source4/libnet/libnet_rpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher  2004
   5    Copyright (C) Rafal Szczesniak   2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23 #include "libnet/libnet.h"
  24 #include "libcli/libcli.h"
  25 #include "librpc/gen_ndr/ndr_lsa_c.h"
  26
  27 /**
  28  * Connects rpc pipe on remote server
  29  *
  30  * @param ctx initialised libnet context
  31  * @param mem_ctx memory context of this call
  32  * @param r data structure containing necessary parameters and return values
  33  * @return nt status of the call
  34  **/
  35
  36 static NTSTATUS libnet_RpcConnectSrv(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r)
  37 {
  38         NTSTATUS status;
  39         const char *binding = NULL;
  40
  41         /* prepare binding string */
  42         switch (r->level) {
  43         case LIBNET_RPC_CONNECT_DC:
  44         case LIBNET_RPC_CONNECT_PDC:
  45         case LIBNET_RPC_CONNECT_SERVER:
  46                 binding = talloc_asprintf(mem_ctx, "ncacn_np:%s", r->in.name);
  47                 break;
  48
  49         case LIBNET_RPC_CONNECT_BINDING:
  50                 binding = r->in.binding;
  51                 break;
  52         }
  53
  54         /* connect to remote dcerpc pipe */
  55         status = dcerpc_pipe_connect(mem_ctx, &r->out.dcerpc_pipe,
  56                                      binding, r->in.dcerpc_iface,
  57                                      ctx->cred, ctx->event_ctx);
  58
  59         if (!NT_STATUS_IS_OK(status)) {
  60                 r->out.error_string = talloc_asprintf(mem_ctx,
  61                                                       "dcerpc_pipe_connect to pipe %s[%s] failed with %s\n",
  62                                                       r->in.dcerpc_iface->name, binding, nt_errstr(status));
  63                 return status;
  64         }
  65
  66         r->out.error_string = NULL;
  67         ctx->pipe = r->out.dcerpc_pipe;
  68
  69         return status;
  70 }
  71
  72
  73 /**
  74  * Connects rpc pipe on domain pdc
  75  *
  76  * @param ctx initialised libnet context
  77  * @param mem_ctx memory context of this call
  78  * @param r data structure containing necessary parameters and return values
  79  * @return nt status of the call
  80  **/
  81
  82 static NTSTATUS libnet_RpcConnectDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r)
  83 {
  84         NTSTATUS status;
  85         struct libnet_RpcConnect r2;
  86         struct libnet_LookupDCs f;
  87         const char *connect_name;
  88
  89         f.in.domain_name  = r->in.name;
  90         switch (r->level) {
  91         case LIBNET_RPC_CONNECT_PDC:
  92                 f.in.name_type = NBT_NAME_PDC;
  93                 break;
  94         case LIBNET_RPC_CONNECT_DC:
  95                 f.in.name_type = NBT_NAME_LOGON;
  96                 break;
  97         default:
  98                 break;
  99         }
 100         f.out.num_dcs = 0;
 101         f.out.dcs  = NULL;
 102
 103         /* find the domain pdc first */
 104         status = libnet_LookupDCs(ctx, mem_ctx, &f);
 105         if (!NT_STATUS_IS_OK(status)) {
 106                 r->out.error_string = talloc_asprintf(mem_ctx, "libnet_LookupDCs failed: %s",
 107                                                       nt_errstr(status));
 108                 return status;
 109         }
 110
 111         /* we might not have got back a name.  Fall back to the IP */
 112         if (f.out.dcs[0].name) {
 113                 connect_name = f.out.dcs[0].name;
 114         } else {
 115                 connect_name = f.out.dcs[0].address;
 116         }
 117
 118         /* ok, pdc has been found so do attempt to rpc connect */
 119         r2.level            = LIBNET_RPC_CONNECT_SERVER;
 120
 121         /* This will cause yet another name resolution, but at least
 122          * we pass the right name down the stack now */
 123         r2.in.name          = talloc_strdup(mem_ctx, connect_name);
 124         r2.in.dcerpc_iface  = r->in.dcerpc_iface;
 125
 126         status = libnet_RpcConnect(ctx, mem_ctx, &r2);
 127
 128         r->out.dcerpc_pipe          = r2.out.dcerpc_pipe;
 129         r->out.error_string         = r2.out.error_string;
 130
 131         ctx->pipe = r->out.dcerpc_pipe;
 132
 133         return status;
 134 }
 135
 136
 137 /**
 138  * Connects to rpc pipe on remote server or pdc
 139  *
 140  * @param ctx initialised libnet context
 141  * @param mem_ctx memory context of this call
 142  * @param r data structure containing necessary parameters and return values
 143  * @return nt status of the call
 144  **/
 145
