59c52bc27002016cb3ef4b2f7164b19d958222f2
[kai/samba.git] / source3 / utils / net_rpc_samsync.c
1 /*
2    Unix SMB/CIFS implementation.
3    dump the remote SAM using rpc samsync operations
4
5    Copyright (C) Andrew Tridgell 2002
6    Copyright (C) Tim Potter 2001,2002
7    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
8    Modified by Volker Lendecke 2002
9    Copyright (C) Jeremy Allison 2005.
10    Copyright (C) Guenther Deschner 2008.
11
12    This program is free software; you can redistribute it and/or modify
13    it under the terms of the GNU General Public License as published by
14    the Free Software Foundation; either version 3 of the License, or
15    (at your option) any later version.
16
17    This program is distributed in the hope that it will be useful,
18    but WITHOUT ANY WARRANTY; without even the implied warranty of
19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20    GNU General Public License for more details.
21
22    You should have received a copy of the GNU General Public License
23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "utils/net.h"
28 #include "../librpc/gen_ndr/ndr_netlogon.h"
29 #include "../librpc/gen_ndr/ndr_drsuapi.h"
30 #include "libnet/libnet_samsync.h"
31 #include "libnet/libnet_dssync.h"
32 #include "../libcli/security/dom_sid.h"
33
34 static void parse_samsync_partial_replication_objects(TALLOC_CTX *mem_ctx,
35                                                       int argc,
36                                                       const char **argv,
37                                                       bool *do_single_object_replication,
38                                                       struct samsync_object **objects,
39                                                       uint32_t *num_objects)
40 {
41         int i;
42
43         if (argc > 0) {
44                 *do_single_object_replication = true;
45         }
46
47         for (i=0; i<argc; i++) {
48
49                 struct samsync_object o;
50
51                 ZERO_STRUCT(o);
52
53                 if (!StrnCaseCmp(argv[i], "user_rid=", strlen("user_rid="))) {
54                         o.object_identifier.rid         = get_int_param(argv[i]);
55                         o.object_type                   = NETR_DELTA_USER;
56                         o.database_id                   = SAM_DATABASE_DOMAIN;
57                 }
58                 if (!StrnCaseCmp(argv[i], "group_rid=", strlen("group_rid="))) {
59                         o.object_identifier.rid         = get_int_param(argv[i]);
60                         o.object_type                   = NETR_DELTA_GROUP;
61                         o.database_id                   = SAM_DATABASE_DOMAIN;
62                 }
63                 if (!StrnCaseCmp(argv[i], "group_member_rid=", strlen("group_member_rid="))) {
64                         o.object_identifier.rid         = get_int_param(argv[i]);
65                         o.object_type                   = NETR_DELTA_GROUP_MEMBER;
66                         o.database_id                   = SAM_DATABASE_DOMAIN;
67                 }
68                 if (!StrnCaseCmp(argv[i], "alias_rid=", strlen("alias_rid="))) {
69                         o.object_identifier.rid         = get_int_param(argv[i]);
70                         o.object_type                   = NETR_DELTA_ALIAS;
71                         o.database_id                   = SAM_DATABASE_BUILTIN;
72                 }
73                 if (!StrnCaseCmp(argv[i], "alias_member_rid=", strlen("alias_member_rid="))) {
74                         o.object_identifier.rid         = get_int_param(argv[i]);
75                         o.object_type                   = NETR_DELTA_ALIAS_MEMBER;
76                         o.database_id                   = SAM_DATABASE_BUILTIN;
77                 }
78                 if (!StrnCaseCmp(argv[i], "account_sid=", strlen("account_sid="))) {
79                         const char *sid_str = get_string_param(argv[i]);
80                         string_to_sid(&o.object_identifier.sid, sid_str);
81                         o.object_type                   = NETR_DELTA_ACCOUNT;
82                         o.database_id                   = SAM_DATABASE_PRIVS;
83                 }
84                 if (!StrnCaseCmp(argv[i], "policy_sid=", strlen("policy_sid="))) {
85                         const char *sid_str = get_string_param(argv[i]);
86                         string_to_sid(&o.object_identifier.sid, sid_str);
87                         o.object_type                   = NETR_DELTA_POLICY;
