source3/winbindd/winbindd_msrpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind rpc backend functions
   5
   6    Copyright (C) Tim Potter 2000-2001,2003
   7    Copyright (C) Andrew Tridgell 2001
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2008 (pidl conversion)
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #include "winbindd_rpc.h"
  28
  29 #include "../librpc/gen_ndr/ndr_samr_c.h"
  30 #include "rpc_client/cli_pipe.h"
  31 #include "rpc_client/cli_samr.h"
  32 #include "rpc_client/cli_lsarpc.h"
  33 #include "../libcli/security/security.h"
  34 #include "libsmb/samlogon_cache.h"
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_WINBIND
  38
  39 static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
  40                                       struct winbindd_domain *domain,
  41                                       uint32_t num_names,
  42                                       const char **names,
  43                                       const char ***domains,
  44                                       struct dom_sid **sids,
  45                                       enum lsa_SidType **types);
  46
  47 /* Query display info for a domain.  This returns enough information plus a
  48    bit extra to give an overview of domain users for the User Manager
  49    application. */
  50 static NTSTATUS msrpc_query_user_list(struct winbindd_domain *domain,
  51                                       TALLOC_CTX *mem_ctx,
  52                                       uint32_t **prids)
  53 {
  54         struct rpc_pipe_client *samr_pipe = NULL;
  55         struct policy_handle dom_pol;
  56         uint32_t *rids = NULL;
  57         TALLOC_CTX *tmp_ctx;
  58         NTSTATUS status;
  59
  60         DEBUG(3, ("msrpc_query_user_list\n"));
  61
  62         tmp_ctx = talloc_stackframe();
  63         if (tmp_ctx == NULL) {
  64                 return NT_STATUS_NO_MEMORY;
  65         }
  66
  67         if ( !winbindd_can_contact_domain( domain ) ) {
  68                 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
  69                           domain->name));
  70                 status = NT_STATUS_OK;
  71                 goto done;
  72         }
  73
  74         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
  75         if (!NT_STATUS_IS_OK(status)) {
  76                 goto done;
  77         }
  78
  79         status = rpc_query_user_list(tmp_ctx,
  80                                      samr_pipe,
  81                                      &dom_pol,
  82                                      &domain->sid,
  83                                      &rids);
  84         if (!NT_STATUS_IS_OK(status)) {
  85                 goto done;
  86         }
  87
  88         if (prids) {
  89                 *prids = talloc_move(mem_ctx, &rids);
  90         }
  91
  92 done:
  93         TALLOC_FREE(rids);
  94         TALLOC_FREE(tmp_ctx);
  95         return status;
  96 }
  97
  98 /* list all domain groups */
  99 static NTSTATUS msrpc_enum_dom_groups(struct winbindd_domain *domain,
 100                                       TALLOC_CTX *mem_ctx,
 101                                       uint32_t *pnum_info,
 102                                       struct wb_acct_info **pinfo)
 103 {
 104         struct rpc_pipe_client *samr_pipe;
 105         struct policy_handle dom_pol;
 106         struct wb_acct_info *info = NULL;
 107         uint32_t num_info = 0;
 108         TALLOC_CTX *tmp_ctx;
 109         NTSTATUS status;
 110
 111         DEBUG(3,("msrpc_enum_dom_groups\n"));
 112
 113         if (pnum_info) {
 114                 *pnum_info = 0;
 115         }
 116
 117         tmp_ctx = talloc_stackframe();
 118         if (tmp_ctx == NULL) {
 119                 return NT_STATUS_NO_MEMORY;
 120         }
 121
 122         if ( !winbindd_can_contact_domain( domain ) ) {
 123                 DEBUG(10,("enum_domain_groups: No incoming trust for domain %s\n",
 124                           domain->name));
 125                 status = NT_STATUS_OK;
 126                 goto done;
 127         }
 128
 129         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
 130         if (!NT_STATUS_IS_OK(status)) {
 131                 goto done;
 132         }
 133
 134         status = rpc_enum_dom_groups(tmp_ctx,
 135                                      samr_pipe,
 136                                      &dom_pol,
 137                                      &num_info,
 138                                      &info);
 139         if (!NT_STATUS_IS_OK(status)) {
 140                 goto done;
 141         }
 142
 143         if (pnum_info) {
 144                 *pnum_info = num_info;
 145         }
 146
 147         if (pinfo) {
