source3/winbindd/winbindd_msrpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind rpc backend functions
   5
   6    Copyright (C) Tim Potter 2000-2001,2003
   7    Copyright (C) Andrew Tridgell 2001
   8    Copyright (C) Volker Lendecke 2005
   9    Copyright (C) Guenther Deschner 2008 (pidl conversion)
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #include "winbindd_rpc.h"
  28
  29 #include "../librpc/gen_ndr/ndr_samr_c.h"
  30 #include "rpc_client/cli_pipe.h"
  31 #include "rpc_client/cli_samr.h"
  32 #include "rpc_client/cli_lsarpc.h"
  33 #include "../libcli/security/security.h"
  34
  35 #undef DBGC_CLASS
  36 #define DBGC_CLASS DBGC_WINBIND
  37
  38 static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
  39                                       struct winbindd_domain *domain,
  40                                       uint32_t num_names,
  41                                       const char **names,
  42                                       const char ***domains,
  43                                       struct dom_sid **sids,
  44                                       enum lsa_SidType **types);
  45
  46 /* Query display info for a domain.  This returns enough information plus a
  47    bit extra to give an overview of domain users for the User Manager
  48    application. */
  49 static NTSTATUS msrpc_query_user_list(struct winbindd_domain *domain,
  50                                       TALLOC_CTX *mem_ctx,
  51                                       uint32_t *pnum_info,
  52                                       struct wbint_userinfo **pinfo)
  53 {
  54         struct rpc_pipe_client *samr_pipe = NULL;
  55         struct policy_handle dom_pol;
  56         struct wbint_userinfo *info = NULL;
  57         uint32_t num_info = 0;
  58         TALLOC_CTX *tmp_ctx;
  59         NTSTATUS status;
  60
  61         DEBUG(3, ("msrpc_query_user_list\n"));
  62
  63         if (pnum_info) {
  64                 *pnum_info = 0;
  65         }
  66
  67         tmp_ctx = talloc_stackframe();
  68         if (tmp_ctx == NULL) {
  69                 return NT_STATUS_NO_MEMORY;
  70         }
  71
  72         if ( !winbindd_can_contact_domain( domain ) ) {
  73                 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
  74                           domain->name));
  75                 status = NT_STATUS_OK;
  76                 goto done;
  77         }
  78
  79         status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
  80         if (!NT_STATUS_IS_OK(status)) {
  81                 goto done;
  82         }
  83
  84         status = rpc_query_user_list(tmp_ctx,
  85                                      samr_pipe,
  86                                      &dom_pol,
  87                                      &domain->sid,
  88                                      &num_info,
  89                                      &info);
  90         if (!NT_STATUS_IS_OK(status)) {
  91                 goto done;
  92         }
  93
  94         if (pnum_info) {
  95                 *pnum_info = num_info;
  96         }
  97
  98         if (pinfo) {
  99                 *pinfo = talloc_move(mem_ctx, &info);
 100         }
 101
 102 done:
 103         TALLOC_FREE(tmp_ctx);
 104         return status;
 105 }
 106
 107 /* list all domain groups */
 108 static NTSTATUS msrpc_enum_dom_groups(struct winbindd_domain *domain,
 109                                       TALLOC_CTX *mem_ctx,
 110                                       uint32_t *pnum_info,
 111                                       struct wb_acct_info **pinfo)
 112 {
 113         struct rpc_pipe_client *samr_pipe;
 114         struct policy_handle dom_pol;
 115         struct wb_acct_info *info = NULL;
 116         uint32_t num_info = 0;
 117         TALLOC_CTX *tmp_ctx;
 118         NTSTATUS status;
 119
 120         DEBUG(3,("msrpc_enum_dom_groups\n"));
 121
 122         if (pnum_info) {
 123                 *pnum_info = 0;
 124         }
 125
 126         tmp_ctx = talloc_stackframe();
 127         if (tmp_ctx == NULL) {
 128                 return NT_STATUS_NO_MEMORY;
 129         }
 130
 131         if ( !winbindd_can_contact_domain( domain ) ) {
 132                 DEBUG(10,("enum_domain_groups: No incoming trust for domain %s\n",
 133                           domain->name));
 134                 status = NT_STATUS_OK;
 135                 goto done;
 136         }
 137
 138         status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
 139         if (!NT_STATUS_IS_OK(status)) {
 140                 goto done;
 141         }
 142
 143         status = rpc_enum_dom_groups(tmp_ctx,
 144                                      samr_pipe,
 145                                      &dom_pol,
 146                                      &num_info,
 147                                      &info);
 148         if (!NT_STATUS_IS_OK(status)) {
 149                 goto done;
 150         }
 151
 152         if (pnum_info) {
 153                 *pnum_info = num_info;
 154         }
 155
 156         if (pinfo) {
 157                 *pinfo = talloc_move(mem_ctx, &info);
 158         }
 159
 160 done:
 161         TALLOC_FREE(tmp_ctx);
 162         return status;
 163 }
 164
 165 /* List all domain groups */
 166
 167 static NTSTATUS msrpc_enum_local_groups(struct winbindd_domain *domain,
 168                                         TALLOC_CTX *mem_ctx,
 169                                         uint32_t *pnum_info,
 170                                         struct wb_acct_info **pinfo)
 171 {
 172         struct rpc_pipe_client *samr_pipe;
 173         struct policy_handle dom_pol;
 174         struct wb_acct_info *info = NULL;
 175         uint32_t num_info = 0;
 176         TALLOC_CTX *tmp_ctx;
 177         NTSTATUS status;
 178
 179         DEBUG(3,("msrpc_enum_local_groups\n"));
 180
 181         if (pnum_info) {
 182                 *pnum_info = 0;
 183         }
 184
 185         tmp_ctx = talloc_stackframe();
 186         if (tmp_ctx == NULL) {
 187                 return NT_STATUS_NO_MEMORY;
 188         }
 189
 190         if ( !winbindd_can_contact_domain( domain ) ) {
 191                 DEBUG(10,("enum_local_groups: No incoming trust for domain %s\n",
