2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Rafal Szczesniak 2005
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 #include "libnet/libnet.h"
24 #include "libcli/libcli.h"
25 #include "librpc/gen_ndr/ndr_lsa_c.h"
28 * Connects rpc pipe on remote server
30 * @param ctx initialised libnet context
31 * @param mem_ctx memory context of this call
32 * @param r data structure containing necessary parameters and return values
33 * @return nt status of the call
36 static NTSTATUS libnet_RpcConnectSrv(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r)
39 const char *binding = NULL;
41 /* prepare binding string */
43 case LIBNET_RPC_CONNECT_DC:
44 case LIBNET_RPC_CONNECT_PDC:
45 case LIBNET_RPC_CONNECT_SERVER:
46 binding = talloc_asprintf(mem_ctx, "ncacn_np:%s", r->in.name);
49 case LIBNET_RPC_CONNECT_BINDING:
50 binding = r->in.binding;
54 /* connect to remote dcerpc pipe */
55 status = dcerpc_pipe_connect(mem_ctx, &r->out.dcerpc_pipe,
56 binding, r->in.dcerpc_iface,
57 ctx->cred, ctx->event_ctx);
59 if (!NT_STATUS_IS_OK(status)) {
60 r->out.error_string = talloc_asprintf(mem_ctx,
61 "dcerpc_pipe_connect to pipe %s[%s] failed with %s\n",
62 r->in.dcerpc_iface->name, binding, nt_errstr(status));
66 r->out.error_string = NULL;
67 ctx->pipe = r->out.dcerpc_pipe;
74 * Connects rpc pipe on domain pdc
76 * @param ctx initialised libnet context
77 * @param mem_ctx memory context of this call
78 * @param r data structure containing necessary parameters and return values
79 * @return nt status of the call
82 static NTSTATUS libnet_RpcConnectDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r)
85 struct libnet_RpcConnect r2;
86 struct libnet_LookupDCs f;
87 const char *connect_name;
89 f.in.domain_name = r->in.name;
91 case LIBNET_RPC_CONNECT_PDC:
92 f.in.name_type = NBT_NAME_PDC;
94 case LIBNET_RPC_CONNECT_DC:
95 f.in.name_type = NBT_NAME_LOGON;
103 /* find the domain pdc first */
104 status = libnet_LookupDCs(ctx, mem_ctx, &f);
105 if (!NT_STATUS_IS_OK(status)) {
106 r->out.error_string = talloc_asprintf(mem_ctx, "libnet_LookupDCs failed: %s",
111 /* we might not have got back a name. Fall back to the IP */
112 if (f.out.dcs[0].name) {
113 connect_name = f.out.dcs[0].name;
115 connect_name = f.out.dcs[0].address;
118 /* ok, pdc has been found so do attempt to rpc connect */
119 r2.level = LIBNET_RPC_CONNECT_SERVER;
121 /* This will cause yet another name resolution, but at least
122 * we pass the right name down the stack now */
123 r2.in.name = talloc_strdup(mem_ctx, connect_name);
124 r2.in.dcerpc_iface = r->in.dcerpc_iface;
126 status = libnet_RpcConnect(ctx, mem_ctx, &r2);
128 r->out.dcerpc_pipe = r2.out.dcerpc_pipe;
129 r->out.error_string = r2.out.error_string;
131 ctx->pipe = r->out.dcerpc_pipe;
138 * Connects to rpc pipe on remote server or pdc
140 * @param ctx initialised libnet context
141 * @param mem_ctx memory context of this call
142 * @param r data structure containing necessary parameters and return values
143 * @return nt status of the call
146 NTSTATUS libnet_RpcConnect(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r)
149 case LIBNET_RPC_CONNECT_SERVER:
150 return libnet_RpcConnectSrv(ctx, mem_ctx, r);
152 case LIBNET_RPC_CONNECT_BINDING:
153 return libnet_RpcConnectSrv(ctx, mem_ctx, r);
155 case LIBNET_RPC_CONNECT_PDC:
156 case LIBNET_RPC_CONNECT_DC:
157 return libnet_RpcConnectDC(ctx, mem_ctx, r);
160 return NT_STATUS_INVALID_LEVEL;
164 * Connects to rpc pipe on remote server or pdc, and returns info on the domain name, domain sid and realm
166 * @param ctx initialised libnet context
167 * @param r data structure containing necessary parameters and return values. Must be a talloc context
168 * @return nt status of the call
171 NTSTATUS libnet_RpcConnectDCInfo(struct libnet_context *ctx,
172 struct libnet_RpcConnectDCInfo *r)
177 struct libnet_RpcConnect *c;
178 struct lsa_ObjectAttribute attr;
179 struct lsa_QosInfo qos;
180 struct lsa_OpenPolicy2 lsa_open_policy;
181 struct policy_handle lsa_p_handle;
182 struct lsa_QueryInfoPolicy2 lsa_query_info2;
183 struct lsa_QueryInfoPolicy lsa_query_info;
185 struct dcerpc_pipe *lsa_pipe;
187 struct dcerpc_binding *final_binding;
188 struct dcerpc_pipe *final_pipe;
