From 012893cb421d77efc538c9f4c78b2421aef3f06e Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Mon, 3 Oct 2005 17:36:49 +0000 Subject: [PATCH] r10691: This gets half-way to wbinfo -n. It acquires an lsa pipe, and does a queryinfopolicy. Idea is to get a consistency check between that and our notion of the domain name and sid, and take the lsa pipe as the holder of the central smbcli_tree that netlogon and samr use as well. Volker (This used to be commit 126c80aefc4f53c4ba79afc12d70602ef9055ddb) --- source4/include/structs.h | 1 + source4/winbind/config.mk | 2 +- source4/winbind/wb_async_helpers.c | 328 ++++++++++++++++++++++++++- source4/winbind/wb_async_helpers.h | 12 + source4/winbind/wb_samba3_cmd.c | 77 +++++++ source4/winbind/wb_samba3_protocol.c | 3 + source4/winbind/wb_server.h | 1 + 7 files changed, 418 insertions(+), 6 deletions(-) diff --git a/source4/include/structs.h b/source4/include/structs.h index 896e69c1a3a..582aee1332b 100644 --- a/source4/include/structs.h +++ b/source4/include/structs.h @@ -257,6 +257,7 @@ struct wins_server; struct wb_finddcs; struct wb_get_schannel_creds; +struct wb_get_lsa_pipe; struct cldap_socket; struct cldapd_server; diff --git a/source4/winbind/config.mk b/source4/winbind/config.mk index 5f055768c03..3b56eea552c 100644 --- a/source4/winbind/config.mk +++ b/source4/winbind/config.mk @@ -10,6 +10,6 @@ INIT_OBJ_FILES = \ winbind/wb_samba3_protocol.o \ winbind/wb_samba3_cmd.o \ winbind/wb_async_helpers.o -REQUIRED_SUBSYSTEMS = +REQUIRED_SUBSYSTEMS = RPC_NDR_LSA # End MODULE server_service_winbind ################################################ diff --git a/source4/winbind/wb_async_helpers.c b/source4/winbind/wb_async_helpers.c index 89286bccf17..e03c6bccefb 100644 --- a/source4/winbind/wb_async_helpers.c +++ b/source4/winbind/wb_async_helpers.c @@ -23,6 +23,7 @@ #include "includes.h" #include "libcli/composite/composite.h" +#include "libcli/smb_composite/smb_composite.h" #include "winbind/wb_async_helpers.h" #include "librpc/gen_ndr/nbt.h" @@ -32,6 +33,7 @@ #include "librpc/gen_ndr/ndr_irpc.h" #include "libcli/raw/libcliraw.h" #include "librpc/gen_ndr/ndr_netlogon.h" +#include "librpc/gen_ndr/ndr_lsa.h" #include "libcli/auth/credentials.h" struct finddcs_state { @@ -213,7 +215,7 @@ struct get_schannel_creds_state { struct wb_get_schannel_creds *io; struct netr_ServerReqChallenge *r; - struct creds_CredentialState creds_state; + struct creds_CredentialState *creds_state; struct netr_Credential netr_cred; uint32_t negotiate_flags; struct netr_ServerAuthenticate2 *a; @@ -327,15 +329,16 @@ static void get_schannel_creds_recv_chal(struct rpc_request *req) state->ctx->status = state->r->out.result; if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + state->creds_state = talloc(state, struct creds_CredentialState); mach_pwd = cli_credentials_get_nt_hash(state->io->in.creds, state); - if (mach_pwd == NULL) { + if ((state->creds_state == NULL) || (mach_pwd == NULL)) { state->ctx->status = NT_STATUS_NO_MEMORY; goto done; } state->negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS; - creds_client_init(&state->creds_state, state->r->in.credentials, + creds_client_init(state->creds_state, state->r->in.credentials, state->r->out.credentials, mach_pwd, &state->netr_cred, state->negotiate_flags); @@ -388,12 +391,20 @@ static void get_schannel_creds_recv_auth(struct rpc_request *req) struct