 148                 *pinfo = talloc_move(mem_ctx, &info);
 149         }
 150
 151 done:
 152         TALLOC_FREE(tmp_ctx);
 153         return status;
 154 }
 155
 156 /* List all domain groups */
 157
 158 static NTSTATUS msrpc_enum_local_groups(struct winbindd_domain *domain,
 159                                         TALLOC_CTX *mem_ctx,
 160                                         uint32_t *pnum_info,
 161                                         struct wb_acct_info **pinfo)
 162 {
 163         struct rpc_pipe_client *samr_pipe;
 164         struct policy_handle dom_pol;
 165         struct wb_acct_info *info = NULL;
 166         uint32_t num_info = 0;
 167         TALLOC_CTX *tmp_ctx;
 168         NTSTATUS status;
 169
 170         DEBUG(3,("msrpc_enum_local_groups\n"));
 171
 172         if (pnum_info) {
 173                 *pnum_info = 0;
 174         }
 175
 176         tmp_ctx = talloc_stackframe();
 177         if (tmp_ctx == NULL) {
 178                 return NT_STATUS_NO_MEMORY;
 179         }
 180
 181         if ( !winbindd_can_contact_domain( domain ) ) {
 182                 DEBUG(10,("enum_local_groups: No incoming trust for domain %s\n",
 183                           domain->name));
 184                 status = NT_STATUS_OK;
 185                 goto done;
 186         }
 187
 188         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
 189         if (!NT_STATUS_IS_OK(status)) {
 190                 goto done;
 191         }
 192
 193         status = rpc_enum_local_groups(mem_ctx,
 194                                        samr_pipe,
 195                                        &dom_pol,
 196                                        &num_info,
 197                                        &info);
 198         if (!NT_STATUS_IS_OK(status)) {
 199                 goto done;
 200         }
 201
 202         if (pnum_info) {
 203                 *pnum_info = num_info;
 204         }
 205
 206         if (pinfo) {
 207                 *pinfo = talloc_move(mem_ctx, &info);
 208         }
 209
 210 done:
 211         TALLOC_FREE(tmp_ctx);
 212         return status;
 213 }
 214
 215 /* convert a single name to a sid in a domain */
 216 static NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
 217                                   TALLOC_CTX *mem_ctx,
 218                                   const char *domain_name,
 219                                   const char *name,
 220                                   uint32_t flags,
 221                                   struct dom_sid *sid,
 222                                   enum lsa_SidType *type)
 223 {
 224         NTSTATUS result;
 225         struct dom_sid *sids = NULL;
 226         enum lsa_SidType *types = NULL;
 227         char *full_name = NULL;
 228         const char *names[1];
 229         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 230         char *mapped_name = NULL;
 231
 232         if (name == NULL || *name=='\0') {
 233                 full_name = talloc_asprintf(mem_ctx, "%s", domain_name);
 234         } else if (domain_name == NULL || *domain_name == '\0') {
 235                 full_name = talloc_asprintf(mem_ctx, "%s", name);
 236         } else {
 237                 full_name = talloc_asprintf(mem_ctx, "%s\\%s", domain_name, name);
 238         }
 239         if (!full_name) {
 240                 DEBUG(0, ("talloc_asprintf failed!\n"));
 241                 return NT_STATUS_NO_MEMORY;
 242         }
 243
 244         DEBUG(3, ("msrpc_name_to_sid: name=%s\n", full_name));
 245
 246         name_map_status = normalize_name_unmap(mem_ctx, full_name,
 247                                                &mapped_name);
 248
 249         /* Reset the full_name pointer if we mapped anything */
 250
 251         if (NT_STATUS_IS_OK(name_map_status) ||
 252             NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 253         {
 254                 full_name = mapped_name;
 255         }
 256
 257         DEBUG(3,("name_to_sid [rpc] %s for domain %s\n",
 258                  full_name?full_name:"", domain_name ));
 259
 260         names[0] = full_name;
 261
 262         result = winbindd_lookup_names(mem_ctx, domain, 1,
 263                                        names, NULL,
 264                                        &sids, &types);
 265         if (!NT_STATUS_IS_OK(result))
 266                 return result;
 267
 268         /* Return rid and type if lookup successful */
 269
 270         sid_copy(sid, &sids[0]);
 271         *type = types[0];
 272
 273         return NT_STATUS_OK;
 274 }
 275
 276 /*
 277   convert a domain SID to a user or group name
 278 */
 279 static NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
 280                                   TALLOC_CTX *mem_ctx,
