2 Unix SMB/CIFS implementation.
4 A composite API for initializing a domain
6 Copyright (C) Volker Lendecke 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "libcli/composite/composite.h"
25 #include "libcli/smb_composite/smb_composite.h"
26 #include "winbind/wb_async_helpers.h"
27 #include "winbind/wb_server.h"
28 #include "smbd/service_stream.h"
29 #include "dlinklist.h"
31 #include "librpc/gen_ndr/nbt.h"
32 #include "librpc/gen_ndr/samr.h"
33 #include "lib/messaging/irpc.h"
34 #include "librpc/gen_ndr/irpc.h"
35 #include "librpc/gen_ndr/ndr_irpc.h"
36 #include "libcli/raw/libcliraw.h"
37 #include "librpc/gen_ndr/ndr_netlogon.h"
38 #include "librpc/gen_ndr/ndr_lsa.h"
39 #include "libcli/auth/credentials.h"
43 * Initialize a domain:
45 * - With schannel credentials, try to open the SMB connection with the
46 * machine creds. This works against W2k3SP1 with an NTLMSSP session
47 * setup. Fall back to anonymous.
49 * - If we have schannel creds, do the auth2 and open the schannel'ed netlogon
52 * - Open LSA. If we have machine creds, try to open with ntlmssp. Fall back
53 * to schannel and then to anon bind.
55 * - With queryinfopolicy, verify that we're talking to the right domain
57 * A bit complex, but with all the combinations I think it's the best we can
58 * get. NT4, W2k3 and W2k all have different combinations, but in the end we
59 * have a signed&sealed lsa connection on all of them.
61 * Not sure if it is overkill, but it seems to work.
64 struct init_domain_state {
65 struct composite_context *ctx;
66 struct wbsrv_domain *domain;
69 struct nbt_dc_name *dcs;
71 struct smb_composite_connect conn;
73 struct dcerpc_pipe *auth2_pipe;
74 struct dcerpc_pipe *netlogon_pipe;
76 struct dcerpc_pipe *lsa_pipe;
77 struct policy_handle *lsa_policy;
79 struct dcerpc_pipe *samr_pipe;
80 struct policy_handle *samr_handle;
81 struct policy_handle *domain_handle;
83 struct lsa_QueryInfoPolicy queryinfo;
86 static void init_domain_recv_dcs(struct composite_context *ctx);
87 static void init_domain_recv_tree(struct composite_context *ctx);
88 static void init_domain_recv_netlogoncreds(struct composite_context *ctx);
89 static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
90 static void init_domain_recv_lsa(struct composite_context *ctx);
91 static void init_domain_recv_queryinfo(struct rpc_request *req);
92 static void init_domain_recv_samr(struct composite_context *ctx);
94 struct composite_context *wb_init_domain_send(struct wbsrv_domain *domain,
95 struct event_context *event_ctx,
96 struct messaging_context *msg_ctx)
98 struct composite_context *result, *ctx;
99 struct init_domain_state *state;
101 result = talloc(domain, struct composite_context);
102 if (result == NULL) goto failed;
103 result->state = COMPOSITE_STATE_IN_PROGRESS;
104 result->async.fn = NULL;
105 result->event_ctx = event_ctx;
107 state = talloc_zero(result, struct init_domain_state);
108 if (state == NULL) goto failed;
110 result->private_data = state;
112 state->domain = domain;
114 if (state->domain->schannel_creds != NULL) {
115 talloc_free(state->domain->schannel_creds);
118 state->domain->schannel_creds = cli_credentials_init(state->domain);
119 if (state->domain->schannel_creds == NULL) goto failed;
120 cli_credentials_set_conf(state->domain->schannel_creds);
122 cli_credentials_set_machine_account(state->domain->
124 if (!NT_STATUS_IS_OK(state->ctx->status)) goto failed;
126 ctx = wb_finddcs_send(domain->name, domain->sid, event_ctx, msg_ctx);
