Copyright (C) Tim Potter 2000
Copyright (C) Andrew Bartlett 2002
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "winbindd.h"
+#include "../librpc/gen_ndr/cli_netlogon.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_WINBIND
-/* Check the machine account password is valid */
+/* Constants and helper functions for determining domain trust types */
-void winbindd_check_machine_acct(struct winbindd_cli_state *state)
-{
- DEBUG(3, ("[%5lu]: check machine account\n",
- (unsigned long)state->pid));
+enum trust_type {
+ EXTERNAL = 0,
+ FOREST,
+ IN_FOREST,
+ NONE,
+};
- sendto_domain(state, find_our_domain());
-}
+const char *trust_type_strings[] = {"External",
+ "Forest",
+ "In Forest",
+ "None"};
-enum winbindd_result winbindd_dual_check_machine_acct(struct winbindd_domain *domain,
- struct winbindd_cli_state *state)
+static enum trust_type get_trust_type(struct winbindd_tdc_domain *domain)
{
- NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
- int num_retries = 0;
- struct winbindd_domain *contact_domain;
-
- DEBUG(3, ("[%5lu]: check machine account\n", (unsigned long)state->pid));
-
- /* Get trust account password */
-
- again:
-
- contact_domain = find_our_domain();
-
- /* This call does a cli_nt_setup_creds() which implicitly checks
- the trust account password. */
-
- invalidate_cm_connection(&contact_domain->conn);
-
- {
- struct rpc_pipe_client *netlogon_pipe;
- result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
- }
-
- if (!NT_STATUS_IS_OK(result)) {
- DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
- goto done;
- }
-
- /* There is a race condition between fetching the trust account
- password and the periodic machine password change. So it's
- possible that the trust account password has been changed on us.
- We are returned NT_STATUS_ACCESS_DENIED if this happens. */
-
-#define MAX_RETRIES 8
-
- if ((num_retries < MAX_RETRIES) &&
- NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED)) {
- num_retries++;
- goto again;
- }
-
- /* Pass back result code - zero for success, other values for
- specific failures. */
+ if (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN)
+ return EXTERNAL;
+ else if (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE)
+ return FOREST;
+ else if (((domain->trust_flags & NETR_TRUST_FLAG_IN_FOREST) == NETR_TRUST_FLAG_IN_FOREST) &&
+ ((domain->trust_flags & NETR_TRUST_FLAG_PRIMARY) == 0x0))
+ return IN_FOREST;
+ return NONE;
+}
- DEBUG(3, ("secret is %s\n", NT_STATUS_IS_OK(result) ?
- "good" : "bad"));
+static const char *get_trust_type_string(struct winbindd_tdc_domain *domain)
+{
+ return trust_type_strings[get_trust_type(domain)];
+}
- done:
- state->response.data.auth.nt_status = NT_STATUS_V(result);
- fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
- fstrcpy(state->response.data.auth.error_string, nt_errstr(result));
- state->response.data.auth.pam_error = nt_status_to_pam(result);
+static bool trust_is_inbound(struct winbindd_tdc_domain *domain)
+{
+ return (domain->trust_flags == 0x0) ||
+ ((domain->trust_flags & NETR_TRUST_FLAG_IN_FOREST) ==
+ NETR_TRUST_FLAG_IN_FOREST) ||
+ ((domain->trust_flags & NETR_TRUST_FLAG_INBOUND) ==
+ NETR_TRUST_FLAG_INBOUND);
+}
- DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Checking the trust account password returned %s\n",
- state->response.data.auth.nt_status_string));
