source3/winbindd/winbindd_cm.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon connection manager
   5
   6    Copyright (C) Tim Potter                2001
   7    Copyright (C) Andrew Bartlett           2002
   8    Copyright (C) Gerald (Jerry) Carter     2003-2005.
   9    Copyright (C) Volker Lendecke           2004-2005
  10    Copyright (C) Jeremy Allison            2006
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 /*
  27    We need to manage connections to domain controllers without having to
  28    mess up the main winbindd code with other issues.  The aim of the
  29    connection manager is to:
  30
  31        - make connections to domain controllers and cache them
  32        - re-establish connections when networks or servers go down
  33        - centralise the policy on connection timeouts, domain controller
  34          selection etc
  35        - manage re-entrancy for when winbindd becomes able to handle
  36          multiple outstanding rpc requests
  37
  38    Why not have connection management as part of the rpc layer like tng?
  39    Good question.  This code may morph into libsmb/rpc_cache.c or something
  40    like that but at the moment it's simply staying as part of winbind.  I
  41    think the TNG architecture of forcing every user of the rpc layer to use
  42    the connection caching system is a bad idea.  It should be an optional
  43    method of using the routines.
  44
  45    The TNG design is quite good but I disagree with some aspects of the
  46    implementation. -tpot
  47
  48  */
  49
  50 /*
  51    TODO:
  52
  53      - I'm pretty annoyed by all the make_nmb_name() stuff.  It should be
  54        moved down into another function.
  55
  56      - Take care when destroying cli_structs as they can be shared between
  57        various sam handles.
  58
  59  */
  60
  61 #include "includes.h"
  62 #include "winbindd.h"
  63 #include "../libcli/auth/libcli_auth.h"
  64 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
  65 #include "rpc_client/cli_pipe.h"
  66 #include "rpc_client/cli_netlogon.h"
  67 #include "../librpc/gen_ndr/ndr_samr_c.h"
  68 #include "../librpc/gen_ndr/ndr_lsa_c.h"
  69 #include "rpc_client/cli_lsarpc.h"
  70 #include "../librpc/gen_ndr/ndr_dssetup_c.h"
  71 #include "libads/sitename_cache.h"
  72 #include "libsmb/libsmb.h"
  73 #include "libsmb/clidgram.h"
  74 #include "ads.h"
  75 #include "secrets.h"
  76 #include "../libcli/security/security.h"
  77 #include "passdb.h"
  78 #include "messages.h"
  79 #include "auth/gensec/gensec.h"
  80 #include "../libcli/smb/smbXcli_base.h"
  81 #include "libcli/auth/netlogon_creds_cli.h"
  82 #include "auth.h"
  83 #include "rpc_server/rpc_ncacn_np.h"
  84 #include "auth/credentials/credentials.h"
  85 #include "lib/param/param.h"
  86
  87 #undef DBGC_CLASS
  88 #define DBGC_CLASS DBGC_WINBIND
  89
  90 struct dc_name_ip {
  91         fstring name;
  92         struct sockaddr_storage ss;
  93 };
  94
  95 extern struct winbindd_methods reconnect_methods;
  96 extern bool override_logfile;
  97
  98 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain, bool need_rw_dc);
  99 static void set_dc_type_and_flags( struct winbindd_domain *domain );
 100 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain );
 101 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
 102                     struct dc_name_ip **dcs, int *num_dcs);
 103
 104 /****************************************************************
 105  Child failed to find DC's. Reschedule check.
 106 ****************************************************************/
 107
 108 static void msg_failed_to_go_online(struct messaging_context *msg,
 109                                     void *private_data,
 110                                     uint32_t msg_type,
 111                                     struct server_id server_id,
 112                                     DATA_BLOB *data)
 113 {
 114         struct winbindd_domain *domain;
 115         const char *domainname = (const char *)data->data;
 116
 117         if (data->data == NULL || data->length == 0) {
 118                 return;
 119         }
 120
 121         DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
 122
 123         for (domain = domain_list(); domain; domain = domain->next) {
 124                 if (domain->internal) {
 125                         continue;
 126                 }
 127
 128                 if (strequal(domain->name, domainname)) {
 129                         if (domain->online) {
 130                                 /* We're already online, ignore. */
 131                                 DEBUG(5,("msg_fail_to_go_online: domain %s "
 132                                         "already online.\n", domainname));
 133                                 continue;
 134                         }
 135
 136                         /* Reschedule the online check. */
 137                         set_domain_offline(domain);
 138                         break;
 139                 }
 140         }
 141 }
 142
 143 /****************************************************************
 144  Actually cause a reconnect from a message.
 145 ****************************************************************/
 146
 147 static void msg_try_to_go_online(struct messaging_context *msg,
 148                                  void *private_data,
 149                                  uint32_t msg_type,
 150                                  struct server_id server_id,
 151                                  DATA_BLOB *data)
 152 {
 153         struct winbindd_domain *domain;
 154         const char *domainname = (const char *)data->data;
 155
 156         if (data->data == NULL || data->length == 0) {
 157                 return;
 158         }
 159
 160         DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
 161
 162         for (domain = domain_list(); domain; domain = domain->next) {
 163                 if (domain->internal) {
 164                         continue;
 165                 }
 166
 167                 if (strequal(domain->name, domainname)) {
 168
 169                         if (domain->online) {
 170                                 /* We're already online, ignore. */
 171                                 DEBUG(5,("msg_try_to_go_online: domain %s "
 172                                         "already online.\n", domainname));
 173                                 continue;
 174                         }
 175
 176                         /* This call takes care of setting the online
 177                            flag to true if we connected, or re-adding
 178                            the offline handler if false. Bypasses online
 179                            check so always does network calls. */
 180
 181                         init_dc_connection_network(domain, true);
 182                         break;
 183                 }
 184         }
 185 }
 186
 187 /****************************************************************
 188  Fork a child to try and contact a DC. Do this as contacting a
 189  DC requires blocking lookups and we don't want to block our
 190  parent.
 191 ****************************************************************/
 192
 193 static bool fork_child_dc_connect(struct winbindd_domain *domain)
 194 {
 195         struct dc_name_ip *dcs = NULL;
 196         int num_dcs = 0;
 197         TALLOC_CTX *mem_ctx = NULL;
 198         pid_t parent_pid = getpid();
 199         char *lfile = NULL;
 200         NTSTATUS status;
 201
 202         if (domain->dc_probe_pid != (pid_t)-1) {
 203                 /*
 204                  * We might already have a DC probe
 205                  * child working, check.
 206                  */
 207                 if (process_exists_by_pid(domain->dc_probe_pid)) {
 208                         DEBUG(10,("fork_child_dc_connect: pid %u already "
 209                                 "checking for DC's.\n",
 210                                 (unsigned int)domain->dc_probe_pid));
 211                         return true;
 212                 }
 213                 domain->dc_probe_pid = (pid_t)-1;
 214         }
 215
 216         domain->dc_probe_pid = fork();
 217
 218         if (domain->dc_probe_pid == (pid_t)-1) {
 219                 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
 220                 return False;
 221         }
 222
 223         if (domain->dc_probe_pid != (pid_t)0) {
 224                 /* Parent */
 225                 messaging_register(winbind_messaging_context(), NULL,
 226                                    MSG_WINBIND_TRY_TO_GO_ONLINE,
 227                                    msg_try_to_go_online);
 228                 messaging_register(winbind_messaging_context(), NULL,
 229                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 230                                    msg_failed_to_go_online);
 231                 return True;
 232         }
 233
 234         /* Child. */
 235
 236         /* Leave messages blocked - we will never process one. */
 237
 238         if (!override_logfile) {
 239                 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
 240                         DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
 241                         _exit(1);
 242                 }
 243         }
 244
 245         status = winbindd_reinit_after_fork(NULL, lfile);
 246         if (!NT_STATUS_IS_OK(status)) {
 247                 DEBUG(1, ("winbindd_reinit_after_fork failed: %s\n",
 248                           nt_errstr(status)));
 249                 messaging_send_buf(winbind_messaging_context(),
 250                                    pid_to_procid(parent_pid),
 251                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 252                                    (const uint8_t *)domain->name,
 253                                    strlen(domain->name)+1);
 254                 _exit(1);
 255         }
 256         SAFE_FREE(lfile);
 257
 258         mem_ctx = talloc_init("fork_child_dc_connect");
 259         if (!mem_ctx) {
 260                 DEBUG(0,("talloc_init failed.\n"));
 261                 messaging_send_buf(winbind_messaging_context(),
 262                                    pid_to_procid(parent_pid),
 263                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 264                                    (const uint8_t *)domain->name,
 265                                    strlen(domain->name)+1);
 266                 _exit(1);
 267         }
 268
 269         if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
 270                 /* Still offline ? Can't find DC's. */
 271                 messaging_send_buf(winbind_messaging_context(),
 272                                    pid_to_procid(parent_pid),
 273                                    MSG_WINBIND_FAILED_TO_GO_ONLINE,
 274                                    (const uint8_t *)domain->name,
 275                                    strlen(domain->name)+1);
 276                 _exit(0);
 277         }
 278
 279         /* We got a DC. Send a message to our parent to get it to
 280            try and do the same. */
 281
 282         messaging_send_buf(winbind_messaging_context(),
 283                            pid_to_procid(parent_pid),
 284                            MSG_WINBIND_TRY_TO_GO_ONLINE,
 285                            (const uint8_t *)domain->name,
 286                            strlen(domain->name)+1);
 287         _exit(0);
 288 }
 289
 290 /****************************************************************
 291  Handler triggered if we're offline to try and detect a DC.
 292 ****************************************************************/
 293
 294 static void check_domain_online_handler(struct tevent_context *ctx,
 295                                         struct tevent_timer *te,
 296                                         struct timeval now,
 297                                         void *private_data)
 298 {
 299         struct winbindd_domain *domain =
 300                 (struct winbindd_domain *)private_data;
 301
 302         DEBUG(10,("check_domain_online_handler: called for domain "
 303                   "%s (online = %s)\n", domain->name,
 304                   domain->online ? "True" : "False" ));
 305
 306         TALLOC_FREE(domain->check_online_event);
 307
 308         /* Are we still in "startup" mode ? */
 309
 310         if (domain->startup && (time_mono(NULL) > domain->startup_time + 30)) {
 311                 /* No longer in "startup" mode. */
 312                 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
 313                         domain->name ));
 314                 domain->startup = False;
 315         }
 316
 317         /* We've been told to stay offline, so stay
 318            that way. */
 319
 320         if (get_global_winbindd_state_offline()) {
 321                 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
 322                         domain->name ));
 323                 return;
 324         }
 325
 326         /* Fork a child to test if it can contact a DC.
 327            If it can then send ourselves a message to
 328            cause a reconnect. */
 329
 330         fork_child_dc_connect(domain);
 331 }
 332
 333 /****************************************************************
 334  If we're still offline setup the timeout check.
 335 ****************************************************************/
 336
 337 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
 338 {
 339         int wbr = lp_winbind_reconnect_delay();
 340
 341         if (domain->startup) {
 342                 domain->check_online_timeout = 10;
 343         } else if (domain->check_online_timeout < wbr) {
 344                 domain->check_online_timeout = wbr;
 345         }
 346 }
 347
 348 void winbind_msg_domain_offline(struct messaging_context *msg_ctx,
 349                                 void *private_data,
 350                                 uint32_t msg_type,
 351                                 struct server_id server_id,
 352                                 DATA_BLOB *data)
 353 {
 354         const char *domain_name = (const char *)data->data;
 355         struct winbindd_domain *domain;
 356
 357         domain = find_domain_from_name_noinit(domain_name);
 358         if (domain == NULL) {
 359                 return;
 360         }
 361
 362         domain->online = false;
 363
 364         DEBUG(10, ("Domain %s is marked as offline now.\n",
 365                    domain_name));
 366 }
 367
 368 void winbind_msg_domain_online(struct messaging_context *msg_ctx,
 369                                 void *private_data,
 370                                 uint32_t msg_type,
 371                                 struct server_id server_id,
 372                                 DATA_BLOB *data)
 373 {
 374         const char *domain_name = (const char *)data->data;
 375         struct winbindd_domain *domain;
 376
 377         domain = find_domain_from_name_noinit(domain_name);
 378         if (domain == NULL) {
 379                 return;
 380         }
 381
 382         domain->online = true;
 383
 384         DEBUG(10, ("Domain %s is marked as online now.\n",
 385                    domain_name));
 386 }
 387
 388 /****************************************************************
 389  Set domain offline and also add handler to put us back online
 390  if we detect a DC.
 391 ****************************************************************/
 392
 393 void set_domain_offline(struct winbindd_domain *domain)
 394 {
 395         pid_t parent_pid = getppid();
 396
 397         DEBUG(10,("set_domain_offline: called for domain %s\n",
 398                 domain->name ));
 399
 400         TALLOC_FREE(domain->check_online_event);
 401
 402         if (domain->internal) {
 403                 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
 404                         domain->name ));
 405                 return;
 406         }
 407
 408         domain->online = False;
 409
 410         /* Offline domains are always initialized. They're
 411            re-initialized when they go back online. */
 412
 413         domain->initialized = True;
 414
 415         /* We only add the timeout handler that checks and
 416            allows us to go back online when we've not
 417            been told to remain offline. */
 418
 419         if (get_global_winbindd_state_offline()) {
 420                 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
 421                         domain->name ));
 422                 return;
 423         }
 424
 425         /* If we're in startup mode, check again in 10 seconds, not in
 426            lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
 427
 428         calc_new_online_timeout_check(domain);
 429
 430         domain->check_online_event = tevent_add_timer(winbind_event_context(),
 431                                                 NULL,
 432                                                 timeval_current_ofs(domain->check_online_timeout,0),
 433                                                 check_domain_online_handler,
 434                                                 domain);
 435
 436         /* The above *has* to succeed for winbindd to work. */
 437         if (!domain->check_online_event) {
 438                 smb_panic("set_domain_offline: failed to add online handler");
 439         }
 440
 441         DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
 442                 domain->name ));
 443
 444         /* Send a message to the parent that the domain is offline. */
 445         if (parent_pid > 1 && !domain->internal) {
 446                 messaging_send_buf(winbind_messaging_context(),
 447                                    pid_to_procid(parent_pid),
 448                                    MSG_WINBIND_DOMAIN_OFFLINE,
 449                                    (uint8 *)domain->name,
 450                                    strlen(domain->name) + 1);
 451         }
 452
 453         /* Send an offline message to the idmap child when our
 454            primary domain goes offline */
 455
 456         if ( domain->primary ) {
 457                 struct winbindd_child *idmap = idmap_child();
 458
 459                 if ( idmap->pid != 0 ) {
 460                         messaging_send_buf(winbind_messaging_context(),
 461                                            pid_to_procid(idmap->pid),
 462                                            MSG_WINBIND_OFFLINE,
 463                                            (const uint8_t *)domain->name,
 464                                            strlen(domain->name)+1);
 465                 }
 466         }
 467
 468         return;
 469 }
 470
 471 /****************************************************************
 472  Set domain online - if allowed.
 473 ****************************************************************/
 474
 475 static void set_domain_online(struct winbindd_domain *domain)
 476 {
 477         pid_t parent_pid = getppid();
 478
 479         DEBUG(10,("set_domain_online: called for domain %s\n",
 480                 domain->name ));
 481
 482         if (domain->internal) {
 483                 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
 484                         domain->name ));
 485                 return;
 486         }
 487
 488         if (get_global_winbindd_state_offline()) {
 489                 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
 490                         domain->name ));
 491                 return;
 492         }
 493
 494         winbindd_set_locator_kdc_envs(domain);
 495
 496         /* If we are waiting to get a krb5 ticket, trigger immediately. */
 497         ccache_regain_all_now();
 498
 499         /* Ok, we're out of any startup mode now... */
 500         domain->startup = False;
 501
 502         if (domain->online == False) {
 503                 /* We were offline - now we're online. We default to
 504                    using the MS-RPC backend if we started offline,
 505                    and if we're going online for the first time we
 506                    should really re-initialize the backends and the
 507                    checks to see if we're talking to an AD or NT domain.