 281                                   const struct dom_sid *sid,
 282                                   char **domain_name,
 283                                   char **name,
 284                                   enum lsa_SidType *type)
 285 {
 286         char **domains;
 287         char **names;
 288         enum lsa_SidType *types = NULL;
 289         NTSTATUS result;
 290         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 291         char *mapped_name = NULL;
 292
 293         DEBUG(3, ("msrpc_sid_to_name: %s for domain %s\n", sid_string_dbg(sid),
 294                  domain->name ));
 295
 296         result = winbindd_lookup_sids(mem_ctx,
 297                                       domain,
 298                                       1,
 299                                       sid,
 300                                       &domains,
 301                                       &names,
 302                                       &types);
 303         if (!NT_STATUS_IS_OK(result)) {
 304                 DEBUG(2,("msrpc_sid_to_name: failed to lookup sids: %s\n",
 305                         nt_errstr(result)));
 306                 return result;
 307         }
 308
 309
 310         *type = (enum lsa_SidType)types[0];
 311         *domain_name = domains[0];
 312         *name = names[0];
 313
 314         DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name));
 315
 316         name_map_status = normalize_name_map(mem_ctx, domain, *name,
 317                                              &mapped_name);
 318         if (NT_STATUS_IS_OK(name_map_status) ||
 319             NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 320         {
 321                 *name = mapped_name;
 322                 DEBUG(5,("returning mapped name -- %s\n", *name));
 323         }
 324
 325         return NT_STATUS_OK;
 326 }
 327
 328 static NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
 329                                     TALLOC_CTX *mem_ctx,
 330                                     const struct dom_sid *sid,
 331                                     uint32_t *rids,
 332                                     size_t num_rids,
 333                                     char **domain_name,
 334                                     char ***names,
 335                                     enum lsa_SidType **types)
 336 {
 337         char **domains;
 338         NTSTATUS result;
 339         struct dom_sid *sids;
 340         size_t i;
 341         char **ret_names;
 342
 343         DEBUG(3, ("msrpc_rids_to_names: domain %s\n", domain->name ));
 344
 345         if (num_rids) {
 346                 sids = talloc_array(mem_ctx, struct dom_sid, num_rids);
 347                 if (sids == NULL) {
 348                         return NT_STATUS_NO_MEMORY;
 349                 }
 350         } else {
 351                 sids = NULL;
 352         }
 353
 354         for (i=0; i<num_rids; i++) {
 355                 if (!sid_compose(&sids[i], sid, rids[i])) {
 356                         return NT_STATUS_INTERNAL_ERROR;
 357                 }
 358         }
 359
 360         result = winbindd_lookup_sids(mem_ctx,
 361                                       domain,
 362                                       num_rids,
 363                                       sids,
 364                                       &domains,
 365                                       names,
 366                                       types);
 367
 368         if (!NT_STATUS_IS_OK(result) &&
 369             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
 370                 return result;
 371         }
 372
 373         ret_names = *names;
 374         for (i=0; i<num_rids; i++) {
 375                 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 376                 char *mapped_name = NULL;
 377
 378                 if ((*types)[i] != SID_NAME_UNKNOWN) {
 379                         name_map_status = normalize_name_map(mem_ctx,
 380                                                              domain,
 381                                                              ret_names[i],
 382                                                              &mapped_name);
 383                         if (NT_STATUS_IS_OK(name_map_status) ||
 384                             NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 385                         {
 386                                 ret_names[i] = mapped_name;
 387                         }
 388
 389                         *domain_name = domains[i];
 390                 }
 391         }
 392
 393         return result;
 394 }
 395
 396 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
 397
 398 static NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
