e201814163233b7eb43dca2d94d9b50f71168d77
[ira/wip.git] / source3 / libsmb / trusts_util.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Routines to operate on various trust relationships
4  *  Copyright (C) Andrew Bartlett                   2001
5  *  Copyright (C) Rafal Szczesniak                  2003
6  *
7  *  This program is free software; you can redistribute it and/or modify
8  *  it under the terms of the GNU General Public License as published by
9  *  the Free Software Foundation; either version 3 of the License, or
10  *  (at your option) any later version.
11  *  
12  *  This program is distributed in the hope that it will be useful,
13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  *  GNU General Public License for more details.
16  *  
17  *  You should have received a copy of the GNU General Public License
18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20
21 #include "includes.h"
22 #include "../libcli/auth/libcli_auth.h"
23
24 /*********************************************************
25  Change the domain password on the PDC.
26  Store the password ourselves, but use the supplied password
27  Caller must have already setup the connection to the NETLOGON pipe
28 **********************************************************/
29
30 NTSTATUS trust_pw_change_and_store_it(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx, 
31                                       const char *domain,
32                                       const char *account_name,
33                                       unsigned char orig_trust_passwd_hash[16],
34                                       uint32 sec_channel_type)
35 {
36         unsigned char new_trust_passwd_hash[16];
37         char *new_trust_passwd;
38         NTSTATUS nt_status;
39
40         /* Create a random machine account password */
41         new_trust_passwd = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
42
43         if (new_trust_passwd == NULL) {
44                 DEBUG(0, ("talloc_strdup failed\n"));
45                 return NT_STATUS_NO_MEMORY;
46         }
47
48         E_md4hash(new_trust_passwd, new_trust_passwd_hash);
49
50         nt_status = rpccli_netlogon_set_trust_password(cli, mem_ctx,
51                                                        account_name,
52                                                        orig_trust_passwd_hash,
53                                                        new_trust_passwd,
54                                                        new_trust_passwd_hash,
55                                                        sec_channel_type);
56
57         if (NT_STATUS_IS_OK(nt_status)) {
58                 DEBUG(3,("%s : trust_pw_change_and_store_it: Changed password.\n", 
59                          current_timestring(debug_ctx(), False)));
60                 /*
61                  * Return the result of trying to write the new password
62                  * back into the trust account file.
63                  */
64                 if (!secrets_store_machine_password(new_trust_passwd, domain, sec_channel_type)) {
65                         nt_status = NT_STATUS_UNSUCCESSFUL;
66                 }
67         }
68
69         return nt_status;
70 }
71
72 /*********************************************************
73  Change the domain password on the PDC.
74  Do most of the legwork ourselfs.  Caller must have
75  already setup the connection to the NETLOGON pipe
76 **********************************************************/
77
78 NTSTATUS trust_pw_find_change_and_store_it(struct rpc_pipe_client *cli, 
79                                            TALLOC_CTX *mem_ctx, 
80                                            const char *domain) 
81 {
82         unsigned char old_trust_passwd_hash[16];
83         uint32 sec_channel_type = 0;
84
85         if (!secrets_fetch_trust_account_password(domain,
86                                                   old_trust_passwd_hash, 
87                                                   NULL, &sec_channel_type)) {
88                 DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain));
89                 return NT_STATUS_UNSUCCESSFUL;
90         }
91
92         return trust_pw_change_and_store_it(cli, mem_ctx, domain,
93                                             global_myname(),
94                                             old_trust_passwd_hash,
95                                             sec_channel_type);
96 }
97
98 /*********************************************************************
99  Enumerate the list of trusted domains from a DC
100 *********************************************************************/
101
102 bool enumerate_domain_trusts( TALLOC_CTX *mem_ctx, const char *domain,
103                                      char ***domain_names, uint32 *num_domains,
104                                      DOM_SID **sids )
105 {
106         struct policy_handle    pol;
107         NTSTATUS        result = NT_STATUS_UNSUCCESSFUL;
108         fstring         dc_name;
109         struct sockaddr_storage dc_ss;
110         uint32          enum_ctx = 0;
111         struct cli_state *cli = NULL;
112         struct rpc_pipe_client *lsa_pipe;
113         bool            retry;
114         struct lsa_DomainList dom_list;
115         int i;
116
117         *domain_names = NULL;
118         *num_domains = 0;
119         *sids = NULL;
120
121         /* lookup a DC first */
122
123         if ( !get_dc_name(domain, NULL, dc_name, &dc_ss) ) {
124                 DEBUG(3,("enumerate_domain_trusts: can't locate a DC for domain %s\n",
125                         domain));
126                 return False;
127         }
128
129         /* setup the anonymous connection */
130
131         result = cli_full_connection( &cli, global_myname(), dc_name, &dc_ss, 0, "IPC$", "IPC",
132                 "", "", "", 0, Undefined, &retry);
133         if ( !NT_STATUS_IS_OK(result) )
134                 goto done;
135
136         /* open the LSARPC_PIPE */
137
138         result = cli_rpc_pipe_open_noauth(cli, &ndr_table_lsarpc.syntax_id,
139                                           &lsa_pipe);
140         if (!NT_STATUS_IS_OK(result)) {
141                 goto done;
142         }
143
144         /* get a handle */
145
146         result = rpccli_lsa_open_policy(lsa_pipe, mem_ctx, True,
147                 LSA_POLICY_VIEW_LOCAL_INFORMATION, &pol);
148         if ( !NT_STATUS_IS_OK(result) )
149                 goto done;
150
151         /* Lookup list of trusted domains */
152
153         result = rpccli_lsa_EnumTrustDom(lsa_pipe, mem_ctx,
154                                          &pol,
155                                          &enum_ctx,
156                                          &dom_list,
157                                          (uint32_t)-1);
158         if ( !NT_STATUS_IS_OK(result) )
159                 goto done;
160
161         *num_domains = dom_list.count;
162
163         *domain_names = TALLOC_ZERO_ARRAY(mem_ctx, char *, *num_domains);
164         if (!*domain_names) {
165                 result = NT_STATUS_NO_MEMORY;
166                 goto done;
167         }
168
169         *sids = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, *num_domains);
170         if (!*sids) {
171                 result = NT_STATUS_NO_MEMORY;
172                 goto done;
173         }
174
175         for (i=0; i< *num_domains; i++) {
176                 (*domain_names)[i] = CONST_DISCARD(char *, dom_list.domains[i].name.string);
177                 (*sids)[i] = *dom_list.domains[i].sid;
178         }
179
180 done:
181         /* cleanup */
182         if (cli) {
183                 DEBUG(10,("enumerate_domain_trusts: shutting down connection...\n"));
184                 cli_shutdown( cli );
185         }
186
187         return NT_STATUS_IS_OK(result);
188 }