source4/dsdb/samdb/cracknames.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    endpoint server for the drsuapi pipe
   5    DsCrackNames()
   6
   7    Copyright (C) Stefan Metzmacher 2004
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "librpc/gen_ndr/ndr_drsuapi.h"
  27 #include "rpc_server/dcerpc_server.h"
  28 #include "rpc_server/common/common.h"
  29 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  30 #include "lib/ldb/include/ldb.h"
  31 #include "lib/ldb/include/ldb_errors.h"
  32 #include "system/kerberos.h"
  33 #include "auth/kerberos/kerberos.h"
  34 #include "dsdb/samdb/samdb.h"
  35 #include "libcli/ldap/ldap.h"
  36 #include "auth/auth.h"
  37
  38 static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
  39                                    struct smb_krb5_context *smb_krb5_context,
  40                                    uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
  41                                    const struct ldb_dn *name_dn, const char *name,
  42                                    const char *domain_filter, const char *result_filter,
  43                                    struct drsuapi_DsNameInfo1 *info1);
  44 static WERROR DsCrackNameOneSyntactical(TALLOC_CTX *mem_ctx,
  45                                         uint32_t format_offered, uint32_t format_desired,
  46                                         const struct ldb_dn *name_dn, const char *name,
  47                                         struct drsuapi_DsNameInfo1 *info1);
  48
  49 static enum drsuapi_DsNameStatus LDB_lookup_spn_alias(krb5_context context, struct ldb_context *ldb_ctx,
  50                                    TALLOC_CTX *mem_ctx,
  51                                    const char *alias_from,
  52                                    char **alias_to)
  53 {
  54         int i;
  55         int ret;
  56         struct ldb_result *res;
  57         struct ldb_message_element *spnmappings;
  58         struct ldb_dn *service_dn = ldb_dn_string_compose(mem_ctx, samdb_base_dn(mem_ctx),
  59                                                 "CN=Directory Service,CN=Windows NT"
  60                                                 ",CN=Services,CN=Configuration");
  61         char *service_dn_str = ldb_dn_linearize(mem_ctx, service_dn);
  62         const char *directory_attrs[] = {
  63                 "sPNMappings",
  64                 NULL
  65         };
  66
  67         ret = ldb_search(ldb_ctx, service_dn, LDB_SCOPE_BASE, "(objectClass=nTDSService)",
  68                            directory_attrs, &res);
  69         talloc_steal(mem_ctx, res);
  70
  71         if (ret != LDB_SUCCESS) {
  72                 DEBUG(1, ("ldb_search: dn: %s not found: %s", service_dn_str, ldb_errstring(ldb_ctx)));
  73                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  74         } else if (res->count > 1) {
  75                 DEBUG(1, ("ldb_search: dn: %s found %d times!", service_dn_str, res->count));
  76                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  77         }
  78
  79         spnmappings = ldb_msg_find_element(res->msgs[0], "sPNMappings");
  80         if (!spnmappings || spnmappings->num_values == 0) {
  81                 DEBUG(1, ("ldb_search: dn: %s no sPNMappings attribute", service_dn_str));
  82                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  83         }
  84
  85         for (i = 0; i < spnmappings->num_values; i++) {
  86                 char *mapping, *p, *str;
  87                 mapping = talloc_strdup(mem_ctx,
  88                                         (const char *)spnmappings->values[i].data);
  89                 if (!mapping) {
  90                         DEBUG(1, ("LDB_lookup_spn_alias: ldb_search: dn: %s did not have an sPNMapping\n", service_dn_str));
  91                         return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  92                 }
  93
  94                 /* C string manipulation sucks */
  95
  96                 p = strchr(mapping, '=');
  97                 if (!p) {
  98                         DEBUG(1, ("ldb_search: dn: %s sPNMapping malformed: %s\n",
  99                                   service_dn_str, mapping));
 100                         return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 101                 }
 102                 p[0] = '\0';
 103                 p++;
 104                 do {
 105                         str = p;
 106                         p = strchr(p, ',');
 107                         if (p) {
 108                                 p[0] = '\0';
 109                                 p++;
 110                         }
 111                         if (strcasecmp(str, alias_from) == 0) {
 112                                 *alias_to = mapping;
 113                                 return DRSUAPI_DS_NAME_STATUS_OK;
 114                         }
 115                 } while (p);
 116         }
 117         DEBUG(1, ("LDB_lookup_spn_alias: no alias for service %s applicable\n", alias_from));
 118         return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 119 }
 120
 121 /* When cracking a ServicePrincipalName, many services may be served
 122  * by the host/ servicePrincipalName.  The incoming query is for cifs/
 123  * but we translate it here, and search on host/.  This is done after
 124  * the cifs/ entry has been searched for, making this a fallback */
 125
 126 static WERROR DsCrackNameSPNAlias(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 127                                   struct smb_krb5_context *smb_krb5_context,
 128                                   uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 129                                   const char *name, struct drsuapi_DsNameInfo1 *info1)
 130 {
 131         WERROR wret;
 132         krb5_error_code ret;
 133         krb5_principal principal;
 134         const char *service;
 135         char *new_service;
 136         char *new_princ;
 137         enum drsuapi_DsNameStatus namestatus;
 138
 139         /* parse principal */