 399                                          TALLOC_CTX *mem_ctx,
 400                                          uint32_t num_sids, const struct dom_sid *sids,
 401                                          uint32_t *pnum_aliases,
 402                                          uint32_t **palias_rids)
 403 {
 404         struct rpc_pipe_client *samr_pipe;
 405         struct policy_handle dom_pol;
 406         uint32_t num_aliases = 0;
 407         uint32_t *alias_rids = NULL;
 408         TALLOC_CTX *tmp_ctx;
 409         NTSTATUS status;
 410
 411         DEBUG(3,("msrpc_lookup_useraliases\n"));
 412
 413         if (pnum_aliases) {
 414                 *pnum_aliases = 0;
 415         }
 416
 417         tmp_ctx = talloc_stackframe();
 418         if (tmp_ctx == NULL) {
 419                 return NT_STATUS_NO_MEMORY;
 420         }
 421
 422         if (!winbindd_can_contact_domain(domain)) {
 423                 DEBUG(10,("msrpc_lookup_useraliases: No incoming trust for domain %s\n",
 424                           domain->name));
 425                 /* Tell the cache manager not to remember this one */
 426                 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 427                 goto done;
 428         }
 429
 430         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
 431         if (!NT_STATUS_IS_OK(status)) {
 432                 goto done;
 433         }
 434
 435         status = rpc_lookup_useraliases(tmp_ctx,
 436                                         samr_pipe,
 437                                         &dom_pol,
 438                                         num_sids,
 439                                         sids,
 440                                         &num_aliases,
 441                                         &alias_rids);
 442         if (!NT_STATUS_IS_OK(status)) {
 443                 goto done;
 444         }
 445
 446         if (pnum_aliases) {
 447                 *pnum_aliases = num_aliases;
 448         }
 449
 450         if (palias_rids) {
 451                 *palias_rids = talloc_move(mem_ctx, &alias_rids);
 452         }
 453
 454 done:
 455         TALLOC_FREE(tmp_ctx);
 456         return status;
 457 }
 458
 459
 460 /* Lookup group membership given a rid.   */
 461 static NTSTATUS msrpc_lookup_groupmem(struct winbindd_domain *domain,
 462                                       TALLOC_CTX *mem_ctx,
 463                                       const struct dom_sid *group_sid,
 464                                       enum lsa_SidType type,
 465                                       uint32_t *num_names,
 466                                       struct dom_sid **sid_mem,
 467                                       char ***names,
 468                                       uint32_t **name_types)
 469 {
 470         NTSTATUS status, result;
 471         uint32_t i, total_names = 0;
 472         struct policy_handle dom_pol, group_pol;
 473         uint32_t des_access = SEC_FLAG_MAXIMUM_ALLOWED;
 474         uint32_t *rid_mem = NULL;
 475         uint32_t group_rid;
 476         unsigned int j, r;
 477         struct rpc_pipe_client *cli;
 478         unsigned int orig_timeout;
 479         struct samr_RidAttrArray *rids = NULL;
 480         struct dcerpc_binding_handle *b;
 481
 482         DEBUG(3,("msrpc_lookup_groupmem: %s sid=%s\n", domain->name,
 483                   sid_string_dbg(group_sid)));
 484
 485         if ( !winbindd_can_contact_domain( domain ) ) {
 486                 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
 487                           domain->name));
 488                 return NT_STATUS_OK;
 489         }
 490
 491         if (!sid_peek_check_rid(&domain->sid, group_sid, &group_rid))
 492                 return NT_STATUS_UNSUCCESSFUL;
 493
 494         *num_names = 0;
 495
 496         result = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
 497         if (!NT_STATUS_IS_OK(result))
 498                 return result;
 499
 500         b = cli->binding_handle;
 501
 502         status = dcerpc_samr_OpenGroup(b, mem_ctx,
 503                                        &dom_pol,
 504                                        des_access,
 505                                        group_rid,
 506                                        &group_pol,
 507                                        &result);
 508         if (!NT_STATUS_IS_OK(status)) {
 509                 return status;
 510         }
 511         if (!NT_STATUS_IS_OK(result)) {
 512                 return result;
 513         }
 514
 515         /* Step #1: Get a list of user rids that are the members of the
 516            group. */
 517
 518         /* This call can take a long time - allow the server to time out.
