + + c = libnet_CreateUser_send(ctx, mem_ctx, r, NULL); + return libnet_CreateUser_recv(c, mem_ctx, r); +} + + +struct delete_user_state { + struct libnet_DeleteUser r; + struct libnet_context *ctx; + struct libnet_DomainOpen domain_open; + struct libnet_rpc_userdel user_del; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_rpc_userdel(struct composite_context *ctx); +static void continue_domain_open_delete(struct composite_context *ctx); + + +/** + * Sends request to delete user account + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to structure containing arguments and result of this call + * @param monitor function pointer for receiving monitor messages + */ +struct composite_context *libnet_DeleteUser_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_DeleteUser *r, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct delete_user_state *s; + struct composite_context *delete_req; + bool prereq_met = false; + + /* composite context allocation and setup */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct delete_user_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* store arguments in state structure */ + s->ctx = ctx; + s->r = *r; + ZERO_STRUCT(s->r.out); + + /* prerequisite: make sure the domain is opened before proceeding */ + prereq_met = samr_domain_opened(ctx, c, s->r.in.domain_name, &c, &s->domain_open, + continue_domain_open_delete, monitor); + if (!prereq_met) return c; + + /* prepare arguments for userdel call */ + s->user_del.in.username = r->in.user_name; + s->user_del.in.domain_handle = ctx->samr.handle; + + /* send request */ + delete_req = libnet_rpc_userdel_send(s, s->ctx->event_ctx, + ctx->samr.samr_handle, + &s->user_del, monitor); + if (composite_nomem(delete_req, c)) return c; + + /* set the next stage */ + composite_continue(c, delete_req, continue_rpc_userdel, c); + return c; +} + + +/* + * Stage 0.5 (optional): receive result of domain open request + * and send useradd request + */ +static void continue_domain_open_delete(struct composite_context *ctx) +{ + struct composite_context *c; + struct delete_user_state *s; + struct composite_context *delete_req; + struct monitor_msg msg; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct delete_user_state); + + /* receive result of DomainOpen call */ + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domain_open); + if (!composite_is_ok(c)) return; + + /* send monitor message */ + if (s->monitor_fn) s->monitor_fn(&msg); + + /* prepare arguments for userdel call */ + s->user_del.in.username = s->r.in.user_name; + s->user_del.in.domain_handle = s->ctx->samr.handle; + + /* send request */ + delete_req = libnet_rpc_userdel_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->user_del, s->monitor_fn); + if (composite_nomem(delete_req, c)) return; + + /* set the next stage */ + composite_continue(c, delete_req, continue_rpc_userdel, c); +} + + +/* + * Stage 1: receive result of userdel call and finish the composite function + */ +static void continue_rpc_userdel(struct composite_context *ctx) +{ + struct composite_context *c; + struct delete_user_state *s; + struct monitor_msg msg; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct delete_user_state); + + /* receive result of userdel call */ + c->status = libnet_rpc_userdel_recv(ctx, c, &s->user_del); + if (!composite_is_ok(c)) return; + + /* send monitor message */ + if (s->monitor_fn) s->monitor_fn(&msg); + + /* we're done */ + composite_done(c); +} + + +/** + * Receives result of asynchronous DeleteUser call + * + * @param c composite context returned by async DeleteUser call + * @param mem_ctx memory context of this call + * @param r pointer to structure containing arguments and result + */ +NTSTATUS libnet_DeleteUser_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_DeleteUser *r) +{ + NTSTATUS status; + struct delete_user_state *s; + + r->out.error_string = NULL; + + /* wait for result of async request and check status code */ + status = composite_wait(c); + if (!NT_STATUS_IS_OK(status)) { + s = talloc_get_type_abort(c->private_data, struct delete_user_state); + r->out.error_string = talloc_steal(mem_ctx, s->r.out.error_string); + } + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of DeleteUser call + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to structure containing arguments and result + */ +NTSTATUS libnet_DeleteUser(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_DeleteUser *r) +{ + struct composite_context *c; + + c = libnet_DeleteUser_send(ctx, mem_ctx, r, NULL); + return libnet_DeleteUser_recv(c, mem_ctx, r); +} + + +struct modify_user_state { + struct libnet_ModifyUser r; + struct libnet_context *ctx; + struct libnet_DomainOpen domain_open; + struct libnet_rpc_userinfo user_info; + struct libnet_rpc_usermod user_mod; + + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_rpc_usermod(struct composite_context *ctx); +static void continue_domain_open_modify(struct composite_context *ctx); +static NTSTATUS set_user_changes(TALLOC_CTX *mem_ctx, struct usermod_change *mod, + struct libnet_rpc_userinfo *info, struct libnet_ModifyUser *r); +static void continue_rpc_userinfo(struct composite_context *ctx); + + +/** + * Sends request to modify user account + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to structure containing arguments and result of this call + * @param monitor function pointer for receiving monitor messages + */ +struct composite_context *libnet_ModifyUser_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_ModifyUser *r, + void (*monitor)(struct monitor_msg*)) +{ + const uint16_t level = 21; + struct composite_context *c; + struct modify_user_state *s; + struct composite_context *userinfo_req; + bool prereq_met = false; + + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct modify_user_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + s->ctx = ctx; + s->r = *r; + + prereq_met = samr_domain_opened(ctx, c, s->r.in.domain_name, &c, &s->domain_open, + continue_domain_open_modify, monitor); + if (!prereq_met) return c; + + s->user_info.in.username = r->in.user_name; + s->user_info.in.domain_handle = ctx->samr.handle; + s->user_info.in.level = level; + + userinfo_req = libnet_rpc_userinfo_send(s, s->ctx->event_ctx, + ctx->samr.samr_handle, + &s->user_info, monitor); + if (composite_nomem(userinfo_req, c)) return c; + + composite_continue(c, userinfo_req, continue_rpc_userinfo, c); + return c; +} + + +/* + * Stage 0.5 (optional): receive result of domain open request + * and send userinfo request + */ +static void continue_domain_open_modify(struct composite_context *ctx) +{ + const uint16_t level = 21; + struct composite_context *c; + struct modify_user_state *s; + struct composite_context *userinfo_req; + struct monitor_msg msg; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct modify_user_state); + + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domain_open); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) s->monitor_fn(&msg); + + s->user_info.in.domain_handle = s->ctx->samr.handle; + s->user_info.in.username = s->r.in.user_name; + s->user_info.in.level = level; + + userinfo_req = libnet_rpc_userinfo_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->user_info, s->monitor_fn); + if (composite_nomem(userinfo_req, c)) return; + + composite_continue(c, userinfo_req, continue_rpc_userinfo, c); +} + + +/* + * Stage 1: receive result of userinfo call, prepare user changes + * (set the fields a caller required to change) and send usermod request + */ +static void continue_rpc_userinfo(struct composite_context *ctx) +{ + struct composite_context *c; + struct modify_user_state *s; + struct composite_context *usermod_req; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct modify_user_state); + + c->status = libnet_rpc_userinfo_recv(ctx, c, &s->user_info); + if (!composite_is_ok(c)) return; + + s->user_mod.in.domain_handle = s->ctx->samr.handle; + s->user_mod.in.username = s->r.in.user_name; + + c->status = set_user_changes(c, &s->user_mod.in.change, &s->user_info, &s->r); + + usermod_req = libnet_rpc_usermod_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->user_mod, s->monitor_fn); + if (composite_nomem(usermod_req, c)) return; + + composite_continue(c, usermod_req, continue_rpc_usermod, c); +} + + +/* + * Prepare user changes: compare userinfo result to requested changes and + * set the field values and flags accordingly for user modify call + */ +static NTSTATUS set_user_changes(TALLOC_CTX *mem_ctx, struct usermod_change *mod, + struct libnet_rpc_userinfo *info, struct libnet_ModifyUser *r) +{ + struct samr_UserInfo21 *user; + + if (mod == NULL || info == NULL || r == NULL || info->in.level != 21) { + return NT_STATUS_INVALID_PARAMETER; + } + + user = &info->out.info.info21; + mod->fields = 0; /* reset flag field before setting individual flags */ + + /* account name change */ + SET_FIELD_LSA_STRING(r->in, user, mod, account_name, USERMOD_FIELD_ACCOUNT_NAME); + + /* full name change */ + SET_FIELD_LSA_STRING(r->in, user, mod, full_name, USERMOD_FIELD_FULL_NAME); + + /* description change */ + SET_FIELD_LSA_STRING(r->in, user, mod, description, USERMOD_FIELD_DESCRIPTION); + + /* comment change */ + SET_FIELD_LSA_STRING(r->in, user, mod, comment, USERMOD_FIELD_COMMENT); + + /* home directory change */ + SET_FIELD_LSA_STRING(r->in, user, mod, home_directory, USERMOD_FIELD_HOME_DIRECTORY); + + /* home drive change */ + SET_FIELD_LSA_STRING(r->in, user, mod, home_drive, USERMOD_FIELD_HOME_DRIVE); + + /* logon script change */ + SET_FIELD_LSA_STRING(r->in, user, mod, logon_script, USERMOD_FIELD_LOGON_SCRIPT); + + /* profile path change */ + SET_FIELD_LSA_STRING(r->in, user, mod, profile_path, USERMOD_FIELD_PROFILE_PATH); + + /* account expiry change */ + SET_FIELD_NTTIME(r->in, user, mod, acct_expiry, USERMOD_FIELD_ACCT_EXPIRY); + + /* account flags change */ + SET_FIELD_ACCT_FLAGS(r->in, user, mod, acct_flags, USERMOD_FIELD_ACCT_FLAGS); + + return NT_STATUS_OK; +} + + +/* + * Stage 2: receive result of usermod request and finish the composite function + */ +static void continue_rpc_usermod(struct composite_context *ctx) +{ + struct composite_context *c; + struct modify_user_state *s; + struct monitor_msg msg; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct modify_user_state); + + c->status = libnet_rpc_usermod_recv(ctx, c, &s->user_mod); + if (!composite_is_ok(c)) return; + + if (s->monitor_fn) s->monitor_fn(&msg); + composite_done(c); +} + + +/** + * Receive result of ModifyUser call + * + * @param c composite context returned by send request routine + * @param mem_ctx memory context of this call + * @param r pointer to a structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_ModifyUser_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_ModifyUser *r) +{ + NTSTATUS status = composite_wait(c); + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of ModifyUser call + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to a structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_ModifyUser(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_ModifyUser *r) +{ + struct composite_context *c; + + c = libnet_ModifyUser_send(ctx, mem_ctx, r, NULL); + return libnet_ModifyUser_recv(c, mem_ctx, r); +} + + +struct user_info_state { + struct libnet_context *ctx; + const char *domain_name; + enum libnet_UserInfo_level level; + const char *user_name; + const char *sid_string; + struct libnet_LookupName lookup; + struct libnet_DomainOpen domopen; + struct libnet_rpc_userinfo userinfo; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_name_found(struct composite_context *ctx); +static void continue_domain_open_info(struct composite_context *ctx); +static void continue_info_received(struct composite_context *ctx); + + +/** + * Sends request to get user account information + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to a structure containing arguments and results of this call + * @param monitor function pointer for receiving monitor messages + * @return compostite context of this request + */ +struct composite_context* libnet_UserInfo_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_UserInfo *r, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct user_info_state *s; + struct composite_context *lookup_req, *info_req; + bool prereq_met = false; + + /* composite context allocation and setup */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct user_info_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* store arguments in the state structure */ + s->monitor_fn = monitor; + s->ctx = ctx; + s->domain_name = talloc_strdup(c, r->in.domain_name); + s->level = r->in.level; + switch (s->level) { + case USER_INFO_BY_NAME: + s->user_name = talloc_strdup(c, r->in.data.user_name); + s->sid_string = NULL; + break; + case USER_INFO_BY_SID: + s->user_name = NULL; + s->sid_string = dom_sid_string(c, r->in.data.user_sid); + break; + } + + /* prerequisite: make sure the domain is opened */ + prereq_met = samr_domain_opened(ctx, c, s->domain_name, &c, &s->domopen, + continue_domain_open_info, monitor); + if (!prereq_met) return c; + + switch (s->level) { + case USER_INFO_BY_NAME: + /* prepare arguments for LookupName call */ + s->lookup.in.domain_name = s->domain_name; + s->lookup.in.name = s->user_name; + + /* send the request */ + lookup_req = libnet_LookupName_send(ctx, c, &s->lookup, + s->monitor_fn); + if (composite_nomem(lookup_req, c)) return c; + + /* set the next stage */ + composite_continue(c, lookup_req, continue_name_found, c); + break; + case USER_INFO_BY_SID: + /* prepare arguments for UserInfo call */ + s->userinfo.in.domain_handle = s->ctx->samr.handle; + s->userinfo.in.sid = s->sid_string; + s->userinfo.in.level = 21; + + /* send the request */ + info_req = libnet_rpc_userinfo_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->userinfo, + s->monitor_fn); + if (composite_nomem(info_req, c)) return c; + + /* set the next stage */ + composite_continue(c, info_req, continue_info_received, c); + break; + } + + return c; +} + + +/* + * Stage 0.5 (optional): receive result of domain open request + * and send LookupName request + */ +static void continue_domain_open_info(struct composite_context *ctx) +{ + struct composite_context *c; + struct user_info_state *s; + struct composite_context *lookup_req, *info_req; + struct monitor_msg msg; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct user_info_state); + + /* receive result of DomainOpen call */ + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domopen); + if (!composite_is_ok(c)) return; + + /* send monitor message */ + if (s->monitor_fn) s->monitor_fn(&msg); + + switch (s->level) { + case USER_INFO_BY_NAME: + /* prepare arguments for LookupName call */ + s->lookup.in.domain_name = s->domain_name; + s->lookup.in.name = s->user_name; + + /* send the request */ + lookup_req = libnet_LookupName_send(s->ctx, c, &s->lookup, s->monitor_fn); + if (composite_nomem(lookup_req, c)) return; + + /* set the next stage */ + composite_continue(c, lookup_req, continue_name_found, c); + break; + + case USER_INFO_BY_SID: + /* prepare arguments for UserInfo call */ + s->userinfo.in.domain_handle = s->ctx->samr.handle; + s->userinfo.in.sid = s->sid_string; + s->userinfo.in.level = 21; + + /* send the request */ + info_req = libnet_rpc_userinfo_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->userinfo, + s->monitor_fn); + if (composite_nomem(info_req, c)) return; + + /* set the next stage */ + composite_continue(c, info_req, continue_info_received, c); + break; + } +} + + +/* + * Stage 1: receive the name (if found) and send userinfo request + */ +static void continue_name_found(struct composite_context *ctx) +{ + struct composite_context *c; + struct user_info_state *s; + struct composite_context *info_req; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct user_info_state); + + /* receive result of LookupName call */ + c->status = libnet_LookupName_recv(ctx, c, &s->lookup); + if (!composite_is_ok(c)) return; + + /* we're only interested in user accounts this time */ + if (s->lookup.out.sid_type != SID_NAME_USER) { + composite_error(c, NT_STATUS_NO_SUCH_USER); + return; + } + + /* prepare arguments for UserInfo call */ + s->userinfo.in.domain_handle = s->ctx->samr.handle; + s->userinfo.in.sid = s->lookup.out.sidstr; + s->userinfo.in.level = 21; + + /* send the request */ + info_req = libnet_rpc_userinfo_send(s, s->ctx->event_ctx, + s->ctx->samr.samr_handle, + &s->userinfo, s->monitor_fn); + if (composite_nomem(info_req, c)) return; + + /* set