+static bool trust_is_outbound(struct winbindd_tdc_domain *domain)
+{
+ return (domain->trust_flags == 0x0) ||
+ ((domain->trust_flags & NETR_TRUST_FLAG_IN_FOREST) ==
+ NETR_TRUST_FLAG_IN_FOREST) ||
+ ((domain->trust_flags & NETR_TRUST_FLAG_OUTBOUND) ==
+ NETR_TRUST_FLAG_OUTBOUND);
+}
- return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
+static bool trust_is_transitive(struct winbindd_tdc_domain *domain)
+{
+ if ((domain->trust_attribs == NETR_TRUST_ATTRIBUTE_NON_TRANSITIVE) ||
+ (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) ||
+ (domain->trust_attribs == NETR_TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL))
+ return False;
+ return True;
}
void winbindd_list_trusted_domains(struct winbindd_cli_state *state)
{
- struct winbindd_domain *d = NULL;
+ struct winbindd_tdc_domain *dom_list = NULL;
+ struct winbindd_tdc_domain *d = NULL;
+ size_t num_domains = 0;
int extra_data_len = 0;
char *extra_data = NULL;
-
+ int i = 0;
+
DEBUG(3, ("[%5lu]: list trusted domains\n",
(unsigned long)state->pid));
- for ( d=domain_list(); d; d=d->next ) {
+ if( !wcache_tdc_fetch_list( &dom_list, &num_domains )) {
+ request_error(state);
+ goto done;
+ }
+
+ for ( i = 0; i < num_domains; i++ ) {
+ struct winbindd_domain *domain;
+ bool is_online = true;
+
+ d = &dom_list[i];
+ domain = find_domain_from_name_noinit(d->domain_name);
+ if (domain) {
+ is_online = domain->online;
+ }
+
if ( !extra_data ) {
- extra_data = talloc_asprintf(
- state->mem_ctx, "%s\\%s\\%s",
- d->name, d->alt_name ? d->alt_name : d->name,
- sid_string_talloc(state->mem_ctx, &d->sid));
+ extra_data = talloc_asprintf(state->mem_ctx,
+ "%s\\%s\\%s\\%s\\%s\\%s\\%s\\%s",
+ d->domain_name,
+ d->dns_name ? d->dns_name : d->domain_name,
+ sid_string_talloc(state->mem_ctx, &d->sid),
+ get_trust_type_string(d),
+ trust_is_transitive(d) ? "Yes" : "No",
+ trust_is_inbound(d) ? "Yes" : "No",
+ trust_is_outbound(d) ? "Yes" : "No",
+ is_online ? "Online" : "Offline" );
} else {
- extra_data = talloc_asprintf(
- state->mem_ctx, "%s\n%s\\%s\\%s",
- extra_data, d->name,
- d->alt_name ? d->alt_name : d->name,
- sid_string_talloc(state->mem_ctx, &d->sid));
+ extra_data = talloc_asprintf(state->mem_ctx,
+ "%s\n%s\\%s\\%s\\%s\\%s\\%s\\%s\\%s",
+ extra_data,
+ d->domain_name,
+ d->dns_name ? d->dns_name : d->domain_name,
+ sid_string_talloc(state->mem_ctx, &d->sid),
+ get_trust_type_string(d),
+ trust_is_transitive(d) ? "Yes" : "No",
+ trust_is_inbound(d) ? "Yes" : "No",
+ trust_is_outbound(d) ? "Yes" : "No",
+ is_online ? "Online" : "Offline" );
}
}
-
+
extra_data_len = 0;
if (extra_data != NULL) {
extra_data_len = strlen(extra_data);
}
if (extra_data_len > 0) {
- state->response.extra_data.data = SMB_STRDUP(extra_data);
- state->response.length += extra_data_len+1;
+ state->response->extra_data.data = extra_data;
+ state->response->length += extra_data_len+1;
}
- TALLOC_FREE( extra_data );
-
request_ok(state);
+done:
+ TALLOC_FREE( dom_list );
}
enum winbindd_result winbindd_dual_list_trusted_domains(struct winbindd_domain *domain,
sid_string_talloc(state->mem_ctx, &sids[i]));
/* add our primary domain */
-
+
for (i=0; i<num_domains; i++) {
if (strequal(names[i], domain->name)) {
have_own_domain = True;
}
}
- if (state->request.data.list_all_domains && !have_own_domain) {
+ if (state->request->data.list_all_domains && !have_own_domain) {