get_schannel_creds_state); state->ctx->status = dcerpc_ndr_request_recv(req); - DEBUG(5, ("result: %s\n", nt_errstr(state->ctx->status))); if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; state->ctx->status = state->a->out.result; - DEBUG(5, ("result: %s\n", nt_errstr(state->ctx->status))); if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + if (!creds_client_check(state->creds_state, + state->a->out.credentials)) { + DEBUG(5, ("Server got us invalid creds\n")); + state->ctx->status = NT_STATUS_UNSUCCESSFUL; + goto done; + } + + cli_credentials_set_netlogon_creds(state->io->in.creds, + state->creds_state); + state->ctx->state = COMPOSITE_STATE_DONE; done: @@ -425,3 +436,310 @@ NTSTATUS wb_get_schannel_creds(struct wb_get_schannel_creds *io, struct composite_context *c = wb_get_schannel_creds_send(io, ev); return wb_get_schannel_creds_recv(c, mem_ctx); } + +struct get_lsa_pipe_state { + struct composite_context *ctx; + struct wb_get_lsa_pipe *io; + struct wb_finddcs *finddcs; + struct smb_composite_connect *conn; + struct dcerpc_pipe *lsa_pipe; + + struct lsa_ObjectAttribute objectattr; + struct lsa_OpenPolicy2 openpolicy; + struct policy_handle policy_handle; + + struct lsa_QueryInfoPolicy queryinfo; + + struct lsa_Close close; +}; + +static void get_lsa_pipe_recv_dcs(struct composite_context *ctx); +static void get_lsa_pipe_recv_tree(struct composite_context *ctx); +static void get_lsa_pipe_recv_pipe(struct composite_context *ctx); +static void get_lsa_pipe_recv_openpol(struct rpc_request *req); +static void get_lsa_pipe_recv_queryinfo(struct rpc_request *req); +static void get_lsa_pipe_recv_close(struct rpc_request *req); + +struct composite_context *wb_get_lsa_pipe_send(struct wb_get_lsa_pipe *io) +{ + struct composite_context *result, *ctx; + struct get_lsa_pipe_state *state; + + result = talloc_zero(NULL, struct composite_context); + if (result == NULL) goto failed; + result->state = COMPOSITE_STATE_IN_PROGRESS; + result->event_ctx = io->in.event_ctx; + + state = talloc(result, struct get_lsa_pipe_state); + if (state == NULL) goto failed; + result->private_data = state; + + state->io = io; + + state->finddcs = talloc(state, struct wb_finddcs); + if (state->finddcs == NULL) goto failed; + + state->finddcs->in.msg_ctx = io->in.msg_ctx; + state->finddcs->in.domain = lp_workgroup(); + + ctx = wb_finddcs_send(state->finddcs, io->in.event_ctx); + if (ctx == NULL) goto failed; + + ctx->async.fn = get_lsa_pipe_recv_dcs; + ctx->async.private_data = state; + state->ctx = result; + return result; + + failed: + talloc_free(result); + return NULL; +} + +static void get_lsa_pipe_recv_dcs(struct composite_context *ctx) +{ + struct get_lsa_pipe_state *state = + talloc_get_type(ctx->async.private_data, + struct get_lsa_pipe_state); + + state->ctx->status = wb_finddcs_recv(ctx, state); + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + + state->conn = talloc(state, struct smb_composite_connect); + if (state->conn == NULL) { + state->ctx->status = NT_STATUS_NO_MEMORY; + goto done; + } + + state->conn->in.dest_host = state->finddcs->out.dcs[0].address; + state->conn->in.port = 0; + state->conn->in.called_name = state->finddcs->out.dcs[0].name; + state->conn->in.service = "IPC$"; + state->conn->in.service_type = "IPC"; + state->conn->in.workgroup = lp_workgroup(); + + state->conn->in.credentials = cli_credentials_init(state->conn); + if (state->conn->in.credentials == NULL) { + state->ctx->status = NT_STATUS_NO_MEMORY; + goto done; + } + cli_credentials_set_conf(state->conn->in.credentials); + cli_credentials_set_anonymous(state->conn->in.credentials); + + ctx = smb_composite_connect_send(state->conn, state, + state->ctx->event_ctx); + if (ctx == NULL) { + state->ctx->status = NT_STATUS_NO_MEMORY; + goto done; + } + + ctx->async.fn = get_lsa_pipe_recv_tree; + ctx->async.private_data = state; + return; + + done: + if (!NT_STATUS_IS_OK(state->ctx->status)) { + state->ctx->state = COMPOSITE_STATE_ERROR; + } + if ((state->ctx->state >= COMPOSITE_STATE_DONE) && + (state->ctx->async.fn != NULL)) { + state->ctx->async.fn(state->ctx); + } +} + +static void get_lsa_pipe_recv_tree(struct composite_context *ctx) +{ + struct get_lsa_pipe_state *state = + talloc_get_type(ctx->async.private_data, + struct get_lsa_pipe_state); + + state->ctx->status = smb_composite_connect_recv(ctx, state); + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + + state->lsa_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx); + if (state->lsa_pipe == NULL) { + state->ctx->status = NT_STATUS_NO_MEMORY; + goto done; + } + + ctx = dcerpc_pipe_open_smb_send(state->lsa_pipe->conn, + state->conn->out.tree, "\\lsarpc"); + if (ctx == NULL) { + state->ctx->status = NT_STATUS_NO_MEMORY; + goto done; + } + + ctx->async.fn = get_lsa_pipe_recv_pipe; + ctx->async.private_data = state; + return; + + done: + if (!NT_STATUS_IS_OK(state->ctx->status)) { + state->ctx->state = COMPOSITE_STATE_ERROR; + } + if ((state->ctx->state >= COMPOSITE_STATE_DONE) && + (state->ctx->async.fn != NULL)) { + state->ctx->async.fn(state->ctx); + } +} + +static void get_lsa_pipe_recv_pipe(struct composite_context *ctx) +{ + struct get_lsa_pipe_state *state = + talloc_get_type(ctx->async.private_data, + struct get_lsa_pipe_state); + struct rpc_request *req; + + state->ctx->status = dcerpc_pipe_open_smb_recv(ctx); + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + + talloc_unlink(state, state->conn->out.tree); /* The pipe owns it now */ + state->conn->out.tree = NULL; + + state->ctx->status = dcerpc_bind_auth_none(state->lsa_pipe, + DCERPC_LSARPC_UUID, + DCERPC_LSARPC_VERSION); + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + + ZERO_STRUCT(state->openpolicy); + state->openpolicy.in.system_name = + talloc_asprintf(state, "\\\\%s", + dcerpc_server_name(state->lsa_pipe)); + ZERO_STRUCT(state->objectattr); + state->openpolicy.in.attr = &state->objectattr; + state->openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + state->openpolicy.out.handle = &state->policy_handle; + + req = dcerpc_lsa_OpenPolicy2_send(state->lsa_pipe, state, + &state->openpolicy); + if (req == NULL) { + state->ctx->status = NT_STATUS_NO_MEMORY; + goto done; + } + + req->async.callback = get_lsa_pipe_recv_openpol; + req->async.private = state; + return; + + done: + if (!NT_STATUS_IS_OK(state->ctx->status)) { + state->ctx->state = COMPOSITE_STATE_ERROR; + } + if ((state->ctx->state >= COMPOSITE_STATE_DONE) && + (state->ctx->async.fn != NULL)) { + state->ctx->async.fn(state->ctx); + } +} + +static void get_lsa_pipe_recv_openpol(struct rpc_request *req) +{ + struct get_lsa_pipe_state *state = + talloc_get_type(req->async.private, struct get_lsa_pipe_state); + + state->ctx->status = dcerpc_ndr_request_recv(req); + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + state->ctx->status = state->openpolicy.out.result; + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + + ZERO_STRUCT(state->queryinfo); + state->queryinfo.in.handle = &state->policy_handle; + state->queryinfo.in.level = LSA_POLICY_INFO_ACCOUNT_DOMAIN; + + req = dcerpc_lsa_QueryInfoPolicy_send(state->lsa_pipe, state, + &state->queryinfo); + if (req == NULL) { + state->ctx->status = NT_STATUS_NO_MEMORY; + goto done; + } + + req->async.callback = get_lsa_pipe_recv_queryinfo; + req->async.private = state; + return; + + done: + if (!NT_STATUS_IS_OK(state->ctx->status)) { + state->ctx->state = COMPOSITE_STATE_ERROR; + } + if ((state->ctx->state >= COMPOSITE_STATE_DONE) && + (state->ctx->async.fn != NULL)) { + state->ctx->async.fn(state->ctx); + } +} + +static void get_lsa_pipe_recv_queryinfo(struct rpc_request *req) +{ + struct get_lsa_pipe_state *state = + talloc_get_type(req->async.private, struct get_lsa_pipe_state); + + state->ctx->status = dcerpc_ndr_request_recv(req); + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + state->ctx->status = state->queryinfo.out.result; + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + + ZERO_STRUCT(state->close); + state->close.in.handle = &state->policy_handle; + state->close.out.handle = &state->policy_handle; + + req = dcerpc_lsa_Close_send(state->lsa_pipe, state, + &state->close); + if (req == NULL) { + state->ctx->status = NT_STATUS_NO_MEMORY; + goto done; + } + + req->async.callback = get_lsa_pipe_recv_close; + req->async.private = state; + return; + + done: + if (!NT_STATUS_IS_OK(state->ctx->status)) { + state->ctx->state = COMPOSITE_STATE_ERROR; + } + if ((state->ctx->state >= COMPOSITE_STATE_DONE) && + (state->ctx->async.fn != NULL)) { + state->ctx->async.fn(state->ctx); + } +} + +static void get_lsa_pipe_recv_close(struct rpc_request *req) +{ + struct get_lsa_pipe_state *state = + talloc_get_type(req->async.private, struct get_lsa_pipe_state); + + state->ctx->status = dcerpc_ndr_request_recv(req); + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + state->ctx->status = state->close.out.result; + if (!NT_STATUS_IS_OK(state->ctx->status)) goto done; + + state->ctx->state = COMPOSITE_STATE_DONE; + + done: + if (!NT_STATUS_IS_OK(state->ctx->status)) { + state->ctx->state = COMPOSITE_STATE_ERROR; + } + if ((state->ctx->state >= COMPOSITE_STATE_DONE) && + (state->ctx->async.fn != NULL)) { + state->ctx->async.fn(state->ctx); + } +} + +NTSTATUS wb_get_lsa_pipe_recv(struct composite_context *c, + TALLOC_CTX *mem_ctx) +{ + NTSTATUS status = composite_wait(c); + struct get_lsa_pipe_state *state = + talloc_get_type(c->private_data, + struct get_lsa_pipe_state); + state->io->out.domain_sid = + talloc_steal(mem_ctx, state->queryinfo.out.info->domain.sid); + state->io->out.pipe = + talloc_steal(mem_ctx, state->lsa_pipe); + talloc_free(c); + return status; +} + +NTSTATUS wb_get_lsa_pipe(struct wb_get_lsa_pipe *io, + TALLOC_CTX *mem_ctx) +{ + struct composite_context *c = wb_get_lsa_pipe_send(io); + return wb_get_lsa_pipe_recv(c, mem_ctx); +} diff --git a/source4/winbind/wb_async_helpers.h b/source4/winbind/wb_async_helpers.h index b37a66e972d..e3de3125901 100644 --- a/source4/winbind/wb_async_helpers.h +++ b/source4/winbind/wb_async_helpers.h @@ -44,3 +44,15 @@ struct wb_get_schannel_creds { struct dcerpc_pipe *netlogon; } out; }; + +struct wb_get_lsa_pipe { + struct { + struct event_context *event_ctx; + struct messaging_context *msg_ctx; + const char *domain; + } in; + struct { + const struct dom_sid *domain_sid; + struct dcerpc_pipe *pipe; + } out; +}; diff --git a/source4/winbind/wb_samba3_cmd.c b/source4/winbind/wb_samba3_cmd.c index d4bfbd6219d..751c48f8fd6 100644 --- a/source4/winbind/wb_samba3_cmd.c +++ b/source4/winbind/wb_samba3_cmd.c @@ -311,3 +311,80 @@ static void wbsrv_samba3_check_machacc_receive_creds(struct composite_context *a return; } } + +struct lookupname_state { + struct wbsrv_samba3_call *s3call; + struct wb_get_lsa_pipe *getlsa; +}; + +static void lookupname_recv_lsa(struct composite_context *req); + +NTSTATUS wbsrv_samba3_lookupname(struct wbsrv_samba3_call *s3call) +{ + struct composite_context *ctx; + struct lookupname_state *state; + struct wbsrv_service *service = + s3call->call->wbconn->listen_socket->service; + + DEBUG(5, ("wbsrv_samba3_lookupname called\n")); + + talloc_free(service->lsa_pipe); + service->lsa_pipe = NULL; + + state = talloc(s3call, struct lookupname_state); + NT_STATUS_HAVE_NO_MEMORY(state); + + state->s3call = s3call; + state->getlsa = talloc(s3call, struct wb_get_lsa_pipe); + NT_STATUS_HAVE_NO_MEMORY(state->getlsa); + + state->getlsa->in.msg_ctx = s3call->call->wbconn->conn->msg_ctx; + state->getlsa->in.event_ctx = s3call->call->event_ctx; + state->getlsa->in.domain = lp_workgroup(); + + ctx = wb_get_lsa_pipe_send(state->getlsa); + NT_STATUS_HAVE_NO_MEMORY(ctx); + + /* setup the callbacks */ + ctx->async.fn = lookupname_recv_lsa; + ctx->async.private_data = state; + + /* tell the caller we reply later */ + s3call->call->flags |= WBSRV_CALL_FLAGS_REPLY_ASYNC; + return NT_STATUS_OK; +} + +static void lookupname_recv_lsa(struct composite_context *ctx) +{ + struct lookupname_state *state = + talloc_get_type(ctx->async.private_data, + struct lookupname_state); + struct wbsrv_service *service = + state->s3call->call->wbconn->listen_socket->service; + NTSTATUS status; + + status = wb_get_lsa_pipe_recv(ctx, service); + if (!NT_STATUS_IS_OK(status)) goto done; + + service->lsa_pipe = state->getlsa->out.pipe; + + done: + if (!NT_STATUS_IS_OK(status)) { + struct winbindd_response *resp = &state->s3call->response; + resp->result = WINBINDD_ERROR; + WBSRV_SAMBA3_SET_STRING(resp->data.auth.nt_status_string, + nt_errstr(status)); + WBSRV_SAMBA3_SET_STRING(resp->data.auth.error_string, + nt_errstr(status)); + resp->data.auth.pam_error = nt_status_to_pam(status); + + } + + status = wbsrv_send_reply(state->s3call->call); + if (!NT_STATUS_IS_OK(status)) { + wbsrv_terminate_connection(state->s3call->call->wbconn, + "wbsrv_queue_reply() failed"); + return; + } + +} diff --git a/source4/winbind/wb_samba3_protocol.c b/source4/winbind/wb_samba3_protocol.c index d7e32daddb3..f5e6fb71cf7 100644 --- a/source4/winbind/wb_samba3_protocol.c +++ b/source4/winbind/wb_samba3_protocol.c @@ -90,6 +90,9 @@ NTSTATUS wbsrv_samba3_handle_call(struct wbsrv_call *call) case WINBINDD_PRIV_PIPE_DIR: return wbsrv_samba3_priv_pipe_dir(s3call); + + case WINBINDD_LOOKUPNAME: + return wbsrv_samba3_lookupname(s3call); } s3call->response.result = WINBINDD_ERROR; diff --git a/source4/winbind/wb_server.h b/source4/winbind/wb_server.h index 3838354d527..e90ea7f0a72 100644 --- a/source4/winbind/wb_server.h +++ b/source4/winbind/wb_server.h @@ -33,6 +33,7 @@ struct wbsrv_service { struct task_server *task; struct dcerpc_pipe *netlogon; + struct dcerpc_pipe *lsa_pipe; }; /* -- 2.34.1