 192                           domain->name));
 193                 status = NT_STATUS_OK;
 194                 goto done;
 195         }
 196
 197         status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
 198         if (!NT_STATUS_IS_OK(status)) {
 199                 goto done;
 200         }
 201
 202         status = rpc_enum_local_groups(mem_ctx,
 203                                        samr_pipe,
 204                                        &dom_pol,
 205                                        &num_info,
 206                                        &info);
 207         if (!NT_STATUS_IS_OK(status)) {
 208                 goto done;
 209         }
 210
 211         if (pnum_info) {
 212                 *pnum_info = num_info;
 213         }
 214
 215         if (pinfo) {
 216                 *pinfo = talloc_move(mem_ctx, &info);
 217         }
 218
 219 done:
 220         TALLOC_FREE(tmp_ctx);
 221         return status;
 222 }
 223
 224 /* convert a single name to a sid in a domain */
 225 static NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
 226                                   TALLOC_CTX *mem_ctx,
 227                                   const char *domain_name,
 228                                   const char *name,
 229                                   uint32_t flags,
 230                                   struct dom_sid *sid,
 231                                   enum lsa_SidType *type)
 232 {
 233         NTSTATUS result;
 234         struct dom_sid *sids = NULL;
 235         enum lsa_SidType *types = NULL;
 236         char *full_name = NULL;
 237         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 238         char *mapped_name = NULL;
 239
 240         if (name == NULL || *name=='\0') {
 241                 full_name = talloc_asprintf(mem_ctx, "%s", domain_name);
 242         } else if (domain_name == NULL || *domain_name == '\0') {
 243                 full_name = talloc_asprintf(mem_ctx, "%s", name);
 244         } else {
 245                 full_name = talloc_asprintf(mem_ctx, "%s\\%s", domain_name, name);
 246         }
 247         if (!full_name) {
 248                 DEBUG(0, ("talloc_asprintf failed!\n"));
 249                 return NT_STATUS_NO_MEMORY;
 250         }
 251
 252         DEBUG(3, ("msrpc_name_to_sid: name=%s\n", full_name));
 253
 254         name_map_status = normalize_name_unmap(mem_ctx, full_name,
 255                                                &mapped_name);
 256
 257         /* Reset the full_name pointer if we mapped anytthing */
 258
 259         if (NT_STATUS_IS_OK(name_map_status) ||
 260             NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 261         {
 262                 full_name = mapped_name;
 263         }
 264
 265         DEBUG(3,("name_to_sid [rpc] %s for domain %s\n",
 266                  full_name?full_name:"", domain_name ));
 267
 268         result = winbindd_lookup_names(mem_ctx, domain, 1,
 269                                        (const char **)&full_name, NULL,
 270                                        &sids, &types);
 271         if (!NT_STATUS_IS_OK(result))
 272                 return result;
 273
 274         /* Return rid and type if lookup successful */
 275
 276         sid_copy(sid, &sids[0]);
 277         *type = types[0];
 278
 279         return NT_STATUS_OK;
 280 }
 281
 282 /*
 283   convert a domain SID to a user or group name
 284 */
 285 static NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
 286                                   TALLOC_CTX *mem_ctx,
 287                                   const struct dom_sid *sid,
 288                                   char **domain_name,
 289                                   char **name,
 290                                   enum lsa_SidType *type)
 291 {
 292         char **domains;
 293         char **names;
 294         enum lsa_SidType *types = NULL;
 295         NTSTATUS result;
 296         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 297         char *mapped_name = NULL;
 298
 299         DEBUG(3, ("msrpc_sid_to_name: %s for domain %s\n", sid_string_dbg(sid),
 300                  domain->name ));
 301
 302         result = winbindd_lookup_sids(mem_ctx,
 303                                       domain,
 304                                       1,
 305                                       sid,
 306                                       &domains,
 307                                       &names,
 308                                       &types);
 309         if (!NT_STATUS_IS_OK(result)) {
 310                 DEBUG(2,("msrpc_sid_to_name: failed to lookup sids: %s\n",
 311                         nt_errstr(result)));
 312                 return result;
 313         }
 314
 315
 316         *type = (enum lsa_SidType)types[0];
 317         *domain_name = domains[0];
 318         *name = names[0];
 319
 320         DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name));
 321
 322         name_map_status = normalize_name_map(mem_ctx, domain, *name,
 323                                              &mapped_name);
 324         if (NT_STATUS_IS_OK(name_map_status) ||
 325             NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 326         {
 327                 *name = mapped_name;
 328                 DEBUG(5,("returning mapped name -- %s\n", *name));
 329         }
 330
 331         return NT_STATUS_OK;
 332 }
 333
 334 static NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
 335                                     TALLOC_CTX *mem_ctx,
 336                                     const struct dom_sid *sid,
 337                                     uint32 *rids,
 338                                     size_t num_rids,
 339                                     char **domain_name,
 340                                     char ***names,
 341                                     enum lsa_SidType **types)
 342 {
 343         char **domains;
 344         NTSTATUS result;
 345         struct dom_sid *sids;
 346         size_t i;
 347         char **ret_names;
 348
 349         DEBUG(3, ("msrpc_rids_to_names: domain %s\n", domain->name ));
 350
 351         if (num_rids) {
 352                 sids = talloc_array(mem_ctx, struct dom_sid, num_rids);