 146 NTSTATUS libnet_RpcConnect(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r)
 147 {
 148         switch (r->level) {
 149                 case LIBNET_RPC_CONNECT_SERVER:
 150                         return libnet_RpcConnectSrv(ctx, mem_ctx, r);
 151
 152                 case LIBNET_RPC_CONNECT_BINDING:
 153                         return libnet_RpcConnectSrv(ctx, mem_ctx, r);
 154
 155                 case LIBNET_RPC_CONNECT_PDC:
 156                 case LIBNET_RPC_CONNECT_DC:
 157                         return libnet_RpcConnectDC(ctx, mem_ctx, r);
 158         }
 159
 160         return NT_STATUS_INVALID_LEVEL;
 161 }
 162
 163 /**
 164  * Connects to rpc pipe on remote server or pdc, and returns info on the domain name, domain sid and realm
 165  *
 166  * @param ctx initialised libnet context
 167  * @param r data structure containing necessary parameters and return values.  Must be a talloc context
 168  * @return nt status of the call
 169  **/
 170
 171 NTSTATUS libnet_RpcConnectDCInfo(struct libnet_context *ctx,
 172                                  struct libnet_RpcConnectDCInfo *r)
 173 {
 174         TALLOC_CTX *tmp_ctx;
 175         NTSTATUS status;
 176
 177         struct libnet_RpcConnect *c;
 178         struct lsa_ObjectAttribute attr;
 179         struct lsa_QosInfo qos;
 180         struct lsa_OpenPolicy2 lsa_open_policy;
 181         struct policy_handle lsa_p_handle;
 182         struct lsa_QueryInfoPolicy2 lsa_query_info2;
 183         struct lsa_QueryInfoPolicy lsa_query_info;
 184
 185         struct dcerpc_pipe *lsa_pipe;
 186
 187         struct dcerpc_binding *final_binding;
 188         struct dcerpc_pipe *final_pipe;
 189
 190         tmp_ctx = talloc_new(r);
 191         if (!tmp_ctx) {
 192                 r->out.error_string = NULL;
 193                 return NT_STATUS_NO_MEMORY;
 194         }
 195
 196         c = talloc(tmp_ctx, struct libnet_RpcConnect);
 197         if (!c) {
 198                 r->out.error_string = NULL;
 199                 talloc_free(tmp_ctx);
 200                 return NT_STATUS_NO_MEMORY;
 201         }
 202         c->level              = r->level;
 203
 204         if (r->level != LIBNET_RPC_CONNECT_BINDING) {
 205                 c->in.name    = r->in.name;
 206         } else {
 207                 c->in.binding = r->in.binding;
 208         }
 209
 210         c->in.dcerpc_iface    = &dcerpc_table_lsarpc;
 211
 212         /* connect to the LSA pipe of the PDC */
 213
 214         status = libnet_RpcConnect(ctx, c, c);
 215         if (!NT_STATUS_IS_OK(status)) {
 216                 if (r->level != LIBNET_RPC_CONNECT_BINDING) {
 217                         r->out.error_string = talloc_asprintf(r,
 218                                                               "Connection to LSA pipe of DC failed: %s",
 219                                                               c->out.error_string);
 220                 } else {
 221                         r->out.error_string = talloc_asprintf(r,
 222                                                               "Connection to LSA pipe with binding '%s' failed: %s",
 223                                                               r->in.binding, c->out.error_string);
 224                 }
 225                 talloc_free(tmp_ctx);
 226                 return status;
 227         }
 228         lsa_pipe = c->out.dcerpc_pipe;
 229
 230         /* Get an LSA policy handle */
 231
 232         ZERO_STRUCT(lsa_p_handle);
 233         qos.len = 0;
 234         qos.impersonation_level = 2;
 235         qos.context_mode = 1;
 236         qos.effective_only = 0;
 237
 238         attr.len = 0;
 239         attr.root_dir = NULL;
 240         attr.object_name = NULL;
 241         attr.attributes = 0;
 242         attr.sec_desc = NULL;
 243         attr.sec_qos = &qos;
 244
 245         lsa_open_policy.in.attr = &attr;
 246
 247         lsa_open_policy.in.system_name = talloc_asprintf(tmp_ctx, "\\");
 248         if (!lsa_open_policy.in.system_name) {
 249                 r->out.error_string = NULL;
 250                 talloc_free(tmp_ctx);
 251                 return NT_STATUS_NO_MEMORY;
 252         }
 253
 254         lsa_open_policy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 255         lsa_open_policy.out.handle = &lsa_p_handle;
 256
 257         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, tmp_ctx, &lsa_open_policy);
 258
 259         /* This now fails on ncacn_ip_tcp against Win2k3 SP1 */
 260         if (NT_STATUS_IS_OK(status)) {
 261                 /* Look to see if this is ADS (a fault indicates NT4 or Samba 3.0) */
 262
 263                 lsa_query_info2.in.handle = &lsa_p_handle;
