summaryrefslogtreecommitdiff
path: root/source4
diff options
context:
space:
mode:
Diffstat (limited to 'source4')
-rw-r--r--source4/include/structs.h3
-rw-r--r--source4/libcli/composite/composite.c74
-rw-r--r--source4/winbind/config.mk1
-rw-r--r--source4/winbind/wb_async_helpers.c254
-rw-r--r--source4/winbind/wb_init_domain.c564
-rw-r--r--source4/winbind/wb_samba3_cmd.c4
-rw-r--r--source4/winbind/wb_server.h14
7 files changed, 665 insertions, 249 deletions
diff --git a/source4/include/structs.h b/source4/include/structs.h
index 9cca331696..142d28990e 100644
--- a/source4/include/structs.h
+++ b/source4/include/structs.h
@@ -215,6 +215,8 @@ struct lsa_RightSet;
struct composite_context;
struct monitor_msg;
+struct irpc_request;
+struct rpc_request;
struct smb_composite_loadfile;
struct smb_composite_savefile;
@@ -292,6 +294,7 @@ struct samba3_share_info;
struct samba3;
struct wbsrv_service;
+struct wbsrv_domain;
struct wbsrv_protocol_ops;
struct wbsrv_listen_socket;
struct wbsrv_connection;
diff --git a/source4/libcli/composite/composite.c b/source4/libcli/composite/composite.c
index 4a5247c9ea..6458a971b4 100644
--- a/source4/libcli/composite/composite.c
+++ b/source4/libcli/composite/composite.c
@@ -25,7 +25,7 @@
#include "lib/events/events.h"
#include "libcli/raw/libcliraw.h"
#include "libcli/composite/composite.h"
-
+#include "lib/messaging/irpc.h"
/*
block until a composite function has completed, then return the status
@@ -68,3 +68,75 @@ void composite_trigger_done(struct composite_context *c)
/* a zero timeout means immediate */
event_add_timed(c->event_ctx, c, timeval_zero(), composite_trigger, c);
}
+
+
+/*
+ * Some composite helpers that are handy if you write larger composite
+ * functions.
+ */
+
+BOOL comp_is_ok(struct composite_context *ctx)
+{
+ if (NT_STATUS_IS_OK(ctx->status)) {
+ return True;
+ }
+ ctx->state = COMPOSITE_STATE_ERROR;
+ if (ctx->async.fn != NULL) {
+ ctx->async.fn(ctx);
+ }
+ return False;
+}
+
+void comp_error(struct composite_context *ctx, NTSTATUS status)
+{
+ ctx->status = status;
+ SMB_ASSERT(!comp_is_ok(ctx));
+}
+
+BOOL comp_nomem(const void *p, struct composite_context *ctx)
+{
+ if (p != NULL) {
+ return False;
+ }
+ comp_error(ctx, NT_STATUS_NO_MEMORY);
+ return True;
+}
+
+void comp_done(struct composite_context *ctx)
+{
+ ctx->state = COMPOSITE_STATE_DONE;
+ if (ctx->async.fn != NULL) {
+ ctx->async.fn(ctx);
+ }
+}
+
+void comp_cont(struct composite_context *ctx,
+ struct composite_context *new_ctx,
+ void (*continuation)(struct composite_context *),
+ void *private_data)
+{
+ if (comp_nomem(new_ctx, ctx)) return;
+ new_ctx->async.fn = continuation;
+ new_ctx->async.private_data = private_data;
+}
+
+void rpc_cont(struct composite_context *ctx,
+ struct rpc_request *new_req,
+ void (*continuation)(struct rpc_request *),
+ void *private_data)
+{
+ if (comp_nomem(new_req, ctx)) return;
+ new_req->async.callback = continuation;
+ new_req->async.private = private_data;
+}
+
+void irpc_cont(struct composite_context *ctx,
+ struct irpc_request *new_req,
+ void (*continuation)(struct irpc_request *),
+ void *private_data)
+{
+ if (comp_nomem(new_req, ctx)) return;
+ new_req->async.fn = continuation;
+ new_req->async.private = private_data;
+}
+
diff --git a/source4/winbind/config.mk b/source4/winbind/config.mk
index 3b56eea552..991cce198a 100644
--- a/source4/winbind/config.mk
+++ b/source4/winbind/config.mk
@@ -9,6 +9,7 @@ INIT_OBJ_FILES = \
winbind/wb_server.o \
winbind/wb_samba3_protocol.o \
winbind/wb_samba3_cmd.o \
+ winbind/wb_init_domain.o \
winbind/wb_async_helpers.o
REQUIRED_SUBSYSTEMS = RPC_NDR_LSA
# End MODULE server_service_winbind
diff --git a/source4/winbind/wb_async_helpers.c b/source4/winbind/wb_async_helpers.c
index 73361e2eeb..5a0c70461d 100644
--- a/source4/winbind/wb_async_helpers.c