 353                 if (sids == NULL) {
 354                         return NT_STATUS_NO_MEMORY;
 355                 }
 356         } else {
 357                 sids = NULL;
 358         }
 359
 360         for (i=0; i<num_rids; i++) {
 361                 if (!sid_compose(&sids[i], sid, rids[i])) {
 362                         return NT_STATUS_INTERNAL_ERROR;
 363                 }
 364         }
 365
 366         result = winbindd_lookup_sids(mem_ctx,
 367                                       domain,
 368                                       num_rids,
 369                                       sids,
 370                                       &domains,
 371                                       names,
 372                                       types);
 373
 374         if (!NT_STATUS_IS_OK(result) &&
 375             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
 376                 return result;
 377         }
 378
 379         ret_names = *names;
 380         for (i=0; i<num_rids; i++) {
 381                 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 382                 char *mapped_name = NULL;
 383
 384                 if ((*types)[i] != SID_NAME_UNKNOWN) {
 385                         name_map_status = normalize_name_map(mem_ctx,
 386                                                              domain,
 387                                                              ret_names[i],
 388                                                              &mapped_name);
 389                         if (NT_STATUS_IS_OK(name_map_status) ||
 390                             NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 391                         {
 392                                 ret_names[i] = mapped_name;
 393                         }
 394
 395                         *domain_name = domains[i];
 396                 }
 397         }
 398
 399         return result;
 400 }
 401
 402 /* Lookup user information from a rid or username. */
 403 static NTSTATUS msrpc_query_user(struct winbindd_domain *domain,
 404                            TALLOC_CTX *mem_ctx,
 405                            const struct dom_sid *user_sid,
 406                            struct wbint_userinfo *user_info)
 407 {
 408         struct rpc_pipe_client *samr_pipe;
 409         struct policy_handle dom_pol;
 410         struct netr_SamInfo3 *user = NULL;
 411         TALLOC_CTX *tmp_ctx;
 412         NTSTATUS status;
 413
 414         DEBUG(3,("msrpc_query_user sid=%s\n", sid_string_dbg(user_sid)));
 415
 416         tmp_ctx = talloc_stackframe();
 417         if (tmp_ctx == NULL) {
 418                 return NT_STATUS_NO_MEMORY;
 419         }
 420
 421         if (user_info) {
 422                 user_info->homedir = NULL;
 423                 user_info->shell = NULL;
 424                 user_info->primary_gid = (gid_t)-1;
 425         }
 426
 427         /* try netsamlogon cache first */
 428         if (winbindd_use_cache()) {
 429                 user = netsamlogon_cache_get(tmp_ctx, user_sid);
 430         }
 431         if (user != NULL) {
 432                 DEBUG(5,("msrpc_query_user: Cache lookup succeeded for %s\n",
 433                         sid_string_dbg(user_sid)));
 434
 435                 sid_compose(&user_info->user_sid, &domain->sid, user->base.rid);
 436                 sid_compose(&user_info->group_sid, &domain->sid,
 437                             user->base.primary_gid);
 438
 439                 user_info->acct_name = talloc_strdup(user_info,
 440                                                      user->base.account_name.string);
 441                 user_info->full_name = talloc_strdup(user_info,
 442                                                      user->base.full_name.string);
 443
 444                 status = NT_STATUS_OK;
 445                 goto done;
 446         }
 447
 448         if ( !winbindd_can_contact_domain( domain ) ) {
 449                 DEBUG(10,("query_user: No incoming trust for domain %s\n",
 450                           domain->name));
 451                 /* Tell the cache manager not to remember this one */
 452                 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 453                 goto done;
 454         }
 455
 456         /* no cache; hit the wire */
 457         status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
 458         if (!NT_STATUS_IS_OK(status)) {
 459                 goto done;
 460         }
 461
 462         status = rpc_query_user(tmp_ctx,
 463                                 samr_pipe,
 464                                 &dom_pol,
 465                                 &domain->sid,
 466                                 user_sid,
 467                                 user_info);
 468
 469 done:
 470         TALLOC_FREE(tmp_ctx);
 471         return status;
 472 }
 473
 474 /* Lookup groups a user is a member of.  I wish Unix had a call like this! */
 475 static NTSTATUS msrpc_lookup_usergroups(struct winbindd_domain *domain,
 476                                         TALLOC_CTX *mem_ctx,
 477                                         const struct dom_sid *user_sid,
 478                                         uint32_t *pnum_groups,
 479                                         struct dom_sid **puser_grpsids)
 480 {
 481         struct rpc_pipe_client *samr_pipe;
 482         struct policy_handle dom_pol;
 483         struct dom_sid *user_grpsids = NULL;
 484         uint32_t num_groups = 0;
 485         TALLOC_CTX *tmp_ctx;
 486         NTSTATUS status;
 487
 488         DEBUG(3,("msrpc_lookup_usergroups sid=%s\n", sid_string_dbg(user_sid)));
 489
 490         *pnum_groups = 0;
 491
 492         tmp_ctx = talloc_stackframe();
 493         if (tmp_ctx == NULL) {
 494                 return NT_STATUS_NO_MEMORY;
 495         }
 496
 497         /* Check if we have a cached user_info_3 */
 498         status = lookup_usergroups_cached(domain,
 499                                           tmp_ctx,
 500                                           user_sid,
 501                                           &num_groups,
 502                                           &user_grpsids);
 503         if (NT_STATUS_IS_OK(status)) {
 504                 goto cached;
 505         }