 140         ret = krb5_parse_name_norealm(smb_krb5_context->krb5_context,
 141                                       name, &principal);
 142         if (ret) {
 143                 DEBUG(2, ("Could not parse principal: %s: %s",
 144                           name, smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 145                                                            ret, mem_ctx)));
 146                 return WERR_NOMEM;
 147         }
 148
 149         /* grab cifs/, http/ etc */
 150
 151         /* This is checked for in callers, but be safe */
 152         if (principal->name.name_string.len < 2) {
 153                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 154                 return WERR_OK;
 155         }
 156         service = principal->name.name_string.val[0];
 157
 158         /* MAP it */
 159         namestatus = LDB_lookup_spn_alias(smb_krb5_context->krb5_context,
 160                                           sam_ctx, mem_ctx,
 161                                           service, &new_service);
 162
 163         if (namestatus != DRSUAPI_DS_NAME_STATUS_OK) {
 164                 info1->status = namestatus;
 165                 return WERR_OK;
 166         }
 167
 168         if (ret != 0) {
 169                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 170                 return WERR_OK;
 171         }
 172
 173         /* ooh, very nasty playing around in the Principal... */
 174         free(principal->name.name_string.val[0]);
 175         principal->name.name_string.val[0] = strdup(new_service);
 176         if (!principal->name.name_string.val[0]) {
 177                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 178                 return WERR_NOMEM;
 179         }
 180
 181         /* reform principal */
 182         ret = krb5_unparse_name_norealm(smb_krb5_context->krb5_context, principal, &new_princ);
 183
 184         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 185
 186         if (ret) {
 187                 return WERR_NOMEM;
 188         }
 189
 190         wret = DsCrackNameOneName(sam_ctx, mem_ctx, format_flags, format_offered, format_desired,
 191                                   new_princ, info1);
 192         free(new_princ);
 193         return wret;
 194 }
 195
 196 /* Subcase of CrackNames, for the userPrincipalName */
 197
 198 static WERROR DsCrackNameUPN(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 199                              struct smb_krb5_context *smb_krb5_context,
 200                              uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 201                              const char *name, struct drsuapi_DsNameInfo1 *info1)
 202 {
 203         WERROR status;
 204         const char *domain_filter = NULL;
 205         const char *result_filter = NULL;
 206         krb5_error_code ret;
 207         krb5_principal principal;
 208         char **realm;
 209         char *unparsed_name_short;
 210
 211         /* Prevent recursion */
 212         if (!name) {
 213                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 214                 return WERR_OK;
 215         }
 216
 217         ret = krb5_parse_name_mustrealm(smb_krb5_context->krb5_context, name, &principal);
 218         if (ret) {
 219                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 220                 return WERR_OK;
 221         }
 222
 223         domain_filter = NULL;
 224         realm = krb5_princ_realm(smb_krb5_context->krb5_context, principal);
 225         domain_filter = talloc_asprintf(mem_ctx,
 226                                         "(&(&(|(&(dnsRoot=%s)(nETBIOSName=*))(nETBIOSName=%s))(objectclass=crossRef))(ncName=*))",
 227                                         ldb_binary_encode_string(mem_ctx, *realm),
 228                                         ldb_binary_encode_string(mem_ctx, *realm));
 229         ret = krb5_unparse_name_norealm(smb_krb5_context->krb5_context, principal, &unparsed_name_short);
 230         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 231
 232         if (ret) {
 233                 free(unparsed_name_short);
 234                 return WERR_NOMEM;
 235         }
 236
 237         /* This may need to be extended for more userPrincipalName variations */
 238         result_filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(samAccountName=%s))",
 239                                         ldb_binary_encode_string(mem_ctx, unparsed_name_short));
 240         if (!result_filter || !domain_filter) {
 241                 free(unparsed_name_short);
 242                 return WERR_NOMEM;
 243         }
 244         status = DsCrackNameOneFilter(sam_ctx, mem_ctx,
 245                                       smb_krb5_context,
 246                                       format_flags, format_offered, format_desired,
 247                                       NULL, unparsed_name_short, domain_filter, result_filter,
 248                                       info1);
 249         free(unparsed_name_short);
 250         return status;
 251 }
 252
 253 /* Crack a single 'name', from format_offered into format_desired, returning the result in info1 */
 254
 255 WERROR DsCrackNameOneName(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 256                           uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 257                           const char *name, struct drsuapi_DsNameInfo1 *info1)
 258 {
 259         krb5_error_code ret;
 260         const char *domain_filter = NULL;
 261         const char *result_filter = NULL;
 262         struct ldb_dn *name_dn = NULL;
 263
 264         struct smb_krb5_context *smb_krb5_context;
 265         ret = smb_krb5_init_context(mem_ctx, &smb_krb5_context);
 266
 267         if (ret) {
 268                 return WERR_NOMEM;
 269         }
 270
 271         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 272         info1->dns_domain_name = NULL;
 273         info1->result_name = NULL;
 274
 275         if (!name) {
 276                 return WERR_INVALID_PARAM;
 277         }
 278
 279         /* TODO: - fill the correct names in all cases!