the next stage */ + composite_continue(c, info_req, continue_info_received, c); +} + + +/* + * Stage 2: receive user account information and finish the composite function + */ +static void continue_info_received(struct composite_context *ctx) +{ + struct composite_context *c; + struct user_info_state *s; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct user_info_state); + + /* receive result of userinfo call */ + c->status = libnet_rpc_userinfo_recv(ctx, c, &s->userinfo); + if (!composite_is_ok(c)) return; + + composite_done(c); +} + + +/** + * Receive result of UserInfo call + * + * @param c composite context returned by send request routine + * @param mem_ctx memory context of this call + * @param r pointer to a structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_UserInfo_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_UserInfo *r) +{ + NTSTATUS status; + struct user_info_state *s; + + status = composite_wait(c); + + if (NT_STATUS_IS_OK(status) && r != NULL) { + struct samr_UserInfo21 *info; + + s = talloc_get_type_abort(c->private_data, struct user_info_state); + info = &s->userinfo.out.info.info21; + + r->out.user_sid = dom_sid_add_rid(mem_ctx, s->ctx->samr.sid, info->rid); + r->out.primary_group_sid = dom_sid_add_rid(mem_ctx, s->ctx->samr.sid, info->primary_gid); + + /* string fields */ + r->out.account_name = talloc_steal(mem_ctx, info->account_name.string); + r->out.full_name = talloc_steal(mem_ctx, info->full_name.string); + r->out.description = talloc_steal(mem_ctx, info->description.string); + r->out.home_directory = talloc_steal(mem_ctx, info->home_directory.string); + r->out.home_drive = talloc_steal(mem_ctx, info->home_drive.string); + r->out.comment = talloc_steal(mem_ctx, info->comment.string); + r->out.logon_script = talloc_steal(mem_ctx, info->logon_script.string); + r->out.profile_path = talloc_steal(mem_ctx, info->profile_path.string); + + /* time fields (allocation) */ + r->out.acct_expiry = talloc(mem_ctx, struct timeval); + r->out.allow_password_change = talloc(mem_ctx, struct timeval); + r->out.force_password_change = talloc(mem_ctx, struct timeval); + r->out.last_logon = talloc(mem_ctx, struct timeval); + r->out.last_logoff = talloc(mem_ctx, struct timeval); + r->out.last_password_change = talloc(mem_ctx, struct timeval); + + /* time fields (converting) */ + nttime_to_timeval(r->out.acct_expiry, info->acct_expiry); + nttime_to_timeval(r->out.allow_password_change, info->allow_password_change); + nttime_to_timeval(r->out.force_password_change, info->force_password_change); + nttime_to_timeval(r->out.last_logon, info->last_logon); + nttime_to_timeval(r->out.last_logoff, info->last_logoff); + nttime_to_timeval(r->out.last_password_change, info->last_password_change); + + /* flag and number fields */ + r->out.acct_flags = info->acct_flags; + + r->out.error_string = talloc_strdup(mem_ctx, "Success"); + + } else { + r->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of UserInfo call + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to a structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_UserInfo(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + struct libnet_UserInfo *r) +{ + struct composite_context *c; + + c = libnet_UserInfo_send(ctx, mem_ctx, r, NULL); + return libnet_UserInfo_recv(c, mem_ctx, r); +} + + +struct userlist_state { + struct libnet_context *ctx; + const char *domain_name; + struct lsa_DomainInfo dominfo; + int page_size; + uint32_t resume_index; + struct userlist *users; + uint32_t count; + + struct libnet_DomainOpen domain_open; + struct lsa_QueryInfoPolicy query_domain; + struct samr_EnumDomainUsers user_list; + + void (*monitor_fn)(struct monitor_msg*); +}; + + +static void continue_lsa_domain_opened(struct composite_context *ctx); +static void continue_domain_queried(struct tevent_req *subreq); +static void continue_samr_domain_opened(struct composite_context *ctx); +static void continue_users_enumerated(struct tevent_req *subreq); + + +/** + * Sends request to list (enumerate) user accounts + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to structure containing arguments and results of this call + * @param monitor function pointer for receiving monitor messages + * @return compostite context of this request + */ +struct composite_context* libnet_UserList_send(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_UserList *r, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct userlist_state *s; + struct tevent_req *subreq; + bool prereq_met = false; + + /* composite context allocation and setup */ + c = composite_create(mem_ctx, ctx->event_ctx); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct userlist_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* store the arguments in the state structure */ + s->ctx = ctx; + s->page_size = r->in.page_size; + s->resume_index = r->in.resume_index; + s->domain_name = talloc_strdup(c, r->in.domain_name); + s->monitor_fn = monitor; + + /* make sure we have lsa domain handle before doing anything */ + prereq_met = lsa_domain_opened(ctx, c, s->domain_name, &c, &s->domain_open, + continue_lsa_domain_opened, monitor); + if (!prereq_met) return c; + + /* prepare arguments of QueryDomainInfo call */ + s->query_domain.in.handle = &ctx->lsa.handle; + s->query_domain.in.level = LSA_POLICY_INFO_DOMAIN; + s->query_domain.out.info = talloc_zero(c, union lsa_PolicyInformation *); + if (composite_nomem(s->query_domain.out.info, c)) return c; + + /* send the request */ + subreq = dcerpc_lsa_QueryInfoPolicy_r_send(s, c->event_ctx, + ctx->lsa.pipe->binding_handle, + &s->query_domain); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_domain_queried, c); + return c; +} + + +/* + * Stage 0.5 (optional): receive lsa domain handle and send + * request to query domain info + */ +static void continue_lsa_domain_opened(struct composite_context *ctx) +{ + struct composite_context *c; + struct userlist_state *s; + struct tevent_req *subreq; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct userlist_state); + + /* receive lsa domain handle */ + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domain_open); + if (!composite_is_ok(c)) return; + + /* prepare arguments of QueryDomainInfo call */ + s->query_domain.in.handle = &s->ctx->lsa.handle; + s->query_domain.in.level = LSA_POLICY_INFO_DOMAIN; + s->query_domain.out.info = talloc_zero(c, union lsa_PolicyInformation *); + if (composite_nomem(s->query_domain.out.info, c)) return; + + /* send the request */ + subreq = dcerpc_lsa_QueryInfoPolicy_r_send(s, c->event_ctx, + s->ctx->lsa.pipe->binding_handle, + &s->query_domain); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_domain_queried, c); +} + + +/* + * Stage 1: receive domain info and request to enum users, + * provided a valid samr handle is opened + */ +static void continue_domain_queried(struct tevent_req *subreq) +{ + struct composite_context *c; + struct userlist_state *s; + bool prereq_met = false; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct userlist_state); + + /* receive result of rpc request */ + c->status = dcerpc_lsa_QueryInfoPolicy_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* get the returned domain info */ + s->dominfo = (*s->query_domain.out.info)->domain; + + /* make sure we have samr domain handle before continuing */ + prereq_met = samr_domain_opened(s->ctx, c, s->domain_name, &c, &s->domain_open, + continue_samr_domain_opened, s->monitor_fn); + if (!prereq_met) return; + + /* prepare arguments of EnumDomainUsers call */ + s->user_list.in.domain_handle = &s->ctx->samr.handle; + s->user_list.in.max_size = s->page_size; + s->user_list.in.resume_handle = &s->resume_index; + s->user_list.in.acct_flags = ACB_NORMAL; + s->user_list.out.resume_handle = &s->resume_index; + s->user_list.out.num_entries = talloc(s, uint32_t); + if (composite_nomem(s->user_list.out.num_entries, c)) return; + s->user_list.out.sam = talloc(s, struct samr_SamArray *); + if (composite_nomem(s->user_list.out.sam, c)) return; + + /* send the request */ + subreq = dcerpc_samr_EnumDomainUsers_r_send(s, c->event_ctx, + s->ctx->samr.pipe->binding_handle, + &s->user_list); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_users_enumerated, c); +} + + +/* + * Stage 1.5 (optional): receive samr domain handle + * and request to enumerate accounts + */ +static void continue_samr_domain_opened(struct composite_context *ctx) +{ + struct composite_context *c; + struct userlist_state *s; + struct tevent_req *subreq; + + c = talloc_get_type_abort(ctx->async.private_data, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct userlist_state); + + /* receive samr domain handle */ + c->status = libnet_DomainOpen_recv(ctx, s->ctx, c, &s->domain_open); + if (!composite_is_ok(c)) return; + + /* prepare arguments of EnumDomainUsers call */ + s->user_list.in.domain_handle = &s->ctx->samr.handle; + s->user_list.in.max_size = s->page_size; + s->user_list.in.resume_handle = &s->resume_index; + s->user_list.in.acct_flags = ACB_NORMAL; + s->user_list.out.resume_handle = &s->resume_index; + s->user_list.out.sam = talloc(s, struct samr_SamArray *); + if (composite_nomem(s->user_list.out.sam, c)) return; + s->user_list.out.num_entries = talloc(s, uint32_t); + if (composite_nomem(s->user_list.out.num_entries, c)) return; + + /* send the request */ + subreq = dcerpc_samr_EnumDomainUsers_r_send(s, c->event_ctx, + s->ctx->samr.pipe->binding_handle, + &s->user_list); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_users_enumerated, c); +} + + +/* + * Stage 2: receive enumerated users and their rids + */ +static void continue_users_enumerated(struct tevent_req *subreq) +{ + struct composite_context *c; + struct userlist_state *s; + uint32_t i; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct userlist_state); + + /* receive result of rpc request */ + c->status = dcerpc_samr_EnumDomainUsers_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* get the actual status of the rpc call result + (instead of rpc layer status) */ + c->status = s->user_list.out.result; + + /* we're interested in status "ok" as well as two + enum-specific status codes */ + if (NT_STATUS_IS_OK(c->status) || + NT_STATUS_EQUAL(c->status, STATUS_MORE_ENTRIES) || + NT_STATUS_EQUAL(c->status, NT_STATUS_NO_MORE_ENTRIES)) { + + /* get enumerated accounts counter and resume handle (the latter allows + making subsequent call to continue enumeration) */ + s->resume_index = *s->user_list.out.resume_handle; + s->count = *s->user_list.out.num_entries; + + /* prepare returned user accounts array */ + s->users = talloc_array(c, struct userlist, (*s->user_list.out.sam)->count); + if (composite_nomem(s->users, c)) return; + + for (i = 0; i < (*s->user_list.out.sam)->count; i++) { + struct dom_sid *user_sid; + struct samr_SamEntry *entry = &(*s->user_list.out.sam)->entries[i]; + struct dom_sid *domain_sid = (*s->query_domain.out.info)->domain.sid; + + /* construct user sid from returned rid and queried domain sid */ + user_sid = dom_sid_add_rid(c, domain_sid, entry->idx); + if (composite_nomem(user_sid, c)) return; + + /* username */ + s->users[i].username = talloc_strdup(s->users, entry->name.string); + if (composite_nomem(s->users[i].username, c)) return; + + /* sid string */ + s->users[i].sid = dom_sid_string(s->users, user_sid); + if (composite_nomem(s->users[i].sid, c)) return; + } + + /* that's it */ + composite_done(c); + return; + + } else { + /* something went wrong */ + composite_error(c, c->status); + return; + } +} + + +/** + * Receive result of UserList call + * + * @param c composite context returned by send request routine + * @param mem_ctx memory context of this call + * @param r pointer to structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_UserList_recv(struct composite_context* c, TALLOC_CTX *mem_ctx, + struct libnet_UserList *r) +{ + NTSTATUS status; + struct userlist_state *s; + + if (c == NULL || mem_ctx == NULL || r == NULL) { + talloc_free(c); + return NT_STATUS_INVALID_PARAMETER; + } + + status = composite_wait(c); + if (NT_STATUS_IS_OK(status) || + NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES) || + NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) { + + s = talloc_get_type_abort(c->private_data, struct userlist_state); + + /* get results from composite context */ + r->out.count = s->count; + r->out.resume_index = s->resume_index; + r->out.users = talloc_steal(mem_ctx, s->users); + + if (NT_STATUS_IS_OK(status)) { + r->out.error_string = talloc_strdup(mem_ctx, "Success"); + } else { + /* success, but we're not done yet */ + r->out.error_string = talloc_asprintf(mem_ctx, "Success (status: %s)", + nt_errstr(status)); + } + + } else { + r->out.error_string = talloc_asprintf(mem_ctx, "Error: %s", nt_errstr(status)); + } + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of UserList call + * + * @param ctx initialised libnet context + * @param mem_ctx memory context of this call + * @param r pointer to structure containing arguments and result of this call + * @return nt status + */ +NTSTATUS libnet_UserList(struct libnet_context *ctx, + TALLOC_CTX *mem_ctx, + struct libnet_UserList *r) +{ + struct composite_context *c; + + c = libnet_UserList_send(ctx, mem_ctx, r, NULL); + return libnet_UserList_recv(c, mem_ctx, r); +} diff --git a/source4/libnet/libnet_user.h b/source4/libnet/libnet_user.h new file mode 100644 index 0000000..8203d14 --- /dev/null +++ b/source4/libnet/libnet_user.h @@ -0,0 +1,156 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak <mimir@samba.org> 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +struct libnet_CreateUser { + struct { + const char *user_name; + const char *domain_name; + } in; + struct { + const char *error_string; + } out; +}; + + +struct libnet_DeleteUser { + struct { + const char *user_name; + const char *domain_name; + } in; + struct { + const char *error_string; + } out; +}; + + +struct libnet_ModifyUser { + struct { + const char *user_name; + const char *domain_name; + + const char *account_name; + const char *full_name; + const char *description; + const char *home_directory; + const char *home_drive; + const char *comment; + const char *logon_script; + const char *profile_path; + struct timeval *acct_expiry; + struct timeval *allow_password_change; + struct timeval *force_password_change; + struct timeval *last_password_change; + uint32_t acct_flags; + } in; + struct { + const char *error_string; + } out; +}; + + +#define SET_FIELD_LSA_STRING(new, current, mod, field, flag) \ + if (new.field != NULL && \ + !strequal_m(current->field.string, new.field)) { \ + \ + mod->field = talloc_strdup(mem_ctx, new.field); \ + if (mod->field == NULL) return NT_STATUS_NO_MEMORY; \ + \ + mod->fields |= flag; \ + } + +#define SET_FIELD_NTTIME(new, current, mod, field, flag) \ + if (new.field != 0) { \ + NTTIME newval = timeval_to_nttime(new.field); \ + if (newval != current->field) { \ + mod->field = talloc_memdup(mem_ctx, new.field, sizeof(*new.field)); \ + if (mod->field == NULL) return NT_STATUS_NO_MEMORY; \ + mod->fields |= flag; \ + } \ + } + +#define SET_FIELD_UINT32(new, current, mod, field, flag) \ + if (current->field != new.field) { \ + mod->field = new.field; \ + mod->fields |= flag; \ + } + +#define SET_FIELD_ACCT_FLAGS(new, current, mod, field, flag) \ + if (new.field) { \ + if (current->field != new.field) { \ + mod->field = new.field; \ + mod->fields |= flag; \ + } \ + } + +enum libnet_UserInfo_level { + USER_INFO_BY_NAME=0, + USER_INFO_BY_SID +}; + +struct libnet_UserInfo { + struct { + const char *domain_name; + enum libnet_UserInfo_level level; + union { + const char *user_name; + const struct dom_sid *user_sid; + } data; + } in; + struct { + struct dom_sid *user_sid; + struct dom_sid *primary_group_sid; + const char *account_name; + const char *full_name; + const char *description; + const char *home_directory; + const char *home_drive; + const char *comment; + const char *logon_script; + const char *profile_path; + struct timeval *acct_expiry; + struct timeval *allow_password_change; + struct timeval *force_password_change; + struct timeval *last_logon; + struct timeval *last_logoff; + struct timeval *last_password_change; + uint32_t acct_flags; + const char *error_string; + } out; +}; + + +struct libnet_UserList { + struct { + const char *domain_name; + int page_size; + uint32_t resume_index; + } in; + struct { + int count; + uint32_t resume_index; + + struct userlist { + const char *sid; + const char *username; + } *users; + + const char *error_string; + } out; +}; diff --git a/source4/libnet/libnet_vampire.c b/source4/libnet/libnet_vampire.c new file mode 100644 index 0000000..54bbbe3 --- /dev/null +++ b/source4/libnet/libnet_vampire.c @@ -0,0 +1,838 @@ +/* + Unix SMB/CIFS implementation. + + Extract the user/system database from a remote server + + Copyright (C) Stefan Metzmacher 2004-2006 + Copyright (C) Brad Henry 2005 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +#include "includes.h" +#include "libnet/libnet.h" +#include "lib/events/events.h" +#include "dsdb/samdb/samdb.h" +#include "../lib/util/dlinklist.h" +#include <ldb.h> +#include <ldb_errors.h> +#include "librpc/ndr/libndr.h" +#include "librpc/gen_ndr/ndr_drsuapi.h" +#include "librpc/gen_ndr/ndr_drsblobs.h" +#include "librpc/gen_ndr/ndr_misc.h" +#include "system/time.h" +#include "ldb_wrap.h" +#include "auth/auth.h" +#include "auth/credentials/credentials.h" +#include "param/param.h" +#include "param/provision.h" +#include "libcli/security/security.h" +#include "dsdb/common/util.