 506
 507         if ( !winbindd_can_contact_domain( domain ) ) {
 508                 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
 509                           domain->name));
 510
 511                 /* Tell the cache manager not to remember this one */
 512                 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 513                 goto done;
 514         }
 515
 516         /* no cache; hit the wire */
 517         status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
 518         if (!NT_STATUS_IS_OK(status)) {
 519                 goto done;
 520         }
 521
 522         status = rpc_lookup_usergroups(tmp_ctx,
 523                                        samr_pipe,
 524                                        &dom_pol,
 525                                        &domain->sid,
 526                                        user_sid,
 527                                        &num_groups,
 528                                        &user_grpsids);
 529         if (!NT_STATUS_IS_OK(status)) {
 530                 goto done;
 531         }
 532
 533 cached:
 534         *pnum_groups = num_groups;
 535
 536         if (puser_grpsids) {
 537                 *puser_grpsids = talloc_move(mem_ctx, &user_grpsids);
 538         }
 539
 540 done:
 541         TALLOC_FREE(tmp_ctx);
 542         return status;
 543         return NT_STATUS_OK;
 544 }
 545
 546 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
 547
 548 static NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
 549                                          TALLOC_CTX *mem_ctx,
 550                                          uint32 num_sids, const struct dom_sid *sids,
 551                                          uint32 *pnum_aliases,
 552                                          uint32 **palias_rids)
 553 {
 554         struct rpc_pipe_client *samr_pipe;
 555         struct policy_handle dom_pol;
 556         uint32_t num_aliases = 0;
 557         uint32_t *alias_rids = NULL;
 558         TALLOC_CTX *tmp_ctx;
 559         NTSTATUS status;
 560
 561         DEBUG(3,("msrpc_lookup_useraliases\n"));
 562
 563         if (pnum_aliases) {
 564                 *pnum_aliases = 0;
 565         }
 566
 567         tmp_ctx = talloc_stackframe();
 568         if (tmp_ctx == NULL) {
 569                 return NT_STATUS_NO_MEMORY;
 570         }
 571
 572         if (!winbindd_can_contact_domain(domain)) {
 573                 DEBUG(10,("msrpc_lookup_useraliases: No incoming trust for domain %s\n",
 574                           domain->name));
 575                 /* Tell the cache manager not to remember this one */
 576                 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
 577                 goto done;
 578         }
 579
 580         status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
 581         if (!NT_STATUS_IS_OK(status)) {
 582                 goto done;
 583         }
 584
 585         status = rpc_lookup_useraliases(tmp_ctx,
 586                                         samr_pipe,
 587                                         &dom_pol,
 588                                         num_sids,
 589                                         sids,
 590                                         &num_aliases,
 591                                         &alias_rids);
 592         if (!NT_STATUS_IS_OK(status)) {
 593                 goto done;
 594         }
 595
 596         if (pnum_aliases) {
 597                 *pnum_aliases = num_aliases;
 598         }
 599
 600         if (palias_rids) {
 601                 *palias_rids = talloc_move(mem_ctx, &alias_rids);
 602         }
 603
 604 done:
 605         TALLOC_FREE(tmp_ctx);
 606         return status;
 607 }
 608
 609
 610 /* Lookup group membership given a rid.   */
 611 static NTSTATUS msrpc_lookup_groupmem(struct winbindd_domain *domain,
 612                                       TALLOC_CTX *mem_ctx,
 613                                       const struct dom_sid *group_sid,
 614                                       enum lsa_SidType type,
 615                                       uint32_t *num_names,
 616                                       struct dom_sid **sid_mem,
 617                                       char ***names,
 618                                       uint32_t **name_types)
 619 {
 620         NTSTATUS status, result;
 621         uint32 i, total_names = 0;
 622         struct policy_handle dom_pol, group_pol;
 623         uint32 des_access = SEC_FLAG_MAXIMUM_ALLOWED;
 624         uint32 *rid_mem = NULL;
 625         uint32 group_rid;
 626         unsigned int j, r;
 627         struct rpc_pipe_client *cli;
 628         unsigned int orig_timeout;
 629         struct samr_RidAttrArray *rids = NULL;
 630         struct dcerpc_binding_handle *b;
 631
 632         DEBUG(3,("msrpc_lookup_groupmem: %s sid=%s\n", domain->name,
 633                   sid_string_dbg(group_sid)));
 634
 635         if ( !winbindd_can_contact_domain( domain ) ) {
 636                 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
 637                           domain->name));
 638                 return NT_STATUS_OK;
 639         }
 640
 641         if (!sid_peek_check_rid(&domain->sid, group_sid, &group_rid))
 642                 return NT_STATUS_UNSUCCESSFUL;
 643
 644         *num_names = 0;
 645
 646         result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
 647         if (!NT_STATUS_IS_OK(result))
 648                 return result;
 649
 650         b = cli->binding_handle;
 651
 652         status = dcerpc_samr_OpenGroup(b, mem_ctx,
 653                                        &dom_pol,
 654                                        des_access,
 655                                        group_rid,
 656                                        &group_pol,
 657                                        &result);
 658         if (!NT_STATUS_IS_OK(status)) {
 659                 return status;
 660         }
 661         if (!NT_STATUS_IS_OK(result)) {
 662                 return result;
 663         }
 664
 665         /* Step #1: Get a list of user rids that are the members of the
 666            group. */
 667
 668         /* This call can take a long time - allow the server to time out.
