2 Unix SMB/CIFS implementation.
4 Winbind daemon connection manager
6 Copyright (C) Tim Potter 2001
7 Copyright (C) Andrew Bartlett 2002
8 Copyright (C) Gerald (Jerry) Carter 2003-2005.
9 Copyright (C) Volker Lendecke 2004-2005
10 Copyright (C) Jeremy Allison 2006
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 We need to manage connections to domain controllers without having to
28 mess up the main winbindd code with other issues. The aim of the
29 connection manager is to:
31 - make connections to domain controllers and cache them
32 - re-establish connections when networks or servers go down
33 - centralise the policy on connection timeouts, domain controller
35 - manage re-entrancy for when winbindd becomes able to handle
36 multiple outstanding rpc requests
38 Why not have connection management as part of the rpc layer like tng?
39 Good question. This code may morph into libsmb/rpc_cache.c or something
40 like that but at the moment it's simply staying as part of winbind. I
41 think the TNG architecture of forcing every user of the rpc layer to use
42 the connection caching system is a bad idea. It should be an optional
43 method of using the routines.
45 The TNG design is quite good but I disagree with some aspects of the
53 - I'm pretty annoyed by all the make_nmb_name() stuff. It should be
54 moved down into another function.
56 - Take care when destroying cli_structs as they can be shared between
65 #define DBGC_CLASS DBGC_WINBIND
69 struct sockaddr_storage ss;
72 extern struct winbindd_methods reconnect_methods;
73 extern bool override_logfile;
75 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain);
76 static void set_dc_type_and_flags( struct winbindd_domain *domain );
77 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
78 struct dc_name_ip **dcs, int *num_dcs);
80 /****************************************************************
81 Child failed to find DC's. Reschedule check.
82 ****************************************************************/
84 static void msg_failed_to_go_online(struct messaging_context *msg,
87 struct server_id server_id,
90 struct winbindd_domain *domain;
91 const char *domainname = (const char *)data->data;
93 if (data->data == NULL || data->length == 0) {
97 DEBUG(5,("msg_fail_to_go_online: received for domain %s.\n", domainname));
99 for (domain = domain_list(); domain; domain = domain->next) {
100 if (domain->internal) {
104 if (strequal(domain->name, domainname)) {
105 if (domain->online) {
106 /* We're already online, ignore. */
107 DEBUG(5,("msg_fail_to_go_online: domain %s "
108 "already online.\n", domainname));
112 /* Reschedule the online check. */
113 set_domain_offline(domain);
119 /****************************************************************
120 Actually cause a reconnect from a message.
121 ****************************************************************/
123 static void msg_try_to_go_online(struct messaging_context *msg,
126 struct server_id server_id,
129 struct winbindd_domain *domain;
130 const char *domainname = (const char *)data->data;
132 if (data->data == NULL || data->length == 0) {
136 DEBUG(5,("msg_try_to_go_online: received for domain %s.\n", domainname));
138 for (domain = domain_list(); domain; domain = domain->next) {
139 if (domain->internal) {
143 if (strequal(domain->name, domainname)) {
145 if (domain->online) {
146 /* We're already online, ignore. */
147 DEBUG(5,("msg_try_to_go_online: domain %s "
148 "already online.\n", domainname));
152 /* This call takes care of setting the online
153 flag to true if we connected, or re-adding
154 the offline handler if false. Bypasses online
155 check so always does network calls. */
157 init_dc_connection_network(domain);
163 /****************************************************************
164 Fork a child to try and contact a DC. Do this as contacting a
165 DC requires blocking lookups and we don't want to block our
167 ****************************************************************/
169 static bool fork_child_dc_connect(struct winbindd_domain *domain)
171 struct dc_name_ip *dcs = NULL;
173 TALLOC_CTX *mem_ctx = NULL;
174 pid_t parent_pid = sys_getpid();
180 if (domain->dc_probe_pid != (pid_t)-1) {
182 * We might already have a DC probe
183 * child working, check.
185 if (process_exists_by_pid(domain->dc_probe_pid)) {
186 DEBUG(10,("fork_child_dc_connect: pid %u already "
187 "checking for DC's.\n",
188 (unsigned int)domain->dc_probe_pid));
191 domain->dc_probe_pid = (pid_t)-1;
194 domain->dc_probe_pid = sys_fork();
196 if (domain->dc_probe_pid == (pid_t)-1) {
197 DEBUG(0, ("fork_child_dc_connect: Could not fork: %s\n", strerror(errno)));
201 if (domain->dc_probe_pid != (pid_t)0) {
203 messaging_register(winbind_messaging_context(), NULL,
204 MSG_WINBIND_TRY_TO_GO_ONLINE,
205 msg_try_to_go_online);
206 messaging_register(winbind_messaging_context(), NULL,
207 MSG_WINBIND_FAILED_TO_GO_ONLINE,
208 msg_failed_to_go_online);
214 /* Leave messages blocked - we will never process one. */
216 if (!override_logfile) {
217 if (asprintf(&lfile, "%s/log.winbindd-dc-connect", get_dyn_LOGFILEBASE()) == -1) {
218 DEBUG(0, ("fork_child_dc_connect: out of memory.\n"));
223 if (!winbindd_reinit_after_fork(lfile)) {
224 messaging_send_buf(winbind_messaging_context(),
225 pid_to_procid(parent_pid),
226 MSG_WINBIND_FAILED_TO_GO_ONLINE,
227 (uint8 *)domain->name,
228 strlen(domain->name)+1);
233 mem_ctx = talloc_init("fork_child_dc_connect");
235 DEBUG(0,("talloc_init failed.\n"));
236 messaging_send_buf(winbind_messaging_context(),
237 pid_to_procid(parent_pid),
238 MSG_WINBIND_FAILED_TO_GO_ONLINE,
239 (uint8 *)domain->name,
240 strlen(domain->name)+1);
244 if ((!get_dcs(mem_ctx, domain, &dcs, &num_dcs)) || (num_dcs == 0)) {
245 /* Still offline ? Can't find DC's. */
246 messaging_send_buf(winbind_messaging_context(),
247 pid_to_procid(parent_pid),
248 MSG_WINBIND_FAILED_TO_GO_ONLINE,
249 (uint8 *)domain->name,
250 strlen(domain->name)+1);
254 /* We got a DC. Send a message to our parent to get it to
255 try and do the same. */
257 messaging_send_buf(winbind_messaging_context(),
258 pid_to_procid(parent_pid),
259 MSG_WINBIND_TRY_TO_GO_ONLINE,
260 (uint8 *)domain->name,
261 strlen(domain->name)+1);
265 /****************************************************************
266 Handler triggered if we're offline to try and detect a DC.
267 ****************************************************************/
269 static void check_domain_online_handler(struct event_context *ctx,
270 struct timed_event *te,
274 struct winbindd_domain *domain =
275 (struct winbindd_domain *)private_data;
277 DEBUG(10,("check_domain_online_handler: called for domain "
278 "%s (online = %s)\n", domain->name,
279 domain->online ? "True" : "False" ));
281 TALLOC_FREE(domain->check_online_event);
283 /* Are we still in "startup" mode ? */
285 if (domain->startup && (now.tv_sec > domain->startup_time + 30)) {
286 /* No longer in "startup" mode. */
287 DEBUG(10,("check_domain_online_handler: domain %s no longer in 'startup' mode.\n",
289 domain->startup = False;
292 /* We've been told to stay offline, so stay
295 if (get_global_winbindd_state_offline()) {
296 DEBUG(10,("check_domain_online_handler: domain %s remaining globally offline\n",
301 /* Fork a child to test if it can contact a DC.