+++ b/source4/winbind/wb_async_helpers.c
@@ -38,71 +38,6 @@
#include "librpc/gen_ndr/ndr_lsa.h"
#include "libcli/auth/credentials.h"
-static BOOL comp_is_ok(struct composite_context *ctx)
-{
- if (NT_STATUS_IS_OK(ctx->status)) {
- return True;
- }
- ctx->state = COMPOSITE_STATE_ERROR;
- if (ctx->async.fn != NULL) {
- ctx->async.fn(ctx);
- }
- return False;
-}
-
-static void comp_error(struct composite_context *ctx, NTSTATUS status)
-{
- ctx->status = status;
- SMB_ASSERT(!comp_is_ok(ctx));
-}
-
-static BOOL comp_nomem(const void *p, struct composite_context *ctx)
-{
- if (p != NULL) {
- return False;
- }
- comp_error(ctx, NT_STATUS_NO_MEMORY);
- return True;
-}
-
-static void comp_done(struct composite_context *ctx)
-{
- ctx->state = COMPOSITE_STATE_DONE;
- if (ctx->async.fn != NULL) {
- ctx->async.fn(ctx);
- }
-}
-
-static void comp_cont(struct composite_context *ctx,
- struct composite_context *new_ctx,
- void (*continuation)(struct composite_context *),
- void *private_data)
-{
- if (comp_nomem(new_ctx, ctx)) return;
- new_ctx->async.fn = continuation;
- new_ctx->async.private_data = private_data;
-}
-
-static void rpc_cont(struct composite_context *ctx,
- struct rpc_request *new_req,
- void (*continuation)(struct rpc_request *),
- void *private_data)
-{
- if (comp_nomem(new_req, ctx)) return;
- new_req->async.callback = continuation;
- new_req->async.private = private_data;
-}
-
-static void irpc_cont(struct composite_context *ctx,
- struct irpc_request *new_req,
- void (*continuation)(struct irpc_request *),
- void *private_data)
-{
- if (comp_nomem(new_req, ctx)) return;
- new_req->async.fn = continuation;
- new_req->async.private = private_data;
-}
-
struct finddcs_state {
struct composite_context *ctx;
struct messaging_context *msg_ctx;
@@ -1042,8 +977,7 @@ struct cmd_checkmachacc_state {
struct wbsrv_domain *domain;
};
-static void cmd_checkmachacc_recv_lsa(struct composite_context *ctx);
-static void cmd_checkmachacc_recv_creds(struct composite_context *ctx);
+static void cmd_checkmachacc_recv_init(struct composite_context *ctx);
struct composite_context *wb_cmd_checkmachacc_send(struct wbsrv_call *call)
{
@@ -1078,32 +1012,10 @@ struct composite_context *wb_cmd_checkmachacc_send(struct wbsrv_call *call)
schannel_creds);
if (!NT_STATUS_IS_OK(state->ctx->status)) goto failed;
- if (state->domain->netlogon_auth2_pipe != NULL) {
- talloc_free(state->domain->netlogon_auth2_pipe);
- state->domain->netlogon_auth2_pipe = NULL;
- }
-
- if (state->domain->lsa_pipe != NULL) {
- struct smbcli_tree *tree =
- dcerpc_smb_tree(state->domain->lsa_pipe->conn);
-
- if (tree == NULL) goto failed;
-
- ctx = wb_get_schannel_creds_send(state->domain->schannel_creds,
- tree, result->event_ctx);
- if (ctx == NULL) goto failed;
-
- ctx->async.fn = cmd_checkmachacc_recv_creds;
- ctx->async.private_data = state;
- return result;
- }
-
- ctx = wb_get_lsa_pipe_send(result->event_ctx,
- call->wbconn->conn->msg_ctx,
- state->domain->name,
- state->domain->sid);
+ ctx = wb_init_domain_send(state->domain, result->event_ctx,
+ call->wbconn->conn->msg_ctx);
if (ctx == NULL) goto failed;
- ctx->async.fn = cmd_checkmachacc_recv_lsa;
+ ctx->async.fn = cmd_checkmachacc_recv_init;
ctx->async.private_data = state;
return result;
@@ -1113,63 +1025,23 @@ struct composite_context *wb_cmd_checkmachacc_send(struct wbsrv_call *call)
return NULL;
}
-static void cmd_checkmachacc_recv_lsa(struct composite_context *ctx)
+static void cmd_checkmachacc_recv_init(struct composite_context *ctx)
{
struct cmd_checkmachacc_state *state =
talloc_get_type(ctx->async.private_data,
struct cmd_checkmachacc_state);
- struct wbsrv_service *service =
- state->call->wbconn->listen_socket->service;
-
- struct dcerpc_pipe *pipe;
- struct smbcli_tree *tree;