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_DRS_REPL + +/* +List of tasks vampire.py must perform: +- Domain Join + - but don't write the secrets.ldb + - results for this should be enough to handle the provision +- if vampire method is samsync + - Provision using these results + - do we still want to support this NT4 technology? +- Start samsync with libnet code + - provision in the callback +- Write out the secrets database, using the code from libnet_Join + +*/ +struct libnet_vampire_cb_state { + const char *netbios_name; + const char *domain_name; + const char *realm; + struct cli_credentials *machine_account; + + /* Schema loaded from local LDIF files */ + struct dsdb_schema *provision_schema; + + /* 1st pass, with some OIDs/attribute names/class names not + * converted, because we may not know them yet */ + struct dsdb_schema *self_made_schema; + + /* prefixMap in LDB format, from the remote DRS server */ + DATA_BLOB prefixmap_blob; + const struct dsdb_schema *schema; + + struct ldb_context *ldb; + + struct { + uint32_t object_count; + struct drsuapi_DsReplicaObjectListItemEx *first_object; + struct drsuapi_DsReplicaObjectListItemEx *last_object; + } schema_part; + + const char *targetdir; + + struct loadparm_context *lp_ctx; + struct tevent_context *event_ctx; + unsigned total_objects; + unsigned total_links; + char *last_partition; + const char *server_dn_str; +}; + +/* initialise a state structure ready for replication of chunks */ +void *libnet_vampire_replicate_init(TALLOC_CTX *mem_ctx, + struct ldb_context *samdb, + struct loadparm_context *lp_ctx) +{ + struct libnet_vampire_cb_state *s = talloc_zero(mem_ctx, struct libnet_vampire_cb_state); + if (!s) { + return NULL; + } + + s->ldb = samdb; + s->lp_ctx = lp_ctx; + s->provision_schema = dsdb_get_schema(s->ldb, s); + s->schema = s->provision_schema; + s->netbios_name = lpcfg_netbios_name(lp_ctx); + s->domain_name = lpcfg_workgroup(lp_ctx); + s->realm = lpcfg_realm(lp_ctx); + + return s; +} + +/* Caller is expected to keep supplied pointers around for the lifetime of the structure */ +void *libnet_vampire_cb_state_init(TALLOC_CTX *mem_ctx, + struct loadparm_context *lp_ctx, struct tevent_context *event_ctx, + const char *netbios_name, const char *domain_name, const char *realm, + const char *targetdir) +{ + struct libnet_vampire_cb_state *s = talloc_zero(mem_ctx, struct libnet_vampire_cb_state); + if (!s) { + return NULL; + } + + s->lp_ctx = lp_ctx; + s->event_ctx = event_ctx; + s->netbios_name = netbios_name; + s->domain_name = domain_name; + s->realm = realm; + s->targetdir = targetdir; + return s; +} + +struct ldb_context *libnet_vampire_cb_ldb(struct libnet_vampire_cb_state *state) +{ + state = talloc_get_type_abort(state, struct libnet_vampire_cb_state); + return state->ldb; +} + +struct loadparm_context *libnet_vampire_cb_lp_ctx(struct libnet_vampire_cb_state *state) +{ + state = talloc_get_type_abort(state, struct libnet_vampire_cb_state); + return state->lp_ctx; +} + +NTSTATUS libnet_vampire_cb_prepare_db(void *private_data, + const struct libnet_BecomeDC_PrepareDB *p) +{ + struct libnet_vampire_cb_state *s = talloc_get_type(private_data, struct libnet_vampire_cb_state); + struct provision_settings settings; + struct provision_result result; + NTSTATUS status; + + ZERO_STRUCT(settings); + settings.site_name = p->dest_dsa->site_name; + settings.root_dn_str = p->forest->root_dn_str; + settings.domain_dn_str = p->domain->dn_str; + settings.config_dn_str = p->forest->config_dn_str; + settings.schema_dn_str = p->forest->schema_dn_str; + settings.netbios_name = p->dest_dsa->netbios_name; + settings.realm = s->realm; + settings.domain = s->domain_name; + settings.server_dn_str = p->dest_dsa->server_dn_str; + settings.machine_password = generate_random_machine_password(s, 120, 120); + settings.targetdir = s->targetdir; + settings.use_ntvfs = true; + status = provision_bare(s, s->lp_ctx, &settings, &result); + + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + s->ldb = talloc_steal(s, result.samdb); + s->lp_ctx = talloc_reparent(talloc_parent(result.lp_ctx), s, result.lp_ctx); + s->provision_schema = dsdb_get_schema(s->ldb, s); + s->server_dn_str = talloc_steal(s, p->dest_dsa->server_dn_str); + + /* wrap the entire vapire operation in a transaction. This + isn't just cosmetic - we use this to ensure that linked + attribute back links are added at the end by relying on a + transaction commit hook in the linked attributes module. We + need to do this as the order of objects coming from the + server is not sufficiently deterministic to know that the + record that a backlink needs to be created in has itself + been created before the object containing the forward link + has come over the wire */ + if (ldb_transaction_start(s->ldb) != LDB_SUCCESS) { + return NT_STATUS_FOOBAR; + } + + return NT_STATUS_OK; + + +} + +NTSTATUS libnet_vampire_cb_check_options(void *private_data, + const struct libnet_BecomeDC_CheckOptions *o) +{ + struct libnet_vampire_cb_state *s = talloc_get_type(private_data, struct libnet_vampire_cb_state); + + DEBUG(0,("Become DC [%s] of Domain[%s]/[%s]\n", + s->netbios_name, + o->domain->netbios_name, o->domain->dns_name)); + + DEBUG(0,("Promotion Partner is Server[%s] from Site[%s]\n", + o->source_dsa->dns_name, o->source_dsa->site_name)); + + DEBUG(0,("Options:crossRef behavior_version[%u]\n" + "\tschema object_version[%u]\n" + "\tdomain behavior_version[%u]\n" + "\tdomain w2k3_update_revision[%u]\n", + o->forest->crossref_behavior_version, + o->forest->schema_object_version, + o->domain->behavior_version, + o->domain->w2k3_update_revision)); + + return NT_STATUS_OK; +} + +static WERROR libnet_vampire_cb_apply_schema(struct libnet_vampire_cb_state *s, + const struct libnet_BecomeDC_StoreChunk *c) +{ + WERROR status; + struct dsdb_schema_prefixmap *pfm_remote; + const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr; + struct dsdb_schema *provision_schema; + uint32_t object_count = 0; + struct drsuapi_DsReplicaObjectListItemEx *first_object; + uint32_t linked_attributes_count; + struct drsuapi_DsReplicaLinkedAttribute *linked_attributes; + const struct drsuapi_DsReplicaCursor2CtrEx *uptodateness_vector; + struct dsdb_extended_replicated_objects *schema_objs; + struct repsFromTo1 *s_dsa; + char *tmp_dns_name; + struct ldb_context *schema_ldb; + struct ldb_dn *partition_dn; + struct ldb_message *msg; + struct ldb_message_element *prefixMap_el; + uint32_t i; + int ret; + bool ok; + uint64_t seq_num = 0; + uint32_t cycle_before_switching; + + DEBUG(0,("Analyze and apply schema objects\n")); + + s_dsa = talloc_zero(s, struct repsFromTo1); + if (s_dsa == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + s_dsa->other_info = talloc(s_dsa, struct repsFromTo1OtherInfo); + if (s_dsa->other_info == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + + switch (c->ctr_level) { + case 1: + mapping_ctr = &c->ctr1->mapping_ctr; + object_count = s->schema_part.object_count; + first_object = s->schema_part.first_object; + linked_attributes_count = 0; + linked_attributes = NULL; + s_dsa->highwatermark = c->ctr1->new_highwatermark; + s_dsa->source_dsa_obj_guid = c->ctr1->source_dsa_guid; + s_dsa->source_dsa_invocation_id = c->ctr1->source_dsa_invocation_id; + uptodateness_vector = NULL; /* TODO: map it */ + break; + case 6: + mapping_ctr = &c->ctr6->mapping_ctr; + object_count = s->schema_part.object_count; + first_object = s->schema_part.first_object; + linked_attributes_count = c->ctr6->linked_attributes_count; + linked_attributes = c->ctr6->linked_attributes; + s_dsa->highwatermark = c->ctr6->new_highwatermark; + s_dsa->source_dsa_obj_guid = c->ctr6->source_dsa_guid; + s_dsa->source_dsa_invocation_id = c->ctr6->source_dsa_invocation_id; + uptodateness_vector = c->ctr6->uptodateness_vector; + break; + default: + return WERR_INVALID_PARAMETER; + } + /* We must set these up to ensure the replMetaData is written + * correctly, before our NTDS Settings entry is replicated */ + ok = samdb_set_ntds_invocation_id(s->ldb, &c->dest_dsa->invocation_id); + if (!ok) { + DEBUG(0,("Failed to set cached ntds invocationId\n")); + return WERR_INTERNAL_ERROR; + } + ok = samdb_set_ntds_objectGUID(s->ldb, &c->dest_dsa->ntds_guid); + if (!ok) { + DEBUG(0,("Failed to set cached ntds objectGUID\n")); + return WERR_INTERNAL_ERROR; + } + + status = dsdb_schema_pfm_from_drsuapi_pfm(mapping_ctr, true, + s, &pfm_remote, NULL); + if (!W_ERROR_IS_OK(status)) { + DEBUG(0,(__location__ ": Failed to decode remote prefixMap: %s\n", + win_errstr(status))); + return status; + } + + s_dsa->replica_flags = DRSUAPI_DRS_WRIT_REP + | DRSUAPI_DRS_INIT_SYNC + | DRSUAPI_DRS_PER_SYNC; + memset(s_dsa->schedule, 0x11, sizeof(s_dsa->schedule)); + + tmp_dns_name = GUID_string(s_dsa->other_info, &s_dsa->source_dsa_obj_guid); + if (tmp_dns_name == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + tmp_dns_name = talloc_asprintf_append_buffer(tmp_dns_name, "._msdcs.%s", c->forest->dns_name); + if (tmp_dns_name == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + s_dsa->other_info->dns_name = tmp_dns_name; + + if (s->self_made_schema == NULL) { + DEBUG(0,("libnet_vampire_cb_apply_schema: called with out self_made_schema\n")); + return WERR_INTERNAL_ERROR; + } + + schema_ldb = provision_get_schema(s, s->lp_ctx, + c->forest->schema_dn_str, + &s->prefixmap_blob); + if (!schema_ldb) { + DEBUG(0,("Failed to re-load from local provision using remote prefixMap. " + "Will continue with local prefixMap\n")); + provision_schema = dsdb_get_schema(s->ldb, s); + } else { + provision_schema = dsdb_get_schema(schema_ldb, s); + ret = dsdb_reference_schema(s->ldb, provision_schema, SCHEMA_MEMORY_ONLY); + if (ret != LDB_SUCCESS) { + DEBUG(0,("Failed to attach schema from local provision using remote prefixMap.\n")); + return WERR_INTERNAL_ERROR; + } + talloc_unlink(s, schema_ldb); + } + + cycle_before_switching = lpcfg_parm_long(s->lp_ctx, NULL, + "become dc", + "schema convert retrial", 1); + + provision_schema->resolving_in_progress = true; + s->self_made_schema->resolving_in_progress = true; + + status = dsdb_repl_resolve_working_schema(s->ldb, + pfm_remote, + cycle_before_switching, + provision_schema, + s->self_made_schema, + object_count, + first_object); + if (!W_ERROR_IS_OK(status)) { + DEBUG(0, ("%s: dsdb_repl_resolve_working_schema() failed: %s\n", + __location__, win_errstr(status))); + return status; + } + + /* free temp objects for 1st conversion phase */ + talloc_unlink(s, provision_schema); + + s->self_made_schema->resolving_in_progress = false; + + /* + * attach the schema we just brought over DRS to the ldb, + * so we can use it in dsdb_convert_object_ex below + */ + ret = dsdb_set_schema(s->ldb, s->self_made_schema, SCHEMA_WRITE); + if (ret != LDB_SUCCESS) { + DEBUG(0,("Failed to attach working schema from DRS.\n")); + return WERR_INTERNAL_ERROR; + } + + /* we don't want to access the self made schema anymore */ + s->schema = s->self_made_schema; + s->self_made_schema = NULL; + + partition_dn = ldb_dn_new(s, s->ldb, c->partition->nc.dn); + if (partition_dn == NULL) { + DEBUG(0,("Failed to parse partition DN from DRS.\n")); + return WERR_INVALID_PARAMETER; + } + + /* Now convert the schema elements again, using the schema we finalised, ready to actually import */ + status = dsdb_replicated_objects_convert(s->ldb, + s->schema, + partition_dn, + mapping_ctr, + object_count, + first_object, + linked_attributes_count, + linked_attributes, + s_dsa, + uptodateness_vector, + c->gensec_skey, + 0, + s, &schema_objs); + if (!W_ERROR_IS_OK(status)) { + DEBUG(0,("Failed to convert objects when trying to import over DRS (2nd pass, to store remote schema): %s\n", win_errstr(status))); + return status; + } + + if (lpcfg_parm_bool(s->lp_ctx, NULL, "become dc", "dump objects", false)) { + for (i=0; i < schema_objs->num_objects; i++) { + struct ldb_ldif ldif; + fprintf(stdout, "#\n"); + ldif.changetype = LDB_CHANGETYPE_NONE; + ldif.msg = schema_objs->objects[i].msg; + ldb_ldif_write_file(s->ldb, stdout, &ldif); + NDR_PRINT_DEBUG(replPropertyMetaDataBlob, schema_objs->objects[i].meta_data); + } + } + + status = dsdb_replicated_objects_commit(s->ldb, NULL, schema_objs, &seq_num); + if (!W_ERROR_IS_OK(status)) { + DEBUG(0,("Failed to commit objects: %s\n", win_errstr(status))); + return status; + } + + msg = ldb_msg_new(schema_objs); + if (msg == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + msg->dn = schema_objs->partition_dn; + + /* We must ensure a prefixMap has been written. Unlike other + * attributes (including schemaInfo), it is not replicated in + * the normal replication stream. We can use the one from + * s->prefixmap_blob because we operate with one, unchanging + * prefixMap for this entire operation. */ + ret = ldb_msg_add_value(msg, "prefixMap", &s->prefixmap_blob, &prefixMap_el); + if (ret != LDB_SUCCESS) { + return WERR_NOT_ENOUGH_MEMORY; + } + /* We want to know if a prefixMap was written already, as it + * would mean that the above comment was not true, and we have + * somehow updated the prefixMap during this transaction */ + prefixMap_el->flags = LDB_FLAG_MOD_ADD; + + ret = dsdb_modify(s->ldb, msg, DSDB_FLAG_AS_SYSTEM); + if (ret != LDB_SUCCESS) { + DEBUG(0,("Failed to add prefixMap: %s\n", ldb_errstring(s->ldb))); + return WERR_INTERNAL_ERROR; + } + + talloc_free(s_dsa); + talloc_free(schema_objs); + + s->schema = dsdb_get_schema(s->ldb, s); + if (!s->schema) { + DEBUG(0,("Failed to get loaded dsdb_schema\n")); + return WERR_INTERNAL_ERROR; + } + + return WERR_OK; +} + +WERROR libnet_vampire_cb_schema_chunk(void *private_data, + const struct libnet_BecomeDC_StoreChunk *c) +{ + struct libnet_vampire_cb_state *s = talloc_get_type(private_data, struct libnet_vampire_cb_state); + WERROR werr; + const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr; + uint32_t nc_object_count; + uint32_t nc_total_received = 0; + uint32_t object_count; + struct drsuapi_DsReplicaObjectListItemEx *first_object; + struct drsuapi_DsReplicaObjectListItemEx *cur; + uint32_t nc_linked_attributes_count; + uint32_t linked_attributes_count; + + switch (c->ctr_level) { + case 1: + mapping_ctr = &c->ctr1->mapping_ctr; + nc_object_count = c->ctr1->extended_ret; /* maybe w2k send this unexpected? */ + object_count = c->ctr1->object_count; + first_object = c->ctr1->first_object; + nc_linked_attributes_count = 0; + linked_attributes_count = 0; + break; + case 6: + mapping_ctr = &c->ctr6->mapping_ctr; + nc_object_count = c->ctr6->nc_object_count; + object_count = c->ctr6->object_count; + first_object = c->ctr6->first_object; + nc_linked_attributes_count = c->ctr6->nc_linked_attributes_count; + linked_attributes_count = c->ctr6->linked_attributes_count; + break; + default: + return WERR_INVALID_PARAMETER; + } + + if (!s->schema_part.first_object) { + nc_total_received = object_count; + } else { + nc_total_received = s->schema_part.object_count + object_count; + } + if (nc_object_count) { + DEBUG(0,("Schema-DN[%s] objects[%u/%u] linked_values[%u/%u]\n", + c->partition->nc.dn, nc_total_received, nc_object_count, + linked_attributes_count, nc_linked_attributes_count)); + } else { + DEBUG(0,("Schema-DN[%s] objects[%u] linked_values[%u]\n", + c->partition->nc.dn, nc_total_received, linked_attributes_count)); + } + + if (!s->self_made_schema) { + struct drsuapi_DsReplicaOIDMapping_Ctr mapping_ctr_without_schema_info; + /* Put the DRS prefixmap aside for the schema we are + * about to load in the provision, and into the one we + * are making