127 if (ctx == NULL) goto failed;
129 ctx->async.fn = init_domain_recv_dcs;
130 ctx->async.private_data = state;
138 static void init_domain_recv_dcs(struct composite_context *ctx)
140 struct init_domain_state *state =
141 talloc_get_type(ctx->async.private_data,
142 struct init_domain_state);
144 state->ctx->status = wb_finddcs_recv(ctx, state, &state->num_dcs,
146 if (!composite_is_ok(state->ctx)) return;
148 if (state->num_dcs < 1) {
149 composite_error(state->ctx, NT_STATUS_NO_LOGON_SERVERS);
153 state->conn.in.dest_host = state->dcs[0].address;
154 state->conn.in.port = 0;
155 state->conn.in.called_name = state->dcs[0].name;
156 state->conn.in.service = "IPC$";
157 state->conn.in.service_type = "IPC";
158 state->conn.in.workgroup = state->domain->name;
160 state->conn.in.credentials = state->domain->schannel_creds;
162 if (state->conn.in.credentials == NULL) {
163 state->conn.in.credentials = cli_credentials_init(state);
164 if (composite_nomem(state->conn.in.credentials, state->ctx)) {
167 cli_credentials_set_conf(state->conn.in.credentials);
168 cli_credentials_set_anonymous(state->conn.in.credentials);
171 state->conn.in.fallback_to_anonymous = True;
173 ctx = smb_composite_connect_send(&state->conn, state,
174 state->ctx->event_ctx);
175 composite_continue(state->ctx, ctx, init_domain_recv_tree, state);
178 static void init_domain_recv_tree(struct composite_context *ctx)
180 struct init_domain_state *state =
181 talloc_get_type(ctx->async.private_data,
182 struct init_domain_state);
184 state->ctx->status = smb_composite_connect_recv(ctx, state);
185 if (!composite_is_ok(state->ctx)) return;
187 if (state->domain->schannel_creds == NULL) {
188 /* No chance to open netlogon */
189 ctx = wb_connect_lsa_send(state->conn.out.tree, NULL);
190 composite_continue(state->ctx, ctx,
191 init_domain_recv_lsa, state);
195 ctx = wb_get_schannel_creds_send(state->domain->schannel_creds,
196 state->conn.out.tree,
197 state->ctx->event_ctx);
198 composite_continue(state->ctx, ctx,
199 init_domain_recv_netlogoncreds, state);
202 static void init_domain_recv_netlogoncreds(struct composite_context *ctx)
204 struct init_domain_state *state =
205 talloc_get_type(ctx->async.private_data,
206 struct init_domain_state);
207 struct smbcli_tree *tree = NULL;
209 state->ctx->status = wb_get_schannel_creds_recv(ctx, state,
211 if (!composite_is_ok(state->ctx)) return;
213 talloc_unlink(state, state->conn.out.tree); /* The pipe owns it now */
215 state->netlogon_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx);
216 if (composite_nomem(state->netlogon_pipe, state->ctx)) return;
218 if (state->auth2_pipe != NULL) {
219 tree = dcerpc_smb_tree(state->auth2_pipe->conn);
223 composite_error(state->ctx, NT_STATUS_INTERNAL_ERROR);
227 ctx = dcerpc_pipe_open_smb_send(state->netlogon_pipe->conn, tree,
229 composite_continue(state->ctx, ctx,
230 init_domain_recv_netlogonpipe, state);
233 static void init_domain_recv_netlogonpipe(struct composite_context *ctx)
235 struct init_domain_state *state =
236 talloc_get_type(ctx->async.private_data,
237 struct init_domain_state);
239 state->ctx->status = dcerpc_pipe_open_smb_recv(ctx);
240 if (!composite_is_ok(state->ctx)) return;
242 state->netlogon_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
244 dcerpc_bind_auth_password(state->netlogon_pipe,
245 DCERPC_NETLOGON_UUID,
246 DCERPC_NETLOGON_VERSION,
247 state->domain->schannel_creds,
248 DCERPC_AUTH_TYPE_SCHANNEL,
250 if (!composite_is_ok(state->ctx)) return;
