/* Unix SMB/CIFS implementation. dsgetdcname Copyright (C) Gerald Carter 2006 Copyright (C) Guenther Deschner 2007-2008 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "includes.h" #define DSGETDCNAME_FMT "DSGETDCNAME/DOMAIN/%s" /* 15 minutes */ #define DSGETDCNAME_CACHE_TTL 60*15 struct ip_service_name { struct sockaddr_storage ss; unsigned port; const char *hostname; }; /**************************************************************** ****************************************************************/ void debug_dsdcinfo_flags(int lvl, uint32_t flags) { DEBUG(lvl,("debug_dsdcinfo_flags: 0x%08x\n\t", flags)); if (flags & DS_FORCE_REDISCOVERY) DEBUGADD(lvl,("DS_FORCE_REDISCOVERY ")); if (flags & 0x000000002) DEBUGADD(lvl,("0x00000002 ")); if (flags & 0x000000004) DEBUGADD(lvl,("0x00000004 ")); if (flags & 0x000000008) DEBUGADD(lvl,("0x00000008 ")); if (flags & DS_DIRECTORY_SERVICE_REQUIRED) DEBUGADD(lvl,("DS_DIRECTORY_SERVICE_REQUIRED ")); if (flags & DS_DIRECTORY_SERVICE_PREFERRED) DEBUGADD(lvl,("DS_DIRECTORY_SERVICE_PREFERRED ")); if (flags & DS_GC_SERVER_REQUIRED) DEBUGADD(lvl,("DS_GC_SERVER_REQUIRED ")); if (flags & DS_PDC_REQUIRED) DEBUGADD(lvl,("DS_PDC_REQUIRED ")); if (flags & DS_BACKGROUND_ONLY) DEBUGADD(lvl,("DS_BACKGROUND_ONLY ")); if (flags & DS_IP_REQUIRED) DEBUGADD(lvl,("DS_IP_REQUIRED ")); if (flags & DS_KDC_REQUIRED) DEBUGADD(lvl,("DS_KDC_REQUIRED ")); if (flags & DS_TIMESERV_REQUIRED) DEBUGADD(lvl,("DS_TIMESERV_REQUIRED ")); if (flags & DS_WRITABLE_REQUIRED) DEBUGADD(lvl,("DS_WRITABLE_REQUIRED ")); if (flags & DS_GOOD_TIMESERV_PREFERRED) DEBUGADD(lvl,("DS_GOOD_TIMESERV_PREFERRED ")); if (flags & DS_AVOID_SELF) DEBUGADD(lvl,("DS_AVOID_SELF ")); if (flags & DS_ONLY_LDAP_NEEDED) DEBUGADD(lvl,("DS_ONLY_LDAP_NEEDED ")); if (flags & DS_IS_FLAT_NAME) DEBUGADD(lvl,("DS_IS_FLAT_NAME ")); if (flags & DS_IS_DNS_NAME) DEBUGADD(lvl,("DS_IS_DNS_NAME ")); if (flags & 0x00040000) DEBUGADD(lvl,("0x00040000 ")); if (flags & 0x00080000) DEBUGADD(lvl,("0x00080000 ")); if (flags & 0x00100000) DEBUGADD(lvl,("0x00100000 ")); if (flags & 0x00200000) DEBUGADD(lvl,("0x00200000 ")); if (flags & 0x00400000) DEBUGADD(lvl,("0x00400000 ")); if (flags & 0x00800000) DEBUGADD(lvl,("0x00800000 ")); if (flags & 0x01000000) DEBUGADD(lvl,("0x01000000 ")); if (flags & 0x02000000) DEBUGADD(lvl,("0x02000000 ")); if (flags & 0x04000000) DEBUGADD(lvl,("0x04000000 ")); if (flags & 0x08000000) DEBUGADD(lvl,("0x08000000 ")); if (flags & 0x10000000) DEBUGADD(lvl,("0x10000000 ")); if (flags & 0x20000000) DEBUGADD(lvl,("0x20000000 ")); if (flags & DS_RETURN_DNS_NAME) DEBUGADD(lvl,("DS_RETURN_DNS_NAME ")); if (flags & DS_RETURN_FLAT_NAME) DEBUGADD(lvl,("DS_RETURN_FLAT_NAME ")); if (flags) DEBUGADD(lvl,("\n")); } /**************************************************************** ****************************************************************/ static char *dsgetdcname_cache_key(TALLOC_CTX *mem_ctx, const char *domain) { if (!mem_ctx || !domain) { return NULL; } return