summaryrefslogtreecommitdiff
path: root/source4/utils
diff options
context:
space:
mode:
Diffstat (limited to 'source4/utils')
-rw-r--r--source4/utils/net/config.mk22
-rw-r--r--source4/utils/net/drs/net_drs.c298
-rw-r--r--source4/utils/net/drs/net_drs.h56
-rw-r--r--source4/utils/net/net.c2
4 files changed, 377 insertions, 1 deletions
diff --git a/source4/utils/net/config.mk b/source4/utils/net/config.mk
index ff8cb2c526..c323b7cf5b 100644
--- a/source4/utils/net/config.mk
+++ b/source4/utils/net/config.mk
@@ -1,5 +1,23 @@
# $(utilssrcdir)/net subsystem
+
+#################################
+# Start MODULE net_drs
+[MODULE::net_drs]
+SUBSYSTEM = net
+OUTPUT_TYPE = MERGED_OBJ
+PRIVATE_DEPENDENCIES = \
+ LIBCLI_DRSUAPI \
+ LIBLDB
+# End MODULE net_drs
+#################################
+
+net_drs_OBJ_FILES = $(addprefix $(utilssrcdir)/net/drs/, \
+ net_drs.o)
+
+$(eval $(call proto_header_template,$(utilssrcdir)/net/drs/net_drs_proto.h,$(net_drs_OBJ_FILES:.o=.c)))
+
+
#################################
# Start BINARY net
[BINARY::net]
@@ -10,7 +28,8 @@ PRIVATE_DEPENDENCIES = \
LIBSAMBA-NET \
LIBPOPT \
POPT_SAMBA \
- POPT_CREDENTIALS
+ POPT_CREDENTIALS \
+ net_drs
# End BINARY net
#################################
@@ -26,3 +45,4 @@ net_OBJ_FILES = $(addprefix $(utilssrcdir)/net/, \
$(eval $(call proto_header_template,$(utilssrcdir)/net/net_proto.h,$(net_OBJ_FILES:.o=.c)))
+
diff --git a/source4/utils/net/drs/net_drs.c b/source4/utils/net/drs/net_drs.c
new file mode 100644
index 0000000000..547d642bfb
--- /dev/null
+++ b/source4/utils/net/drs/net_drs.c
@@ -0,0 +1,298 @@
+/*
+ Samba Unix/Linux SMB client library
+
+ Implements functions offered by repadmin.exe tool under Windows
+
+ Copyright (C) Kamen Mazdrashki <kamen.mazdrashki@postpath.com> 2010
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "utils/net/net.h"
+#include "librpc/gen_ndr/ndr_drsuapi_c.h"
+#include "net_drs.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb_wrap.h"
+
+#include <unistd.h>
+
+
+/**
+ * 'net drs' supported sub-commands
+ */
+static const struct net_functable net_drs_functable[] = {
+ { "bind", "Display replication features for a domain controller\n", net_drs_bind_cmd, net_drs_bind_usage },
+ { NULL, NULL }
+};
+
+/**
+ * 'net drs' entry point
+ */
+int net_drs(struct net_context *ctx, int argc, const char **argv)
+{
+ return net_run_function(ctx, argc, argv, net_drs_functable, net_drs_usage);
+}
+
+/**
+ * 'net drs' usage message
+ */
+int net_drs_usage(struct net_context *ctx, int argc, const char **argv)
+{
+ d_printf("net drs <command> [options]\n");
+ d_printf("\n");
+ d_printf("Currently implemented commands:\n");
+ d_printf(" bind - Display DC replication features");
+ return 0;
+}
+
+/**
+ * Create drsuapi connection to remote DC
+ * and fill-in DC capabilities
+ */
+static bool net_drs_DsBind(struct net_drs_context *drs_ctx)
+{
+ NTSTATUS status;
+ struct GUID bind_guid;
+ struct drsuapi_DsBind req;
+ struct drsuapi_DsBindInfoCtr in_bind_ctr;
+ union drsuapi_DsBindInfo *bind_info;
+
+ SMB_ASSERT(drs_ctx->binding != NULL);
+
+ status = dcerpc_pipe_connect_b(drs_ctx,
+ &drs_ctx->drs_pipe,
+ drs_ctx->binding,
+ &ndr_table_drsuapi,
+ drs_ctx->net_ctx->credentials,
+ drs_ctx->net_ctx->event_ctx,
+ drs_ctx->net_ctx->lp_ctx);
+ if (!NT_STATUS_IS_OK(status)) {
+ d_printf("Failed to connect to server: %s\n", nt_errstr(status));
+ return false;
+ }
+
+ ZERO_STRUCT(in_bind_ctr);
+ in_bind_ctr.length = 48;
+ in_bind_ctr.info.info48.pid = (uint32_t)getpid();
+ GUID_from_string(DRSUAPI_DS_BIND_GUID, &bind_guid);
