nsswitch/wbinfo.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind status program.
   5
   6    Copyright (C) Tim Potter      2000-2003
   7    Copyright (C) Andrew Bartlett 2002-2007
   8    Copyright (C) Volker Lendecke 2009
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbind_client.h"
  26 #include "libwbclient/wbclient.h"
  27 #include "../libcli/auth/libcli_auth.h"
  28 #include "lib/cmdline/popt_common.h"
  29 #include "lib/afs/afs_settoken.h"
  30 #include "lib/util/smb_strtox.h"
  31 #include "lib/util/string_wrappers.h"
  32
  33 #ifdef DBGC_CLASS
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_WINBIND
  36 #endif
  37
  38 static struct wbcInterfaceDetails *init_interface_details(void)
  39 {
  40         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
  41         static struct wbcInterfaceDetails *details;
  42
  43         if (details) {
  44                 return details;
  45         }
  46
  47         wbc_status = wbcInterfaceDetails(&details);
  48         if (!WBC_ERROR_IS_OK(wbc_status)) {
  49                 d_fprintf(stderr, "could not obtain winbind interface "
  50                                   "details: %s\n", wbcErrorString(wbc_status));
  51         }
  52
  53         return details;
  54 }
  55
  56 static char winbind_separator(void)
  57 {
  58         struct wbcInterfaceDetails *details;
  59         static bool got_sep;
  60         static char sep;
  61
  62         if (got_sep)
  63                 return sep;
  64
  65         details = init_interface_details();
  66
  67         if (!details) {
  68                 d_fprintf(stderr, "could not obtain winbind separator!\n");
  69                 return 0;
  70         }
  71
  72         sep = details->winbind_separator;
  73         got_sep = true;
  74
  75         if (!sep) {
  76                 d_fprintf(stderr, "winbind separator was NULL!\n");
  77                 return 0;
  78         }
  79
  80         return sep;
  81 }
  82
  83 static const char *get_winbind_domain(void)
  84 {
  85         static struct wbcInterfaceDetails *details;
  86
  87         details = init_interface_details();
  88
  89         if (!details) {
  90                 d_fprintf(stderr, "could not obtain winbind domain name!\n");
  91                 return 0;
  92         }
  93
  94         return details->netbios_domain;
  95 }
  96
  97 static const char *get_winbind_netbios_name(void)
  98 {
  99         static struct wbcInterfaceDetails *details;
 100
 101         details = init_interface_details();
 102
 103         if (!details) {
 104                 d_fprintf(stderr, "could not obtain winbind netbios name!\n");
 105                 return 0;
 106         }
 107
 108         return details->netbios_name;
 109 }
 110
 111 /* Copy of parse_domain_user from winbindd_util.c.  Parse a string of the
 112    form DOMAIN/user into a domain and a user */
 113
 114 static bool parse_wbinfo_domain_user(const char *domuser, fstring domain,
 115                                      fstring user)
 116 {
 117
 118         char *p = strchr(domuser,winbind_separator());
 119
 120         if (!p) {
 121                 /* Maybe it was a UPN? */
 122                 p = strchr(domuser, '@');
 123                 if (p != NULL) {
 124                         fstrcpy(domain, "");
 125                         fstrcpy(user, domuser);
 126                         return true;
 127                 }
 128
 129                 fstrcpy(user, domuser);
 130                 fstrcpy(domain, get_winbind_domain());
 131                 return true;
 132         }
 133
 134         fstrcpy(user, p+1);
 135         fstrcpy(domain, domuser);
 136         domain[PTR_DIFF(p, domuser)] = 0;
 137
 138         return true;
 139 }
 140
 141 /* Parse string of "uid,sid" or "gid,sid" into separate int and string values.
 142  * Return true if input was valid, false otherwise. */
 143 static bool parse_mapping_arg(char *arg, int *id, char **sid)
 144 {
 145         char *tmp;
 146         int error = 0;
 147
 148         if (!arg || !*arg)
 149                 return false;
 150
 151         tmp = strtok(arg, ",");
 152         *sid = strtok(NULL, ",");
 153
 154         if (!tmp || !*tmp || !*sid || !**sid)
 155                 return false;
 156
 157         /* Because atoi() can return 0 on invalid input, which would be a valid
 158          * UID/GID we must use strtoul() and do error checking */
 159         *id = smb_strtoul(tmp, NULL, 10, &error, SMB_STR_FULL_STR_CONV);
 160         if (error != 0)
 161                 return false;
 162
 163         return true;
 164 }
 165
 166 /* pull pwent info for a given user */
 167
 168 static bool wbinfo_get_userinfo(char *user)
 169 {
 170         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 171         struct passwd *pwd = NULL;
 172
 173         wbc_status = wbcGetpwnam(user, &pwd);
 174         if (!WBC_ERROR_IS_OK(wbc_status)) {
 175                 d_fprintf(stderr, "failed to call wbcGetpwnam: %s\n",
 176                           wbcErrorString(wbc_status));
 177                 return false;
 178         }
 179
 180         d_printf("%s:%s:%u:%u:%s:%s:%s\n",
 181                  pwd->pw_name,
 182                  pwd->pw_passwd,
 183                  (unsigned int)pwd->pw_uid,
 184                  (unsigned int)pwd->pw_gid,
 185                  pwd->pw_gecos,
 186                  pwd->pw_dir,
 187                  pwd->pw_shell);
 188
 189         wbcFreeMemory(pwd);
 190
 191         return true;
 192 }
 193
 194 /* pull pwent info for a given uid */
 195 static bool wbinfo_get_uidinfo(int uid)
 196 {
 197         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 198         struct passwd *pwd = NULL;
 199
 200         wbc_status = wbcGetpwuid(uid, &pwd);
 201         if (!WBC_ERROR_IS_OK(wbc_status)) {
 202                 d_fprintf(stderr, "failed to call wbcGetpwuid: %s\n",
 203                           wbcErrorString(wbc_status));
 204                 return false;
 205         }
 206
 207         d_printf("%s:%s:%u:%u:%s:%s:%s\n",
 208                  pwd->pw_name,
 209                  pwd->pw_passwd,
 210                  (unsigned int)pwd->pw_uid,
 211                  (unsigned int)pwd->pw_gid,
 212                  pwd->pw_gecos,
 213                  pwd->pw_dir,
 214                  pwd->pw_shell);
 215
 216         wbcFreeMemory(pwd);
 217
 218         return true;
 219 }
 220
 221 static bool wbinfo_get_user_sidinfo(const char *sid_str)
 222 {
 223         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 224         struct passwd *pwd = NULL;
 225         struct wbcDomainSid sid;
 226
 227         wbc_status = wbcStringToSid(sid_str, &sid);
 228         wbc_status = wbcGetpwsid(&sid, &pwd);
 229         if (!WBC_ERROR_IS_OK(wbc_status)) {
 230                 d_fprintf(stderr, "failed to call wbcGetpwsid: %s\n",
 231                           wbcErrorString(wbc_status));
 232                 return false;
 233         }
 234
 235         d_printf("%s:%s:%u:%u:%s:%s:%s\n",
 236                  pwd->pw_name,
 237                  pwd->pw_passwd,
 238                  (unsigned int)pwd->pw_uid,
 239                  (unsigned int)pwd->pw_gid,
 240                  pwd->pw_gecos,
 241                  pwd->pw_dir,
 242                  pwd->pw_shell);
 243
 244         wbcFreeMemory(pwd);
 245
 246         return true;
 247 }
 248
 249
 250 /* pull grent for a given group */
 251 static bool wbinfo_get_groupinfo(const char *group)
 252 {
 253         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 254         struct group *grp;
 255         char **mem;
 256
 257         wbc_status = wbcGetgrnam(group, &grp);
 258         if (!WBC_ERROR_IS_OK(wbc_status)) {
 259                 d_fprintf(stderr, "failed to call wbcGetgrnam: %s\n",
 260                           wbcErrorString(wbc_status));
 261                 return false;
 262         }
 263
 264         d_printf("%s:%s:%u:",
 265                  grp->gr_name,
 266                  grp->gr_passwd,
 267                  (unsigned int)grp->gr_gid);
 268
 269         mem = grp->gr_mem;
 270         while (*mem != NULL) {
 271                 d_printf("%s%s", *mem, *(mem+1) != NULL ? "," : "");
 272                 mem += 1;
 273         }
 274         d_printf("\n");
 275
 276         wbcFreeMemory(grp);
 277
 278         return true;
 279 }
 280
 281 /* pull grent for a given gid */
 282 static bool wbinfo_get_gidinfo(int gid)
 283 {
 284         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 285         struct group *grp;
 286         char **mem;
 287
 288         wbc_status = wbcGetgrgid(gid, &grp);
 289         if (!WBC_ERROR_IS_OK(wbc_status)) {
 290                 d_fprintf(stderr, "failed to call wbcGetgrgid: %s\n",
 291                           wbcErrorString(wbc_status));
 292                 return false;
 293         }
 294
 295         d_printf("%s:%s:%u:",
 296                  grp->gr_name,
 297                  grp->gr_passwd,
 298                  (unsigned int)grp->gr_gid);
 299
 300         mem = grp->gr_mem;
 301         while (*mem != NULL) {
 302                 d_printf("%s%s", *mem, *(mem+1) != NULL ? "," : "");
 303                 mem += 1;
 304         }
 305         d_printf("\n");
 306
 307         wbcFreeMemory(grp);
 308
 309         return true;
 310 }
 311
 312 /* List groups a user is a member of */
 313
 314 static bool wbinfo_get_usergroups(const char *user)
 315 {
 316         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 317         uint32_t num_groups;
 318         uint32_t i;
 319         gid_t *groups = NULL;
 320
 321         /* Send request */
 322
 323         wbc_status = wbcGetGroups(user, &num_groups, &groups);
 324         if (!WBC_ERROR_IS_OK(wbc_status)) {
 325                 d_fprintf(stderr, "failed to call wbcGetGroups: %s\n",
 326                           wbcErrorString(wbc_status));
 327                 return false;
 328         }
 329
 330         for (i = 0; i < num_groups; i++) {
 331                 d_printf("%d\n", (int)groups[i]);
 332         }
 333
 334         wbcFreeMemory(groups);
 335
 336         return true;
 337 }
 338
 339
 340 /* List group SIDs a user SID is a member of */
 341 static bool wbinfo_get_usersids(const char *user_sid_str)
 342 {
 343         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 344         uint32_t num_sids;
 345         uint32_t i;
 346         struct wbcDomainSid user_sid, *sids = NULL;
 347
 348         /* Send request */
 349
 350         wbc_status = wbcStringToSid(user_sid_str, &user_sid);
 351         if (!WBC_ERROR_IS_OK(wbc_status)) {
 352                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
 353                           wbcErrorString(wbc_status));
 354                 return false;
 355         }
 356
 357         wbc_status = wbcLookupUserSids(&user_sid, false, &num_sids, &sids);
 358         if (!WBC_ERROR_IS_OK(wbc_status)) {
 359                 d_fprintf(stderr, "failed to call wbcLookupUserSids: %s\n",
 360                           wbcErrorString(wbc_status));
 361                 return false;
 362         }
 363
 364         for (i = 0; i < num_sids; i++) {
 365                 char str[WBC_SID_STRING_BUFLEN];
 366                 wbcSidToStringBuf(&sids[i], str, sizeof(str));
 367                 d_printf("%s\n", str);
 368         }
 369
 370         wbcFreeMemory(sids);
 371
 372         return true;
 373 }
 374
 375 static bool wbinfo_get_userdomgroups(const char *user_sid_str)
 376 {
 377         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 378         uint32_t num_sids;
 379         uint32_t i;
 380         struct wbcDomainSid user_sid, *sids = NULL;
 381
 382         /* Send request */
 383
 384         wbc_status = wbcStringToSid(user_sid_str, &user_sid);
 385         if (!WBC_ERROR_IS_OK(wbc_status)) {
 386                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
 387                           wbcErrorString(wbc_status));
 388                 return false;
 389         }
 390
 391         wbc_status = wbcLookupUserSids(&user_sid, true, &num_sids, &sids);
 392         if (!WBC_ERROR_IS_OK(wbc_status)) {
 393                 d_fprintf(stderr, "failed to call wbcLookupUserSids: %s\n",
 394                           wbcErrorString(wbc_status));
 395                 return false;
 396         }
 397
 398         for (i = 0; i < num_sids; i++) {
 399                 char str[WBC_SID_STRING_BUFLEN];
 400                 wbcSidToStringBuf(&sids[i], str, sizeof(str));
 401                 d_printf("%s\n", str);
 402         }
 403
 404         wbcFreeMemory(sids);
 405
 406         return true;
 407 }
 408
 409 static bool wbinfo_get_sidaliases(const char *domain,
 410                                   const char *user_sid_str)
 411 {
 412         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 413         struct wbcDomainInfo *dinfo = NULL;
 414         uint32_t i;
 415         struct wbcDomainSid user_sid;
 416         uint32_t *alias_rids = NULL;
 417         uint32_t num_alias_rids;
 418         char domain_sid_str[WBC_SID_STRING_BUFLEN];
 419
 420         /* Send request */
 421         if ((domain == NULL) || (strequal(domain, ".")) ||
 422            (domain[0] == '\0')) {
 423                 domain = get_winbind_domain();
 424         }
 425
 426         /* Send request */
 427
 428         wbc_status = wbcDomainInfo(domain, &dinfo);
 429         if (!WBC_ERROR_IS_OK(wbc_status)) {
 430                 d_fprintf(stderr, "wbcDomainInfo(%s) failed: %s\n", domain,
 431                           wbcErrorString(wbc_status));
 432                 goto done;
 433         }
 434         wbc_status = wbcStringToSid(user_sid_str, &user_sid);
 435         if (!WBC_ERROR_IS_OK(wbc_status)) {
 436                 goto done;
 437         }
 438
 439         wbc_status = wbcGetSidAliases(&dinfo->sid, &user_sid, 1,
 440             &alias_rids, &num_alias_rids);
 441         if (!WBC_ERROR_IS_OK(wbc_status)) {
 442                 goto done;
 443         }
 444
 445         wbcSidToStringBuf(&dinfo->sid, domain_sid_str, sizeof(domain_sid_str));
 446
 447         for (i = 0; i < num_alias_rids; i++) {
 448                 d_printf("%s-%d\n", domain_sid_str, alias_rids[i]);
 449         }
 450
 451         wbcFreeMemory(alias_rids);
 452
 453 done:
 454         wbcFreeMemory(dinfo);
 455         return (WBC_ERR_SUCCESS == wbc_status);
 456 }
 457
 458
 459 /* Convert NetBIOS name to IP */
 460
 461 static bool wbinfo_wins_byname(const char *name)
 462 {
 463         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 464         char *ip = NULL;
 465
 466         wbc_status = wbcResolveWinsByName(name, &ip);
 467         if (!WBC_ERROR_IS_OK(wbc_status)) {
 468                 d_fprintf(stderr, "failed to call wbcResolveWinsByName: %s\n",
 469                           wbcErrorString(wbc_status));
 470                 return false;
 471         }
 472
 473         /* Display response */
 474
 475         d_printf("%s\n", ip);
 476
 477         wbcFreeMemory(ip);
 478
 479         return true;
 480 }
 481
 482 /* Convert IP to NetBIOS name */
 483
 484 static bool wbinfo_wins_byip(const char *ip)
 485 {
 486         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 487         char *name = NULL;
 488
 489         wbc_status = wbcResolveWinsByIP(ip, &name);
 490         if (!WBC_ERROR_IS_OK(wbc_status)) {
 491                 d_fprintf(stderr, "failed to call wbcResolveWinsByIP: %s\n",
 492                           wbcErrorString(wbc_status));
 493                 return false;
 494         }
 495
 496         /* Display response */
 497
 498         d_printf("%s\n", name);
 499
 500         wbcFreeMemory(name);
 501
 502         return true;
 503 }
 504
 505 /* List all/trusted domains */
 506
 507 static bool wbinfo_list_domains(bool list_all_domains, bool verbose)
 508 {
 509         struct wbcDomainInfo *domain_list = NULL;
 510         size_t i, num_domains;
 511         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 512         bool print_all = !list_all_domains && verbose;
 513