- state->ctx->status = wb_get_lsa_pipe_recv(ctx, state, &pipe);
+ state->ctx->status = wb_init_domain_recv(ctx);
if (!comp_is_ok(state->ctx)) return;
- if (state->domain->lsa_pipe == NULL) {
- /* We gonna drop "our" pipe if someone else was faster */
- state->domain->lsa_pipe = talloc_steal(service, pipe);
- }
-
- tree = dcerpc_smb_tree(state->domain->lsa_pipe->conn);
-
- if (tree == NULL) {
- comp_error(state->ctx, NT_STATUS_INVALID_PARAMETER);
- return;
- }
-
- ctx = wb_get_schannel_creds_send(state->domain->schannel_creds, tree,
- state->ctx->event_ctx);
- comp_cont(state->ctx, ctx, cmd_checkmachacc_recv_creds, state);
-}
-
-static void cmd_checkmachacc_recv_creds(struct composite_context *ctx)
-{
- struct cmd_checkmachacc_state *state =
- talloc_get_type(ctx->async.private_data,
- struct cmd_checkmachacc_state);
- struct wbsrv_service *service =
- state->call->wbconn->listen_socket->service;
- struct dcerpc_pipe *pipe;
-
- state->ctx->status = wb_get_schannel_creds_recv(ctx, state, &pipe);
- if (!comp_is_ok(state->ctx)) return;
-
- if (state->domain->netlogon_auth2_pipe != NULL) {
- /* Someone else was faster, we need to replace it with our
- * pipe */
- talloc_free(state->domain->netlogon_auth2_pipe);
- }
-
- state->domain->netlogon_auth2_pipe = talloc_steal(service, pipe);
-
comp_done(state->ctx);
}
NTSTATUS wb_cmd_checkmachacc_recv(struct composite_context *c)
{
- return composite_wait(c);
+ NTSTATUS status = composite_wait(c);
+ talloc_free(c);
+ return status;
}
NTSTATUS wb_cmd_checkmachacc(struct wbsrv_call *call)
@@ -1177,111 +1049,3 @@ NTSTATUS wb_cmd_checkmachacc(struct wbsrv_call *call)
struct composite_context *c = wb_cmd_checkmachacc_send(call);
return wb_cmd_checkmachacc_recv(c);
}
-
-struct get_netlogon_pipe_state {
- struct composite_context *ctx;
- struct wbsrv_call *call;
- struct wbsrv_domain *domain;
- struct dcerpc_pipe *p;
-};
-
-static void get_netlogon_pipe_recv_machacc(struct composite_context *ctx);
-static void get_netlogon_pipe_recv_pipe(struct composite_context *ctx);
-
-struct composite_context *wb_get_netlogon_pipe_send(struct wbsrv_call *call)
-{
- struct composite_context *result, *ctx;
- struct get_netlogon_pipe_state *state;
- struct wbsrv_service *service = call->wbconn->listen_socket->service;
-
- result = talloc(call, struct composite_context);
- if (result == NULL) goto failed;
- result->state = COMPOSITE_STATE_IN_PROGRESS;
- result->event_ctx = call->event_ctx;
-
- state = talloc(result, struct get_netlogon_pipe_state);
- if (state == NULL) goto failed;
- state->ctx = result;
- result->private_data = state;
- state->call = call;
-
- state->domain = service->domains;
-
- if (state->domain->netlogon_pipe != NULL) {
- talloc_free(state->domain->netlogon_pipe);
- state->domain->netlogon_pipe = NULL;
- }
-
- ctx = wb_cmd_checkmachacc_send(call);
- if (ctx == NULL) goto failed;
- ctx->async.fn = get_netlogon_pipe_recv_machacc;
- ctx->async.private_data = state;
- return result;
-
- failed:
- talloc_free(result);
- return NULL;
-}
-
-static void get_netlogon_pipe_recv_machacc(struct composite_context *ctx)
-{
- struct get_netlogon_pipe_state *state =
- talloc_get_type(ctx->async.private_data,
- struct get_netlogon_pipe_state);
-
- struct smbcli_tree *tree = NULL;
-
- state->ctx->status = wb_cmd_checkmachacc_recv(ctx);
- if (!comp_is_ok(state->ctx)) return;
-
- state->p = dcerpc_pipe_init(state, state->ctx->event_ctx);
- if (comp_nomem(state->p, state->ctx)) return;
-
- if (state->domain->lsa_pipe != NULL) {
- tree = dcerpc_smb_tree(state->domain->lsa_pipe->conn);
- }
-
- if (tree == NULL) {
- comp_error(state->ctx, NT_STATUS_INTERNAL_ERROR);
- return;
- }
-
- ctx = dcerpc_pipe_open_smb_send(state->p->conn, tree, "\\netlogon");
- comp_cont(state->ctx, ctx, get_netlogon_pipe_recv_pipe, state);
-}
-