+ req.in.bind_guid = &bind_guid;
+ req.in.bind_info = &in_bind_ctr;
+ req.out.bind_handle = &drs_ctx->bind_handle;
+
+ status = dcerpc_drsuapi_DsBind(drs_ctx->drs_pipe, drs_ctx, &req);
+ if (!NT_STATUS_IS_OK(status)) {
+ const char *errstr = nt_errstr(status);
+ if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
+ errstr = dcerpc_errstr(drs_ctx, drs_ctx->drs_pipe->last_fault_code);
+ }
+ d_printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr);
+ return false;
+ } else if (!W_ERROR_IS_OK(req.out.result)) {
+ d_printf("DsBind failed - %s\n", win_errstr(req.out.result));
+ return false;
+ }
+
+ /* fill-in remote DC capabilities */
+ ZERO_STRUCT(drs_ctx->info48);
+ bind_info = &req.out.bind_info->info;
+ drs_ctx->bind_info_len = req.out.bind_info->length;
+ switch (drs_ctx->bind_info_len) {
+ case 48:
+ drs_ctx->info48.supported_extensions_ext = bind_info->info48.supported_extensions_ext;
+ drs_ctx->info48.config_dn_guid = bind_info->info48.config_dn_guid;
+ case 28:
+ drs_ctx->info48.repl_epoch = bind_info->info28.repl_epoch;
+ case 24:
+ drs_ctx->info48.supported_extensions = bind_info->info24.supported_extensions;
+ drs_ctx->info48.site_guid = bind_info->info24.site_guid;
+ drs_ctx->info48.pid = bind_info->info24.pid;
+ break;
+ default:
+ d_printf("Error: server returned BindInfo length %d", req.out.bind_info->length);
+ return false;
+ }
+
+ return true;
+}
+
+/**
+ * Close DRSUAPI connection to remote DC
+ */
+static bool net_drs_DsUnbind(struct net_drs_context *drs_ctx)
+{
+ struct drsuapi_DsUnbind r;
+ struct policy_handle bind_handle;
+
+ ZERO_STRUCT(r);
+ r.out.bind_handle = &bind_handle;
+
+ r.in.bind_handle = &drs_ctx->bind_handle;
+ dcerpc_drsuapi_DsUnbind(drs_ctx->drs_pipe, drs_ctx, &r);
+
+ return true;
+}
+
+
+/**
+ * Open secured LDAP connection to remote DC
+ */
+static bool net_drs_ldap_connect(struct net_drs_context *drs_ctx)
+{
+ char *url;
+ bool bret = true;
+
+ url = talloc_asprintf(drs_ctx, "ldap://%s/", drs_ctx->dc_name);
+ if (!url) {
+ d_printf(__location__ ": Have no memory");
+ return false;
+ }
+
+ drs_ctx->ldap.ldb = ldb_wrap_connect(drs_ctx,
+ drs_ctx->net_ctx->event_ctx, drs_ctx->net_ctx->lp_ctx,
+ url,
+ NULL,
+ drs_ctx->net_ctx->credentials,
+ 0);
+ if (drs_ctx->ldap.ldb == NULL) {
+ d_printf("Unable to connect to LDAP %s", url);
+ bret = false;
+ }
+
+ talloc_free(url);
+
+ return bret;
+}
+
+/**
+ * fetch RootDSE record
+ */
+static bool net_drs_ldap_rootdse(struct net_drs_context *drs_ctx)
+{
+ int ret;
+ struct ldb_result *r;
+ struct ldb_dn *basedn;
+ static const char *attrs[] = {
+ "*",
+ NULL
+ };
+
+ SMB_ASSERT(drs_ctx->ldap.ldb != NULL);
+
+ basedn = ldb_dn_new(drs_ctx, drs_ctx->ldap.ldb, NULL);
+ if (!basedn) {
+ d_printf(__location__ ": No memory");
+ return false;
+ }
+
+ ret = ldb_search(drs_ctx->ldap.ldb, drs_ctx, &r,
+ basedn, LDB_SCOPE_BASE, attrs,
+ "(objectClass=*)");
+ talloc_free(basedn);
+ if (ret != LDB_SUCCESS) {
+ d_printf("RootDSE search failed: %s", ldb_errstring(drs_ctx->ldap.ldb));
+ talloc_free(r);
+ return false;
+ } else if (r->count != 1) {
+ d_printf("RootDSE search returned more than one record!");
+ talloc_free(r);
+ return false;
+ }
+
+ drs_ctx->ldap.rootdse = r->msgs[0];
+
+ return true;
+}
+
+/**
+ * parses binding from command line
+ * and gets target DC name
+ */
+static bool net_drs_parse_binding(struct net_drs_context *drs_ctx, const char *dc_binding)
+{
+ NTSTATUS status;
+
+ status = dcerpc_parse_binding(drs_ctx, dc_binding, &drs_ctx->binding);
+ if (!NT_STATUS_IS_OK(status)) {
+ d_printf("Bad binding supplied %s\n", dc_binding);