 519            35 seconds should do it. */
 520
 521         orig_timeout = rpccli_set_timeout(cli, 35000);
 522
 523         status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
 524                                               &group_pol,
 525                                               &rids,
 526                                               &result);
 527
 528         /* And restore our original timeout. */
 529         rpccli_set_timeout(cli, orig_timeout);
 530
 531         {
 532                 NTSTATUS _result;
 533                 dcerpc_samr_Close(b, mem_ctx, &group_pol, &_result);
 534         }
 535
 536         if (!NT_STATUS_IS_OK(status)) {
 537                 return status;
 538         }
 539
 540         if (!NT_STATUS_IS_OK(result)) {
 541                 return result;
 542         }
 543
 544         if (!rids || !rids->count) {
 545                 names = NULL;
 546                 name_types = NULL;
 547                 sid_mem = NULL;
 548                 return NT_STATUS_OK;
 549         }
 550
 551         *num_names = rids->count;
 552         rid_mem = rids->rids;
 553
 554         /* Step #2: Convert list of rids into list of usernames.  Do this
 555            in bunches of ~1000 to avoid crashing NT4.  It looks like there
 556            is a buffer overflow or something like that lurking around
 557            somewhere. */
 558
 559 #define MAX_LOOKUP_RIDS 900
 560
 561         *names = talloc_zero_array(mem_ctx, char *, *num_names);
 562         *name_types = talloc_zero_array(mem_ctx, uint32_t, *num_names);
 563         *sid_mem = talloc_zero_array(mem_ctx, struct dom_sid, *num_names);
 564
 565         for (j=0;j<(*num_names);j++)
 566                 sid_compose(&(*sid_mem)[j], &domain->sid, rid_mem[j]);
 567
 568         if (*num_names>0 && (!*names || !*name_types))
 569                 return NT_STATUS_NO_MEMORY;
 570
 571         for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
 572                 int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
 573                 struct lsa_Strings tmp_names;
 574                 struct samr_Ids tmp_types;
 575
 576                 /* Lookup a chunk of rids */
 577
 578                 status = dcerpc_samr_LookupRids(b, mem_ctx,
 579                                                 &dom_pol,
 580                                                 num_lookup_rids,
 581                                                 &rid_mem[i],
 582                                                 &tmp_names,
 583                                                 &tmp_types,
 584                                                 &result);
 585                 if (!NT_STATUS_IS_OK(status)) {
 586                         return status;
 587                 }
 588
 589                 /* see if we have a real error (and yes the
 590                    STATUS_SOME_UNMAPPED is the one returned from 2k) */
 591
 592                 if (!NT_STATUS_IS_OK(result) &&
 593                     !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
 594                         return result;
 595
 596                 /* Copy result into array.  The talloc system will take
 597                    care of freeing the temporary arrays later on. */
 598
 599                 if (tmp_names.count != num_lookup_rids) {
 600                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
 601                 }
 602                 if (tmp_types.count != num_lookup_rids) {
 603                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
 604                 }
 605
 606                 for (r=0; r<tmp_names.count; r++) {
 607                         if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
 608                                 continue;
 609                         }
 610                         if (total_names >= *num_names) {
 611                                 break;
 612                         }
 613                         (*names)[total_names] = fill_domain_username_talloc(
 614                                 mem_ctx, domain->name,
 615                                 tmp_names.names[r].string, true);
 616                         (*name_types)[total_names] = tmp_types.ids[r];
 617                         total_names += 1;
 618                 }
 619         }
 620
 621         *num_names = total_names;
 622
 623         return NT_STATUS_OK;
 624 }
 625
 626 #ifdef HAVE_LDAP
 627
 628 #include "ads.h"
 629
 630 static int get_ldap_seq(const char *server, struct sockaddr_storage *ss, int port, uint32_t *seq)
 631 {
 632         int ret = -1;
 633         struct timeval to;
 634         const char *attrs[] = {"highestCommittedUSN", NULL};
 635         LDAPMessage *res = NULL;
 636         char **values = NULL;
 637         LDAP *ldp = NULL;
 638
 639         *seq = DOM_SEQUENCE_NONE;
 640
 641         /*
 642          * Parameterised (5) second timeout on open. This is needed as the
 643          * search timeout doesn't seem to apply to doing an open as well. JRA.
 644          */
 645
 646         ldp = ldap_open_with_timeout(server, ss, port, lp_ldap_timeout());
 647         if (ldp == NULL)
 648                 return -1;
 649
 650         /* Timeout if no response within 20 seconds. */
 651         to.tv_sec = 10;
 652         to.tv_usec = 0;
 653
 654         if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)",
 655                            discard_const_p(char *, attrs), 0, &to, &res))
 656                 goto done;
 657
 658         if (ldap_count_entries(ldp, res) != 1)
 659                 goto done;
 660
 661         values = ldap_get_values(ldp, res, "highestCommittedUSN");
 662         if (!values || !values[0])
 663                 goto done;
 664
 665         *seq = atoi(values[0]);
 666         ret = 0;
 667
 668   done:
 669
 670         if (values)
 671                 ldap_value_free(values);
 672         if (res)
 673                 ldap_msgfree(res);
 674         if (ldp)
 675                 ldap_unbind(ldp);
 676         return ret;