extra_data = talloc_asprintf(
state->mem_ctx, "%s\n%s\\%s\\%s",
extra_data, domain->name,
}
if (extra_data_len > 0) {
- state->response.extra_data.data = SMB_STRDUP(extra_data);
- state->response.length += extra_data_len+1;
- }
-
- return WINBINDD_OK;
-}
-
-void winbindd_getdcname(struct winbindd_cli_state *state)
-{
- struct winbindd_domain *domain;
-
- state->request.domain_name
- [sizeof(state->request.domain_name)-1] = '\0';
-
- DEBUG(3, ("[%5lu]: Get DC name for %s\n", (unsigned long)state->pid,
- state->request.domain_name));
-
- domain = find_domain_from_name_noinit(state->request.domain_name);
- if (domain && domain->internal) {
- fstrcpy(state->response.data.dc_name, global_myname());
- request_ok(state);
- return;
- }
-
- sendto_domain(state, find_our_domain());
-}
-
-enum winbindd_result winbindd_dual_getdcname(struct winbindd_domain *domain,
- struct winbindd_cli_state *state)
-{
- const char *dcname_slash = NULL;
- const char *p;
- struct rpc_pipe_client *netlogon_pipe;
- NTSTATUS result;
- WERROR werr;
- unsigned int orig_timeout;
- struct winbindd_domain *req_domain;
-
- state->request.domain_name
- [sizeof(state->request.domain_name)-1] = '\0';
-
- DEBUG(3, ("[%5lu]: Get DC name for %s\n", (unsigned long)state->pid,
- state->request.domain_name));
-
- result = cm_connect_netlogon(domain, &netlogon_pipe);
-
- if (!NT_STATUS_IS_OK(result)) {
- DEBUG(1, ("Can't contact the NETLOGON pipe\n"));
- return WINBINDD_ERROR;
- }
-
- /* This call can take a long time - allow the server to time out.
- 35 seconds should do it. */
-
- orig_timeout = cli_set_timeout(netlogon_pipe->cli, 35000);
-
- req_domain = find_domain_from_name_noinit(state->request.domain_name);
- if (req_domain == domain) {
- result = rpccli_netr_GetDcName(netlogon_pipe,
- state->mem_ctx,
- domain->dcname,
- state->request.domain_name,
- &dcname_slash,
- &werr);
- } else {
- result = rpccli_netr_GetAnyDCName(netlogon_pipe,
- state->mem_ctx,
- domain->dcname,
- state->request.domain_name,
- &dcname_slash,
- &werr);
- }
- /* And restore our original timeout. */
- cli_set_timeout(netlogon_pipe->cli, orig_timeout);
-
- if (!NT_STATUS_IS_OK(result)) {
- DEBUG(5,("Error requesting DCname for domain %s: %s\n",
- state->request.domain_name, nt_errstr(result)));
- return WINBINDD_ERROR;
- }
-
- if (!W_ERROR_IS_OK(werr)) {
- DEBUG(5, ("Error requesting DCname for domain %s: %s\n",
- state->request.domain_name, dos_errstr(werr)));
- return WINBINDD_ERROR;
+ state->response->extra_data.data = extra_data;
+ state->response->length += extra_data_len+1;
}
- p = dcname_slash;
- if (*p == '\\') {
- p+=1;
- }
- if (*p == '\\') {
- p+=1;
- }
-
- fstrcpy(state->response.data.dc_name, p);
return WINBINDD_OK;
}
-struct sequence_state {
- TALLOC_CTX *mem_ctx;
- struct winbindd_cli_state *cli_state;
- struct winbindd_domain *domain;
- struct winbindd_request *request;
- struct winbindd_response *response;
- char *extra_data;
-};
-
-static void sequence_recv(void *private_data, bool success);
-
-void winbindd_show_sequence(struct winbindd_cli_state *state)
-{
- struct sequence_state *seq;
-
- /* Ensure null termination */
- state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
-
- if (strlen(state->request.domain_name) > 0) {
- struct winbindd_domain *domain;
- domain = find_domain_from_name_noinit(