-static void get_netlogon_pipe_recv_pipe(struct composite_context *ctx)
-{
- struct get_netlogon_pipe_state *state =
- talloc_get_type(ctx->async.private_data,
- struct get_netlogon_pipe_state);
- struct wbsrv_service *service =
- state->call->wbconn->listen_socket->service;
-
- state->ctx->status = dcerpc_pipe_open_smb_recv(ctx);
- if (!comp_is_ok(state->ctx)) return;
-
- state->p->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
- state->ctx->status =
- dcerpc_bind_auth_password(state->p,
- DCERPC_NETLOGON_UUID,
- DCERPC_NETLOGON_VERSION,
- state->domain->schannel_creds,
- DCERPC_AUTH_TYPE_SCHANNEL,
- NULL);
- if (!comp_is_ok(state->ctx)) return;
-
- state->domain->netlogon_pipe = talloc_steal(service, state->p);
- comp_done(state->ctx);
-}
-
-NTSTATUS wb_get_netlogon_pipe_recv(struct composite_context *c)
-{
- return composite_wait(c);
-}
-
-NTSTATUS wb_get_netlogon_pipe(struct wbsrv_call *call)
-{
- struct composite_context *c = wb_get_netlogon_pipe_send(call);
- return wb_get_netlogon_pipe_recv(c);
-}
diff --git a/source4/winbind/wb_init_domain.c b/source4/winbind/wb_init_domain.c
new file mode 100644
index 0000000000..93794f3ca3
--- /dev/null
+++ b/source4/winbind/wb_init_domain.c
@@ -0,0 +1,564 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ Copyright (C) Volker Lendecke 2005
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+/*
+ a composite API for initializing a domain
+*/
+
+#include "includes.h"
+#include "libcli/composite/composite.h"
+#include "libcli/smb_composite/smb_composite.h"
+#include "winbind/wb_async_helpers.h"
+#include "winbind/wb_server.h"
+#include "smbd/service_stream.h"
+
+#include "librpc/gen_ndr/nbt.h"
+#include "librpc/gen_ndr/samr.h"
+#include "lib/messaging/irpc.h"
+#include "librpc/gen_ndr/irpc.h"
+#include "librpc/gen_ndr/ndr_irpc.h"
+#include "libcli/raw/libcliraw.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/gen_ndr/ndr_lsa.h"
+#include "libcli/auth/credentials.h"
+
+
+/* Helper to initialize LSA with different auth methods and opening the lsa
+ * policy */
+
+struct init_lsa_state {
+ struct composite_context *ctx;
+ struct dcerpc_pipe *lsa_pipe;
+
+ uint8_t auth_type;
+ struct cli_credentials *creds;
+
+ struct lsa_ObjectAttribute objectattr;
+ struct lsa_OpenPolicy2 openpolicy;
+ struct policy_handle *handle;
+};
+
+static void init_lsa_recv_pipe(struct composite_context *ctx);
+static void init_lsa_recv_openpol(struct rpc_request *req);
+
+static struct composite_context *wb_init_lsa_send(struct smbcli_tree *tree,
+ uint8_t auth_type,
+ struct cli_credentials *creds)
+{
+ struct composite_context *result, *ctx;
+ struct init_lsa_state *state;
+
+ result = talloc(NULL, struct composite_context);
+ if (result == NULL) goto failed;
+ result->state = COMPOSITE_STATE_IN_PROGRESS;
+ result->event_ctx = tree->session->transport->socket->event.ctx;
+
+ state = talloc(result, struct init_lsa_state);
+ if (state == NULL) goto failed;
+ state->ctx = result;
+ result->private_data = state;
+
+ state->auth_type = auth_type;
+ state->creds = creds;
+
+ state->lsa_pipe = dcerpc_pipe_init(state, result->event_ctx);
+ if (state->lsa_pipe == NULL) goto failed;
+
+ ctx = dcerpc_pipe_open_smb_send(state->lsa_pipe->conn, tree,
+ "\\lsarpc");
+ ctx->async.fn = init_lsa_recv_pipe;
+ ctx->async.private_data = state;
+ return result;
+
+ failed:
+ talloc_free(result);
+ return NULL;
+}
+
+static void init_lsa_recv_pipe(struct composite_context *ctx)
+{
+ struct init_lsa_state *state =
+ talloc_get_type(ctx->async.private_data,
+ struct init_lsa_state);
+ struct rpc_request *req;
+
+ state->ctx->status = dcerpc_pipe_open_smb_recv(ctx);
+ if (!comp_is_ok(state->ctx)) return;
+
+ switch (state->auth_type) {
+ case DCERPC_AUTH_TYPE_NONE:
+ state->ctx->status =
+ dcerpc_bind_auth_none(state->lsa_pipe,
+ DCERPC_LSARPC_UUID,