 514         wbc_status = wbcListTrusts(&domain_list, &num_domains);
 515         if (!WBC_ERROR_IS_OK(wbc_status)) {
 516                 d_fprintf(stderr, "failed to call wbcListTrusts: %s\n",
 517                           wbcErrorString(wbc_status));
 518                 return false;
 519         }
 520
 521         if (print_all) {
 522                 d_printf("%-16s%-65s%-12s%-12s%-5s%-5s\n",
 523                          "Domain Name", "DNS Domain", "Trust Type",
 524                          "Transitive", "In", "Out");
 525         }
 526
 527         for (i=0; i<num_domains; i++) {
 528                 if (print_all) {
 529                         d_printf("%-16s", domain_list[i].short_name);
 530                 } else {
 531                         d_printf("%s", domain_list[i].short_name);
 532                         d_printf("\n");
 533                         continue;
 534                 }
 535
 536                 d_printf("%-65s", domain_list[i].dns_name);
 537
 538                 switch(domain_list[i].trust_type) {
 539                 case WBC_DOMINFO_TRUSTTYPE_NONE:
 540                         if (domain_list[i].trust_routing != NULL) {
 541                                 d_printf("%s\n", domain_list[i].trust_routing);
 542                         } else {
 543                                 d_printf("None\n");
 544                         }
 545                         continue;
 546                 case WBC_DOMINFO_TRUSTTYPE_LOCAL:
 547                         d_printf("Local\n");
 548                         continue;
 549                 case WBC_DOMINFO_TRUSTTYPE_RWDC:
 550                         d_printf("RWDC\n");
 551                         continue;
 552                 case WBC_DOMINFO_TRUSTTYPE_RODC:
 553                         d_printf("RODC\n");
 554                         continue;
 555                 case WBC_DOMINFO_TRUSTTYPE_PDC:
 556                         d_printf("PDC\n");
 557                         continue;
 558                 case WBC_DOMINFO_TRUSTTYPE_WKSTA:
 559                         d_printf("Workstation ");
 560                         break;
 561                 case WBC_DOMINFO_TRUSTTYPE_FOREST:
 562                         d_printf("Forest      ");
 563                         break;
 564                 case WBC_DOMINFO_TRUSTTYPE_EXTERNAL:
 565                         d_printf("External    ");
 566                         break;
 567                 case WBC_DOMINFO_TRUSTTYPE_IN_FOREST:
 568                         d_printf("In-Forest   ");
 569                         break;
 570                 }
 571
 572                 if (domain_list[i].trust_flags & WBC_DOMINFO_TRUST_TRANSITIVE) {
 573                         d_printf("Yes         ");
 574                 } else {
 575                         d_printf("No          ");
 576                 }
 577
 578                 if (domain_list[i].trust_flags & WBC_DOMINFO_TRUST_INCOMING) {
 579                         d_printf("Yes  ");
 580                 } else {
 581                         d_printf("No   ");
 582                 }
 583
 584                 if (domain_list[i].trust_flags & WBC_DOMINFO_TRUST_OUTGOING) {
 585                         d_printf("Yes  ");
 586                 } else {
 587                         d_printf("No   ");
 588                 }
 589
 590                 d_printf("\n");
 591         }
 592
 593         wbcFreeMemory(domain_list);
 594
 595         return true;
 596 }
 597
 598 /* List own domain */
 599
 600 static bool wbinfo_list_own_domain(void)
 601 {
 602         d_printf("%s\n", get_winbind_domain());
 603
 604         return true;
 605 }
 606
 607 /* show sequence numbers */
 608 static bool wbinfo_show_sequence(const char *domain)
 609 {
 610         d_printf("This command has been deprecated.  Please use the "
 611                  "--online-status option instead.\n");
 612         return false;
 613 }
 614
 615 /* show sequence numbers */
 616 static bool wbinfo_show_onlinestatus(const char *domain)
 617 {
 618         struct wbcDomainInfo *domain_list = NULL;
 619         size_t i, num_domains;
 620         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 621
 622         wbc_status = wbcListTrusts(&domain_list, &num_domains);
 623         if (!WBC_ERROR_IS_OK(wbc_status)) {
 624                 d_fprintf(stderr, "failed to call wbcListTrusts: %s\n",
 625                           wbcErrorString(wbc_status));
 626                 return false;
 627         }
 628
 629         for (i=0; i<num_domains; i++) {
 630                 bool is_offline;
 631
 632                 if (domain) {
 633                         if (!strequal(domain_list[i].short_name, domain)) {
 634                                 continue;
 635                         }
 636                 }
 637
 638                 is_offline = (domain_list[i].domain_flags &
 639                               WBC_DOMINFO_DOMAIN_OFFLINE);
 640
 641                 d_printf("%s : %s\n",
 642                          domain_list[i].short_name,
 643                          is_offline ? "no active connection" : "active connection" );
 644         }
 645
 646         wbcFreeMemory(domain_list);
 647
 648         return true;
 649 }
 650
 651
 652 /* Show domain info */
 653
 654 static bool wbinfo_domain_info(const char *domain)
 655 {
 656         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 657         struct wbcDomainInfo *dinfo = NULL;
 658         char sid_str[WBC_SID_STRING_BUFLEN];
 659
 660         if ((domain == NULL) || (strequal(domain, ".")) || (domain[0] == '\0')){
 661                 domain = get_winbind_domain();
 662         }
 663
 664         /* Send request */
 665
 666         wbc_status = wbcDomainInfo(domain, &dinfo);
 667         if (!WBC_ERROR_IS_OK(wbc_status)) {
 668                 d_fprintf(stderr, "failed to call wbcDomainInfo: %s\n",
 669                           wbcErrorString(wbc_status));
 670                 return false;
 671         }
 672
 673         wbcSidToStringBuf(&dinfo->sid, sid_str, sizeof(sid_str));
 674
 675         /* Display response */
 676
 677         d_printf("Name              : %s\n", dinfo->short_name);
 678         d_printf("Alt_Name          : %s\n", dinfo->dns_name);
 679
 680         d_printf("SID               : %s\n", sid_str);
 681
 682         d_printf("Active Directory  : %s\n",
 683                  (dinfo->domain_flags & WBC_DOMINFO_DOMAIN_AD) ? "Yes" : "No");
 684         d_printf("Native            : %s\n",
 685                  (dinfo->domain_flags & WBC_DOMINFO_DOMAIN_NATIVE) ?
 686                  "Yes" : "No");
 687
 688         d_printf("Primary           : %s\n",
 689                  (dinfo->domain_flags & WBC_DOMINFO_DOMAIN_PRIMARY) ?
 690                  "Yes" : "No");
 691
 692         wbcFreeMemory(dinfo);
 693
 694         return true;
 695 }
 696
 697 /* Get a foreign DC's name */
 698 static bool wbinfo_getdcname(const char *domain_name)
 699 {
 700         struct winbindd_request request;
 701         struct winbindd_response response;
 702
 703         ZERO_STRUCT(request);
 704         ZERO_STRUCT(response);
 705
 706         fstrcpy(request.domain_name, domain_name);
 707
 708         /* Send request */
 709
 710         if (winbindd_request_response(NULL, WINBINDD_GETDCNAME, &request,
 711                                       &response) != NSS_STATUS_SUCCESS) {
 712                 d_fprintf(stderr, "Could not get dc name for %s\n",domain_name);
 713                 return false;
 714         }
 715
 716         /* Display response */
 717
 718         d_printf("%s\n", response.data.dc_name);
 719
 720         return true;
 721 }
 722
 723 /* Find a DC */
 724 static bool wbinfo_dsgetdcname(const char *domain_name, uint32_t flags)
 725 {
 726         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 727         struct wbcDomainControllerInfoEx *dc_info;
 728         char *str = NULL;
 729
 730         wbc_status = wbcLookupDomainControllerEx(domain_name, NULL, NULL,
 731                                                  flags | DS_DIRECTORY_SERVICE_REQUIRED,
 732                                                  &dc_info);
 733         if (!WBC_ERROR_IS_OK(wbc_status)) {
 734                 printf("Could not find dc for %s\n", domain_name);
 735                 return false;
 736         }
 737
 738         wbcGuidToString(dc_info->domain_guid, &str);
 739
 740         d_printf("%s\n", dc_info->dc_unc);
 741         d_printf("%s\n", dc_info->dc_address);
 742         d_printf("%d\n", dc_info->dc_address_type);
 743         d_printf("%s\n", str);
 744         d_printf("%s\n", dc_info->domain_name);
 745         d_printf("%s\n", dc_info->forest_name);
 746         d_printf("0x%08x\n", dc_info->dc_flags);
 747         d_printf("%s\n", dc_info->dc_site_name);
 748         d_printf("%s\n", dc_info->client_site_name);
 749
 750         wbcFreeMemory(str);
 751         wbcFreeMemory(dc_info);
 752
 753         return true;
 754 }
 755
 756 /* Check trust account password */
 757
 758 static bool wbinfo_check_secret(const char *domain)
 759 {
 760         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 761         struct wbcAuthErrorInfo *error = NULL;
 762         const char *domain_name;
 763
 764         if (domain) {
 765                 domain_name = domain;
 766         } else {
 767                 domain_name = get_winbind_domain();
 768         }
 769
 770         wbc_status = wbcCheckTrustCredentials(domain_name, &error);
 771
 772         d_printf("checking the trust secret for domain %s via RPC calls %s\n",
 773                 domain_name,
 774                 WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
 775
 776         if (wbc_status == WBC_ERR_AUTH_ERROR) {
 777                 d_fprintf(stderr, "wbcCheckTrustCredentials(%s): error code was %s (0x%x)\n",
 778                           domain_name, error->nt_string, error->nt_status);
 779                 wbcFreeMemory(error);
 780         }
 781         if (!WBC_ERROR_IS_OK(wbc_status)) {
 782                 d_fprintf(stderr, "failed to call wbcCheckTrustCredentials: "
 783                           "%s\n", wbcErrorString(wbc_status));
 784                 return false;
 785         }
 786
 787         return true;
 788 }
 789
 790 /* Find the currently connected DCs */
 791
 792 static bool wbinfo_dc_info(const char *domain_name)
 793 {
 794         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 795         size_t i, num_dcs;
 796         const char **dc_names, **dc_ips;
 797
 798         wbc_status = wbcDcInfo(domain_name, &num_dcs,
 799                                &dc_names, &dc_ips);
 800         if (!WBC_ERROR_IS_OK(wbc_status)) {
 801                 printf("Could not find dc info %s\n",
 802                        domain_name ? domain_name : "our domain");
 803                 return false;
 804         }
 805
 806         for (i=0; i<num_dcs; i++) {
 807                 printf("%s (%s)\n", dc_names[i], dc_ips[i]);
 808         }
 809         wbcFreeMemory(dc_names);
 810         wbcFreeMemory(dc_ips);
 811
 812         return true;
 813 }
 814
 815 /* Change trust account password */
 816
 817 static bool wbinfo_change_secret(const char *domain)
 818 {
 819         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 820         struct wbcAuthErrorInfo *error = NULL;
 821         const char *domain_name;
 822
 823         if (domain) {
 824                 domain_name = domain;
 825         } else {
 826                 domain_name = get_winbind_domain();
 827         }
 828
 829         wbc_status = wbcChangeTrustCredentials(domain_name, &error);
 830
 831         d_printf("changing the trust secret for domain %s via RPC calls %s\n",
 832                 domain_name,
 833                 WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
 834
 835         if (wbc_status == WBC_ERR_AUTH_ERROR) {
 836                 d_fprintf(stderr, "wbcChangeTrustCredentials(%s): error code was %s (0x%x)\n",
 837                           domain_name, error->nt_string, error->nt_status);
 838                 wbcFreeMemory(error);
 839         }
 840         if (!WBC_ERROR_IS_OK(wbc_status)) {
 841                 d_fprintf(stderr, "failed to call wbcChangeTrustCredentials: "
 842                           "%s\n", wbcErrorString(wbc_status));
 843                 return false;
 844         }
 845
 846         return true;
 847 }
 848
 849 /* Check DC connection */
 850
 851 static bool wbinfo_ping_dc(const char *domain)
 852 {
 853         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 854         struct wbcAuthErrorInfo *error = NULL;
 855         char *dcname = NULL;
 856
 857         const char *domain_name;
 858
 859         if (domain) {
 860                 domain_name = domain;
 861         } else {
 862                 domain_name = get_winbind_domain();
 863         }
 864
 865         wbc_status = wbcPingDc2(domain_name, &error, &dcname);
 866
 867         d_printf("checking the NETLOGON for domain[%s] dc connection to \"%s\" %s\n",
 868                  domain_name ? domain_name : "",
 869                  dcname ? dcname : "",
 870                  WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
 871
 872         wbcFreeMemory(dcname);
 873         if (wbc_status == WBC_ERR_AUTH_ERROR) {
 874                 d_fprintf(stderr, "wbcPingDc2(%s): error code was %s (0x%x)\n",
 875                           domain_name, error->nt_string, error->nt_status);
 876                 wbcFreeMemory(error);
 877                 return false;
 878         }
 879         if (!WBC_ERROR_IS_OK(wbc_status)) {
 880                 d_fprintf(stderr, "failed to call wbcPingDc: %s\n",
 881                           wbcErrorString(wbc_status));
 882                 return false;
 883         }
 884
 885         return true;
 886 }
 887
 888 /* Convert uid to sid */
 889
 890 static bool wbinfo_uid_to_sid(uid_t uid)
 891 {
 892         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 893         struct wbcDomainSid sid;
 894         char sid_str[WBC_SID_STRING_BUFLEN];
 895
 896         /* Send request */
 897
 898         wbc_status = wbcUidToSid(uid, &sid);
 899         if (!WBC_ERROR_IS_OK(wbc_status)) {
 900                 d_fprintf(stderr, "failed to call wbcUidToSid: %s\n",
 901                           wbcErrorString(wbc_status));
 902                 return false;
 903         }
 904
 905         wbcSidToStringBuf(&sid, sid_str, sizeof(sid_str));
 906
 907         /* Display response */
 908
 909         d_printf("%s\n", sid_str);
 910
 911         return true;
 912 }
 913
 914 /* Convert gid to sid */
 915
 916 static bool wbinfo_gid_to_sid(gid_t gid)
 917 {
 918         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 919         struct wbcDomainSid sid;
 920         char sid_str[WBC_SID_STRING_BUFLEN];
 921
 922         /* Send request */
 923
 924         wbc_status = wbcGidToSid(gid, &sid);
 925         if (!WBC_ERROR_IS_OK(wbc_status)) {
 926                 d_fprintf(stderr, "failed to call wbcGidToSid: %s\n",
 927                           wbcErrorString(wbc_status));
 928                 return false;
 929         }
 930
 931         wbcSidToStringBuf(&sid, sid_str, sizeof(sid_str));
 932
 933         /* Display response */
 934
 935         d_printf("%s\n", sid_str);
 936
 937         return true;
 938 }
 939
 940 /* Convert sid to uid */
 941
 942 static bool wbinfo_sid_to_uid(const char *sid_str)
 943 {
 944         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 945         struct wbcDomainSid sid;
 946         uid_t uid;
 947
 948         /* Send request */
 949
 950         wbc_status = wbcStringToSid(sid_str, &sid);
 951         if (!WBC_ERROR_IS_OK(wbc_status)) {
 952                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
 953                           wbcErrorString(wbc_status));
 954                 return false;
 955         }
 956
 957         wbc_status = wbcSidToUid(&sid, &uid);
 958         if (!WBC_ERROR_IS_OK(wbc_status)) {
 959                 d_fprintf(stderr, "failed to call wbcSidToUid: %s\n",