- state->request.domain_name);
- if (domain == NULL) {
- request_error(state);
- return;
- }
- sendto_domain(state, domain);
- return;
- }
-
- /* Ask all domains in sequence, collect the results in sequence_recv */
-
- seq = TALLOC_P(state->mem_ctx, struct sequence_state);
- if (seq == NULL) {
- DEBUG(0, ("talloc failed\n"));
- request_error(state);
- return;
- }
-
- seq->mem_ctx = state->mem_ctx;
- seq->cli_state = state;
- seq->domain = domain_list();
- if (seq->domain == NULL) {
- DEBUG(0, ("domain list empty\n"));
- request_error(state);
- return;
- }
- seq->request = TALLOC_ZERO_P(state->mem_ctx,
- struct winbindd_request);
- seq->response = TALLOC_ZERO_P(state->mem_ctx,
- struct winbindd_response);
- seq->extra_data = talloc_strdup(state->mem_ctx, "");
-
- if ((seq->request == NULL) || (seq->response == NULL) ||
- (seq->extra_data == NULL)) {
- DEBUG(0, ("talloc failed\n"));
- request_error(state);
- return;
- }
-
- seq->request->length = sizeof(*seq->request);
- seq->request->cmd = WINBINDD_SHOW_SEQUENCE;
- fstrcpy(seq->request->domain_name, seq->domain->name);
-
- async_domain_request(state->mem_ctx, seq->domain,
- seq->request, seq->response,
- sequence_recv, seq);
-}
-
-static void sequence_recv(void *private_data, bool success)
-{
- struct sequence_state *state =
- (struct sequence_state *)private_data;
- uint32 seq = DOM_SEQUENCE_NONE;
-
- if ((success) && (state->response->result == WINBINDD_OK))
- seq = state->response->data.sequence_number;
-
- if (seq == DOM_SEQUENCE_NONE) {
- state->extra_data = talloc_asprintf(state->mem_ctx,
- "%s%s : DISCONNECTED\n",
- state->extra_data,
- state->domain->name);
- } else {
- state->extra_data = talloc_asprintf(state->mem_ctx,
- "%s%s : %d\n",
- state->extra_data,
- state->domain->name, seq);
- }
-
- state->domain->sequence_number = seq;
-
- state->domain = state->domain->next;
-
- if (state->domain == NULL) {
- struct winbindd_cli_state *cli_state = state->cli_state;
- cli_state->response.length =
- sizeof(cli_state->response) +
- strlen(state->extra_data) + 1;
- cli_state->response.extra_data.data =
- SMB_STRDUP(state->extra_data);
- request_ok(cli_state);
- return;
- }
-
- /* Ask the next domain */
- fstrcpy(state->request->domain_name, state->domain->name);
- async_domain_request(state->mem_ctx, state->domain,
- state->request, state->response,
- sequence_recv, state);
-}
-
/* This is the child-only version of --sequence. It only allows for a single
* domain (ie "our" one) to be displayed. */
DEBUG(3, ("[%5lu]: show sequence\n", (unsigned long)state->pid));
/* Ensure null termination */
- state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
+ state->request->domain_name[sizeof(state->request->domain_name)-1]='\0';
domain->methods->sequence_number(domain, &domain->sequence_number);
- state->response.data.sequence_number =
+ state->response->data.sequence_number =
domain->sequence_number;
return WINBINDD_OK;
struct domain_info_state {
struct winbindd_domain *domain;
- struct winbindd_cli_state *cli_state;
+ struct winbindd_cli_state *cli;
+ struct winbindd_request ping_request;
};
-static void domain_info_init_recv(void *private_data, bool success);
+static void domain_info_done(struct tevent_req *req);
-void winbindd_domain_info(struct winbindd_cli_state *state)
+void winbindd_domain_info(struct winbindd_cli_state *cli)
{