+ DCERPC_LSARPC_VERSION);
+ break;
+ case DCERPC_AUTH_TYPE_NTLMSSP:
+ case DCERPC_AUTH_TYPE_SCHANNEL:
+ if (state->creds == NULL) {
+ comp_error(state->ctx, NT_STATUS_INTERNAL_ERROR);
+ return;
+ }
+ state->lsa_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
+ state->ctx->status =
+ dcerpc_bind_auth_password(state->lsa_pipe,
+ DCERPC_LSARPC_UUID,
+ DCERPC_LSARPC_VERSION,
+ state->creds,
+ state->auth_type,
+ NULL);
+ break;
+ default:
+ state->ctx->status = NT_STATUS_INTERNAL_ERROR;
+
+ }
+
+ state->handle = talloc(state, struct policy_handle);
+ if (comp_nomem(state->handle, state->ctx)) return;
+
+ state->openpolicy.in.system_name =
+ talloc_asprintf(state, "\\\\%s",
+ dcerpc_server_name(state->lsa_pipe));
+ ZERO_STRUCT(state->objectattr);
+ state->openpolicy.in.attr = &state->objectattr;
+ state->openpolicy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
+ state->openpolicy.out.handle = state->handle;
+
+ req = dcerpc_lsa_OpenPolicy2_send(state->lsa_pipe, state,
+ &state->openpolicy);
+ rpc_cont(state->ctx, req, init_lsa_recv_openpol, state);
+}
+
+static void init_lsa_recv_openpol(struct rpc_request *req)
+{
+ struct init_lsa_state *state =
+ talloc_get_type(req->async.private,
+ struct init_lsa_state);
+
+ state->ctx->status = dcerpc_ndr_request_recv(req);
+ if (!comp_is_ok(state->ctx)) return;
+ state->ctx->status = state->openpolicy.out.result;
+ if (!comp_is_ok(state->ctx)) return;
+
+ comp_done(state->ctx);
+}
+
+static NTSTATUS wb_init_lsa_recv(struct composite_context *c,
+ TALLOC_CTX *mem_ctx,
+ struct dcerpc_pipe **lsa_pipe,
+ struct policy_handle **lsa_policy)
+{
+ NTSTATUS status = composite_wait(c);
+ if (NT_STATUS_IS_OK(status)) {
+ struct init_lsa_state *state =
+ talloc_get_type(c->private_data,
+ struct init_lsa_state);
+ *lsa_pipe = talloc_steal(mem_ctx, state->lsa_pipe);
+ *lsa_policy = talloc_steal(mem_ctx, state->handle);
+ }
+ talloc_free(c);
+ return status;
+}
+
+/*
+ * Initialize a domain:
+ *
+ * - With schannel credentials, try to open the SMB connection with the machine
+ * creds. Fall back to anonymous.
+ *
+ * - If we have schannel creds, do the auth2 and open the schannel'ed netlogon
+ * pipe.
+ *
+ * - Open LSA. If we have machine creds, try to open with ntlmssp. Fall back
+ * to schannel and then to anon bind.
+ *
+ * - With queryinfopolicy, verify that we're talking to the right domain
+ *
+ * A bit complex, but with all the combinations I think it's the best we can
+ * get. NT4, W2k3 and W2k all have different combinations, but in the end we
+ * have a signed&sealed lsa connection on all of them.
+ *
+ * Not sure if it is overkill, but it seems to work.
+ */
+
+struct init_domain_state {
+ struct composite_context *ctx;
+ struct wbsrv_domain *domain;
+
+ int num_dcs;
+ struct nbt_dc_name *dcs;
+
+ struct smb_composite_connect conn;
+
+ struct dcerpc_pipe *auth2_pipe;
+ struct dcerpc_pipe *netlogon_pipe;
+
+ struct dcerpc_pipe *lsa_pipe;
+ struct policy_handle *lsa_policy;
+
+ struct lsa_QueryInfoPolicy queryinfo;
+};
+
+static void init_domain_recv_dcs(struct composite_context *ctx);
+static void init_domain_recv_authsmb(struct composite_context *ctx);
+static void init_domain_anonsmb(struct init_domain_state *state);
+static void init_domain_recv_anonsmb(struct composite_context *ctx);
+static void init_domain_openpipes(struct init_domain_state *state);
+static void init_domain_openlsa(struct init_domain_state *state);
+static void init_domain_recv_netlogoncreds(struct composite_context *ctx);
+static void init_domain_recv_netlogonpipe(struct composite_context *ctx);
+static void init_domain_recv_lsa_ntlmssp(struct composite_context *ctx);
+static void init_domain_recv_lsa_schannel(struct composite_context *ctx);
+static void init_domain_recv_lsa_none(struct composite_context *ctx);