 280          *       - handle format_flags
 281          */
 282
 283         /* here we need to set the domain_filter and/or the result_filter */
 284         switch (format_offered) {
 285         case DRSUAPI_DS_NAME_FORMAT_CANONICAL: {
 286                 char *str;
 287
 288                 str = talloc_strdup(mem_ctx, name);
 289                 WERR_TALLOC_CHECK(str);
 290
 291                 if (strlen(str) == 0 || str[strlen(str)-1] != '/') {
 292                         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 293                         return WERR_OK;
 294                 }
 295
 296                 str[strlen(str)-1] = '\0';
 297
 298                 domain_filter = talloc_asprintf(mem_ctx,
 299                                                 "(&(&(&(dnsRoot=%s)(objectclass=crossRef)))(nETBIOSName=*)(ncName=*))",
 300                                                 ldb_binary_encode_string(mem_ctx, str));
 301                 WERR_TALLOC_CHECK(domain_filter);
 302
 303                 break;
 304         }
 305         case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT: {
 306                 char *p;
 307                 char *domain;
 308                 const char *account = NULL;
 309
 310                 domain = talloc_strdup(mem_ctx, name);
 311                 WERR_TALLOC_CHECK(domain);
 312
 313                 p = strchr(domain, '\\');
 314                 if (!p) {
 315                         /* invalid input format */
 316                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 317                         return WERR_OK;
 318                 }
 319                 p[0] = '\0';
 320
 321                 if (p[1]) {
 322                         account = &p[1];
 323                 }
 324
 325                 domain_filter = talloc_asprintf(mem_ctx,
 326                                                 "(&(&(nETBIOSName=%s)(objectclass=crossRef))(ncName=*))",
 327                                                 ldb_binary_encode_string(mem_ctx, domain));
 328                 WERR_TALLOC_CHECK(domain_filter);
 329                 if (account) {
 330                         result_filter = talloc_asprintf(mem_ctx, "(sAMAccountName=%s)",
 331                                                         ldb_binary_encode_string(mem_ctx, account));
 332                         WERR_TALLOC_CHECK(result_filter);
 333                 }
 334
 335                 talloc_free(domain);
 336                 break;
 337         }
 338         case DRSUAPI_DS_NAME_FORMAT_FQDN_1779: {
 339                 name_dn = ldb_dn_explode(mem_ctx, name);
 340                 domain_filter = NULL;
 341                 if (!name_dn) {
 342                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 343                         return WERR_OK;
 344                 }
 345                 break;
 346         }
 347         case DRSUAPI_DS_NAME_FORMAT_GUID: {
 348                 struct GUID guid;
 349                 char *ldap_guid;
 350                 NTSTATUS nt_status;
 351                 domain_filter = NULL;
 352
 353                 nt_status = GUID_from_string(name, &guid);
 354                 if (!NT_STATUS_IS_OK(nt_status)) {
 355                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 356                         return WERR_OK;
 357                 }
 358
 359                 ldap_guid = ldap_encode_ndr_GUID(mem_ctx, &guid);
 360                 if (!ldap_guid) {
 361                         return WERR_NOMEM;
 362                 }
 363                 result_filter = talloc_asprintf(mem_ctx, "(objectGUID=%s)",
 364                                                 ldap_guid);
 365                 WERR_TALLOC_CHECK(result_filter);
 366                 break;
 367         }
 368         case DRSUAPI_DS_NAME_FORMAT_DISPLAY: {
 369                 domain_filter = NULL;
 370
 371                 result_filter = talloc_asprintf(mem_ctx, "(|(displayName=%s)(samAccountName=%s))",
 372                                                 ldb_binary_encode_string(mem_ctx, name),
 373                                                 ldb_binary_encode_string(mem_ctx, name));
 374                 WERR_TALLOC_CHECK(result_filter);
 375                 break;
 376         }
 377
 378         case DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY: {
 379                 struct dom_sid *sid = dom_sid_parse_talloc(mem_ctx, name);
 380                 char *ldap_sid;
 381
 382                 domain_filter = NULL;
 383                 if (!sid) {
 384                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 385                         return WERR_OK;
 386                 }
 387                 ldap_sid = ldap_encode_ndr_dom_sid(mem_ctx,
 388                                                    sid);
 389                 if (!ldap_sid) {
 390                         return WERR_NOMEM;
 391                 }
 392                 result_filter = talloc_asprintf(mem_ctx, "(objectSid=%s)",
 393                                                 ldap_sid);
 394                 WERR_TALLOC_CHECK(result_filter);
 395                 break;
 396         }
 397         case DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL: {
 398                 krb5_principal principal;
 399                 char *unparsed_name;
 400                 ret = krb5_parse_name(smb_krb5_context->krb5_context, name, &principal);
 401                 if (ret) {