252 ctx = wb_connect_lsa_send(state->conn.out.tree,
253 state->domain->schannel_creds);
254 composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
257 static void init_domain_recv_lsa(struct composite_context *ctx)
259 struct init_domain_state *state =
260 talloc_get_type(ctx->async.private_data,
261 struct init_domain_state);
263 struct rpc_request *req;
265 state->ctx->status = wb_connect_lsa_recv(ctx, state,
266 &state->domain->lsa_auth_type,
269 if (!composite_is_ok(state->ctx)) return;
271 if (state->auth2_pipe == NULL) {
272 /* Give the tree to the LSA pipe. If auth2_pipe exists we have
273 * given it to that already */
274 talloc_unlink(state, state->conn.out.tree);
275 state->conn.out.tree = NULL;
278 state->queryinfo.in.handle = state->lsa_policy;
279 state->queryinfo.in.level = LSA_POLICY_INFO_ACCOUNT_DOMAIN;
281 req = dcerpc_lsa_QueryInfoPolicy_send(state->lsa_pipe, state,
283 composite_continue_rpc(state->ctx, req,
284 init_domain_recv_queryinfo, state);
287 static void init_domain_recv_queryinfo(struct rpc_request *req)
289 struct init_domain_state *state =
290 talloc_get_type(req->async.private, struct init_domain_state);
291 struct lsa_DomainInfo *dominfo;
292 struct composite_context *ctx;
294 state->ctx->status = dcerpc_ndr_request_recv(req);
295 if (!composite_is_ok(state->ctx)) return;
296 state->ctx->status = state->queryinfo.out.result;
297 if (!composite_is_ok(state->ctx)) return;
299 dominfo = &state->queryinfo.out.info->account_domain;
301 if (strcasecmp(state->domain->name, dominfo->name.string) != 0) {
302 DEBUG(2, ("Expected domain name %s, DC %s said %s\n",
304 dcerpc_server_name(state->lsa_pipe),
305 dominfo->name.string));
306 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
310 if (!dom_sid_equal(state->domain->sid, dominfo->sid)) {
311 DEBUG(2, ("Expected domain sid %s, DC %s said %s\n",
312 dom_sid_string(state, state->domain->sid),
313 dcerpc_server_name(state->lsa_pipe),
314 dom_sid_string(state, dominfo->sid)));
315 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
319 state->samr_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx);
320 if (composite_nomem(state->samr_pipe, state->ctx)) return;
322 ctx = wb_connect_sam_send(state->conn.out.tree,
323 state->domain->lsa_auth_type,
324 state->domain->schannel_creds,
326 composite_continue(state->ctx, ctx,
327 init_domain_recv_samr, state);
330 static void init_domain_recv_samr(struct composite_context *ctx)
332 struct init_domain_state *state =
333 talloc_get_type(ctx->async.private_data,
334 struct init_domain_state);
336 state->ctx->status = wb_connect_sam_recv(ctx, state, &state->samr_pipe,
338 &state->domain_handle);
339 if (!composite_is_ok(state->ctx)) return;
341 composite_done(state->ctx);
344 NTSTATUS wb_init_domain_recv(struct composite_context *c)
346 NTSTATUS status = composite_wait(c);
347 if (NT_STATUS_IS_OK(status)) {
348 struct init_domain_state *state =
349 talloc_get_type(c->private_data,
350 struct init_domain_state);
351 struct wbsrv_domain *domain = state->domain;
353 talloc_free(domain->netlogon_auth2_pipe);
354 domain->netlogon_auth2_pipe =
355 talloc_steal(domain, state->auth2_pipe);
357 talloc_free(domain->netlogon_pipe);
358 domain->netlogon_pipe =
359 talloc_steal(domain, state->netlogon_pipe);
361 talloc_free(domain->lsa_pipe);
363 talloc_steal(domain, state->lsa_pipe);
365 talloc_free(domain->lsa_policy);
367 talloc_steal(domain, state->lsa_policy);
369 talloc_free(domain->samr_pipe);