+ struct domain_info_state *state;
struct winbindd_domain *domain;
+ struct tevent_req *req;
- DEBUG(3, ("[%5lu]: domain_info [%s]\n", (unsigned long)state->pid,
- state->request.domain_name));
+ DEBUG(3, ("[%5lu]: domain_info [%s]\n", (unsigned long)cli->pid,
+ cli->request->domain_name));
- domain = find_domain_from_name_noinit(state->request.domain_name);
+ domain = find_domain_from_name_noinit(cli->request->domain_name);
if (domain == NULL) {
DEBUG(3, ("Did not find domain [%s]\n",
- state->request.domain_name));
- request_error(state);
+ cli->request->domain_name));
+ request_error(cli);
return;
}
- if (!domain->initialized) {
- struct domain_info_state *istate;
-
- istate = TALLOC_P(state->mem_ctx, struct domain_info_state);
- if (istate == NULL) {
- DEBUG(0, ("talloc failed\n"));
- request_error(state);
- return;
- }
-
- istate->cli_state = state;
- istate->domain = domain;
+ if (domain->initialized) {
+ fstrcpy(cli->response->data.domain_info.name,
+ domain->name);
+ fstrcpy(cli->response->data.domain_info.alt_name,
+ domain->alt_name);
+ sid_to_fstring(cli->response->data.domain_info.sid,
+ &domain->sid);
+ cli->response->data.domain_info.native_mode =
+ domain->native_mode;
+ cli->response->data.domain_info.active_directory =
+ domain->active_directory;
+ cli->response->data.domain_info.primary =
+ domain->primary;
+ request_ok(cli);
+ return;
+ }
- init_child_connection(domain, domain_info_init_recv, istate);
-
+ state = talloc_zero(cli->mem_ctx, struct domain_info_state);
+ if (state == NULL) {
+ DEBUG(0, ("talloc failed\n"));
+ request_error(cli);
return;
}
- fstrcpy(state->response.data.domain_info.name,
- domain->name);
- fstrcpy(state->response.data.domain_info.alt_name,
- domain->alt_name);
- sid_to_fstring(state->response.data.domain_info.sid, &domain->sid);
-
- state->response.data.domain_info.native_mode =
- domain->native_mode;
- state->response.data.domain_info.active_directory =
- domain->active_directory;
- state->response.data.domain_info.primary =
- domain->primary;
+ state->cli = cli;
+ state->domain = domain;
+ state->ping_request.cmd = WINBINDD_PING;
- request_ok(state);
+ /*
+ * Send a ping down. This implicitly initializes the domain.
+ */
+
+ req = wb_domain_request_send(state, winbind_event_context(),
+ domain, &state->ping_request);
+ if (req == NULL) {
+ DEBUG(3, ("wb_domain_request_send failed\n"));
+ request_error(cli);
+ return;
+ }
+ tevent_req_set_callback(req, domain_info_done, state);
}
-static void domain_info_init_recv(void *private_data, bool success)
+static void domain_info_done(struct tevent_req *req)
{
- struct domain_info_state *istate =
- (struct domain_info_state *)private_data;
- struct winbindd_cli_state *state = istate->cli_state;
- struct winbindd_domain *domain = istate->domain;
-
- DEBUG(10, ("Got back from child init: %d\n", success));
+ struct domain_info_state *state = tevent_req_callback_data(
+ req, struct domain_info_state);
+ struct winbindd_response *response;
+ int ret, err;
- if ((!success) || (!domain->initialized)) {
- DEBUG(5, ("Could not init child for domain %s\n",
- domain->name));
- request_error(state);
+ ret = wb_domain_request_recv(req, req, &response, &err);
+ TALLOC_FREE(req);
+ if (ret == -1) {
+ DEBUG(10, ("wb_domain_request failed: %s\n", strerror(errno)));
+ request_error(state->cli);
+ return;
+ }