 402                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 403                         return WERR_OK;
 404                 }
 405
 406                 domain_filter = NULL;
 407
 408                 ret = krb5_unparse_name(smb_krb5_context->krb5_context, principal, &unparsed_name);
 409                 if (ret) {
 410                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 411                         return WERR_NOMEM;
 412                 }
 413
 414                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 415                 result_filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(userPrincipalName=%s))",
 416                                                 ldb_binary_encode_string(mem_ctx, unparsed_name));
 417
 418                 free(unparsed_name);
 419                 WERR_TALLOC_CHECK(result_filter);
 420                 break;
 421         }
 422         case DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL: {
 423                 krb5_principal principal;
 424                 char *unparsed_name_short;
 425                 char *service;
 426                 ret = krb5_parse_name_norealm(smb_krb5_context->krb5_context, name, &principal);
 427                 if (ret) {
 428                         /* perhaps it's a principal with a realm, so return the right 'domain only' response */
 429                         char **realm;
 430                         ret = krb5_parse_name_mustrealm(smb_krb5_context->krb5_context, name, &principal);
 431                         if (ret) {
 432                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 433                                 return WERR_OK;
 434                         }
 435
 436                         /* This isn't an allocation assignemnt, so it is free'ed with the krb5_free_principal */
 437                         realm = krb5_princ_realm(smb_krb5_context->krb5_context, principal);
 438
 439                         info1->dns_domain_name  = talloc_strdup(info1, *realm);
 440                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 441
 442                         WERR_TALLOC_CHECK(info1->dns_domain_name);
 443
 444                         info1->status = DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY;
 445                         return WERR_OK;
 446
 447                 } else if (principal->name.name_string.len < 2) {
 448                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 449                         return WERR_OK;
 450                 }
 451
 452                 domain_filter = NULL;
 453
 454                 ret = krb5_unparse_name_norealm(smb_krb5_context->krb5_context, principal, &unparsed_name_short);
 455                 if (ret) {
 456                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 457                         return WERR_NOMEM;
 458                 }
 459
 460                 service = principal->name.name_string.val[0];
 461                 if ((principal->name.name_string.len == 2) && (strcasecmp(service, "host") == 0)) {
 462                         /* the 'cn' attribute is just the leading part of the name */
 463                         char *computer_name;
 464                         computer_name = talloc_strndup(mem_ctx, principal->name.name_string.val[1],
 465                                                       strcspn(principal->name.name_string.val[1], "."));
 466                         if (computer_name == NULL) {
 467                                 return WERR_NOMEM;
 468                         }
 469
 470                         result_filter = talloc_asprintf(mem_ctx, "(|(&(servicePrincipalName=%s)(objectClass=user))(&(cn=%s)(objectClass=computer)))",
 471                                                         ldb_binary_encode_string(mem_ctx, unparsed_name_short),
 472                                                         ldb_binary_encode_string(mem_ctx, computer_name));
 473                 } else {
 474                         result_filter = talloc_asprintf(mem_ctx, "(&(servicePrincipalName=%s)(objectClass=user))",
 475                                                         ldb_binary_encode_string(mem_ctx, unparsed_name_short));
 476                 }
 477                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 478                 free(unparsed_name_short);
 479                 WERR_TALLOC_CHECK(result_filter);
 480
 481                 break;
 482         }
 483         default: {
 484                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 485                 return WERR_OK;
 486         }
 487
 488         }
 489
 490         if (format_flags & DRSUAPI_DS_NAME_FLAG_SYNTACTICAL_ONLY) {
 491                 return DsCrackNameOneSyntactical(mem_ctx, format_offered, format_desired,
 492                                                  name_dn, name, info1);
 493         }
 494
 495         return DsCrackNameOneFilter(sam_ctx, mem_ctx,
 496                                     smb_krb5_context,
 497                                     format_flags, format_offered, format_desired,
 498                                     name_dn, name,
 499                                     domain_filter, result_filter,
 500                                     info1);
 501 }
 502
 503 /* Subcase of CrackNames.  It is possible to translate a LDAP-style DN
 504  * (FQDN_1779) into a canoical name without actually searching the
 505  * database */
 506