371 talloc_steal(domain, state->samr_pipe);
373 talloc_free(domain->samr_handle);
374 domain->samr_handle =
375 talloc_steal(domain, state->samr_handle);
377 talloc_free(domain->domain_handle);
378 domain->domain_handle =
379 talloc_steal(domain, state->domain_handle);
381 domain->initialized = True;
387 NTSTATUS wb_init_domain(struct wbsrv_domain *domain,
388 struct event_context *event_ctx,
389 struct messaging_context *messaging_ctx)
391 struct composite_context *c =
392 wb_init_domain_send(domain, event_ctx, messaging_ctx);
393 return wb_init_domain_recv(c);
396 struct queue_domain_state {
397 struct queue_domain_state *prev, *next;
398 struct composite_context *ctx;
399 struct wbsrv_domain *domain;
400 struct composite_context *(*send_fn)(void *p);
401 NTSTATUS (*recv_fn)(struct composite_context *c,
406 static void queue_domain_recv_init(struct composite_context *ctx);
407 static void queue_domain_recv_sub(struct composite_context *ctx);
409 struct composite_context *wb_queue_domain_send(TALLOC_CTX *mem_ctx,
410 struct wbsrv_domain *domain,
411 struct event_context *event_ctx,
412 struct messaging_context *msg_ctx,
413 struct composite_context *(*send_fn)(void *p),
414 NTSTATUS (*recv_fn)(struct composite_context *c,
418 struct composite_context *result, *ctx;
419 struct queue_domain_state *state;
421 result = talloc(mem_ctx, struct composite_context);
422 if (result == NULL) goto failed;
423 result->state = COMPOSITE_STATE_IN_PROGRESS;
424 result->async.fn = NULL;
425 result->event_ctx = event_ctx;
427 state = talloc(result, struct queue_domain_state);
428 if (state == NULL) goto failed;
430 result->private_data = state;
432 state->send_fn = send_fn;
433 state->recv_fn = recv_fn;
434 state->private_data = private_data;
435 state->domain = domain;
438 DEBUG(0, ("Domain %s busy\n", domain->name));
439 DLIST_ADD_END(domain->request_queue, state,
440 struct queue_domain_state *);
446 if (!domain->initialized) {
447 ctx = wb_init_domain_send(domain, result->event_ctx, msg_ctx);
448 if (ctx == NULL) goto failed;
449 ctx->async.fn = queue_domain_recv_init;
450 ctx->async.private_data = state;
454 ctx = state->send_fn(state->private_data);
455 if (ctx == NULL) goto failed;
456 ctx->async.fn = queue_domain_recv_sub;
457 ctx->async.private_data = state;
465 static void queue_domain_recv_init(struct composite_context *ctx)
467 struct queue_domain_state *state =
468 talloc_get_type(ctx->async.private_data,
469 struct queue_domain_state);
471 state->ctx->status = wb_init_domain_recv(ctx);
472 if (!composite_is_ok(state->ctx)) return;
474 ctx = state->send_fn(state->private_data);
475 composite_continue(state->ctx, ctx, queue_domain_recv_sub, state);
478 static void queue_domain_recv_sub(struct composite_context *ctx)
480 struct queue_domain_state *state =
481 talloc_get_type(ctx->async.private_data,
482 struct queue_domain_state);
484 state->ctx->status = state->recv_fn(ctx, state->private_data);
485 state->domain->busy = False;
487 if (state->domain->request_queue != NULL) {
488 struct queue_domain_state *s2;
489 s2 = state->domain->request_queue;
490 DLIST_REMOVE(state->domain->request_queue, s2);
491 ctx = s2->send_fn(s2->private_data);
492 composite_continue(s2->ctx, ctx, queue_domain_recv_sub, s2);
493 state->domain->busy = True;
496 if (!composite_is_ok(state->ctx)) return;
497 composite_done(state->ctx);
500 NTSTATUS wb_queue_domain_recv(struct composite_context *ctx)
502 NTSTATUS status = composite_wait(ctx);