 508                 */
 509
 510                 domain->initialized = False;
 511
 512                 /* 'reconnect_methods' is the MS-RPC backend. */
 513                 if (domain->backend == &reconnect_methods) {
 514                         domain->backend = NULL;
 515                 }
 516         }
 517
 518         /* Ensure we have no online timeout checks. */
 519         domain->check_online_timeout = 0;
 520         TALLOC_FREE(domain->check_online_event);
 521
 522         /* Ensure we ignore any pending child messages. */
 523         messaging_deregister(winbind_messaging_context(),
 524                              MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
 525         messaging_deregister(winbind_messaging_context(),
 526                              MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
 527
 528         domain->online = True;
 529
 530         /* Send a message to the parent that the domain is online. */
 531         if (parent_pid > 1 && !domain->internal) {
 532                 messaging_send_buf(winbind_messaging_context(),
 533                                    pid_to_procid(parent_pid),
 534                                    MSG_WINBIND_DOMAIN_ONLINE,
 535                                    (uint8 *)domain->name,
 536                                    strlen(domain->name) + 1);
 537         }
 538
 539         /* Send an online message to the idmap child when our
 540            primary domain comes online */
 541
 542         if ( domain->primary ) {
 543                 struct winbindd_child *idmap = idmap_child();
 544
 545                 if ( idmap->pid != 0 ) {
 546                         messaging_send_buf(winbind_messaging_context(),
 547                                            pid_to_procid(idmap->pid),
 548                                            MSG_WINBIND_ONLINE,
 549                                            (const uint8_t *)domain->name,
 550                                            strlen(domain->name)+1);
 551                 }
 552         }
 553
 554         return;
 555 }
 556
 557 /****************************************************************
 558  Requested to set a domain online.
 559 ****************************************************************/
 560
 561 void set_domain_online_request(struct winbindd_domain *domain)
 562 {
 563         struct timeval tev;
 564
 565         DEBUG(10,("set_domain_online_request: called for domain %s\n",
 566                 domain->name ));
 567
 568         if (get_global_winbindd_state_offline()) {
 569                 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
 570                         domain->name ));
 571                 return;
 572         }
 573
 574         if (domain->internal) {
 575                 DEBUG(10, ("set_domain_online_request: Internal domains are "
 576                            "always online\n"));
 577                 return;
 578         }
 579
 580         /* We've been told it's safe to go online and
 581            try and connect to a DC. But I don't believe it
 582            because network manager seems to lie.
 583            Wait at least 5 seconds. Heuristics suck... */
 584
 585
 586         GetTimeOfDay(&tev);
 587
 588         /* Go into "startup" mode again. */
 589         domain->startup_time = time_mono(NULL);
 590         domain->startup = True;
 591
 592         tev.tv_sec += 5;
 593
 594         if (!domain->check_online_event) {
 595                 /* If we've come from being globally offline we
 596                    don't have a check online event handler set.
 597                    We need to add one now we're trying to go
 598                    back online. */
 599
 600                 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
 601                         domain->name ));
 602         }
 603
 604         TALLOC_FREE(domain->check_online_event);
 605
 606         domain->check_online_event = tevent_add_timer(winbind_event_context(),
 607                                                      NULL,
 608                                                      tev,
 609                                                      check_domain_online_handler,
 610                                                      domain);
 611
 612         /* The above *has* to succeed for winbindd to work. */
 613         if (!domain->check_online_event) {
 614                 smb_panic("set_domain_online_request: failed to add online handler");
 615         }
 616 }
 617
 618 /****************************************************************
 619  Add -ve connection cache entries for domain and realm.
 620 ****************************************************************/
 621
 622 static void winbind_add_failed_connection_entry(
 623         const struct winbindd_domain *domain,
 624         const char *server,
 625         NTSTATUS result)
 626 {
 627         add_failed_connection_entry(domain->name, server, result);
 628         /* If this was the saf name for the last thing we talked to,
 629            remove it. */
 630         saf_delete(domain->name);
 631         if (domain->alt_name != NULL) {
 632                 add_failed_connection_entry(domain->alt_name, server, result);
 633                 saf_delete(domain->alt_name);
 634         }
 635         winbindd_unset_locator_kdc_env(domain);
 636 }
 637
 638 /* Choose between anonymous or authenticated connections.  We need to use
 639    an authenticated connection if DCs have the RestrictAnonymous registry
 640    entry set > 0, or the "Additional restrictions for anonymous
 641    connections" set in the win2k Local Security Policy.
 642
 643    Caller to free() result in domain, username, password
 644 */
 645
 646 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
 647 {
 648         *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
 649         *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 650         *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
 651
 652         if (*username && **username) {
 653
 654                 if (!*domain || !**domain)
 655                         *domain = smb_xstrdup(lp_workgroup());
 656
 657                 if (!*password || !**password)
 658                         *password = smb_xstrdup("");
 659
 660                 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
 661                           *domain, *username));
 662
 663         } else {
 664                 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
 665                 *username = smb_xstrdup("");
 666                 *domain = smb_xstrdup("");
 667                 *password = smb_xstrdup("");
 668         }
 669 }
 670
 671 static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx,
 672                                        struct cli_credentials **_creds)
 673 {
 674
 675         TALLOC_CTX *frame = talloc_stackframe();
 676         NTSTATUS status = NT_STATUS_INTERNAL_ERROR;
 677         struct loadparm_context *lp_ctx;
 678         char *username = NULL;
 679         char *netbios_domain = NULL;
 680         char *password = NULL;
 681         struct cli_credentials *creds = NULL;
 682         bool ok;
 683
 684         cm_get_ipc_userpass(&username, &netbios_domain, &password);
 685
 686         lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());
 687         if (lp_ctx == NULL) {
 688                 DEBUG(1, ("loadparm_init_s3 failed\n"));
 689                 status = NT_STATUS_INTERNAL_ERROR;
 690                 goto fail;
 691         }
 692
 693         creds = cli_credentials_init(mem_ctx);
 694         if (creds == NULL) {
 695                 status = NT_STATUS_NO_MEMORY;
 696                 goto fail;
 697         }
 698
 699         cli_credentials_set_conf(creds, lp_ctx);
 700         cli_credentials_set_kerberos_state(creds, CRED_DONT_USE_KERBEROS);
 701
 702         ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED);
 703         if (!ok) {
 704                 status = NT_STATUS_NO_MEMORY;
 705                 goto fail;
 706         }
 707
 708         ok = cli_credentials_set_username(creds, username, CRED_SPECIFIED);
 709         if (!ok) {
 710                 status = NT_STATUS_NO_MEMORY;
 711                 goto fail;
 712         }
 713
 714         ok = cli_credentials_set_password(creds, password, CRED_SPECIFIED);
 715         if (!ok) {
 716                 status = NT_STATUS_NO_MEMORY;
 717                 goto fail;
 718         }
 719
 720         *_creds = creds;
 721         creds = NULL;
 722         status = NT_STATUS_OK;
 723  fail:
 724         TALLOC_FREE(creds);
 725         SAFE_FREE(username);
 726         SAFE_FREE(netbios_domain);
 727         SAFE_FREE(password);
 728         TALLOC_FREE(frame);
 729         return status;
 730 }
 731
 732 static bool cm_is_ipc_credentials(struct cli_credentials *creds)
 733 {
 734         TALLOC_CTX *frame = talloc_stackframe();
 735         char *ipc_account = NULL;
 736         char *ipc_domain = NULL;
 737         char *ipc_password = NULL;
 738         const char *creds_account = NULL;
 739         const char *creds_domain = NULL;
 740         const char *creds_password = NULL;
 741         bool ret = false;
 742
 743         cm_get_ipc_userpass(&ipc_account, &ipc_domain, &ipc_password);
 744
 745         creds_account = cli_credentials_get_username(creds);
 746         creds_domain = cli_credentials_get_domain(creds);
 747         creds_password = cli_credentials_get_password(creds);
 748
 749         if (!strequal(ipc_domain, creds_domain)) {
 750                 goto done;
 751         }
 752
 753         if (!strequal(ipc_account, creds_account)) {
 754                 goto done;
 755         }
 756
 757         if (!strcsequal(ipc_password, creds_password)) {
 758                 goto done;
 759         }
 760
 761         ret = true;
 762  done:
 763         SAFE_FREE(ipc_account);
 764         SAFE_FREE(ipc_domain);
 765         SAFE_FREE(ipc_password);
 766         TALLOC_FREE(frame);
 767         return ret;
 768 }
 769
 770 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
 771                                      fstring dcname,
 772                                      struct sockaddr_storage *dc_ss)
 773 {
 774         struct winbindd_domain *our_domain = NULL;
 775         struct rpc_pipe_client *netlogon_pipe = NULL;
 776         NTSTATUS result;
 777         WERROR werr;
 778         TALLOC_CTX *mem_ctx;
 779         unsigned int orig_timeout;
 780         const char *tmp = NULL;
 781         const char *p;
 782         struct dcerpc_binding_handle *b;
 783
 784         /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
 785          * moment.... */
 786
 787         if (IS_DC) {
 788                 return False;
 789         }
 790
 791         if (domain->primary) {
 792                 return False;
 793         }
 794
 795         our_domain = find_our_domain();
 796
 797         if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
 798                 return False;
 799         }
 800
 801         result = cm_connect_netlogon(our_domain, &netlogon_pipe);
 802         if (!NT_STATUS_IS_OK(result)) {
 803                 talloc_destroy(mem_ctx);
 804                 return False;
 805         }
 806
 807         b = netlogon_pipe->binding_handle;
 808
 809         /* This call can take a long time - allow the server to time out.
 810            35 seconds should do it. */
 811
 812         orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
 813
 814         if (our_domain->active_directory) {
 815                 struct netr_DsRGetDCNameInfo *domain_info = NULL;
 816
 817                 result = dcerpc_netr_DsRGetDCName(b,
 818                                                   mem_ctx,
 819                                                   our_domain->dcname,
 820                                                   domain->name,
 821                                                   NULL,
 822                                                   NULL,
 823                                                   DS_RETURN_DNS_NAME,
 824                                                   &domain_info,
 825                                                   &werr);
 826                 if (NT_STATUS_IS_OK(result) && W_ERROR_IS_OK(werr)) {
 827                         tmp = talloc_strdup(
 828                                 mem_ctx, domain_info->dc_unc);
 829                         if (tmp == NULL) {
 830                                 DEBUG(0, ("talloc_strdup failed\n"));
 831                                 talloc_destroy(mem_ctx);
 832                                 return false;
 833                         }
 834                         if (domain->alt_name == NULL) {
 835                                 domain->alt_name = talloc_strdup(domain,
 836                                                                  domain_info->domain_name);
 837                                 if (domain->alt_name == NULL) {
 838                                         DEBUG(0, ("talloc_strdup failed\n"));
 839                                         talloc_destroy(mem_ctx);
 840                                         return false;
 841                                 }
 842                         }
 843                         if (domain->forest_name == NULL) {
 844                                 domain->forest_name = talloc_strdup(domain,
 845                                                                     domain_info->forest_name);
 846                                 if (domain->forest_name == NULL) {
 847                                         DEBUG(0, ("talloc_strdup failed\n"));
 848                                         talloc_destroy(mem_ctx);
 849                                         return false;
 850                                 }
 851                         }
 852                 }
 853         } else {
 854                 result = dcerpc_netr_GetAnyDCName(b, mem_ctx,
 855                                                   our_domain->dcname,
 856                                                   domain->name,
 857                                                   &tmp,
 858                                                   &werr);
 859         }
 860
 861         /* And restore our original timeout. */
 862         rpccli_set_timeout(netlogon_pipe, orig_timeout);
 863
 864         if (!NT_STATUS_IS_OK(result)) {
 865                 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
 866                         nt_errstr(result)));
 867                 talloc_destroy(mem_ctx);
 868                 return false;
 869         }
 870
 871         if (!W_ERROR_IS_OK(werr)) {
 872                 DEBUG(10,("dcerpc_netr_GetAnyDCName failed: %s\n",
 873                            win_errstr(werr)));
 874                 talloc_destroy(mem_ctx);
 875                 return false;
 876         }
 877
 878         /* dcerpc_netr_GetAnyDCName gives us a name with \\ */
 879         p = strip_hostname(tmp);
 880
 881         fstrcpy(dcname, p);
 882
 883         talloc_destroy(mem_ctx);
 884
 885         DEBUG(10,("dcerpc_netr_GetAnyDCName returned %s\n", dcname));
 886
 887         if (!resolve_name(dcname, dc_ss, 0x20, true)) {
 888                 return False;
 889         }
 890
 891         return True;
 892 }
 893
 894 /**
 895  * Helper function to assemble trust password and account name
 896  */
 897 static NTSTATUS get_trust_credentials(struct winbindd_domain *domain,
 898                                       TALLOC_CTX *mem_ctx,
 899                                       bool netlogon,
 900                                       struct cli_credentials **_creds)
 901 {
 902         const struct winbindd_domain *creds_domain = NULL;
 903         struct cli_credentials *creds;
 904         NTSTATUS status;
 905
 906         /* If we are a DC and this is not our own domain */
 907
 908         if (IS_DC && netlogon) {
 909                 creds_domain = domain;
 910         } else {
 911                 creds_domain = find_our_domain();
 912                 if (creds_domain == NULL) {
 913                         return NT_STATUS_INVALID_SERVER_STATE;
 914                 }
 915         }
 916
 917         status = pdb_get_trust_credentials(creds_domain->name,
 918                                            creds_domain->alt_name,
 919                                            mem_ctx,
 920                                            &creds);
 921         if (!NT_STATUS_IS_OK(status)) {
 922                 goto ipc_fallback;
 923         }
 924
 925         if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
 926                 cli_credentials_set_kerberos_state(creds,
 927                                                    CRED_MUST_USE_KERBEROS);
 928         }
 929
 930         if (domain->primary && lp_security() == SEC_ADS) {
 931                 cli_credentials_set_kerberos_state(creds,
 932                                                    CRED_AUTO_USE_KERBEROS);
 933         } else if (!domain->active_directory) {
 934                 cli_credentials_set_kerberos_state(creds,
 935                                                    CRED_DONT_USE_KERBEROS);
 936         }
 937
 938         if (creds_domain != domain) {
 939                 /*
 940                  * We can only use schannel against a direct trust
 941                  */
 942                 cli_credentials_set_secure_channel_type(creds,
 943                                                         SEC_CHAN_NULL);
 944         }
 945
 946         *_creds = creds;
 947         return NT_STATUS_OK;
 948
 949  ipc_fallback:
 950         if (netlogon) {
 951                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 952         }
 953
 954         status = cm_get_ipc_credentials(mem_ctx, &creds);
 955         if (!NT_STATUS_IS_OK(status)) {
 956                 return status;
 957         }
 958
 959         *_creds = creds;
 960         return NT_STATUS_OK;
 961 }
 962
 963 /************************************************************************
 964  Given a fd with a just-connected TCP connection to a DC, open a connection
 965  to the pipe.