 960                           wbcErrorString(wbc_status));
 961                 return false;
 962         }
 963
 964         /* Display response */
 965
 966         d_printf("%d\n", (int)uid);
 967
 968         return true;
 969 }
 970
 971 static bool wbinfo_sid_to_gid(const char *sid_str)
 972 {
 973         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 974         struct wbcDomainSid sid;
 975         gid_t gid;
 976
 977         /* Send request */
 978
 979         wbc_status = wbcStringToSid(sid_str, &sid);
 980         if (!WBC_ERROR_IS_OK(wbc_status)) {
 981                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
 982                           wbcErrorString(wbc_status));
 983                 return false;
 984         }
 985
 986         wbc_status = wbcSidToGid(&sid, &gid);
 987         if (!WBC_ERROR_IS_OK(wbc_status)) {
 988                 d_fprintf(stderr, "failed to call wbcSidToGid: %s\n",
 989                           wbcErrorString(wbc_status));
 990                 return false;
 991         }
 992
 993         /* Display response */
 994
 995         d_printf("%d\n", (int)gid);
 996
 997         return true;
 998 }
 999
1000 static bool wbinfo_sids_to_unix_ids(const char *arg)
1001 {
1002         char sidstr[WBC_SID_STRING_BUFLEN];
1003         struct wbcDomainSid *sids;
1004         struct wbcUnixId *unix_ids;
1005         int i, num_sids;
1006         const char *p;
1007         wbcErr wbc_status;
1008
1009
1010         num_sids = 0;
1011         sids = NULL;
1012         p = arg;
1013
1014         while (next_token(&p, sidstr, LIST_SEP, sizeof(sidstr))) {
1015                 sids = talloc_realloc(talloc_tos(), sids, struct wbcDomainSid,
1016                                       num_sids+1);
1017                 if (sids == NULL) {
1018                         d_fprintf(stderr, "talloc failed\n");
1019                         return false;
1020                 }
1021                 wbc_status = wbcStringToSid(sidstr, &sids[num_sids]);
1022                 if (!WBC_ERROR_IS_OK(wbc_status)) {
1023                         d_fprintf(stderr, "wbcSidToString(%s) failed: %s\n",
1024                                   sidstr, wbcErrorString(wbc_status));
1025                         TALLOC_FREE(sids);
1026                         return false;
1027                 }
1028                 num_sids += 1;
1029         }
1030
1031         unix_ids = talloc_array(talloc_tos(), struct wbcUnixId, num_sids);
1032         if (unix_ids == NULL) {
1033                 TALLOC_FREE(sids);
1034                 return false;
1035         }
1036
1037         wbc_status = wbcSidsToUnixIds(sids, num_sids, unix_ids);
1038         if (!WBC_ERROR_IS_OK(wbc_status)) {
1039                 d_fprintf(stderr, "wbcSidsToUnixIds failed: %s\n",
1040                           wbcErrorString(wbc_status));
1041                 TALLOC_FREE(sids);
1042                 return false;
1043         }
1044
1045         for (i=0; i<num_sids; i++) {
1046
1047                 wbcSidToStringBuf(&sids[i], sidstr, sizeof(sidstr));
1048
1049                 switch(unix_ids[i].type) {
1050                 case WBC_ID_TYPE_UID:
1051                         d_printf("%s -> uid %d\n", sidstr, unix_ids[i].id.uid);
1052                         break;
1053                 case WBC_ID_TYPE_GID:
1054                         d_printf("%s -> gid %d\n", sidstr, unix_ids[i].id.gid);
1055                         break;
1056                 case WBC_ID_TYPE_BOTH:
1057                         d_printf("%s -> uid/gid %d\n", sidstr, unix_ids[i].id.uid);
1058                         break;
1059                 default:
1060                         d_printf("%s -> unmapped\n", sidstr);
1061                         break;
1062                 }
1063         }
1064
1065         TALLOC_FREE(sids);
1066         TALLOC_FREE(unix_ids);
1067
1068         return true;
1069 }
1070
1071 static bool wbinfo_xids_to_sids(const char *arg)
1072 {
1073         fstring idstr;
1074         struct wbcUnixId *xids = NULL;
1075         struct wbcDomainSid *sids;
1076         wbcErr wbc_status;
1077         int num_xids = 0;
1078         const char *p;
1079         int i;
1080
1081         p = arg;
1082
1083         while (next_token(&p, idstr, LIST_SEP, sizeof(idstr))) {
1084                 xids = talloc_realloc(talloc_tos(), xids, struct wbcUnixId,
1085                                       num_xids+1);
1086                 if (xids == NULL) {
1087                         d_fprintf(stderr, "talloc failed\n");
1088                         return false;
1089                 }
1090
1091                 switch (idstr[0]) {
1092                 case 'u':
1093                         xids[num_xids] = (struct wbcUnixId) {
1094                                 .type = WBC_ID_TYPE_UID,
1095                                 .id.uid = atoi(&idstr[1])
1096                         };
1097                         break;
1098                 case 'g':
1099                         xids[num_xids] = (struct wbcUnixId) {
1100                                 .type = WBC_ID_TYPE_GID,
1101                                 .id.gid = atoi(&idstr[1])
1102                         };
1103                         break;
1104                 default:
1105                         d_fprintf(stderr, "%s is an invalid id\n", idstr);
1106                         TALLOC_FREE(xids);
1107                         return false;
1108                 }
1109                 num_xids += 1;
1110         }
1111
1112         sids = talloc_array(talloc_tos(), struct wbcDomainSid, num_xids);
1113         if (sids == NULL) {
1114                 d_fprintf(stderr, "talloc failed\n");
1115                 TALLOC_FREE(xids);
1116                 return false;
1117         }
1118
1119         wbc_status = wbcUnixIdsToSids(xids, num_xids, sids);
1120         if (!WBC_ERROR_IS_OK(wbc_status)) {
1121                 d_fprintf(stderr, "wbcUnixIdsToSids failed: %s\n",
1122                           wbcErrorString(wbc_status));
1123                 TALLOC_FREE(sids);
1124                 TALLOC_FREE(xids);
1125                 return false;
1126         }
1127
1128         for (i=0; i<num_xids; i++) {
1129                 char str[WBC_SID_STRING_BUFLEN];
1130                 struct wbcDomainSid null_sid = { 0 };
1131
1132                 if (memcmp(&null_sid, &sids[i], sizeof(struct wbcDomainSid)) == 0) {
1133                         d_printf("NOT MAPPED\n");
1134                         continue;
1135                 }
1136                 wbcSidToStringBuf(&sids[i], str, sizeof(str));
1137                 d_printf("%s\n", str);
1138         }
1139
1140         return true;
1141 }
1142
1143 static bool wbinfo_allocate_uid(void)
1144 {
1145         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1146         uid_t uid;
1147
1148         /* Send request */
1149
1150         wbc_status = wbcAllocateUid(&uid);
1151         if (!WBC_ERROR_IS_OK(wbc_status)) {
1152                 d_fprintf(stderr, "failed to call wbcAllocateUid: %s\n",
1153                           wbcErrorString(wbc_status));
1154                 return false;
1155         }
1156
1157         /* Display response */
1158
1159         d_printf("New uid: %u\n", (unsigned int)uid);
1160
1161         return true;
1162 }
1163
1164 static bool wbinfo_allocate_gid(void)
1165 {
1166         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1167         gid_t gid;
1168
1169         /* Send request */
1170
1171         wbc_status = wbcAllocateGid(&gid);
1172         if (!WBC_ERROR_IS_OK(wbc_status)) {
1173                 d_fprintf(stderr, "failed to call wbcAllocateGid: %s\n",
1174                           wbcErrorString(wbc_status));
1175                 return false;
1176         }
1177
1178         /* Display response */
1179
1180         d_printf("New gid: %u\n", (unsigned int)gid);
1181
1182         return true;
1183 }
1184
1185 static bool wbinfo_set_uid_mapping(uid_t uid, const char *sid_str)
1186 {
1187         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1188         struct wbcDomainSid sid;
1189
1190         /* Send request */
1191
1192         wbc_status = wbcStringToSid(sid_str, &sid);
1193         if (!WBC_ERROR_IS_OK(wbc_status)) {
1194                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
1195                           wbcErrorString(wbc_status));
1196                 return false;
1197         }
1198
1199         wbc_status = wbcSetUidMapping(uid, &sid);
1200         if (!WBC_ERROR_IS_OK(wbc_status)) {
1201                 d_fprintf(stderr, "failed to call wbcSetUidMapping: %s\n",
1202                           wbcErrorString(wbc_status));
1203                 return false;
1204         }
1205
1206         /* Display response */
1207
1208         d_printf("uid %u now mapped to sid %s\n",
1209                 (unsigned int)uid, sid_str);
1210
1211         return true;
1212 }
1213
1214 static bool wbinfo_set_gid_mapping(gid_t gid, const char *sid_str)
1215 {
1216         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1217         struct wbcDomainSid sid;
1218
1219         /* Send request */
1220
1221         wbc_status = wbcStringToSid(sid_str, &sid);
1222         if (!WBC_ERROR_IS_OK(wbc_status)) {
1223                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
1224                           wbcErrorString(wbc_status));
1225                 return false;
1226         }
1227
1228         wbc_status = wbcSetGidMapping(gid, &sid);
1229         if (!WBC_ERROR_IS_OK(wbc_status)) {
1230                 d_fprintf(stderr, "failed to call wbcSetGidMapping: %s\n",
1231                           wbcErrorString(wbc_status));
1232                 return false;
1233         }
1234
1235         /* Display response */
1236
1237         d_printf("gid %u now mapped to sid %s\n",
1238                 (unsigned int)gid, sid_str);
1239
1240         return true;
1241 }
1242
1243 static bool wbinfo_remove_uid_mapping(uid_t uid, const char *sid_str)
1244 {
1245         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1246         struct wbcDomainSid sid;
1247
1248         /* Send request */
1249
1250         wbc_status = wbcStringToSid(sid_str, &sid);
1251         if (!WBC_ERROR_IS_OK(wbc_status)) {
1252                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
1253                           wbcErrorString(wbc_status));
1254                 return false;
1255         }
1256
1257         wbc_status = wbcRemoveUidMapping(uid, &sid);
1258         if (!WBC_ERROR_IS_OK(wbc_status)) {
1259                 d_fprintf(stderr, "failed to call wbcRemoveUidMapping: %s\n",
1260                           wbcErrorString(wbc_status));
1261                 return false;
1262         }
1263
1264         /* Display response */
1265
1266         d_printf("Removed uid %u to sid %s mapping\n",
1267                 (unsigned int)uid, sid_str);
1268
1269         return true;
1270 }
1271
1272 static bool wbinfo_remove_gid_mapping(gid_t gid, const char *sid_str)
1273 {
1274         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1275         struct wbcDomainSid sid;
1276
1277         /* Send request */
1278
1279         wbc_status = wbcStringToSid(sid_str, &sid);
1280         if (!WBC_ERROR_IS_OK(wbc_status)) {
1281                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
1282                           wbcErrorString(wbc_status));
1283                 return false;
1284         }
1285
1286         wbc_status = wbcRemoveGidMapping(gid, &sid);
1287         if (!WBC_ERROR_IS_OK(wbc_status)) {
1288                 d_fprintf(stderr, "failed to call wbcRemoveGidMapping: %s\n",
1289                           wbcErrorString(wbc_status));
1290                 return false;
1291         }
1292
1293         /* Display response */
1294
1295         d_printf("Removed gid %u to sid %s mapping\n",
1296                 (unsigned int)gid, sid_str);
1297
1298         return true;
1299 }
1300
1301 /* Convert sid to string */
1302
1303 static bool wbinfo_lookupsid(const char *sid_str)
1304 {
1305         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1306         struct wbcDomainSid sid;
1307         char *domain;
1308         char *name;
1309         enum wbcSidType type;
1310
1311         /* Send off request */
1312
1313         wbc_status = wbcStringToSid(sid_str, &sid);
1314         if (!WBC_ERROR_IS_OK(wbc_status)) {
1315                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
1316                           wbcErrorString(wbc_status));
1317                 return false;
1318         }
1319
1320         wbc_status = wbcLookupSid(&sid, &domain, &name, &type);
1321         if (!WBC_ERROR_IS_OK(wbc_status)) {
1322                 d_fprintf(stderr, "failed to call wbcLookupSid: %s\n",
1323                           wbcErrorString(wbc_status));
1324                 return false;
1325         }
1326
1327         /* Display response */
1328
1329         if (type == WBC_SID_NAME_DOMAIN) {
1330                 d_printf("%s %d\n", domain, type);
1331         } else {
1332                 d_printf("%s%c%s %d\n",
1333                          domain, winbind_separator(), name, type);
1334         }
1335
1336         wbcFreeMemory(domain);
1337         wbcFreeMemory(name);
1338
1339         return true;
1340 }
1341
1342 /* Convert sid to fullname */
1343
1344 static bool wbinfo_lookupsid_fullname(const char *sid_str)
1345 {
1346         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1347         struct wbcDomainSid sid;
1348         char *domain;
1349         char *name;
1350         enum wbcSidType type;
1351
1352         /* Send off request */
1353
1354         wbc_status = wbcStringToSid(sid_str, &sid);
1355         if (!WBC_ERROR_IS_OK(wbc_status)) {
1356                 d_fprintf(stderr, "failed to call wbcStringToSid: %s\n",
1357                           wbcErrorString(wbc_status));
1358                 return false;
1359         }
1360
1361         wbc_status = wbcGetDisplayName(&sid, &domain, &name, &type);
1362         if (!WBC_ERROR_IS_OK(wbc_status)) {
1363                 d_fprintf(stderr, "failed to call wbcGetDisplayName: %s\n",
1364                           wbcErrorString(wbc_status));
1365                 return false;
1366         }
1367
1368         /* Display response */
1369
1370         d_printf("%s%c%s %d\n",
1371                  domain, winbind_separator(), name, type);
1372
1373         wbcFreeMemory(domain);
1374         wbcFreeMemory(name);
1375
1376         return true;
1377 }
1378
1379 /* Lookup a list of RIDs */
1380
1381 static bool wbinfo_lookuprids(const char *domain, const char *arg)
1382 {
1383         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1384         struct wbcDomainInfo *dinfo = NULL;
1385         char *domain_name = NULL;
1386         const char **names = NULL;
1387         enum wbcSidType *types = NULL;
1388         size_t i, num_rids;
1389         uint32_t *rids = NULL;
1390         const char *p;
1391         char *ridstr;
1392         TALLOC_CTX *mem_ctx = NULL;
1393         bool ret = false;
1394
1395         if ((domain == NULL) || (strequal(domain, ".")) || (domain[0] == '\0')){
1396                 domain = get_winbind_domain();
1397         }
1398
1399         /* Send request */
1400
1401         wbc_status = wbcDomainInfo(domain, &dinfo);
1402         if (!WBC_ERROR_IS_OK(wbc_status)) {
1403                 d_printf("wbcDomainInfo(%s) failed: %s\n", domain,
1404                          wbcErrorString(wbc_status));
1405                 goto done;
1406         }
1407
1408         mem_ctx = talloc_new(NULL);
1409         if (mem_ctx == NULL) {
1410                 d_printf("talloc_new failed\n");
1411                 goto done;
1412         }
1413
1414         num_rids = 0;
1415         rids = NULL;
1416         p = arg;
1417
1418         while (next_token_talloc(mem_ctx, &p, &ridstr, " ,\n")) {
1419                 int error = 0;
1420                 uint32_t rid;
1421
1422                 rid = smb_strtoul(ridstr, NULL, 10, &error, SMB_STR_STANDARD);
1423                 if (error != 0) {
1424                         d_printf("failed to convert rid\n");