with the help of DRS */ + + mapping_ctr_without_schema_info = *mapping_ctr; + + /* This strips off the 0xFF schema info from the end, + * because we don't want it in the blob */ + if (mapping_ctr_without_schema_info.num_mappings > 0) { + mapping_ctr_without_schema_info.num_mappings--; + } + werr = dsdb_get_drsuapi_prefixmap_as_blob(&mapping_ctr_without_schema_info, s, &s->prefixmap_blob); + if (!W_ERROR_IS_OK(werr)) { + return werr; + } + + /* Set up two manually-constructed schema - the local + * schema from the provision will be used to build + * one, which will then in turn be used to build the + * other. */ + s->self_made_schema = dsdb_new_schema(s); + if (s->self_made_schema == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + + werr = dsdb_load_prefixmap_from_drsuapi(s->self_made_schema, mapping_ctr); + if (!W_ERROR_IS_OK(werr)) { + return werr; + } + } else { + werr = dsdb_schema_pfm_contains_drsuapi_pfm(s->self_made_schema->prefixmap, mapping_ctr); + if (!W_ERROR_IS_OK(werr)) { + return werr; + } + } + + if (!s->schema_part.first_object) { + s->schema_part.object_count = object_count; + s->schema_part.first_object = talloc_steal(s, first_object); + } else { + s->schema_part.object_count += object_count; + s->schema_part.last_object->next_object = talloc_steal(s->schema_part.last_object, + first_object); + } + if (first_object != NULL) { + for (cur = first_object; cur->next_object; cur = cur->next_object) {} + } else { + cur = first_object; + } + + s->schema_part.last_object = cur; + + if (!c->partition->more_data) { + return libnet_vampire_cb_apply_schema(s, c); + } + + return WERR_OK; +} + +WERROR libnet_vampire_cb_store_chunk(void *private_data, + const struct libnet_BecomeDC_StoreChunk *c) +{ + struct libnet_vampire_cb_state *s = talloc_get_type(private_data, struct libnet_vampire_cb_state); + WERROR status; + struct dsdb_schema *schema; + const struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr; + uint32_t nc_object_count; + uint32_t object_count; + struct drsuapi_DsReplicaObjectListItemEx *first_object; + uint32_t nc_linked_attributes_count; + uint32_t linked_attributes_count; + struct drsuapi_DsReplicaLinkedAttribute *linked_attributes; + const struct drsuapi_DsReplicaCursor2CtrEx *uptodateness_vector; + struct dsdb_extended_replicated_objects *objs; + uint32_t req_replica_flags; + uint32_t dsdb_repl_flags = 0; + struct repsFromTo1 *s_dsa; + char *tmp_dns_name; + uint32_t i; + uint64_t seq_num = 0; + bool is_exop = false; + struct ldb_dn *partition_dn = NULL; + struct ldb_dn *nc_root = NULL; + + s_dsa = talloc_zero(s, struct repsFromTo1); + if (s_dsa == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + s_dsa->other_info = talloc(s_dsa, struct repsFromTo1OtherInfo); + if (s_dsa->other_info == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + + switch (c->ctr_level) { + case 1: + mapping_ctr = &c->ctr1->mapping_ctr; + nc_object_count = c->ctr1->extended_ret; /* maybe w2k send this unexpected? */ + object_count = c->ctr1->object_count; + first_object = c->ctr1->first_object; + nc_linked_attributes_count = 0; + linked_attributes_count = 0; + linked_attributes = NULL; + s_dsa->highwatermark = c->ctr1->new_highwatermark; + s_dsa->source_dsa_obj_guid = c->ctr1->source_dsa_guid; + s_dsa->source_dsa_invocation_id = c->ctr1->source_dsa_invocation_id; + uptodateness_vector = NULL; /* TODO: map it */ + break; + case 6: + mapping_ctr = &c->ctr6->mapping_ctr; + nc_object_count = c->ctr6->nc_object_count; + object_count = c->ctr6->object_count; + first_object = c->ctr6->first_object; + nc_linked_attributes_count = c->ctr6->nc_linked_attributes_count; + linked_attributes_count = c->ctr6->linked_attributes_count; + linked_attributes = c->ctr6->linked_attributes; + s_dsa->highwatermark = c->ctr6->new_highwatermark; + s_dsa->source_dsa_obj_guid = c->ctr6->source_dsa_guid; + s_dsa->source_dsa_invocation_id = c->ctr6->source_dsa_invocation_id; + uptodateness_vector = c->ctr6->uptodateness_vector; + break; + default: + return WERR_INVALID_PARAMETER; + } + + switch (c->req_level) { + case 0: + /* none */ + req_replica_flags = 0; + break; + case 5: + if (c->req5->extended_op != DRSUAPI_EXOP_NONE) { + is_exop = true; + } + req_replica_flags = c->req5->replica_flags; + break; + case 8: + if (c->req8->extended_op != DRSUAPI_EXOP_NONE) { + is_exop = true; + } + req_replica_flags = c->req8->replica_flags; + break; + case 10: + if (c->req10->extended_op != DRSUAPI_EXOP_NONE) { + is_exop = true; + } + req_replica_flags = c->req10->replica_flags; + + if (c->req10->more_flags & DRSUAPI_DRS_GET_TGT) { + dsdb_repl_flags |= DSDB_REPL_FLAG_TARGETS_UPTODATE; + } + break; + default: + return WERR_INVALID_PARAMETER; + } + + /* + * If the peer DC doesn't support GET_TGT (req v10), then the link + * targets are as up-to-date as they're ever gonna be. (Without this, + * cases where we'd normally retry with GET_TGT cause the join to fail) + */ + if (c->req_level < 10) { + dsdb_repl_flags |= DSDB_REPL_FLAG_TARGETS_UPTODATE; + } + + if (req_replica_flags & DRSUAPI_DRS_CRITICAL_ONLY || is_exop) { + /* + * If we only replicate the critical objects, or this + * is an exop we should not remember what we already + * got, as it is incomplete. + */ + ZERO_STRUCT(s_dsa->highwatermark); + uptodateness_vector = NULL; + dsdb_repl_flags |= DSDB_REPL_FLAG_OBJECT_SUBSET; + } + + /* TODO: avoid hardcoded flags */ + s_dsa->replica_flags = DRSUAPI_DRS_WRIT_REP + | DRSUAPI_DRS_INIT_SYNC + | DRSUAPI_DRS_PER_SYNC; + memset(s_dsa->schedule, 0x11, sizeof(s_dsa->schedule)); + + tmp_dns_name = GUID_string(s_dsa->other_info, &s_dsa->source_dsa_obj_guid); + if (tmp_dns_name == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + tmp_dns_name = talloc_asprintf_append_buffer(tmp_dns_name, "._msdcs.%s", c->forest->dns_name); + if (tmp_dns_name == NULL) { + return WERR_NOT_ENOUGH_MEMORY; + } + s_dsa->other_info->dns_name = tmp_dns_name; + + /* we want to show a count per partition */ + if (!s->last_partition || strcmp(s->last_partition, c->partition->nc.dn) != 0) { + s->total_objects = 0; + s->total_links = 0; + talloc_free(s->last_partition); + s->last_partition = talloc_strdup(s, c->partition->nc.dn); + } + s->total_objects += object_count; + s->total_links += linked_attributes_count; + + partition_dn = ldb_dn_new(s_dsa, s->ldb, c->partition->nc.dn); + if (partition_dn == NULL) { + DEBUG(0,("Failed to parse partition DN from DRS.\n")); + return WERR_INVALID_PARAMETER; + } + + if (is_exop) { + int ret; + if (nc_object_count) { + DEBUG(0,("Exop on[%s] objects[%u/%u] linked_values[%u/%u]\n", + c->partition->nc.dn, s->total_objects, nc_object_count, + s->total_links, nc_linked_attributes_count)); + } else { + DEBUG(0,("Exop on[%s] objects[%u] linked_values[%u]\n", + c->partition->nc.dn, s->total_objects, linked_attributes_count)); + } + ret = dsdb_find_nc_root(s->ldb, s_dsa, + partition_dn, &nc_root); + if (ret != LDB_SUCCESS) { + DEBUG(0,(__location__ ": Failed to find nc_root for %s\n", + ldb_dn_get_linearized(partition_dn))); + return WERR_INTERNAL_ERROR; + } + } else { + if (nc_object_count) { + DEBUG(0,("Partition[%s] objects[%u/%u] linked_values[%u/%u]\n", + c->partition->nc.dn, s->total_objects, nc_object_count, + s->total_links, nc_linked_attributes_count)); + } else { + DEBUG(0,("Partition[%s] objects[%u] linked_values[%u]\n", + c->partition->nc.dn, s->total_objects, s->total_links)); + } + nc_root = partition_dn; + } + + + schema = dsdb_get_schema(s->ldb, NULL); + if (!schema) { + DEBUG(0,(__location__ ": Schema is not loaded yet!\n")); + return WERR_INTERNAL_ERROR; + } + + if (req_replica_flags & DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS) { + dsdb_repl_flags |= DSDB_REPL_FLAG_PRIORITISE_INCOMING; + } + + if (req_replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) { + dsdb_repl_flags |= DSDB_REPL_FLAG_EXPECT_NO_SECRETS; + } + + status = dsdb_replicated_objects_convert(s->ldb, + schema, + nc_root, + mapping_ctr, + object_count, + first_object, + linked_attributes_count, + linked_attributes, + s_dsa, + uptodateness_vector, + c->gensec_skey, + dsdb_repl_flags, + s, &objs); + if (!W_ERROR_IS_OK(status)) { + DEBUG(0,("Failed to convert objects: %s\n", win_errstr(status))); + return status; + } + + if (lpcfg_parm_bool(s->lp_ctx, NULL, "become dc", "dump objects", false)) { + for (i=0; i < objs->num_objects; i++) { + struct ldb_ldif ldif; + fprintf(stdout, "#\n"); + ldif.changetype = LDB_CHANGETYPE_NONE; + ldif.msg = objs->objects[i].msg; + ldb_ldif_write_file(s->ldb, stdout, &ldif); + NDR_PRINT_DEBUG(replPropertyMetaDataBlob, objs->objects[i].meta_data); + } + } + status = dsdb_replicated_objects_commit(s->ldb, NULL, objs, &seq_num); + if (!W_ERROR_IS_OK(status)) { + DEBUG(0,("Failed to commit objects: %s\n", win_errstr(status))); + return status; + } + + /* reset debug counters once we've finished replicating the partition */ + if (!c->partition->more_data) { + s->total_objects = 0; + s->total_links = 0; + } + + talloc_free(s_dsa); + talloc_free(objs); + + for (i=0; i < linked_attributes_count; i++) { + const struct dsdb_attribute *sa; + + if (!linked_attributes[i].identifier) { + DEBUG(0, ("No linked attribute identifier\n")); + return WERR_INTERNAL_ERROR; + } + + if (!linked_attributes[i].value.blob) { + DEBUG(0, ("No linked attribute value\n")); + return WERR_INTERNAL_ERROR; + } + + sa = dsdb_attribute_by_attributeID_id(s->schema, + linked_attributes[i].attid); + if (!sa) { + DEBUG(0, ("Unable to find attribute via attribute id %d\n", linked_attributes[i].attid)); + return WERR_INTERNAL_ERROR; + } + + if (lpcfg_parm_bool(s->lp_ctx, NULL, "become dc", "dump objects", false)) { + DEBUG(0,("# %s\n", sa->lDAPDisplayName)); + NDR_PRINT_DEBUG(drsuapi_DsReplicaLinkedAttribute, &linked_attributes[i]); + dump_data(0, + linked_attributes[i].value.blob->data, + linked_attributes[i].value.blob->length); + } + } + + return WERR_OK; +} + diff --git a/source4/libnet/libnet_vampire.h b/source4/libnet/libnet_vampire.h new file mode 100644 index 0000000..ea616ab --- /dev/null +++ b/source4/libnet/libnet_vampire.h @@ -0,0 +1,58 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Stefan Metzmacher 2004 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + Copyright (C) Brad Henry 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef __LIBNET_VAMPIRE_H__ +#define __LIBNET_VAMPIRE_H__ + +struct libnet_Vampire { + struct { + const char *domain_name; + const char *netbios_name; + const char *targetdir; + } in; + + struct { + struct dom_sid *domain_sid; + const char *domain_name; + const char *error_string; + } out; +}; + +struct libnet_Replicate { + struct { + const char *domain_name; + const char *netbios_name; + const char *targetdir; /* optional, may be NULL */ + struct dom_sid *domain_sid; + const char *realm; + const char *server; + const char *join_password; + uint32_t kvno; + } in; + struct { + const char *error_string; + } out; +}; + +/* Private context for the default callbacks */ +struct libnet_vampire_cb_state; + +#endif /* __LIBNET_VAMPIRE_H__ */ diff --git a/source4/libnet/prereq_domain.c b/source4/libnet/prereq_domain.c new file mode 100644 index 0000000..679669e --- /dev/null +++ b/source4/libnet/prereq_domain.c @@ -0,0 +1,144 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2006 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +#include "includes.h" +#include "libnet/libnet.h" +#include "libcli/composite/composite.h" +#include "auth/credentials/credentials.h" +#include "librpc/ndr/libndr.h" +#include "librpc/gen_ndr/samr.h" +#include "librpc/gen_ndr/ndr_samr.h" +#include "librpc/gen_ndr/lsa.h" +#include "librpc/gen_ndr/ndr_lsa.h" + + +bool samr_domain_opened(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + const char *domain_name, + struct composite_context **parent_ctx, + struct libnet_DomainOpen *domain_open, + void (*continue_fn)(struct composite_context*), + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *domopen_req; + + if (parent_ctx == NULL || *parent_ctx == NULL) return false; + + if (domain_name == NULL) { + /* + * Try to guess the domain name from credentials, + * if it's not been explicitly specified. + */ + + if (ndr_policy_handle_empty(&ctx->samr.handle)) { + domain_open->in.type = DOMAIN_SAMR; + domain_open->in.domain_name = cli_credentials_get_domain(ctx->cred); + domain_open->in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + + } else { + composite_error(*parent_ctx, NT_STATUS_INVALID_PARAMETER); + return true; + } + + } else { + /* + * The domain name has been specified, so check whether the same + * domain is already opened. If it is - just return NULL. Start + * opening a new domain otherwise. + */ + + if (ndr_policy_handle_empty(&ctx->samr.handle) || + !strequal(domain_name, ctx->samr.name)) { + domain_open->in.type = DOMAIN_SAMR; + domain_open->in.domain_name = domain_name; + domain_open->in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + + } else { + /* domain has already been opened and it's the same domain + as requested */ + return true; + } + } + + /* send request to open the domain */ + domopen_req = libnet_DomainOpen_send(ctx, mem_ctx, domain_open, monitor); + if (composite_nomem(domopen_req, *parent_ctx)) return false; + + composite_continue(*parent_ctx, domopen_req, continue_fn, *parent_ctx); + return false; +} + + +bool lsa_domain_opened(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, + const char *domain_name, + struct composite_context **parent_ctx, + struct libnet_DomainOpen *domain_open, + void (*continue_fn)(struct composite_context*), + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *domopen_req; + + if (parent_ctx == NULL || *parent_ctx == NULL) return false; + + if (domain_name == NULL) { + /* + * Try to guess the domain name from credentials, + * if it's not been explicitly specified. + */ + + if (ndr_policy_handle_empty(&ctx->lsa.handle)) { + domain_open->in.type = DOMAIN_LSA; + domain_open->in.domain_name = cli_credentials_get_domain(ctx->cred); + domain_open->in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + + } else { + composite_error(*parent_ctx, NT_STATUS_INVALID_PARAMETER); + /* this ensures the calling function exits and composite function error + gets noticed quickly */ + return true; + } + + } else { + /* + * The domain name has been specified, so check whether the same + * domain is already opened. If it is - just return NULL. Start + * opening a new domain otherwise. + */ + + if (ndr_policy_handle_empty(&ctx->lsa.handle) || + !strequal(domain_name, ctx->lsa.name)) { + domain_open->in.type = DOMAIN_LSA; + domain_open->in.domain_name = domain_name; + domain_open->in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + + } else { + /* domain has already been opened and it's the same domain + as requested */ + return true; + } + } + + /* send request to open the domain */ + domopen_req = libnet_DomainOpen_send(ctx, mem_ctx, domain_open, monitor); + /* see the comment above to find out why true is returned here */ + if (composite_nomem(domopen_req, *parent_ctx)) return true; + + composite_continue(*parent_ctx, domopen_req, continue_fn, *parent_ctx); + return false; +} diff --git a/source4/libnet/py_net.c b/source4/libnet/py_net.c new file mode 100644 index 0000000..071ad04 --- /dev/null +++ b/source4/libnet/py_net.c @@ -0,0 +1,950 @@ +/* + Unix SMB/CIFS implementation. + Samba utility functions + + Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2008-2010 + Copyright (C) Kamen Mazdrashki <kamen.mazdrashki@postpath.com> 2009 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "lib/replace/system/python.h" +#include "python/py3compat.h" +#include "includes.h" +#include "python/modules.h" +#include <pyldb.h> +#include <pytalloc.h> +#include "libnet.h" +#include "auth/credentials/pycredentials.h" +#include "libcli/security/security.h" +#include "lib/events/events.h" +#include "param/pyparam.h" +#include "auth/gensec/gensec.h" +#include "librpc/rpc/pyrpc_util.h" +#include "libcli/resolve/resolve.h" +#include "libcli/finddc.h" +#include "dsdb/samdb/samdb.h" +#include "py_net.h" +#include "librpc/rpc/pyrpc_util.h" +#include "libcli/drsuapi/drsuapi.h" + +static void PyErr_SetDsExtendedError(enum drsuapi_DsExtendedError ext_err, const char *error_description) +{ + PyObject *mod = NULL; + PyObject *error = NULL; + mod = PyImport_ImportModule("samba"); + if (mod) { + error = PyObject_GetAttrString(mod, "DsExtendedError"); + } + if (error_description == NULL) { + switch (ext_err) { + /* Copied out of ndr_drsuapi.c:ndr_print_drsuapi_DsExtendedError() */ + case DRSUAPI_EXOP_ERR_NONE: + error_description = "DRSUAPI_EXOP_ERR_NONE"; + break; + case DRSUAPI_EXOP_ERR_SUCCESS: + error_description = "DRSUAPI_EXOP_ERR_SUCCESS"; + break; + case DRSUAPI_EXOP_ERR_UNKNOWN_OP: + error_description = "DRSUAPI_EXOP_ERR_UNKNOWN_OP"; + break; + case DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER: + error_description = "DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER"; + break; + case DRSUAPI_EXOP_ERR_UPDATE_ERR: + error_description = "DRSUAPI_EXOP_ERR_UPDATE_ERR"; + break; + case DRSUAPI_EXOP_ERR_EXCEPTION: + error_description = "DRSUAPI_EXOP_ERR_EXCEPTION"; + break; + case DRSUAPI_EXOP_ERR_UNKNOWN_CALLER: + error_description = "DRSUAPI_EXOP_ERR_UNKNOWN_CALLER"; + break; + case DRSUAPI_EXOP_ERR_RID_ALLOC: + error_description = "DRSUAPI_EXOP_ERR_RID_ALLOC"; + break; + case DRSUAPI_EXOP_ERR_FSMO_OWNER_DELETED: + error_description = "DRSUAPI_EXOP_ERR_FSMO_OWNER_DELETED"; + break; + case DRSUAPI_EXOP_ERR_FMSO_PENDING_OP: + error_description = "DRSUAPI_EXOP_ERR_FMSO_PENDING_OP"; + break; + case DRSUAPI_EXOP_ERR_MISMATCH: + error_description = "DRSUAPI_EXOP_ERR_MISMATCH"; + break; + case DRSUAPI_EXOP_ERR_COULDNT_CONTACT: + error_description = "DRSUAPI_EXOP_ERR_COULDNT_CONTACT"; + break; + case DRSUAPI_EXOP_ERR_FSMO_REFUSING_ROLES: + error_description = "DRSUAPI_EXOP_ERR_FSMO_REFUSING_ROLES"; + break; + case DRSUAPI_EXOP_ERR_DIR_ERROR: + error_description = "DRSUAPI_EXOP_ERR_DIR_ERROR"; + break; + case DRSUAPI_EXOP_ERR_FSMO_MISSING_SETTINGS: + error_description = "DRSUAPI_EXOP_ERR_FSMO_MISSING_SETTINGS"; + break; + case DRSUAPI_EXOP_ERR_ACCESS_DENIED: + error_description = "DRSUAPI_EXOP_ERR_ACCESS_DENIED"; + break; + case DRSUAPI_EXOP_ERR_PARAM_ERROR: + error_description = "DRSUAPI_EXOP_ERR_PARAM_ERROR"; + break; + } + } + if (error) { + PyObject *value = + Py_BuildValue(discard_const_p(char, "(i,s)"), + ext_err, + error_description); + PyErr_SetObject(error, value); + if (value) { + Py_DECREF(value); + } + Py_DECREF(error); + } +} + +static PyObject *py_net_join_member(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + struct libnet_Join_member r; + int _level = 0; + NTSTATUS status; + PyObject *result; + TALLOC_CTX *mem_ctx; + const char *kwnames[] = { "domain_name", "netbios_name", "level", "machinepass", NULL }; + + ZERO_STRUCT(r); + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "ssi|z:Join", discard_const_p(char *, kwnames), + &r.in.domain_name, &r.in.netbios_name, + &_level, + &r.in.account_pass)) { + return NULL; + } + r.in.level = _level; + + mem_ctx = talloc_new(self->mem_ctx); + if (mem_ctx == NULL) { + PyErr_NoMemory(); + return NULL; + } + + status = libnet_Join_member(self->libnet_ctx, mem_ctx, &r); + if (NT_STATUS_IS_ERR(status)) { + PyErr_SetNTSTATUS_and_string(status, + r.out.error_string + ? r.out.error_string + : nt_errstr(status)); + talloc_free(mem_ctx); + return NULL; + } + + result = Py_BuildValue("sss", r.out.join_password, + dom_sid_string(mem_ctx, r.out.domain_sid), + r.out.domain_name); + + talloc_free(mem_ctx); + + return result; +} + +static const char py_net_join_member_doc[] = "join_member(domain_name, netbios_name, level) -> (join_password, domain_sid, domain_name)\n\n" \ +"Join the domain with the specified name."; + +static PyObject *py_net_change_password(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + union libnet_ChangePassword r; + NTSTATUS status; + TALLOC_CTX *mem_ctx = NULL; + struct tevent_context *ev = NULL; + const char *kwnames[] = { "newpassword", "oldpassword", "domain", "username", NULL }; + const char *newpass = NULL; + const char *oldpass = NULL; + ZERO_STRUCT(r); + if (!PyArg_ParseTupleAndKeywords(args, kwargs, PYARG_STR_UNI + "|"PYARG_STR_UNI"ss:change_password", + discard_const_p(char *, kwnames), + "utf8", + &newpass, + "utf8", + &oldpass, + &r.generic.in.domain_name, + &r.generic.in.account_name)) { + return NULL; + } + + r.generic.in.newpassword = newpass; + r.generic.in.oldpassword = oldpass; + + r.generic.level = LIBNET_CHANGE_PASSWORD_GENERIC; + if (r.generic.in.account_name == NULL) { + r.generic.in.account_name + = cli_credentials_get_username(self->libnet_ctx->cred); + } + if (r.generic.in.domain_name == NULL) { + r.generic.in.domain_name + = cli_credentials_get_domain(self->libnet_ctx->cred); + } + if (r.generic.in.oldpassword == NULL) { + r.generic.in.oldpassword + = cli_credentials_get_password(self->libnet_ctx->cred); + } + + /* FIXME: we really need to get a context from the caller or we may end + * up with 2 event contexts */ + ev = s4_event_context_init(NULL); + + mem_ctx = talloc_new(ev); + if (mem_ctx == NULL) { + PyMem_Free(discard_const_p(char, newpass)); + PyMem_Free(discard_const_p(char, oldpass)); + PyErr_NoMemory(); + return NULL; + } + + status = libnet_ChangePassword(self->libnet_ctx, mem_ctx, &r); + + PyMem_Free(discard_const_p(char, newpass)); + PyMem_Free(discard_const_p(char, oldpass)); + + if (NT_STATUS_IS_ERR(status)) { + PyErr_SetNTSTATUS_and_string(status, + r.generic.out.error_string + ? r.generic.out.error_string + : nt_errstr(status)); + talloc_free(mem_ctx); + return NULL; + } + + talloc_free(mem_ctx); + Py_RETURN_NONE; +} + +static const char py_net_change_password_doc[] = "change_password(newpassword) -> True\n\n" \ +"Change password for a user. You must supply credential with enough rights to do this.\n\n" \ +"Sample usage is:\n" \ +"net.change_password(newpassword=<new_password>)\n"; + + +static PyObject *py_net_set_password(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + union libnet_SetPassword r; + NTSTATUS status; + TALLOC_CTX *mem_ctx; + struct tevent_context *ev; + const char *kwnames[] = { "account_name", "domain_name", "newpassword", "force_samr_18", NULL }; + PyObject *py_force_samr_18 = Py_False; + + ZERO_STRUCT(r); + + r.generic.level = LIBNET_SET_PASSWORD_GENERIC; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sss|O:set_password", + discard_const_p(char *, kwnames), + &r.generic.in.account_name, + &r.generic.in.domain_name, + &r.generic.in.newpassword, + &py_force_samr_18)) { + return NULL; + } + + if (py_force_samr_18) { + if (!PyBool_Check(py_force_samr_18)) { + PyErr_SetString(PyExc_TypeError, "Expected boolean force_samr_18"); + return NULL; + } + if (py_force_samr_18 == Py_True) { + r.generic.samr_level = LIBNET_SET_PASSWORD_SAMR_HANDLE_18; + } + } + + /* FIXME: we really need to get a context from the caller or we may end + * up with 2 event contexts */ + ev = s4_event_context_init(NULL); + + mem_ctx = talloc_new(ev); + if (mem_ctx == NULL) { + PyErr_NoMemory(); + return NULL; + } + + status = libnet_SetPassword(self->libnet_ctx, mem_ctx, &r); + if (NT_STATUS_IS_ERR(status)) { + PyErr_SetNTSTATUS_and_string(status, + r.generic.out.error_string + ? r.generic.out.error_string + : nt_errstr(status)); + talloc_free(mem_ctx); + return NULL; + } + + talloc_free(mem_ctx); + + Py_RETURN_NONE; +} + +static const char py_net_set_password_doc[] = "set_password(account_name, domain_name, newpassword) -> True\n\n" \ +"Set password for a user. You must supply credential with enough rights to do this.\n\n" \ +"Sample usage is:\n" \ +"net.set_password(account_name=account_name, domain_name=domain_name, newpassword=new_pass)\n"; + + +static PyObject *py_net_time(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + const char *kwnames[] = { "server_name", NULL }; + union libnet_RemoteTOD r; + NTSTATUS status; + TALLOC_CTX *mem_ctx; + char timestr[64]; + PyObject *ret; + struct tm *tm; + size_t len; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s", + discard_const_p(char *, kwnames), &r.generic.in.server_name)) + return NULL; + + r.generic.level = LIBNET_REMOTE_TOD_GENERIC; + + mem_ctx = talloc_new(NULL); + if (mem_ctx == NULL) { + PyErr_NoMemory(); + return NULL; + } + + status = libnet_RemoteTOD(self->libnet_ctx, mem_ctx, &r); + if (!NT_STATUS_IS_OK(status)) { + PyErr_SetNTSTATUS_and_string(status, + r.generic.out.error_string + ? r.generic.out.error_string + : nt_errstr(status)); + talloc_free(mem_ctx); + return NULL; + } + + ZERO_STRUCT(timestr); + tm = localtime(&r.generic.out.time); + + len = strftime(timestr, sizeof(timestr), "%c %Z", tm); + if (len == 0) { + PyErr_NoMemory(); + ret = NULL; + } else { + ret = PyUnicode_FromStringAndSize(timestr, (Py_ssize_t)len); + } + + talloc_free(mem_ctx); + return ret; +} + +static const char py_net_time_doc[] = "time(server_name) -> timestr\n" +"Retrieve the remote time on a server"; + +static PyObject *py_net_user_create(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + const char *kwnames[] = { "username", NULL }; + NTSTATUS status; + TALLOC_CTX *mem_ctx; + struct libnet_CreateUser r; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s", discard_const_p(char *, kwnames), + &r.in.user_name)) + return NULL; + + r.in.domain_name = cli_credentials_get_domain(self->libnet_ctx->cred); + + mem_ctx = talloc_new(NULL); + if (mem_ctx == NULL) { + PyErr_NoMemory(); + return NULL; + } + + status = libnet_CreateUser(self->libnet_ctx, mem_ctx, &r); + if (!NT_STATUS_IS_OK(status)) { + PyErr_SetNTSTATUS_and_string(status, + r.out.error_string + ? r.out.error_string + : nt_errstr(status)); + talloc_free(mem_ctx); + return NULL; + } + + talloc_free(mem_ctx); + + Py_RETURN_NONE; +} + +static const char py_net_create_user_doc[] = "create_user(username)\n" +"Create a new user."; + +static PyObject *py_net_user_delete(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + const char *kwnames[] = { "username", NULL }; + NTSTATUS status; + TALLOC_CTX *mem_ctx; + struct libnet_DeleteUser r; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s", discard_const_p(char *, kwnames), + &r.in.user_name)) + return NULL; + + r.in.domain_name = cli_credentials_get_domain(self->libnet_ctx->cred); + + mem_ctx = talloc_new(NULL); + if (mem_ctx == NULL) { + PyErr_NoMemory(); + return NULL; + } + + status = libnet_DeleteUser(self->libnet_ctx, mem_ctx, &r); + if (!NT_STATUS_IS_OK(status)) { + PyErr_SetNTSTATUS_and_string(status, + r.out.error_string + ? r.out.error_string + : nt_errstr(status)); + talloc_free(mem_ctx); + return NULL; + } + + talloc_free(mem_ctx); + + Py_RETURN_NONE; +} + +static const char py_net_delete_user_doc[] = "delete_user(username)\n" +"Delete a user."; + +struct replicate_state { + void *vampire_state; + dcerpc_InterfaceObject *drs_pipe; + struct libnet_BecomeDC_StoreChunk chunk; + DATA_BLOB gensec_skey; + struct libnet_BecomeDC_Partition partition; + struct libnet_BecomeDC_Forest forest; + struct libnet_BecomeDC_DestDSA dest_dsa; +}; + +/* + setup for replicate_chunk() calls + */ +static PyObject *py_net_replicate_init(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + const char *kwnames[] = { "samdb", "lp", "drspipe", "invocation_id", NULL }; + PyObject *py_ldb, *py_lp, *py_drspipe, *py_invocation_id; + struct ldb_context *samdb; + struct loadparm_context *lp; + struct replicate_state *s; + NTSTATUS status; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "OOOO", + discard_const_p(char *, kwnames), + &py_ldb, &py_lp, &py_drspipe, + &py_invocation_id)) { + return NULL; + } + + s = talloc_zero(NULL, struct replicate_state); + if (!s) return NULL; + + lp = lpcfg_from_py_object(s, py_lp); + if (lp == NULL) { + PyErr_SetString(PyExc_TypeError, "Expected lp object"); + talloc_free(s); + return NULL; + } + + samdb = pyldb_Ldb_AsLdbContext(py_ldb); + if (samdb == NULL) { + PyErr_SetString(PyExc_TypeError, "Expected ldb object"); + talloc_free(s); + return NULL; + } + if (!py_check_dcerpc_type(py_invocation_id, "samba.dcerpc.misc", "GUID")) { + + talloc_free(s); + return NULL; + } + s->dest_dsa.invocation_id = *pytalloc_get_type(py_invocation_id, struct GUID); + + s->drs_pipe = (dcerpc_InterfaceObject *)(py_drspipe); + + s->vampire_state = libnet_vampire_replicate_init(s, samdb, lp); + if (s->vampire_state == NULL) { + PyErr_SetString(PyExc_TypeError, "Failed to initialise vampire_state"); + talloc_free(s); + return NULL; + } + + status = gensec_session_key(s->drs_pipe->pipe->conn->security_state.generic_state, + s, + &s->gensec_skey); + if (!NT_STATUS_IS_OK(status)) { + char *error_string = talloc_asprintf(s, + "Unable to get session key from drspipe: %s", + nt_errstr(status)); + PyErr_SetNTSTATUS_and_string(status, error_string); + talloc_free(s); + return NULL; + } + + s->forest.dns_name = samdb_dn_to_dns_domain(s, ldb_get_root_basedn(samdb)); + s->forest.root_dn_str = ldb_dn_get_linearized(ldb_get_root_basedn(samdb)); + s->forest.config_dn_str = ldb_dn_get_linearized(ldb_get_config_basedn(samdb)); + s->forest.schema_dn_str = ldb_dn_get_linearized(ldb_get_schema_basedn(samdb)); + + s->chunk.gensec_skey = &s->gensec_skey; + s->chunk.partition = &s->partition; + s->chunk.forest = &s->forest; + s->chunk.dest_dsa = &s->dest_dsa; + + return pytalloc_GenericObject_steal(s); +} + + +/* + process one replication chunk + */ +static PyObject *py_net_replicate_chunk(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + const char *kwnames[] = { "state", "level", "ctr", + "schema", "req_level", "req", + NULL }; + PyObject *py_state, *py_ctr, *py_schema = Py_None, *py_req = Py_None; + struct replicate_state *s; + unsigned level; + unsigned req_level = 0; + WERROR (*chunk_handler)(void *private_data, const struct libnet_BecomeDC_StoreChunk *c); + WERROR werr; + enum drsuapi_DsExtendedError extended_ret = DRSUAPI_EXOP_ERR_NONE; + enum drsuapi_DsExtendedOperation exop = DRSUAPI_EXOP_NONE; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "OIO|OIO", + discard_const_p(char *, kwnames), + &py_state, &level, &py_ctr, + &py_schema, &req_level, &py_req)) { + return NULL; + } + + s = pytalloc_get_type(py_state, struct replicate_state); + if (!s) { + return NULL; + } + + switch (level) { + case 1: + if (!py_check_dcerpc_type(py_ctr, "samba.dcerpc.drsuapi", "DsGetNCChangesCtr1")) { + return NULL; + } + s->chunk.ctr1 = pytalloc_get_ptr(py_ctr); + if (s->chunk.ctr1->naming_context != NULL) { + s->partition.nc = *s->chunk.ctr1->naming_context; + } + extended_ret = s->chunk.ctr1->extended_ret; + s->partition.more_data = s->chunk.ctr1->more_data; + s->partition.source_dsa_guid = s->chunk.ctr1->source_dsa_guid; + s->partition.source_dsa_invocation_id = s->chunk.ctr1->source_dsa_invocation_id; + s->partition.highwatermark = s->chunk.ctr1->new_highwatermark; + break; + case 6: + if (!py_check_dcerpc_type(py_ctr, "samba.dcerpc.drsuapi", "DsGetNCChangesCtr6")) { + return NULL; + } + s->chunk.ctr6 = pytalloc_get_ptr(py_ctr); + if (s->chunk.ctr6->naming_context != NULL) { + s->partition.nc = *s->chunk.ctr6->naming_context; + } + extended_ret = s->chunk.ctr6->extended_ret; + s->partition.more_data = s->chunk.ctr6->more_data; + s->partition.source_dsa_guid = s->chunk.ctr6->source_dsa_guid; + s->partition.source_dsa_invocation_id = s->chunk.ctr6->source_dsa_invocation_id; + s->partition.highwatermark = s->chunk.ctr6->new_highwatermark; + break; + default: + PyErr_Format(PyExc_TypeError, "Bad level %u in replicate_chunk", level); + return NULL; + } + + s->chunk.req5 = NULL; + s->chunk.req8 = NULL; + s->chunk.req10 = NULL; + if (py_req != Py_None) { + switch (req_level) { + case 0: + break; + case 5: + if (!py_check_dcerpc_type(py_req, "samba.dcerpc.drsuapi", "DsGetNCChangesRequest5")) { + return NULL; + } + + s->chunk.req5 = pytalloc_get_ptr(py_req); + exop = s->chunk.req5->extended_op; + break; + case 8: + if (!py_check_dcerpc_type(py_req, "samba.dcerpc.drsuapi", "DsGetNCChangesRequest8")) { + return NULL; + } + + s->chunk.req8 = pytalloc_get_ptr(py_req); + exop = s->chunk.req8->extended_op; + break; + case 10: + if (!py_check_dcerpc_type(py_req, "samba.dcerpc.drsuapi", "DsGetNCChangesRequest10")) { + return NULL; + } + + s->chunk.req10 = pytalloc_get_ptr(py_req); + exop = s->chunk.req10->extended_op; + break; + default: + PyErr_Format(PyExc_TypeError, "Bad req_level %u in replicate_chunk", req_level); + return NULL; + } + } + + if (exop != DRSUAPI_EXOP_NONE && extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) { + PyErr_SetDsExtendedError(extended_ret, NULL); + return NULL; + } + + s->chunk.req_level = req_level; + + chunk_handler = libnet_vampire_cb_store_chunk; + if (py_schema) { + if (!PyBool_Check(py_schema)) { + PyErr_SetString(PyExc_TypeError, "Expected boolean schema"); + return NULL; + } + if (py_schema == Py_True) { + chunk_handler = libnet_vampire_cb_schema_chunk; + } + } + + s->chunk.ctr_level = level; + + werr = chunk_handler(s->vampire_state, &s->chunk); + if (!W_ERROR_IS_OK(werr)) { + char *error_string + = talloc_asprintf(NULL, + "Failed