88                         o.database_id                   = SAM_DATABASE_PRIVS;
89                 }
90                 if (!StrnCaseCmp(argv[i], "trustdom_sid=", strlen("trustdom_sid="))) {
91                         const char *sid_str = get_string_param(argv[i]);
92                         string_to_sid(&o.object_identifier.sid, sid_str);
93                         o.object_type                   = NETR_DELTA_TRUSTED_DOMAIN;
94                         o.database_id                   = SAM_DATABASE_PRIVS;
95                 }
96                 if (!StrnCaseCmp(argv[i], "secret_name=", strlen("secret_name="))) {
97                         o.object_identifier.name        = get_string_param(argv[i]);
98                         o.object_type                   = NETR_DELTA_SECRET;
99                         o.database_id                   = SAM_DATABASE_PRIVS;
100                 }
101
102                 if (o.object_type > 0) {
103                         ADD_TO_ARRAY(mem_ctx, struct samsync_object, o,
104                                      objects, num_objects);
105                 }
106         }
107 }
108
109 /* dump sam database via samsync rpc calls */
110 NTSTATUS rpc_samdump_internals(struct net_context *c,
111                                 const struct dom_sid *domain_sid,
112                                 const char *domain_name,
113                                 struct cli_state *cli,
114                                 struct rpc_pipe_client *pipe_hnd,
115                                 TALLOC_CTX *mem_ctx,
116                                 int argc,
117                                 const char **argv)
118 {
119         struct samsync_context *ctx = NULL;
120         NTSTATUS status;
121
122         status = libnet_samsync_init_context(mem_ctx,
123                                              domain_sid,
124                                              &ctx);
125         if (!NT_STATUS_IS_OK(status)) {
126                 return status;
127         }
128
129         ctx->mode               = NET_SAMSYNC_MODE_DUMP;
130         ctx->cli                = pipe_hnd;
131         ctx->ops                = &libnet_samsync_display_ops;
132         ctx->domain_name        = domain_name;
133
134         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
135         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
136
137         parse_samsync_partial_replication_objects(ctx, argc, argv,
138                                                   &ctx->single_object_replication,
139                                                   &ctx->objects,
140                                                   &ctx->num_objects);
141
142         libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
143
144         libnet_samsync(SAM_DATABASE_BUILTIN, ctx);
145
146         libnet_samsync(SAM_DATABASE_PRIVS, ctx);
147
148         TALLOC_FREE(ctx);
149
150         return NT_STATUS_OK;
151 }
152
153 /**
154  * Basic usage function for 'net rpc vampire'
155  *
156  * @param c     A net_context structure
157  * @param argc  Standard main() style argc
158  * @param argc  Standard main() style argv.  Initial components are already
159  *              stripped
160  **/
161
162 int rpc_vampire_usage(struct net_context *c, int argc, const char **argv)
163 {
164         d_printf(_("net rpc vampire ([ldif [<ldif-filename>] | [keytab] "
165                    "[<keytab-filename]) [options]\n"
166                    "\t to pull accounts from a remote PDC where we are a BDC\n"
167                    "\t\t no args puts accounts in local passdb from smb.conf\n"
168                    "\t\t ldif - put accounts in ldif format (file defaults to "
169                    "/tmp/tmp.ldif)\n"
170                    "\t\t keytab - put account passwords in krb5 keytab "
171                    "(defaults to system keytab)\n"));
172
173         net_common_flags_usage(c, argc, argv);
174         return -1;
175 }
176
177
178 /* dump sam database via samsync rpc calls */
179 NTSTATUS rpc_vampire_internals(struct net_context *c,
180                                 const struct dom_sid *domain_sid,
181                                 const char *domain_name,
182                                 struct cli_state *cli,
183                                 struct rpc_pipe_client *pipe_hnd,
184                                 TALLOC_CTX *mem_ctx,
185                                 int argc,
186                                 const char **argv)
187 {
188         NTSTATUS result;
189         struct samsync_context *ctx = NULL;
190