talloc_asprintf_strupper_m(mem_ctx, DSGETDCNAME_FMT, domain); } /**************************************************************** ****************************************************************/ static NTSTATUS dsgetdcname_cache_delete(TALLOC_CTX *mem_ctx, const char *domain_name) { char *key; if (!gencache_init()) { return NT_STATUS_INTERNAL_DB_ERROR; } key = dsgetdcname_cache_key(mem_ctx, domain_name); if (!key) { return NT_STATUS_NO_MEMORY; } if (!gencache_del(key)) { return NT_STATUS_UNSUCCESSFUL; } return NT_STATUS_OK; } /**************************************************************** ****************************************************************/ static NTSTATUS dsgetdcname_cache_store(TALLOC_CTX *mem_ctx, const char *domain_name, struct netr_DsRGetDCNameInfo *info) { time_t expire_time; char *key; bool ret = false; DATA_BLOB blob; enum ndr_err_code ndr_err; if (!gencache_init()) { return NT_STATUS_INTERNAL_DB_ERROR; } key = dsgetdcname_cache_key(mem_ctx, domain_name); if (!key) { return NT_STATUS_NO_MEMORY; } expire_time = time(NULL) + DSGETDCNAME_CACHE_TTL; ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info, (ndr_push_flags_fn_t)ndr_push_netr_DsRGetDCNameInfo); if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { return ndr_map_error2ntstatus(ndr_err); } if (gencache_lock_entry(key) != 0) { data_blob_free(&blob); return NT_STATUS_LOCK_NOT_GRANTED; } ret = gencache_set_data_blob(key, &blob, expire_time); data_blob_free(&blob); gencache_unlock_entry(key); return ret ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL; } /**************************************************************** ****************************************************************/ static NTSTATUS dsgetdcname_cache_refresh(TALLOC_CTX *mem_ctx, const char *domain_name, struct GUID *domain_guid, uint32_t flags, const char *site_name, struct netr_DsRGetDCNameInfo *info) { struct cldap_netlogon_reply r; /* check if matching entry is older then 15 minutes, if yes, send * CLDAP/MAILSLOT ping again and store the cached data */ ZERO_STRUCT(r); if (ads_cldap_netlogon(info->dc_unc, info->domain_name, &r)) { dsgetdcname_cache_delete(mem_ctx, domain_name); return dsgetdcname_cache_store(mem_ctx, info->domain_name, info); } return NT_STATUS_INVALID_NETWORK_RESPONSE; } /**************************************************************** ****************************************************************/ #define RETURN_ON_FALSE(x) if (!x) return false; static bool check_cldap_reply_required_flags(uint32_t ret_flags, uint32_t req_flags) { if (req_flags & DS_PDC_REQUIRED) RETURN_ON_FALSE(ret_flags & ADS_PDC); if (req_flags & DS_GC_SERVER_REQUIRED) RETURN_ON_FALSE(ret_flags & ADS_GC); if (req_flags & DS_ONLY_LDAP_NEEDED) RETURN_ON_FALSE(ret_flags & ADS_LDAP); if ((req_flags & DS_DIRECTORY_SERVICE_REQUIRED) || (req_flags & DS_DIRECTORY_SERVICE_PREFERRED)) RETURN_ON_FALSE(ret_flags & ADS_DS); if (req_flags & DS_KDC_REQUIRED) RETURN_ON_FALSE(ret_flags & ADS_KDC); if (req_flags & DS_TIMESERV_REQUIRED) RETURN_ON_FALSE(ret_flags & ADS_TIMESERV); if (req_flags & DS_WRITABLE_REQUIRED) RETURN_ON_FALSE(ret_flags & ADS_WRITABLE); return