+ if (!state->domain->initialized) {
+ DEBUG(5, ("wb_domain_request did not initialize domain %s\n",
+ state->domain->name));
+ request_error(state->cli);
return;
}
- fstrcpy(state->response.data.domain_info.name,
- domain->name);
- fstrcpy(state->response.data.domain_info.alt_name,
- domain->alt_name);
- sid_to_fstring(state->response.data.domain_info.sid, &domain->sid);
-
- state->response.data.domain_info.native_mode =
- domain->native_mode;
- state->response.data.domain_info.active_directory =
- domain->active_directory;
- state->response.data.domain_info.primary =
- domain->primary;
-
- request_ok(state);
-}
-
-void winbindd_ping(struct winbindd_cli_state *state)
-{
- DEBUG(3, ("[%5lu]: ping\n", (unsigned long)state->pid));
- request_ok(state);
+ fstrcpy(state->cli->response->data.domain_info.name,
+ state->domain->name);
+ fstrcpy(state->cli->response->data.domain_info.alt_name,
+ state->domain->alt_name);
+ sid_to_fstring(state->cli->response->data.domain_info.sid,
+ &state->domain->sid);
+
+ state->cli->response->data.domain_info.native_mode =
+ state->domain->native_mode;
+ state->cli->response->data.domain_info.active_directory =
+ state->domain->active_directory;
+ state->cli->response->data.domain_info.primary =
+ state->domain->primary;
+
+ request_ok(state->cli);
}
/* List various tidbits of information */
DEBUG(3, ("[%5lu]: request misc info\n", (unsigned long)state->pid));
- state->response.data.info.winbind_separator = *lp_winbind_separator();
- fstrcpy(state->response.data.info.samba_version, SAMBA_VERSION_STRING);
+ state->response->data.info.winbind_separator = *lp_winbind_separator();
+ fstrcpy(state->response->data.info.samba_version, samba_version_string());
request_ok(state);
}
{
DEBUG(3, ("[%5lu]: request interface version\n",
(unsigned long)state->pid));
-
- state->response.data.interface_version = WINBIND_INTERFACE_VERSION;
+
+ state->response->data.interface_version = WINBIND_INTERFACE_VERSION;
request_ok(state);
}
void winbindd_domain_name(struct winbindd_cli_state *state)
{
DEBUG(3, ("[%5lu]: request domain name\n", (unsigned long)state->pid));
-
- fstrcpy(state->response.data.domain_name, lp_workgroup());
+
+ fstrcpy(state->response->data.domain_name, lp_workgroup());
request_ok(state);
}
{
DEBUG(3, ("[%5lu]: request netbios name\n",
(unsigned long)state->pid));
-
- fstrcpy(state->response.data.netbios_name, global_myname());
+
+ fstrcpy(state->response->data.netbios_name, global_myname());
request_ok(state);
}
-/* Where can I find the privilaged pipe? */
+/* Where can I find the privileged pipe? */
void winbindd_priv_pipe_dir(struct winbindd_cli_state *state)
{
-
+ char *priv_dir;
DEBUG(3, ("[%5lu]: request location of privileged pipe\n",
(unsigned long)state->pid));
-
- state->response.extra_data.data = SMB_STRDUP(get_winbind_priv_pipe_dir());
- if (!state->response.extra_data.data) {
- DEBUG(0, ("malloc failed\n"));
- request_error(state);
- return;
- }
+
+ priv_dir = get_winbind_priv_pipe_dir();
+ state->response->extra_data.data = talloc_move(state->mem_ctx,
+ &priv_dir);
/* must add one to length to copy the 0 for string termination */
- state->response.length +=
- strlen((char *)state->response.extra_data.data) + 1;
+ state->response->length +=
+ strlen((char *)state->response->extra_data.data) + 1;
request_ok(state);
}
git.samba.org / ira / wip.git / blobdiff