1425                         goto done;
1426                 }
1427                 rids = talloc_realloc(mem_ctx, rids, uint32_t, num_rids + 1);
1428                 if (rids == NULL) {
1429                         d_printf("talloc_realloc failed\n");
1430                 }
1431                 rids[num_rids] = rid;
1432                 num_rids += 1;
1433         }
1434
1435         if (rids == NULL) {
1436                 d_printf("no rids\n");
1437                 goto done;
1438         }
1439
1440         wbc_status = wbcLookupRids(&dinfo->sid, num_rids, rids,
1441                                    &p, &names, &types);
1442         if (!WBC_ERROR_IS_OK(wbc_status)) {
1443                 d_printf("winbind_lookup_rids failed: %s\n",
1444                          wbcErrorString(wbc_status));
1445                 goto done;
1446         }
1447
1448         domain_name = discard_const_p(char, p);
1449         d_printf("Domain: %s\n", domain_name);
1450
1451         for (i=0; i<num_rids; i++) {
1452                 d_printf("%8d: %s (%s)\n", rids[i], names[i],
1453                          wbcSidTypeString(types[i]));
1454         }
1455
1456         ret = true;
1457 done:
1458         wbcFreeMemory(dinfo);
1459         wbcFreeMemory(domain_name);
1460         wbcFreeMemory(names);
1461         wbcFreeMemory(types);
1462         TALLOC_FREE(mem_ctx);
1463         return ret;
1464 }
1465
1466 static bool wbinfo_lookup_sids(const char *arg)
1467 {
1468         char sidstr[WBC_SID_STRING_BUFLEN];
1469         struct wbcDomainSid *sids;
1470         struct wbcDomainInfo *domains;
1471         struct wbcTranslatedName *names;
1472         int num_domains;
1473         int i, num_sids;
1474         const char *p;
1475         wbcErr wbc_status;
1476
1477
1478         num_sids = 0;
1479         sids = NULL;
1480         p = arg;
1481
1482         while (next_token(&p, sidstr, LIST_SEP, sizeof(sidstr))) {
1483                 sids = talloc_realloc(talloc_tos(), sids, struct wbcDomainSid,
1484                                       num_sids+1);
1485                 if (sids == NULL) {
1486                         d_fprintf(stderr, "talloc failed\n");
1487                         return false;
1488                 }
1489                 wbc_status = wbcStringToSid(sidstr, &sids[num_sids]);
1490                 if (!WBC_ERROR_IS_OK(wbc_status)) {
1491                         d_fprintf(stderr, "wbcSidToString(%s) failed: %s\n",
1492                                   sidstr, wbcErrorString(wbc_status));
1493                         TALLOC_FREE(sids);
1494                         return false;
1495                 }
1496                 num_sids += 1;
1497         }
1498
1499         wbc_status = wbcLookupSids(sids, num_sids, &domains, &num_domains,
1500                                    &names);
1501         if (!WBC_ERROR_IS_OK(wbc_status)) {
1502                 d_fprintf(stderr, "wbcLookupSids failed: %s\n",
1503                           wbcErrorString(wbc_status));
1504                 TALLOC_FREE(sids);
1505                 return false;
1506         }
1507
1508         for (i=0; i<num_sids; i++) {
1509                 const char *domain = NULL;
1510
1511                 wbcSidToStringBuf(&sids[i], sidstr, sizeof(sidstr));
1512
1513                 if (names[i].domain_index >= num_domains) {
1514                         domain = "<none>";
1515                 } else if (names[i].domain_index < 0) {
1516                         domain = "<none>";
1517                 } else {
1518                         domain = domains[names[i].domain_index].short_name;
1519                 }
1520
1521                 if (names[i].type == WBC_SID_NAME_DOMAIN) {
1522                         d_printf("%s -> %s %d\n", sidstr,
1523                                  domain,
1524                                  names[i].type);
1525                 } else {
1526                         d_printf("%s -> %s%c%s %d\n", sidstr,
1527                                  domain,
1528                                  winbind_separator(),
1529                                  names[i].name, names[i].type);
1530                 }
1531         }
1532         wbcFreeMemory(names);
1533         wbcFreeMemory(domains);
1534         return true;
1535 }
1536
1537 /* Convert string to sid */
1538
1539 static bool wbinfo_lookupname(const char *full_name)
1540 {
1541         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1542         struct wbcDomainSid sid;
1543         char sid_str[WBC_SID_STRING_BUFLEN];
1544         enum wbcSidType type;
1545         fstring domain_name;
1546         fstring account_name;
1547
1548         /* Send off request */
1549
1550         parse_wbinfo_domain_user(full_name, domain_name,
1551                                  account_name);
1552
1553         wbc_status = wbcLookupName(domain_name, account_name,
1554                                    &sid, &type);
1555         if (!WBC_ERROR_IS_OK(wbc_status)) {
1556                 d_fprintf(stderr, "failed to call wbcLookupName: %s\n",
1557                           wbcErrorString(wbc_status));
1558                 return false;
1559         }
1560
1561         wbcSidToStringBuf(&sid, sid_str, sizeof(sid_str));
1562
1563         /* Display response */
1564
1565         d_printf("%s %s (%d)\n", sid_str, wbcSidTypeString(type), type);
1566
1567         return true;
1568 }
1569
1570 static char *wbinfo_prompt_pass(TALLOC_CTX *mem_ctx,
1571                                 const char *prefix,
1572                                 const char *username)
1573 {
1574         char *prompt;
1575         char buf[1024] = {0};
1576         int rc;
1577
1578         prompt = talloc_asprintf(mem_ctx, "Enter %s's ", username);
1579         if (!prompt) {
1580                 return NULL;
1581         }
1582         if (prefix) {
1583                 prompt = talloc_asprintf_append(prompt, "%s ", prefix);
1584                 if (!prompt) {
1585                         return NULL;
1586                 }
1587         }
1588         prompt = talloc_asprintf_append(prompt, "password: ");
1589         if (!prompt) {
1590                 return NULL;
1591         }
1592
1593         rc = samba_getpass(prompt, buf, sizeof(buf), false, false);
1594         TALLOC_FREE(prompt);
1595         if (rc < 0) {
1596                 return NULL;
1597         }
1598
1599         return talloc_strdup(mem_ctx, buf);
1600 }
1601
1602 /* Authenticate a user with a plaintext password */
1603
1604 static bool wbinfo_auth_krb5(char *username, const char *cctype, uint32_t flags)
1605 {
1606         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1607         char *s = NULL;
1608         char *p = NULL;
1609         char *password = NULL;
1610         char *name = NULL;
1611         char *local_cctype = NULL;
1612         uid_t uid;
1613         struct wbcLogonUserParams params;
1614         struct wbcLogonUserInfo *info;
1615         struct wbcAuthErrorInfo *error;
1616         struct wbcUserPasswordPolicyInfo *policy;
1617         TALLOC_CTX *frame = talloc_tos();
1618
1619         if ((s = talloc_strdup(frame, username)) == NULL) {
1620                 return false;
1621         }
1622
1623         if ((p = strchr(s, '%')) != NULL) {
1624                 *p = 0;
1625                 p++;
1626                 password = talloc_strdup(frame, p);
1627         } else {
1628                 password = wbinfo_prompt_pass(frame, NULL, username);
1629         }
1630
1631         local_cctype = talloc_strdup(frame, cctype);
1632
1633         name = s;
1634
1635         uid = geteuid();
1636
1637         params.username = name;
1638         params.password = password;
1639         params.num_blobs = 0;
1640         params.blobs = NULL;
1641
1642         wbc_status = wbcAddNamedBlob(&params.num_blobs,
1643                                      &params.blobs,
1644                                      "flags",
1645                                      0,
1646                                      (uint8_t *)&flags,
1647                                      sizeof(flags));
1648         if (!WBC_ERROR_IS_OK(wbc_status)) {
1649                 d_fprintf(stderr, "failed to call wbcAddNamedBlob: %s\n",
1650                           wbcErrorString(wbc_status));
1651                 goto done;
1652         }
1653
1654         wbc_status = wbcAddNamedBlob(&params.num_blobs,
1655                                      &params.blobs,
1656                                      "user_uid",
1657                                      0,
1658                                      (uint8_t *)&uid,
1659                                      sizeof(uid));
1660         if (!WBC_ERROR_IS_OK(wbc_status)) {
1661                 d_fprintf(stderr, "failed to call wbcAddNamedBlob: %s\n",
1662                           wbcErrorString(wbc_status));
1663                 goto done;
1664         }
1665
1666         wbc_status = wbcAddNamedBlob(&params.num_blobs,
1667                                      &params.blobs,
1668                                      "krb5_cc_type",
1669                                      0,
1670                                      (uint8_t *)local_cctype,
1671                                      strlen(cctype)+1);
1672         if (!WBC_ERROR_IS_OK(wbc_status)) {
1673                 d_fprintf(stderr, "failed to call wbcAddNamedBlob: %s\n",
1674                           wbcErrorString(wbc_status));
1675                 goto done;
1676         }
1677
1678         wbc_status = wbcLogonUser(&params, &info, &error, &policy);
1679
1680         d_printf("plaintext kerberos password authentication for [%s] %s "
1681                  "(requesting cctype: %s)\n",
1682                  name, WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed",
1683                  cctype);
1684
1685         if (error) {
1686                 d_fprintf(stderr,
1687                          "wbcLogonUser(%s): error code was %s (0x%x)\n"
1688                          "error message was: %s\n",
1689                          params.username, error->nt_string,
1690                          error->nt_status,
1691                          error->display_string);
1692         }
1693
1694         if (WBC_ERROR_IS_OK(wbc_status)) {
1695                 if (flags & WBFLAG_PAM_INFO3_TEXT) {
1696                         if (info && info->info && info->info->user_flags &
1697                             NETLOGON_CACHED_ACCOUNT) {
1698                                 d_printf("user_flgs: "
1699                                          "NETLOGON_CACHED_ACCOUNT\n");
1700                         }
1701                 }
1702
1703                 if (info) {
1704                         size_t i;
1705                         for (i=0; i < info->num_blobs; i++) {
1706                                 if (strequal(info->blobs[i].name,
1707                                              "krb5ccname")) {
1708                                         d_printf("credentials were put "
1709                                                  "in: %s\n",
1710                                                 (const char *)
1711                                                       info->blobs[i].blob.data);
1712                                         break;
1713                                 }
1714                         }
1715                 } else {
1716                         d_printf("no credentials cached\n");
1717                 }
1718         }
1719  done:
1720
1721         wbcFreeMemory(params.blobs);
1722
1723         return WBC_ERROR_IS_OK(wbc_status);
1724 }
1725
1726 /* Authenticate a user with a plaintext password */
1727
1728 static bool wbinfo_auth(char *username)
1729 {
1730         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1731         char *s = NULL;
1732         char *p = NULL;
1733         char *password = NULL;
1734         char *name = NULL;
1735         TALLOC_CTX *frame = talloc_tos();
1736
1737         if ((s = talloc_strdup(frame, username)) == NULL) {
1738                 return false;
1739         }
1740
1741         if ((p = strchr(s, '%')) != NULL) {
1742                 *p = 0;
1743                 p++;
1744                 password = talloc_strdup(frame, p);
1745         } else {
1746                 password = wbinfo_prompt_pass(frame, NULL, username);
1747         }
1748
1749         name = s;
1750
1751         wbc_status = wbcAuthenticateUser(name, password);
1752
1753         d_printf("plaintext password authentication %s\n",
1754                  WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
1755
1756 #if 0
1757         if (response.data.auth.nt_status)
1758                 d_fprintf(stderr,
1759                          "error code was %s (0x%x)\nerror message was: %s\n",
1760                          response.data.auth.nt_status_string,
1761                          response.data.auth.nt_status,
1762                          response.data.auth.error_string);
1763 #endif
1764
1765         return WBC_ERROR_IS_OK(wbc_status);
1766 }
1767
1768 /* Authenticate a user with a challenge/response */
1769
1770 static bool wbinfo_auth_crap(char *username, bool use_ntlmv2, bool use_lanman)
1771 {
1772         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1773         struct wbcAuthUserParams params;
1774         struct wbcAuthUserInfo *info = NULL;
1775         struct wbcAuthErrorInfo *err = NULL;
1776         DATA_BLOB lm = data_blob_null;
1777         DATA_BLOB nt = data_blob_null;
1778         fstring name_user;
1779         fstring name_domain;
1780         char *pass;
1781         char *p;
1782         TALLOC_CTX *frame = talloc_tos();
1783
1784         p = strchr(username, '%');
1785
1786         if (p) {
1787                 *p = 0;
1788                 pass = talloc_strdup(frame, p + 1);
1789         } else {
1790                 pass = wbinfo_prompt_pass(frame, NULL, username);
1791         }
1792
1793         parse_wbinfo_domain_user(username, name_domain, name_user);
1794
1795         params.account_name     = name_user;
1796         params.domain_name      = name_domain;
1797         params.workstation_name = NULL;
1798
1799         params.flags            = 0;
1800         params.parameter_control= WBC_MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT |
1801                                   WBC_MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT;
1802
1803         params.level            = WBC_AUTH_USER_LEVEL_RESPONSE;
1804
1805         generate_random_buffer(params.password.response.challenge, 8);
1806
1807         if (use_ntlmv2) {
1808                 DATA_BLOB server_chal;
1809                 DATA_BLOB names_blob;
1810                 const char *netbios_name = NULL;
1811                 const char *domain = NULL;
1812
1813                 netbios_name = get_winbind_netbios_name(),
1814                 domain = get_winbind_domain();
1815                 if (domain == NULL) {
1816                         d_fprintf(stderr, "Failed to get domain from winbindd\n");
1817                         return false;
1818                 }
1819
1820                 server_chal = data_blob(params.password.response.challenge, 8);
1821
1822                 /* Pretend this is a login to 'us', for blob purposes */
1823                 names_blob = NTLMv2_generate_names_blob(NULL,
1824                                                         netbios_name,
1825                                                         domain);
1826
1827                 if (pass != NULL &&
1828                     !SMBNTLMv2encrypt(NULL, name_user, name_domain, pass,
1829                                       &server_chal,
1830                                       &names_blob,
1831                                       &lm, &nt, NULL, NULL)) {
1832                         data_blob_free(&names_blob);
1833                         data_blob_free(&server_chal);
1834                         TALLOC_FREE(pass);
1835                         return false;
1836                 }
1837                 data_blob_free(&names_blob);
1838                 data_blob_free(&server_chal);
1839
1840         } else {
1841                 if (use_lanman) {