+static void init_domain_check_lsa(struct init_domain_state *state);
+static void init_domain_recv_queryinfo(struct rpc_request *req);
+
+struct composite_context *wb_init_domain_send(struct wbsrv_domain *domain,
+ struct event_context *event_ctx,
+ struct messaging_context *msg_ctx)
+{
+ struct composite_context *result, *ctx;
+ struct init_domain_state *state;
+
+ result = talloc(domain, struct composite_context);
+ if (result == NULL) goto failed;
+ result->state = COMPOSITE_STATE_IN_PROGRESS;
+ result->async.fn = NULL;
+ result->event_ctx = event_ctx;
+
+ state = talloc_zero(result, struct init_domain_state);
+ if (state == NULL) goto failed;
+ state->ctx = result;
+ result->private_data = state;
+
+ state->domain = domain;
+
+ ctx = wb_finddcs_send(domain->name, domain->sid, event_ctx, msg_ctx);
+ if (ctx == NULL) goto failed;
+
+ ctx->async.fn = init_domain_recv_dcs;
+ ctx->async.private_data = state;
+ return result;
+
+ failed:
+ talloc_free(result);
+ return NULL;
+}
+
+static void init_domain_recv_dcs(struct composite_context *ctx)
+{
+ struct init_domain_state *state =
+ talloc_get_type(ctx->async.private_data,
+ struct init_domain_state);
+
+ state->ctx->status = wb_finddcs_recv(ctx, state, &state->num_dcs,
+ &state->dcs);
+ if (!comp_is_ok(state->ctx)) return;
+
+ if (state->num_dcs < 1) {
+ comp_error(state->ctx, NT_STATUS_NO_LOGON_SERVERS);
+ return;
+ }
+
+ state->conn.in.dest_host = state->dcs[0].address;
+ state->conn.in.port = 0;
+ state->conn.in.called_name = state->dcs[0].name;
+ state->conn.in.service = "IPC$";
+ state->conn.in.service_type = "IPC";
+ state->conn.in.workgroup = state->domain->name;
+
+ if (state->domain->schannel_creds != NULL) {
+ /* Try to connect as workstation */
+ state->conn.in.credentials = state->domain->schannel_creds;
+ ctx = smb_composite_connect_send(&state->conn, state,
+ state->ctx->event_ctx);
+ comp_cont(state->ctx, ctx, init_domain_recv_authsmb, state);
+ return;
+ }
+
+ init_domain_anonsmb(state);
+}
+
+static void init_domain_recv_authsmb(struct composite_context *ctx)
+{
+ struct init_domain_state *state =
+ talloc_get_type(ctx->async.private_data,
+ struct init_domain_state);
+
+ state->ctx->status = smb_composite_connect_recv(ctx, state);
+ if (NT_STATUS_IS_OK(state->ctx->status)) {
+ init_domain_openpipes(state);
+ return;
+ }
+
+ init_domain_anonsmb(state);
+}
+
+static void init_domain_anonsmb(struct init_domain_state *state)
+{
+ struct composite_context *ctx;
+
+ state->conn.in.credentials = cli_credentials_init(state);
+ if (comp_nomem(state->conn.in.credentials, state->ctx)) return;
+ cli_credentials_set_conf(state->conn.in.credentials);
+ cli_credentials_set_anonymous(state->conn.in.credentials);
+ ctx = smb_composite_connect_send(&state->conn, state,
+ state->ctx->event_ctx);
+ comp_cont(state->ctx, ctx, init_domain_recv_anonsmb, state);
+}
+
+static void init_domain_recv_anonsmb(struct composite_context *ctx)
+{
+ struct init_domain_state *state =
+ talloc_get_type(ctx->async.private_data,
+ struct init_domain_state);
+
+ state->ctx->status = smb_composite_connect_recv(ctx, state);
+ if (!comp_is_ok(state->ctx)) return;
+
+ init_domain_openpipes(state);
+}
+
+static void init_domain_openpipes(struct init_domain_state *state)
+{
+ struct composite_context *ctx;
+
+ if (state->domain->schannel_creds == NULL) {
+ /* No chance to open netlogon */
+ init_domain_openlsa(state);
+ return;
+ }
+
+ ctx = wb_get_schannel_creds_send(state->domain->schannel_creds,
+ state->conn.out.tree,
+ state->ctx->event_ctx);
+ comp_cont(state->ctx, ctx, init_domain_recv_netlogoncreds, state);
+}
+
+static void init_domain_recv_netlogoncreds(struct composite_context *ctx)
+{
+ struct init_domain_state *state =
+ talloc_get_type(ctx->async.private_data,
+ struct init_domain_state);