191         if (!dom_sid_equal(domain_sid, get_global_sam_sid())) {
192                 d_printf(_("Cannot import users from %s at this time, "
193                            "as the current domain:\n\t%s: %s\nconflicts "
194                            "with the remote domain\n\t%s: %s\n"
195                            "Perhaps you need to set: \n\n\tsecurity=user\n\t"
196                            "workgroup=%s\n\n in your smb.conf?\n"),
197                          domain_name,
198                          get_global_sam_name(),
199                          sid_string_dbg(get_global_sam_sid()),
200                          domain_name,
201                          sid_string_dbg(domain_sid),
202                          domain_name);
203                 return NT_STATUS_UNSUCCESSFUL;
204         }
205
206         result = libnet_samsync_init_context(mem_ctx,
207                                              domain_sid,
208                                              &ctx);
209         if (!NT_STATUS_IS_OK(result)) {
210                 return result;
211         }
212
213         ctx->mode               = NET_SAMSYNC_MODE_FETCH_PASSDB;
214         ctx->cli                = pipe_hnd;
215         ctx->ops                = &libnet_samsync_passdb_ops;
216         ctx->domain_name        = domain_name;
217
218         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
219         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
220
221         parse_samsync_partial_replication_objects(ctx, argc, argv,
222                                                   &ctx->single_object_replication,
223                                                   &ctx->objects,
224                                                   &ctx->num_objects);
225
226         /* fetch domain */
227         result = libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
228
229         if (!NT_STATUS_IS_OK(result) && ctx->error_message) {
230                 d_fprintf(stderr, "%s\n", ctx->error_message);
231                 goto fail;
232         }
233
234         if (ctx->result_message) {
235                 d_fprintf(stdout, "%s\n", ctx->result_message);
236         }
237
238         /* fetch builtin */
239         ctx->domain_sid = dom_sid_dup(mem_ctx, &global_sid_Builtin);
240         ctx->domain_sid_str = sid_string_talloc(mem_ctx, ctx->domain_sid);
241         result = libnet_samsync(SAM_DATABASE_BUILTIN, ctx);
242
243         if (!NT_STATUS_IS_OK(result) && ctx->error_message) {
244                 d_fprintf(stderr, "%s\n", ctx->error_message);
245                 goto fail;
246         }
247
248         if (ctx->result_message) {
249                 d_fprintf(stdout, "%s\n", ctx->result_message);
250         }
251
252  fail:
253         TALLOC_FREE(ctx);
254         return result;
255 }
256
257 int rpc_vampire_passdb(struct net_context *c, int argc, const char **argv)
258 {
259         if (c->display_usage) {
260                 d_printf(  "%s\n"
261                            "net rpc vampire passdb\n"
262                            "    %s\n",
263                          _("Usage:"),
264                          _("Dump remote SAM database to passdb"));
265                 return 0;
266         }
267
268         return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id, 0,
269                                rpc_vampire_internals, argc, argv);
270 }
271
272 NTSTATUS rpc_vampire_ldif_internals(struct net_context *c,
273                                     const struct dom_sid *domain_sid,
274                                     const char *domain_name,
275                                     struct cli_state *cli,
276                                     struct rpc_pipe_client *pipe_hnd,
277                                     TALLOC_CTX *mem_ctx,
278                                     int argc,
279                                     const char **argv)
280 {
281         NTSTATUS status;
282         struct samsync_context *ctx = NULL;
283
284         status = libnet_samsync_init_context(mem_ctx,
285                                              domain_sid,
286                                              &ctx);
287         if (!NT_STATUS_IS_OK(status)) {
288                 return status;
289         }
290
291         if (argc >= 1) {
292                 ctx->output_filename = argv[0];
293         }
294         if (argc >= 2) {
295                 parse_samsync_partial_replication_objects(ctx, argc-1, argv+1,
296                                                           &ctx->single_object_replication,
297                                                           &ctx->objects,