 669            35 seconds should do it. */
 670
 671         orig_timeout = rpccli_set_timeout(cli, 35000);
 672
 673         status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
 674                                               &group_pol,
 675                                               &rids,
 676                                               &result);
 677
 678         /* And restore our original timeout. */
 679         rpccli_set_timeout(cli, orig_timeout);
 680
 681         {
 682                 NTSTATUS _result;
 683                 dcerpc_samr_Close(b, mem_ctx, &group_pol, &_result);
 684         }
 685
 686         if (!NT_STATUS_IS_OK(status)) {
 687                 return status;
 688         }
 689
 690         if (!NT_STATUS_IS_OK(result)) {
 691                 return result;
 692         }
 693
 694         if (!rids || !rids->count) {
 695                 names = NULL;
 696                 name_types = NULL;
 697                 sid_mem = NULL;
 698                 return NT_STATUS_OK;
 699         }
 700
 701         *num_names = rids->count;
 702         rid_mem = rids->rids;
 703
 704         /* Step #2: Convert list of rids into list of usernames.  Do this
 705            in bunches of ~1000 to avoid crashing NT4.  It looks like there
 706            is a buffer overflow or something like that lurking around
 707            somewhere. */
 708
 709 #define MAX_LOOKUP_RIDS 900
 710
 711         *names = talloc_zero_array(mem_ctx, char *, *num_names);
 712         *name_types = talloc_zero_array(mem_ctx, uint32, *num_names);
 713         *sid_mem = talloc_zero_array(mem_ctx, struct dom_sid, *num_names);
 714
 715         for (j=0;j<(*num_names);j++)
 716                 sid_compose(&(*sid_mem)[j], &domain->sid, rid_mem[j]);
 717
 718         if (*num_names>0 && (!*names || !*name_types))
 719                 return NT_STATUS_NO_MEMORY;
 720
 721         for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
 722                 int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
 723                 struct lsa_Strings tmp_names;
 724                 struct samr_Ids tmp_types;
 725
 726                 /* Lookup a chunk of rids */
 727
 728                 status = dcerpc_samr_LookupRids(b, mem_ctx,
 729                                                 &dom_pol,
 730                                                 num_lookup_rids,
 731                                                 &rid_mem[i],
 732                                                 &tmp_names,
 733                                                 &tmp_types,
 734                                                 &result);
 735                 if (!NT_STATUS_IS_OK(status)) {
 736                         return status;
 737                 }
 738
 739                 /* see if we have a real error (and yes the
 740                    STATUS_SOME_UNMAPPED is the one returned from 2k) */
 741
 742                 if (!NT_STATUS_IS_OK(result) &&
 743                     !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
 744                         return result;
 745
 746                 /* Copy result into array.  The talloc system will take
 747                    care of freeing the temporary arrays later on. */
 748
 749                 if (tmp_names.count != tmp_types.count) {
 750                         return NT_STATUS_UNSUCCESSFUL;
 751                 }
 752
 753                 for (r=0; r<tmp_names.count; r++) {
 754                         if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
 755                                 continue;
 756                         }
 757                         (*names)[total_names] = fill_domain_username_talloc(
 758                                 mem_ctx, domain->name,
 759                                 tmp_names.names[r].string, true);
 760                         (*name_types)[total_names] = tmp_types.ids[r];
 761                         total_names += 1;
 762                 }
 763         }
 764
 765         *num_names = total_names;
 766
 767         return NT_STATUS_OK;
 768 }
 769
 770 #ifdef HAVE_LDAP
 771
 772 #include <ldap.h>
 773
 774 static int get_ldap_seq(const char *server, struct sockaddr_storage *ss, int port, uint32 *seq)
 775 {
 776         int ret = -1;
 777         struct timeval to;
 778         const char *attrs[] = {"highestCommittedUSN", NULL};
 779         LDAPMessage *res = NULL;
 780         char **values = NULL;
 781         LDAP *ldp = NULL;
 782
 783         *seq = DOM_SEQUENCE_NONE;
 784
 785         /*
 786          * Parameterised (5) second timeout on open. This is needed as the
 787          * search timeout doesn't seem to apply to doing an open as well. JRA.