 507 static WERROR DsCrackNameOneSyntactical(TALLOC_CTX *mem_ctx,
 508                                         uint32_t format_offered, uint32_t format_desired,
 509                                         const struct ldb_dn *name_dn, const char *name,
 510                                         struct drsuapi_DsNameInfo1 *info1)
 511 {
 512         char *cracked;
 513         if (format_offered != DRSUAPI_DS_NAME_FORMAT_FQDN_1779) {
 514                 info1->status = DRSUAPI_DS_NAME_STATUS_NO_SYNTACTICAL_MAPPING;
 515                 return WERR_OK;
 516         }
 517
 518         switch (format_desired) {
 519         case DRSUAPI_DS_NAME_FORMAT_CANONICAL:
 520                 cracked = ldb_dn_canonical_string(mem_ctx, name_dn);
 521                 break;
 522         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX:
 523                 cracked = ldb_dn_canonical_ex_string(mem_ctx, name_dn);
 524                 break;
 525         default:
 526                 info1->status = DRSUAPI_DS_NAME_STATUS_NO_SYNTACTICAL_MAPPING;
 527                 return WERR_OK;
 528         }
 529         info1->status = DRSUAPI_DS_NAME_STATUS_OK;
 530         info1->result_name      = cracked;
 531         if (!cracked) {
 532                 return WERR_NOMEM;
 533         }
 534
 535         return WERR_OK;
 536 }
 537
 538 /* Given a filter for the domain, and one for the result, perform the
 539  * ldb search. The format offered and desired flags change the
 540  * behaviours, including what attributes to return.
 541  *
 542  * The smb_krb5_context is required because we use the krb5 libs for principal parsing
 543  */
 544
 545 static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 546                                    struct smb_krb5_context *smb_krb5_context,
 547                                    uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 548                                    const struct ldb_dn *name_dn, const char *name,
 549                                    const char *domain_filter, const char *result_filter,
 550                                    struct drsuapi_DsNameInfo1 *info1)
 551 {
 552         int ldb_ret;
 553         struct ldb_message **domain_res = NULL;
 554         const char * const *domain_attrs;
 555         const char * const *result_attrs;
 556         struct ldb_message **result_res = NULL;
 557         const struct ldb_dn *result_basedn;
 558
 559         /* here we need to set the attrs lists for domain and result lookups */
 560         switch (format_desired) {
 561         case DRSUAPI_DS_NAME_FORMAT_FQDN_1779:
 562         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX: {
 563                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", NULL};
 564                 const char * const _result_attrs[] = { NULL};
 565
 566                 domain_attrs = _domain_attrs;
 567                 result_attrs = _result_attrs;
 568                 break;
 569         }
 570         case DRSUAPI_DS_NAME_FORMAT_CANONICAL: {
 571                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", NULL};
 572                 const char * const _result_attrs[] = { "canonicalName", NULL };
 573
 574                 domain_attrs = _domain_attrs;
 575                 result_attrs = _result_attrs;
 576                 break;
 577         }
 578         case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT: {
 579                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", "nETBIOSName", NULL};
 580                 const char * const _result_attrs[] = { "sAMAccountName", "objectSid", NULL};
 581
 582                 domain_attrs = _domain_attrs;
 583                 result_attrs = _result_attrs;
 584                 break;
 585         }
 586         case DRSUAPI_DS_NAME_FORMAT_GUID: {
 587                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", NULL};
 588                 const char * const _result_attrs[] = { "objectGUID", NULL};
 589
 590                 domain_attrs = _domain_attrs;
 591                 result_attrs = _result_attrs;
 592                 break;
 593         }
 594         case DRSUAPI_DS_NAME_FORMAT_DISPLAY: {
 595                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", NULL};
 596                 const char * const _result_attrs[] = { "displayName", "samAccountName", NULL};
 597
 598                 domain_attrs = _domain_attrs;
 599                 result_attrs = _result_attrs;
 600                 break;
 601         }
 602         default:
 603                 return WERR_OK;
 604         }
 605
 606         if (domain_filter) {
 607                 /* if we have a domain_filter look it up and set the result_basedn and the dns_domain_name */
 608                 ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res, domain_attrs,
 609                                        "%s", domain_filter);
 610         } else {
 611                 ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res, domain_attrs,
 612                                        "(ncName=%s)", ldb_dn_linearize(mem_ctx, samdb_base_dn(mem_ctx)));
 613         }
 614
 615         switch (ldb_ret) {
 616         case 1:
 617                 break;
 618         case 0:
 619                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 620                 return WERR_OK;
 621         case -1:
 622                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 623                 return WERR_OK;