298                                                           &ctx->num_objects);
299         }
300
301         ctx->mode               = NET_SAMSYNC_MODE_FETCH_LDIF;
302         ctx->cli                = pipe_hnd;
303         ctx->ops                = &libnet_samsync_ldif_ops;
304         ctx->domain_name        = domain_name;
305
306         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
307         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
308
309         /* fetch domain */
310         status = libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
311
312         if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
313                 d_fprintf(stderr, "%s\n", ctx->error_message);
314                 goto fail;
315         }
316
317         if (ctx->result_message) {
318                 d_fprintf(stdout, "%s\n", ctx->result_message);
319         }
320
321         /* fetch builtin */
322         ctx->domain_sid = dom_sid_dup(mem_ctx, &global_sid_Builtin);
323         ctx->domain_sid_str = sid_string_talloc(mem_ctx, ctx->domain_sid);
324         status = libnet_samsync(SAM_DATABASE_BUILTIN, ctx);
325
326         if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
327                 d_fprintf(stderr, "%s\n", ctx->error_message);
328                 goto fail;
329         }
330
331         if (ctx->result_message) {
332                 d_fprintf(stdout, "%s\n", ctx->result_message);
333         }
334
335  fail:
336         TALLOC_FREE(ctx);
337         return status;
338 }
339
340 int rpc_vampire_ldif(struct net_context *c, int argc, const char **argv)
341 {
342         if (c->display_usage) {
343                 d_printf(  "%s\n"
344                            "net rpc vampire ldif\n"
345                            "    %s\n",
346                          _("Usage:"),
347                          _("Dump remote SAM database to LDIF file or "
348                            "stdout"));
349                 return 0;
350         }
351
352         return run_rpc_command(c, NULL, &ndr_table_netlogon.syntax_id, 0,
353                                rpc_vampire_ldif_internals, argc, argv);
354 }
355
356
357 NTSTATUS rpc_vampire_keytab_internals(struct net_context *c,
358                                       const struct dom_sid *domain_sid,
359                                       const char *domain_name,
360                                       struct cli_state *cli,
361                                       struct rpc_pipe_client *pipe_hnd,
362                                       TALLOC_CTX *mem_ctx,
363                                       int argc,
364                                       const char **argv)
365 {
366         NTSTATUS status;
367         struct samsync_context *ctx = NULL;
368
369         status = libnet_samsync_init_context(mem_ctx,
370                                              domain_sid,
371                                              &ctx);
372         if (!NT_STATUS_IS_OK(status)) {
373                 return status;
374         }
375
376         if (argc < 1) {
377                 /* the caller should ensure that a filename is provided */
378                 return NT_STATUS_INVALID_PARAMETER;
379         } else {
380                 ctx->output_filename = argv[0];
381         }
382         if (argc >= 2) {
383                 parse_samsync_partial_replication_objects(ctx, argc-1, argv+1,
384                                                           &ctx->single_object_replication,
385                                                           &ctx->objects,
386                                                           &ctx->num_objects);
387         }
388
389         ctx->mode               = NET_SAMSYNC_MODE_FETCH_KEYTAB;
390         ctx->cli                = pipe_hnd;
391         ctx->ops                = &libnet_samsync_keytab_ops;
392         ctx->domain_name        = domain_name;
393         ctx->username           = c->opt_user_name;
394         ctx->password           = c->opt_password;
395
396         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
397         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
398
399         /* fetch domain */
400         status = libnet_samsync(SAM_DATABASE_DOMAIN, ctx);
401
402         if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
403                 d_fprintf(stderr, "%s\n", ctx->error_message);
404                 goto out;
405         }
406
407         if (ctx->result_message) {
408                 d_fprintf(stdout, "%s\n", ctx->result_message);
409         }