 966 ************************************************************************/
 967
 968 static NTSTATUS cm_prepare_connection(struct winbindd_domain *domain,
 969                                       const int sockfd,
 970                                       const char *controller,
 971                                       struct cli_state **cli,
 972                                       bool *retry)
 973 {
 974         bool try_ipc_auth = false;
 975         const char *machine_password = NULL;
 976         const char *machine_krb5_principal = NULL;
 977         const char *machine_account = NULL;
 978         const char *machine_domain = NULL;
 979         int flags = 0;
 980         struct cli_credentials *creds = NULL;
 981         enum credentials_use_kerberos krb5_state;
 982
 983         struct named_mutex *mutex;
 984
 985         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 986
 987         enum smb_signing_setting smb_sign_client_connections = lp_client_signing();
 988
 989         if (smb_sign_client_connections == SMB_SIGNING_DEFAULT) {
 990                 /*
 991                  * If we are connecting to our own AD domain, require
 992                  * smb signing to disrupt MITM attacks
 993                  */
 994                 if (domain->primary && lp_security() == SEC_ADS) {
 995                         smb_sign_client_connections = SMB_SIGNING_REQUIRED;
 996                 /*
 997                  * If we are in or are an AD domain and connecting to another
 998                  * AD domain in our forest
 999                  * then require smb signing to disrupt MITM attacks
1000                  */
1001                 } else if ((lp_security() == SEC_ADS ||
1002                             lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC)
1003                            && domain->active_directory
1004                            && (domain->domain_trust_attribs
1005                                & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)) {
1006                         smb_sign_client_connections = SMB_SIGNING_REQUIRED;
1007                 }
1008         }
1009
1010         DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
1011                 controller, domain->name ));
1012
1013         *retry = True;
1014
1015         mutex = grab_named_mutex(talloc_tos(), controller,
1016                                  WINBIND_SERVER_MUTEX_WAIT_TIME);
1017         if (mutex == NULL) {
1018                 close(sockfd);
1019                 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
1020                          controller));
1021                 result = NT_STATUS_POSSIBLE_DEADLOCK;
1022                 goto done;
1023         }
1024
1025         flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
1026
1027         *cli = cli_state_create(NULL, sockfd,
1028                                 controller, domain->alt_name,
1029                                 smb_sign_client_connections, flags);
1030         if (*cli == NULL) {
1031                 close(sockfd);
1032                 DEBUG(1, ("Could not cli_initialize\n"));
1033                 result = NT_STATUS_NO_MEMORY;
1034                 goto done;
1035         }
1036
1037         cli_set_timeout(*cli, 10000); /* 10 seconds */
1038
1039         result = smbXcli_negprot((*cli)->conn, (*cli)->timeout,
1040                                  lp_client_min_protocol(),
1041                                  lp_winbindd_max_protocol());
1042
1043         if (!NT_STATUS_IS_OK(result)) {
1044                 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
1045                 goto done;
1046         }
1047
1048         if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_NT1 &&
1049             smb1cli_conn_capabilities((*cli)->conn) & CAP_EXTENDED_SECURITY) {
1050                 try_ipc_auth = true;
1051         } else if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
1052                 try_ipc_auth = true;
1053         } else if (smb_sign_client_connections == SMB_SIGNING_REQUIRED) {
1054                 /*
1055                  * If we are forcing on SMB signing, then we must
1056                  * require authentication unless this is a one-way
1057                  * trust, and we have no stored user/password
1058                  */
1059                 try_ipc_auth = true;
1060         }
1061
1062         if (try_ipc_auth) {
1063                 result = get_trust_credentials(domain, talloc_tos(), false, &creds);
1064                 if (!NT_STATUS_IS_OK(result)) {
1065                         DEBUG(1, ("get_trust_credentials(%s) failed: %s\n",
1066                                   domain->name, nt_errstr(result)));
1067                         goto done;
1068                 }
1069         } else {
1070                 /*
1071                  * Without SPNEGO or NTLMSSP (perhaps via SMB2) we
1072                  * would try and authentication with our machine
1073                  * account password and fail.  This is very rare in
1074                  * the modern world however
1075                  */
1076                 creds = cli_credentials_init_anon(talloc_tos());
1077                 if (creds == NULL) {
1078                         result = NT_STATUS_NO_MEMORY;
1079                         DEBUG(1, ("cli_credentials_init_anon(%s) failed: %s\n",
1080                                   domain->name, nt_errstr(result)));
1081                         goto done;
1082                 }
1083         }
1084
1085         krb5_state = cli_credentials_get_kerberos_state(creds);
1086
1087         machine_krb5_principal = cli_credentials_get_principal(creds,
1088                                                         talloc_tos());
1089         if (machine_krb5_principal == NULL) {
1090                 krb5_state = CRED_DONT_USE_KERBEROS;
1091         }
1092
1093         machine_account = cli_credentials_get_username(creds);
1094         machine_password = cli_credentials_get_password(creds);
1095         machine_domain = cli_credentials_get_domain(creds);
1096
1097         if (krb5_state != CRED_DONT_USE_KERBEROS) {
1098
1099                 /* Try a krb5 session */
1100
1101                 (*cli)->use_kerberos = True;
1102                 DEBUG(5, ("connecting to %s from %s with kerberos principal "
1103                           "[%s] and realm [%s]\n", controller, lp_netbios_name(),
1104                           machine_krb5_principal, domain->alt_name));
1105
1106                 winbindd_set_locator_kdc_envs(domain);
1107
1108                 result = cli_session_setup(*cli,
1109                                            machine_krb5_principal,
1110                                            machine_password,
1111                                            strlen(machine_password)+1,
1112                                            machine_password,
1113                                            strlen(machine_password)+1,
1114                                            machine_domain);
1115
1116                 if (NT_STATUS_IS_OK(result)) {
1117                         if (krb5_state != CRED_MUST_USE_KERBEROS) {
1118                                 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
1119                                 result = cli_init_creds(*cli, machine_account, machine_domain);
1120                                 if (!NT_STATUS_IS_OK(result)) {
1121                                         goto done;
1122                                 }
1123                         }
1124                         goto session_setup_done;
1125                 }
1126
1127                 DEBUG(4,("failed kerberos session setup with %s\n",
1128                          nt_errstr(result)));
1129         }
1130
1131         if (krb5_state != CRED_MUST_USE_KERBEROS) {
1132                 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
1133                 (*cli)->use_kerberos = False;
1134
1135                 DEBUG(5, ("connecting to %s from %s using NTLMSSP with username "
1136                           "[%s]\\[%s]\n",  controller, lp_netbios_name(),
1137                           machine_domain, machine_account));
1138
1139                 result = cli_session_setup(*cli,
1140                                            machine_account,
1141                                            machine_password,
1142                                            strlen(machine_password)+1,
1143                                            machine_password,
1144                                            strlen(machine_password)+1,
1145                                            machine_domain);
1146         }
1147
1148         if (NT_STATUS_IS_OK(result)) {
1149                 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
1150                 result = cli_init_creds(*cli, machine_account, machine_domain, machine_password);
1151                 if (!NT_STATUS_IS_OK(result)) {
1152                         goto done;
1153                 }
1154                 goto session_setup_done;
1155         }
1156
1157         /*
1158          * If we are not going to validiate the conneciton
1159          * with SMB signing, then allow us to fall back to
1160          * anonymous
1161          */
1162         if (NT_STATUS_EQUAL(result, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT)
1163             || NT_STATUS_EQUAL(result, NT_STATUS_TRUSTED_DOMAIN_FAILURE)
1164             || NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE))
1165         {
1166                 if (cli_credentials_is_anonymous(creds)) {
1167                         goto done;
1168                 }
1169
1170                 if (!cm_is_ipc_credentials(creds)) {
1171                         goto ipc_fallback;
1172                 }
1173
1174                 if (smb_sign_client_connections == SMB_SIGNING_REQUIRED) {
1175                         goto done;
1176                 }
1177
1178                 goto anon_fallback;
1179         }
1180
1181         DEBUG(4, ("authenticated session setup failed with %s\n",
1182                 nt_errstr(result)));
1183
1184         goto done;
1185
1186  ipc_fallback:
1187         result = cm_get_ipc_credentials(talloc_tos(), &creds);
1188         if (!NT_STATUS_IS_OK(result)) {
1189                 goto done;
1190         }
1191
1192         if (cli_credentials_is_anonymous(creds)) {
1193                 TALLOC_FREE(creds);
1194                 goto anon_fallback;
1195         }
1196
1197         machine_account = cli_credentials_get_username(creds);
1198         machine_password = cli_credentials_get_password(creds);
1199         machine_domain = cli_credentials_get_domain(creds);
1200
1201         /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the ipc creds. */
1202         (*cli)->use_kerberos = False;
1203
1204         DEBUG(5, ("connecting to %s from %s using NTLMSSP with username "
1205                   "[%s]\\[%s]\n",  controller, lp_netbios_name(),
1206                   machine_domain, machine_account));
1207
1208         result = cli_session_setup(*cli,
1209                                    machine_account,
1210                                    machine_password,
1211                                    strlen(machine_password)+1,
1212                                    machine_password,
1213                                    strlen(machine_password)+1,
1214                                    machine_domain);
1215
1216         if (NT_STATUS_IS_OK(result)) {
1217                 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
1218                 result = cli_init_creds(*cli, machine_account, machine_domain);
1219                 if (!NT_STATUS_IS_OK(result)) {
1220                         goto done;
1221                 }
1222                 goto session_setup_done;
1223         }
1224
1225         /*
1226          * If we are not going to validiate the conneciton
1227          * with SMB signing, then allow us to fall back to
1228          * anonymous
1229          */
1230         if (NT_STATUS_EQUAL(result, NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT)
1231             || NT_STATUS_EQUAL(result, NT_STATUS_TRUSTED_DOMAIN_FAILURE)
1232             || NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE))
1233         {
1234                 goto anon_fallback;
1235         }
1236
1237         DEBUG(4, ("authenticated session setup failed with %s\n",
1238                 nt_errstr(result)));
1239
1240         goto done;
1241
1242  anon_fallback:
1243
1244         if (smb_sign_client_connections == SMB_SIGNING_REQUIRED) {
1245                 goto done;
1246         }
1247
1248         creds = cli_credentials_init_anon(talloc_tos());
1249         if (creds == NULL) {
1250                 result = NT_STATUS_NO_MEMORY;
1251                 goto done;
1252         }
1253
1254         machine_account = cli_credentials_get_username(creds);
1255         machine_password = cli_credentials_get_password(creds);
1256         machine_domain = cli_credentials_get_domain(creds);
1257
1258         /* Fall back to anonymous connection, this might fail later */
1259         DEBUG(10,("cm_prepare_connection: falling back to anonymous "
1260                 "connection for DC %s\n",
1261                 controller ));
1262
1263         (*cli)->use_kerberos = False;
1264
1265         result = cli_session_setup(*cli,
1266                                    machine_account,
1267                                    machine_password,
1268                                    strlen(machine_password)+1,
1269                                    machine_password,
1270                                    strlen(machine_password)+1,
1271                                    machine_domain);
1272
1273         if (NT_STATUS_IS_OK(result)) {
1274                 DEBUG(5, ("Connected anonymously\n"));
1275                 result = cli_init_creds(*cli, machine_account, machine_domain, machine_password);
1276                 if (!NT_STATUS_IS_OK(result)) {
1277                         goto done;
1278                 }
1279                 goto session_setup_done;
1280         }
1281
1282         /* We can't session setup */
1283         goto done;
1284
1285  session_setup_done:
1286
1287         /*
1288          * This should be a short term hack until
1289          * dynamic re-authentication is implemented.
