source4/libnet/libnet_rpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher  2004
   5    Copyright (C) Rafal Szczesniak   2005
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23 #include "libnet/libnet.h"
  24 #include "libcli/libcli.h"
  25 #include "librpc/gen_ndr/ndr_lsa.h"
  26 #include "librpc/gen_ndr/ndr_lsa_c.h"
  27
  28 /**
  29  * Connects rpc pipe on remote server
  30  *
  31  * @param ctx initialised libnet context
  32  * @param mem_ctx memory context of this call
  33  * @param r data structure containing necessary parameters and return values
  34  * @return nt status of the call
  35  **/
  36
  37 static NTSTATUS libnet_RpcConnectSrv(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r)
  38 {
  39         NTSTATUS status;
  40         const char *binding = NULL;
  41
  42         /* prepare binding string */
  43         switch (r->level) {
  44         case LIBNET_RPC_CONNECT_DC:
  45         case LIBNET_RPC_CONNECT_PDC:
  46         case LIBNET_RPC_CONNECT_SERVER:
  47                 binding = talloc_asprintf(mem_ctx, "ncacn_np:%s", r->in.name);
  48                 break;
  49
  50         case LIBNET_RPC_CONNECT_BINDING:
  51                 binding = r->in.binding;
  52                 break;
  53         }
  54
  55         /* connect to remote dcerpc pipe */
  56         status = dcerpc_pipe_connect(mem_ctx, &r->out.dcerpc_pipe,
  57                                      binding, r->in.dcerpc_iface,
  58                                      ctx->cred, ctx->event_ctx);
  59
  60         if (!NT_STATUS_IS_OK(status)) {
  61                 r->out.error_string = talloc_asprintf(mem_ctx,
  62                                                       "dcerpc_pipe_connect to pipe %s[%s] failed with %s\n",
  63                                                       r->in.dcerpc_iface->name, binding, nt_errstr(status));
  64                 return status;
  65         }
  66
  67         r->out.error_string = NULL;
  68         ctx->pipe = r->out.dcerpc_pipe;
  69
  70         return status;
  71 }
  72
  73
  74 /**
  75  * Connects rpc pipe on domain pdc
  76  *
  77  * @param ctx initialised libnet context
  78  * @param mem_ctx memory context of this call
  79  * @param r data structure containing necessary parameters and return values
  80  * @return nt status of the call
  81  **/
  82
  83 static NTSTATUS libnet_RpcConnectDC(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r)
  84 {
  85         NTSTATUS status;
  86         struct libnet_RpcConnect r2;
  87         struct libnet_LookupDCs f;
  88         const char *connect_name;
  89
  90         f.in.domain_name  = r->in.name;
  91         switch (r->level) {
  92         case LIBNET_RPC_CONNECT_PDC:
  93                 f.in.name_type = NBT_NAME_PDC;
  94                 break;
  95         case LIBNET_RPC_CONNECT_DC:
  96                 f.in.name_type = NBT_NAME_LOGON;
  97                 break;
  98         default:
  99                 break;
 100         }
 101         f.out.num_dcs = 0;
 102         f.out.dcs  = NULL;
 103
 104         /* find the domain pdc first */
 105         status = libnet_LookupDCs(ctx, mem_ctx, &f);
 106         if (!NT_STATUS_IS_OK(status)) {
 107                 r->out.error_string = talloc_asprintf(mem_ctx, "libnet_LookupDCs failed: %s",
 108                                                       nt_errstr(status));
 109                 return status;
 110         }
 111
 112         /* we might not have got back a name.  Fall back to the IP */
 113         if (f.out.dcs[0].name) {
 114                 connect_name = f.out.dcs[0].name;
 115         } else {
 116                 connect_name = f.out.dcs[0].address;
 117         }
 118
 119         /* ok, pdc has been found so do attempt to rpc connect */
 120         r2.level            = LIBNET_RPC_CONNECT_SERVER;
 121
 122         /* This will cause yet another name resolution, but at least
 123          * we pass the right name down the stack now */
 124         r2.in.name          = talloc_strdup(mem_ctx, connect_name);
 125         r2.in.dcerpc_iface  = r->in.dcerpc_iface;
 126
 127         status = libnet_RpcConnect(ctx, mem_ctx, &r2);
 128
 129         r->out.dcerpc_pipe          = r2.out.dcerpc_pipe;
 130         r->out.error_string         = r2.out.error_string;
 131
 132         ctx->pipe = r->out.dcerpc_pipe;
 133
 134         return status;
 135 }
 136
 137
 138 /**
 139  * Connects to rpc pipe on remote server or pdc
 140  *
 141  * @param ctx initialised libnet context
 142  * @param mem_ctx memory context of this call
 143  * @param r data structure containing necessary parameters and return values
 144  * @return nt status of the call
 145  **/