to process 'chunk' of DRS replicated objects: %s", + win_errstr(werr)); + PyErr_SetWERROR_and_string(werr, error_string); + TALLOC_FREE(error_string); + return NULL; + } + + Py_RETURN_NONE; +} + + +/* + just do the decryption of a DRS replicated attribute + */ +static PyObject *py_net_replicate_decrypt(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + const char *kwnames[] = { "drspipe", "attribute", "rid", NULL }; + PyObject *py_drspipe, *py_attribute; + NTSTATUS status; + dcerpc_InterfaceObject *drs_pipe; + TALLOC_CTX *frame; + TALLOC_CTX *context; + DATA_BLOB gensec_skey; + unsigned int rid; + struct drsuapi_DsReplicaAttribute *attribute; + WERROR werr; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "OOI", + discard_const_p(char *, kwnames), + &py_drspipe, + &py_attribute, &rid)) { + return NULL; + } + + frame = talloc_stackframe(); + + if (!py_check_dcerpc_type(py_drspipe, + "samba.dcerpc.base", + "ClientConnection")) { + return NULL; + } + drs_pipe = (dcerpc_InterfaceObject *)(py_drspipe); + + status = gensec_session_key(drs_pipe->pipe->conn->security_state.generic_state, + frame, + &gensec_skey); + if (!NT_STATUS_IS_OK(status)) { + char *error_string + = talloc_asprintf(frame, + "Unable to get session key from drspipe: %s", + nt_errstr(status)); + PyErr_SetNTSTATUS_and_string(status, error_string); + talloc_free(frame); + return NULL; + } + + if (!py_check_dcerpc_type(py_attribute, "samba.dcerpc.drsuapi", + "DsReplicaAttribute")) { + return NULL; + } + + attribute = pytalloc_get_ptr(py_attribute); + context = pytalloc_get_mem_ctx(py_attribute); + werr = drsuapi_decrypt_attribute(context, &gensec_skey, + rid, 0, attribute); + if (!W_ERROR_IS_OK(werr)) { + char *error_string = talloc_asprintf(frame, + "Unable to get decrypt attribute: %s", + win_errstr(werr)); + PyErr_SetWERROR_and_string(werr, error_string); + talloc_free(frame); + return NULL; + } + + talloc_free(frame); + + Py_RETURN_NONE; + +} + +/* + find a DC given a domain name and server type + */ +static PyObject *py_net_finddc(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + const char *domain = NULL, *address = NULL; + unsigned server_type; + NTSTATUS status; + struct finddcs *io; + TALLOC_CTX *mem_ctx; + PyObject *ret; + const char * const kwnames[] = { "flags", "domain", "address", NULL }; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "I|zz", + discard_const_p(char *, kwnames), + &server_type, &domain, &address)) { + return NULL; + } + + mem_ctx = talloc_new(self->mem_ctx); + if (mem_ctx == NULL) { + PyErr_NoMemory(); + return NULL; + } + + io = talloc_zero(mem_ctx, struct finddcs); + if (io == NULL) { + TALLOC_FREE(mem_ctx); + PyErr_NoMemory(); + return NULL; + } + + if (domain != NULL) { + io->in.domain_name = domain; + } + if (address != NULL) { + io->in.server_address = address; + } + io->in.minimum_dc_flags = server_type; + + status = finddcs_cldap(io, io, + lpcfg_resolve_context(self->libnet_ctx->lp_ctx), self->ev); + if (NT_STATUS_IS_ERR(status)) { + PyErr_SetNTSTATUS(status); + talloc_free(mem_ctx); + return NULL; + } + + ret = py_return_ndr_struct("samba.dcerpc.nbt", "NETLOGON_SAM_LOGON_RESPONSE_EX", + io, &io->out.netlogon.data.nt5_ex); + talloc_free(mem_ctx); + + return ret; +} + + +static const char py_net_replicate_init_doc[] = "replicate_init(samdb, lp, drspipe)\n" + "Setup for replicate_chunk calls."; + +static const char py_net_replicate_chunk_doc[] = "replicate_chunk(state, level, ctr, schema)\n" + "Process replication for one chunk"; + +static const char py_net_replicate_decrypt_doc[] = "replicate_decrypt(drs, attribute, rid)\n" + "Decrypt (in place) a DsReplicaAttribute replicated with drs.GetNCChanges()"; + +static const char py_net_finddc_doc[] = "finddc(flags=server_type, domain=None, address=None)\n" + "Find a DC with the specified 'server_type' bits. The 'domain' and/or 'address' have to be used as additional search criteria. Returns the whole netlogon struct"; + +static PyMethodDef net_obj_methods[] = { + { + .ml_name = "join_member", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_join_member), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_join_member_doc + }, + { + .ml_name = "change_password", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_change_password), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_change_password_doc + }, + { + .ml_name = "set_password", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_set_password), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_set_password_doc + }, + { + .ml_name = "time", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, py_net_time), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_time_doc + }, + { + .ml_name = "create_user", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_user_create), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_create_user_doc + }, + { + .ml_name = "delete_user", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_user_delete), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_delete_user_doc + }, + { + .ml_name = "replicate_init", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_replicate_init), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_replicate_init_doc + }, + { + .ml_name = "replicate_chunk", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_replicate_chunk), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_replicate_chunk_doc + }, + { + .ml_name = "replicate_decrypt", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_replicate_decrypt), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_replicate_decrypt_doc + }, + { + .ml_name = "finddc", + .ml_meth = PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_finddc), + .ml_flags = METH_VARARGS|METH_KEYWORDS, + .ml_doc = py_net_finddc_doc + }, + { .ml_name = NULL } +}; + +static void py_net_dealloc(py_net_Object *self) +{ + talloc_free(self->ev); + PyObject_Del(self); +} + +static PyObject *net_obj_new(PyTypeObject *type, PyObject *args, PyObject *kwargs) +{ + PyObject *py_creds, *py_lp = Py_None; + const char *kwnames[] = { "creds", "lp", "server", NULL }; + py_net_Object *ret; + struct loadparm_context *lp; + const char *server_address = NULL; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|Oz", + discard_const_p(char *, kwnames), &py_creds, &py_lp, + &server_address)) + return NULL; + + ret = PyObject_New(py_net_Object, type); + if (ret == NULL) { + return NULL; + } + + /* FIXME: we really need to get a context from the caller or we may end + * up with 2 event contexts */ + ret->ev = s4_event_context_init(NULL); + ret->mem_ctx = talloc_new(ret->ev); + + lp = lpcfg_from_py_object(ret->mem_ctx, py_lp); + if (lp == NULL) { + Py_DECREF(ret); + return NULL; + } + + ret->libnet_ctx = libnet_context_init(ret->ev, lp); + if (ret->libnet_ctx == NULL) { + PyErr_SetString(PyExc_RuntimeError, "Unable to initialize net"); + Py_DECREF(ret); + return NULL; + } + + ret->libnet_ctx->server_address = server_address; + + ret->libnet_ctx->cred = cli_credentials_from_py_object(py_creds); + if (ret->libnet_ctx->cred == NULL) { + PyErr_SetString(PyExc_TypeError, "Expected credentials object"); + Py_DECREF(ret); + return NULL; + } + + return (PyObject *)ret; +} + + +PyTypeObject py_net_Type = { + PyVarObject_HEAD_INIT(NULL, 0) + .tp_name = "net.Net", + .tp_basicsize = sizeof(py_net_Object), + .tp_dealloc = (destructor)py_net_dealloc, + .tp_methods = net_obj_methods, + .tp_new = net_obj_new, +}; + +static struct PyModuleDef moduledef = { + PyModuleDef_HEAD_INIT, + .m_name = "net", + .m_size = -1, +}; + +MODULE_INIT_FUNC(net) +{ + PyObject *m; + + if (PyType_Ready(&py_net_Type) < 0) + return NULL; + + m = PyModule_Create(&moduledef); + if (m == NULL) + return NULL; + + Py_INCREF(&py_net_Type); + PyModule_AddObject(m, "Net", (PyObject *)&py_net_Type); + PyModule_AddIntConstant(m, "LIBNET_JOINDOMAIN_AUTOMATIC", LIBNET_JOINDOMAIN_AUTOMATIC); + PyModule_AddIntConstant(m, "LIBNET_JOINDOMAIN_SPECIFIED", LIBNET_JOINDOMAIN_SPECIFIED); + PyModule_AddIntConstant(m, "LIBNET_JOIN_AUTOMATIC", LIBNET_JOIN_AUTOMATIC); + PyModule_AddIntConstant(m, "LIBNET_JOIN_SPECIFIED", LIBNET_JOIN_SPECIFIED); + + return m; +} diff --git a/source4/libnet/py_net.h b/source4/libnet/py_net.h new file mode 100644 index 0000000..2894d47 --- /dev/null +++ b/source4/libnet/py_net.h @@ -0,0 +1,24 @@ +/* + Unix SMB/CIFS implementation. + Samba python bindings to libnet library + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +typedef struct { + PyObject_HEAD + TALLOC_CTX *mem_ctx; + struct libnet_context *libnet_ctx; + struct tevent_context *ev; +} py_net_Object; diff --git a/source4/libnet/py_net_dckeytab.c b/source4/libnet/py_net_dckeytab.c new file mode 100644 index 0000000..0c3df89 --- /dev/null +++ b/source4/libnet/py_net_dckeytab.c @@ -0,0 +1,121 @@ +/* + Unix SMB/CIFS implementation. + Samba utility functions + + Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2008-2010 + Copyright (C) Kamen Mazdrashki <kamen.mazdrashki@postpath.com> 2009 + Copyright (C) Alexander Bokovoy <ab@samba.org> 2012 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "lib/replace/system/python.h" +#include "includes.h" +#include "python/py3compat.h" +#include "python/modules.h" +#include "py_net.h" +#include "libnet_export_keytab.h" + +void initdckeytab(void); + +static PyObject *py_net_export_keytab(py_net_Object *self, PyObject *args, PyObject *kwargs) +{ + struct libnet_export_keytab r; + TALLOC_CTX *mem_ctx; + const char *kwnames[] = { "keytab", "principal", NULL }; + NTSTATUS status; + r.in.principal = NULL; + + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "s|z:export_keytab", discard_const_p(char *, kwnames), + &r.in.keytab_name, + &r.in.principal)) { + return NULL; + } + + mem_ctx = talloc_new(self->mem_ctx); + if (mem_ctx == NULL) { + PyErr_NoMemory(); + return NULL; + } + + status = libnet_export_keytab(self->libnet_ctx, mem_ctx, &r); + if (NT_STATUS_IS_ERR(status)) { + PyErr_SetString(PyExc_RuntimeError, + r.out.error_string?r.out.error_string:nt_errstr(status)); + talloc_free(mem_ctx); + return NULL; + } + + talloc_free(mem_ctx); + + Py_RETURN_NONE; +} + +static const char py_net_export_keytab_doc[] = "export_keytab(keytab, name)\n\n" +"Export the DC keytab to a keytab file."; + +static PyMethodDef export_keytab_method_table[] = { + {"export_keytab", PY_DISCARD_FUNC_SIG(PyCFunction, + py_net_export_keytab), + METH_VARARGS|METH_KEYWORDS, py_net_export_keytab_doc}, + { NULL, NULL, 0, NULL } +}; + +/* + * A fake Python module to inject export_keytab() method into existing samba.net.Net class. + * Python enforces that every loaded module actually creates Python module record in + * the global module table even if we don't really need that record. Thus, we initialize + * dckeytab module but never use it. + * */ +void initdckeytab(void); +static struct PyModuleDef moduledef = { + PyModuleDef_HEAD_INIT, + .m_name = "dckeytab", + .m_doc = "dckeytab", + .m_size = -1, + .m_methods = NULL +}; + +MODULE_INIT_FUNC(dckeytab) +{ + PyObject *m = NULL; + PyObject *Net; + PyObject *descr; + int ret; + + m = PyModule_Create(&moduledef); + if (m == NULL) + return m; + + m = PyImport_ImportModule("samba.net"); + if (m == NULL) + return m; + + Net = (PyObject *)PyObject_GetAttrString(m, "Net"); + if (Net == NULL) + return m; + + descr = PyDescr_NewMethod((PyTypeObject*)Net, &export_keytab_method_table[0]); + if (descr == NULL) + return m; + + ret = PyDict_SetItemString(((PyTypeObject*)Net)->tp_dict, + export_keytab_method_table[0].ml_name, + descr); + if (ret != -1) { + Py_DECREF(descr); + } + + return m; +} diff --git a/source4/libnet/userinfo.c b/source4/libnet/userinfo.c new file mode 100644 index 0000000..ec40b81 --- /dev/null +++ b/source4/libnet/userinfo.c @@ -0,0 +1,382 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/* + a composite function for getting user information via samr pipe +*/ + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "librpc/gen_ndr/security.h" +#include "libcli/security/security.h" +#include "libnet/libnet.h" +#include "librpc/gen_ndr/ndr_samr_c.h" + + +struct userinfo_state { + struct dcerpc_binding_handle *binding_handle; + struct policy_handle domain_handle; + struct policy_handle user_handle; + uint16_t level; + struct samr_LookupNames lookup; + struct samr_OpenUser openuser; + struct samr_QueryUserInfo queryuserinfo; + struct samr_Close samrclose; + union samr_UserInfo *info; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_userinfo_lookup(struct tevent_req *subreq); +static void continue_userinfo_openuser(struct tevent_req *subreq); +static void continue_userinfo_getuser(struct tevent_req *subreq); +static void continue_userinfo_closeuser(struct tevent_req *subreq); + + +/** + * Stage 1 (optional): Look for a username in SAM server. + */ +static void continue_userinfo_lookup(struct tevent_req *subreq) +{ + struct composite_context *c; + struct userinfo_state *s; + struct monitor_msg msg; + struct msg_rpc_lookup_name *msg_lookup; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct userinfo_state); + + /* receive samr_Lookup reply */ + c->status = dcerpc_samr_LookupNames_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* there could be a problem with name resolving itself */ + if (!NT_STATUS_IS_OK(s->lookup.out.result)) { + composite_error(c, s->lookup.out.result); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + msg.type = mon_SamrLookupName; + msg_lookup = talloc(s, struct msg_rpc_lookup_name); + msg_lookup->rid = s->lookup.out.rids->ids; + msg_lookup->count = s->lookup.out.rids->count; + msg.data = (void*)msg_lookup; + msg.data_size = sizeof(*msg_lookup); + + s->monitor_fn(&msg); + } + + + /* have we actually got name resolved + - we're looking for only one at the moment */ + if (s->lookup.out.rids->count != s->lookup.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + if (s->lookup.out.types->count != s->lookup.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + /* TODO: find proper status code for more than one rid found */ + + /* prepare parameters for LookupNames */ + s->openuser.in.domain_handle = &s->domain_handle; + s->openuser.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + s->openuser.in.rid = s->lookup.out.rids->ids[0]; + s->openuser.out.user_handle = &s->user_handle; + + /* send request */ + subreq = dcerpc_samr_OpenUser_r_send(s, c->event_ctx, + s->binding_handle, + &s->openuser); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_userinfo_openuser, c); +} + + +/** + * Stage 2: Open user policy handle. + */ +static void continue_userinfo_openuser(struct tevent_req *subreq) +{ + struct composite_context *c; + struct userinfo_state *s; + struct monitor_msg msg; + struct msg_rpc_open_user *msg_open; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct userinfo_state); + + /* receive samr_OpenUser reply */ + c->status = dcerpc_samr_OpenUser_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!NT_STATUS_IS_OK(s->openuser.out.result)) { + composite_error(c, s->openuser.out.result); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + msg.type = mon_SamrOpenUser; + msg_open = talloc(s, struct msg_rpc_open_user); + msg_open->rid = s->openuser.in.rid; + msg_open->access_mask = s->openuser.in.access_mask; + msg.data = (void*)msg_open; + msg.data_size = sizeof(*msg_open); + + s->monitor_fn(&msg); + } + + /* prepare parameters for QueryUserInfo call */ + s->queryuserinfo.in.user_handle = &s->user_handle; + s->queryuserinfo.in.level = s->level; + s->queryuserinfo.out.info = talloc(s, union samr_UserInfo *); + if (composite_nomem(s->queryuserinfo.out.info, c)) return; + + /* queue rpc call, set event handling and new state */ + subreq = dcerpc_samr_QueryUserInfo_r_send(s, c->event_ctx, + s->binding_handle, + &s->queryuserinfo); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_userinfo_getuser, c); +} + + +/** + * Stage 3: Get requested user information. + */ +static void continue_userinfo_getuser(struct tevent_req *subreq) +{ + struct composite_context *c; + struct userinfo_state *s; + struct monitor_msg msg; + struct msg_rpc_query_user *msg_query; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct userinfo_state); + + /* receive samr_QueryUserInfo reply */ + c->status = dcerpc_samr_QueryUserInfo_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* check if queryuser itself went ok */ + if (!NT_STATUS_IS_OK(s->queryuserinfo.out.result)) { + composite_error(c, s->queryuserinfo.out.result); + return; + } + + s->info = talloc_steal(s, *(s->queryuserinfo.out.info)); + + /* issue a monitor message */ + if (s->monitor_fn) { + msg.type = mon_SamrQueryUser; + msg_query = talloc(s, struct msg_rpc_query_user); + msg_query->level = s->queryuserinfo.in.level; + msg.data = (void*)msg_query; + msg.data_size = sizeof(*msg_query); + + s->monitor_fn(&msg); + } + + /* prepare arguments for Close call */ + s->samrclose.in.handle = &s->user_handle; + s->samrclose.out.handle = &s->user_handle; + + /* queue rpc call, set event handling and new state */ + subreq = dcerpc_samr_Close_r_send(s, c->event_ctx, + s->binding_handle, + &s->samrclose); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_userinfo_closeuser, c); +} + + +/** + * Stage 4: Close policy handle associated with opened user. + */ +static void continue_userinfo_closeuser(struct tevent_req *subreq) +{ + struct composite_context *c; + struct userinfo_state *s; + struct monitor_msg msg; + struct msg_rpc_close_user *msg_close; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type_abort(c->private_data, struct userinfo_state); + + /* receive samr_Close reply */ + c->status = dcerpc_samr_Close_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + if (!NT_STATUS_IS_OK(s->samrclose.out.result)) { + composite_error(c, s->samrclose.out.result); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + msg.type = mon_SamrClose; + msg_close = talloc(s, struct msg_rpc_close_user); + msg_close->rid = s->openuser.in.rid; + msg.data = (void*)msg_close; + msg.data_size = sizeof(*msg_close); + + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +/** + * Sends asynchronous userinfo request + * + * @param p dce/rpc call pipe + * @param io arguments and results of the call + */ +struct composite_context *libnet_rpc_userinfo_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct dcerpc_binding_handle *b, + struct libnet_rpc_userinfo *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct userinfo_state *s; + struct dom_sid *sid; + struct tevent_req *subreq; + + if (!b || !io) return NULL; + + c = composite_create(mem_ctx, ev); + if (c == NULL) return c; + + s = talloc_zero(c, struct userinfo_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + s->level = io->in.level; + s->binding_handle= b; + s->domain_handle = io->in.domain_handle; + s->monitor_fn = monitor; + + if (io->in.sid) { + sid = dom_sid_parse_talloc(s, io->in.sid); + if (composite_nomem(sid, c)) return c; + + s->openuser.in.domain_handle = &s->domain_handle; + s->openuser.