 788          */
 789
 790         ldp = ldap_open_with_timeout(server, ss, port, lp_ldap_timeout());
 791         if (ldp == NULL)
 792                 return -1;
 793
 794         /* Timeout if no response within 20 seconds. */
 795         to.tv_sec = 10;
 796         to.tv_usec = 0;
 797
 798         if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)",
 799                            discard_const_p(char *, attrs), 0, &to, &res))
 800                 goto done;
 801
 802         if (ldap_count_entries(ldp, res) != 1)
 803                 goto done;
 804
 805         values = ldap_get_values(ldp, res, "highestCommittedUSN");
 806         if (!values || !values[0])
 807                 goto done;
 808
 809         *seq = atoi(values[0]);
 810         ret = 0;
 811
 812   done:
 813
 814         if (values)
 815                 ldap_value_free(values);
 816         if (res)
 817                 ldap_msgfree(res);
 818         if (ldp)
 819                 ldap_unbind(ldp);
 820         return ret;
 821 }
 822
 823 /**********************************************************************
 824  Get the sequence number for a Windows AD native mode domain using
 825  LDAP queries.
 826 **********************************************************************/
 827
 828 static int get_ldap_sequence_number(struct winbindd_domain *domain, uint32 *seq)
 829 {
 830         int ret = -1;
 831         char addr[INET6_ADDRSTRLEN];
 832
 833         print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
 834         if ((ret = get_ldap_seq(addr, &domain->dcaddr, LDAP_PORT, seq)) == 0) {
 835                 DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence "
 836                           "number for Domain (%s) from DC (%s)\n",
 837                         domain->name, addr));
 838         }
 839         return ret;
 840 }
 841
 842 #endif /* HAVE_LDAP */
 843
 844 /* find the sequence number for a domain */
 845 static NTSTATUS msrpc_sequence_number(struct winbindd_domain *domain,
 846                                       uint32_t *pseq)
 847 {
 848         struct rpc_pipe_client *samr_pipe;
 849         struct policy_handle dom_pol;
 850         uint32_t seq;
 851         TALLOC_CTX *tmp_ctx;
 852         NTSTATUS status;
 853
 854         DEBUG(3, ("msrpc_sequence_number: fetch sequence_number for %s\n", domain->name));
 855
 856         if (pseq) {
 857                 *pseq = DOM_SEQUENCE_NONE;
 858         }
 859
 860         tmp_ctx = talloc_stackframe();
 861         if (tmp_ctx == NULL) {
 862                 return NT_STATUS_NO_MEMORY;
 863         }
 864
 865         if ( !winbindd_can_contact_domain( domain ) ) {
 866                 DEBUG(10,("sequence_number: No incoming trust for domain %s\n",
 867                           domain->name));
 868                 if (pseq) {
 869                         *pseq = time(NULL);
 870                 }
 871                 status = NT_STATUS_OK;
 872                 goto done;
 873         }
 874
 875 #ifdef HAVE_LDAP
 876         if (domain->active_directory) {
 877                 int rc;
 878
 879                 DEBUG(8,("using get_ldap_seq() to retrieve the "
 880                          "sequence number\n"));
 881
 882                 rc =  get_ldap_sequence_number(domain, &seq);
 883                 if (rc == 0) {
 884                         DEBUG(10,("domain_sequence_number: LDAP for "
 885                                   "domain %s is %u\n",
 886                                   domain->name, seq));
 887
 888                         if (pseq) {
 889                                 *pseq = seq;
 890                         }
 891
 892                         status = NT_STATUS_OK;
 893                         goto done;
 894                 }
 895
 896                 DEBUG(10,("domain_sequence_number: failed to get LDAP "
 897                           "sequence number for domain %s\n",
 898                           domain->name ));
 899         }
 900 #endif /* HAVE_LDAP */
 901
 902         status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
 903         if (!NT_STATUS_IS_OK(status)) {
 904                 goto done;
 905         }
 906
 907         status = rpc_sequence_number(tmp_ctx,
 908                                      samr_pipe,
 909                                      &dom_pol,
 910                                      domain->name,
 911                                      &seq);
 912         if (!NT_STATUS_IS_OK(status)) {
 913                 goto done;
 914         }
 915
 916         if (pseq) {
 917                 *pseq = seq;
 918         }
 919
 920 done:
 921         TALLOC_FREE(tmp_ctx);
 922         return status;
 923 }
 924
 925 /* get a list of trusted domains */
 926 static NTSTATUS msrpc_trusted_domains(struct winbindd_domain *domain,
 927                                       TALLOC_CTX *mem_ctx,
 928                                       struct netr_DomainTrustList *ptrust_list)
 929 {
 930         struct rpc_pipe_client *lsa_pipe;
 931         struct policy_handle lsa_policy;
 932         struct netr_DomainTrust *trusts = NULL;
 933         uint32_t num_trusts = 0;
 934         TALLOC_CTX *tmp_ctx;
 935         NTSTATUS status;
 936
 937         DEBUG(3,("msrpc_trusted_domains\n"));
 938
 939         if (ptrust_list) {
 940                 ZERO_STRUCTP(ptrust_list);
 941         }
 942
 943         tmp_ctx = talloc_stackframe();
 944         if (tmp_ctx == NULL) {
 945                 return NT_STATUS_NO_MEMORY;
 946         }
 947
 948         status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
 949         if (!NT_STATUS_IS_OK(status))
 950                 return status;
 951
 952         status = rpc_trusted_domains(tmp_ctx,
 953                                      lsa_pipe,
 954                                      &lsa_policy,
 955                                      &num_trusts,
 956                                      &trusts);
 957         if (!NT_STATUS_IS_OK(status)) {
 958                 goto done;
 959         }