 146
 147 NTSTATUS libnet_RpcConnect(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_RpcConnect *r)
 148 {
 149         switch (r->level) {
 150                 case LIBNET_RPC_CONNECT_SERVER:
 151                         return libnet_RpcConnectSrv(ctx, mem_ctx, r);
 152
 153                 case LIBNET_RPC_CONNECT_BINDING:
 154                         return libnet_RpcConnectSrv(ctx, mem_ctx, r);
 155
 156                 case LIBNET_RPC_CONNECT_PDC:
 157                 case LIBNET_RPC_CONNECT_DC:
 158                         return libnet_RpcConnectDC(ctx, mem_ctx, r);
 159         }
 160
 161         return NT_STATUS_INVALID_LEVEL;
 162 }
 163
 164 /**
 165  * Connects to rpc pipe on remote server or pdc, and returns info on the domain name, domain sid and realm
 166  *
 167  * @param ctx initialised libnet context
 168  * @param r data structure containing necessary parameters and return values.  Must be a talloc context
 169  * @return nt status of the call
 170  **/
 171
 172 NTSTATUS libnet_RpcConnectDCInfo(struct libnet_context *ctx,
 173                                  struct libnet_RpcConnectDCInfo *r)
 174 {
 175         TALLOC_CTX *tmp_ctx;
 176         NTSTATUS status;
 177
 178         struct libnet_RpcConnect *c;
 179         struct lsa_ObjectAttribute attr;
 180         struct lsa_QosInfo qos;
 181         struct lsa_OpenPolicy2 lsa_open_policy;
 182         struct policy_handle lsa_p_handle;
 183         struct lsa_QueryInfoPolicy2 lsa_query_info2;
 184         struct lsa_QueryInfoPolicy lsa_query_info;
 185
 186         struct dcerpc_pipe *lsa_pipe;
 187
 188         struct dcerpc_binding *final_binding;
 189         struct dcerpc_pipe *final_pipe;
 190
 191         tmp_ctx = talloc_new(r);
 192         if (!tmp_ctx) {
 193                 r->out.error_string = NULL;
 194                 return NT_STATUS_NO_MEMORY;
 195         }
 196
 197         c = talloc(tmp_ctx, struct libnet_RpcConnect);
 198         if (!c) {
 199                 r->out.error_string = NULL;
 200                 talloc_free(tmp_ctx);
 201                 return NT_STATUS_NO_MEMORY;
 202         }
 203         c->level              = r->level;
 204
 205         if (r->level != LIBNET_RPC_CONNECT_BINDING) {
 206                 c->in.name    = r->in.name;
 207         } else {
 208                 c->in.binding = r->in.binding;
 209         }
 210
 211         c->in.dcerpc_iface    = &dcerpc_table_lsarpc;
 212
 213         /* connect to the LSA pipe of the PDC */
 214
 215         status = libnet_RpcConnect(ctx, c, c);
 216         if (!NT_STATUS_IS_OK(status)) {
 217                 if (r->level != LIBNET_RPC_CONNECT_BINDING) {
 218                         r->out.error_string = talloc_asprintf(r,
 219                                                               "Connection to LSA pipe of DC failed: %s",
 220                                                               c->out.error_string);
 221                 } else {
 222                         r->out.error_string = talloc_asprintf(r,
 223                                                               "Connection to LSA pipe with binding '%s' failed: %s",
 224                                                               r->in.binding, c->out.error_string);
 225                 }
 226                 talloc_free(tmp_ctx);
 227                 return status;
 228         }
 229         lsa_pipe = c->out.dcerpc_pipe;
 230
 231         /* Get an LSA policy handle */
 232
 233         ZERO_STRUCT(lsa_p_handle);
 234         qos.len = 0;
 235         qos.impersonation_level = 2;
 236         qos.context_mode = 1;
 237         qos.effective_only = 0;
 238
 239         attr.len = 0;
 240         attr.root_dir = NULL;
 241         attr.object_name = NULL;
 242         attr.attributes = 0;
 243         attr.sec_desc = NULL;
 244         attr.sec_qos = &qos;
 245
 246         lsa_open_policy.in.attr = &attr;
 247
 248         lsa_open_policy.in.system_name = talloc_asprintf(tmp_ctx, "\\");
 249         if (!lsa_open_policy.in.system_name) {
 250                 r->out.error_string = NULL;
 251                 talloc_free(tmp_ctx);
 252                 return NT_STATUS_NO_MEMORY;
 253         }
 254
 255         lsa_open_policy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 256         lsa_open_policy.out.handle = &lsa_p_handle;
 257
 258         status = dcerpc_lsa_OpenPolicy2(lsa_pipe, tmp_ctx, &lsa_open_policy);
 259
 260         /* This now fails on ncacn_ip_tcp against Win2k3 SP1 */
 261         if (NT_STATUS_IS_OK(status)) {
 262                 /* Look to see if this is ADS (a fault indicates NT4 or Samba 3.0) */
 263
 264                 lsa_query_info2.in.handle = &lsa_p_handle;