1842                         bool ok;
1843                         lm = data_blob(NULL, 24);
1844                         ok = SMBencrypt(pass,
1845                                         params.password.response.challenge,
1846                                         lm.data);
1847                         if (!ok) {
1848                                 data_blob_free(&lm);
1849                         }
1850                 }
1851                 nt = data_blob(NULL, 24);
1852                 SMBNTencrypt(pass, params.password.response.challenge,
1853                              nt.data);
1854         }
1855
1856         params.password.response.nt_length      = nt.length;
1857         params.password.response.nt_data        = nt.data;
1858         params.password.response.lm_length      = lm.length;
1859         params.password.response.lm_data        = lm.data;
1860
1861         wbc_status = wbcAuthenticateUserEx(&params, &info, &err);
1862
1863         /* Display response */
1864
1865         d_printf("challenge/response password authentication %s\n",
1866                  WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
1867
1868         if (wbc_status == WBC_ERR_AUTH_ERROR) {
1869                 d_fprintf(stderr,
1870                          "wbcAuthenticateUserEx(%s%c%s): error code was "
1871                           "%s (0x%x, authoritative=%"PRIu8")\n"
1872                          "error message was: %s\n",
1873                          name_domain,
1874                          winbind_separator(),
1875                          name_user,
1876                          err->nt_string,
1877                          err->nt_status,
1878                          err->authoritative,
1879                          err->display_string);
1880                 wbcFreeMemory(err);
1881         } else if (WBC_ERROR_IS_OK(wbc_status)) {
1882                 wbcFreeMemory(info);
1883         }
1884
1885         data_blob_free(&nt);
1886         data_blob_free(&lm);
1887
1888         return WBC_ERROR_IS_OK(wbc_status);
1889 }
1890
1891 /* Authenticate a user with a plaintext password */
1892
1893 static bool wbinfo_pam_logon(char *username, bool verbose)
1894 {
1895         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1896         struct wbcLogonUserParams params;
1897         struct wbcLogonUserInfo *info = NULL;
1898         struct wbcAuthErrorInfo *error = NULL;
1899         char *s = NULL;
1900         char *p = NULL;
1901         TALLOC_CTX *frame = talloc_tos();
1902         uint32_t flags;
1903         uint32_t uid;
1904
1905         ZERO_STRUCT(params);
1906
1907         if ((s = talloc_strdup(frame, username)) == NULL) {
1908                 return false;
1909         }
1910
1911         if ((p = strchr(s, '%')) != NULL) {
1912                 *p = 0;
1913                 p++;
1914                 params.password = talloc_strdup(frame, p);
1915         } else {
1916                 params.password = wbinfo_prompt_pass(frame, NULL, username);
1917         }
1918         params.username = s;
1919
1920         flags = WBFLAG_PAM_CACHED_LOGIN;
1921
1922         wbc_status = wbcAddNamedBlob(&params.num_blobs, &params.blobs,
1923                                      "flags", 0,
1924                                      (uint8_t *)&flags, sizeof(flags));
1925         if (!WBC_ERROR_IS_OK(wbc_status)) {
1926                 d_printf("wbcAddNamedBlob failed: %s\n",
1927                          wbcErrorString(wbc_status));
1928                 return false;
1929         }
1930
1931         uid = getuid();
1932
1933         wbc_status = wbcAddNamedBlob(&params.num_blobs, &params.blobs,
1934                                      "user_uid", 0,
1935                                      (uint8_t *)&uid, sizeof(uid));
1936         if (!WBC_ERROR_IS_OK(wbc_status)) {
1937                 d_printf("wbcAddNamedBlob failed: %s\n",
1938                          wbcErrorString(wbc_status));
1939                 return false;
1940         }
1941
1942         wbc_status = wbcLogonUser(&params, &info, &error, NULL);
1943
1944         if (verbose && (info != NULL)) {
1945                 struct wbcAuthUserInfo *i = info->info;
1946                 uint32_t j;
1947
1948                 if (i->account_name != NULL) {
1949                         d_printf("account_name: %s\n", i->account_name);
1950                 }
1951                 if (i->user_principal != NULL) {
1952                         d_printf("user_principal: %s\n", i->user_principal);
1953                 }
1954                 if (i->full_name != NULL) {
1955                         d_printf("full_name: %s\n", i->full_name);
1956                 }
1957                 if (i->domain_name != NULL) {
1958                         d_printf("domain_name: %s\n", i->domain_name);
1959                 }
1960                 if (i->dns_domain_name != NULL) {
1961                         d_printf("dns_domain_name: %s\n", i->dns_domain_name);
1962                 }
1963                 if (i->logon_server != NULL) {
1964                         d_printf("logon_server: %s\n", i->logon_server);
1965                 }
1966                 if (i->logon_script != NULL) {
1967                         d_printf("logon_script: %s\n", i->logon_script);
1968                 }
1969                 if (i->profile_path != NULL) {
1970                         d_printf("profile_path: %s\n", i->profile_path);
1971                 }
1972                 if (i->home_directory != NULL) {
1973                         d_printf("home_directory: %s\n", i->home_directory);
1974                 }
1975                 if (i->home_drive != NULL) {
1976                         d_printf("home_drive: %s\n", i->home_drive);
1977                 }
1978
1979                 d_printf("sids:");
1980
1981                 for (j=0; j<i->num_sids; j++) {
1982                         char buf[WBC_SID_STRING_BUFLEN];
1983                         wbcSidToStringBuf(&i->sids[j].sid, buf, sizeof(buf));
1984                         d_printf(" %s", buf);
1985                 }
1986                 d_printf("\n");
1987
1988                 wbcFreeMemory(info);
1989                 info = NULL;
1990         }
1991
1992         wbcFreeMemory(params.blobs);
1993
1994         d_printf("plaintext password authentication %s\n",
1995                  WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
1996
1997         if (!WBC_ERROR_IS_OK(wbc_status) && (error != NULL)) {
1998                 d_fprintf(stderr,
1999                           "wbcLogonUser(%s): error code was %s (0x%x)\n"
2000                           "error message was: %s\n",
2001                           params.username,
2002                           error->nt_string,
2003                           (int)error->nt_status,
2004                           error->display_string);
2005                 wbcFreeMemory(error);
2006         }
2007         return WBC_ERROR_IS_OK(wbc_status);
2008 }
2009
2010 /* Save creds with winbind */
2011
2012 static bool wbinfo_ccache_save(char *username)
2013 {
2014         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
2015         char *s = NULL;
2016         char *p = NULL;
2017         char *password = NULL;
2018         char *name = NULL;
2019         TALLOC_CTX *frame = talloc_stackframe();
2020
2021         s = talloc_strdup(frame, username);
2022         if (s == NULL) {
2023                 return false;
2024         }
2025
2026         p = strchr(s, '%');
2027         if (p != NULL) {
2028                 *p = 0;
2029                 p++;
2030                 password = talloc_strdup(frame, p);
2031         } else {
2032                 password = wbinfo_prompt_pass(frame, NULL, username);
2033         }
2034
2035         name = s;
2036
2037         wbc_status = wbcCredentialSave(name, password);
2038
2039         d_printf("saving creds %s\n",
2040                  WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
2041
2042         TALLOC_FREE(frame);
2043
2044         return WBC_ERROR_IS_OK(wbc_status);
2045 }
2046
2047 #ifdef WITH_FAKE_KASERVER
2048 /* Authenticate a user with a plaintext password and set a token */
2049
2050 static bool wbinfo_klog(char *username)
2051 {
2052         struct winbindd_request request;
2053         struct winbindd_response response;
2054         NSS_STATUS result;
2055         char *p;
2056
2057         /* Send off request */
2058
2059         ZERO_STRUCT(request);
2060         ZERO_STRUCT(response);
2061
2062         p = strchr(username, '%');
2063
2064         if (p) {
2065                 *p = 0;
2066                 fstrcpy(request.data.auth.user, username);
2067                 fstrcpy(request.data.auth.pass, p + 1);
2068                 *p = '%';
2069         } else {
2070                 fstrcpy(request.data.auth.user, username);
2071                 (void) samba_getpass("Password: ",
2072                                      request.data.auth.pass,
2073                                      sizeof(request.data.auth.pass),
2074                                      false, false);
2075         }
2076
2077         request.flags |= WBFLAG_PAM_AFS_TOKEN;
2078
2079         result = winbindd_request_response(NULL, WINBINDD_PAM_AUTH, &request,
2080                                            &response);
2081
2082         /* Display response */
2083
2084         d_printf("plaintext password authentication %s\n",
2085                  (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
2086
2087         if (response.data.auth.nt_status)
2088                 d_fprintf(stderr,
2089                          "error code was %s (0x%x)\nerror message was: %s\n",
2090                          response.data.auth.nt_status_string,
2091                          response.data.auth.nt_status,
2092                          response.data.auth.error_string);
2093
2094         if (result != NSS_STATUS_SUCCESS)
2095                 return false;
2096
2097         if (response.extra_data.data == NULL) {
2098                 d_fprintf(stderr, "Did not get token data\n");
2099                 return false;
2100         }
2101
2102         if (!afs_settoken_str((char *)response.extra_data.data)) {
2103                 d_fprintf(stderr, "Could not set token\n");
2104                 return false;
2105         }
2106
2107         d_printf("Successfully created AFS token\n");
2108         return true;
2109 }
2110 #else
2111 static bool wbinfo_klog(char *username)
2112 {
2113         d_fprintf(stderr, "No AFS support compiled in.\n");
2114         return false;
2115 }
2116 #endif
2117
2118 /* Print domain users */
2119
2120 static bool print_domain_users(const char *domain)
2121 {
2122         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
2123         uint32_t i;
2124         uint32_t num_users = 0;
2125         const char **users = NULL;
2126
2127         /* Send request to winbind daemon */
2128
2129         if (domain == NULL) {
2130                 domain = get_winbind_domain();
2131         } else {
2132                 /* '.' is the special sign for our own domain */
2133                 if ((domain[0] == '\0') || strcmp(domain, ".") == 0) {
2134                         domain = get_winbind_domain();
2135                 /* '*' is the special sign for all domains */
2136                 } else if (strcmp(domain, "*") == 0) {
2137                         domain = NULL;
2138                 }
2139         }
2140
2141         wbc_status = wbcListUsers(domain, &num_users, &users);
2142         if (!WBC_ERROR_IS_OK(wbc_status)) {
2143                 return false;
2144         }
2145
2146         for (i=0; i < num_users; i++) {
2147                 d_printf("%s\n", users[i]);
2148         }
2149
2150         wbcFreeMemory(users);
2151
2152         return true;
2153 }
2154
2155 /* Print domain groups */
2156
2157 static bool print_domain_groups(const char *domain)
2158 {
2159         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
2160         uint32_t i;
2161         uint32_t num_groups = 0;
2162         const char **groups = NULL;
2163
2164         /* Send request to winbind daemon */
2165
2166         if (domain == NULL) {
2167                 domain = get_winbind_domain();
2168         } else {
2169                 /* '.' is the special sign for our own domain */
2170                 if ((domain[0] == '\0') || strcmp(domain, ".") == 0) {
2171                         domain = get_winbind_domain();
2172                 /* '*' is the special sign for all domains */
2173                 } else if (strcmp(domain, "*") == 0) {
2174                         domain = NULL;
2175                 }
2176         }
2177
2178         wbc_status = wbcListGroups(domain, &num_groups, &groups);
2179         if (!WBC_ERROR_IS_OK(wbc_status)) {
2180                 d_fprintf(stderr, "failed to call wbcListGroups: %s\n",
2181                           wbcErrorString(wbc_status));
2182                 return false;
2183         }
2184
2185         for (i=0; i < num_groups; i++) {
2186                 d_printf("%s\n", groups[i]);
2187         }
2188
2189         wbcFreeMemory(groups);
2190
2191         return true;
2192 }
2193
2194 /* Set the authorised user for winbindd access in secrets.tdb */
2195
2196 static bool wbinfo_set_auth_user(char *username)
2197 {
2198         d_fprintf(stderr, "This functionality was moved to the 'net' utility.\n"
2199                           "See 'net help setauthuser' for details.\n");
2200         return false;
2201 }
2202
2203 static void wbinfo_get_auth_user(void)
2204 {
2205         d_fprintf(stderr, "This functionality was moved to the 'net' utility.\n"
2206                           "See 'net help getauthuser' for details.\n");
2207 }
2208
2209 static bool wbinfo_ping(void)
2210 {
2211         wbcErr wbc_status;
2212
2213         wbc_status = wbcPing();
2214
2215         /* Display response */
2216
2217         d_printf("Ping to winbindd %s\n",
2218                  WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
2219
2220         return WBC_ERROR_IS_OK(wbc_status);
2221 }
2222
2223 static bool wbinfo_change_user_password(const char *username)
2224 {
2225         wbcErr wbc_status;
2226         char *old_password = NULL;
2227         char *new_password = NULL;
2228         TALLOC_CTX *frame = talloc_tos();
2229
2230         old_password = wbinfo_prompt_pass(frame, "old", username);
2231         new_password = wbinfo_prompt_pass(frame, "new", username);
2232
2233         wbc_status = wbcChangeUserPassword(username, old_password,new_password);
2234
2235         /* Display response */
2236
2237         d_printf("Password change for user %s %s\n", username,
2238                 WBC_ERROR_IS_OK(wbc_status) ? "succeeded" : "failed");
2239
2240         return WBC_ERROR_IS_OK(wbc_status);
2241 }
2242
2243 /* Main program */
2244
2245 enum {
2246         OPT_SET_AUTH_USER = 1000,
2247         OPT_GET_AUTH_USER,
2248         OPT_DOMAIN_NAME,
2249         OPT_SEQUENCE,
2250         OPT_GETDCNAME,
2251         OPT_DSGETDCNAME,
2252         OPT_DC_INFO,
2253         OPT_USERDOMGROUPS,
2254         OPT_SIDALIASES,
2255         OPT_USERSIDS,
2256         OPT_LOOKUP_SIDS,
2257         OPT_ALLOCATE_UID,
2258         OPT_ALLOCATE_GID,
2259         OPT_SET_UID_MAPPING,
2260         OPT_SET_GID_MAPPING,
2261         OPT_REMOVE_UID_MAPPING,
2262         OPT_REMOVE_GID_MAPPING,
2263         OPT_SIDS_TO_XIDS,
2264         OPT_XIDS_TO_SIDS,
2265         OPT_SEPARATOR,
2266         OPT_LIST_ALL_DOMAINS,
2267         OPT_LIST_OWN_DOMAIN,
2268         OPT_UID_INFO,
2269         OPT_USER_SIDINFO,
2270         OPT_GROUP_INFO,
2271         OPT_GID_INFO,
2272         OPT_VERBOSE,
2273         OPT_ONLINESTATUS,
2274         OPT_CHANGE_USER_PASSWORD,
2275         OPT_CCACHE_SAVE,
2276         OPT_SID_TO_FULLNAME,
2277         OPT_NTLMV1,
2278         OPT_NTLMV2,
2279         OPT_PAM_LOGON,
2280         OPT_LOGOFF,
2281         OPT_LOGOFF_USER,
2282         OPT_LOGOFF_UID,
2283         OPT_LANMAN,
2284         OPT_KRB5CCNAME
2285 };
2286
2287 int main(int argc, const char **argv, char **envp)
2288 {
2289         int opt;