+ return false;
+ }
+
+ drs_ctx->binding->transport = NCACN_IP_TCP;
+ drs_ctx->binding->flags |= DCERPC_SIGN | DCERPC_SEAL;
+
+ /* cache target DC name */
+ drs_ctx->dc_name = drs_ctx->binding->target_hostname;
+
+ return true;
+}
+
+/**
+ * Free DRSUAPI connection upon net_drs_context
+ * destruction
+ */
+static int net_drs_context_destructor(struct net_drs_context *drs_ctx)
+{
+ if (drs_ctx->drs_pipe) {
+ net_drs_DsUnbind(drs_ctx);
+ }
+ return 0;
+}
+
+/**
+ * Create net_drs_context context to be used
+ * by 'net drs' sub-commands
+ */
+bool net_drs_create_context(struct net_context *net_ctx,
+ const char *dc_binding,
+ struct net_drs_context **_drs_ctx)
+{
+ struct net_drs_context *drs_ctx;
+
+ drs_ctx = talloc_zero(net_ctx, struct net_drs_context);
+ if (!drs_ctx) {
+ d_printf(__location__ ": No memory");
+ return false;
+ }
+
+ drs_ctx->net_ctx = net_ctx;
+
+ if (!net_drs_parse_binding(drs_ctx, dc_binding)) {
+ goto failed;
+ }
+
+ /* LDAP connect */
+ if (!net_drs_ldap_connect(drs_ctx)) {
+ goto failed;
+ }
+ /* fetch RootDSE */
+ if (!net_drs_ldap_rootdse(drs_ctx)) {
+ goto failed;
+ }
+
+ /* DRSUAPI connection */
+ if (!net_drs_DsBind(drs_ctx)) {
+ goto failed;
+ }
+
+ /* set destructor to free any open connections */
+ talloc_set_destructor(drs_ctx, net_drs_context_destructor);
+
+ *_drs_ctx = drs_ctx;
+ return true;
+
+failed:
+ talloc_free(drs_ctx);
+ return false;
+}
diff --git a/source4/utils/net/drs/net_drs.h b/source4/utils/net/drs/net_drs.h
new file mode 100644
index 0000000000..f5f362077d
--- /dev/null
+++ b/source4/utils/net/drs/net_drs.h
@@ -0,0 +1,56 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ Implements functions offered by repadmin.exe tool under Windows
+
+ Copyright (C) Kamen Mazdrashki <kamen.mazdrashki@postpath.com> 2010
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef NET_DRS_H_
+#define NET_DRS_H_
+
+#include "librpc/gen_ndr/ndr_drsuapi_c.h"
+
+/* net drs commands context */
+struct net_drs_context {
+ struct net_context *net_ctx;
+
+ /* remote DC name supplied from command line */
+ const char *dc_name;
+
+ /* DRSUAPI connection context */
+ struct dcerpc_binding *binding;
+ struct dcerpc_pipe *drs_pipe;
+ struct policy_handle bind_handle;
+
+ /* length of bind info structure returned by remote DC
+ * 'net drs bind' command make use of this value */
+ uint32_t bind_info_len;
+
+ /* remote DC DRSUAPI capabilities */
+ struct drsuapi_DsBindInfo48 info48;
+
+ /* LDAP connection to DC */
+ struct net_drs_ldap {
+ struct ldb_context *ldb;
+ const struct ldb_message *rootdse;
+ } ldap;
+};
+
+
+#include "net_drs_proto.h"
+
+#endif /* NET_DRS_H_ */
diff --git a/source4/utils/net/net.c b/source4/utils/net/net.c
index 3709b0acda..79b6ad8515 100644
--- a/source4/utils/net/net.c
+++ b/source4/utils/net/net.c
@@ -51,6 +51,7 @@
#include "lib/events/events.h"
#include "auth/credentials/credentials.h"
#include "scripting/python/modules.h"
+#include "drs/net_drs.h"
/* There's no Py_ssize_t in 2.4, apparently */
#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5
@@ -204,6 +205,7 @@ static const struct net_functable net_functable[] = {
{"samsync", "synchronise into the local ldb the sam of an NT4 domain\n", net_samsync_ldb, net_samsync_ldb_usage},
{"user", "manage user accounts\n", net_user, net_user_usage},
{"machinepw", "Get a machine password out of our SAM\n", net_machinepw, net_machinepw_usage},
+ {"drs", "Implements functionality offered by repadmin.exe utility in Windows\n", net_drs, net_drs_usage},
{NULL, NULL, NULL, NULL}
};