 265                 lsa_query_info2.in.level = LSA_POLICY_INFO_DNS;
 266
 267                 status = dcerpc_lsa_QueryInfoPolicy2(lsa_pipe, tmp_ctx,
 268                                                      &lsa_query_info2);
 269
 270                 if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 271                         if (!NT_STATUS_IS_OK(status)) {
 272                                 r->out.error_string = talloc_asprintf(r,
 273                                                                       "lsa_QueryInfoPolicy2 failed: %s",
 274                                                                       nt_errstr(status));
 275                                 talloc_free(tmp_ctx);
 276                                 return status;
 277                         }
 278                         r->out.realm = lsa_query_info2.out.info->dns.dns_domain.string;
 279                         r->out.guid = talloc(r, struct GUID);
 280                         if (!r->out.guid) {
 281                                 r->out.error_string = NULL;
 282                                 return NT_STATUS_NO_MEMORY;
 283                         }
 284                         *r->out.guid = lsa_query_info2.out.info->dns.domain_guid;
 285                 } else {
 286                         r->out.realm = NULL;
 287                         r->out.guid = NULL;
 288                 }
 289
 290                 /* Grab the domain SID (regardless of the result of the previous call */
 291
 292                 lsa_query_info.in.handle = &lsa_p_handle;
 293                 lsa_query_info.in.level = LSA_POLICY_INFO_DOMAIN;
 294
 295                 status = dcerpc_lsa_QueryInfoPolicy(lsa_pipe, tmp_ctx,
 296                                                     &lsa_query_info);
 297
 298                 if (!NT_STATUS_IS_OK(status)) {
 299                         r->out.error_string = talloc_asprintf(r,
 300                                                               "lsa_QueryInfoPolicy2 failed: %s",
 301                                                               nt_errstr(status));
 302                         talloc_free(tmp_ctx);
 303                         return status;
 304                 }
 305
 306                 r->out.domain_sid = lsa_query_info.out.info->domain.sid;
 307                 r->out.domain_name = lsa_query_info.out.info->domain.name.string;
 308         } else {
 309                 /* Cause the code further down to try this with just SAMR */
 310                 r->out.domain_sid = NULL;
 311                 r->out.domain_name = NULL;
 312                 r->out.realm = NULL;
 313         }
 314
 315         /* Find the original binding string */
 316         final_binding = talloc(tmp_ctx, struct dcerpc_binding);
 317         if (!final_binding) {
 318                 return NT_STATUS_NO_MEMORY;
 319         }
 320         *final_binding = *lsa_pipe->binding;
 321         /* Ensure we keep hold of the member elements */
 322         talloc_reference(final_binding, lsa_pipe->binding);
 323
 324         /* Make binding string for samr, not the other pipe */
 325         status = dcerpc_epm_map_binding(tmp_ctx, final_binding,
 326                                         r->in.dcerpc_iface,
 327                                         lsa_pipe->conn->event_ctx);
 328         if (!NT_STATUS_IS_OK(status)) {
 329                 r->out.error_string = talloc_asprintf(r,
 330                                                       "Failed to map pipe with endpoint mapper - %s",
 331                                                       nt_errstr(status));
 332                 talloc_free(tmp_ctx);
 333                 return status;
 334         }
 335
 336         /* Now that we have the info setup a final connection to the pipe they wanted */
 337         status = dcerpc_secondary_connection(lsa_pipe, &final_pipe, final_binding);
 338         if (!NT_STATUS_IS_OK(status)) {
 339                 r->out.error_string = talloc_asprintf(r,
 340                                                       "secondary connection failed: %s",
 341                                                       nt_errstr(status));
 342                 talloc_free(tmp_ctx);
 343                 return status;
 344         }
 345         r->out.dcerpc_pipe = final_pipe;
 346
 347         talloc_steal(r, r->out.realm);
 348         talloc_steal(r, r->out.domain_sid);
 349         talloc_steal(r, r->out.domain_name);
 350         talloc_steal(r, r->out.dcerpc_pipe);
 351
 352         /* This should close the LSA pipe, which we don't need now we have the info */
 353         talloc_free(tmp_ctx);
 354         return NT_STATUS_OK;
 355 }
 356