 624         default:
 625                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
 626                 return WERR_OK;
 627         }
 628
 629         info1->dns_domain_name  = samdb_result_string(domain_res[0], "dnsRoot", NULL);
 630         WERR_TALLOC_CHECK(info1->dns_domain_name);
 631         info1->status           = DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY;
 632
 633         if (result_filter) {
 634                 result_basedn = samdb_result_dn(mem_ctx, domain_res[0], "ncName", NULL);
 635
 636                 ldb_ret = gendb_search(sam_ctx, mem_ctx, result_basedn, &result_res,
 637                                        result_attrs, "%s", result_filter);
 638         } else if (format_offered == DRSUAPI_DS_NAME_FORMAT_FQDN_1779) {
 639                 ldb_ret = gendb_search_dn(sam_ctx, mem_ctx, name_dn, &result_res,
 640                                           result_attrs);
 641         } else {
 642                 name_dn = samdb_result_dn(mem_ctx, domain_res[0], "ncName", NULL);
 643                 ldb_ret = gendb_search_dn(sam_ctx, mem_ctx, name_dn, &result_res,
 644                                           result_attrs);
 645         }
 646
 647         switch (ldb_ret) {
 648         case 1:
 649                 break;
 650         case 0:
 651                 switch (format_offered) {
 652                 case DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL:
 653                         return DsCrackNameSPNAlias(sam_ctx, mem_ctx,
 654                                                    smb_krb5_context,
 655                                                    format_flags, format_offered, format_desired,
 656                                                    name, info1);
 657
 658                 case DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL:
 659                         return DsCrackNameUPN(sam_ctx, mem_ctx, smb_krb5_context,
 660                                               format_flags, format_offered, format_desired,
 661                                               name, info1);
 662                 }
 663                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 664                 return WERR_OK;
 665         case -1:
 666                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 667                 return WERR_OK;
 668         default:
 669                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
 670                 return WERR_OK;
 671         }
 672
 673         /* here we can use result_res[0] and domain_res[0] */
 674         switch (format_desired) {
 675         case DRSUAPI_DS_NAME_FORMAT_FQDN_1779: {
 676                 info1->result_name      = ldb_dn_linearize(mem_ctx, result_res[0]->dn);
 677                 WERR_TALLOC_CHECK(info1->result_name);
 678
 679                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 680                 return WERR_OK;
 681         }
 682         case DRSUAPI_DS_NAME_FORMAT_CANONICAL: {
 683                 info1->result_name      = samdb_result_string(result_res[0], "canonicalName", NULL);
 684                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 685                 return WERR_OK;
 686         }
 687         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX: {
 688                 /* Not in the virtual ldb attribute */
 689                 return DsCrackNameOneSyntactical(mem_ctx,
 690                                                  DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 691                                                  DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX,
 692                                                  result_res[0]->dn, name, info1);
 693         }
 694         case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT: {
 695                 const struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, result_res[0], "objectSid");
 696                 const char *_acc = "", *_dom = "";
 697
 698                 if (!sid || (sid->num_auths < 4) || (sid->num_auths > 5)) {
 699                         info1->status = DRSUAPI_DS_NAME_STATUS_NO_MAPPING;
 700                         return WERR_OK;
 701                 }
 702
 703                 if (sid->num_auths == 4) {
 704                         ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res, domain_attrs,
 705                                                "(ncName=%s)", ldb_dn_linearize(mem_ctx, result_res[0]->dn));
 706                         if (ldb_ret != 1) {
 707                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 708                                 return WERR_OK;
 709                         }
 710                         _dom = samdb_result_string(domain_res[0], "nETBIOSName", NULL);
 711                         WERR_TALLOC_CHECK(_dom);
 712
 713                 } else if (sid->num_auths == 5) {
 714                         const char *attrs[] = { NULL };
 715                         struct ldb_message **domain_res2;
 716                         struct dom_sid *dom_sid = dom_sid_dup(mem_ctx, sid);
 717                         if (!dom_sid) {
 718                                 return WERR_OK;
 719                         }
 720                         dom_sid->num_auths--;
 721                         ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res, attrs,
 722                                                "(objectSid=%s)", ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