2290         TALLOC_CTX *frame = talloc_stackframe();
2291         poptContext pc;
2292         static char *string_arg;
2293         char *string_subarg = NULL;
2294         static char *opt_domain_name;
2295         static int int_arg;
2296         int int_subarg = -1;
2297         int result = 1;
2298         bool verbose = false;
2299         bool use_ntlmv2 = true;
2300         bool use_lanman = false;
2301         char *logoff_user = getenv("USER");
2302         int logoff_uid = geteuid();
2303         const char *opt_krb5ccname = "FILE";
2304
2305         struct poptOption long_options[] = {
2306                 POPT_AUTOHELP
2307
2308                 /* longName, shortName, argInfo, argPtr, value, descrip,
2309                    argDesc */
2310
2311                 {
2312                         .longName   = "domain-users",
2313                         .shortName  = 'u',
2314                         .argInfo    = POPT_ARG_NONE,
2315                         .val        = 'u',
2316                         .descrip    = "Lists all domain users",
2317                         .argDescrip = "domain"
2318                 },
2319                 {
2320                         .longName   = "domain-groups",
2321                         .shortName  = 'g',
2322                         .argInfo    = POPT_ARG_NONE,
2323                         .val        = 'g',
2324                         .descrip    = "Lists all domain groups",
2325                         .argDescrip = "domain"
2326                 },
2327                 {
2328                         .longName   = "WINS-by-name",
2329                         .shortName  = 'N',
2330                         .argInfo    = POPT_ARG_STRING,
2331                         .arg        = &string_arg,
2332                         .val        = 'N',
2333                         .descrip    = "Converts NetBIOS name to IP",
2334                         .argDescrip = "NETBIOS-NAME"
2335                 },
2336                 {
2337                         .longName   = "WINS-by-ip",
2338                         .shortName  = 'I',
2339                         .argInfo    = POPT_ARG_STRING,
2340                         .arg        = &string_arg,
2341                         .val        = 'I',
2342                         .descrip    = "Converts IP address to NetBIOS name",
2343                         .argDescrip = "IP"
2344                 },
2345                 {
2346                         .longName   = "name-to-sid",
2347                         .shortName  = 'n',
2348                         .argInfo    = POPT_ARG_STRING,
2349                         .arg        = &string_arg,
2350                         .val        = 'n',
2351                         .descrip    = "Converts name to sid",
2352                         .argDescrip = "NAME"
2353                 },
2354                 {
2355                         .longName   = "sid-to-name",
2356                         .shortName  = 's',
2357                         .argInfo    = POPT_ARG_STRING,
2358                         .arg        = &string_arg,
2359                         .val        = 's',
2360                         .descrip    = "Converts sid to name",
2361                         .argDescrip = "SID"
2362                 },
2363                 {
2364                         .longName   = "sid-to-fullname",
2365                         .argInfo    = POPT_ARG_STRING,
2366                         .arg        = &string_arg,
2367                         .val        = OPT_SID_TO_FULLNAME,
2368                         .descrip    = "Converts sid to fullname",
2369                         .argDescrip = "SID"
2370                 },
2371                 {
2372                         .longName   = "lookup-rids",
2373                         .shortName  = 'R',
2374                         .argInfo    = POPT_ARG_STRING,
2375                         .arg        = &string_arg,
2376                         .val        = 'R',
2377                         .descrip    = "Converts RIDs to names",
2378                         .argDescrip = "RIDs"
2379                 },
2380                 {
2381                         .longName   = "lookup-sids",
2382                         .argInfo    = POPT_ARG_STRING,
2383                         .arg        = &string_arg,
2384                         .val        = OPT_LOOKUP_SIDS,
2385                         .descrip    = "Converts SIDs to types and names",
2386                         .argDescrip = "Sid-List"
2387                 },
2388                 {
2389                         .longName   = "uid-to-sid",
2390                         .shortName  = 'U',
2391                         .argInfo    = POPT_ARG_INT,
2392                         .arg        = &int_arg,
2393                         .val        = 'U',
2394                         .descrip    = "Converts uid to sid",
2395                         .argDescrip = "UID"
2396                 },
2397                 {
2398                         .longName   = "gid-to-sid",
2399                         .shortName  = 'G',
2400                         .argInfo    = POPT_ARG_INT,
2401                         .arg        = &int_arg,
2402                         .val        = 'G',
2403                         .descrip    = "Converts gid to sid",
2404                         .argDescrip = "GID"
2405                 },
2406                 {
2407                         .longName   = "sid-to-uid",
2408                         .shortName  = 'S',
2409                         .argInfo    = POPT_ARG_STRING,
2410                         .arg        = &string_arg,
2411                         .val        = 'S',
2412                         .descrip    = "Converts sid to uid",
2413                         .argDescrip = "SID"
2414                 },
2415                 {
2416                         .longName   = "sid-to-gid",
2417                         .shortName  = 'Y',
2418                         .argInfo    = POPT_ARG_STRING,
2419                         .arg        = &string_arg,
2420                         .val        = 'Y',
2421                         .descrip    = "Converts sid to gid",
2422                         .argDescrip = "SID"
2423                 },
2424                 {
2425                         .longName   = "allocate-uid",
2426                         .argInfo    = POPT_ARG_NONE,
2427                         .val        = OPT_ALLOCATE_UID,
2428                         .descrip    = "Get a new UID out of idmap"
2429                 },
2430                 {
2431                         .longName   = "allocate-gid",
2432                         .argInfo    = POPT_ARG_NONE,
2433                         .val        = OPT_ALLOCATE_GID,
2434                         .descrip    = "Get a new GID out of idmap"
2435                 },
2436                 {
2437                         .longName   = "set-uid-mapping",
2438                         .argInfo    = POPT_ARG_STRING,
2439                         .arg        = &string_arg,
2440                         .val        = OPT_SET_UID_MAPPING,
2441                         .descrip    = "Create or modify uid to sid mapping in "
2442                                       "idmap",
2443                         .argDescrip = "UID,SID"
2444                 },
2445                 {
2446                         .longName   = "set-gid-mapping",
2447                         .argInfo    = POPT_ARG_STRING,
2448                         .arg        = &string_arg,
2449                         .val        = OPT_SET_GID_MAPPING,
2450                         .descrip    = "Create or modify gid to sid mapping in "
2451                                       "idmap",
2452                         .argDescrip = "GID,SID"
2453                 },
2454                 {
2455                         .longName   = "remove-uid-mapping",
2456                         .argInfo    = POPT_ARG_STRING,
2457                         .arg        = &string_arg,
2458                         .val        = OPT_REMOVE_UID_MAPPING,
2459                         .descrip    = "Remove uid to sid mapping in idmap",
2460                         .argDescrip = "UID,SID"
2461                 },
2462                 {
2463                         .longName   = "remove-gid-mapping",
2464                         .argInfo    = POPT_ARG_STRING,
2465                         .arg        = &string_arg,
2466                         .val        = OPT_REMOVE_GID_MAPPING,
2467                         .descrip    = "Remove gid to sid mapping in idmap",
2468                         .argDescrip = "GID,SID",
2469                 },
2470                 {
2471                         .longName   = "sids-to-unix-ids",
2472                         .argInfo    = POPT_ARG_STRING,
2473                         .arg        = &string_arg,
2474                         .val        = OPT_SIDS_TO_XIDS,
2475                         .descrip    = "Translate SIDs to Unix IDs",
2476                         .argDescrip = "Sid-List",
2477                 },
2478                 {
2479                         .longName   = "unix-ids-to-sids",
2480                         .argInfo    = POPT_ARG_STRING,
2481                         .arg        = &string_arg,
2482                         .val        = OPT_XIDS_TO_SIDS,
2483                         .descrip    = "Translate Unix IDs to SIDs",
2484                         .argDescrip = "ID-List (u<num> g<num>)",
2485                 },
2486                 {
2487                         .longName   = "check-secret",
2488                         .shortName  = 't',
2489                         .argInfo    = POPT_ARG_NONE,
2490                         .val        = 't',
2491                         .descrip    = "Check shared secret",
2492                 },
2493                 {
2494                         .longName   = "change-secret",
2495                         .shortName  = 'c',
2496                         .argInfo    = POPT_ARG_NONE,
2497                         .val        = 'c',
2498                         .descrip    = "Change shared secret",
2499                 },
2500                 {
2501                         .longName   = "ping-dc",
2502                         .shortName  = 'P',
2503                         .argInfo    = POPT_ARG_NONE,
2504                         .val        = 'P',
2505                         .descrip    = "Check the NETLOGON connection",
2506                 },
2507                 {
2508                         .longName   = "trusted-domains",
2509                         .shortName  = 'm',
2510                         .argInfo    = POPT_ARG_NONE,
2511                         .val        = 'm',
2512                         .descrip    = "List trusted domains",
2513                 },
2514                 {
2515                         .longName   = "all-domains",
2516                         .argInfo    = POPT_ARG_NONE,
2517                         .val        = OPT_LIST_ALL_DOMAINS,
2518                         .descrip    = "List all domains (trusted and own "
2519                                       "domain)",
2520                 },
2521                 {
2522                         .longName   = "own-domain",
2523                         .argInfo    = POPT_ARG_NONE,
2524                         .val        = OPT_LIST_OWN_DOMAIN,
2525                         .descrip    = "List own domain",
2526                 },
2527                 {
2528                         .longName   = "sequence",
2529                         .argInfo    = POPT_ARG_NONE,
2530                         .val        = OPT_SEQUENCE,
2531                         .descrip    = "Deprecated command, see --online-status",
2532                 },
2533                 {
2534                         .longName   = "online-status",
2535                         .argInfo    = POPT_ARG_NONE,
2536                         .val        = OPT_ONLINESTATUS,
2537                         .descrip    = "Show whether domains maintain an active "
2538                                       "connection",
2539                 },
2540                 {
2541                         .longName   = "domain-info",
2542                         .shortName  = 'D',
2543                         .argInfo    = POPT_ARG_STRING,
2544                         .arg        = &string_arg,
2545                         .val        = 'D',
2546                         .descrip    = "Show most of the info we have about the "
2547                                       "domain",
2548                 },
2549                 {
2550                         .longName   = "user-info",
2551                         .shortName  = 'i',
2552                         .argInfo    = POPT_ARG_STRING,
2553                         .arg        = &string_arg,
2554                         .val        = 'i',
2555                         .descrip    = "Get user info",
2556                         .argDescrip = "USER",
2557                 },
2558                 {
2559                         .longName   = "uid-info",
2560                         .argInfo    = POPT_ARG_INT,
2561                         .arg        = &int_arg,
2562                         .val        = OPT_UID_INFO,
2563                         .descrip    = "Get user info from uid",
2564                         .argDescrip = "UID",
2565                 },
2566                 {
2567                         .longName   = "group-info",
2568                         .argInfo    = POPT_ARG_STRING,
2569                         .arg        = &string_arg,
2570                         .val        = OPT_GROUP_INFO,
2571                         .descrip    = "Get group info",
2572                         .argDescrip = "GROUP",
2573                 },
2574                 {
2575                         .longName   = "user-sidinfo",
2576                         .argInfo    = POPT_ARG_STRING,
2577                         .arg        = &string_arg,
2578                         .val        = OPT_USER_SIDINFO,
2579                         .descrip    = "Get user info from sid",
2580                         .argDescrip = "SID",
2581                 },
2582                 {
2583                         .longName   = "gid-info",
2584                         .argInfo    = POPT_ARG_INT,
2585                         .arg        = &int_arg,
2586                         .val        = OPT_GID_INFO,
2587                         .descrip    = "Get group info from gid",
2588                         .argDescrip = "GID",
2589                 },
2590                 {
2591                         .longName   = "user-groups",
2592                         .shortName  = 'r',
2593                         .argInfo    = POPT_ARG_STRING,
2594                         .arg        = &string_arg,
2595                         .val        = 'r',
2596                         .descrip    = "Get user groups",
2597                         .argDescrip = "USER",
2598                 },
2599                 {
2600                         .longName   = "user-domgroups",
2601                         .argInfo    = POPT_ARG_STRING,
2602                         .arg        = &string_arg,
2603                         .val        = OPT_USERDOMGROUPS,
2604                         .descrip    = "Get user domain groups",
2605                         .argDescrip = "SID",
2606                 },
2607                 {
2608                         .longName   = "sid-aliases",
2609                         .argInfo    = POPT_ARG_STRING,
2610                         .arg        = &string_arg,
2611                         .val        = OPT_SIDALIASES,
2612                         .descrip    = "Get sid aliases",
2613                         .argDescrip = "SID",
2614                 },
2615                 {
2616                         .longName   = "user-sids",
2617                         .argInfo    = POPT_ARG_STRING,
2618                         .arg        = &string_arg,
2619                         .val        = OPT_USERSIDS,
2620                         .descrip    = "Get user group sids for user SID",
2621                         .argDescrip = "SID",