302 If it can then send ourselves a message to
303 cause a reconnect. */
305 fork_child_dc_connect(domain);
308 /****************************************************************
309 If we're still offline setup the timeout check.
310 ****************************************************************/
312 static void calc_new_online_timeout_check(struct winbindd_domain *domain)
314 int wbr = lp_winbind_reconnect_delay();
316 if (domain->startup) {
317 domain->check_online_timeout = 10;
318 } else if (domain->check_online_timeout < wbr) {
319 domain->check_online_timeout = wbr;
323 /****************************************************************
324 Set domain offline and also add handler to put us back online
326 ****************************************************************/
328 void set_domain_offline(struct winbindd_domain *domain)
330 DEBUG(10,("set_domain_offline: called for domain %s\n",
333 TALLOC_FREE(domain->check_online_event);
335 if (domain->internal) {
336 DEBUG(3,("set_domain_offline: domain %s is internal - logic error.\n",
341 domain->online = False;
343 /* Offline domains are always initialized. They're
344 re-initialized when they go back online. */
346 domain->initialized = True;
348 /* We only add the timeout handler that checks and
349 allows us to go back online when we've not
350 been told to remain offline. */
352 if (get_global_winbindd_state_offline()) {
353 DEBUG(10,("set_domain_offline: domain %s remaining globally offline\n",
358 /* If we're in statup mode, check again in 10 seconds, not in
359 lp_winbind_reconnect_delay() seconds (which is 30 seconds by default). */
361 calc_new_online_timeout_check(domain);
363 domain->check_online_event = event_add_timed(winbind_event_context(),
365 timeval_current_ofs(domain->check_online_timeout,0),
366 check_domain_online_handler,
369 /* The above *has* to succeed for winbindd to work. */
370 if (!domain->check_online_event) {
371 smb_panic("set_domain_offline: failed to add online handler");
374 DEBUG(10,("set_domain_offline: added event handler for domain %s\n",
377 /* Send an offline message to the idmap child when our
378 primary domain goes offline */
380 if ( domain->primary ) {
381 struct winbindd_child *idmap = idmap_child();
383 if ( idmap->pid != 0 ) {
384 messaging_send_buf(winbind_messaging_context(),
385 pid_to_procid(idmap->pid),
387 (uint8 *)domain->name,
388 strlen(domain->name)+1);
395 /****************************************************************
396 Set domain online - if allowed.
397 ****************************************************************/
399 static void set_domain_online(struct winbindd_domain *domain)
401 DEBUG(10,("set_domain_online: called for domain %s\n",
404 if (domain->internal) {
405 DEBUG(3,("set_domain_online: domain %s is internal - logic error.\n",
410 if (get_global_winbindd_state_offline()) {
411 DEBUG(10,("set_domain_online: domain %s remaining globally offline\n",
416 winbindd_set_locator_kdc_envs(domain);
418 /* If we are waiting to get a krb5 ticket, trigger immediately. */
419 ccache_regain_all_now();
421 /* Ok, we're out of any startup mode now... */
422 domain->startup = False;
424 if (domain->online == False) {
425 /* We were offline - now we're online. We default to
426 using the MS-RPC backend if we started offline,
427 and if we're going online for the first time we
428 should really re-initialize the backends and the
429 checks to see if we're talking to an AD or NT domain.
432 domain->initialized = False;
434 /* 'reconnect_methods' is the MS-RPC backend. */
435 if (domain->backend == &reconnect_methods) {
436 domain->backend = NULL;
440 /* Ensure we have no online timeout checks. */
441 domain->check_online_timeout = 0;
442 TALLOC_FREE(domain->check_online_event);
444 /* Ensure we ignore any pending child messages. */
445 messaging_deregister(winbind_messaging_context(),
446 MSG_WINBIND_TRY_TO_GO_ONLINE, NULL);
447 messaging_deregister(winbind_messaging_context(),
448 MSG_WINBIND_FAILED_TO_GO_ONLINE, NULL);
450 domain->online = True;
452 /* Send an online message to the idmap child when our
453 primary domain comes online */
455 if ( domain->primary ) {
456 struct winbindd_child *idmap = idmap_child();
458 if ( idmap->pid != 0 ) {
459 messaging_send_buf(winbind_messaging_context(),
460 pid_to_procid(idmap->pid),
462 (uint8 *)domain->name,
463 strlen(domain->name)+1);
470 /****************************************************************
471 Requested to set a domain online.
472 ****************************************************************/
474 void set_domain_online_request(struct winbindd_domain *domain)
478 DEBUG(10,("set_domain_online_request: called for domain %s\n",
481 if (get_global_winbindd_state_offline()) {
482 DEBUG(10,("set_domain_online_request: domain %s remaining globally offline\n",
487 /* We've been told it's safe to go online and
488 try and connect to a DC. But I don't believe it
489 because network manager seems to lie.
490 Wait at least 5 seconds. Heuristics suck... */
495 /* Go into "startup" mode again. */
496 domain->startup_time = tev.tv_sec;
497 domain->startup = True;
501 if (!domain->check_online_event) {
502 /* If we've come from being globally offline we
503 don't have a check online event handler set.
504 We need to add one now we're trying to go
507 DEBUG(10,("set_domain_online_request: domain %s was globally offline.\n",
511 TALLOC_FREE(domain->check_online_event);
513 domain->check_online_event = event_add_timed(winbind_event_context(),
516 check_domain_online_handler,
519 /* The above *has* to succeed for winbindd to work. */
520 if (!domain->check_online_event) {
521 smb_panic("set_domain_online_request: failed to add online handler");
525 /****************************************************************
526 Add -ve connection cache entries for domain and realm.
527 ****************************************************************/
529 void winbind_add_failed_connection_entry(const struct winbindd_domain *domain,
533 add_failed_connection_entry(domain->name, server, result);
534 /* If this was the saf name for the last thing we talked to,
536 saf_delete(domain->name);
537 if (*domain->alt_name) {
538 add_failed_connection_entry(domain->alt_name, server, result);
539 saf_delete(domain->alt_name);
541 winbindd_unset_locator_kdc_env(domain);
544 /* Choose between anonymous or authenticated connections. We need to use
545 an authenticated connection if DCs have the RestrictAnonymous registry
546 entry set > 0, or the "Additional restrictions for anonymous
547 connections" set in the win2k Local Security Policy.
549 Caller to free() result in domain, username, password
552 static void cm_get_ipc_userpass(char **username, char **domain, char **password)
554 *username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
555 *domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
556 *password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
558 if (*username && **username) {
560 if (!*domain || !**domain)
561 *domain = smb_xstrdup(lp_workgroup());
563 if (!*password || !**password)
564 *password = smb_xstrdup("");
566 DEBUG(3, ("cm_get_ipc_userpass: Retrieved auth-user from secrets.tdb [%s\\%s]\n",
567 *domain, *username));
570 DEBUG(3, ("cm_get_ipc_userpass: No auth-user defined\n"));
571 *username = smb_xstrdup("");
572 *domain = smb_xstrdup("");
573 *password = smb_xstrdup("");
577 static bool get_dc_name_via_netlogon(struct winbindd_domain *domain,
579 struct sockaddr_storage *dc_ss)
581 struct winbindd_domain *our_domain = NULL;
582 struct rpc_pipe_client *netlogon_pipe = NULL;
586 unsigned int orig_timeout;
587 const char *tmp = NULL;
590 /* Hmmmm. We can only open one connection to the NETLOGON pipe at the
597 if (domain->primary) {
601 our_domain = find_our_domain();
603 if ((mem_ctx = talloc_init("get_dc_name_via_netlogon")) == NULL) {
607 result = cm_connect_netlogon(our_domain, &netlogon_pipe);
608 if (!NT_STATUS_IS_OK(result)) {
609 talloc_destroy(mem_ctx);
613 /* This call can take a long time - allow the server to time out.