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + s->openuser.in.rid = sid->sub_auths[sid->num_auths - 1]; + s->openuser.out.user_handle = &s->user_handle; + + /* send request */ + subreq = dcerpc_samr_OpenUser_r_send(s, c->event_ctx, + s->binding_handle, + &s->openuser); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_userinfo_openuser, c); + + } else { + /* preparing parameters to send rpc request */ + s->lookup.in.domain_handle = &s->domain_handle; + s->lookup.in.num_names = 1; + s->lookup.in.names = talloc_array(s, struct lsa_String, 1); + if (composite_nomem(s->lookup.in.names, c)) return c; + s->lookup.out.rids = talloc_zero(s, struct samr_Ids); + s->lookup.out.types = talloc_zero(s, struct samr_Ids); + if (composite_nomem(s->lookup.out.rids, c)) return c; + if (composite_nomem(s->lookup.out.types, c)) return c; + + s->lookup.in.names[0].string = talloc_strdup(s, io->in.username); + if (composite_nomem(s->lookup.in.names[0].string, c)) return c; + + /* send request */ + subreq = dcerpc_samr_LookupNames_r_send(s, c->event_ctx, + s->binding_handle, + &s->lookup); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_userinfo_lookup, c); + } + + return c; +} + + +/** + * Waits for and receives result of asynchronous userinfo call + * + * @param c composite context returned by asynchronous userinfo call + * @param mem_ctx memory context of the call + * @param io pointer to results (and arguments) of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_userinfo_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_rpc_userinfo *io) +{ + NTSTATUS status; + struct userinfo_state *s; + + /* wait for results of sending request */ + status = composite_wait(c); + + if (NT_STATUS_IS_OK(status) && io) { + s = talloc_get_type_abort(c->private_data, struct userinfo_state); + talloc_steal(mem_ctx, s->info); + io->out.info = *s->info; + } + + /* memory context associated to composite context is no longer needed */ + talloc_free(c); + return status; +} + + +/** + * Synchronous version of userinfo call + * + * @param pipe dce/rpc call pipe + * @param mem_ctx memory context for the call + * @param io arguments and results of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_userinfo(struct tevent_context *ev, + struct dcerpc_binding_handle *b, + TALLOC_CTX *mem_ctx, + struct libnet_rpc_userinfo *io) +{ + struct composite_context *c = libnet_rpc_userinfo_send(mem_ctx, ev, b, io, NULL); + return libnet_rpc_userinfo_recv(c, mem_ctx, io); +} diff --git a/source4/libnet/userinfo.h b/source4/libnet/userinfo.h new file mode 100644 index 0000000..273ad87 --- /dev/null +++ b/source4/libnet/userinfo.h @@ -0,0 +1,54 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +#include "librpc/gen_ndr/samr.h" + +/* + * IO structures for userinfo.c functions + */ + +struct libnet_rpc_userinfo { + struct { + struct policy_handle domain_handle; + const char *username; + const char *sid; + uint16_t level; + } in; + struct { + union samr_UserInfo info; + } out; +}; + + +/* + * Monitor messages sent from userinfo.c functions + */ + +struct msg_rpc_open_user { + uint32_t rid, access_mask; +}; + +struct msg_rpc_query_user { + uint16_t level; +}; + +struct msg_rpc_close_user { + uint32_t rid; +}; diff --git a/source4/libnet/userman.c b/source4/libnet/userman.c new file mode 100644 index 0000000..9e76364 --- /dev/null +++ b/source4/libnet/userman.c @@ -0,0 +1,922 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/* + a composite functions for user management operations (add/del/chg) +*/ + +#include "includes.h" +#include "libcli/composite/composite.h" +#include "libnet/libnet.h" +#include "librpc/gen_ndr/ndr_samr_c.h" + +/* + * Composite USER ADD functionality + */ + +struct useradd_state { + struct dcerpc_binding_handle *binding_handle; + struct policy_handle domain_handle; + struct samr_CreateUser createuser; + struct policy_handle user_handle; + uint32_t user_rid; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_useradd_create(struct tevent_req *subreq); + + +/** + * Stage 1 (and the only one for now): Create user account. + */ +static void continue_useradd_create(struct tevent_req *subreq) +{ + struct composite_context *c; + struct useradd_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct useradd_state); + + /* check rpc layer status code */ + c->status = dcerpc_samr_CreateUser_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* check create user call status code */ + c->status = s->createuser.out.result; + + /* get created user account data */ + s->user_handle = *s->createuser.out.user_handle; + s->user_rid = *s->createuser.out.rid; + + /* issue a monitor message */ + if (s->monitor_fn) { + struct monitor_msg msg; + struct msg_rpc_create_user rpc_create; + + rpc_create.rid = *s->createuser.out.rid; + + msg.type = mon_SamrCreateUser; + msg.data = (void*)&rpc_create; + msg.data_size = sizeof(rpc_create); + + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +/** + * Sends asynchronous useradd request + * + * @param p dce/rpc call pipe + * @param io arguments and results of the call + * @param monitor monitor function for providing information about the progress + */ + +struct composite_context *libnet_rpc_useradd_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct dcerpc_binding_handle *b, + struct libnet_rpc_useradd *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct useradd_state *s; + struct tevent_req *subreq; + + if (!b || !io) return NULL; + + /* composite allocation and setup */ + c = composite_create(mem_ctx, ev); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct useradd_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* put passed arguments to the state structure */ + s->domain_handle = io->in.domain_handle; + s->binding_handle= b; + s->monitor_fn = monitor; + + /* preparing parameters to send rpc request */ + s->createuser.in.domain_handle = &io->in.domain_handle; + + s->createuser.in.account_name = talloc_zero(c, struct lsa_String); + if (composite_nomem(s->createuser.in.account_name, c)) return c; + + s->createuser.in.account_name->string = talloc_strdup(c, io->in.username); + if (composite_nomem(s->createuser.in.account_name->string, c)) return c; + + s->createuser.out.user_handle = &s->user_handle; + s->createuser.out.rid = &s->user_rid; + + /* send the request */ + subreq = dcerpc_samr_CreateUser_r_send(s, c->event_ctx, + s->binding_handle, + &s->createuser); + if (composite_nomem(subreq, c)) return c; + + tevent_req_set_callback(subreq, continue_useradd_create, c); + return c; +} + + +/** + * Waits for and receives result of asynchronous useradd call + * + * @param c composite context returned by asynchronous useradd call + * @param mem_ctx memory context of the call + * @param io pointer to results (and arguments) of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_useradd_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_rpc_useradd *io) +{ + NTSTATUS status; + struct useradd_state *s; + + status = composite_wait(c); + + if (NT_STATUS_IS_OK(status) && io) { + /* get and return result of the call */ + s = talloc_get_type(c->private_data, struct useradd_state); + io->out.user_handle = s->user_handle; + } + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of useradd call + * + * @param pipe dce/rpc call pipe + * @param mem_ctx memory context for the call + * @param io arguments and results of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_useradd(struct tevent_context *ev, + struct dcerpc_binding_handle *b, + TALLOC_CTX *mem_ctx, + struct libnet_rpc_useradd *io) +{ + struct composite_context *c = libnet_rpc_useradd_send(mem_ctx, ev, b, io, NULL); + return libnet_rpc_useradd_recv(c, mem_ctx, io); +} + + + +/* + * Composite USER DELETE functionality + */ + + +struct userdel_state { + struct dcerpc_binding_handle *binding_handle; + struct policy_handle domain_handle; + struct policy_handle user_handle; + struct samr_LookupNames lookupname; + struct samr_OpenUser openuser; + struct samr_DeleteUser deleteuser; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +static void continue_userdel_name_found(struct tevent_req *subreq); +static void continue_userdel_user_opened(struct tevent_req *subreq); +static void continue_userdel_deleted(struct tevent_req *subreq); + + +/** + * Stage 1: Lookup the user name and resolve it to rid + */ +static void continue_userdel_name_found(struct tevent_req *subreq) +{ + struct composite_context *c; + struct userdel_state *s; + struct monitor_msg msg; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct userdel_state); + + /* receive samr_LookupNames result */ + c->status = dcerpc_samr_LookupNames_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + c->status = s->lookupname.out.result; + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + /* what to do when there's no user account to delete + and what if there's more than one rid resolved */ + if (s->lookupname.out.rids->count != s->lookupname.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + if (s->lookupname.out.types->count != s->lookupname.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + struct msg_rpc_lookup_name msg_lookup; + + msg_lookup.rid = s->lookupname.out.rids->ids; + msg_lookup.count = s->lookupname.out.rids->count; + + msg.type = mon_SamrLookupName; + msg.data = (void*)&msg_lookup; + msg.data_size = sizeof(msg_lookup); + s->monitor_fn(&msg); + } + + /* prepare the arguments for rpc call */ + s->openuser.in.domain_handle = &s->domain_handle; + s->openuser.in.rid = s->lookupname.out.rids->ids[0]; + s->openuser.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + s->openuser.out.user_handle = &s->user_handle; + + /* send rpc request */ + subreq = dcerpc_samr_OpenUser_r_send(s, c->event_ctx, + s->binding_handle, + &s->openuser); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_userdel_user_opened, c); +} + + +/** + * Stage 2: Open user account. + */ +static void continue_userdel_user_opened(struct tevent_req *subreq) +{ + struct composite_context *c; + struct userdel_state *s; + struct monitor_msg msg; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct userdel_state); + + /* receive samr_OpenUser result */ + c->status = dcerpc_samr_OpenUser_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + c->status = s->openuser.out.result; + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + struct msg_rpc_open_user msg_open; + + msg_open.rid = s->openuser.in.rid; + msg_open.access_mask = s->openuser.in.access_mask; + + msg.type = mon_SamrOpenUser; + msg.data = (void*)&msg_open; + msg.data_size = sizeof(msg_open); + s->monitor_fn(&msg); + } + + /* prepare the final rpc call arguments */ + s->deleteuser.in.user_handle = &s->user_handle; + s->deleteuser.out.user_handle = &s->user_handle; + + /* send rpc request */ + subreq = dcerpc_samr_DeleteUser_r_send(s, c->event_ctx, + s->binding_handle, + &s->deleteuser); + if (composite_nomem(subreq, c)) return; + + /* callback handler setup */ + tevent_req_set_callback(subreq, continue_userdel_deleted, c); +} + + +/** + * Stage 3: Delete user account + */ +static void continue_userdel_deleted(struct tevent_req *subreq) +{ + struct composite_context *c; + struct userdel_state *s; + struct monitor_msg msg; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct userdel_state); + + /* receive samr_DeleteUser result */ + c->status = dcerpc_samr_DeleteUser_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* return the actual function call status */ + c->status = s->deleteuser.out.result; + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + msg.type = mon_SamrDeleteUser; + msg.data = NULL; + msg.data_size = 0; + s->monitor_fn(&msg); + } + + composite_done(c); +} + + +/** + * Sends asynchronous userdel request + * + * @param p dce/rpc call pipe + * @param io arguments and results of the call + * @param monitor monitor function for providing information about the progress + */ + +struct composite_context *libnet_rpc_userdel_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct dcerpc_binding_handle *b, + struct libnet_rpc_userdel *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct userdel_state *s; + struct tevent_req *subreq; + + /* composite context allocation and setup */ + c = composite_create(mem_ctx, ev); + if (c == NULL) return NULL; + + s = talloc_zero(c, struct userdel_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* store function parameters in the state structure */ + s->binding_handle= b; + s->domain_handle = io->in.domain_handle; + s->monitor_fn = monitor; + + /* preparing parameters to send rpc request */ + s->lookupname.in.domain_handle = &io->in.domain_handle; + s->lookupname.in.num_names = 1; + s->lookupname.in.names = talloc_zero(s, struct lsa_String); + s->lookupname.in.names->string = io->in.username; + s->lookupname.out.rids = talloc_zero(s, struct samr_Ids); + s->lookupname.out.types = talloc_zero(s, struct samr_Ids); + if (composite_nomem(s->lookupname.out.rids, c)) return c; + if (composite_nomem(s->lookupname.out.types, c)) return c; + + /* send the request */ + subreq = dcerpc_samr_LookupNames_r_send(s, c->event_ctx, + s->binding_handle, + &s->lookupname); + if (composite_nomem(subreq, c)) return c; + + /* set the next stage */ + tevent_req_set_callback(subreq, continue_userdel_name_found, c); + return c; +} + + +/** + * Waits for and receives results of asynchronous userdel call + * + * @param c composite context returned by asynchronous userdel call + * @param mem_ctx memory context of the call + * @param io pointer to results (and arguments) of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_userdel_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_rpc_userdel *io) +{ + NTSTATUS status; + struct userdel_state *s; + + status = composite_wait(c); + + if (NT_STATUS_IS_OK(status) && io) { + s = talloc_get_type(c->private_data, struct userdel_state); + io->out.user_handle = s->user_handle; + } + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of userdel call + * + * @param pipe dce/rpc call pipe + * @param mem_ctx memory context for the call + * @param io arguments and results of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_userdel(struct tevent_context *ev, + struct dcerpc_binding_handle *b, + TALLOC_CTX *mem_ctx, + struct libnet_rpc_userdel *io) +{ + struct composite_context *c = libnet_rpc_userdel_send(mem_ctx, ev, b, io, NULL); + return libnet_rpc_userdel_recv(c, mem_ctx, io); +} + + +/* + * USER MODIFY functionality + */ + +static void continue_usermod_name_found(struct tevent_req *subreq); +static void continue_usermod_user_opened(struct tevent_req *subreq); +static void continue_usermod_user_queried(struct tevent_req *subreq); +static void continue_usermod_user_changed(struct tevent_req *subreq); + + +struct usermod_state { + struct dcerpc_binding_handle *binding_handle; + struct policy_handle domain_handle; + struct policy_handle user_handle; + struct usermod_change change; + union samr_UserInfo info; + struct samr_LookupNames lookupname; + struct samr_OpenUser openuser; + struct samr_SetUserInfo setuser; + struct samr_QueryUserInfo queryuser; + + /* information about the progress */ + void (*monitor_fn)(struct monitor_msg *); +}; + + +/** + * Step 1: Lookup user name + */ +static void continue_usermod_name_found(struct tevent_req *subreq) +{ + struct composite_context *c; + struct usermod_state *s; + struct monitor_msg msg; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct usermod_state); + + /* receive samr_LookupNames result */ + c->status = dcerpc_samr_LookupNames_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + c->status = s->lookupname.out.result; + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + /* what to do when there's no user account to delete + and what if there's more than one rid resolved */ + if (s->lookupname.out.rids->count != s->lookupname.