2622                 },
2623                 {
2624                         .longName   = "authenticate",
2625                         .shortName  = 'a',
2626                         .argInfo    = POPT_ARG_STRING,
2627                         .arg        = &string_arg,
2628                         .val        = 'a',
2629                         .descrip    = "authenticate user",
2630                         .argDescrip = "user%password",
2631                 },
2632                 {
2633                         .longName   = "pam-logon",
2634                         .argInfo    = POPT_ARG_STRING,
2635                         .arg        = &string_arg,
2636                         .val        = OPT_PAM_LOGON,
2637                         .descrip    = "do a pam logon equivalent",
2638                         .argDescrip = "user%password",
2639                 },
2640                 {
2641                         .longName   = "logoff",
2642                         .argInfo    = POPT_ARG_NONE,
2643                         .val        = OPT_LOGOFF,
2644                         .descrip    = "log off user",
2645                         .argDescrip = "uid",
2646                 },
2647                 {
2648                         .longName   = "logoff-user",
2649                         .argInfo    = POPT_ARG_STRING,
2650                         .arg        = &logoff_user,
2651                         .val        = OPT_LOGOFF_USER,
2652                         .descrip    = "username to log off"
2653                 },
2654                 {
2655                         .longName   = "logoff-uid",
2656                         .argInfo    = POPT_ARG_INT,
2657                         .arg        = &logoff_uid,
2658                         .val        = OPT_LOGOFF_UID,
2659                         .descrip    = "uid to log off",
2660                 },
2661                 {
2662                         .longName   = "set-auth-user",
2663                         .argInfo    = POPT_ARG_STRING,
2664                         .arg        = &string_arg,
2665                         .val        = OPT_SET_AUTH_USER,
2666                         .descrip    = "Store user and password used by "
2667                                       "winbindd (root only)",
2668                         .argDescrip = "user%password",
2669                 },
2670                 {
2671                         .longName   = "ccache-save",
2672                         .shortName  = 0,
2673                         .argInfo    = POPT_ARG_STRING,
2674                         .arg        = &string_arg,
2675                         .val        = OPT_CCACHE_SAVE,
2676                         .descrip    = "Store user and password for ccache "
2677                                       "operation",
2678                         .argDescrip = "user%password",
2679                 },
2680                 {
2681                         .longName   = "getdcname",
2682                         .argInfo    = POPT_ARG_STRING,
2683                         .arg        = &string_arg,
2684                         .val        = OPT_GETDCNAME,
2685                         .descrip    = "Get a DC name for a foreign domain",
2686                         .argDescrip = "domainname",
2687                 },
2688                 {
2689                         .longName   = "dsgetdcname",
2690                         .argInfo    = POPT_ARG_STRING,
2691                         .arg        = &string_arg,
2692                         .val        = OPT_DSGETDCNAME,
2693                         .descrip    = "Find a DC for a domain",
2694                         .argDescrip = "domainname",
2695                 },
2696                 {
2697                         .longName   = "dc-info",
2698                         .argInfo    = POPT_ARG_STRING,
2699                         .arg        = &string_arg,
2700                         .val        = OPT_DC_INFO,
2701                         .descrip    = "Find the currently known DCs",
2702                         .argDescrip = "domainname",
2703                 },
2704                 {
2705                         .longName   = "get-auth-user",
2706                         .argInfo    = POPT_ARG_NONE,
2707                         .val        = OPT_GET_AUTH_USER,
2708                         .descrip    = "Retrieve user and password used by "
2709                                       "winbindd (root only)",
2710                 },
2711                 {
2712                         .longName   = "ping",
2713                         .shortName  = 'p',
2714                         .argInfo    = POPT_ARG_NONE,
2715                         .arg        = 0,
2716                         .val        = 'p',
2717                         .descrip    = "Ping winbindd to see if it is alive",
2718                 },
2719                 {
2720                         .longName   = "domain",
2721                         .shortName  = 0,
2722                         .argInfo    = POPT_ARG_STRING,
2723                         .arg        = &opt_domain_name,
2724                         .val        = OPT_DOMAIN_NAME,
2725                         .descrip    = "Define to the domain to restrict "
2726                                       "operation",
2727                         .argDescrip = "domain",
2728                 },
2729 #ifdef WITH_FAKE_KASERVER
2730                 {
2731                         .longName   = "klog",
2732                         .shortName  = 'k',
2733                         .argInfo    = POPT_ARG_STRING,
2734                         .arg        = &string_arg,
2735                         .val        = 'k',
2736                         .descrip    = "set an AFS token from winbind",
2737                         .argDescrip = "user%password",
2738                 },
2739 #endif
2740 #ifdef HAVE_KRB5
2741                 {
2742                         .longName   = "krb5auth",
2743                         .shortName  = 'K',
2744                         .argInfo    = POPT_ARG_STRING,
2745                         .arg        = &string_arg,
2746                         .val        = 'K',
2747                         .descrip    = "authenticate user using Kerberos",
2748                         .argDescrip = "user%password",
2749                 },
2750                         /* destroys wbinfo --help output */
2751                         /* "user%password,DOM\\user%password,user@EXAMPLE.COM,EXAMPLE.COM\\user%password" },
2752                         */
2753                 {
2754                         .longName   = "krb5ccname",
2755                         .argInfo    = POPT_ARG_STRING,
2756                         .arg        = &opt_krb5ccname,
2757                         .val        = OPT_KRB5CCNAME,
2758                         .descrip    = "authenticate user using Kerberos and "
2759                                       "specific credential cache type",
2760                         .argDescrip = "krb5ccname",
2761                 },
2762 #endif
2763                 {
2764                         .longName   = "separator",
2765                         .argInfo    = POPT_ARG_NONE,
2766                         .val        = OPT_SEPARATOR,
2767                         .descrip    = "Get the active winbind separator",
2768                 },
2769                 {
2770                         .longName   = "verbose",
2771                         .argInfo    = POPT_ARG_NONE,
2772                         .val        = OPT_VERBOSE,
2773                         .descrip    = "Print additional information per command",
2774                 },
2775                 {
2776                         .longName   = "change-user-password",
2777                         .argInfo    = POPT_ARG_STRING,
2778                         .arg        = &string_arg,
2779                         .val        = OPT_CHANGE_USER_PASSWORD,
2780                         .descrip    = "Change the password for a user",
2781                 },
2782                 {
2783                         .longName   = "ntlmv1",
2784                         .argInfo    = POPT_ARG_NONE,
2785                         .val        = OPT_NTLMV1,
2786                         .descrip    = "Use NTLMv1 cryptography for user authentication",
2787                 },
2788                 {
2789                         .longName   = "ntlmv2",
2790                         .argInfo    = POPT_ARG_NONE,
2791                         .val        = OPT_NTLMV2,
2792                         .descrip    = "Use NTLMv2 cryptography for user authentication",
2793                 },
2794                 {
2795                         .longName   = "lanman",
2796                         .argInfo    = POPT_ARG_NONE,
2797                         .val        = OPT_LANMAN,
2798                         .descrip    = "Use lanman cryptography for user authentication",
2799                 },
2800                 POPT_COMMON_VERSION
2801                 POPT_TABLEEND
2802         };
2803
2804         /* Samba client initialisation */
2805         smb_init_locale();
2806
2807
2808         /* Parse options */
2809
2810         pc = poptGetContext("wbinfo", argc, argv,
2811                             long_options, 0);
2812
2813         /* Parse command line options */
2814
2815         if (argc == 1) {
2816                 poptPrintHelp(pc, stderr, 0);
2817                 return 1;
2818         }
2819
2820         while((opt = poptGetNextOpt(pc)) != -1) {
2821                 /* get the generic configuration parameters like --domain */
2822                 switch (opt) {
2823                 case OPT_VERBOSE:
2824                         verbose = true;
2825                         break;
2826                 case OPT_NTLMV1:
2827                         use_ntlmv2 = false;
2828                         break;
2829                 case OPT_LANMAN:
2830                         use_lanman = true;
2831                         break;
2832                 }
2833         }
2834
2835         poptFreeContext(pc);
2836
2837         pc = poptGetContext(NULL, argc, (const char **)argv, long_options,
2838                             POPT_CONTEXT_KEEP_FIRST);
2839
2840         while((opt = poptGetNextOpt(pc)) != -1) {
2841                 switch (opt) {
2842                 case 'u':
2843                         if (!print_domain_users(opt_domain_name)) {
2844                                 d_fprintf(stderr,
2845                                           "Error looking up domain users\n");
2846                                 goto done;
2847                         }
2848                         break;
2849                 case 'g':
2850                         if (!print_domain_groups(opt_domain_name)) {
2851                                 d_fprintf(stderr,
2852                                           "Error looking up domain groups\n");
2853                                 goto done;
2854                         }
2855                         break;
2856                 case 's':
2857                         if (!wbinfo_lookupsid(string_arg)) {
2858                                 d_fprintf(stderr,
2859                                           "Could not lookup sid %s\n",
2860                                           string_arg);
2861                                 goto done;
2862                         }
2863                         break;
2864                 case OPT_SID_TO_FULLNAME:
2865                         if (!wbinfo_lookupsid_fullname(string_arg)) {
2866                                 d_fprintf(stderr, "Could not lookup sid %s\n",
2867                                           string_arg);
2868                                 goto done;
2869                         }
2870                         break;
2871                 case 'R':
2872                         if (!wbinfo_lookuprids(opt_domain_name, string_arg)) {
2873                                 d_fprintf(stderr, "Could not lookup RIDs %s\n",
2874                                           string_arg);
2875                                 goto done;
2876                         }
2877                         break;
2878                 case OPT_LOOKUP_SIDS:
2879                         if (!wbinfo_lookup_sids(string_arg)) {
2880                                 d_fprintf(stderr, "Could not lookup SIDs %s\n",
2881                                           string_arg);
2882                                 goto done;
2883                         }
2884                         break;
2885                 case 'n':
2886                         if (!wbinfo_lookupname(string_arg)) {
2887                                 d_fprintf(stderr, "Could not lookup name %s\n",
2888                                           string_arg);
2889                                 goto done;
2890                         }
2891                         break;
2892                 case 'N':
2893                         if (!wbinfo_wins_byname(string_arg)) {
2894                                 d_fprintf(stderr,
2895                                           "Could not lookup WINS by name %s\n",
2896                                           string_arg);
2897                                 goto done;
2898                         }
2899                         break;
2900                 case 'I':
2901                         if (!wbinfo_wins_byip(string_arg)) {
2902                                 d_fprintf(stderr,
2903                                           "Could not lookup WINS by IP %s\n",
2904                                           string_arg);
2905                                 goto done;
2906                         }
2907                         break;
2908                 case 'U':
2909                         if (!wbinfo_uid_to_sid(int_arg)) {
2910                                 d_fprintf(stderr,
2911                                           "Could not convert uid %d to sid\n",
2912                                           int_arg);
2913                                 goto done;
2914                         }
2915                         break;
2916                 case 'G':
2917                         if (!wbinfo_gid_to_sid(int_arg)) {
2918                                 d_fprintf(stderr,
2919                                           "Could not convert gid %d to sid\n",
2920                                           int_arg);
2921                                 goto done;
2922                         }
2923                         break;
2924                 case 'S':
2925                         if (!wbinfo_sid_to_uid(string_arg)) {
2926                                 d_fprintf(stderr,
2927                                           "Could not convert sid %s to uid\n",
2928                                           string_arg);
2929                                 goto done;
2930                         }
2931                         break;
2932                 case 'Y':
2933                         if (!wbinfo_sid_to_gid(string_arg)) {
2934                                 d_fprintf(stderr,
2935                                           "Could not convert sid %s to gid\n",
2936                                           string_arg);
2937                                 goto done;
2938                         }
2939                         break;
2940                 case OPT_ALLOCATE_UID:
2941                         if (!wbinfo_allocate_uid()) {
2942                                 d_fprintf(stderr, "Could not allocate a uid\n");
2943                                 goto done;
2944                         }
2945                         break;
2946                 case OPT_ALLOCATE_GID:
2947                         if (!wbinfo_allocate_gid()) {
2948                                 d_fprintf(stderr, "Could not allocate a gid\n");
2949                                 goto done;
2950                         }
2951                         break;
2952                 case OPT_SET_UID_MAPPING:
2953                         if (!parse_mapping_arg(string_arg, &int_subarg,
2954                                 &string_subarg) ||