614 35 seconds should do it. */
616 orig_timeout = rpccli_set_timeout(netlogon_pipe, 35000);
618 if (our_domain->active_directory) {
619 struct netr_DsRGetDCNameInfo *domain_info = NULL;
621 result = rpccli_netr_DsRGetDCName(netlogon_pipe,
630 if (W_ERROR_IS_OK(werr)) {
632 mem_ctx, domain_info->dc_unc);
634 DEBUG(0, ("talloc_strdup failed\n"));
635 talloc_destroy(mem_ctx);
638 if (strlen(domain->alt_name) == 0) {
639 fstrcpy(domain->alt_name,
640 domain_info->domain_name);
642 if (strlen(domain->forest_name) == 0) {
643 fstrcpy(domain->forest_name,
644 domain_info->forest_name);
648 result = rpccli_netr_GetAnyDCName(netlogon_pipe, mem_ctx,
655 /* And restore our original timeout. */
656 rpccli_set_timeout(netlogon_pipe, orig_timeout);
658 if (!NT_STATUS_IS_OK(result)) {
659 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
661 talloc_destroy(mem_ctx);
665 if (!W_ERROR_IS_OK(werr)) {
666 DEBUG(10,("rpccli_netr_GetAnyDCName failed: %s\n",
668 talloc_destroy(mem_ctx);
672 /* rpccli_netr_GetAnyDCName gives us a name with \\ */
673 p = strip_hostname(tmp);
677 talloc_destroy(mem_ctx);
679 DEBUG(10,("rpccli_netr_GetAnyDCName returned %s\n", dcname));
681 if (!resolve_name(dcname, dc_ss, 0x20)) {
689 * Helper function to assemble trust password and account name
691 static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
692 char **machine_password,
693 char **machine_account,
694 char **machine_krb5_principal)
696 const char *account_name;
697 const char *name = NULL;
699 /* If we are a DC and this is not our own domain */
704 struct winbindd_domain *our_domain = find_our_domain();
707 return NT_STATUS_INVALID_SERVER_STATE;
709 name = our_domain->name;
712 if (!get_trust_pw_clear(name, machine_password,
713 &account_name, NULL))
715 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
718 if ((machine_account != NULL) &&
719 (asprintf(machine_account, "%s$", account_name) == -1))
721 return NT_STATUS_NO_MEMORY;
724 /* For now assume our machine account only exists in our domain */
726 if (machine_krb5_principal != NULL)
728 struct winbindd_domain *our_domain = find_our_domain();
731 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
734 if (asprintf(machine_krb5_principal, "%s$@%s",
735 account_name, our_domain->alt_name) == -1)
737 return NT_STATUS_NO_MEMORY;
740 strupper_m(*machine_krb5_principal);
746 /************************************************************************
747 Given a fd with a just-connected TCP connection to a DC, open a connection
749 ************************************************************************/
751 static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
753 const char *controller,
754 struct cli_state **cli,
757 char *machine_password = NULL;
758 char *machine_krb5_principal = NULL;
759 char *machine_account = NULL;
760 char *ipc_username = NULL;
761 char *ipc_domain = NULL;
762 char *ipc_password = NULL;
764 struct named_mutex *mutex;
766 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
768 struct sockaddr peeraddr;
769 socklen_t peeraddr_len;
771 struct sockaddr_in *peeraddr_in = (struct sockaddr_in *)&peeraddr;
773 DEBUG(10,("cm_prepare_connection: connecting to DC %s for domain %s\n",
774 controller, domain->name ));
778 mutex = grab_named_mutex(talloc_tos(), controller,
779 WINBIND_SERVER_MUTEX_WAIT_TIME);
781 DEBUG(0,("cm_prepare_connection: mutex grab failed for %s\n",
783 result = NT_STATUS_POSSIBLE_DEADLOCK;
787 if ((*cli = cli_initialise()) == NULL) {
788 DEBUG(1, ("Could not cli_initialize\n"));
789 result = NT_STATUS_NO_MEMORY;
793 (*cli)->timeout = 10000; /* 10 seconds */
795 fstrcpy((*cli)->desthost, controller);
796 (*cli)->use_kerberos = True;
798 peeraddr_len = sizeof(peeraddr);
800 if ((getpeername((*cli)->fd, &peeraddr, &peeraddr_len) != 0) ||
801 (peeraddr_len != sizeof(struct sockaddr_in)) ||
802 (peeraddr_in->sin_family != PF_INET))
804 DEBUG(0,("cm_prepare_connection: %s\n", strerror(errno)));
805 result = NT_STATUS_UNSUCCESSFUL;
809 if (ntohs(peeraddr_in->sin_port) == 139) {
810 struct nmb_name calling;
811 struct nmb_name called;
813 make_nmb_name(&calling, global_myname(), 0x0);
814 make_nmb_name(&called, "*SMBSERVER", 0x20);
816 if (!cli_session_request(*cli, &calling, &called)) {
817 DEBUG(8, ("cli_session_request failed for %s\n",
819 result = NT_STATUS_UNSUCCESSFUL;
824 cli_setup_signing_state(*cli, Undefined);
826 result = cli_negprot(*cli);
828 if (!NT_STATUS_IS_OK(result)) {
829 DEBUG(1, ("cli_negprot failed: %s\n", nt_errstr(result)));
833 if (!is_dc_trusted_domain_situation(domain->name) &&
834 (*cli)->protocol >= PROTOCOL_NT1 &&
835 (*cli)->capabilities & CAP_EXTENDED_SECURITY)
837 ADS_STATUS ads_status;
839 result = get_trust_creds(domain, &machine_password,
841 &machine_krb5_principal);
842 if (!NT_STATUS_IS_OK(result)) {
846 if (lp_security() == SEC_ADS) {
848 /* Try a krb5 session */
850 (*cli)->use_kerberos = True;
851 DEBUG(5, ("connecting to %s from %s with kerberos principal "
852 "[%s] and realm [%s]\n", controller, global_myname(),
853 machine_krb5_principal, domain->alt_name));
855 winbindd_set_locator_kdc_envs(domain);
857 ads_status = cli_session_setup_spnego(*cli,
858 machine_krb5_principal,
863 if (!ADS_ERR_OK(ads_status)) {
864 DEBUG(4,("failed kerberos session setup with %s\n",
865 ads_errstr(ads_status)));
868 result = ads_ntstatus(ads_status);
869 if (NT_STATUS_IS_OK(result)) {
870 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
871 cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
872 goto session_setup_done;
876 /* Fall back to non-kerberos session setup using NTLMSSP SPNEGO with the machine account. */
877 (*cli)->use_kerberos = False;
879 DEBUG(5, ("connecting to %s from %s with username "
880 "[%s]\\[%s]\n", controller, global_myname(),
881 lp_workgroup(), machine_account));
883 ads_status = cli_session_setup_spnego(*cli,
888 if (!ADS_ERR_OK(ads_status)) {
889 DEBUG(4, ("authenticated session setup failed with %s\n",
890 ads_errstr(ads_status)));
893 result = ads_ntstatus(ads_status);
894 if (NT_STATUS_IS_OK(result)) {
895 /* Ensure creds are stored for NTLMSSP authenticated pipe access. */
896 cli_init_creds(*cli, machine_account, lp_workgroup(), machine_password);
897 goto session_setup_done;
901 /* Fall back to non-kerberos session setup with auth_user */
903 (*cli)->use_kerberos = False;
905 cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password);
907 if ((((*cli)->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) != 0) &&
908 (strlen(ipc_username) > 0)) {
910 /* Only try authenticated if we have a username */
912 DEBUG(5, ("connecting to %s from %s with username "
913 "[%s]\\[%s]\n", controller, global_myname(),
914 ipc_domain, ipc_username));
916 if (NT_STATUS_IS_OK(cli_session_setup(
918 ipc_password, strlen(ipc_password)+1,
919 ipc_password, strlen(ipc_password)+1,
921 /* Successful logon with given username. */
922 cli_init_creds(*cli, ipc_username, ipc_domain, ipc_password);
923 goto session_setup_done;
925 DEBUG(4, ("authenticated session setup with user %s\\%s failed.\n",
926 ipc_domain, ipc_username ));
932 /* Fall back to anonymous connection, this might fail later */
933 DEBUG(10,("cm_prepare_connection: falling back to anonymous "
934 "connection for DC %s\n",
937 if (NT_STATUS_IS_OK(cli_session_setup(*cli, "", NULL, 0,
939 DEBUG(5, ("Connected anonymously\n"));
940 cli_init_creds(*cli, "", "", "");
941 goto session_setup_done;
944 result = cli_nt_error(*cli);
946 if (NT_STATUS_IS_OK(result))
947 result = NT_STATUS_UNSUCCESSFUL;
949 /* We can't session setup */
955 /* cache the server name for later connections */
957 saf_store( domain->name, (*cli)->desthost );
958 if (domain->alt_name && (*cli)->use_kerberos) {
959 saf_store( domain->alt_name, (*cli)->desthost );
962 winbindd_set_locator_kdc_envs(domain);
964 if (!cli_send_tconX(*cli, "IPC$", "IPC", "", 0)) {
966 result = cli_nt_error(*cli);
968 DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result)));
970 if (NT_STATUS_IS_OK(result))
971 result = NT_STATUS_UNSUCCESSFUL;
979 /* set the domain if empty; needed for schannel connections */
980 if ( !*(*cli)->domain ) {
981 fstrcpy( (*cli)->domain, domain->name );
984 result = NT_STATUS_OK;
988 SAFE_FREE(machine_account);
989 SAFE_FREE(machine_password);
990 SAFE_FREE(machine_krb5_principal);
991 SAFE_FREE(ipc_username);
992 SAFE_FREE(ipc_domain);
993 SAFE_FREE(ipc_password);
995 if (!NT_STATUS_IS_OK(result)) {
996 winbind_add_failed_connection_entry(domain, controller, result);