 677 }
 678
 679 /**********************************************************************
 680  Get the sequence number for a Windows AD native mode domain using
 681  LDAP queries.
 682 **********************************************************************/
 683
 684 static int get_ldap_sequence_number(struct winbindd_domain *domain, uint32_t *seq)
 685 {
 686         int ret = -1;
 687         char addr[INET6_ADDRSTRLEN];
 688
 689         print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
 690         if ((ret = get_ldap_seq(addr, &domain->dcaddr, LDAP_PORT, seq)) == 0) {
 691                 DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence "
 692                           "number for Domain (%s) from DC (%s)\n",
 693                         domain->name, addr));
 694         }
 695         return ret;
 696 }
 697
 698 #endif /* HAVE_LDAP */
 699
 700 /* find the sequence number for a domain */
 701 static NTSTATUS msrpc_sequence_number(struct winbindd_domain *domain,
 702                                       uint32_t *pseq)
 703 {
 704         struct rpc_pipe_client *samr_pipe;
 705         struct policy_handle dom_pol;
 706         uint32_t seq = DOM_SEQUENCE_NONE;
 707         TALLOC_CTX *tmp_ctx;
 708         NTSTATUS status;
 709
 710         DEBUG(3, ("msrpc_sequence_number: fetch sequence_number for %s\n", domain->name));
 711
 712         if (pseq) {
 713                 *pseq = DOM_SEQUENCE_NONE;
 714         }
 715
 716         tmp_ctx = talloc_stackframe();
 717         if (tmp_ctx == NULL) {
 718                 return NT_STATUS_NO_MEMORY;
 719         }
 720
 721         if ( !winbindd_can_contact_domain( domain ) ) {
 722                 DEBUG(10,("sequence_number: No incoming trust for domain %s\n",
 723                           domain->name));
 724                 if (pseq) {
 725                         *pseq = time(NULL);
 726                 }
 727                 status = NT_STATUS_OK;
 728                 goto done;
 729         }
 730
 731 #ifdef HAVE_LDAP
 732         if (domain->active_directory) {
 733                 int rc;
 734
 735                 DEBUG(8,("using get_ldap_seq() to retrieve the "
 736                          "sequence number\n"));
 737
 738                 rc =  get_ldap_sequence_number(domain, &seq);
 739                 if (rc == 0) {
 740                         DEBUG(10,("domain_sequence_number: LDAP for "
 741                                   "domain %s is %u\n",
 742                                   domain->name, seq));
 743
 744                         if (pseq) {
 745                                 *pseq = seq;
 746                         }
 747
 748                         status = NT_STATUS_OK;
 749                         goto done;
 750                 }
 751
 752                 DEBUG(10,("domain_sequence_number: failed to get LDAP "
 753                           "sequence number for domain %s\n",
 754                           domain->name ));
 755         }
 756 #endif /* HAVE_LDAP */
 757
 758         status = cm_connect_sam(domain, tmp_ctx, false, &samr_pipe, &dom_pol);
 759         if (!NT_STATUS_IS_OK(status)) {
 760                 goto done;
 761         }
 762
 763         status = rpc_sequence_number(tmp_ctx,
 764                                      samr_pipe,
 765                                      &dom_pol,
 766                                      domain->name,
 767                                      &seq);
 768         if (!NT_STATUS_IS_OK(status)) {
 769                 goto done;
 770         }
 771
 772         if (pseq) {
 773                 *pseq = seq;
 774         }
 775
 776 done:
 777         TALLOC_FREE(tmp_ctx);
 778         return status;
 779 }
 780
 781 /* get a list of trusted domains */
 782 static NTSTATUS msrpc_trusted_domains(struct winbindd_domain *domain,
 783                                       TALLOC_CTX *mem_ctx,
 784                                       struct netr_DomainTrustList *ptrust_list)
 785 {
 786         struct rpc_pipe_client *lsa_pipe;
 787         struct policy_handle lsa_policy;
 788         struct netr_DomainTrust *trusts = NULL;
 789         uint32_t num_trusts = 0;
 790         TALLOC_CTX *tmp_ctx;
 791         NTSTATUS status;
 792
 793         DEBUG(3,("msrpc_trusted_domains\n"));
 794
 795         if (ptrust_list) {
 796                 ZERO_STRUCTP(ptrust_list);
 797         }
 798
 799         tmp_ctx = talloc_stackframe();
 800         if (tmp_ctx == NULL) {
 801                 return NT_STATUS_NO_MEMORY;
 802         }
 803
 804         status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
 805         if (!NT_STATUS_IS_OK(status)) {
 806                 goto done;
 807         }
 808
 809         status = rpc_trusted_domains(tmp_ctx,
 810                                      lsa_pipe,
 811                                      &lsa_policy,
 812                                      &num_trusts,
 813                                      &trusts);
 814         if (!NT_STATUS_IS_OK(status)) {
 815                 goto done;
 816         }
 817
 818         if (ptrust_list) {
