source4/winbind/wb_init_domain.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    A composite API for initializing a domain
   5
   6    Copyright (C) Volker Lendecke 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/composite/composite.h"
  25 #include "libcli/smb_composite/smb_composite.h"
  26 #include "winbind/wb_async_helpers.h"
  27 #include "winbind/wb_server.h"
  28 #include "smbd/service_stream.h"
  29 #include "smbd/service_task.h"
  30 #include "dlinklist.h"
  31
  32 #include "librpc/gen_ndr/nbt.h"
  33 #include "librpc/gen_ndr/samr.h"
  34 #include "lib/messaging/irpc.h"
  35 #include "librpc/gen_ndr/irpc.h"
  36 #include "librpc/gen_ndr/ndr_irpc.h"
  37 #include "libcli/raw/libcliraw.h"
  38 #include "librpc/gen_ndr/ndr_netlogon.h"
  39 #include "librpc/gen_ndr/ndr_lsa.h"
  40 #include "libcli/auth/credentials.h"
  41
  42
  43 /*
  44  * Initialize a domain:
  45  *
  46  * - With schannel credentials, try to open the SMB connection with the
  47  *   machine creds. This works against W2k3SP1 with an NTLMSSP session
  48  *   setup. Fall back to anonymous.
  49  *
  50  * - If we have schannel creds, do the auth2 and open the schannel'ed netlogon
  51  *   pipe.
  52  *
  53  * - Open LSA. If we have machine creds, try to open with ntlmssp. Fall back
  54  *   to schannel and then to anon bind.
  55  *
  56  * - With queryinfopolicy, verify that we're talking to the right domain
  57  *
  58  * A bit complex, but with all the combinations I think it's the best we can
  59  * get. NT4, W2k3 and W2k all have different combinations, but in the end we
  60  * have a signed&sealed lsa connection on all of them.
  61  *
  62  * Not sure if it is overkill, but it seems to work.
  63  */
  64
  65 struct init_domain_state {
  66         struct composite_context *ctx;
  67         struct wbsrv_domain *domain;
  68         struct wbsrv_service *service;
  69
  70         int num_dcs;
  71         struct nbt_dc_name *dcs;
  72         const char *dcaddr;
  73
  74         struct smb_composite_connect conn;
  75
  76         struct dcerpc_pipe *auth2_pipe;
  77         struct dcerpc_pipe *netlogon_pipe;
  78
  79         struct dcerpc_pipe *lsa_pipe;
  80         struct policy_handle *lsa_policy;
  81
  82         struct dcerpc_pipe *samr_pipe;
  83         struct policy_handle *samr_handle;
  84         struct policy_handle *domain_handle;
  85
  86         struct ldap_connection *ldap_conn;
  87
  88         struct lsa_QueryInfoPolicy queryinfo;
  89 };
  90
  91 static void init_domain_recv_dcs(struct composite_context *ctx);
  92 static void init_domain_recv_dcip(struct composite_context *ctx);
  93 static void init_domain_recv_tree(struct composite_context *ctx);
  94 static void init_domain_recv_netlogoncreds(struct composite_context *ctx);
  95 static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
  96 static void init_domain_recv_lsa(struct composite_context *ctx);
  97 static void init_domain_recv_queryinfo(struct rpc_request *req);
  98 static void init_domain_recv_ldapconn(struct composite_context *ctx);
  99 static void init_domain_recv_samr(struct composite_context *ctx);
 100
 101 struct composite_context *wb_init_domain_send(struct wbsrv_service *service,
 102                                               struct wbsrv_domain *domain)
 103 {
 104         struct composite_context *result, *ctx;
 105         struct init_domain_state *state;
 106
 107         result = talloc(domain, struct composite_context);
 108         if (result == NULL) goto failed;
 109         result->state = COMPOSITE_STATE_IN_PROGRESS;
 110         result->async.fn = NULL;
 111         result->event_ctx = service->task->event_ctx;
 112
 113         state = talloc_zero(result, struct init_domain_state);
 114         if (state == NULL) goto failed;
 115         state->ctx = result;
 116         result->private_data = state;
 117
 118         state->service = service;
 119         state->domain = domain;
 120
 121         if (domain->dcname != NULL) {
 122                 struct nbt_name name;
 123                 make_nbt_name(&name, domain->dcname, 0x20);
 124                 ctx = resolve_name_send(&name, result->event_ctx,
 125                                         lp_name_resolve_order());
 126                 if (ctx == NULL) goto failed;
 127                 ctx->async.fn = init_domain_recv_dcip;
 128                 ctx->async.private_data = state;
 129                 return result;
 130         }
 131
 132         if (state->domain->schannel_creds != NULL) {
 133                 talloc_free(state->domain->schannel_creds);
 134         }
 135
 136         state->domain->schannel_creds = cli_credentials_init(state->domain);
 137         if (state->domain->schannel_creds == NULL) goto failed;
 138         cli_credentials_set_conf(state->domain->schannel_creds);
 139         state->ctx->status =