997 if ((*cli) != NULL) {
1006 /*******************************************************************
1007 Add a dcname and sockaddr_storage pair to the end of a dc_name_ip
1010 Keeps the list unique by not adding duplicate entries.
1012 @param[in] mem_ctx talloc memory context to allocate from
1013 @param[in] domain_name domain of the DC
1014 @param[in] dcname name of the DC to add to the list
1015 @param[in] pss Internet address and port pair to add to the list
1016 @param[in,out] dcs array of dc_name_ip structures to add to
1017 @param[in,out] num_dcs number of dcs returned in the dcs array
1018 @return true if the list was added to, false otherwise
1019 *******************************************************************/
1021 static bool add_one_dc_unique(TALLOC_CTX *mem_ctx, const char *domain_name,
1022 const char *dcname, struct sockaddr_storage *pss,
1023 struct dc_name_ip **dcs, int *num)
1027 if (!NT_STATUS_IS_OK(check_negative_conn_cache(domain_name, dcname))) {
1028 DEBUG(10, ("DC %s was in the negative conn cache\n", dcname));
1032 /* Make sure there's no duplicates in the list */
1033 for (i=0; i<*num; i++)
1034 if (sockaddr_equal((struct sockaddr *)&(*dcs)[i].ss, (struct sockaddr *)pss))
1037 *dcs = TALLOC_REALLOC_ARRAY(mem_ctx, *dcs, struct dc_name_ip, (*num)+1);
1042 fstrcpy((*dcs)[*num].name, dcname);
1043 (*dcs)[*num].ss = *pss;
1048 static bool add_sockaddr_to_array(TALLOC_CTX *mem_ctx,
1049 struct sockaddr_storage *pss, uint16 port,
1050 struct sockaddr_storage **addrs, int *num)
1052 *addrs = TALLOC_REALLOC_ARRAY(mem_ctx, *addrs, struct sockaddr_storage, (*num)+1);
1054 if (*addrs == NULL) {
1059 (*addrs)[*num] = *pss;
1060 set_sockaddr_port((struct sockaddr *)&(*addrs)[*num], port);
1066 /*******************************************************************
1067 convert an ip to a name
1068 *******************************************************************/
1070 static bool dcip_to_name(TALLOC_CTX *mem_ctx,
1071 const struct winbindd_domain *domain,
1072 struct sockaddr_storage *pss,
1075 struct ip_service ip_list;
1076 uint32_t nt_version = NETLOGON_NT_VERSION_1;
1082 /* For active directory servers, try to get the ldap server name.
1083 None of these failures should be considered critical for now */
1085 if (lp_security() == SEC_ADS) {
1087 ADS_STATUS ads_status;
1088 char addr[INET6_ADDRSTRLEN];
1090 print_sockaddr(addr, sizeof(addr), pss);
1092 ads = ads_init(domain->alt_name, domain->name, addr);
1093 ads->auth.flags |= ADS_AUTH_NO_BIND;
1095 ads_status = ads_connect(ads);
1096 if (ADS_ERR_OK(ads_status)) {
1097 /* We got a cldap packet. */
1098 fstrcpy(name, ads->config.ldap_server_name);
1099 namecache_store(name, 0x20, 1, &ip_list);
1101 DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
1103 if (domain->primary && (ads->config.flags & NBT_SERVER_KDC)) {
1104 if (ads_closest_dc(ads)) {
1105 char *sitename = sitename_fetch(ads->config.realm);
1107 /* We're going to use this KDC for this realm/domain.
1108 If we are using sites, then force the krb5 libs
1111 create_local_private_krb5_conf_for_domain(domain->alt_name,
1116 SAFE_FREE(sitename);
1118 /* use an off site KDC */
1119 create_local_private_krb5_conf_for_domain(domain->alt_name,
1124 winbindd_set_locator_kdc_envs(domain);
1126 /* Ensure we contact this DC also. */
1127 saf_store( domain->name, name);
1128 saf_store( domain->alt_name, name);
1131 ads_destroy( &ads );
1135 ads_destroy( &ads );
1139 /* try GETDC requests next */
1141 if (send_getdc_request(mem_ctx, winbind_messaging_context(),
1142 pss, domain->name, &domain->sid,
1144 const char *dc_name = NULL;
1147 for (i=0; i<5; i++) {
1148 if (receive_getdc_response(mem_ctx, pss, domain->name,
1151 fstrcpy(name, dc_name);
1152 namecache_store(name, 0x20, 1, &ip_list);
1159 /* try node status request */
1161 if ( name_status_find(domain->name, 0x1c, 0x20, pss, name) ) {
1162 namecache_store(name, 0x20, 1, &ip_list);
1168 /*******************************************************************
1169 Retrieve a list of IP addresses for domain controllers.
1171 The array is sorted in the preferred connection order.
1173 @param[in] mem_ctx talloc memory context to allocate from
1174 @param[in] domain domain to retrieve DCs for
1175 @param[out] dcs array of dcs that will be returned
1176 @param[out] num_dcs number of dcs returned in the dcs array
1178 *******************************************************************/
1180 static bool get_dcs(TALLOC_CTX *mem_ctx, struct winbindd_domain *domain,
1181 struct dc_name_ip **dcs, int *num_dcs)
1184 struct sockaddr_storage ss;
1185 struct ip_service *ip_list = NULL;
1186 int iplist_size = 0;
1189 enum security_types sec = (enum security_types)lp_security();
1191 is_our_domain = strequal(domain->name, lp_workgroup());
1193 /* If not our domain, get the preferred DC, by asking our primary DC */
1195 && get_dc_name_via_netlogon(domain, dcname, &ss)
1196 && add_one_dc_unique(mem_ctx, domain->name, dcname, &ss, dcs,
1199 char addr[INET6_ADDRSTRLEN];
1200 print_sockaddr(addr, sizeof(addr), &ss);
1201 DEBUG(10, ("Retrieved DC %s at %s via netlogon\n",
1206 if (sec == SEC_ADS) {
1207 char *sitename = NULL;
1209 /* We need to make sure we know the local site before
1210 doing any DNS queries, as this will restrict the
1211 get_sorted_dc_list() call below to only fetching
1212 DNS records for the correct site. */
1214 /* Find any DC to get the site record.