1290          *
1291          * See Bug 9175 - winbindd doesn't recover from
1292          * NT_STATUS_NETWORK_SESSION_EXPIRED
1293          */
1294         if (smbXcli_conn_protocol((*cli)->conn) >= PROTOCOL_SMB2_02) {
1295                 smbXcli_session_set_disconnect_expired((*cli)->smb2.session);
1296         }
1297
1298         result = cli_tree_connect(*cli, "IPC$", "IPC", "", 0);
1299
1300         if (!NT_STATUS_IS_OK(result)) {
1301                 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
1302                 goto done;
1303         }
1304
1305         /* cache the server name for later connections */
1306
1307         saf_store(domain->name, controller);
1308         if (domain->alt_name && (*cli)->use_kerberos) {
1309                 saf_store(domain->alt_name, controller);
1310         }
1311
1312         winbindd_set_locator_kdc_envs(domain);
1313
1314         TALLOC_FREE(mutex);
1315         *retry = False;
1316
1317         result = NT_STATUS_OK;
1318
1319  done:
1320         TALLOC_FREE(mutex);
1321
1322         if (!NT_STATUS_IS_OK(result)) {
1323                 winbind_add_failed_connection_entry(domain, controller, result);
1324                 if ((*cli) != NULL) {
1325                         cli_shutdown(*cli);
1326                         *cli = NULL;
1327                 }
1328         }
1329
1330         return result;
1331 }
1332
1333 /*******************************************************************
1334  Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1335  array.
1336
1337  Keeps the list unique by not adding duplicate entries.
1338
1339  @param[in] mem_ctx talloc memory context to allocate from
1340  @param[in] domain_name domain of the DC
1341  @param[in] dcname name of the DC to add to the list
1342  @param[in] pss Internet address and port pair to add to the list
1343  @param[in,out] dcs array of dc_name_ip structures to add to
1344  @param[in,out] num_dcs number of dcs returned in the dcs array
1345  @return true if the list was added to, false otherwise
1346 *******************************************************************/
1347
1348 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
1349                               const char *dcname, struct sockaddr_storage *pss,
1350                               struct dc_name_ip **dcs, int *num)
1351 {
1352         int i = 0;
1353
1354         if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1355                 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1356                 return False;
1357         }
1358
1359         /* Make sure there's no duplicates in the list */
1360         for (i=0; i<*num; i++)
1361                 if (sockaddr_equal(
1362                             (struct sockaddr *)(void *)&(*dcs)[i].ss,
1363                             (struct sockaddr *)(void *)pss))
1364                         return False;
1365
1366         *dcs = talloc_realloc(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1367
1368         if (*dcs == NULL)
1369                 return False;
1370
1371         fstrcpy((*dcs)[*num].name, dcname);
1372         (*dcs)[*num].ss = *pss;
1373         *num += 1;
1374         return True;
1375 }
1376
1377 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
1378                                   struct sockaddr_storage *pss, uint16 port,
1379                                   struct sockaddr_storage **addrs, int *num)
1380 {
1381         *addrs = talloc_realloc(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1382
1383         if (*addrs == NULL) {
1384                 *num = 0;
1385                 return False;
1386         }
1387
1388         (*addrs)[*num] = *pss;
1389         set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1390
1391         *num += 1;
1392         return True;
1393 }
1394
1395 /*******************************************************************
1396  convert an ip to a name
1397 *******************************************************************/
1398
1399 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
1400                 const struct winbindd_domain *domain,
1401                 struct sockaddr_storage *pss,
1402                 char **name)
1403 {
1404         struct ip_service ip_list;
1405         uint32_t nt_version = NETLOGON_NT_VERSION_1;
1406         NTSTATUS status;
1407         const char *dc_name;
1408         fstring nbtname;
1409
1410         ip_list.ss = *pss;
1411         ip_list.port = 0;
1412
1413 #ifdef HAVE_ADS
1414         /* For active directory servers, try to get the ldap server name.
1415            None of these failures should be considered critical for now */
1416
1417         if ((lp_security() == SEC_ADS) && (domain->alt_name != NULL)) {
1418                 ADS_STRUCT *ads;
1419                 ADS_STATUS ads_status;
1420                 char addr[INET6_ADDRSTRLEN];
1421
1422                 print_sockaddr(addr, sizeof(addr), pss);
1423
1424                 ads = ads_init(domain->alt_name, domain->name, addr);
1425                 ads->auth.flags |= ADS_AUTH_NO_BIND;
1426
1427                 ads_status = ads_connect(ads);
1428                 if (ADS_ERR_OK(ads_status)) {
1429                         /* We got a cldap packet. */
1430                         *name = talloc_strdup(mem_ctx,
1431                                              ads->config.ldap_server_name);
1432                         if (*name == NULL) {
1433                                 return false;
1434                         }
1435                         namecache_store(*name, 0x20, 1, &ip_list);
1436
1437                         DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1438
1439                         if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1440                                 if (ads_closest_dc(ads)) {
1441                                         char *sitename = sitename_fetch(mem_ctx, ads->config.realm);
1442
1443                                         /* We're going to use this KDC for this realm/domain.
1444                                            If we are using sites, then force the krb5 libs
1445                                            to use this KDC. */
1446
1447                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1448                                                                         domain->name,
1449                                                                         sitename,
1450                                                                         pss);
1451
1452                                         TALLOC_FREE(sitename);
1453                                 } else {
1454                                         /* use an off site KDC */
1455                                         create_local_private_krb5_conf_for_domain(domain->alt_name,
1456                                                                         domain->name,
1457                                                                         NULL,
1458                                                                         pss);
1459                                 }
1460                                 winbindd_set_locator_kdc_envs(domain);
1461
1462                                 /* Ensure we contact this DC also. */
1463                                 saf_store(domain->name, *name);
1464                                 saf_store(domain->alt_name, *name);
1465                         }
1466
1467                         ads_destroy( &ads );
1468                         return True;
1469                 }
1470
1471                 ads_destroy( &ads );
1472                 return false;
1473         }
1474 #endif
1475
1476         status = nbt_getdc(winbind_messaging_context(), 10, pss, domain->name,
1477                            &domain->sid, nt_version, mem_ctx, &nt_version,
1478                            &dc_name, NULL);
1479         if (NT_STATUS_IS_OK(status)) {
1480                 *name = talloc_strdup(mem_ctx, dc_name);
1481                 if (*name == NULL) {
1482                         return false;
1483                 }
1484                 namecache_store(*name, 0x20, 1, &ip_list);
1485                 return True;
1486         }
1487
1488         /* try node status request */
1489
1490         if (name_status_find(domain->name, 0x1c, 0x20, pss, nbtname) ) {
1491                 namecache_store(nbtname, 0x20, 1, &ip_list);
1492
1493                 if (name != NULL) {
1494                         *name = talloc_strdup(mem_ctx, nbtname);
1495                         if (*name == NULL) {
1496                                 return false;
1497                         }
1498                 }
1499
1500                 return true;
1501         }
1502         return False;
1503 }
1504
1505 /*******************************************************************
1506  Retrieve a list of IP addresses for domain controllers.
1507
1508  The array is sorted in the preferred connection order.
1509
1510  @param[in] mem_ctx talloc memory context to allocate from
1511  @param[in] domain domain to retrieve DCs for
1512  @param[out] dcs array of dcs that will be returned
1513  @param[out] num_dcs number of dcs returned in the dcs array
1514  @return always true
1515 *******************************************************************/
1516
1517 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
1518                     struct dc_name_ip **dcs, int *num_dcs)
1519 {
1520         fstring dcname;
1521         struct  sockaddr_storage ss;
1522         struct  ip_service *ip_list = NULL;
1523         int     iplist_size = 0;
1524         int     i;
1525         bool    is_our_domain;
1526         enum security_types sec = (enum security_types)lp_security();
1527
1528         is_our_domain = strequal(domain->name, lp_workgroup());
1529
1530         /* If not our domain, get the preferred DC, by asking our primary DC */
1531         if ( !is_our_domain
1532                 && get_dc_name_via_netlogon(domain, dcname, &ss)
1533                 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1534                        num_dcs) )
1535         {
1536                 char addr[INET6_ADDRSTRLEN];
1537                 print_sockaddr(addr, sizeof(addr), &ss);
1538                 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1539                            dcname, addr));
1540                 return True;
1541         }
1542
1543         if ((sec == SEC_ADS) && (domain->alt_name != NULL)) {
1544                 char *sitename = NULL;
1545
1546                 /* We need to make sure we know the local site before
1547                    doing any DNS queries, as this will restrict the
1548                    get_sorted_dc_list() call below to only fetching
1549                    DNS records for the correct site. */
1550
1551                 /* Find any DC to get the site record.
1552                    We deliberately don't care about the
1553                    return here. */
1554
1555                 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1556
1557                 sitename = sitename_fetch(mem_ctx, domain->alt_name);
1558                 if (sitename) {
1559
1560                         /* Do the site-specific AD dns lookup first. */
1561                         get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1562                                &iplist_size, True);
1563
1564                         /* Add ips to the DC array.  We don't look up the name
1565                            of the DC in this function, but we fill in the char*
1566                            of the ip now to make the failed connection cache
1567                            work */
1568                         for ( i=0; i<iplist_size; i++ ) {
1569                                 char addr[INET6_ADDRSTRLEN];
1570                                 print_sockaddr(addr, sizeof(addr),
1571                                                 &ip_list[i].ss);
1572                                 add_one_dc_unique(mem_ctx,
1573                                                 domain->name,
1574                                                 addr,
1575                                                 &ip_list[i].ss,
1576                                                 dcs,
1577                                                 num_dcs);
1578                         }
1579
1580                         SAFE_FREE(ip_list);
1581                         TALLOC_FREE(sitename);
1582                         iplist_size = 0;
1583                 }
1584
1585                 /* Now we add DCs from the main AD DNS lookup. */
1586                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1587                         &iplist_size, True);
1588
1589                 for ( i=0; i<iplist_size; i++ ) {
1590                         char addr[INET6_ADDRSTRLEN];
1591                         print_sockaddr(addr, sizeof(addr),
1592                                         &ip_list[i].ss);
1593                         add_one_dc_unique(mem_ctx,
1594                                         domain->name,
1595                                         addr,
1596                                         &ip_list[i].ss,
1597                                         dcs,
1598                                         num_dcs);
1599                 }
1600
1601                 SAFE_FREE(ip_list);
1602                 iplist_size = 0;
1603         }
1604
1605         /* Try standard netbios queries if no ADS and fall back to DNS queries
1606          * if alt_name is available */
1607         if (*num_dcs == 0) {
1608                 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1609                        false);
1610                 if (iplist_size == 0) {
1611                         if (domain->alt_name != NULL) {
1612                                 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1613                                        &iplist_size, true);
1614                         }
1615                 }
1616
1617                 for ( i=0; i<iplist_size; i++ ) {
1618                         char addr[INET6_ADDRSTRLEN];
1619                         print_sockaddr(addr, sizeof(addr),
1620                                         &ip_list[i].ss);
1621                         add_one_dc_unique(mem_ctx,
1622                                         domain->name,
1623                                         addr,
1624                                         &ip_list[i].ss,
1625                                         dcs,
1626                                         num_dcs);
1627                 }
1628
1629                 SAFE_FREE(ip_list);
1630                 iplist_size = 0;
1631         }
1632
1633         return True;