 140                 cli_credentials_set_machine_account(state->domain->
 141                                                     schannel_creds);
 142         if (!NT_STATUS_IS_OK(state->ctx->status)) goto failed;
 143
 144         ctx = wb_finddcs_send(domain->name, domain->sid, result->event_ctx,
 145                               service->task->msg_ctx);
 146         if (ctx == NULL) goto failed;
 147
 148         ctx->async.fn = init_domain_recv_dcs;
 149         ctx->async.private_data = state;
 150         return result;
 151
 152  failed:
 153         talloc_free(result);
 154         return NULL;
 155 }
 156
 157 static void init_domain_recv_dcs(struct composite_context *ctx)
 158 {
 159         struct init_domain_state *state =
 160                 talloc_get_type(ctx->async.private_data,
 161                                 struct init_domain_state);
 162
 163         state->ctx->status = wb_finddcs_recv(ctx, state, &state->num_dcs,
 164                                              &state->dcs);
 165         if (!composite_is_ok(state->ctx)) return;
 166
 167         if (state->num_dcs < 1) {
 168                 composite_error(state->ctx, NT_STATUS_NO_LOGON_SERVERS);
 169                 return;
 170         }
 171
 172         state->dcaddr = state->dcs[0].address;
 173
 174         state->conn.in.dest_host = state->dcs[0].address;
 175         state->conn.in.port = 0;
 176         state->conn.in.called_name = state->dcs[0].name;
 177         state->conn.in.service = "IPC$";
 178         state->conn.in.service_type = "IPC";
 179         state->conn.in.workgroup = state->domain->name;
 180
 181         state->conn.in.credentials = state->domain->schannel_creds;
 182
 183         if (state->conn.in.credentials == NULL) {
 184                 state->conn.in.credentials = cli_credentials_init(state);
 185                 if (composite_nomem(state->conn.in.credentials, state->ctx)) {
 186                         return;
 187                 }
 188                 cli_credentials_set_conf(state->conn.in.credentials);
 189                 cli_credentials_set_anonymous(state->conn.in.credentials);
 190         }
 191
 192         state->conn.in.fallback_to_anonymous = True;
 193
 194         ctx = smb_composite_connect_send(&state->conn, state,
 195                                          state->ctx->event_ctx);
 196         composite_continue(state->ctx, ctx, init_domain_recv_tree, state);
 197 }
 198
 199 static void init_domain_recv_dcip(struct composite_context *ctx)
 200 {
 201         struct init_domain_state *state =
 202                 talloc_get_type(ctx->async.private_data,
 203                                 struct init_domain_state);
 204
 205         state->ctx->status = resolve_name_recv(ctx, state, &state->dcaddr);
 206         if (!composite_is_ok(state->ctx)) return;
 207
 208         state->conn.in.dest_host = state->dcaddr;
 209         state->conn.in.port = 0;
 210         state->conn.in.called_name = state->domain->dcname;
 211         state->conn.in.service = "IPC$";
 212         state->conn.in.service_type = "IPC";
 213         state->conn.in.workgroup = state->domain->name;
 214         state->conn.in.credentials = state->domain->schannel_creds;
 215
 216         state->conn.in.fallback_to_anonymous = True;
 217
 218         ctx = smb_composite_connect_send(&state->conn, state,
 219                                          state->ctx->event_ctx);
 220         composite_continue(state->ctx, ctx, init_domain_recv_tree, state);
 221 }
 222
 223 static void init_domain_recv_tree(struct composite_context *ctx)
 224 {
 225         struct init_domain_state *state =
 226                 talloc_get_type(ctx->async.private_data,
 227                                 struct init_domain_state);
 228         state->ctx->status = smb_composite_connect_recv(ctx, state);
 229         if (!composite_is_ok(state->ctx)) return;
 230
 231         if ((state->domain->schannel_creds != NULL) &&
 232             (!cli_credentials_is_anonymous(state->domain->schannel_creds)) &&
 233             ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
 234              (dom_sid_equal(state->domain->sid,
 235                             state->service->primary_sid)))) {
 236                 ctx = wb_get_schannel_creds_send(state->domain->schannel_creds,
 237                                                  state->conn.out.tree,
 238                                                  state->ctx->event_ctx);
 239                 composite_continue(state->ctx, ctx,
 240                                    init_domain_recv_netlogoncreds, state);
 241                 return;
 242         }
 243
 244         ctx = wb_connect_lsa_send(state->conn.out.tree, NULL);
 245         composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
 246 }
 247
 248 static void init_domain_recv_netlogoncreds(struct composite_context *ctx)
 249 {
 250         struct init_domain_state *state =
