diff options
Diffstat (limited to 'source4/utils')
| -rw-r--r-- | source4/utils/net/config.mk | 22 | ||||
| -rw-r--r-- | source4/utils/net/drs/net_drs.c | 298 | ||||
| -rw-r--r-- | source4/utils/net/drs/net_drs.h | 56 | ||||
| -rw-r--r-- | source4/utils/net/net.c | 2 |
4 files changed, 377 insertions, 1 deletions
diff --git a/source4/utils/net/config.mk b/source4/utils/net/config.mk index ff8cb2c526..c323b7cf5b 100644 --- a/source4/utils/net/config.mk +++ b/source4/utils/net/config.mk @@ -1,5 +1,23 @@ # $(utilssrcdir)/net subsystem + +################################# +# Start MODULE net_drs +[MODULE::net_drs] +SUBSYSTEM = net +OUTPUT_TYPE = MERGED_OBJ +PRIVATE_DEPENDENCIES = \ + LIBCLI_DRSUAPI \ + LIBLDB +# End MODULE net_drs +################################# + +net_drs_OBJ_FILES = $(addprefix $(utilssrcdir)/net/drs/, \ + net_drs.o) + +$(eval $(call proto_header_template,$(utilssrcdir)/net/drs/net_drs_proto.h,$(net_drs_OBJ_FILES:.o=.c))) + + ################################# # Start BINARY net [BINARY::net] @@ -10,7 +28,8 @@ PRIVATE_DEPENDENCIES = \ LIBSAMBA-NET \ LIBPOPT \ POPT_SAMBA \ - POPT_CREDENTIALS + POPT_CREDENTIALS \ + net_drs # End BINARY net ################################# @@ -26,3 +45,4 @@ net_OBJ_FILES = $(addprefix $(utilssrcdir)/net/, \ $(eval $(call proto_header_template,$(utilssrcdir)/net/net_proto.h,$(net_OBJ_FILES:.o=.c))) + diff --git a/source4/utils/net/drs/net_drs.c b/source4/utils/net/drs/net_drs.c new file mode 100644 index 0000000000..547d642bfb --- /dev/null +++ b/source4/utils/net/drs/net_drs.c @@ -0,0 +1,298 @@ +/* + Samba Unix/Linux SMB client library + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki <kamen.mazdrashki@postpath.com> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "utils/net/net.h" +#include "librpc/gen_ndr/ndr_drsuapi_c.h" +#include "net_drs.h" +#include "lib/ldb/include/ldb.h" +#include "lib/ldb_wrap.h" + +#include <unistd.h> + + +/** + * 'net drs' supported sub-commands + */ +static const struct net_functable net_drs_functable[] = { + { "bind", "Display replication features for a domain controller\n", net_drs_bind_cmd, net_drs_bind_usage }, + { NULL, NULL } +}; + +/** + * 'net drs' entry point + */ +int net_drs(struct net_context *ctx, int argc, const char **argv) +{ + return net_run_function(ctx, argc, argv, net_drs_functable, net_drs_usage); +} + +/** + * 'net drs' usage message + */ +int net_drs_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("net drs <command> [options]\n"); + d_printf("\n"); + d_printf("Currently implemented commands:\n"); + d_printf(" bind - Display DC replication features"); + return 0; +} + +/** + * Create drsuapi connection to remote DC + * and fill-in DC capabilities + */ +static bool net_drs_DsBind(struct net_drs_context *drs_ctx) +{ + NTSTATUS status; + struct GUID bind_guid; + struct drsuapi_DsBind req; + struct drsuapi_DsBindInfoCtr in_bind_ctr; + union drsuapi_DsBindInfo *bind_info; + + SMB_ASSERT(drs_ctx->binding != NULL); + + status = dcerpc_pipe_connect_b(drs_ctx, + &drs_ctx->drs_pipe, + drs_ctx->binding, + &ndr_table_drsuapi, + drs_ctx->net_ctx->credentials, + drs_ctx->net_ctx->event_ctx, + drs_ctx->net_ctx->lp_ctx); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Failed to connect to server: %s\n", nt_errstr(status)); + return false; + } + + ZERO_STRUCT(in_bind_ctr); + in_bind_ctr.length = 48; + in_bind_ctr.info.info48.pid = (uint32_t)getpid(); + GUID_from_string(DRSUAPI_DS_BIND_GUID, &bind_guid); + req.in.bind_guid = &bind_guid; + req.in.bind_info = &in_bind_ctr; + req.out.bind_handle = &drs_ctx->bind_handle; + + status = dcerpc_drsuapi_DsBind(drs_ctx->drs_pipe, drs_ctx, &req); + if (!NT_STATUS_IS_OK(status)) { + const char *errstr = nt_errstr(status); + if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) { + errstr = dcerpc_errstr(drs_ctx, drs_ctx->drs_pipe->last_fault_code); + } + d_printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr); + return false; + } else if (!W_ERROR_IS_OK(req.out.result)) { + d_printf("DsBind failed - %s\n", win_errstr(req.out.result)); + return false; + } + + /* fill-in remote DC capabilities */ + ZERO_STRUCT(drs_ctx->info48); + bind_info = &req.out.bind_info->info; + drs_ctx->bind_info_len = req.out.bind_info->length; + switch (drs_ctx->bind_info_len) { + case 48: + drs_ctx->info48.supported_extensions_ext = bind_info->info48.supported_extensions_ext; + drs_ctx->info48.config_dn_guid = bind_info->info48.config_dn_guid; + case 28: + drs_ctx->info48.repl_epoch = bind_info->info28.repl_epoch; + case 24: + drs_ctx->info48.supported_extensions = bind_info->info24.supported_extensions; + drs_ctx->info48.site_guid = bind_info->info24.site_guid; + drs_ctx->info48.pid = bind_info->info24.pid; + break; + default: + d_printf("Error: server returned BindInfo length %d", req.out.bind_info->length); + return false; + } + + return true; +} + +/** + * Close DRSUAPI connection to remote DC + */ +static bool net_drs_DsUnbind(struct net_drs_context *drs_ctx) +{ + struct drsuapi_DsUnbind r; + struct policy_handle bind_handle; + + ZERO_STRUCT(r); + r.out.bind_handle = &bind_handle; + + r.in.bind_handle = &drs_ctx->bind_handle; + dcerpc_drsuapi_DsUnbind(drs_ctx->drs_pipe, drs_ctx, &r); + + return true; +} + + +/** + * Open secured LDAP connection to remote DC + */ +static bool net_drs_ldap_connect(struct net_drs_context *drs_ctx) +{ + char *url; + bool bret = true; + + url = talloc_asprintf(drs_ctx, "ldap://%s/", drs_ctx->dc_name); + if (!url) { + d_printf(__location__ ": Have no memory"); + return false; + } + + drs_ctx->ldap.ldb = ldb_wrap_connect(drs_ctx, + drs_ctx->net_ctx->event_ctx, drs_ctx->net_ctx->lp_ctx, + url, + NULL, + drs_ctx->net_ctx->credentials, + 0); + if (drs_ctx->ldap.ldb == NULL) { + d_printf("Unable to connect to LDAP %s", url); + bret = false; + } + + talloc_free(url); + + return bret; +} + +/** + * fetch RootDSE record + */ +static bool net_drs_ldap_rootdse(struct net_drs_context *drs_ctx) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "*", + NULL + }; + + SMB_ASSERT(drs_ctx->ldap.ldb != NULL); + + basedn = ldb_dn_new(drs_ctx, drs_ctx->ldap.ldb, NULL); + if (!basedn) { + d_printf(__location__ ": No memory"); + return false; + } + + ret = ldb_search(drs_ctx->ldap.ldb, drs_ctx, &r, + basedn, LDB_SCOPE_BASE, attrs, + "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + d_printf("RootDSE search failed: %s", ldb_errstring(drs_ctx->ldap.ldb)); + talloc_free(r); + return false; + } else if (r->count != 1) { + d_printf("RootDSE search returned more than one record!"); + talloc_free(r); + return false; + } + + drs_ctx->ldap.rootdse = r->msgs[0]; + + return true; +} + +/** + * parses binding from command line + * and gets target DC name + */ +static bool net_drs_parse_binding(struct net_drs_context *drs_ctx, const char *dc_binding) +{ + NTSTATUS status; + + status = dcerpc_parse_binding(drs_ctx, dc_binding, &drs_ctx->binding); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Bad binding supplied %s\n", dc_binding); + return false; + } + + drs_ctx->binding->transport = NCACN_IP_TCP; + drs_ctx->binding->flags |= DCERPC_SIGN | DCERPC_SEAL; + + /* cache target DC name */ + drs_ctx->dc_name = drs_ctx->binding->target_hostname; + + return true; +} + +/** + * Free DRSUAPI connection upon net_drs_context + * destruction + */ +static int net_drs_context_destructor(struct net_drs_context *drs_ctx) +{ + if (drs_ctx->drs_pipe) { + net_drs_DsUnbind(drs_ctx); + } + return 0; +} + +/** + * Create net_drs_context context to be used + * by 'net drs' sub-commands + */ +bool net_drs_create_context(struct net_context *net_ctx, + const char *dc_binding, + struct net_drs_context **_drs_ctx) +{ + struct net_drs_context *drs_ctx; + + drs_ctx = talloc_zero(net_ctx, struct net_drs_context); + if (!drs_ctx) { + d_printf(__location__ ": No memory"); + return false; + } + + drs_ctx->net_ctx = net_ctx; + + if (!net_drs_parse_binding(drs_ctx, dc_binding)) { + goto failed; + } + + /* LDAP connect */ + if (!net_drs_ldap_connect(drs_ctx)) { + goto failed; + } + /* fetch RootDSE */ + if (!net_drs_ldap_rootdse(drs_ctx)) { + goto failed; + } + + /* DRSUAPI connection */ + if (!net_drs_DsBind(drs_ctx)) { + goto failed; + } + + /* set destructor to free any open connections */ + talloc_set_destructor(drs_ctx, net_drs_context_destructor); + + *_drs_ctx = drs_ctx; + return true; + +failed: + talloc_free(drs_ctx); + return false; +} diff --git a/source4/utils/net/drs/net_drs.h b/source4/utils/net/drs/net_drs.h new file mode 100644 index 0000000000..f5f362077d --- /dev/null +++ b/source4/utils/net/drs/net_drs.h @@ -0,0 +1,56 @@ +/* + Unix SMB/CIFS implementation. + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki <kamen.mazdrashki@postpath.com> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef NET_DRS_H_ +#define NET_DRS_H_ + +#include "librpc/gen_ndr/ndr_drsuapi_c.h" + +/* net drs commands context */ +struct net_drs_context { + struct net_context *net_ctx; + + /* remote DC name supplied from command line */ + const char *dc_name; + + /* DRSUAPI connection context */ + struct dcerpc_binding *binding; + struct dcerpc_pipe *drs_pipe; + struct policy_handle bind_handle; + + /* length of bind info structure returned by remote DC + * 'net drs bind' command make use of this value */ + uint32_t bind_info_len; + + /* remote DC DRSUAPI capabilities */ + struct drsuapi_DsBindInfo48 info48; + + /* LDAP connection to DC */ + struct net_drs_ldap { + struct ldb_context *ldb; + const struct ldb_message *rootdse; + } ldap; +}; + + +#include "net_drs_proto.h" + +#endif /* NET_DRS_H_ */ diff --git a/source4/utils/net/net.c b/source4/utils/net/net.c index 3709b0acda..79b6ad8515 100644 --- a/source4/utils/net/net.c +++ b/source4/utils/net/net.c @@ -51,6 +51,7 @@ #include "lib/events/events.h" #include "auth/credentials/credentials.h" #include "scripting/python/modules.h" +#include "drs/net_drs.h" /* There's no Py_ssize_t in 2.4, apparently */ #if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5 @@ -204,6 +205,7 @@ static const struct net_functable net_functable[] = { {"samsync", "synchronise into the local ldb the sam of an NT4 domain\n", net_samsync_ldb, net_samsync_ldb_usage}, {"user", "manage user accounts\n", net_user, net_user_usage}, {"machinepw", "Get a machine password out of our SAM\n", net_machinepw, net_machinepw_usage}, + {"drs", "Implements functionality offered by repadmin.exe utility in Windows\n", net_drs, net_drs_usage}, {NULL, NULL, NULL, NULL} }; |