1634 }
1635
1636 /*******************************************************************
1637  Find and make a connection to a DC in the given domain.
1638
1639  @param[in] mem_ctx talloc memory context to allocate from
1640  @param[in] domain domain to find a dc in
1641  @param[out] dcname NetBIOS or FQDN of DC that's connected to
1642  @param[out] pss DC Internet address and port
1643  @param[out] fd fd of the open socket connected to the newly found dc
1644  @return true when a DC connection is made, false otherwise
1645 *******************************************************************/
1646
1647 static bool find_new_dc(TALLOC_CTX *mem_ctx,
1648                         struct winbindd_domain *domain,
1649                         char **dcname, struct sockaddr_storage *pss, int *fd)
1650 {
1651         struct dc_name_ip *dcs = NULL;
1652         int num_dcs = 0;
1653
1654         const char **dcnames = NULL;
1655         int num_dcnames = 0;
1656
1657         struct sockaddr_storage *addrs = NULL;
1658         int num_addrs = 0;
1659
1660         int i;
1661         size_t fd_index;
1662
1663         NTSTATUS status;
1664
1665         *fd = -1;
1666
1667  again:
1668         if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1669                 return False;
1670
1671         for (i=0; i<num_dcs; i++) {
1672
1673                 if (!add_string_to_array(mem_ctx, dcs[i].name,
1674                                     &dcnames, &num_dcnames)) {
1675                         return False;
1676                 }
1677                 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, TCP_SMB_PORT,
1678                                       &addrs, &num_addrs)) {
1679                         return False;
1680                 }
1681         }
1682
1683         if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1684                 return False;
1685
1686         if ((addrs == NULL) || (dcnames == NULL))
1687                 return False;
1688
1689         status = smbsock_any_connect(addrs, dcnames, NULL, NULL, NULL,
1690                                      num_addrs, 0, 10, fd, &fd_index, NULL);
1691         if (!NT_STATUS_IS_OK(status)) {
1692                 for (i=0; i<num_dcs; i++) {
1693                         char ab[INET6_ADDRSTRLEN];
1694                         print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1695                         DEBUG(10, ("find_new_dc: smbsock_any_connect failed for "
1696                                 "domain %s address %s. Error was %s\n",
1697                                    domain->name, ab, nt_errstr(status) ));
1698                         winbind_add_failed_connection_entry(domain,
1699                                 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1700                 }
1701                 return False;
1702         }
1703
1704         *pss = addrs[fd_index];
1705
1706         if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1707                 /* Ok, we've got a name for the DC */
1708                 *dcname = talloc_strdup(mem_ctx, dcnames[fd_index]);
1709                 if (*dcname == NULL) {
1710                         return false;
1711                 }
1712                 return true;
1713         }
1714
1715         /* Try to figure out the name */
1716         if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1717                 return True;
1718         }
1719
1720         /* We can not continue without the DC's name */
1721         winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1722                                     NT_STATUS_UNSUCCESSFUL);
1723
1724         /* Throw away all arrays as we're doing this again. */
1725         TALLOC_FREE(dcs);
1726         num_dcs = 0;
1727
1728         TALLOC_FREE(dcnames);
1729         num_dcnames = 0;
1730
1731         TALLOC_FREE(addrs);
1732         num_addrs = 0;
1733
1734         close(*fd);
1735         *fd = -1;
1736
1737         goto again;
1738 }
1739
1740 static char *current_dc_key(TALLOC_CTX *mem_ctx, const char *domain_name)
1741 {
1742         return talloc_asprintf_strupper_m(mem_ctx, "CURRENT_DCNAME/%s",
1743                                           domain_name);
1744 }
1745
1746 static void store_current_dc_in_gencache(const char *domain_name,
1747                                          const char *dc_name,
1748                                          struct cli_state *cli)
1749 {
1750         char addr[INET6_ADDRSTRLEN];
1751         char *key = NULL;
1752         char *value = NULL;
1753
1754         if (!cli_state_is_connected(cli)) {
1755                 return;
1756         }
1757
1758         print_sockaddr(addr, sizeof(addr),
1759                        smbXcli_conn_remote_sockaddr(cli->conn));
1760
1761         key = current_dc_key(talloc_tos(), domain_name);
1762         if (key == NULL) {
1763                 goto done;
1764         }
1765
1766         value = talloc_asprintf(talloc_tos(), "%s %s", addr, dc_name);
1767         if (value == NULL) {
1768                 goto done;
1769         }
1770
1771         gencache_set(key, value, 0x7fffffff);
1772 done:
1773         TALLOC_FREE(value);
1774         TALLOC_FREE(key);
1775 }
1776
1777 bool fetch_current_dc_from_gencache(TALLOC_CTX *mem_ctx,
1778                                     const char *domain_name,
1779                                     char **p_dc_name, char **p_dc_ip)
1780 {
1781         char *key, *p;
1782         char *value = NULL;
1783         bool ret = false;
1784         char *dc_name = NULL;
1785         char *dc_ip = NULL;
1786
1787         key = current_dc_key(talloc_tos(), domain_name);
1788         if (key == NULL) {
1789                 goto done;
1790         }
1791         if (!gencache_get(key, mem_ctx, &value, NULL)) {
1792                 goto done;
1793         }
1794         p = strchr(value, ' ');
1795         if (p == NULL) {
1796                 goto done;
1797         }
1798         dc_ip = talloc_strndup(mem_ctx, value, p - value);
1799         if (dc_ip == NULL) {
1800                 goto done;
1801         }
1802         dc_name = talloc_strdup(mem_ctx, p+1);
1803         if (dc_name == NULL) {
1804                 goto done;
1805         }
1806
1807         if (p_dc_ip != NULL) {
1808                 *p_dc_ip = dc_ip;
1809                 dc_ip = NULL;
1810         }
1811         if (p_dc_name != NULL) {
1812                 *p_dc_name = dc_name;
1813                 dc_name = NULL;
1814         }
1815         ret = true;
1816 done:
1817         TALLOC_FREE(dc_name);
1818         TALLOC_FREE(dc_ip);
1819         TALLOC_FREE(key);
1820         TALLOC_FREE(value);
1821         return ret;
1822 }
1823
1824 NTSTATUS wb_open_internal_pipe(TALLOC_CTX *mem_ctx,
1825                                const struct ndr_interface_table *table,
1826                                struct rpc_pipe_client **ret_pipe)
1827 {
1828         struct rpc_pipe_client *cli = NULL;
1829         const struct auth_session_info *session_info;
1830         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1831
1832
1833         session_info = get_session_info_system();
1834         SMB_ASSERT(session_info != NULL);
1835
1836         /* create a connection to the specified pipe */
1837         if (lp_parm_bool(-1, "winbindd", "use external pipes", false)) {
1838                 status = rpc_pipe_open_interface(mem_ctx,
1839                                                  table,
1840                                                  session_info,
1841                                                  NULL,
1842                                                  winbind_messaging_context(),
1843                                                  &cli);
1844         } else {
1845                 status = rpc_pipe_open_internal(mem_ctx,
1846                                                 &table->syntax_id,
1847                                                 session_info,
1848                                                 NULL,
1849                                                 winbind_messaging_context(),
1850                                                 &cli);
1851         }
1852         if (!NT_STATUS_IS_OK(status)) {
1853                 DEBUG(0, ("open_internal_pipe: Could not connect to %s pipe: %s\n",
1854                           table->name, nt_errstr(status)));
1855                 return status;
1856         }
1857
1858         if (ret_pipe) {
1859                 *ret_pipe = cli;
1860         }
1861
1862         return NT_STATUS_OK;
1863 }
1864
1865 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
1866                                    struct winbindd_cm_conn *new_conn)
1867 {
1868         TALLOC_CTX *mem_ctx;
1869         NTSTATUS result;
1870         char *saf_servername;
1871         int retries;
1872
1873         if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1874                 set_domain_offline(domain);
1875                 return NT_STATUS_NO_MEMORY;
1876         }
1877
1878         saf_servername = saf_fetch(mem_ctx, domain->name );
1879
1880         /* we have to check the server affinity cache here since
1881            later we select a DC based on response time and not preference */
1882
1883         /* Check the negative connection cache
1884            before talking to it. It going down may have
1885            triggered the reconnection. */
1886
1887         if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1888
1889                 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1890                         saf_servername, domain->name ));
1891
1892                 /* convert an ip address to a name */
1893                 if (is_ipaddress( saf_servername ) ) {
1894                         char *dcname = NULL;
1895                         struct sockaddr_storage ss;
1896
1897                         if (!interpret_string_addr(&ss, saf_servername,
1898                                                 AI_NUMERICHOST)) {
1899                                 TALLOC_FREE(mem_ctx);
1900                                 return NT_STATUS_UNSUCCESSFUL;
1901                         }
1902                         if (dcip_to_name(mem_ctx, domain, &ss, &dcname)) {
1903                                 domain->dcname = talloc_strdup(domain,
1904                                                                dcname);
1905                                 if (domain->dcname == NULL) {
1906                                         TALLOC_FREE(mem_ctx);
1907                                         return NT_STATUS_NO_MEMORY;
1908                                 }
1909                         } else {
1910                                 winbind_add_failed_connection_entry(
1911                                         domain, saf_servername,
1912                                         NT_STATUS_UNSUCCESSFUL);
1913                         }
1914                 } else {
1915                         domain->dcname = talloc_strdup(domain, saf_servername);
1916                         if (domain->dcname == NULL) {
1917                                 TALLOC_FREE(mem_ctx);
1918                                 return NT_STATUS_NO_MEMORY;
1919                         }
1920                 }
1921         }
1922
1923         for (retries = 0; retries < 3; retries++) {
1924                 int fd = -1;
1925                 bool retry = False;
1926                 char *dcname = NULL;
1927
1928                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1929
1930                 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1931                         domain->dcname ? domain->dcname : "", domain->name ));
1932
1933                 if (domain->dcname != NULL
1934                         && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1935                         && (resolve_name(domain->dcname, &domain->dcaddr, 0x20, true)))
1936                 {
1937                         NTSTATUS status;
1938
1939                         status = smbsock_connect(&domain->dcaddr, 0,
1940                                                  NULL, -1, NULL, -1,
1941                                                  &fd, NULL, 10);
1942                         if (!NT_STATUS_IS_OK(status)) {
1943                                 fd = -1;
1944                         }
1945                 }
1946
1947                 if ((fd == -1) &&
1948                     !find_new_dc(mem_ctx, domain, &dcname, &domain->dcaddr, &fd))
1949                 {
1950                         /* This is the one place where we will
1951                            set the global winbindd offline state
1952                            to true, if a "WINBINDD_OFFLINE" entry
1953                            is found in the winbindd cache. */
1954                         set_global_winbindd_state_offline();
1955                         break;
1956                 }
1957                 if (dcname != NULL) {
1958                         talloc_free(domain->dcname);
1959
1960                         domain->dcname = talloc_move(domain, &dcname);
1961                         if (domain->dcname == NULL) {
1962                                 result = NT_STATUS_NO_MEMORY;
1963                                 break;
1964                         }
1965                 }
1966
1967                 new_conn->cli = NULL;
1968
1969                 result = cm_prepare_connection(domain, fd, domain->dcname,
1970                         &new_conn->cli, &retry);
1971                 if (!NT_STATUS_IS_OK(result)) {
1972                         /* Don't leak the smb connection socket */
1973                         close(fd);
1974                 }
1975
1976                 if (!retry)
1977                         break;
1978         }
1979
1980         if (NT_STATUS_IS_OK(result)) {
1981                 bool seal_pipes = true;
1982
1983                 winbindd_set_locator_kdc_envs(domain);
1984
1985                 if (domain->online == False) {
1986                         /* We're changing state from offline to online. */
1987                         set_global_winbindd_state_online();
1988                 }
1989                 set_domain_online(domain);
1990
1991                 /*
1992                  * Much as I hate global state, this seems to be the point
1993                  * where we can be certain that we have a proper connection to
1994                  * a DC. wbinfo --dc-info needs that information, store it in
1995                  * gencache with a looong timeout. This will need revisiting
1996                  * once we start to connect to multiple DCs, wbcDcInfo is
1997                  * already prepared for that.
1998                  */
1999                 store_current_dc_in_gencache(domain->name, domain->dcname,
2000                                              new_conn->cli);
2001
2002                 seal_pipes = lp_winbind_sealed_pipes();
2003                 seal_pipes = lp_parm_bool(-1, "winbind sealed pipes",
2004                                           domain->name,
2005                                           seal_pipes);
2006
2007                 if (seal_pipes) {
2008                         new_conn->auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
2009                 } else {
2010                         new_conn->auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
2011                 }
2012         } else {
2013                 /* Ensure we setup the retry handler. */
2014                 set_domain_offline(domain);
2015         }
2016
2017         talloc_destroy(mem_ctx);
2018         return result;
2019 }
2020
2021 /* Close down all open pipes on a connection. */
2022
2023 void invalidate_cm_connection(struct winbindd_domain *domain)
2024 {
2025         NTSTATUS result;
2026         struct winbindd_cm_conn *conn = &domain->conn;
2027
2028         /* We're closing down a possibly dead
2029            connection. Don't have impossibly long (10s) timeouts. */
2030
2031         if (conn->cli) {
2032                 cli_set_timeout(conn->cli, 1000); /* 1 second. */
2033         }
2034
2035         if (conn->samr_pipe != NULL) {
2036                 if (is_valid_policy_hnd(&conn->sam_connect_handle)) {
2037                         dcerpc_samr_Close(conn->samr_pipe->binding_handle,
2038                                           talloc_tos(),
2039                                           &conn->sam_connect_handle,
2040                                           &result);
2041                 }
2042                 TALLOC_FREE(conn->samr_pipe);
2043                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
2044                 if (conn->cli) {
2045                         cli_set_timeout(conn->cli, 500);
2046                 }
2047         }
2048
2049         if (conn->lsa_pipe != NULL) {
2050                 if (is_valid_policy_hnd(&conn->lsa_policy)) {
2051                         dcerpc_lsa_Close(conn->lsa_pipe->binding_handle,
2052                                          talloc_tos(),
2053                                          &conn->lsa_policy,
2054                                          &result);
2055                 }
2056                 TALLOC_FREE(conn->lsa_pipe);
2057                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
2058                 if (conn->cli) {
2059                         cli_set_timeout(conn->cli, 500);
2060                 }
2061         }
2062
2063         if (conn->lsa_pipe_tcp != NULL) {
2064                 if (is_valid_policy_hnd(&conn->lsa_policy)) {
2065                         dcerpc_lsa_Close(conn->lsa_pipe_tcp->binding_handle,
2066                                          talloc_tos(),
2067                                          &conn->lsa_policy,
2068                                          &result);
2069                 }
2070                 TALLOC_FREE(conn->lsa_pipe_tcp);
2071                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
2072                 if (conn->cli) {
2073                         cli_set_timeout(conn->cli, 500);
2074                 }
2075         }
2076
2077         if (conn->netlogon_pipe != NULL) {
2078                 TALLOC_FREE(conn->netlogon_pipe);
2079                 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
2080                 if (conn->cli) {
2081                         cli_set_timeout(conn->cli, 500);
2082                 }
2083         }
2084
2085         conn->auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
2086         conn->netlogon_force_reauth = false;
2087         conn->netlogon_flags = 0;
2088         TALLOC_FREE(conn->netlogon_creds);
2089
2090         if (conn->cli) {
2091                 cli_shutdown(conn->cli);
2092         }
2093
2094         conn->cli = NULL;
2095 }
2096
2097 void close_conns_after_fork(void)
2098 {
2099         struct winbindd_domain *domain;
2100         struct winbindd_cli_state *cli_state;
2101
2102         for (domain = domain_list(); domain; domain = domain->next) {
2103                 /*
2104                  * first close the low level SMB TCP connection
2105                  * so that we don't generate any SMBclose
2106                  * requests in invalidate_cm_connection()
2107                  */
2108                 if (cli_state_is_connected(domain->conn.cli)) {
2109                         smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
2110                 }
2111
2112                 invalidate_cm_connection(domain);
2113         }
2114
2115         for (cli_state = winbindd_client_list();
2116              cli_state != NULL;
2117              cli_state = cli_state->next) {
2118                 if (cli_state->sock >= 0) {
2119                         close(cli_state->sock);
2120                         cli_state->sock = -1;
2121                 }
2122         }
2123 }
2124
2125 static bool connection_ok(struct winbindd_domain *domain)
2126 {
2127         bool ok;
2128
2129         ok = cli_state_is_connected(domain->conn.cli);
2130         if (!ok) {
2131                 DEBUG(3, ("connection_ok: Connection to %s for domain %s is not connected\n",
2132                           domain->dcname, domain->name));
2133                 return False;
2134         }
2135
2136         if (domain->online == False) {
2137                 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
2138                 return False;
2139         }
2140
2141         return True;
2142 }
2143
2144 /* Initialize a new connection up to the RPC BIND.
2145    Bypass online status check so always does network calls. */
2146
2147 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain, bool need_rw_dc)
2148 {
2149         NTSTATUS result;
2150         bool skip_connection = domain->internal;
2151         if (need_rw_dc && domain->rodc) {
2152                 skip_connection = false;
2153         }
2154
2155         /* Internal connections never use the network. */
2156         if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
2157                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2158         }
2159
2160         /* Still ask the internal LSA and SAMR server about the local domain */
2161         if (skip_connection || connection_ok(domain)) {
2162                 if (!domain->initialized) {
2163                         set_dc_type_and_flags(domain);
2164                 }
2165                 return NT_STATUS_OK;
2166         }
2167
2168         invalidate_cm_connection(domain);
2169
2170         if (!domain->primary && !domain->initialized) {
2171                 /*
2172                  * Before we connect to a trust, work out if it is an
2173                  * AD domain by asking our own domain.