 251                 talloc_get_type(ctx->async.private_data,
 252                                 struct init_domain_state);
 253         struct smbcli_tree *tree = NULL;
 254
 255         state->ctx->status = wb_get_schannel_creds_recv(ctx, state,
 256                                                         &state->auth2_pipe);
 257         if (!composite_is_ok(state->ctx)) return;
 258
 259         talloc_unlink(state, state->conn.out.tree); /* The pipe owns it now */
 260
 261         if (!lp_winbind_sealed_pipes()) {
 262                 state->netlogon_pipe = talloc_reference(state,
 263                                                         state->auth2_pipe);
 264                 ctx = wb_connect_lsa_send(state->conn.out.tree, NULL);
 265                 composite_continue(state->ctx, ctx, init_domain_recv_lsa,
 266                                    state);
 267                 return;
 268         }
 269
 270         state->netlogon_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx);
 271         if (composite_nomem(state->netlogon_pipe, state->ctx)) return;
 272
 273         if (state->auth2_pipe != NULL) {
 274                 tree = dcerpc_smb_tree(state->auth2_pipe->conn);
 275         }
 276
 277         if (tree == NULL) {
 278                 composite_error(state->ctx, NT_STATUS_INTERNAL_ERROR);
 279                 return;
 280         }
 281
 282         ctx = dcerpc_pipe_open_smb_send(state->netlogon_pipe->conn, tree,
 283                                         "\\netlogon");
 284         composite_continue(state->ctx, ctx,
 285                            init_domain_recv_netlogonpipe, state);
 286 }
 287
 288 static void init_domain_recv_netlogonpipe(struct composite_context *ctx)
 289 {
 290         struct init_domain_state *state =
 291                 talloc_get_type(ctx->async.private_data,
 292                                 struct init_domain_state);
 293
 294         state->ctx->status = dcerpc_pipe_open_smb_recv(ctx);
 295         if (!composite_is_ok(state->ctx)) return;
 296
 297         state->netlogon_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
 298         state->ctx->status =
 299                 dcerpc_bind_auth_password(state->netlogon_pipe,
 300                                           DCERPC_NETLOGON_UUID,
 301                                           DCERPC_NETLOGON_VERSION,
 302                                           state->domain->schannel_creds,
 303                                           DCERPC_AUTH_TYPE_SCHANNEL,
 304                                           NULL);
 305         if (!composite_is_ok(state->ctx)) return;
 306
 307         ctx = wb_connect_lsa_send(state->conn.out.tree,
 308                                   state->domain->schannel_creds);
 309         composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
 310 }
 311
 312 static void init_domain_recv_lsa(struct composite_context *ctx)
 313 {
 314         struct init_domain_state *state =
 315                 talloc_get_type(ctx->async.private_data,
 316                                 struct init_domain_state);
 317
 318         struct rpc_request *req;
 319
 320         state->ctx->status = wb_connect_lsa_recv(ctx, state,
 321                                                  &state->domain->lsa_auth_type,
 322                                                  &state->lsa_pipe,
 323                                                  &state->lsa_policy);
 324         if (!composite_is_ok(state->ctx)) return;
 325
 326         if (state->auth2_pipe == NULL) {
 327                 /* Give the tree to the LSA pipe. If auth2_pipe exists we have
 328                  * given it to that already */
 329                 talloc_unlink(state, state->conn.out.tree);
 330         }
 331
 332         state->queryinfo.in.handle = state->lsa_policy;
 333         state->queryinfo.in.level = LSA_POLICY_INFO_ACCOUNT_DOMAIN;
 334
 335         req = dcerpc_lsa_QueryInfoPolicy_send(state->lsa_pipe, state,
 336                                               &state->queryinfo);
 337         composite_continue_rpc(state->ctx, req,
 338                                init_domain_recv_queryinfo, state);
 339 }
 340
 341 static void init_domain_recv_queryinfo(struct rpc_request *req)
 342 {
 343         struct init_domain_state *state =
 344                 talloc_get_type(req->async.private, struct init_domain_state);
 345         struct lsa_DomainInfo *dominfo;
 346         struct composite_context *ctx;
 347         const char *ldap_url;
 348
 349         state->ctx->status = dcerpc_ndr_request_recv(req);
 350         if (!composite_is_ok(state->ctx)) return;
 351         state->ctx->status = state->queryinfo.out.result;
 352         if (!composite_is_ok(state->ctx)) return;
 353
 354         dominfo = &state->queryinfo.out.info->account_domain;
 355
 356         if (strcasecmp(state->domain->name, dominfo->name.string) != 0) {
