source4/winbind/wb_init_domain.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    A composite API for initializing a domain
   5
   6    Copyright (C) Volker Lendecke 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/composite/composite.h"
  25 #include "libcli/smb_composite/smb_composite.h"
  26 #include "winbind/wb_server.h"
  27 #include "smbd/service_task.h"
  28
  29 #include "libcli/auth/credentials.h"
  30
  31 #include "libcli/ldap/ldap_client.h"
  32
  33
  34 /*
  35  * Initialize a domain:
  36  *
  37  * - With schannel credentials, try to open the SMB connection with the
  38  *   machine creds. This works against W2k3SP1 with an NTLMSSP session
  39  *   setup. Fall back to anonymous.
  40  *
  41  * - If we have schannel creds, do the auth2 and open the schannel'ed netlogon
  42  *   pipe.
  43  *
  44  * - Open LSA. If we have machine creds, try to open with ntlmssp. Fall back
  45  *   to schannel and then to anon bind.
  46  *
  47  * - With queryinfopolicy, verify that we're talking to the right domain
  48  *
  49  * A bit complex, but with all the combinations I think it's the best we can
  50  * get. NT4, W2k3 and W2k all have different combinations, but in the end we
  51  * have a signed&sealed lsa connection on all of them.
  52  *
  53  * Not sure if it is overkill, but it seems to work.
  54  */
  55
  56 struct init_domain_state {
  57         struct composite_context *ctx;
  58         struct wbsrv_domain *domain;
  59         struct wbsrv_service *service;
  60
  61         struct smb_composite_connect conn;
  62
  63         struct lsa_QueryInfoPolicy queryinfo;
  64 };
  65
  66 static void init_domain_recv_tree(struct composite_context *ctx);
  67 static void init_domain_recv_netlogoncreds(struct composite_context *ctx);
  68 static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
  69 static void init_domain_recv_schannel(struct composite_context *ctx);
  70 static void init_domain_recv_lsa(struct composite_context *ctx);
  71 static void init_domain_recv_queryinfo(struct rpc_request *req);
  72 static void init_domain_recv_ldapconn(struct composite_context *ctx);
  73 static void init_domain_recv_samr(struct composite_context *ctx);
  74
  75 struct composite_context *wb_init_domain_send(TALLOC_CTX *mem_ctx,
  76                                               struct wbsrv_service *service,
  77                                               struct wb_dom_info *dom_info)
  78 {
  79         struct composite_context *result, *ctx;
  80         struct init_domain_state *state;
  81
  82         result = talloc(mem_ctx, struct composite_context);
  83         if (result == NULL) goto failed;
  84         result->state = COMPOSITE_STATE_IN_PROGRESS;
  85         result->async.fn = NULL;
  86         result->event_ctx = service->task->event_ctx;
  87
  88         state = talloc_zero(result, struct init_domain_state);
  89         if (state == NULL) goto failed;
  90         state->ctx = result;
  91         result->private_data = state;
  92
  93         state->service = service;
  94
  95         state->domain = talloc(state, struct wbsrv_domain);
  96         if (state->domain == NULL) goto failed;
  97
  98         state->domain->info = talloc_reference(state->domain, dom_info);
  99         if (state->domain->info == NULL) goto failed;
 100
 101         state->domain->schannel_creds = cli_credentials_init(state->domain);
 102         if (state->domain->schannel_creds == NULL) goto failed;
 103
 104         cli_credentials_set_conf(state->domain->schannel_creds);
 105         state->ctx->status =
 106                 cli_credentials_set_machine_account(state->domain->
 107                                                     schannel_creds);
 108         if (!NT_STATUS_IS_OK(state->ctx->status)) goto failed;
 109
 110         state->conn.in.dest_host = dom_info->dc_address;
 111         state->conn.in.port = 0;
 112         state->conn.in.called_name = dom_info->dc_name;
 113         state->conn.in.service = "IPC$";
 114         state->conn.in.service_type = "IPC";
 115         state->conn.in.workgroup = dom_info->name;
 116         state->conn.in.credentials = state->domain->schannel_creds;
 117
 118         state->conn.in.fallback_to_anonymous = True;
 119
 120         ctx = smb_composite_connect_send(&state->conn, state->domain,
 121                                          result->event_ctx);
 122         if (ctx == NULL) goto failed;
 123
 124         ctx->async.fn = init_domain_recv_tree;
 125         ctx->async.private_data = state;
 126         return result;
 127
 128  failed:
 129         talloc_free(result);
 130         return NULL;
 131 }
 132
 133 static void init_domain_recv_tree(struct composite_context *ctx)
 134 {
 135         struct init_domain_state *state =
 136                 talloc_get_type(ctx->async.private_data,
 137                                 struct init_domain_state);
 138         state->ctx->status = smb_composite_connect_recv(ctx, state);
 139         if (!composite_is_ok(state->ctx)) return;
 140
 141         if ((state->domain->schannel_creds != NULL) &&
 142             (!cli_credentials_is_anonymous(state->domain->schannel_creds)) &&
 143             ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