2174                  */
2175                 set_dc_type_and_flags_trustinfo(domain);
2176         }
2177
2178         result = cm_open_connection(domain, &domain->conn);
2179
2180         if (NT_STATUS_IS_OK(result) && !domain->initialized) {
2181                 set_dc_type_and_flags(domain);
2182         }
2183
2184         return result;
2185 }
2186
2187 NTSTATUS init_dc_connection(struct winbindd_domain *domain, bool need_rw_dc)
2188 {
2189         if (dom_sid_equal(&domain->sid, &global_sid_Builtin)) {
2190                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2191         }
2192
2193         if (domain->initialized && !domain->online) {
2194                 /* We check for online status elsewhere. */
2195                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
2196         }
2197
2198         return init_dc_connection_network(domain, need_rw_dc);
2199 }
2200
2201 static NTSTATUS init_dc_connection_rpc(struct winbindd_domain *domain, bool need_rw_dc)
2202 {
2203         NTSTATUS status;
2204
2205         status = init_dc_connection(domain, need_rw_dc);
2206         if (!NT_STATUS_IS_OK(status)) {
2207                 return status;
2208         }
2209
2210         if (!domain->internal && domain->conn.cli == NULL) {
2211                 /* happens for trusted domains without inbound trust */
2212                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2213         }
2214
2215         return NT_STATUS_OK;
2216 }
2217
2218 /******************************************************************************
2219  Set the trust flags (direction and forest location) for a domain
2220 ******************************************************************************/
2221
2222 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
2223 {
2224         struct winbindd_domain *our_domain;
2225         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2226         WERROR werr;
2227         struct netr_DomainTrustList trusts;
2228         int i;
2229         uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
2230                         NETR_TRUST_FLAG_OUTBOUND |
2231                         NETR_TRUST_FLAG_INBOUND);
2232         struct rpc_pipe_client *cli;
2233         TALLOC_CTX *mem_ctx = NULL;
2234         struct dcerpc_binding_handle *b;
2235
2236         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
2237
2238         /* Our primary domain doesn't need to worry about trust flags.
2239            Force it to go through the network setup */
2240         if ( domain->primary ) {
2241                 return False;
2242         }
2243
2244         mem_ctx = talloc_stackframe();
2245         our_domain = find_our_domain();
2246         if (our_domain->internal) {
2247                 result = init_dc_connection(our_domain, false);
2248                 if (!NT_STATUS_IS_OK(result)) {
2249                         DEBUG(3,("set_dc_type_and_flags_trustinfo: "
2250                                  "Not able to make a connection to our domain: %s\n",
2251                                   nt_errstr(result)));
2252                         TALLOC_FREE(mem_ctx);
2253                         return false;
2254                 }
2255         }
2256
2257         /* This won't work unless our domain is AD */
2258         if ( !our_domain->active_directory ) {
2259                 TALLOC_FREE(mem_ctx);
2260                 return False;
2261         }
2262
2263         if (our_domain->internal) {
2264                 result = wb_open_internal_pipe(mem_ctx, &ndr_table_netlogon, &cli);
2265         } else if (!connection_ok(our_domain)) {
2266                 DEBUG(3,("set_dc_type_and_flags_trustinfo: "
2267                          "No connection to our domain!\n"));
2268                 TALLOC_FREE(mem_ctx);
2269                 return False;
2270         } else {
2271                 result = cm_connect_netlogon(our_domain, &cli);
2272         }
2273
2274         if (!NT_STATUS_IS_OK(result)) {
2275                 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
2276                           "a connection to %s for PIPE_NETLOGON (%s)\n",
2277                           domain->name, nt_errstr(result)));
2278                 TALLOC_FREE(mem_ctx);
2279                 return False;
2280         }
2281         b = cli->binding_handle;
2282
2283         /* Use DsEnumerateDomainTrusts to get us the trust direction and type. */
2284         result = dcerpc_netr_DsrEnumerateDomainTrusts(b, mem_ctx,
2285                                                       cli->desthost,
2286                                                       flags,
2287                                                       &trusts,
2288                                                       &werr);
2289         if (!NT_STATUS_IS_OK(result)) {
2290                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
2291                         "failed to query trusted domain list: %s\n",
2292                         nt_errstr(result)));
2293                 TALLOC_FREE(mem_ctx);
2294                 return false;
2295         }
2296         if (!W_ERROR_IS_OK(werr)) {
2297                 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
2298                         "failed to query trusted domain list: %s\n",
2299                         win_errstr(werr)));
2300                 TALLOC_FREE(mem_ctx);
2301                 return false;
2302         }
2303
2304         /* Now find the domain name and get the flags */
2305
2306         for ( i=0; i<trusts.count; i++ ) {
2307                 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
2308                         domain->domain_flags          = trusts.array[i].trust_flags;
2309                         domain->domain_type           = trusts.array[i].trust_type;
2310                         domain->domain_trust_attribs  = trusts.array[i].trust_attributes;
2311
2312                         if ( domain->domain_type == LSA_TRUST_TYPE_UPLEVEL )
2313                                 domain->active_directory = True;
2314
2315                         /* This flag is only set if the domain is *our*
2316                            primary domain and the primary domain is in
2317                            native mode */
2318
2319                         domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
2320
2321                         DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
2322                                   "native mode.\n", domain->name,
2323                                   domain->native_mode ? "" : "NOT "));
2324
2325                         DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
2326                                  "running active directory.\n", domain->name,
2327                                  domain->active_directory ? "" : "NOT "));
2328
2329                         domain->can_do_ncacn_ip_tcp = domain->active_directory;
2330
2331                         domain->initialized = True;
2332
2333                         break;
2334                 }
2335         }
2336
2337         TALLOC_FREE(mem_ctx);
2338
2339         return domain->initialized;
2340 }
2341
2342 /******************************************************************************
2343  We can 'sense' certain things about the DC by it's replies to certain
2344  questions.
2345
2346  This tells us if this particular remote server is Active Directory, and if it
2347  is native mode.
2348 ******************************************************************************/
2349
2350 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
2351 {
2352         NTSTATUS status, result;
2353         WERROR werr;
2354         TALLOC_CTX              *mem_ctx = NULL;
2355         struct rpc_pipe_client  *cli = NULL;
2356         struct policy_handle pol;
2357         union dssetup_DsRoleInfo info;
2358         union lsa_PolicyInformation *lsa_info = NULL;
2359
2360         if (!domain->internal && !connection_ok(domain)) {
2361                 return;
2362         }
2363
2364         mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
2365                               domain->name);
2366         if (!mem_ctx) {
2367                 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
2368                 return;
2369         }
2370
2371         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
2372
2373         if (domain->internal) {
2374                 status = wb_open_internal_pipe(mem_ctx,
2375                                                &ndr_table_dssetup,
2376                                                &cli);
2377         } else {
2378                 status = cli_rpc_pipe_open_noauth(domain->conn.cli,
2379                                                   &ndr_table_dssetup,
2380                                                   &cli);
2381         }
2382
2383         if (!NT_STATUS_IS_OK(status)) {
2384                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
2385                           "PI_DSSETUP on domain %s: (%s)\n",
2386                           domain->name, nt_errstr(status)));
2387
2388                 /* if this is just a non-AD domain we need to continue
2389                  * identifying so that we can in the end return with
2390                  * domain->initialized = True - gd */
2391
2392                 goto no_dssetup;
2393         }
2394
2395         status = dcerpc_dssetup_DsRoleGetPrimaryDomainInformation(cli->binding_handle, mem_ctx,
2396                                                                   DS_ROLE_BASIC_INFORMATION,
2397                                                                   &info,
2398                                                                   &werr);
2399         TALLOC_FREE(cli);
2400
2401         if (NT_STATUS_IS_OK(status)) {
2402                 result = werror_to_ntstatus(werr);
2403         }
2404         if (!NT_STATUS_IS_OK(status)) {
2405                 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
2406                           "on domain %s failed: (%s)\n",
2407                           domain->name, nt_errstr(status)));
2408
2409                 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
2410                  * every opcode on the DSSETUP pipe, continue with
2411                  * no_dssetup mode here as well to get domain->initialized
2412                  * set - gd */
2413
2414                 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
2415                         goto no_dssetup;
2416                 }
2417
2418                 TALLOC_FREE(mem_ctx);
2419                 return;
2420         }
2421
2422         if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
2423             !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
2424                 domain->native_mode = True;
2425         } else {
2426                 domain->native_mode = False;
2427         }
2428
2429 no_dssetup:
2430         if (domain->internal) {
2431                 status = wb_open_internal_pipe(mem_ctx,
2432                                                &ndr_table_lsarpc,
2433                                                &cli);
2434         } else {
2435                 status = cli_rpc_pipe_open_noauth(domain->conn.cli,
2436                                                   &ndr_table_lsarpc, &cli);
2437         }
2438         if (!NT_STATUS_IS_OK(status)) {
2439                 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
2440                           "PI_LSARPC on domain %s: (%s)\n",
2441                           domain->name, nt_errstr(status)));
2442                 TALLOC_FREE(cli);
2443                 TALLOC_FREE(mem_ctx);
2444                 return;
2445         }
2446
2447         status = rpccli_lsa_open_policy2(cli, mem_ctx, True,
2448                                          SEC_FLAG_MAXIMUM_ALLOWED, &pol);
2449
2450         if (NT_STATUS_IS_OK(status)) {
2451                 /* This particular query is exactly what Win2k clients use
2452                    to determine that the DC is active directory */
2453                 status = dcerpc_lsa_QueryInfoPolicy2(cli->binding_handle, mem_ctx,
2454                                                      &pol,
2455                                                      LSA_POLICY_INFO_DNS,
2456                                                      &lsa_info,
2457                                                      &result);
2458         }
2459
2460         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2461                 domain->active_directory = True;
2462
2463                 if (lsa_info->dns.name.string) {
2464                         if (!strequal(domain->name, lsa_info->dns.name.string))
2465                         {
2466                                 DEBUG(1, ("set_dc_type_and_flags_connect: DC "
2467                                           "for domain %s claimed it was a DC "
2468                                           "for domain %s, refusing to "
2469                                           "initialize\n",
2470                                           domain->name,
2471                                           lsa_info->dns.name.string));
2472                                 TALLOC_FREE(cli);
2473                                 TALLOC_FREE(mem_ctx);
2474                                 return;
2475                         }
2476                         talloc_free(domain->name);
2477                         domain->name = talloc_strdup(domain,
2478                                                      lsa_info->dns.name.string);
2479                         if (domain->name == NULL) {
2480                                 goto done;
2481                         }
2482                 }
2483
2484                 if (lsa_info->dns.dns_domain.string) {
2485                         if (domain->alt_name != NULL &&
2486                             !strequal(domain->alt_name,
2487                                       lsa_info->dns.dns_domain.string))
2488                         {
2489                                 DEBUG(1, ("set_dc_type_and_flags_connect: DC "
2490                                           "for domain %s (%s) claimed it was "
2491                                           "a DC for domain %s, refusing to "
2492                                           "initialize\n",
2493                                           domain->alt_name, domain->name,
2494                                           lsa_info->dns.dns_domain.string));
2495                                 TALLOC_FREE(cli);
2496                                 TALLOC_FREE(mem_ctx);
2497                                 return;
2498                         }
2499                         talloc_free(domain->alt_name);
2500                         domain->alt_name =
2501                                 talloc_strdup(domain,
2502                                               lsa_info->dns.dns_domain.string);
2503                         if (domain->alt_name == NULL) {
2504                                 goto done;
2505                         }
2506                 }
2507
2508                 /* See if we can set some domain trust flags about
2509                    ourself */
2510
2511                 if (lsa_info->dns.dns_forest.string) {
2512                         talloc_free(domain->forest_name);
2513                         domain->forest_name =
2514                                 talloc_strdup(domain,
2515                                               lsa_info->dns.dns_forest.string);
2516                         if (domain->forest_name == NULL) {
2517                                 goto done;
2518                         }
2519
2520                         if (strequal(domain->forest_name, domain->alt_name)) {
2521                                 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
2522                         }
2523                 }
2524
2525                 if (lsa_info->dns.sid) {
2526                         if (!is_null_sid(&domain->sid) &&
2527                             !dom_sid_equal(&domain->sid,
2528                                            lsa_info->dns.sid))
2529                         {
2530                                 DEBUG(1, ("set_dc_type_and_flags_connect: DC "
2531                                           "for domain %s (%s) claimed it was "
2532                                           "a DC for domain %s, refusing to "
2533                                           "initialize\n",
2534                                           dom_sid_string(talloc_tos(),
2535                                                          &domain->sid),
2536                                           domain->name,
2537                                           dom_sid_string(talloc_tos(),
2538                                                          lsa_info->dns.sid)));
2539                                 TALLOC_FREE(cli);
2540                                 TALLOC_FREE(mem_ctx);
2541                                 return;
2542                         }
2543                         sid_copy(&domain->sid, lsa_info->dns.sid);
2544                 }
2545         } else {
2546                 domain->active_directory = False;
2547
2548                 status = rpccli_lsa_open_policy(cli, mem_ctx, True,
2549                                                 SEC_FLAG_MAXIMUM_ALLOWED,
2550                                                 &pol);
2551
2552                 if (!NT_STATUS_IS_OK(status)) {
2553                         goto done;
2554                 }
2555
2556                 status = dcerpc_lsa_QueryInfoPolicy(cli->binding_handle, mem_ctx,
2557                                                     &pol,
2558                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
2559                                                     &lsa_info,
2560                                                     &result);
2561                 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2562
2563                         if (lsa_info->account_domain.name.string) {
2564                                 if (!strequal(domain->name,
2565                                         lsa_info->account_domain.name.string))
2566                                 {
2567                                         DEBUG(1,
2568                                               ("set_dc_type_and_flags_connect: "
2569                                                "DC for domain %s claimed it was"
2570                                                " a DC for domain %s, refusing "
2571                                                "to initialize\n", domain->name,
2572                                                lsa_info->
2573                                                 account_domain.name.string));
2574                                         TALLOC_FREE(cli);
2575                                         TALLOC_FREE(mem_ctx);
2576                                         return;
2577                                 }
2578                                 talloc_free(domain->name);
2579                                 domain->name =
2580                                         talloc_strdup(domain,
2581                                                       lsa_info->account_domain.name.string);
2582                         }
2583
2584                         if (lsa_info->account_domain.sid) {
2585                                 if (!is_null_sid(&domain->sid) &&
2586                                     !dom_sid_equal(&domain->sid,
2587                                                 lsa_info->account_domain.sid))
2588                                 {
2589                                         DEBUG(1,
2590                                               ("set_dc_type_and_flags_connect: "
2591                                                "DC for domain %s (%s) claimed "
2592                                                "it was a DC for domain %s, "
2593                                                "refusing to initialize\n",
2594                                                dom_sid_string(talloc_tos(),
2595                                                               &domain->sid),
2596                                                domain->name,
2597                                                dom_sid_string(talloc_tos(),
2598                                                 lsa_info->account_domain.sid)));
2599                                         TALLOC_FREE(cli);
2600                                         TALLOC_FREE(mem_ctx);
2601                                         return;
2602                                 }
2603                                 sid_copy(&domain->sid, lsa_info->account_domain.sid);
2604                         }
2605                 }
2606         }
2607 done:
2608
2609         DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
2610                   domain->name, domain->native_mode ? "" : "NOT "));
2611
2612         DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
2613                   domain->name, domain->active_directory ? "" : "NOT "));
2614
2615         domain->can_do_ncacn_ip_tcp = domain->active_directory;
2616
2617         TALLOC_FREE(cli);
2618
2619         TALLOC_FREE(mem_ctx);
2620
2621         domain->initialized = True;