1215 We deliberately don't care about the
1218 get_dc_name(domain->name, domain->alt_name, dcname, &ss);
1220 sitename = sitename_fetch(domain->alt_name);
1223 /* Do the site-specific AD dns lookup first. */
1224 get_sorted_dc_list(domain->alt_name, sitename, &ip_list,
1225 &iplist_size, True);
1227 /* Add ips to the DC array. We don't look up the name
1228 of the DC in this function, but we fill in the char*
1229 of the ip now to make the failed connection cache
1231 for ( i=0; i<iplist_size; i++ ) {
1232 char addr[INET6_ADDRSTRLEN];
1233 print_sockaddr(addr, sizeof(addr),
1235 add_one_dc_unique(mem_ctx,
1244 SAFE_FREE(sitename);
1248 /* Now we add DCs from the main AD DNS lookup. */
1249 get_sorted_dc_list(domain->alt_name, NULL, &ip_list,
1250 &iplist_size, True);
1252 for ( i=0; i<iplist_size; i++ ) {
1253 char addr[INET6_ADDRSTRLEN];
1254 print_sockaddr(addr, sizeof(addr),
1256 add_one_dc_unique(mem_ctx,
1268 /* Try standard netbios queries if no ADS */
1269 if (*num_dcs == 0) {
1270 get_sorted_dc_list(domain->name, NULL, &ip_list, &iplist_size,
1273 for ( i=0; i<iplist_size; i++ ) {
1274 char addr[INET6_ADDRSTRLEN];
1275 print_sockaddr(addr, sizeof(addr),
1277 add_one_dc_unique(mem_ctx,
1292 /*******************************************************************
1293 Find and make a connection to a DC in the given domain.
1295 @param[in] mem_ctx talloc memory context to allocate from
1296 @param[in] domain domain to find a dc in
1297 @param[out] dcname NetBIOS or FQDN of DC that's connected to
1298 @param[out] pss DC Internet address and port
1299 @param[out] fd fd of the open socket connected to the newly found dc
1300 @return true when a DC connection is made, false otherwise
1301 *******************************************************************/
1303 static bool find_new_dc(TALLOC_CTX *mem_ctx,
1304 struct winbindd_domain *domain,
1305 fstring dcname, struct sockaddr_storage *pss, int *fd)
1307 struct dc_name_ip *dcs = NULL;
1310 const char **dcnames = NULL;
1311 int num_dcnames = 0;
1313 struct sockaddr_storage *addrs = NULL;
1321 if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
1324 for (i=0; i<num_dcs; i++) {
1326 if (!add_string_to_array(mem_ctx, dcs[i].name,
1327 &dcnames, &num_dcnames)) {
1330 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 445,
1331 &addrs, &num_addrs)) {
1335 if (!add_string_to_array(mem_ctx, dcs[i].name,
1336 &dcnames, &num_dcnames)) {
1339 if (!add_sockaddr_to_array(mem_ctx, &dcs[i].ss, 139,
1340 &addrs, &num_addrs)) {
1345 if ((num_dcnames == 0) || (num_dcnames != num_addrs))
1348 if ((addrs == NULL) || (dcnames == NULL))
1351 /* 5 second timeout. */
1352 if (!open_any_socket_out(addrs, num_addrs, 5000, &fd_index, fd) ) {
1353 for (i=0; i<num_dcs; i++) {
1354 char ab[INET6_ADDRSTRLEN];
1355 print_sockaddr(ab, sizeof(ab), &dcs[i].ss);
1356 DEBUG(10, ("find_new_dc: open_any_socket_out failed for "
1357 "domain %s address %s. Error was %s\n",
1358 domain->name, ab, strerror(errno) ));
1359 winbind_add_failed_connection_entry(domain,
1360 dcs[i].name, NT_STATUS_UNSUCCESSFUL);
1365 *pss = addrs[fd_index];
1367 if (*dcnames[fd_index] != '\0' && !is_ipaddress(dcnames[fd_index])) {
1368 /* Ok, we've got a name for the DC */
1369 fstrcpy(dcname, dcnames[fd_index]);
1373 /* Try to figure out the name */
1374 if (dcip_to_name(mem_ctx, domain, pss, dcname)) {
1378 /* We can not continue without the DC's name */
1379 winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
1380 NT_STATUS_UNSUCCESSFUL);
1382 /* Throw away all arrays as we're doing this again. */
1386 TALLOC_FREE(dcnames);
1398 static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
1399 struct winbindd_cm_conn *new_conn)
1401 TALLOC_CTX *mem_ctx;
1403 char *saf_servername = saf_fetch( domain->name );
1406 if ((mem_ctx = talloc_init("cm_open_connection")) == NULL) {
1407 SAFE_FREE(saf_servername);
1408 set_domain_offline(domain);
1409 return NT_STATUS_NO_MEMORY;
1412 /* we have to check the server affinity cache here since
1413 later we selecte a DC based on response time and not preference */
1415 /* Check the negative connection cache
1416 before talking to it. It going down may have
1417 triggered the reconnection. */
1419 if ( saf_servername && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, saf_servername))) {
1421 DEBUG(10,("cm_open_connection: saf_servername is '%s' for domain %s\n",
1422 saf_servername, domain->name ));
1424 /* convert an ip address to a name */
1425 if (is_ipaddress( saf_servername ) ) {
1427 struct sockaddr_storage ss;
1429 if (!interpret_string_addr(&ss, saf_servername,
1431 return NT_STATUS_UNSUCCESSFUL;
1433 if (dcip_to_name(mem_ctx, domain, &ss, saf_name )) {
1434 fstrcpy( domain->dcname, saf_name );
1436 winbind_add_failed_connection_entry(
1437 domain, saf_servername,
1438 NT_STATUS_UNSUCCESSFUL);
1441 fstrcpy( domain->dcname, saf_servername );
1444 SAFE_FREE( saf_servername );
1447 for (retries = 0; retries < 3; retries++) {
1451 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1453 DEBUG(10,("cm_open_connection: dcname is '%s' for domain %s\n",
1454 domain->dcname, domain->name ));
1457 && NT_STATUS_IS_OK(check_negative_conn_cache( domain->name, domain->dcname))
1458 && (resolve_name(domain->dcname, &domain->dcaddr, 0x20)))
1460 struct sockaddr_storage *addrs = NULL;
1464 if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 445, &addrs, &num_addrs)) {
1465 set_domain_offline(domain);
1466 talloc_destroy(mem_ctx);
1467 return NT_STATUS_NO_MEMORY;
1469 if (!add_sockaddr_to_array(mem_ctx, &domain->dcaddr, 139, &addrs, &num_addrs)) {
1470 set_domain_offline(domain);
1471 talloc_destroy(mem_ctx);
1472 return NT_STATUS_NO_MEMORY;
1475 /* 5 second timeout. */
1476 if (!open_any_socket_out(addrs, num_addrs, 5000, &dummy, &fd)) {
1482 && !find_new_dc(mem_ctx, domain, domain->dcname, &domain->dcaddr, &fd))
1484 /* This is the one place where we will
1485 set the global winbindd offline state
1486 to true, if a "WINBINDD_OFFLINE" entry
1487 is found in the winbindd cache. */
1488 set_global_winbindd_state_offline();
1492 new_conn->cli = NULL;
1494 result = cm_prepare_connection(domain, fd, domain->dcname,
1495 &new_conn->cli, &retry);
1501 if (NT_STATUS_IS_OK(result)) {
1503 winbindd_set_locator_kdc_envs(domain);
1505 if (domain->online == False) {
1506 /* We're changing state from offline to online. */
1507 set_global_winbindd_state_online();
1509 set_domain_online(domain);
1511 /* Ensure we setup the retry handler. */
1512 set_domain_offline(domain);
1515 talloc_destroy(mem_ctx);
1519 /* Close down all open pipes on a connection. */
1521 void invalidate_cm_connection(struct winbindd_cm_conn *conn)
1523 /* We're closing down a possibly dead
1524 connection. Don't have impossibly long (10s) timeouts. */
1527 cli_set_timeout(conn->cli, 1000); /* 1 second. */
1530 if (conn->samr_pipe != NULL) {
1531 TALLOC_FREE(conn->samr_pipe);
1532 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1534 cli_set_timeout(conn->cli, 500);
1538 if (conn->lsa_pipe != NULL) {
1539 TALLOC_FREE(conn->lsa_pipe);
1540 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1542 cli_set_timeout(conn->cli, 500);
1546 if (conn->netlogon_pipe != NULL) {
1547 TALLOC_FREE(conn->netlogon_pipe);
1548 /* Ok, it must be dead. Drop timeout to 0.5 sec. */
1550 cli_set_timeout(conn->cli, 500);
1555 cli_shutdown(conn->cli);
1561 void close_conns_after_fork(void)
1563 struct winbindd_domain *domain;
1565 for (domain = domain_list(); domain; domain = domain->next) {
1566 if (domain->conn.cli == NULL)
1569 if (domain->conn.cli->fd == -1)
1572 close(domain->conn.cli->fd);
1573 domain->conn.cli->fd = -1;
1577 static bool connection_ok(struct winbindd_domain *domain)
1579 if (domain->conn.cli == NULL) {
1580 DEBUG(8, ("connection_ok: Connection to %s for domain %s has NULL "
1581 "cli!\n", domain->dcname, domain->name));
1585 if (!domain->conn.cli->initialised) {
1586 DEBUG(3, ("connection_ok: Connection to %s for domain %s was never "
1587 "initialised!\n", domain->dcname, domain->name));
1591 if (domain->conn.cli->fd == -1) {
1592 DEBUG(3, ("connection_ok: Connection to %s for domain %s has died or was "
1593 "never started (fd == -1)\n",
1594 domain->dcname, domain->name));
1598 if (domain->online == False) {
1599 DEBUG(3, ("connection_ok: Domain %s is offline\n", domain->name));
1606 /* Initialize a new connection up to the RPC BIND.