 819                 ptrust_list->count = num_trusts;
 820                 ptrust_list->array = talloc_move(mem_ctx, &trusts);
 821         }
 822
 823 done:
 824         TALLOC_FREE(tmp_ctx);
 825         return status;
 826 }
 827
 828 /* find the lockout policy for a domain */
 829 static NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
 830                                      TALLOC_CTX *mem_ctx,
 831                                      struct samr_DomInfo12 *lockout_policy)
 832 {
 833         NTSTATUS status, result;
 834         struct rpc_pipe_client *cli;
 835         struct policy_handle dom_pol;
 836         union samr_DomainInfo *info = NULL;
 837         struct dcerpc_binding_handle *b;
 838
 839         DEBUG(3, ("msrpc_lockout_policy: fetch lockout policy for %s\n", domain->name));
 840
 841         if ( !winbindd_can_contact_domain( domain ) ) {
 842                 DEBUG(10,("msrpc_lockout_policy: No incoming trust for domain %s\n",
 843                           domain->name));
 844                 return NT_STATUS_NOT_SUPPORTED;
 845         }
 846
 847         status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
 848         if (!NT_STATUS_IS_OK(status)) {
 849                 goto done;
 850         }
 851
 852         b = cli->binding_handle;
 853
 854         status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
 855                                              &dom_pol,
 856                                              DomainLockoutInformation,
 857                                              &info,
 858                                              &result);
 859         if (!NT_STATUS_IS_OK(status)) {
 860                 goto done;
 861         }
 862         if (!NT_STATUS_IS_OK(result)) {
 863                 status = result;
 864                 goto done;
 865         }
 866
 867         *lockout_policy = info->info12;
 868
 869         DEBUG(10,("msrpc_lockout_policy: lockout_threshold %d\n",
 870                 info->info12.lockout_threshold));
 871
 872   done:
 873
 874         return status;
 875 }
 876
 877 /* find the password policy for a domain */
 878 static NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
 879                                       TALLOC_CTX *mem_ctx,
 880                                       struct samr_DomInfo1 *password_policy)
 881 {
 882         NTSTATUS status, result;
 883         struct rpc_pipe_client *cli;
 884         struct policy_handle dom_pol;
 885         union samr_DomainInfo *info = NULL;
 886         struct dcerpc_binding_handle *b;
 887
 888         DEBUG(3, ("msrpc_password_policy: fetch password policy for %s\n",
 889                   domain->name));
 890
 891         if ( !winbindd_can_contact_domain( domain ) ) {
 892                 DEBUG(10,("msrpc_password_policy: No incoming trust for domain %s\n",
 893                           domain->name));
 894                 return NT_STATUS_NOT_SUPPORTED;
 895         }
 896
 897         status = cm_connect_sam(domain, mem_ctx, false, &cli, &dom_pol);
 898         if (!NT_STATUS_IS_OK(status)) {
 899                 goto done;
 900         }
 901
 902         b = cli->binding_handle;
 903
 904         status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
 905                                              &dom_pol,
 906                                              DomainPasswordInformation,
 907                                              &info,
 908                                              &result);
 909         if (!NT_STATUS_IS_OK(status)) {
 910                 goto done;
 911         }
 912         if (!NT_STATUS_IS_OK(result)) {
 913                 goto done;
 914         }
 915
 916         *password_policy = info->info1;
 917
 918         DEBUG(10,("msrpc_password_policy: min_length_password %d\n",
 919                 info->info1.min_password_length));
 920
 921   done:
 922
 923         return status;
 924 }
 925
 926 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
 927                               struct winbindd_domain *domain,
 928                               uint32_t num_sids,
 929                               const struct dom_sid *sids,
 930                               char ***domains,
 931                               char ***names,
 932                               enum lsa_SidType **types)
 933 {
 934         NTSTATUS status;
 935         NTSTATUS result;
 936         struct rpc_pipe_client *cli = NULL;
 937         struct dcerpc_binding_handle *b = NULL;
 938         struct policy_handle lsa_policy;
 939         unsigned int orig_timeout;
 940         bool use_lookupsids3 = false;
 941         bool retried = false;
 942
 943  connect:
 944         status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
 945         if (!NT_STATUS_IS_OK(status)) {
 946                 return status;
 947         }
 948
 949         b = cli->binding_handle;
 950
 951         if (cli->transport->transport == NCACN_IP_TCP) {
 952                 use_lookupsids3 = true;
 953         }
 954
 955         /*
 956          * This call can take a long time
 957          * allow the server to time out.