 144              (dom_sid_equal(state->domain->info->sid,
 145                             state->service->primary_sid)))) {
 146                 ctx = wb_get_schannel_creds_send(state,
 147                                                  state->domain->schannel_creds,
 148                                                  state->conn.out.tree,
 149                                                  state->ctx->event_ctx);
 150                 composite_continue(state->ctx, ctx,
 151                                    init_domain_recv_netlogoncreds, state);
 152                 return;
 153         }
 154
 155         ctx = wb_connect_lsa_send(state, state->conn.out.tree, NULL);
 156         composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
 157 }
 158
 159 static void init_domain_recv_netlogoncreds(struct composite_context *ctx)
 160 {
 161         struct init_domain_state *state =
 162                 talloc_get_type(ctx->async.private_data,
 163                                 struct init_domain_state);
 164         struct dcerpc_pipe *auth2_pipe;
 165         struct smbcli_tree *tree = NULL;
 166
 167         state->ctx->status =
 168                 wb_get_schannel_creds_recv(ctx, state, &auth2_pipe);
 169         if (!composite_is_ok(state->ctx)) return;
 170
 171         if (!lp_winbind_sealed_pipes()) {
 172                 state->domain->netlogon_pipe = talloc_reference(state->domain,
 173                                                                 auth2_pipe);
 174                 ctx = wb_connect_lsa_send(state, state->conn.out.tree, NULL);
 175                 composite_continue(state->ctx, ctx, init_domain_recv_lsa,
 176                                    state);
 177                 return;
 178         }
 179
 180         state->domain->netlogon_pipe =
 181                 dcerpc_pipe_init(state->domain, state->ctx->event_ctx);
 182         if (composite_nomem(state->domain->netlogon_pipe, state->ctx)) return;
 183
 184         tree = dcerpc_smb_tree(auth2_pipe->conn);
 185         if (tree == NULL) {
 186                 composite_error(state->ctx, NT_STATUS_INTERNAL_ERROR);
 187                 return;
 188         }
 189
 190         ctx = dcerpc_pipe_open_smb_send(state->domain->netlogon_pipe->conn,
 191                                         tree, "\\netlogon");
 192         composite_continue(state->ctx, ctx, init_domain_recv_netlogonpipe,
 193                            state);
 194 }
 195
 196 static void init_domain_recv_netlogonpipe(struct composite_context *ctx)
 197 {
 198         struct init_domain_state *state =
 199                 talloc_get_type(ctx->async.private_data,
 200                                 struct init_domain_state);
 201
 202         state->ctx->status = dcerpc_pipe_open_smb_recv(ctx);
 203         if (!composite_is_ok(state->ctx)) return;
 204
 205         state->domain->netlogon_pipe->conn->flags |=
 206                 (DCERPC_SIGN | DCERPC_SEAL);
 207         ctx = dcerpc_bind_auth_send(state, state->domain->netlogon_pipe,
 208                                     &dcerpc_table_netlogon,
 209                                     state->domain->schannel_creds,
 210                                     DCERPC_AUTH_TYPE_SCHANNEL,
 211                                     DCERPC_AUTH_LEVEL_PRIVACY,
 212                                     NULL);
 213         composite_continue(state->ctx, ctx, init_domain_recv_schannel, state);
 214 }
 215
 216 static void init_domain_recv_schannel(struct composite_context *ctx)
 217 {
 218         struct init_domain_state *state =
 219                 talloc_get_type(ctx->async.private_data,
 220                                 struct init_domain_state);
 221
 222         state->ctx->status = dcerpc_bind_auth_recv(ctx);
 223         if (!composite_is_ok(state->ctx)) return;
 224
 225         ctx = wb_connect_lsa_send(state, state->conn.out.tree,
 226                                   state->domain->schannel_creds);
 227         composite_continue(state->ctx, ctx, init_domain_recv_lsa, state);
 228 }
 229
 230 static void init_domain_recv_lsa(struct composite_context *ctx)
 231 {
 232         struct init_domain_state *state =
 233                 talloc_get_type(ctx->async.private_data,
 234                                 struct init_domain_state);
 235
 236         struct rpc_request *req;
 237
 238         state->ctx->status = wb_connect_lsa_recv(ctx, state->domain,
 239                                                  &state->domain->lsa_auth_type,
 240                                                  &state->domain->lsa_pipe,
 241                                                  &state->domain->lsa_policy);
 242         if (!composite_is_ok(state->ctx)) return;
 243
 244         /* Give the tree to the pipes. */
 245         talloc_unlink(state, state->conn.out.tree);
 246
 247         state->queryinfo.in.handle = state->domain->lsa_policy;
 248         state->queryinfo.in.level = LSA_POLICY_INFO_ACCOUNT_DOMAIN;
 249
 250         req = dcerpc_lsa_QueryInfoPolicy_send(state->domain->lsa_pipe, state,
 251                                               &state->queryinfo);
 252         composite_continue_rpc(state->ctx, req,
 253                                init_domain_recv_queryinfo, state);