1607 Bypass online status check so always does network calls. */
1609 static NTSTATUS init_dc_connection_network(struct winbindd_domain *domain)
1613 /* Internal connections never use the network. */
1614 if (domain->internal) {
1615 domain->initialized = True;
1616 return NT_STATUS_OK;
1619 if (connection_ok(domain)) {
1620 if (!domain->initialized) {
1621 set_dc_type_and_flags(domain);
1623 return NT_STATUS_OK;
1626 invalidate_cm_connection(&domain->conn);
1628 result = cm_open_connection(domain, &domain->conn);
1630 if (NT_STATUS_IS_OK(result) && !domain->initialized) {
1631 set_dc_type_and_flags(domain);
1637 NTSTATUS init_dc_connection(struct winbindd_domain *domain)
1639 if (domain->initialized && !domain->online) {
1640 /* We check for online status elsewhere. */
1641 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1644 return init_dc_connection_network(domain);
1647 /******************************************************************************
1648 Set the trust flags (direction and forest location) for a domain
1649 ******************************************************************************/
1651 static bool set_dc_type_and_flags_trustinfo( struct winbindd_domain *domain )
1653 struct winbindd_domain *our_domain;
1654 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1655 struct netr_DomainTrustList trusts;
1657 uint32 flags = (NETR_TRUST_FLAG_IN_FOREST |
1658 NETR_TRUST_FLAG_OUTBOUND |
1659 NETR_TRUST_FLAG_INBOUND);
1660 struct rpc_pipe_client *cli;
1661 TALLOC_CTX *mem_ctx = NULL;
1663 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s\n", domain->name ));
1665 /* Our primary domain doesn't need to worry about trust flags.
1666 Force it to go through the network setup */
1667 if ( domain->primary ) {
1671 our_domain = find_our_domain();
1673 if ( !connection_ok(our_domain) ) {
1674 DEBUG(3,("set_dc_type_and_flags_trustinfo: No connection to our domain!\n"));
1678 /* This won't work unless our domain is AD */
1680 if ( !our_domain->active_directory ) {
1684 /* Use DsEnumerateDomainTrusts to get us the trust direction
1687 result = cm_connect_netlogon(our_domain, &cli);
1689 if (!NT_STATUS_IS_OK(result)) {
1690 DEBUG(5, ("set_dc_type_and_flags_trustinfo: Could not open "
1691 "a connection to %s for PIPE_NETLOGON (%s)\n",
1692 domain->name, nt_errstr(result)));
1696 if ( (mem_ctx = talloc_init("set_dc_type_and_flags_trustinfo")) == NULL ) {
1697 DEBUG(0,("set_dc_type_and_flags_trustinfo: talloc_init() failed!\n"));
1701 result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1706 if (!NT_STATUS_IS_OK(result)) {
1707 DEBUG(0,("set_dc_type_and_flags_trustinfo: "
1708 "failed to query trusted domain list: %s\n",
1709 nt_errstr(result)));
1710 talloc_destroy(mem_ctx);
1714 /* Now find the domain name and get the flags */
1716 for ( i=0; i<trusts.count; i++ ) {
1717 if ( strequal( domain->name, trusts.array[i].netbios_name) ) {
1718 domain->domain_flags = trusts.array[i].trust_flags;
1719 domain->domain_type = trusts.array[i].trust_type;
1720 domain->domain_trust_attribs = trusts.array[i].trust_attributes;
1722 if ( domain->domain_type == NETR_TRUST_TYPE_UPLEVEL )
1723 domain->active_directory = True;
1725 /* This flag is only set if the domain is *our*
1726 primary domain and the primary domain is in
1729 domain->native_mode = (domain->domain_flags & NETR_TRUST_FLAG_NATIVE);
1731 DEBUG(5, ("set_dc_type_and_flags_trustinfo: domain %s is %sin "
1732 "native mode.\n", domain->name,
1733 domain->native_mode ? "" : "NOT "));
1735 DEBUG(5,("set_dc_type_and_flags_trustinfo: domain %s is %s"
1736 "running active directory.\n", domain->name,
1737 domain->active_directory ? "" : "NOT "));
1740 domain->initialized = True;
1742 if ( !winbindd_can_contact_domain( domain) )
1743 domain->internal = True;
1749 talloc_destroy( mem_ctx );
1751 return domain->initialized;
1754 /******************************************************************************
1755 We can 'sense' certain things about the DC by it's replies to certain
1758 This tells us if this particular remote server is Active Directory, and if it
1760 ******************************************************************************/
1762 static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
1766 TALLOC_CTX *mem_ctx = NULL;
1767 struct rpc_pipe_client *cli;
1769 union dssetup_DsRoleInfo info;
1770 union lsa_PolicyInformation *lsa_info = NULL;
1772 if (!connection_ok(domain)) {
1776 mem_ctx = talloc_init("set_dc_type_and_flags on domain %s\n",
1779 DEBUG(1, ("set_dc_type_and_flags_connect: talloc_init() failed\n"));
1783 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s\n", domain->name ));
1785 result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1786 &ndr_table_dssetup.syntax_id,
1789 if (!NT_STATUS_IS_OK(result)) {
1790 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1791 "PI_DSSETUP on domain %s: (%s)\n",
1792 domain->name, nt_errstr(result)));
1794 /* if this is just a non-AD domain we need to continue
1795 * identifying so that we can in the end return with
1796 * domain->initialized = True - gd */
1801 result = rpccli_dssetup_DsRoleGetPrimaryDomainInformation(cli, mem_ctx,
1802 DS_ROLE_BASIC_INFORMATION,
1807 if (!NT_STATUS_IS_OK(result)) {
1808 DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
1809 "on domain %s failed: (%s)\n",
1810 domain->name, nt_errstr(result)));
1812 /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
1813 * every opcode on the DSSETUP pipe, continue with
1814 * no_dssetup mode here as well to get domain->initialized
1817 if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
1821 TALLOC_FREE(mem_ctx);
1825 if ((info.basic.flags & DS_ROLE_PRIMARY_DS_RUNNING) &&
1826 !(info.basic.flags & DS_ROLE_PRIMARY_DS_MIXED_MODE)) {
1827 domain->native_mode = True;
1829 domain->native_mode = False;
1833 result = cli_rpc_pipe_open_noauth(domain->conn.cli,
1834 &ndr_table_lsarpc.syntax_id, &cli);
1836 if (!NT_STATUS_IS_OK(result)) {
1837 DEBUG(5, ("set_dc_type_and_flags_connect: Could not bind to "
1838 "PI_LSARPC on domain %s: (%s)\n",
1839 domain->name, nt_errstr(result)));
1841 TALLOC_FREE(mem_ctx);
1845 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1846 SEC_RIGHTS_MAXIMUM_ALLOWED, &pol);
1848 if (NT_STATUS_IS_OK(result)) {
1849 /* This particular query is exactly what Win2k clients use
1850 to determine that the DC is active directory */
1851 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
1853 LSA_POLICY_INFO_DNS,
1857 if (NT_STATUS_IS_OK(result)) {
1858 domain->active_directory = True;
1860 if (lsa_info->dns.name.string) {
1861 fstrcpy(domain->name, lsa_info->dns.name.string);
1864 if (lsa_info->dns.dns_domain.string) {
1865 fstrcpy(domain->alt_name,
1866 lsa_info->dns.dns_domain.string);
1869 /* See if we can set some domain trust flags about
1872 if (lsa_info->dns.dns_forest.string) {
1873 fstrcpy(domain->forest_name,
1874 lsa_info->dns.dns_forest.string);
1876 if (strequal(domain->forest_name, domain->alt_name)) {
1877 domain->domain_flags |= NETR_TRUST_FLAG_TREEROOT;
1881 if (lsa_info->dns.sid) {
1882 sid_copy(&domain->sid, lsa_info->dns.sid);
1885 domain->active_directory = False;
1887 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
1888 SEC_RIGHTS_MAXIMUM_ALLOWED,
1891 if (!NT_STATUS_IS_OK(result)) {
1895 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
1897 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
1900 if (NT_STATUS_IS_OK(result)) {
1902 if (lsa_info->account_domain.name.string) {
1903 fstrcpy(domain->name,
1904 lsa_info->account_domain.name.string);
1907 if (lsa_info->account_domain.sid) {
1908 sid_copy(&domain->sid, lsa_info->account_domain.sid);
1914 DEBUG(5, ("set_dc_type_and_flags_connect: domain %s is %sin native mode.\n",
1915 domain->name, domain->native_mode ? "" : "NOT "));
1917 DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
1918 domain->name, domain->active_directory ? "" : "NOT "));
1922 TALLOC_FREE(mem_ctx);
1924 domain->initialized = True;