+ struct smbcli_tree *tree = NULL;
+
+ state->ctx->status = wb_get_schannel_creds_recv(ctx, state,
+ &state->auth2_pipe);
+ if (!comp_is_ok(state->ctx)) return;
+
+ talloc_unlink(state, state->conn.out.tree); /* The pipe owns it now */
+
+ state->netlogon_pipe = dcerpc_pipe_init(state, state->ctx->event_ctx);
+ if (comp_nomem(state->netlogon_pipe, state->ctx)) return;
+
+ if (state->auth2_pipe != NULL) {
+ tree = dcerpc_smb_tree(state->auth2_pipe->conn);
+ }
+
+ if (tree == NULL) {
+ comp_error(state->ctx, NT_STATUS_INTERNAL_ERROR);
+ return;
+ }
+
+ ctx = dcerpc_pipe_open_smb_send(state->netlogon_pipe->conn, tree,
+ "\\netlogon");
+ comp_cont(state->ctx, ctx, init_domain_recv_netlogonpipe, state);
+}
+
+static void init_domain_recv_netlogonpipe(struct composite_context *ctx)
+{
+ struct init_domain_state *state =
+ talloc_get_type(ctx->async.private_data,
+ struct init_domain_state);
+
+ state->ctx->status = dcerpc_pipe_open_smb_recv(ctx);
+ if (!comp_is_ok(state->ctx)) return;
+
+ state->netlogon_pipe->conn->flags |= (DCERPC_SIGN | DCERPC_SEAL);
+ state->ctx->status =
+ dcerpc_bind_auth_password(state->netlogon_pipe,
+ DCERPC_NETLOGON_UUID,
+ DCERPC_NETLOGON_VERSION,
+ state->domain->schannel_creds,
+ DCERPC_AUTH_TYPE_SCHANNEL,
+ NULL);
+ if (!comp_is_ok(state->ctx)) return;
+
+ init_domain_openlsa(state);
+}
+
+static void init_domain_openlsa(struct init_domain_state *state)
+{
+ struct composite_context *ctx;
+
+ if (state->domain->schannel_creds != NULL) {
+ ctx = wb_init_lsa_send(state->conn.out.tree,
+ DCERPC_AUTH_TYPE_NTLMSSP,
+ state->domain->schannel_creds);
+ comp_cont(state->ctx, ctx,
+ init_domain_recv_lsa_ntlmssp, state);
+ return;
+ }
+
+ ctx = wb_init_lsa_send(state->conn.out.tree, DCERPC_AUTH_TYPE_NONE,
+ NULL);
+ comp_cont(state->ctx, ctx, init_domain_recv_lsa_none, state);
+}
+
+static void init_domain_recv_lsa_ntlmssp(struct composite_context *ctx)
+{
+ struct init_domain_state *state =
+ talloc_get_type(ctx->async.private_data,
+ struct init_domain_state);
+
+ state->ctx->status = wb_init_lsa_recv(ctx, state, &state->lsa_pipe,
+ &state->lsa_policy);
+ if (NT_STATUS_IS_OK(state->ctx->status)) {
+ init_domain_check_lsa(state);
+ return;
+ }
+
+ ctx = wb_init_lsa_send(state->conn.out.tree,
+ DCERPC_AUTH_TYPE_SCHANNEL,
+ state->domain->schannel_creds);
+ comp_cont(state->ctx, ctx, init_domain_recv_lsa_schannel, state);
+}
+
+static void init_domain_recv_lsa_schannel(struct composite_context *ctx)
+{
+ struct init_domain_state *state =
+ talloc_get_type(ctx->async.private_data,
+ struct init_domain_state);
+
+ state->ctx->status = wb_init_lsa_recv(ctx, state, &state->lsa_pipe,
+ &state->lsa_policy);
+ if (NT_STATUS_IS_OK(state->ctx->status)) {
+ init_domain_check_lsa(state);
+ return;
+ }
+
+ ctx = wb_init_lsa_send(state->conn.out.tree,
+ DCERPC_AUTH_TYPE_NONE, NULL);
+ comp_cont(state->ctx, ctx, init_domain_recv_lsa_none, state);
+}
+
+static void init_domain_recv_lsa_none(struct composite_context *ctx)
+{
+ struct init_domain_state *state =
+ talloc_get_type(ctx->async.private_data,
+ struct init_domain_state);
+
+ state->ctx->status = wb_init_lsa_recv(ctx, state, &state->lsa_pipe,
+ &state->lsa_policy);
+ if (!comp_is_ok(state->ctx)) return;
+
+ init_domain_check_lsa(state);
+}
+
+static void init_domain_check_lsa(struct init_domain_state *state)
+{
+ struct rpc_request *req;
+
+ if (state->auth2_pipe == NULL) {
+ /* Give the tree to the LSA pipe, otherwise it has been given
+ * to the auth2 pipe already */
+ talloc_unlink(state, state->conn.out.tree);
+ state->conn.out.tree = NULL;
+ }
+
+ state->queryinfo.in.handle = state->lsa_policy;
+ state->queryinfo.in.level = LSA_POLICY_INFO_ACCOUNT_DOMAIN;
+
+ req = dcerpc_lsa_QueryInfoPolicy_send(state->lsa_pipe, state,
+ &state->queryinfo);