190 tmp_ctx = talloc_new(r);
192 r->out.error_string = NULL;
193 return NT_STATUS_NO_MEMORY;
196 c = talloc(tmp_ctx, struct libnet_RpcConnect);
198 r->out.error_string = NULL;
199 talloc_free(tmp_ctx);
200 return NT_STATUS_NO_MEMORY;
204 if (r->level != LIBNET_RPC_CONNECT_BINDING) {
205 c->in.name = r->in.name;
207 c->in.binding = r->in.binding;
210 c->in.dcerpc_iface = &dcerpc_table_lsarpc;
212 /* connect to the LSA pipe of the PDC */
214 status = libnet_RpcConnect(ctx, c, c);
215 if (!NT_STATUS_IS_OK(status)) {
216 if (r->level != LIBNET_RPC_CONNECT_BINDING) {
217 r->out.error_string = talloc_asprintf(r,
218 "Connection to LSA pipe of DC failed: %s",
219 c->out.error_string);
221 r->out.error_string = talloc_asprintf(r,
222 "Connection to LSA pipe with binding '%s' failed: %s",
223 r->in.binding, c->out.error_string);
225 talloc_free(tmp_ctx);
228 lsa_pipe = c->out.dcerpc_pipe;
230 /* Get an LSA policy handle */
232 ZERO_STRUCT(lsa_p_handle);
234 qos.impersonation_level = 2;
235 qos.context_mode = 1;
236 qos.effective_only = 0;
239 attr.root_dir = NULL;
240 attr.object_name = NULL;
242 attr.sec_desc = NULL;
245 lsa_open_policy.in.attr = &attr;
247 lsa_open_policy.in.system_name = talloc_asprintf(tmp_ctx, "\\");
248 if (!lsa_open_policy.in.system_name) {
249 r->out.error_string = NULL;
250 talloc_free(tmp_ctx);
251 return NT_STATUS_NO_MEMORY;
254 lsa_open_policy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
255 lsa_open_policy.out.handle = &lsa_p_handle;
257 status = dcerpc_lsa_OpenPolicy2(lsa_pipe, tmp_ctx, &lsa_open_policy);
259 /* This now fails on ncacn_ip_tcp against Win2k3 SP1 */
260 if (NT_STATUS_IS_OK(status)) {
261 /* Look to see if this is ADS (a fault indicates NT4 or Samba 3.0) */
263 lsa_query_info2.in.handle = &lsa_p_handle;
264 lsa_query_info2.in.level = LSA_POLICY_INFO_DNS;
266 status = dcerpc_lsa_QueryInfoPolicy2(lsa_pipe, tmp_ctx,
269 if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
270 if (!NT_STATUS_IS_OK(status)) {
271 r->out.error_string = talloc_asprintf(r,
272 "lsa_QueryInfoPolicy2 failed: %s",
274 talloc_free(tmp_ctx);
277 r->out.realm = lsa_query_info2.out.info->dns.dns_domain.string;
278 r->out.guid = talloc(r, struct GUID);
280 r->out.error_string = NULL;
281 return NT_STATUS_NO_MEMORY;
283 *r->out.guid = lsa_query_info2.out.info->dns.domain_guid;
289 /* Grab the domain SID (regardless of the result of the previous call */
291 lsa_query_info.in.handle = &lsa_p_handle;
292 lsa_query_info.in.level = LSA_POLICY_INFO_DOMAIN;
294 status = dcerpc_lsa_QueryInfoPolicy(lsa_pipe, tmp_ctx,
297 if (!NT_STATUS_IS_OK(status)) {
298 r->out.error_string = talloc_asprintf(r,
299 "lsa_QueryInfoPolicy2 failed: %s",
301 talloc_free(tmp_ctx);
305 r->out.domain_sid = lsa_query_info.out.info->domain.sid;
306 r->out.domain_name = lsa_query_info.out.info->domain.name.string;
308 /* Cause the code further down to try this with just SAMR */
309 r->out.domain_sid = NULL;
310 r->out.domain_name = NULL;
314 /* Find the original binding string */
315 final_binding = talloc(tmp_ctx, struct dcerpc_binding);
316 if (!final_binding) {
317 return NT_STATUS_NO_MEMORY;
319 *final_binding = *lsa_pipe->binding;
320 /* Ensure we keep hold of the member elements */
321 talloc_reference(final_binding, lsa_pipe->binding);
323 /* Make binding string for samr, not the other pipe */
324 status = dcerpc_epm_map_binding(tmp_ctx, final_binding,
326 lsa_pipe->conn->event_ctx);
327 if (!NT_STATUS_IS_OK(status)) {
328 r->out.error_string = talloc_asprintf(r,
329 "Failed to map pipe with endpoint mapper - %s",
331 talloc_free(tmp_ctx);
335 /* Now that we have the info setup a final connection to the pipe they wanted */
336 status = dcerpc_secondary_connection(lsa_pipe, &final_pipe, final_binding);
337 if (!NT_STATUS_IS_OK(status)) {
338 r->out.error_string = talloc_asprintf(r,
339 "secondary connection failed: %s",
341 talloc_free(tmp_ctx);
344 r->out.dcerpc_pipe = final_pipe;
346 talloc_steal(r, r->out.realm);
347 talloc_steal(r, r->out.domain_sid);
348 talloc_steal(r, r->out.domain_name);
349 talloc_steal(r, r->out.dcerpc_pipe);
351 /* This should close the LSA pipe, which we don't need now we have the info */
352 talloc_free(tmp_ctx);