 254 }
 255
 256 static void init_domain_recv_queryinfo(struct rpc_request *req)
 257 {
 258         struct init_domain_state *state =
 259                 talloc_get_type(req->async.private, struct init_domain_state);
 260         struct lsa_DomainInfo *dominfo;
 261         struct composite_context *ctx;
 262         const char *ldap_url;
 263
 264         state->ctx->status = dcerpc_ndr_request_recv(req);
 265         if (!composite_is_ok(state->ctx)) return;
 266         state->ctx->status = state->queryinfo.out.result;
 267         if (!composite_is_ok(state->ctx)) return;
 268
 269         dominfo = &state->queryinfo.out.info->account_domain;
 270
 271         if (strcasecmp(state->domain->info->name, dominfo->name.string) != 0) {
 272                 DEBUG(2, ("Expected domain name %s, DC %s said %s\n",
 273                           state->domain->info->name,
 274                           dcerpc_server_name(state->domain->lsa_pipe),
 275                           dominfo->name.string));
 276                 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
 277                 return;
 278         }
 279
 280         if (!dom_sid_equal(state->domain->info->sid, dominfo->sid)) {
 281                 DEBUG(2, ("Expected domain sid %s, DC %s said %s\n",
 282                           dom_sid_string(state, state->domain->info->sid),
 283                           dcerpc_server_name(state->domain->lsa_pipe),
 284                           dom_sid_string(state, dominfo->sid)));
 285                 composite_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
 286                 return;
 287         }
 288
 289         state->domain->ldap_conn =
 290                 ldap_new_connection(state->domain, state->ctx->event_ctx);
 291         composite_nomem(state->domain->ldap_conn, state->ctx);
 292
 293         ldap_url = talloc_asprintf(state, "ldap://%s/",
 294                                    state->domain->info->dc_address);
 295         composite_nomem(ldap_url, state->ctx);
 296
 297         ctx = ldap_connect_send(state->domain->ldap_conn, ldap_url);
 298         composite_continue(state->ctx, ctx, init_domain_recv_ldapconn, state);
 299 }
 300
 301 static void init_domain_recv_ldapconn(struct composite_context *ctx)
 302 {
 303         struct init_domain_state *state =
 304                 talloc_get_type(ctx->async.private_data,
 305                                 struct init_domain_state);
 306
 307         state->ctx->status = ldap_connect_recv(ctx);
 308         if (NT_STATUS_IS_OK(state->ctx->status)) {
 309                 state->domain->ldap_conn->host =
 310                         talloc_strdup(state->domain->ldap_conn,
 311                                       state->domain->info->dc_name);
 312                 state->ctx->status =
 313                         ldap_bind_sasl(state->domain->ldap_conn,
 314                                        state->domain->schannel_creds);
 315                 DEBUG(0, ("ldap_bind returned %s\n",
 316                           nt_errstr(state->ctx->status)));
 317         }
 318
 319         state->domain->samr_pipe =
 320                 dcerpc_pipe_init(state->domain, state->ctx->event_ctx);
 321         if (composite_nomem(state->domain->samr_pipe, state->ctx)) return;
 322
 323         ctx = wb_connect_sam_send(state, state->conn.out.tree,
 324                                   state->domain->lsa_auth_type,
 325                                   state->domain->schannel_creds,
 326                                   state->domain->info->sid);
 327         composite_continue(state->ctx, ctx, init_domain_recv_samr, state);
 328 }
 329
 330 static void init_domain_recv_samr(struct composite_context *ctx)
 331 {
 332         struct init_domain_state *state =
 333                 talloc_get_type(ctx->async.private_data,
 334                                 struct init_domain_state);
 335
 336         state->ctx->status = wb_connect_sam_recv(
 337                 ctx, state->domain, &state->domain->samr_pipe,
 338                 &state->domain->samr_handle, &state->domain->domain_handle);
 339         if (!composite_is_ok(state->ctx)) return;
 340
 341         composite_done(state->ctx);
 342 }
 343
 344 NTSTATUS wb_init_domain_recv(struct composite_context *c,
 345                              TALLOC_CTX *mem_ctx,
 346                              struct wbsrv_domain **result)
 347 {
 348         NTSTATUS status = composite_wait(c);
 349         if (NT_STATUS_IS_OK(status)) {
 350                 struct init_domain_state *state =
 351                         talloc_get_type(c->private_data,
 352                                         struct init_domain_state);
 353                 *result = talloc_steal(mem_ctx, state->domain);
 354         }
 355         talloc_free(c);
 356         return status;
 357 }
 358
 359 NTSTATUS wb_init_domain(TALLOC_CTX *mem_ctx, struct wbsrv_service *service,
 360                         struct wb_dom_info *dom_info,
 361                         struct wbsrv_domain **result)
 362 {
 363         struct composite_context *c =
 364                 wb_init_domain_send(mem_ctx, service, dom_info);
 365         return wb_init_domain_recv(c, mem_ctx, result);
 366 }