 357                 DEBUG(2, ("Expected domain name %s, DC %s said %s\n",
 358                           state->domain->name,
 359                           dcerpc_server_name(state->lsa_pipe),
 360                           dominfo->name.string));
 361                 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
 362                 return;
 363         }
 364
 365         if (!dom_sid_equal(state->domain->sid, dominfo->sid)) {
 366                 DEBUG(2, ("Expected domain sid %s, DC %s said %s\n",
 367                           dom_sid_string(state, state->domain->sid),
 368                           dcerpc_server_name(state->lsa_pipe),
 369                           dom_sid_string(state, dominfo->sid)));
 370                 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
 371                 return;
 372         }
 373
 374         state->ldap_conn = ldap_new_connection(state, state->ctx->event_ctx);
 375         composite_nomem(state->ldap_conn, state->ctx);
 376
 377         ldap_url = talloc_asprintf(state, "ldap://%s/", state->dcaddr);
 378         composite_nomem(ldap_url, state->ctx);
 379
 380         ctx = ldap_connect_send(state->ldap_conn, ldap_url);
 381         composite_continue(state->ctx, ctx, init_domain_recv_ldapconn, state);
 382 }
 383
 384 static void init_domain_recv_ldapconn(struct composite_context *ctx)
 385 {
 386         struct init_domain_state *state =
 387                 talloc_get_type(ctx->async.private_data,
 388                                 struct init_domain_state);
 389
 390         state->ctx->status = ldap_connect_recv(ctx);
 391         DEBUG(0, ("ldap_connect returned %s\n",
 392                   nt_errstr(state->ctx->status)));
 393
 394         state->samr_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx);
 395         if (composite_nomem(state->samr_pipe, state->ctx)) return;
 396
 397         ctx = wb_connect_sam_send(state->conn.out.tree,
 398                                   state->domain->lsa_auth_type,
 399                                   state->domain->schannel_creds,
 400                                   state->domain->sid);
 401         composite_continue(state->ctx, ctx, init_domain_recv_samr, state);
 402 }
 403
 404 static void init_domain_recv_samr(struct composite_context *ctx)
 405 {
 406         struct init_domain_state *state =
 407                 talloc_get_type(ctx->async.private_data,
 408                                 struct init_domain_state);
 409
 410         state->ctx->status = wb_connect_sam_recv(ctx, state, &state->samr_pipe,
 411                                                  &state->samr_handle,
 412                                                  &state->domain_handle);
 413         if (!composite_is_ok(state->ctx)) return;
 414
 415         composite_done(state->ctx);
 416 }
 417
 418 NTSTATUS wb_init_domain_recv(struct composite_context *c)
 419 {
 420         NTSTATUS status = composite_wait(c);
 421         if (NT_STATUS_IS_OK(status)) {
 422                 struct init_domain_state *state =
 423                         talloc_get_type(c->private_data,
 424                                         struct init_domain_state);
 425                 struct wbsrv_domain *domain = state->domain;
 426
 427                 talloc_free(domain->netlogon_auth2_pipe);
 428                 domain->netlogon_auth2_pipe =
 429                         talloc_steal(domain, state->auth2_pipe);
 430
 431                 talloc_free(domain->netlogon_pipe);
 432                 domain->netlogon_pipe =
 433                         talloc_steal(domain, state->netlogon_pipe);
 434
 435                 talloc_free(domain->lsa_pipe);
 436                 domain->lsa_pipe =
 437                         talloc_steal(domain, state->lsa_pipe);
 438
 439                 talloc_free(domain->lsa_policy);
 440                 domain->lsa_policy =
 441                         talloc_steal(domain, state->lsa_policy);
 442
 443                 talloc_free(domain->samr_pipe);
 444                 domain->samr_pipe =
 445                         talloc_steal(domain, state->samr_pipe);
 446
 447                 talloc_free(domain->samr_handle);
 448                 domain->samr_handle =
 449                         talloc_steal(domain, state->samr_handle);
 450
 451                 talloc_free(domain->domain_handle);
 452                 domain->domain_handle =
 453                         talloc_steal(domain, state->domain_handle);
 454
 455                 domain->initialized = True;
 456         }
 457         talloc_free(c);
 458         return status;
 459 }
 460
 461 NTSTATUS wb_init_domain(struct wbsrv_service *service,
 462                         struct wbsrv_domain *domain)
 463 {
 464         struct composite_context *c =
 465                 wb_init_domain_send(service, domain);
 466         return wb_init_domain_recv(c);
 467 }