2622 }
2623
2624 /**********************************************************************
2625  Set the domain_flags (trust attributes, domain operating modes, etc...
2626 ***********************************************************************/
2627
2628 static void set_dc_type_and_flags( struct winbindd_domain *domain )
2629 {
2630         /* we always have to contact our primary domain */
2631
2632         if ( domain->primary || domain->internal) {
2633                 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
2634                           "primary or internal domain\n"));
2635                 set_dc_type_and_flags_connect( domain );
2636                 return;
2637         }
2638
2639         /* Use our DC to get the information if possible */
2640
2641         if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
2642                 /* Otherwise, fallback to contacting the
2643                    domain directly */
2644                 set_dc_type_and_flags_connect( domain );
2645         }
2646
2647         return;
2648 }
2649
2650
2651
2652 /**********************************************************************
2653 ***********************************************************************/
2654
2655 static NTSTATUS cm_get_schannel_creds(struct winbindd_domain *domain,
2656                                    struct netlogon_creds_cli_context **ppdc)
2657 {
2658         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2659         struct rpc_pipe_client *netlogon_pipe;
2660
2661         *ppdc = NULL;
2662
2663         if ((!IS_DC) && (!domain->primary)) {
2664                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2665         }
2666
2667         if (domain->conn.netlogon_creds != NULL) {
2668                 if (!(domain->conn.netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
2669                         return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2670                 }
2671                 *ppdc = domain->conn.netlogon_creds;
2672                 return NT_STATUS_OK;
2673         }
2674
2675         result = cm_connect_netlogon(domain, &netlogon_pipe);
2676         if (!NT_STATUS_IS_OK(result)) {
2677                 return result;
2678         }
2679
2680         if (domain->conn.netlogon_creds == NULL) {
2681                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2682         }
2683
2684         if (!(domain->conn.netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
2685                 return NT_STATUS_TRUSTED_DOMAIN_FAILURE;
2686         }
2687
2688         *ppdc = domain->conn.netlogon_creds;
2689         return NT_STATUS_OK;
2690 }
2691
2692 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2693                         bool need_rw_dc,
2694                         struct rpc_pipe_client **cli, struct policy_handle *sam_handle)
2695 {
2696         struct winbindd_cm_conn *conn;
2697         NTSTATUS status, result;
2698         struct netlogon_creds_cli_context *p_creds;
2699         struct cli_credentials *creds = NULL;
2700
2701         if (sid_check_is_our_sam(&domain->sid)) {
2702                 if (domain->rodc == false || need_rw_dc == false) {
2703                         return open_internal_samr_conn(mem_ctx, domain, cli, sam_handle);
2704                 }
2705         }
2706
2707         status = init_dc_connection_rpc(domain, need_rw_dc);
2708         if (!NT_STATUS_IS_OK(status)) {
2709                 return status;
2710         }
2711
2712         conn = &domain->conn;
2713
2714         if (rpccli_is_connected(conn->samr_pipe)) {
2715                 goto done;
2716         }
2717
2718         TALLOC_FREE(conn->samr_pipe);
2719
2720         /*
2721          * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2722          * sign and sealed pipe using the machine account password by
2723          * preference. If we can't - try schannel, if that fails, try
2724          * anonymous.
2725          */
2726
2727         result = get_trust_credentials(domain, talloc_tos(), false, &creds);
2728         if (!NT_STATUS_IS_OK(result)) {
2729                 DEBUG(10, ("cm_connect_sam: No no user available for "
2730                            "domain %s, trying schannel\n", conn->cli->domain));
2731                 goto schannel;
2732         }
2733
2734         if (cli_credentials_is_anonymous(creds)) {
2735                 goto anonymous;
2736         }
2737
2738         /*
2739          * We have an authenticated connection. Use a SPNEGO
2740          * authenticated SAMR pipe with sign & seal.
2741          */
2742         status = cli_rpc_pipe_open_with_creds(conn->cli,
2743                                               &ndr_table_samr,
2744                                               NCACN_NP,
2745                                               DCERPC_AUTH_TYPE_SPNEGO,
2746                                               conn->auth_level,
2747                                               smbXcli_conn_remote_name(conn->cli->conn),
2748                                               creds,
2749                                               &conn->samr_pipe);
2750         if (!NT_STATUS_IS_OK(status)) {
2751                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2752                           "pipe for domain %s using NTLMSSP "
2753                           "authenticated pipe: user %s. Error was "
2754                           "%s\n", domain->name,
2755                           cli_credentials_get_unparsed_name(creds, talloc_tos()),
2756                           nt_errstr(status)));
2757                 goto schannel;
2758         }
2759
2760         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2761                   "domain %s using NTLMSSP authenticated "
2762                   "pipe: user %s\n", domain->name,
2763                   cli_credentials_get_unparsed_name(creds, talloc_tos())));
2764
2765         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2766                                       conn->samr_pipe->desthost,
2767                                       SEC_FLAG_MAXIMUM_ALLOWED,
2768                                       &conn->sam_connect_handle,
2769                                       &result);
2770         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2771                 goto open_domain;
2772         }
2773         if (NT_STATUS_IS_OK(status)) {
2774                 status = result;
2775         }
2776
2777         DEBUG(10,("cm_connect_sam: ntlmssp-sealed dcerpc_samr_Connect2 "
2778                   "failed for domain %s, error was %s. Trying schannel\n",
2779                   domain->name, nt_errstr(status) ));
2780         TALLOC_FREE(conn->samr_pipe);
2781
2782  schannel:
2783
2784         /* Fall back to schannel if it's a W2K pre-SP1 box. */
2785
2786         status = cm_get_schannel_creds(domain, &p_creds);
2787         if (!NT_STATUS_IS_OK(status)) {
2788                 /* If this call fails - conn->cli can now be NULL ! */
2789                 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2790                            "for domain %s (error %s), trying anon\n",
2791                         domain->name,
2792                         nt_errstr(status) ));
2793                 goto anonymous;
2794         }
2795         status = cli_rpc_pipe_open_schannel_with_key
2796                 (conn->cli, &ndr_table_samr, NCACN_NP,
2797                  domain->name, p_creds, &conn->samr_pipe);
2798
2799         if (!NT_STATUS_IS_OK(status)) {
2800                 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2801                           "domain %s using schannel. Error was %s\n",
2802                           domain->name, nt_errstr(status) ));
2803                 goto anonymous;
2804         }
2805         DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2806                   "schannel.\n", domain->name ));
2807
2808         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2809                                       conn->samr_pipe->desthost,
2810                                       SEC_FLAG_MAXIMUM_ALLOWED,
2811                                       &conn->sam_connect_handle,
2812                                       &result);
2813         if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
2814                 goto open_domain;
2815         }
2816         if (NT_STATUS_IS_OK(status)) {
2817                 status = result;
2818         }
2819         DEBUG(10,("cm_connect_sam: schannel-sealed dcerpc_samr_Connect2 failed "
2820                   "for domain %s, error was %s. Trying anonymous\n",
2821                   domain->name, nt_errstr(status) ));
2822         TALLOC_FREE(conn->samr_pipe);
2823
2824  anonymous:
2825
2826         /* Finally fall back to anonymous. */
2827         if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
2828                 status = NT_STATUS_DOWNGRADE_DETECTED;
2829                 DEBUG(1, ("Unwilling to make SAMR connection to domain %s"
2830                           "without connection level security, "
2831                           "must set 'winbind sealed pipes = false' and "
2832                           "'require strong key = false' to proceed: %s\n",
2833                           domain->name, nt_errstr(status)));
2834                 goto done;
2835         }
2836         status = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr,
2837                                           &conn->samr_pipe);
2838
2839         if (!NT_STATUS_IS_OK(status)) {
2840                 goto done;
2841         }
2842
2843         status = dcerpc_samr_Connect2(conn->samr_pipe->binding_handle, mem_ctx,
2844                                       conn->samr_pipe->desthost,
2845                                       SEC_FLAG_MAXIMUM_ALLOWED,
2846                                       &conn->sam_connect_handle,
2847                                       &result);
2848         if (!NT_STATUS_IS_OK(status)) {
2849                 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2850                           "for domain %s Error was %s\n",
2851                           domain->name, nt_errstr(status) ));
2852                 goto done;
2853         }
2854         if (!NT_STATUS_IS_OK(result)) {
2855                 status = result;
2856                 DEBUG(10,("cm_connect_sam: dcerpc_samr_Connect2 failed "
2857                           "for domain %s Error was %s\n",
2858                           domain->name, nt_errstr(result)));
2859                 goto done;
2860         }
2861
2862  open_domain:
2863         status = dcerpc_samr_OpenDomain(conn->samr_pipe->binding_handle,
2864                                         mem_ctx,
2865                                         &conn->sam_connect_handle,
2866                                         SEC_FLAG_MAXIMUM_ALLOWED,
2867                                         &domain->sid,
2868                                         &conn->sam_domain_handle,
2869                                         &result);
2870         if (!NT_STATUS_IS_OK(status)) {
2871                 goto done;
2872         }
2873
2874         status = result;
2875  done:
2876
2877         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
2878                 /*
2879                  * if we got access denied, we might just have no access rights
2880                  * to talk to the remote samr server server (e.g. when we are a
2881                  * PDC and we are connecting a w2k8 pdc via an interdomain
2882                  * trust). In that case do not invalidate the whole connection
2883                  * stack
2884                  */
2885                 TALLOC_FREE(conn->samr_pipe);
2886                 ZERO_STRUCT(conn->sam_domain_handle);
2887                 return status;
2888         } else if (!NT_STATUS_IS_OK(status)) {
2889                 invalidate_cm_connection(domain);
2890                 return status;
2891         }
2892
2893         *cli = conn->samr_pipe;
2894         *sam_handle = conn->sam_domain_handle;
2895         return status;
2896 }
2897
2898 /**********************************************************************
2899  open an schanneld ncacn_ip_tcp connection to LSA
2900 ***********************************************************************/
2901
2902 static NTSTATUS cm_connect_lsa_tcp(struct winbindd_domain *domain,
2903                                    TALLOC_CTX *mem_ctx,
2904                                    struct rpc_pipe_client **cli)
2905 {
2906         struct winbindd_cm_conn *conn;
2907         struct netlogon_creds_cli_context *creds;
2908         NTSTATUS status;
2909
2910         DEBUG(10,("cm_connect_lsa_tcp\n"));
2911
2912         status = init_dc_connection_rpc(domain, false);
2913         if (!NT_STATUS_IS_OK(status)) {
2914                 return status;
2915         }
2916
2917         conn = &domain->conn;
2918
2919         if (conn->lsa_pipe_tcp &&
2920             conn->lsa_pipe_tcp->transport->transport == NCACN_IP_TCP &&
2921             conn->lsa_pipe_tcp->auth->auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY &&
2922             rpccli_is_connected(conn->lsa_pipe_tcp)) {
2923                 goto done;
2924         }
2925
2926         TALLOC_FREE(conn->lsa_pipe_tcp);
2927
2928         status = cm_get_schannel_creds(domain, &creds);
2929         if (!NT_STATUS_IS_OK(status)) {
2930                 goto done;
2931         }
2932
2933         status = cli_rpc_pipe_open_schannel_with_key(conn->cli,
2934                                                      &ndr_table_lsarpc,
2935                                                      NCACN_IP_TCP,
2936                                                      domain->name,
2937                                                      creds,
2938                                                      &conn->lsa_pipe_tcp);
2939         if (!NT_STATUS_IS_OK(status)) {
2940                 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key failed: %s\n",
2941                         nt_errstr(status)));
2942                 goto done;
2943         }
2944
2945  done:
2946         if (!NT_STATUS_IS_OK(status)) {
2947                 TALLOC_FREE(conn->lsa_pipe_tcp);
2948                 return status;
2949         }
2950
2951         *cli = conn->lsa_pipe_tcp;
2952
2953         return status;
2954 }
2955
2956 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2957                         struct rpc_pipe_client **cli, struct policy_handle *lsa_policy)
2958 {
2959         struct winbindd_cm_conn *conn;
2960         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2961         struct netlogon_creds_cli_context *p_creds;
2962         struct cli_credentials *creds = NULL;
2963
2964         result = init_dc_connection_rpc(domain, false);
2965         if (!NT_STATUS_IS_OK(result))
2966                 return result;
2967
2968         conn = &domain->conn;
2969
2970         if (rpccli_is_connected(conn->lsa_pipe)) {
2971                 goto done;
2972         }
2973
2974         TALLOC_FREE(conn->lsa_pipe);
2975
2976         result = get_trust_credentials(domain, talloc_tos(), false, &creds);
2977         if (!NT_STATUS_IS_OK(result)) {
2978                 DEBUG(10, ("cm_connect_sam: No no user available for "
2979                            "domain %s, trying schannel\n", conn->cli->domain));
2980                 goto schannel;
2981         }
2982
2983         if (cli_credentials_is_anonymous(creds)) {
2984                 goto anonymous;
2985         }
2986
2987         /*
2988          * We have an authenticated connection. Use a SPNEGO
2989          * authenticated LSA pipe with sign & seal.