+ rpc_cont(state->ctx, req, init_domain_recv_queryinfo, state);
+}
+
+static void init_domain_recv_queryinfo(struct rpc_request *req)
+{
+ struct init_domain_state *state =
+ talloc_get_type(req->async.private, struct init_domain_state);
+ struct lsa_DomainInfo *dominfo;
+
+ state->ctx->status = dcerpc_ndr_request_recv(req);
+ if (!comp_is_ok(state->ctx)) return;
+ state->ctx->status = state->queryinfo.out.result;
+ if (!comp_is_ok(state->ctx)) return;
+
+ dominfo = &state->queryinfo.out.info->account_domain;
+
+ if (strcasecmp(state->domain->name, dominfo->name.string) != 0) {
+ DEBUG(2, ("Expected domain name %s, DC %s said %s\n",
+ state->domain->name,
+ dcerpc_server_name(state->lsa_pipe),
+ dominfo->name.string));
+ comp_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
+ return;
+ }
+
+ if (!dom_sid_equal(state->domain->sid, dominfo->sid)) {
+ DEBUG(2, ("Expected domain sid %s, DC %s said %s\n",
+ dom_sid_string(state, state->domain->sid),
+ dcerpc_server_name(state->lsa_pipe),
+ dom_sid_string(state, dominfo->sid)));
+ comp_error(state->ctx, NT_STATUS_INVALID_DOMAIN_STATE);
+ return;
+ }
+
+ comp_done(state->ctx);
+}
+
+NTSTATUS wb_init_domain_recv(struct composite_context *c)
+{
+ NTSTATUS status = composite_wait(c);
+ if (NT_STATUS_IS_OK(status)) {
+ struct init_domain_state *state =
+ talloc_get_type(c->private_data,
+ struct init_domain_state);
+ struct wbsrv_domain *domain = state->domain;
+
+ talloc_free(domain->netlogon_auth2_pipe);
+ domain->netlogon_auth2_pipe =
+ talloc_steal(domain, state->auth2_pipe);
+
+ talloc_free(domain->netlogon_pipe);
+ domain->netlogon_pipe =
+ talloc_steal(domain, state->netlogon_pipe);
+
+ talloc_free(domain->lsa_pipe);
+ domain->lsa_pipe =
+ talloc_steal(domain, state->lsa_pipe);
+
+ talloc_free(domain->lsa_policy);
+ domain->lsa_policy =
+ talloc_steal(domain, state->lsa_policy);
+
+ domain->initialized = True;
+ }
+ talloc_free(c);
+ return status;
+}
+
+NTSTATUS wb_init_domain(struct wbsrv_domain *domain,
+ struct event_context *event_ctx,
+ struct messaging_context *messaging_ctx)
+{
+ struct composite_context *c =
+ wb_init_domain_send(domain, event_ctx, messaging_ctx);
+ return wb_init_domain_recv(c);
+}
diff --git a/source4/winbind/wb_samba3_cmd.c b/source4/winbind/wb_samba3_cmd.c
index 56ae4365a6..64d75016bb 100644
--- a/source4/winbind/wb_samba3_cmd.c
+++ b/source4/winbind/wb_samba3_cmd.c
@@ -87,7 +87,7 @@ NTSTATUS wbsrv_samba3_check_machacc(struct wbsrv_samba3_call *s3call)
DEBUG(5, ("wbsrv_samba3_check_machacc called\n"));
- ctx = wb_get_netlogon_pipe_send(s3call->call);
+ ctx = wb_cmd_checkmachacc_send(s3call->call);
NT_STATUS_HAVE_NO_MEMORY(ctx);
ctx->async.fn = checkmachacc_recv_creds;
@@ -103,7 +103,7 @@ static void checkmachacc_recv_creds(struct composite_context *ctx)
struct wbsrv_samba3_call);
NTSTATUS status;
- status = wb_get_netlogon_pipe_recv(ctx);
+ status = wb_cmd_checkmachacc_recv(ctx);
if (NT_STATUS_IS_OK(status)) {
s3call->response.result = WINBINDD_OK;
} else {
diff --git a/source4/winbind/wb_server.h b/source4/winbind/wb_server.h
index 7ad43dccf5..df871f4c25 100644
--- a/source4/winbind/wb_server.h
+++ b/source4/winbind/wb_server.h
@@ -36,16 +36,28 @@ struct wbsrv_service {
struct wbsrv_domain *domains;
};
+struct wbsrv_samconn {
+ struct wbsrv_domain *domain;
+ void *private_data;
+
+ struct composite_context (*seqnum_send)(struct wbsrv_samconn *);
+ NTSTATUS (*seqnum_recv)(struct composite_context *, uint64_t *);
+};
+
struct wbsrv_domain {
struct wbsrv_domain *next, *prev;
+ BOOL initialized;
+
const char *name;
const struct dom_sid *sid;
struct dcerpc_pipe *lsa_pipe;
+ struct policy_handle *lsa_policy;
+
struct dcerpc_pipe *netlogon_auth2_pipe;
- struct cli_credentials *schannel_creds;
struct dcerpc_pipe *netlogon_pipe;
+ struct cli_credentials *schannel_creds;
};
/*