 960
 961         if (ptrust_list) {
 962                 ptrust_list->count = num_trusts;
 963                 ptrust_list->array = talloc_move(mem_ctx, &trusts);
 964         }
 965
 966 done:
 967         TALLOC_FREE(tmp_ctx);
 968         return status;
 969 }
 970
 971 /* find the lockout policy for a domain */
 972 static NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
 973                                      TALLOC_CTX *mem_ctx,
 974                                      struct samr_DomInfo12 *lockout_policy)
 975 {
 976         NTSTATUS status, result;
 977         struct rpc_pipe_client *cli;
 978         struct policy_handle dom_pol;
 979         union samr_DomainInfo *info = NULL;
 980         struct dcerpc_binding_handle *b;
 981
 982         DEBUG(3, ("msrpc_lockout_policy: fetch lockout policy for %s\n", domain->name));
 983
 984         if ( !winbindd_can_contact_domain( domain ) ) {
 985                 DEBUG(10,("msrpc_lockout_policy: No incoming trust for domain %s\n",
 986                           domain->name));
 987                 return NT_STATUS_NOT_SUPPORTED;
 988         }
 989
 990         status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
 991         if (!NT_STATUS_IS_OK(status)) {
 992                 goto done;
 993         }
 994
 995         b = cli->binding_handle;
 996
 997         status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
 998                                              &dom_pol,
 999                                              DomainLockoutInformation,
1000                                              &info,
1001                                              &result);
1002         if (!NT_STATUS_IS_OK(status)) {
1003                 goto done;
1004         }
1005         if (!NT_STATUS_IS_OK(result)) {
1006                 status = result;
1007                 goto done;
1008         }
1009
1010         *lockout_policy = info->info12;
1011
1012         DEBUG(10,("msrpc_lockout_policy: lockout_threshold %d\n",
1013                 info->info12.lockout_threshold));
1014
1015   done:
1016
1017         return status;
1018 }
1019
1020 /* find the password policy for a domain */
1021 static NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
1022                                       TALLOC_CTX *mem_ctx,
1023                                       struct samr_DomInfo1 *password_policy)
1024 {
1025         NTSTATUS status, result;
1026         struct rpc_pipe_client *cli;
1027         struct policy_handle dom_pol;
1028         union samr_DomainInfo *info = NULL;
1029         struct dcerpc_binding_handle *b;
1030
1031         DEBUG(3, ("msrpc_password_policy: fetch password policy for %s\n",
1032                   domain->name));
1033
1034         if ( !winbindd_can_contact_domain( domain ) ) {
1035                 DEBUG(10,("msrpc_password_policy: No incoming trust for domain %s\n",
1036                           domain->name));
1037                 return NT_STATUS_NOT_SUPPORTED;
1038         }
1039
1040         status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
1041         if (!NT_STATUS_IS_OK(status)) {
1042                 goto done;
1043         }
1044
1045         b = cli->binding_handle;
1046
1047         status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
1048                                              &dom_pol,
1049                                              DomainPasswordInformation,
1050                                              &info,
1051                                              &result);
1052         if (!NT_STATUS_IS_OK(status)) {
1053                 goto done;
1054         }
1055         if (!NT_STATUS_IS_OK(result)) {
1056                 goto done;
1057         }
1058
1059         *password_policy = info->info1;
1060
1061         DEBUG(10,("msrpc_password_policy: min_length_password %d\n",
1062                 info->info1.min_password_length));
1063
1064   done:
1065
1066         return status;
1067 }
1068
1069 typedef NTSTATUS (*lookup_sids_fn_t)(struct dcerpc_binding_handle *h,
1070                                      TALLOC_CTX *mem_ctx,
1071                                      struct policy_handle *pol,
1072                                      int num_sids,
1073                                      const struct dom_sid *sids,
1074                                      char ***pdomains,
1075                                      char ***pnames,
1076                                      enum lsa_SidType **ptypes,
1077                                      NTSTATUS *result);
1078
1079 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
1080                               struct winbindd_domain *domain,
1081                               uint32_t num_sids,
1082                               const struct dom_sid *sids,
1083                               char ***domains,
1084                               char ***names,
1085                               enum lsa_SidType **types)
1086 {
1087         NTSTATUS status;
1088         NTSTATUS result;
1089         struct rpc_pipe_client *cli = NULL;
1090         struct dcerpc_binding_handle *b = NULL;
1091         struct policy_handle lsa_policy;
1092         unsigned int orig_timeout;
1093         lookup_sids_fn_t lookup_sids_fn = dcerpc_lsa_lookup_sids;
1094
1095         if (domain->can_do_ncacn_ip_tcp) {
1096                 status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
1097                 if (NT_STATUS_IS_OK(status)) {
1098                         lookup_sids_fn = dcerpc_lsa_lookup_sids3;
1099                         goto lookup;
1100                 }
1101                 domain->can_do_ncacn_ip_tcp = false;
1102         }
1103         status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
1104
1105         if (!NT_STATUS_IS_OK(status)) {
1106                 return status;
1107         }
1108
1109  lookup:
1110         b = cli->binding_handle;
1111
1112         /*
1113          * This call can take a long time
1114          * allow the server to time out.