2990          */
2991         result = cli_rpc_pipe_open_with_creds
2992                 (conn->cli, &ndr_table_lsarpc, NCACN_NP,
2993                  DCERPC_AUTH_TYPE_SPNEGO,
2994                  conn->auth_level,
2995                  smbXcli_conn_remote_name(conn->cli->conn),
2996                  creds,
2997                  &conn->lsa_pipe);
2998         if (!NT_STATUS_IS_OK(result)) {
2999                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
3000                           "domain %s using NTLMSSP authenticated pipe: user "
3001                           "%s. Error was %s. Trying schannel.\n",
3002                           domain->name,
3003                           cli_credentials_get_unparsed_name(creds, talloc_tos()),
3004                           nt_errstr(result)));
3005                 goto schannel;
3006         }
3007
3008         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
3009                   "NTLMSSP authenticated pipe: user %s\n",
3010                   domain->name, cli_credentials_get_unparsed_name(creds, talloc_tos())));
3011
3012         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
3013                                         SEC_FLAG_MAXIMUM_ALLOWED,
3014                                         &conn->lsa_policy);
3015         if (NT_STATUS_IS_OK(result)) {
3016                 goto done;
3017         }
3018
3019         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
3020                   "schannel\n"));
3021
3022         TALLOC_FREE(conn->lsa_pipe);
3023
3024  schannel:
3025
3026         /* Fall back to schannel if it's a W2K pre-SP1 box. */
3027
3028         result = cm_get_schannel_creds(domain, &p_creds);
3029         if (!NT_STATUS_IS_OK(result)) {
3030                 /* If this call fails - conn->cli can now be NULL ! */
3031                 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
3032                            "for domain %s (error %s), trying anon\n",
3033                         domain->name,
3034                         nt_errstr(result) ));
3035                 goto anonymous;
3036         }
3037         result = cli_rpc_pipe_open_schannel_with_key
3038                 (conn->cli, &ndr_table_lsarpc, NCACN_NP,
3039                  domain->name, p_creds, &conn->lsa_pipe);
3040
3041         if (!NT_STATUS_IS_OK(result)) {
3042                 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
3043                           "domain %s using schannel. Error was %s\n",
3044                           domain->name, nt_errstr(result) ));
3045                 goto anonymous;
3046         }
3047         DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
3048                   "schannel.\n", domain->name ));
3049
3050         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
3051                                         SEC_FLAG_MAXIMUM_ALLOWED,
3052                                         &conn->lsa_policy);
3053         if (NT_STATUS_IS_OK(result)) {
3054                 goto done;
3055         }
3056
3057         DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
3058                   "anonymous\n"));
3059
3060         TALLOC_FREE(conn->lsa_pipe);
3061
3062  anonymous:
3063
3064         if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
3065                 result = NT_STATUS_DOWNGRADE_DETECTED;
3066                 DEBUG(1, ("Unwilling to make LSA connection to domain %s"
3067                           "without connection level security, "
3068                           "must set 'winbind sealed pipes = false' and "
3069                           "'require strong key = false' to proceed: %s\n",
3070                           domain->name, nt_errstr(result)));
3071                 goto done;
3072         }
3073
3074         result = cli_rpc_pipe_open_noauth(conn->cli,
3075                                           &ndr_table_lsarpc,
3076                                           &conn->lsa_pipe);
3077         if (!NT_STATUS_IS_OK(result)) {
3078                 goto done;
3079         }
3080
3081         result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
3082                                         SEC_FLAG_MAXIMUM_ALLOWED,
3083                                         &conn->lsa_policy);
3084  done:
3085         if (!NT_STATUS_IS_OK(result)) {
3086                 invalidate_cm_connection(domain);
3087                 return result;
3088         }
3089
3090         *cli = conn->lsa_pipe;
3091         *lsa_policy = conn->lsa_policy;
3092         return result;
3093 }
3094
3095 /****************************************************************************
3096 Open a LSA connection to a DC, suiteable for LSA lookup calls.
3097 ****************************************************************************/
3098
3099 NTSTATUS cm_connect_lsat(struct winbindd_domain *domain,
3100                          TALLOC_CTX *mem_ctx,
3101                          struct rpc_pipe_client **cli,
3102                          struct policy_handle *lsa_policy)
3103 {
3104         NTSTATUS status;
3105
3106         if (domain->can_do_ncacn_ip_tcp) {
3107                 status = cm_connect_lsa_tcp(domain, mem_ctx, cli);
3108                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
3109                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
3110                     NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3111                         invalidate_cm_connection(domain);
3112                         status = cm_connect_lsa_tcp(domain, mem_ctx, cli);
3113                 }
3114                 if (NT_STATUS_IS_OK(status)) {
3115                         return status;
3116                 }
3117
3118                 /*
3119                  * we tried twice to connect via ncan_ip_tcp and schannel and
3120                  * failed - maybe it is a trusted domain we can't connect to ?
3121                  * do not try tcp next time - gd
3122                  *
3123                  * This also prevents NETLOGON over TCP
3124                  */
3125                 domain->can_do_ncacn_ip_tcp = false;
3126         }
3127
3128         status = cm_connect_lsa(domain, mem_ctx, cli, lsa_policy);
3129
3130         return status;
3131 }
3132
3133 /****************************************************************************
3134  Open the netlogon pipe to this DC. Use schannel if specified in client conf.
3135  session key stored in conn->netlogon_pipe->dc->sess_key.
3136 ****************************************************************************/
3137
3138 static NTSTATUS cm_connect_netlogon_transport(struct winbindd_domain *domain,
3139                                               enum dcerpc_transport_t transport,
3140                                               struct rpc_pipe_client **cli)
3141 {
3142         struct messaging_context *msg_ctx = winbind_messaging_context();
3143         struct winbindd_cm_conn *conn;
3144         NTSTATUS result;
3145         enum netr_SchannelType sec_chan_type;
3146         const char *account_name;
3147         const char *domain_name;
3148         const struct samr_Password *current_nt_hash = NULL;
3149         const struct samr_Password *previous_nt_hash = NULL;
3150         struct netlogon_creds_CredentialState *netlogon_creds = NULL;
3151         struct cli_credentials *creds = NULL;
3152
3153         *cli = NULL;
3154
3155         result = init_dc_connection_rpc(domain, true);
3156         if (!NT_STATUS_IS_OK(result)) {
3157                 return result;
3158         }
3159
3160         conn = &domain->conn;
3161
3162         if (rpccli_is_connected(conn->netlogon_pipe)) {
3163                 *cli = conn->netlogon_pipe;
3164                 return NT_STATUS_OK;
3165         }
3166
3167         TALLOC_FREE(conn->netlogon_pipe);
3168         conn->netlogon_flags = 0;
3169         TALLOC_FREE(conn->netlogon_creds);
3170
3171         result = get_trust_credentials(domain, talloc_tos(), true, &creds);
3172         if (!NT_STATUS_IS_OK(result)) {
3173                 DEBUG(10, ("cm_connect_sam: No no user available for "
3174                            "domain %s when trying schannel\n", conn->cli->domain));
3175                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3176         }
3177
3178         if (cli_credentials_is_anonymous(creds)) {
3179                 DEBUG(1, ("get_trust_credential only gave anonymous for %s, unable to make get NETLOGON credentials\n",
3180                           domain->name));
3181                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3182         }
3183
3184         sec_chan_type = cli_credentials_get_secure_channel_type(creds);
3185         if (sec_chan_type == SEC_CHAN_NULL) {
3186                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3187                 goto no_schannel;
3188         }
3189
3190         account_name = cli_credentials_get_username(creds);
3191         domain_name = cli_credentials_get_domain(creds);
3192         current_nt_hash = cli_credentials_get_nt_hash(creds, talloc_tos());
3193         if (current_nt_hash == NULL) {
3194                 return NT_STATUS_NO_MEMORY;
3195         }
3196
3197         result = rpccli_create_netlogon_creds(domain->dcname,
3198                                               domain_name,
3199                                               account_name,
3200                                               sec_chan_type,
3201                                               msg_ctx,
3202                                               domain,
3203                                               &conn->netlogon_creds);
3204         if (!NT_STATUS_IS_OK(result)) {
3205                 DEBUG(1, ("rpccli_create_netlogon_creds failed for %s, "
3206                           "unable to create NETLOGON credentials: %s\n",
3207                           domain->name, nt_errstr(result)));
3208                 return result;
3209         }
3210
3211         result = rpccli_setup_netlogon_creds(conn->cli, transport,
3212                                              conn->netlogon_creds,
3213                                              conn->netlogon_force_reauth,
3214                                              *current_nt_hash,
3215                                              previous_nt_hash);
3216         conn->netlogon_force_reauth = false;
3217         if (!NT_STATUS_IS_OK(result)) {
3218                 DEBUG(1, ("rpccli_setup_netlogon_creds failed for %s, "
3219                           "unable to setup NETLOGON credentials: %s\n",
3220                           domain->name, nt_errstr(result)));
3221                 return result;
3222         }
3223
3224         result = netlogon_creds_cli_get(conn->netlogon_creds,
3225                                         talloc_tos(),
3226                                         &netlogon_creds);
3227         if (!NT_STATUS_IS_OK(result)) {
3228                 DEBUG(1, ("netlogon_creds_cli_get failed for %s, "
3229                           "unable to get NETLOGON credentials: %s\n",
3230                           domain->name, nt_errstr(result)));
3231                 return result;
3232         }
3233         conn->netlogon_flags = netlogon_creds->negotiate_flags;
3234         TALLOC_FREE(netlogon_creds);
3235
3236  no_schannel:
3237         if (!(conn->netlogon_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
3238                 if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
3239                         result = NT_STATUS_DOWNGRADE_DETECTED;
3240                         DEBUG(1, ("Unwilling to make connection to domain %s"
3241                                   "without connection level security, "
3242                                   "must set 'winbind sealed pipes = false' and "
3243                                   "'require strong key = false' to proceed: %s\n",
3244                                   domain->name, nt_errstr(result)));
3245                         invalidate_cm_connection(domain);
3246                         return result;
3247                 }
3248                 result = cli_rpc_pipe_open_noauth_transport(conn->cli,
3249                                                             transport,
3250                                                             &ndr_table_netlogon,
3251                                                             &conn->netlogon_pipe);
3252                 if (!NT_STATUS_IS_OK(result)) {
3253                         invalidate_cm_connection(domain);
3254                         return result;
3255                 }
3256
3257                 *cli = conn->netlogon_pipe;
3258                 return NT_STATUS_OK;
3259         }
3260
3261         /* Using the credentials from the first pipe, open a signed and sealed
3262            second netlogon pipe. The session key is stored in the schannel
3263            part of the new pipe auth struct.
3264         */
3265
3266         result = cli_rpc_pipe_open_schannel_with_key(
3267                 conn->cli, &ndr_table_netlogon, transport,
3268                 domain->name,
3269                 conn->netlogon_creds,
3270                 &conn->netlogon_pipe);
3271         if (!NT_STATUS_IS_OK(result)) {
3272                 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
3273                           "was %s\n", nt_errstr(result)));
3274
3275                 invalidate_cm_connection(domain);
3276                 return result;
3277         }
3278
3279         *cli = conn->netlogon_pipe;
3280         return NT_STATUS_OK;
3281 }
3282
3283 /****************************************************************************
3284 Open a LSA connection to a DC, suiteable for LSA lookup calls.
3285 ****************************************************************************/
3286
3287 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
3288                              struct rpc_pipe_client **cli)
3289 {
3290         NTSTATUS status;
3291
3292         if (domain->active_directory && domain->can_do_ncacn_ip_tcp) {
3293                 status = cm_connect_netlogon_transport(domain, NCACN_IP_TCP, cli);
3294                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
3295                     NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
3296                     NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3297                         invalidate_cm_connection(domain);
3298                         status = cm_connect_netlogon_transport(domain, NCACN_IP_TCP, cli);
3299                 }
3300                 if (NT_STATUS_IS_OK(status)) {
3301                         return status;
3302                 }
3303
3304                 /*
3305                  * we tried twice to connect via ncan_ip_tcp and schannel and
3306                  * failed - maybe it is a trusted domain we can't connect to ?
3307                  * do not try tcp next time - gd
3308                  *
3309                  * This also prevents LSA over TCP
3310                  */
3311                 domain->can_do_ncacn_ip_tcp = false;
3312         }
3313
3314         status = cm_connect_netlogon_transport(domain, NCACN_NP, cli);
3315
3316         return status;
3317 }
3318
3319 void winbind_msg_ip_dropped(struct messaging_context *msg_ctx,
3320                             void *private_data,
3321                             uint32_t msg_type,
3322                             struct server_id server_id,
3323                             DATA_BLOB *data)
3324 {
3325         struct winbindd_domain *domain;
3326         char *freeit = NULL;
3327         char *addr;
3328
3329         if ((data == NULL)
3330             || (data->data == NULL)
3331             || (data->length == 0)
3332             || (data->data[data->length-1] != '\0')) {
3333                 DEBUG(1, ("invalid msg_ip_dropped message: not a valid "
3334                           "string\n"));
3335                 return;
3336         }
3337
3338         addr = (char *)data->data;
3339         DEBUG(10, ("IP %s dropped\n", addr));
3340
3341         if (!is_ipaddress(addr)) {
3342                 char *slash;
3343                 /*
3344                  * Some code sends us ip addresses with the /netmask
3345                  * suffix
3346                  */
3347                 slash = strchr(addr, '/');
3348                 if (slash == NULL) {
3349                         DEBUG(1, ("invalid msg_ip_dropped message: %s",
3350                                   addr));
3351                         return;
3352                 }
3353                 freeit = talloc_strndup(talloc_tos(), addr, slash-addr);
3354                 if (freeit == NULL) {
3355                         DEBUG(1, ("talloc failed\n"));
3356                         return;
3357                 }
3358                 addr = freeit;
3359                 DEBUG(10, ("Stripped /netmask to IP %s\n", addr));
3360         }
3361
3362         for (domain = domain_list(); domain != NULL; domain = domain->next) {
3363                 char sockaddr[INET6_ADDRSTRLEN];
3364
3365                 if (!cli_state_is_connected(domain->conn.cli)) {
3366                         continue;
3367                 }
3368
3369                 print_sockaddr(sockaddr, sizeof(sockaddr),
3370                                smbXcli_conn_local_sockaddr(domain->conn.cli->conn));
3371
3372                 if (strequal(sockaddr, addr)) {
3373                         smbXcli_conn_disconnect(domain->conn.cli->conn, NT_STATUS_OK);
3374                 }
3375         }
3376         TALLOC_FREE(freeit);
3377 }