1927 /**********************************************************************
1928 Set the domain_flags (trust attributes, domain operating modes, etc...
1929 ***********************************************************************/
1931 static void set_dc_type_and_flags( struct winbindd_domain *domain )
1933 /* we always have to contact our primary domain */
1935 if ( domain->primary ) {
1936 DEBUG(10,("set_dc_type_and_flags: setting up flags for "
1937 "primary domain\n"));
1938 set_dc_type_and_flags_connect( domain );
1942 /* Use our DC to get the information if possible */
1944 if ( !set_dc_type_and_flags_trustinfo( domain ) ) {
1945 /* Otherwise, fallback to contacting the
1947 set_dc_type_and_flags_connect( domain );
1955 /**********************************************************************
1956 ***********************************************************************/
1958 static bool cm_get_schannel_dcinfo(struct winbindd_domain *domain,
1959 struct dcinfo **ppdc)
1962 struct rpc_pipe_client *netlogon_pipe;
1964 if (lp_client_schannel() == False) {
1968 result = cm_connect_netlogon(domain, &netlogon_pipe);
1969 if (!NT_STATUS_IS_OK(result)) {
1973 /* Return a pointer to the struct dcinfo from the
1976 if (!domain->conn.netlogon_pipe->dc) {
1980 *ppdc = domain->conn.netlogon_pipe->dc;
1984 NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
1985 struct rpc_pipe_client **cli, POLICY_HND *sam_handle)
1987 struct winbindd_cm_conn *conn;
1988 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1990 struct dcinfo *p_dcinfo;
1991 char *machine_password = NULL;
1992 char *machine_account = NULL;
1993 char *domain_name = NULL;
1995 result = init_dc_connection(domain);
1996 if (!NT_STATUS_IS_OK(result)) {
2000 conn = &domain->conn;
2002 if (conn->samr_pipe != NULL) {
2008 * No SAMR pipe yet. Attempt to get an NTLMSSP SPNEGO authenticated
2009 * sign and sealed pipe using the machine account password by
2010 * preference. If we can't - try schannel, if that fails, try
2014 pwd_get_cleartext(&conn->cli->pwd, conn_pwd);
2015 if ((conn->cli->user_name[0] == '\0') ||
2016 (conn->cli->domain[0] == '\0') ||
2017 (conn_pwd[0] == '\0'))
2019 result = get_trust_creds(domain, &machine_password,
2020 &machine_account, NULL);
2021 if (!NT_STATUS_IS_OK(result)) {
2022 DEBUG(10, ("cm_connect_sam: No no user available for "
2023 "domain %s, trying schannel\n", conn->cli->domain));
2026 domain_name = domain->name;
2028 machine_password = SMB_STRDUP(conn_pwd);
2029 machine_account = SMB_STRDUP(conn->cli->user_name);
2030 domain_name = conn->cli->domain;
2033 if (!machine_password || !machine_account) {
2034 result = NT_STATUS_NO_MEMORY;
2038 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2039 authenticated SAMR pipe with sign & seal. */
2040 result = cli_rpc_pipe_open_spnego_ntlmssp(conn->cli,
2041 &ndr_table_samr.syntax_id,
2042 PIPE_AUTH_LEVEL_PRIVACY,
2048 if (!NT_STATUS_IS_OK(result)) {
2049 DEBUG(10,("cm_connect_sam: failed to connect to SAMR "
2050 "pipe for domain %s using NTLMSSP "
2051 "authenticated pipe: user %s\\%s. Error was "
2052 "%s\n", domain->name, domain_name,
2053 machine_account, nt_errstr(result)));
2057 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for "
2058 "domain %s using NTLMSSP authenticated "
2059 "pipe: user %s\\%s\n", domain->name,
2060 domain_name, machine_account));
2062 result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2063 conn->samr_pipe->desthost,
2064 SEC_RIGHTS_MAXIMUM_ALLOWED,
2065 &conn->sam_connect_handle);
2066 if (NT_STATUS_IS_OK(result)) {
2069 DEBUG(10,("cm_connect_sam: ntlmssp-sealed rpccli_samr_Connect2 "
2070 "failed for domain %s, error was %s. Trying schannel\n",
2071 domain->name, nt_errstr(result) ));
2072 TALLOC_FREE(conn->samr_pipe);
2076 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2078 if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
2079 /* If this call fails - conn->cli can now be NULL ! */
2080 DEBUG(10, ("cm_connect_sam: Could not get schannel auth info "
2081 "for domain %s, trying anon\n", domain->name));
2084 result = cli_rpc_pipe_open_schannel_with_key
2085 (conn->cli, &ndr_table_samr.syntax_id, PIPE_AUTH_LEVEL_PRIVACY,
2086 domain->name, p_dcinfo, &conn->samr_pipe);
2088 if (!NT_STATUS_IS_OK(result)) {
2089 DEBUG(10,("cm_connect_sam: failed to connect to SAMR pipe for "
2090 "domain %s using schannel. Error was %s\n",
2091 domain->name, nt_errstr(result) ));
2094 DEBUG(10,("cm_connect_sam: connected to SAMR pipe for domain %s using "
2095 "schannel.\n", domain->name ));
2097 result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2098 conn->samr_pipe->desthost,
2099 SEC_RIGHTS_MAXIMUM_ALLOWED,
2100 &conn->sam_connect_handle);
2101 if (NT_STATUS_IS_OK(result)) {
2104 DEBUG(10,("cm_connect_sam: schannel-sealed rpccli_samr_Connect2 failed "
2105 "for domain %s, error was %s. Trying anonymous\n",
2106 domain->name, nt_errstr(result) ));
2107 TALLOC_FREE(conn->samr_pipe);
2111 /* Finally fall back to anonymous. */
2112 result = cli_rpc_pipe_open_noauth(conn->cli, &ndr_table_samr.syntax_id,
2115 if (!NT_STATUS_IS_OK(result)) {
2119 result = rpccli_samr_Connect2(conn->samr_pipe, mem_ctx,
2120 conn->samr_pipe->desthost,
2121 SEC_RIGHTS_MAXIMUM_ALLOWED,
2122 &conn->sam_connect_handle);
2123 if (!NT_STATUS_IS_OK(result)) {
2124 DEBUG(10,("cm_connect_sam: rpccli_samr_Connect2 failed "
2125 "for domain %s Error was %s\n",
2126 domain->name, nt_errstr(result) ));
2131 result = rpccli_samr_OpenDomain(conn->samr_pipe,
2133 &conn->sam_connect_handle,
2134 SEC_RIGHTS_MAXIMUM_ALLOWED,
2136 &conn->sam_domain_handle);
2140 if (!NT_STATUS_IS_OK(result)) {
2141 invalidate_cm_connection(conn);
2145 *cli = conn->samr_pipe;
2146 *sam_handle = conn->sam_domain_handle;
2147 SAFE_FREE(machine_password);
2148 SAFE_FREE(machine_account);
2152 NTSTATUS cm_connect_lsa(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
2153 struct rpc_pipe_client **cli, POLICY_HND *lsa_policy)
2155 struct winbindd_cm_conn *conn;