 958          * 35 seconds should do it.
 959          */
 960         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
 961
 962         status = dcerpc_lsa_lookup_sids_generic(b,
 963                                                 mem_ctx,
 964                                                 &lsa_policy,
 965                                                 num_sids,
 966                                                 sids,
 967                                                 domains,
 968                                                 names,
 969                                                 types,
 970                                                 use_lookupsids3,
 971                                                 &result);
 972
 973         /* And restore our original timeout. */
 974         dcerpc_binding_handle_set_timeout(b, orig_timeout);
 975
 976         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
 977             NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
 978             NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
 979                 /*
 980                  * This can happen if the schannel key is not
 981                  * valid anymore, we need to invalidate the
 982                  * all connections to the dc and reestablish
 983                  * a netlogon connection first.
 984                  */
 985                 invalidate_cm_connection(domain);
 986                 domain->can_do_ncacn_ip_tcp = domain->active_directory;
 987                 if (!retried) {
 988                         retried = true;
 989                         goto connect;
 990                 }
 991                 status = NT_STATUS_ACCESS_DENIED;
 992         }
 993
 994         if (!NT_STATUS_IS_OK(status)) {
 995                 return status;
 996         }
 997
 998         if (!NT_STATUS_IS_OK(result)) {
 999                 return result;
1000         }
1001
1002         return NT_STATUS_OK;
1003 }
1004
1005 static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
1006                                       struct winbindd_domain *domain,
1007                                       uint32_t num_names,
1008                                       const char **names,
1009                                       const char ***domains,
1010                                       struct dom_sid **sids,
1011                                       enum lsa_SidType **types)
1012 {
1013         NTSTATUS status;
1014         NTSTATUS result;
1015         struct rpc_pipe_client *cli = NULL;
1016         struct dcerpc_binding_handle *b = NULL;
1017         struct policy_handle lsa_policy;
1018         unsigned int orig_timeout = 0;
1019         bool use_lookupnames4 = false;
1020         bool retried = false;
1021
1022  connect:
1023         status = cm_connect_lsat(domain, mem_ctx, &cli, &lsa_policy);
1024         if (!NT_STATUS_IS_OK(status)) {
1025                 return status;
1026         }
1027
1028         b = cli->binding_handle;
1029
1030         if (cli->transport->transport == NCACN_IP_TCP) {
1031                 use_lookupnames4 = true;
1032         }
1033
1034         /*
1035          * This call can take a long time
1036          * allow the server to time out.
1037          * 35 seconds should do it.
1038          */
1039         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
1040
1041         status = dcerpc_lsa_lookup_names_generic(b,
1042                                                  mem_ctx,
1043                                                  &lsa_policy,
1044                                                  num_names,
1045                                                  (const char **) names,
1046                                                  domains,
1047                                                  1,
1048                                                  sids,
1049                                                  types,
1050                                                  use_lookupnames4,
1051                                                  &result);
1052
1053         /* And restore our original timeout. */
1054         dcerpc_binding_handle_set_timeout(b, orig_timeout);
1055
1056         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
1057             NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR) ||
1058             NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
1059                 /*
1060                  * This can happen if the schannel key is not
1061                  * valid anymore, we need to invalidate the
1062                  * all connections to the dc and reestablish
1063                  * a netlogon connection first.
1064                  */
1065                 invalidate_cm_connection(domain);
1066                 if (!retried) {
1067                         retried = true;
1068                         goto connect;
1069                 }
1070                 status = NT_STATUS_ACCESS_DENIED;
1071         }
1072
1073         if (!NT_STATUS_IS_OK(status)) {
1074                 return status;
1075         }
1076
1077         if (!NT_STATUS_IS_OK(result)) {
1078                 return result;
1079         }
1080
1081         return NT_STATUS_OK;
1082 }
1083
1084 /* the rpc backend methods are exposed via this structure */
1085 struct winbindd_methods msrpc_methods = {
1086         False,
1087         msrpc_query_user_list,
1088         msrpc_enum_dom_groups,
1089         msrpc_enum_local_groups,
1090         msrpc_name_to_sid,
1091         msrpc_sid_to_name,
1092         msrpc_rids_to_names,
1093         msrpc_lookup_useraliases,
1094         msrpc_lookup_groupmem,
1095         msrpc_sequence_number,
1096         msrpc_lockout_policy,
1097         msrpc_password_policy,
1098         msrpc_trusted_domains,
1099 };