 723                         if (ldb_ret != 1) {
 724                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 725                                 return WERR_OK;
 726                         }
 727                         ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res2, domain_attrs,
 728                                                "(ncName=%s)", ldb_dn_linearize(mem_ctx, domain_res[0]->dn));
 729                         if (ldb_ret != 1) {
 730                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 731                                 return WERR_OK;
 732                         }
 733
 734                         _dom = samdb_result_string(domain_res2[0], "nETBIOSName", NULL);
 735                         WERR_TALLOC_CHECK(_dom);
 736
 737                         _acc = samdb_result_string(result_res[0], "sAMAccountName", NULL);
 738                         WERR_TALLOC_CHECK(_acc);
 739                 }
 740
 741                 info1->result_name      = talloc_asprintf(mem_ctx, "%s\\%s", _dom, _acc);
 742                 WERR_TALLOC_CHECK(info1->result_name);
 743
 744                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 745                 return WERR_OK;
 746         }
 747         case DRSUAPI_DS_NAME_FORMAT_GUID: {
 748                 struct GUID guid;
 749
 750                 guid = samdb_result_guid(result_res[0], "objectGUID");
 751
 752                 info1->result_name      = GUID_string2(mem_ctx, &guid);
 753                 WERR_TALLOC_CHECK(info1->result_name);
 754
 755                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 756                 return WERR_OK;
 757         }
 758         case DRSUAPI_DS_NAME_FORMAT_DISPLAY: {
 759                 info1->result_name      = samdb_result_string(result_res[0], "displayName", NULL);
 760                 if (!info1->result_name) {
 761                         info1->result_name      = samdb_result_string(result_res[0], "sAMAccountName", NULL);
 762                 }
 763                 if (!info1->result_name) {
 764                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 765                 } else {
 766                         info1->status = DRSUAPI_DS_NAME_STATUS_OK;
 767                 }
 768                 return WERR_OK;
 769         }
 770         default:
 771                 return WERR_OK;
 772         }
 773
 774         return WERR_INVALID_PARAM;
 775 }
 776
 777 /* Given a user Principal Name (such as foo@bar.com),
 778  * return the user and domain DNs.  This is used in the KDC to then
 779  * return the Keys and evaluate policy */
 780
 781 NTSTATUS crack_user_principal_name(struct ldb_context *sam_ctx,
 782                                    TALLOC_CTX *mem_ctx,
 783                                    const char *user_principal_name,
 784                                    struct ldb_dn **user_dn,
 785                                    struct ldb_dn **domain_dn)
 786 {
 787         WERROR werr;
 788         struct drsuapi_DsNameInfo1 info1;
 789         werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
 790                                   DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL,
 791                                   DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 792                                   user_principal_name,
 793                                   &info1);
 794         if (!W_ERROR_IS_OK(werr)) {
 795                 return werror_to_ntstatus(werr);
 796         }
 797         switch (info1.status) {
 798         case DRSUAPI_DS_NAME_STATUS_OK:
 799                 break;
 800         case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 801         case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 802         case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 803                 return NT_STATUS_NO_SUCH_USER;
 804         case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 805         default:
 806                 return NT_STATUS_UNSUCCESSFUL;
 807         }
 808
 809         *user_dn = ldb_dn_explode(mem_ctx, info1.result_name);
 810
 811         if (domain_dn) {
 812                 werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
 813                                           DRSUAPI_DS_NAME_FORMAT_CANONICAL,
 814                                           DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 815                                           talloc_asprintf(mem_ctx, "%s/",
 816                                                           info1.dns_domain_name),
 817                                           &info1);
 818                 if (!W_ERROR_IS_OK(werr)) {
 819                         return werror_to_ntstatus(werr);
 820                 }
 821                 switch (info1.status) {
 822                 case DRSUAPI_DS_NAME_STATUS_OK:
 823                         break;
 824                 case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 825                 case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 826                 case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 827                         return NT_STATUS_NO_SUCH_USER;
 828                 case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 829                 default:
 830                         return NT_STATUS_UNSUCCESSFUL;
 831                 }
 832
 833                 *domain_dn = ldb_dn_explode(mem_ctx, info1.result_name);