 264                 lsa_query_info2.in.level = LSA_POLICY_INFO_DNS;
 265
 266                 status = dcerpc_lsa_QueryInfoPolicy2(lsa_pipe, tmp_ctx,
 267                                                      &lsa_query_info2);
 268
 269                 if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 270                         if (!NT_STATUS_IS_OK(status)) {
 271                                 r->out.error_string = talloc_asprintf(r,
 272                                                                       "lsa_QueryInfoPolicy2 failed: %s",
 273                                                                       nt_errstr(status));
 274                                 talloc_free(tmp_ctx);
 275                                 return status;
 276                         }
 277                         r->out.realm = lsa_query_info2.out.info->dns.dns_domain.string;
 278                         r->out.guid = talloc(r, struct GUID);
 279                         if (!r->out.guid) {
 280                                 r->out.error_string = NULL;
 281                                 return NT_STATUS_NO_MEMORY;
 282                         }
 283                         *r->out.guid = lsa_query_info2.out.info->dns.domain_guid;
 284                 } else {
 285                         r->out.realm = NULL;
 286                         r->out.guid = NULL;
 287                 }
 288
 289                 /* Grab the domain SID (regardless of the result of the previous call */
 290
 291                 lsa_query_info.in.handle = &lsa_p_handle;
 292                 lsa_query_info.in.level = LSA_POLICY_INFO_DOMAIN;
 293
 294                 status = dcerpc_lsa_QueryInfoPolicy(lsa_pipe, tmp_ctx,
 295                                                     &lsa_query_info);
 296
 297                 if (!NT_STATUS_IS_OK(status)) {
 298                         r->out.error_string = talloc_asprintf(r,
 299                                                               "lsa_QueryInfoPolicy2 failed: %s",
 300                                                               nt_errstr(status));
 301                         talloc_free(tmp_ctx);
 302                         return status;
 303                 }
 304
 305                 r->out.domain_sid = lsa_query_info.out.info->domain.sid;
 306                 r->out.domain_name = lsa_query_info.out.info->domain.name.string;
 307         } else {
 308                 /* Cause the code further down to try this with just SAMR */
 309                 r->out.domain_sid = NULL;
 310                 r->out.domain_name = NULL;
 311                 r->out.realm = NULL;
 312         }
 313
 314         /* Find the original binding string */
 315         final_binding = talloc(tmp_ctx, struct dcerpc_binding);
 316         if (!final_binding) {
 317                 return NT_STATUS_NO_MEMORY;
 318         }
 319         *final_binding = *lsa_pipe->binding;
 320         /* Ensure we keep hold of the member elements */
 321         talloc_reference(final_binding, lsa_pipe->binding);
 322
 323         /* Make binding string for samr, not the other pipe */
 324         status = dcerpc_epm_map_binding(tmp_ctx, final_binding,
 325                                         r->in.dcerpc_iface,
 326                                         lsa_pipe->conn->event_ctx);
 327         if (!NT_STATUS_IS_OK(status)) {
 328                 r->out.error_string = talloc_asprintf(r,
 329                                                       "Failed to map pipe with endpoint mapper - %s",
 330                                                       nt_errstr(status));
 331                 talloc_free(tmp_ctx);
 332                 return status;
 333         }
 334
 335         /* Now that we have the info setup a final connection to the pipe they wanted */
 336         status = dcerpc_secondary_connection(lsa_pipe, &final_pipe, final_binding);
 337         if (!NT_STATUS_IS_OK(status)) {
 338                 r->out.error_string = talloc_asprintf(r,
 339                                                       "secondary connection failed: %s",
 340                                                       nt_errstr(status));
 341                 talloc_free(tmp_ctx);
 342                 return status;
 343         }
 344         r->out.dcerpc_pipe = final_pipe;
 345
 346         talloc_steal(r, r->out.realm);
 347         talloc_steal(r, r->out.domain_sid);
 348         talloc_steal(r, r->out.domain_name);
 349         talloc_steal(r, r->out.dcerpc_pipe);
 350
 351         /* This should close the LSA pipe, which we don't need now we have the info */
 352         talloc_free(tmp_ctx);
 353         return NT_STATUS_OK;
 354 }
 355