1115          * 35 seconds should do it.
1116          */
1117         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
1118
1119         status = lookup_sids_fn(b,
1120                                 mem_ctx,
1121                                 &lsa_policy,
1122                                 num_sids,
1123                                 sids,
1124                                 domains,
1125                                 names,
1126                                 types,
1127                                 &result);
1128
1129         /* And restore our original timeout. */
1130         dcerpc_binding_handle_set_timeout(b, orig_timeout);
1131
1132         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
1133             NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
1134                 /*
1135                  * This can happen if the schannel key is not
1136                  * valid anymore, we need to invalidate the
1137                  * all connections to the dc and reestablish
1138                  * a netlogon connection first.
1139                  */
1140                 invalidate_cm_connection(&domain->conn);
1141                 status = NT_STATUS_ACCESS_DENIED;
1142         }
1143
1144         if (!NT_STATUS_IS_OK(status)) {
1145                 return status;
1146         }
1147
1148         if (!NT_STATUS_IS_OK(result)) {
1149                 return result;
1150         }
1151
1152         return NT_STATUS_OK;
1153 }
1154
1155 typedef NTSTATUS (*lookup_names_fn_t)(struct dcerpc_binding_handle *h,
1156                                       TALLOC_CTX *mem_ctx,
1157                                       struct policy_handle *pol,
1158                                       uint32_t num_names,
1159                                       const char **names,
1160                                       const char ***dom_names,
1161                                       enum lsa_LookupNamesLevel level,
1162                                       struct dom_sid **sids,
1163                                       enum lsa_SidType **types,
1164                                       NTSTATUS *result);
1165
1166 static NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
1167                                       struct winbindd_domain *domain,
1168                                       uint32_t num_names,
1169                                       const char **names,
1170                                       const char ***domains,
1171                                       struct dom_sid **sids,
1172                                       enum lsa_SidType **types)
1173 {
1174         NTSTATUS status;
1175         NTSTATUS result;
1176         struct rpc_pipe_client *cli = NULL;
1177         struct dcerpc_binding_handle *b = NULL;
1178         struct policy_handle lsa_policy;
1179         unsigned int orig_timeout = 0;
1180         lookup_names_fn_t lookup_names_fn = dcerpc_lsa_lookup_names;
1181
1182         if (domain->can_do_ncacn_ip_tcp) {
1183                 status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
1184                 if (NT_STATUS_IS_OK(status)) {
1185                         lookup_names_fn = dcerpc_lsa_lookup_names4;
1186                         goto lookup;
1187                 }
1188                 domain->can_do_ncacn_ip_tcp = false;
1189         }
1190         status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
1191
1192         if (!NT_STATUS_IS_OK(status)) {
1193                 return status;
1194         }
1195
1196  lookup:
1197         b = cli->binding_handle;
1198
1199         /*
1200          * This call can take a long time
1201          * allow the server to time out.
1202          * 35 seconds should do it.
1203          */
1204         orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
1205
1206         status = lookup_names_fn(b,
1207                                  mem_ctx,
1208                                  &lsa_policy,
1209                                  num_names,
1210                                  (const char **) names,
1211                                  domains,
1212                                  1,
1213                                  sids,
1214                                  types,
1215                                  &result);
1216
1217         /* And restore our original timeout. */
1218         dcerpc_binding_handle_set_timeout(b, orig_timeout);
1219
1220         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
1221             NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
1222                 /*
1223                  * This can happen if the schannel key is not
1224                  * valid anymore, we need to invalidate the
1225                  * all connections to the dc and reestablish
1226                  * a netlogon connection first.
1227                  */
1228                 invalidate_cm_connection(&domain->conn);
1229                 status = NT_STATUS_ACCESS_DENIED;
1230         }
1231
1232         if (!NT_STATUS_IS_OK(status)) {
1233                 return status;
1234         }
1235
1236         if (!NT_STATUS_IS_OK(result)) {
1237                 return result;
1238         }
1239
1240         return NT_STATUS_OK;
1241 }
1242
1243 /* the rpc backend methods are exposed via this structure */
1244 struct winbindd_methods msrpc_methods = {
1245         False,
1246         msrpc_query_user_list,
1247         msrpc_enum_dom_groups,
1248         msrpc_enum_local_groups,
1249         msrpc_name_to_sid,
1250         msrpc_sid_to_name,
1251         msrpc_rids_to_names,
1252         msrpc_query_user,
1253         msrpc_lookup_usergroups,
1254         msrpc_lookup_useraliases,
1255         msrpc_lookup_groupmem,
1256         msrpc_sequence_number,
1257         msrpc_lockout_policy,
1258         msrpc_password_policy,
1259         msrpc_trusted_domains,
1260 };