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + if (s->lookupname.out.types->count != s->lookupname.in.num_names) { + composite_error(c, NT_STATUS_INVALID_NETWORK_RESPONSE); + return; + } + + /* issue a monitor message */ + if (s->monitor_fn) { + struct msg_rpc_lookup_name msg_lookup; + + msg_lookup.rid = s->lookupname.out.rids->ids; + msg_lookup.count = s->lookupname.out.rids->count; + + msg.type = mon_SamrLookupName; + msg.data = (void*)&msg_lookup; + msg.data_size = sizeof(msg_lookup); + s->monitor_fn(&msg); + } + + /* prepare the next rpc call */ + s->openuser.in.domain_handle = &s->domain_handle; + s->openuser.in.rid = s->lookupname.out.rids->ids[0]; + s->openuser.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + s->openuser.out.user_handle = &s->user_handle; + + /* send the rpc request */ + subreq = dcerpc_samr_OpenUser_r_send(s, c->event_ctx, + s->binding_handle, + &s->openuser); + if (composite_nomem(subreq, c)) return; + + tevent_req_set_callback(subreq, continue_usermod_user_opened, c); +} + + +/** + * Choose a proper level of samr_UserInfo structure depending on required + * change specified by means of flags field. Subsequent calls of this + * function are made until there's no flags set meaning that all of the + * changes have been made. + */ +static bool usermod_setfields(struct usermod_state *s, uint16_t *level, + union samr_UserInfo *i, bool queried) +{ + if (s->change.fields == 0) return s->change.fields; + + *level = 0; + + if ((s->change.fields & USERMOD_FIELD_ACCOUNT_NAME) && + (*level == 0 || *level == 7)) { + *level = 7; + i->info7.account_name.string = s->change.account_name; + + s->change.fields ^= USERMOD_FIELD_ACCOUNT_NAME; + } + + if ((s->change.fields & USERMOD_FIELD_FULL_NAME) && + (*level == 0 || *level == 8)) { + *level = 8; + i->info8.full_name.string = s->change.full_name; + + s->change.fields ^= USERMOD_FIELD_FULL_NAME; + } + + if ((s->change.fields & USERMOD_FIELD_DESCRIPTION) && + (*level == 0 || *level == 13)) { + *level = 13; + i->info13.description.string = s->change.description; + + s->change.fields ^= USERMOD_FIELD_DESCRIPTION; + } + + if ((s->change.fields & USERMOD_FIELD_COMMENT) && + (*level == 0 || *level == 2)) { + *level = 2; + + if (queried) { + /* the user info is obtained, so now set the required field */ + i->info2.comment.string = s->change.comment; + s->change.fields ^= USERMOD_FIELD_COMMENT; + + } else { + /* we need to query the user info before setting one field in it */ + return false; + } + } + + if ((s->change.fields & USERMOD_FIELD_LOGON_SCRIPT) && + (*level == 0 || *level == 11)) { + *level = 11; + i->info11.logon_script.string = s->change.logon_script; + + s->change.fields ^= USERMOD_FIELD_LOGON_SCRIPT; + } + + if ((s->change.fields & USERMOD_FIELD_PROFILE_PATH) && + (*level == 0 || *level == 12)) { + *level = 12; + i->info12.profile_path.string = s->change.profile_path; + + s->change.fields ^= USERMOD_FIELD_PROFILE_PATH; + } + + if ((s->change.fields & USERMOD_FIELD_HOME_DIRECTORY) && + (*level == 0 || *level == 10)) { + *level = 10; + + if (queried) { + i->info10.home_directory.string = s->change.home_directory; + s->change.fields ^= USERMOD_FIELD_HOME_DIRECTORY; + } else { + return false; + } + } + + if ((s->change.fields & USERMOD_FIELD_HOME_DRIVE) && + (*level == 0 || *level == 10)) { + *level = 10; + + if (queried) { + i->info10.home_drive.string = s->change.home_drive; + s->change.fields ^= USERMOD_FIELD_HOME_DRIVE; + } else { + return false; + } + } + + if ((s->change.fields & USERMOD_FIELD_ACCT_EXPIRY) && + (*level == 0 || *level == 17)) { + *level = 17; + i->info17.acct_expiry = timeval_to_nttime(s->change.acct_expiry); + + s->change.fields ^= USERMOD_FIELD_ACCT_EXPIRY; + } + + if ((s->change.fields & USERMOD_FIELD_ACCT_FLAGS) && + (*level == 0 || *level == 16)) { + *level = 16; + i->info16.acct_flags = s->change.acct_flags; + + s->change.fields ^= USERMOD_FIELD_ACCT_FLAGS; + } + + /* We're going to be here back again soon unless all fields have been set */ + return true; +} + + +static NTSTATUS usermod_change(struct composite_context *c, + struct usermod_state *s) +{ + bool do_set; + union samr_UserInfo *i = &s->info; + struct tevent_req *subreq; + + /* set the level to invalid value, so that unless setfields routine + gives it a valid value we report the error correctly */ + uint16_t level = 27; + + /* prepare UserInfo level and data based on bitmask field */ + do_set = usermod_setfields(s, &level, i, false); + + if (level < 1 || level > 26) { + /* apparently there's a field that the setfields routine + does not know how to set */ + return NT_STATUS_INVALID_PARAMETER; + } + + /* If some specific level is used to set user account data and the change + itself does not cover all fields then we need to query the user info + first, right before changing the data. Otherwise we could set required + fields and accidentally reset the others. + */ + if (!do_set) { + s->queryuser.in.user_handle = &s->user_handle; + s->queryuser.in.level = level; + s->queryuser.out.info = talloc(s, union samr_UserInfo *); + if (composite_nomem(s->queryuser.out.info, c)) return NT_STATUS_NO_MEMORY; + + + /* send query user info request to retrieve complete data of + a particular info level */ + subreq = dcerpc_samr_QueryUserInfo_r_send(s, c->event_ctx, + s->binding_handle, + &s->queryuser); + if (composite_nomem(subreq, c)) return NT_STATUS_NO_MEMORY; + tevent_req_set_callback(subreq, continue_usermod_user_queried, c); + + } else { + s->setuser.in.user_handle = &s->user_handle; + s->setuser.in.level = level; + s->setuser.in.info = i; + + /* send set user info request after making required change */ + subreq = dcerpc_samr_SetUserInfo_r_send(s, c->event_ctx, + s->binding_handle, + &s->setuser); + if (composite_nomem(subreq, c)) return NT_STATUS_NO_MEMORY; + tevent_req_set_callback(subreq, continue_usermod_user_changed, c); + } + + return NT_STATUS_OK; +} + + +/** + * Stage 2: Open user account + */ +static void continue_usermod_user_opened(struct tevent_req *subreq) +{ + struct composite_context *c; + struct usermod_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct usermod_state); + + c->status = dcerpc_samr_OpenUser_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + c->status = s->openuser.out.result; + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + c->status = usermod_change(c, s); +} + + +/** + * Stage 2a (optional): Query the user information + */ +static void continue_usermod_user_queried(struct tevent_req *subreq) +{ + struct composite_context *c; + struct usermod_state *s; + union samr_UserInfo *i; + uint16_t level = 0; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct usermod_state); + + i = &s->info; + + /* receive samr_QueryUserInfo result */ + c->status = dcerpc_samr_QueryUserInfo_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + c->status = s->queryuser.out.result; + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + /* get returned user data and make a change (potentially one + of many) */ + s->info = *(*s->queryuser.out.info); + + usermod_setfields(s, &level, i, true); + + /* prepare rpc call arguments */ + s->setuser.in.user_handle = &s->user_handle; + s->setuser.in.level = level; + s->setuser.in.info = i; + + /* send the rpc request */ + subreq = dcerpc_samr_SetUserInfo_r_send(s, c->event_ctx, + s->binding_handle, + &s->setuser); + if (composite_nomem(subreq, c)) return; + tevent_req_set_callback(subreq, continue_usermod_user_changed, c); +} + + +/** + * Stage 3: Set new user account data + */ +static void continue_usermod_user_changed(struct tevent_req *subreq) +{ + struct composite_context *c; + struct usermod_state *s; + + c = tevent_req_callback_data(subreq, struct composite_context); + s = talloc_get_type(c->private_data, struct usermod_state); + + /* receive samr_SetUserInfo result */ + c->status = dcerpc_samr_SetUserInfo_r_recv(subreq, s); + TALLOC_FREE(subreq); + if (!composite_is_ok(c)) return; + + /* return the actual function call status */ + c->status = s->setuser.out.result; + if (!NT_STATUS_IS_OK(c->status)) { + composite_error(c, c->status); + return; + } + + if (s->change.fields == 0) { + /* all fields have been set - we're done */ + composite_done(c); + + } else { + /* something's still not changed - repeat the procedure */ + c->status = usermod_change(c, s); + } +} + + +/** + * Sends asynchronous usermod request + * + * @param p dce/rpc call pipe + * @param io arguments and results of the call + * @param monitor monitor function for providing information about the progress + */ + +struct composite_context *libnet_rpc_usermod_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct dcerpc_binding_handle *b, + struct libnet_rpc_usermod *io, + void (*monitor)(struct monitor_msg*)) +{ + struct composite_context *c; + struct usermod_state *s; + struct tevent_req *subreq; + + /* composite context allocation and setup */ + c = composite_create(mem_ctx, ev); + if (c == NULL) return NULL; + s = talloc_zero(c, struct usermod_state); + if (composite_nomem(s, c)) return c; + + c->private_data = s; + + /* store parameters in the call structure */ + s->binding_handle= b; + s->domain_handle = io->in.domain_handle; + s->change = io->in.change; + s->monitor_fn = monitor; + + /* prepare rpc call arguments */ + s->lookupname.in.domain_handle = &io->in.domain_handle; + s->lookupname.in.num_names = 1; + s->lookupname.in.names = talloc_zero(s, struct lsa_String); + s->lookupname.in.names->string = io->in.username; + s->lookupname.out.rids = talloc_zero(s, struct samr_Ids); + s->lookupname.out.types = talloc_zero(s, struct samr_Ids); + if (composite_nomem(s->lookupname.out.rids, c)) return c; + if (composite_nomem(s->lookupname.out.types, c)) return c; + + /* send the rpc request */ + subreq = dcerpc_samr_LookupNames_r_send(s, c->event_ctx, + s->binding_handle, + &s->lookupname); + if (composite_nomem(subreq, c)) return c; + + /* callback handler setup */ + tevent_req_set_callback(subreq, continue_usermod_name_found, c); + return c; +} + + +/** + * Waits for and receives results of asynchronous usermod call + * + * @param c composite context returned by asynchronous usermod call + * @param mem_ctx memory context of the call + * @param io pointer to results (and arguments) of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_usermod_recv(struct composite_context *c, TALLOC_CTX *mem_ctx, + struct libnet_rpc_usermod *io) +{ + NTSTATUS status; + + status = composite_wait(c); + + talloc_free(c); + return status; +} + + +/** + * Synchronous version of usermod call + * + * @param pipe dce/rpc call pipe + * @param mem_ctx memory context for the call + * @param io arguments and results of the call + * @return nt status code of execution + */ + +NTSTATUS libnet_rpc_usermod(struct tevent_context *ev, + struct dcerpc_binding_handle *b, + TALLOC_CTX *mem_ctx, + struct libnet_rpc_usermod *io) +{ + struct composite_context *c = libnet_rpc_usermod_send(mem_ctx, ev, b, io, NULL); + return libnet_rpc_usermod_recv(c, mem_ctx, io); +} diff --git a/source4/libnet/userman.h b/source4/libnet/userman.h new file mode 100644 index 0000000..b681c25 --- /dev/null +++ b/source4/libnet/userman.h @@ -0,0 +1,106 @@ +/* + Unix SMB/CIFS implementation. + + Copyright (C) Rafal Szczesniak 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "librpc/gen_ndr/misc.h" + + +/* + * IO structures for userman.c functions + */ + +struct libnet_rpc_useradd { + struct { + struct policy_handle domain_handle; + const char *username; + } in; + struct { + struct policy_handle user_handle; + } out; +}; + + +struct libnet_rpc_userdel { + struct { + struct policy_handle domain_handle; + const char *username; + } in; + struct { + struct policy_handle user_handle; + } out; +}; + + +#define USERMOD_FIELD_ACCOUNT_NAME ( 0x00000001 ) +#define USERMOD_FIELD_FULL_NAME ( 0x00000002 ) +#define USERMOD_FIELD_DESCRIPTION ( 0x00000010 ) +#define USERMOD_FIELD_COMMENT ( 0x00000020 ) +#define USERMOD_FIELD_HOME_DIRECTORY ( 0x00000040 ) +#define USERMOD_FIELD_HOME_DRIVE ( 0x00000080 ) +#define USERMOD_FIELD_LOGON_SCRIPT ( 0x00000100 ) +#define USERMOD_FIELD_PROFILE_PATH ( 0x00000200 ) +#define USERMOD_FIELD_WORKSTATIONS ( 0x00000400 ) +#define USERMOD_FIELD_LOGON_HOURS ( 0x00002000 ) +#define USERMOD_FIELD_ACCT_EXPIRY ( 0x00004000 ) +#define USERMOD_FIELD_ACCT_FLAGS ( 0x00100000 ) +#define USERMOD_FIELD_PARAMETERS ( 0x00200000 ) +#define USERMOD_FIELD_COUNTRY_CODE ( 0x00400000 ) +#define USERMOD_FIELD_CODE_PAGE ( 0x00800000 ) + +struct libnet_rpc_usermod { + struct { + struct policy_handle domain_handle; + const char *username; + + struct usermod_change { + uint32_t fields; /* bitmask field */ + + const char *account_name; + const char *full_name; + const char *description; + const char *comment; + const char *logon_script; + const char *profile_path; + const char *home_directory; + const char *home_drive; + const char *workstations; + struct timeval *acct_expiry; + struct timeval *allow_password_change; + struct timeval *force_password_change; + struct timeval *last_logon; + struct timeval *last_logoff; + struct timeval *last_password_change; + uint32_t acct_flags; + } change; + } in; +}; + + +/* + * Monitor messages sent from userman.c functions + */ + +struct msg_rpc_create_user { + uint32_t rid; +}; + + +struct msg_rpc_lookup_name { + uint32_t *rid; + uint32_t count; +}; diff --git a/source4/libnet/wscript_build b/source4/libnet/wscript_build new file mode 100644 index 0000000..0ec06f2 --- /dev/null +++ b/source4/libnet/wscript_build @@ -0,0 +1,29 @@ +#!/usr/bin/env python + +pytalloc_util = bld.pyembed_libname('pytalloc-util') +pyrpc_util = bld.pyembed_libname('pyrpc_util') +provision = bld.pyembed_libname('PROVISION') +name = bld.pyembed_libname('samba-net') +auto_proto='libnet_proto.h' +bld.SAMBA_LIBRARY(name, + source='libnet.c libnet_passwd.c libnet_time.c libnet_rpc.c libnet_join.c libnet_site.c libnet_become_dc.c libnet_unbecome_dc.c libnet_vampire.c libnet_user.c libnet_group.c libnet_share.c libnet_lookup.c libnet_domain.c userinfo.c groupinfo.c userman.c groupman.c prereq_domain.c', + autoproto=auto_proto, + deps='INIT_SAMR', + public_deps='samba-credentials dcerpc dcerpc-samr RPC_NDR_LSA RPC_NDR_SRVSVC RPC_NDR_DRSUAPI cli_composite LIBCLI_RESOLVE LIBCLI_FINDDCS cli_cldap LIBCLI_FINDDCS gensec_schannel LIBCLI_AUTH ndr smbpasswdparser %s LIBCLI_SAMSYNC LIBTSOCKET GNUTLS_HELPERS' % (provision), + private_library=True, + pyembed=True, + enabled=bld.PYTHON_BUILD_IS_ENABLED() + ) + +bld.SAMBA_PYTHON('python_net', + source='py_net.c', + deps='%s %s %s' % (name, pyrpc_util, pytalloc_util), + realname='samba/net.so' + ) + +bld.SAMBA_PYTHON('python_dckeytab', + source='py_net_dckeytab.c libnet_export_keytab.c', + deps='%s db-glue krb5 com_err' % (pyrpc_util), + realname='samba/dckeytab.so', + enabled=bld.CONFIG_SET('AD_DC_BUILD_IS_ENABLED') + ) |