2955                             !wbinfo_set_uid_mapping(int_subarg, string_subarg))
2956                         {
2957                                 d_fprintf(stderr, "Could not create or modify "
2958                                           "uid to sid mapping\n");
2959                                 goto done;
2960                         }
2961                         break;
2962                 case OPT_SET_GID_MAPPING:
2963                         if (!parse_mapping_arg(string_arg, &int_subarg,
2964                                 &string_subarg) ||
2965                             !wbinfo_set_gid_mapping(int_subarg, string_subarg))
2966                         {
2967                                 d_fprintf(stderr, "Could not create or modify "
2968                                           "gid to sid mapping\n");
2969                                 goto done;
2970                         }
2971                         break;
2972                 case OPT_REMOVE_UID_MAPPING:
2973                         if (!parse_mapping_arg(string_arg, &int_subarg,
2974                                 &string_subarg) ||
2975                             !wbinfo_remove_uid_mapping(int_subarg,
2976                                 string_subarg))
2977                         {
2978                                 d_fprintf(stderr, "Could not remove uid to sid "
2979                                     "mapping\n");
2980                                 goto done;
2981                         }
2982                         break;
2983                 case OPT_REMOVE_GID_MAPPING:
2984                         if (!parse_mapping_arg(string_arg, &int_subarg,
2985                                 &string_subarg) ||
2986                             !wbinfo_remove_gid_mapping(int_subarg,
2987                                 string_subarg))
2988                         {
2989                                 d_fprintf(stderr, "Could not remove gid to sid "
2990                                     "mapping\n");
2991                                 goto done;
2992                         }
2993                         break;
2994                 case OPT_SIDS_TO_XIDS:
2995                         if (!wbinfo_sids_to_unix_ids(string_arg)) {
2996                                 d_fprintf(stderr, "wbinfo_sids_to_unix_ids "
2997                                           "failed\n");
2998                                 goto done;
2999                         }
3000                         break;
3001                 case OPT_XIDS_TO_SIDS:
3002                         if (!wbinfo_xids_to_sids(string_arg)) {
3003                                 d_fprintf(stderr, "wbinfo_xids_to_sids "
3004                                           "failed\n");
3005                                 goto done;
3006                         }
3007                         break;
3008                 case 't':
3009                         if (!wbinfo_check_secret(opt_domain_name)) {
3010                                 d_fprintf(stderr, "Could not check secret\n");
3011                                 goto done;
3012                         }
3013                         break;
3014                 case 'c':
3015                         if (!wbinfo_change_secret(opt_domain_name)) {
3016                                 d_fprintf(stderr, "Could not change secret\n");
3017                                 goto done;
3018                         }
3019                         break;
3020                 case 'P':
3021                         if (!wbinfo_ping_dc(opt_domain_name)) {
3022                                 goto done;
3023                         }
3024                         break;
3025                 case 'm':
3026                         if (!wbinfo_list_domains(false, verbose)) {
3027                                 d_fprintf(stderr,
3028                                           "Could not list trusted domains\n");
3029                                 goto done;
3030                         }
3031                         break;
3032                 case OPT_SEQUENCE:
3033                         if (!wbinfo_show_sequence(opt_domain_name)) {
3034                                 d_fprintf(stderr,
3035                                           "Could not show sequence numbers\n");
3036                                 goto done;
3037                         }
3038                         break;
3039                 case OPT_ONLINESTATUS:
3040                         if (!wbinfo_show_onlinestatus(opt_domain_name)) {
3041                                 d_fprintf(stderr,
3042                                           "Could not show online-status\n");
3043                                 goto done;
3044                         }
3045                         break;
3046                 case 'D':
3047                         if (!wbinfo_domain_info(string_arg)) {
3048                                 d_fprintf(stderr,
3049                                           "Could not get domain info\n");
3050                                 goto done;
3051                         }
3052                         break;
3053                 case 'i':
3054                         if (!wbinfo_get_userinfo(string_arg)) {
3055                                 d_fprintf(stderr,
3056                                           "Could not get info for user %s\n",
3057                                           string_arg);
3058                                 goto done;
3059                         }
3060                         break;
3061                 case OPT_USER_SIDINFO:
3062                         if ( !wbinfo_get_user_sidinfo(string_arg)) {
3063                                 d_fprintf(stderr,
3064                                           "Could not get info for user "
3065                                           "sid %s\n", string_arg);
3066                                 goto done;
3067                         }
3068                         break;
3069                 case OPT_UID_INFO:
3070                         if ( !wbinfo_get_uidinfo(int_arg)) {
3071                                 d_fprintf(stderr, "Could not get info for uid "
3072                                                 "%d\n", int_arg);
3073                                 goto done;
3074                         }
3075                         break;
3076                 case OPT_GROUP_INFO:
3077                         if ( !wbinfo_get_groupinfo(string_arg)) {
3078                                 d_fprintf(stderr, "Could not get info for "
3079                                           "group %s\n", string_arg);
3080                                 goto done;
3081                         }
3082                         break;
3083                 case OPT_GID_INFO:
3084                         if ( !wbinfo_get_gidinfo(int_arg)) {
3085                                 d_fprintf(stderr, "Could not get info for gid "
3086                                                 "%d\n", int_arg);
3087                                 goto done;
3088                         }
3089                         break;
3090                 case 'r':
3091                         if (!wbinfo_get_usergroups(string_arg)) {
3092                                 d_fprintf(stderr,
3093                                           "Could not get groups for user %s\n",
3094                                           string_arg);
3095                                 goto done;
3096                         }
3097                         break;
3098                 case OPT_USERSIDS:
3099                         if (!wbinfo_get_usersids(string_arg)) {
3100                                 d_fprintf(stderr, "Could not get group SIDs "
3101                                           "for user SID %s\n",
3102                                           string_arg);
3103                                 goto done;
3104                         }
3105                         break;
3106                 case OPT_USERDOMGROUPS:
3107                         if (!wbinfo_get_userdomgroups(string_arg)) {
3108                                 d_fprintf(stderr, "Could not get user's domain "
3109                                          "groups for user SID %s\n",
3110                                          string_arg);
3111                                 goto done;
3112                         }
3113                         break;
3114                 case OPT_SIDALIASES:
3115                         if (!wbinfo_get_sidaliases(opt_domain_name,
3116                                                    string_arg)) {
3117                                 d_fprintf(stderr, "Could not get sid aliases "
3118                                          "for user SID %s\n", string_arg);
3119                                 goto done;
3120                         }
3121                         break;
3122                 case 'a': {
3123                                 bool got_error = false;
3124
3125                                 if (!wbinfo_auth(string_arg)) {
3126                                         d_fprintf(stderr,
3127                                                   "Could not authenticate user "
3128                                                   "%s with plaintext "
3129                                                   "password\n", string_arg);
3130                                         got_error = true;
3131                                 }
3132
3133                                 if (!wbinfo_auth_crap(string_arg, use_ntlmv2,
3134                                                       use_lanman)) {
3135                                         d_fprintf(stderr,
3136                                                 "Could not authenticate user "
3137                                                 "%s with challenge/response\n",
3138                                                 string_arg);
3139                                         got_error = true;
3140                                 }
3141
3142                                 if (got_error)
3143                                         goto done;
3144                                 break;
3145                         }
3146                 case OPT_PAM_LOGON:
3147                         if (!wbinfo_pam_logon(string_arg, verbose)) {
3148                                 d_fprintf(stderr, "pam_logon failed for %s\n",
3149                                           string_arg);
3150                                 goto done;
3151                         }
3152                         break;
3153                 case OPT_LOGOFF:
3154                 {
3155                         wbcErr wbc_status;
3156
3157                         wbc_status = wbcLogoffUser(logoff_user, logoff_uid,
3158                                                    "");
3159                         d_printf("Logoff %s (%d): %s\n", logoff_user,
3160                                  logoff_uid, wbcErrorString(wbc_status));
3161                         break;
3162                 }
3163                 case 'K': {
3164                                 uint32_t flags = WBFLAG_PAM_KRB5 |
3165                                                  WBFLAG_PAM_CACHED_LOGIN |
3166                                                 WBFLAG_PAM_FALLBACK_AFTER_KRB5 |
3167                                                  WBFLAG_PAM_INFO3_TEXT |
3168                                                  WBFLAG_PAM_CONTACT_TRUSTDOM;
3169
3170                                 if (!wbinfo_auth_krb5(string_arg, opt_krb5ccname,
3171                                                       flags)) {
3172                                         d_fprintf(stderr,
3173                                                 "Could not authenticate user "
3174                                                 "[%s] with Kerberos "
3175                                                 "(ccache: %s)\n", string_arg,
3176                                                 opt_krb5ccname);
3177                                         goto done;
3178                                 }
3179                                 break;
3180                         }
3181                 case 'k':
3182                         if (!wbinfo_klog(string_arg)) {
3183                                 d_fprintf(stderr, "Could not klog user\n");
3184                                 goto done;
3185                         }
3186                         break;
3187                 case 'p':
3188                         if (!wbinfo_ping()) {
3189                                 d_fprintf(stderr, "could not ping winbindd!\n");
3190                                 goto done;
3191                         }
3192                         break;
3193                 case OPT_SET_AUTH_USER:
3194                         if (!wbinfo_set_auth_user(string_arg)) {
3195                                 goto done;
3196                         }
3197                         break;
3198                 case OPT_GET_AUTH_USER:
3199                         wbinfo_get_auth_user();
3200                         goto done;
3201                         break;
3202                 case OPT_CCACHE_SAVE:
3203                         if (!wbinfo_ccache_save(string_arg)) {
3204                                 goto done;
3205                         }
3206                         break;
3207                 case OPT_GETDCNAME:
3208                         if (!wbinfo_getdcname(string_arg)) {
3209                                 goto done;
3210                         }
3211                         break;
3212                 case OPT_DSGETDCNAME:
3213                         if (!wbinfo_dsgetdcname(string_arg, 0)) {
3214                                 goto done;
3215                         }
3216                         break;
3217                 case OPT_DC_INFO:
3218                         if (!wbinfo_dc_info(string_arg)) {
3219                                 goto done;
3220                         }
3221                         break;
3222                 case OPT_SEPARATOR: {
3223                         const char sep = winbind_separator();
3224                         if ( !sep ) {
3225                                 goto done;
3226                         }
3227                         d_printf("%c\n", sep);
3228                         break;
3229                 }
3230                 case OPT_LIST_ALL_DOMAINS:
3231                         if (!wbinfo_list_domains(true, verbose)) {
3232                                 goto done;
3233                         }
3234                         break;
3235                 case OPT_LIST_OWN_DOMAIN:
3236                         if (!wbinfo_list_own_domain()) {
3237                                 goto done;
3238                         }
3239                         break;
3240                 case OPT_CHANGE_USER_PASSWORD:
3241                         if (!wbinfo_change_user_password(string_arg)) {
3242                                 d_fprintf(stderr,
3243                                         "Could not change user password "
3244                                          "for user %s\n", string_arg);
3245                                 goto done;
3246                         }
3247                         break;
3248
3249                 /* generic configuration options */
3250                 case OPT_DOMAIN_NAME:
3251                 case OPT_VERBOSE:
3252                 case OPT_NTLMV1:
3253                 case OPT_NTLMV2:
3254                 case OPT_LANMAN:
3255                 case OPT_LOGOFF_USER:
3256                 case OPT_LOGOFF_UID:
3257                 case OPT_KRB5CCNAME:
3258                         break;
3259                 default:
3260                         d_fprintf(stderr, "Invalid option\n");
3261                         poptPrintHelp(pc, stderr, 0);
3262                         goto done;
3263                 }
3264         }
3265
3266         result = 0;
3267
3268         /* Exit code */
3269
3270  done:
3271         talloc_free(frame);
3272
3273         poptFreeContext(pc);
3274         return result;
3275 }