2156 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2158 struct dcinfo *p_dcinfo;
2160 result = init_dc_connection(domain);
2161 if (!NT_STATUS_IS_OK(result))
2164 conn = &domain->conn;
2166 if (conn->lsa_pipe != NULL) {
2170 pwd_get_cleartext(&conn->cli->pwd, conn_pwd);
2171 if ((conn->cli->user_name[0] == '\0') ||
2172 (conn->cli->domain[0] == '\0') ||
2173 (conn_pwd[0] == '\0')) {
2174 DEBUG(10, ("cm_connect_lsa: No no user available for "
2175 "domain %s, trying schannel\n", conn->cli->domain));
2179 /* We have an authenticated connection. Use a NTLMSSP SPNEGO
2180 * authenticated LSA pipe with sign & seal. */
2181 result = cli_rpc_pipe_open_spnego_ntlmssp
2182 (conn->cli, &ndr_table_lsarpc.syntax_id,
2183 PIPE_AUTH_LEVEL_PRIVACY,
2184 conn->cli->domain, conn->cli->user_name, conn_pwd,
2187 if (!NT_STATUS_IS_OK(result)) {
2188 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2189 "domain %s using NTLMSSP authenticated pipe: user "
2190 "%s\\%s. Error was %s. Trying schannel.\n",
2191 domain->name, conn->cli->domain,
2192 conn->cli->user_name, nt_errstr(result)));
2196 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2197 "NTLMSSP authenticated pipe: user %s\\%s\n",
2198 domain->name, conn->cli->domain, conn->cli->user_name ));
2200 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2201 SEC_RIGHTS_MAXIMUM_ALLOWED,
2203 if (NT_STATUS_IS_OK(result)) {
2207 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2210 TALLOC_FREE(conn->lsa_pipe);
2214 /* Fall back to schannel if it's a W2K pre-SP1 box. */
2216 if (!cm_get_schannel_dcinfo(domain, &p_dcinfo)) {
2217 /* If this call fails - conn->cli can now be NULL ! */
2218 DEBUG(10, ("cm_connect_lsa: Could not get schannel auth info "
2219 "for domain %s, trying anon\n", domain->name));
2222 result = cli_rpc_pipe_open_schannel_with_key
2223 (conn->cli, &ndr_table_lsarpc.syntax_id,
2224 PIPE_AUTH_LEVEL_PRIVACY,
2225 domain->name, p_dcinfo, &conn->lsa_pipe);
2227 if (!NT_STATUS_IS_OK(result)) {
2228 DEBUG(10,("cm_connect_lsa: failed to connect to LSA pipe for "
2229 "domain %s using schannel. Error was %s\n",
2230 domain->name, nt_errstr(result) ));
2233 DEBUG(10,("cm_connect_lsa: connected to LSA pipe for domain %s using "
2234 "schannel.\n", domain->name ));
2236 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2237 SEC_RIGHTS_MAXIMUM_ALLOWED,
2239 if (NT_STATUS_IS_OK(result)) {
2243 DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
2246 TALLOC_FREE(conn->lsa_pipe);
2250 result = cli_rpc_pipe_open_noauth(conn->cli,
2251 &ndr_table_lsarpc.syntax_id,
2253 if (!NT_STATUS_IS_OK(result)) {
2254 result = NT_STATUS_PIPE_NOT_AVAILABLE;
2258 result = rpccli_lsa_open_policy(conn->lsa_pipe, mem_ctx, True,
2259 SEC_RIGHTS_MAXIMUM_ALLOWED,
2262 if (!NT_STATUS_IS_OK(result)) {
2263 invalidate_cm_connection(conn);
2267 *cli = conn->lsa_pipe;
2268 *lsa_policy = conn->lsa_policy;
2272 /****************************************************************************
2273 Open the netlogon pipe to this DC. Use schannel if specified in client conf.
2274 session key stored in conn->netlogon_pipe->dc->sess_key.
2275 ****************************************************************************/
2277 NTSTATUS cm_connect_netlogon(struct winbindd_domain *domain,
2278 struct rpc_pipe_client **cli)
2280 struct winbindd_cm_conn *conn;
2283 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
2285 uint32 sec_chan_type;
2286 const char *account_name;
2287 struct rpc_pipe_client *netlogon_pipe = NULL;
2291 result = init_dc_connection(domain);
2292 if (!NT_STATUS_IS_OK(result)) {
2296 conn = &domain->conn;
2298 if (conn->netlogon_pipe != NULL) {
2299 *cli = conn->netlogon_pipe;
2300 return NT_STATUS_OK;
2303 result = cli_rpc_pipe_open_noauth(conn->cli,
2304 &ndr_table_netlogon.syntax_id,
2306 if (!NT_STATUS_IS_OK(result)) {
2310 if ((!IS_DC) && (!domain->primary)) {
2311 /* Clear the schannel request bit and drop down */
2312 neg_flags &= ~NETLOGON_NEG_SCHANNEL;
2316 if (lp_client_schannel() != False) {
2317 neg_flags |= NETLOGON_NEG_SCHANNEL;
2320 if (!get_trust_pw_hash(domain->name, mach_pwd, &account_name,
2323 TALLOC_FREE(netlogon_pipe);
2324 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2327 result = rpccli_netlogon_setup_creds(
2329 domain->dcname, /* server name. */
2330 domain->name, /* domain name */
2331 global_myname(), /* client name */
2332 account_name, /* machine account */
2333 mach_pwd, /* machine password */
2334 sec_chan_type, /* from get_trust_pw */
2337 if (!NT_STATUS_IS_OK(result)) {
2338 TALLOC_FREE(netlogon_pipe);
2342 if ((lp_client_schannel() == True) &&
2343 ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2344 DEBUG(3, ("Server did not offer schannel\n"));
2345 TALLOC_FREE(netlogon_pipe);
2346 return NT_STATUS_ACCESS_DENIED;
2350 if ((lp_client_schannel() == False) ||
2351 ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
2353 * NetSamLogonEx only works for schannel
2355 domain->can_do_samlogon_ex = False;
2357 /* We're done - just keep the existing connection to NETLOGON
2359 conn->netlogon_pipe = netlogon_pipe;
2360 *cli = conn->netlogon_pipe;
2361 return NT_STATUS_OK;
2364 /* Using the credentials from the first pipe, open a signed and sealed
2365 second netlogon pipe. The session key is stored in the schannel
2366 part of the new pipe auth struct.
2369 result = cli_rpc_pipe_open_schannel_with_key(
2370 conn->cli, &ndr_table_netlogon.syntax_id,
2371 PIPE_AUTH_LEVEL_PRIVACY, domain->name, netlogon_pipe->dc,
2372 &conn->netlogon_pipe);
2374 /* We can now close the initial netlogon pipe. */
2375 TALLOC_FREE(netlogon_pipe);
2377 if (!NT_STATUS_IS_OK(result)) {
2378 DEBUG(3, ("Could not open schannel'ed NETLOGON pipe. Error "
2379 "was %s\n", nt_errstr(result)));
2381 /* make sure we return something besides OK */
2382 return !NT_STATUS_IS_OK(result) ? result : NT_STATUS_PIPE_NOT_AVAILABLE;
2386 * Try NetSamLogonEx for AD domains
2388 domain->can_do_samlogon_ex = domain->active_directory;
2390 *cli = conn->netlogon_pipe;
2391 return NT_STATUS_OK;