410
411  out:
412         TALLOC_FREE(ctx);
413
414         return status;
415 }
416
417 static NTSTATUS rpc_vampire_keytab_ds_internals(struct net_context *c,
418                                                 const struct dom_sid *domain_sid,
419                                                 const char *domain_name,
420                                                 struct cli_state *cli,
421                                                 struct rpc_pipe_client *pipe_hnd,
422                                                 TALLOC_CTX *mem_ctx,
423                                                 int argc,
424                                                 const char **argv)
425 {
426         NTSTATUS status;
427         struct dssync_context *ctx = NULL;
428
429         status = libnet_dssync_init_context(mem_ctx,
430                                             &ctx);
431         if (!NT_STATUS_IS_OK(status)) {
432                 return status;
433         }
434
435         ctx->force_full_replication = c->opt_force_full_repl ? true : false;
436         ctx->clean_old_entries = c->opt_clean_old_entries ? true : false;
437
438         if (argc < 1) {
439                 /* the caller should ensure that a filename is provided */
440                 return NT_STATUS_INVALID_PARAMETER;
441         } else {
442                 ctx->output_filename = argv[0];
443         }
444
445         if (argc >= 2) {
446                 ctx->object_dns = &argv[1];
447                 ctx->object_count = argc - 1;
448                 ctx->single_object_replication = c->opt_single_obj_repl ? true
449                                                                         : false;
450         }
451
452         ctx->cli                = pipe_hnd;
453         ctx->domain_name        = domain_name;
454         ctx->ops                = &libnet_dssync_keytab_ops;
455
456         status = libnet_dssync(mem_ctx, ctx);
457         if (!NT_STATUS_IS_OK(status) && ctx->error_message) {
458                 d_fprintf(stderr, "%s\n", ctx->error_message);
459                 goto out;
460         }
461
462         if (ctx->result_message) {
463                 d_fprintf(stdout, "%s\n", ctx->result_message);
464         }
465
466  out:
467         TALLOC_FREE(ctx);
468
469         return status;
470 }
471
472 /**
473  * Basic function for 'net rpc vampire keytab'
474  *
475  * @param c     A net_context structure
476  * @param argc  Standard main() style argc
477  * @param argc  Standard main() style argv.  Initial components are already
478  *              stripped
479  **/
480
481 int rpc_vampire_keytab(struct net_context *c, int argc, const char **argv)
482 {
483         int ret = 0;
484         NTSTATUS status;
485         struct cli_state *cli = NULL;
486         struct net_dc_info dc_info;
487
488         if (c->display_usage || (argc < 1)) {
489                 d_printf("%s\n%s",
490                          _("Usage:"),
491                          _("net rpc vampire keytab <keytabfile>\n"
492                            "    Dump remote SAM database to Kerberos keytab "
493                            "file\n"));
494                 return 0;
495         }
496
497         status = net_make_ipc_connection(c, 0, &cli);
498         if (!NT_STATUS_IS_OK(status)) {
499                 return -1;
500         }
501
502         status = net_scan_dc(c, cli, &dc_info);
503         if (!NT_STATUS_IS_OK(status)) {
504                 return -1;
505         }
506
507         if (!dc_info.is_ad) {
508                 printf(_("DC is not running Active Directory\n"));
509                 ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
510                                       0,
511                                       rpc_vampire_keytab_internals, argc, argv);
512                 return -1;
513         } else {
514                 ret = run_rpc_command(c, cli, &ndr_table_drsuapi.syntax_id,
515                                       NET_FLAGS_SEAL | NET_FLAGS_TCP,
516                                       rpc_vampire_keytab_ds_internals, argc, argv);
517                 if (ret != 0 && dc_info.is_mixed_mode) {
518                         printf(_("Fallback to NT4 vampire on Mixed-Mode AD "
519                                  "Domain\n"));
520                         ret = run_rpc_command(c, cli, &ndr_table_netlogon.syntax_id,
521                                               0,
522                                               rpc_vampire_keytab_internals, argc, argv);
523                 }
524         }
525
526         return ret;
527 }