 834         }
 835
 836         return NT_STATUS_OK;
 837
 838 }
 839
 840 /* Given a Service Principal Name (such as host/foo.bar.com@BAR.COM),
 841  * return the user and domain DNs.  This is used in the KDC to then
 842  * return the Keys and evaluate policy */
 843
 844 NTSTATUS crack_service_principal_name(struct ldb_context *sam_ctx,
 845                                       TALLOC_CTX *mem_ctx,
 846                                       const char *service_principal_name,
 847                                       struct ldb_dn **user_dn,
 848                                       struct ldb_dn **domain_dn)
 849 {
 850         WERROR werr;
 851         struct drsuapi_DsNameInfo1 info1;
 852         werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
 853                                   DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL,
 854                                   DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 855                                   service_principal_name,
 856                                   &info1);
 857         if (!W_ERROR_IS_OK(werr)) {
 858                 return werror_to_ntstatus(werr);
 859         }
 860         switch (info1.status) {
 861         case DRSUAPI_DS_NAME_STATUS_OK:
 862                 break;
 863         case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 864         case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 865         case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 866                 return NT_STATUS_NO_SUCH_USER;
 867         case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 868         default:
 869                 return NT_STATUS_UNSUCCESSFUL;
 870         }
 871
 872         *user_dn = ldb_dn_explode(mem_ctx, info1.result_name);
 873
 874         if (domain_dn) {
 875                 werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
 876                                           DRSUAPI_DS_NAME_FORMAT_CANONICAL,
 877                                           DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 878                                           talloc_asprintf(mem_ctx, "%s/",
 879                                                           info1.dns_domain_name),
 880                                           &info1);
 881                 if (!W_ERROR_IS_OK(werr)) {
 882                         return werror_to_ntstatus(werr);
 883                 }
 884                 switch (info1.status) {
 885                 case DRSUAPI_DS_NAME_STATUS_OK:
 886                         break;
 887                 case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 888                 case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 889                 case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 890                         return NT_STATUS_NO_SUCH_USER;
 891                 case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 892                 default:
 893                         return NT_STATUS_UNSUCCESSFUL;
 894                 }
 895
 896                 *domain_dn = ldb_dn_explode(mem_ctx, info1.result_name);
 897         }
 898
 899         return NT_STATUS_OK;
 900
 901 }
 902
 903 NTSTATUS crack_dn_to_nt4_name(TALLOC_CTX *mem_ctx,
 904                               const char *dn,
 905                               const char **nt4_domain, const char **nt4_account)
 906 {
 907         WERROR werr;
 908         struct drsuapi_DsNameInfo1 info1;
 909         struct ldb_context *ldb;
 910         char *p;
 911
 912         /* Handle anonymous bind */
 913         if (!dn || !*dn) {
 914                 *nt4_domain = "";
 915                 *nt4_account = "";
 916                 return NT_STATUS_OK;
 917         }
 918
 919         ldb = samdb_connect(mem_ctx, system_session(mem_ctx));
 920         if (ldb == NULL) {
 921                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 922         }
 923
 924         werr = DsCrackNameOneName(ldb, mem_ctx, 0,
 925                                   DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 926                                   DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT,
 927                                   dn,
 928                                   &info1);
 929         if (!W_ERROR_IS_OK(werr)) {
 930                 return werror_to_ntstatus(werr);
 931         }
 932         switch (info1.status) {
 933         case DRSUAPI_DS_NAME_STATUS_OK:
 934                 break;
 935         case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 936         case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 937         case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 938                 return NT_STATUS_NO_SUCH_USER;
 939         case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 940         default:
 941                 return NT_STATUS_UNSUCCESSFUL;
 942         }
 943
 944         *nt4_domain = talloc_strdup(mem_ctx, info1.result_name);
 945
 946         p = strchr(*nt4_domain, '\\');
 947         if (!p) {
 948                 return NT_STATUS_INVALID_PARAMETER;
 949         }
 950         p[0] = '\0';
 951
 952         if (p[1]) {
 953                 *nt4_account = talloc_strdup(mem_ctx, &p[1]);
 954         }
 955
 956         if (!*nt4_account || !*nt4_domain) {
 957                 return NT_STATUS_NO_MEMORY;
 958         }
 959
 960         return NT_STATUS_OK;
 961
 962 }