true; } /**************************************************************** ****************************************************************/ static NTSTATUS dsgetdcname_cache_fetch(TALLOC_CTX *mem_ctx, const char *domain_name, struct GUID *domain_guid, uint32_t flags, const char *site_name, struct netr_DsRGetDCNameInfo **info_p, bool *expired) { char *key; DATA_BLOB blob; enum ndr_err_code ndr_err; struct netr_DsRGetDCNameInfo *info; if (!gencache_init()) { return NT_STATUS_INTERNAL_DB_ERROR; } key = dsgetdcname_cache_key(mem_ctx, domain_name); if (!key) { return NT_STATUS_NO_MEMORY; } if (!gencache_get_data_blob(key, &blob, expired)) { return NT_STATUS_OBJECT_NAME_NOT_FOUND; } info = TALLOC_ZERO_P(mem_ctx, struct netr_DsRGetDCNameInfo); if (!info) { return NT_STATUS_NO_MEMORY; } ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, info, (ndr_pull_flags_fn_t)ndr_pull_netr_DsRGetDCNameInfo); data_blob_free(&blob); if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { dsgetdcname_cache_delete(mem_ctx, domain_name); return ndr_map_error2ntstatus(ndr_err); } if (DEBUGLEVEL >= 10) { NDR_PRINT_DEBUG(netr_DsRGetDCNameInfo, info); } /* check flags */ if (!check_cldap_reply_required_flags(info->dc_flags, flags)) { DEBUG(10,("invalid flags\n")); return NT_STATUS_INVALID_PARAMETER; } if ((flags & DS_IP_REQUIRED) && (info->dc_address_type != DS_ADDRESS_TYPE_INET)) { return NT_STATUS_INVALID_PARAMETER_MIX; } *info_p = info; return NT_STATUS_OK; } /**************************************************************** ****************************************************************/ static NTSTATUS dsgetdcname_cached(TALLOC_CTX *mem_ctx, const char *domain_name, struct GUID *domain_guid, uint32_t flags, const char *site_name, struct netr_DsRGetDCNameInfo **info) { NTSTATUS status; bool expired = false; status = dsgetdcname_cache_fetch(mem_ctx, domain_name, domain_guid, flags, site_name, info, &expired); if (!NT_STATUS_IS_OK(status)) { DEBUG(10,("dsgetdcname_cached: cache fetch failed with: %s\n", nt_errstr(status))); return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND; } if (flags & DS_BACKGROUND_ONLY) { return status; } if (expired) { status = dsgetdcname_cache_refresh(mem_ctx, domain_name, domain_guid, flags, site_name, *info); if (!NT_STATUS_IS_OK(status)) { return status; } } return status; } /**************************************************************** ****************************************************************/ static bool check_allowed_required_flags(uint32_t flags) { uint32_t return_type = flags & (DS_RETURN_FLAT_NAME|DS_RETURN_DNS_NAME); uint32_t offered_type = flags & (DS_IS_FLAT_NAME|DS_IS_DNS_NAME); uint32_t query_type = flags & (DS_BACKGROUND_ONLY|DS_FORCE_REDISCOVERY); /* FIXME: check for DSGETDC_VALID_FLAGS and check for excluse bits * (DS_PDC_REQUIRED, DS_KDC_REQUIRED, DS_GC_SERVER_REQUIRED) */ debug_dsdcinfo_flags(10, flags); if (return_type == (DS_RETURN_FLAT_NAME|DS_RETURN_DNS_NAME)) { return false; } if (offered_type == (DS_IS_DNS_NAME|DS_IS_FLAT_NAME)) { return false; } if (query_type == (DS_BACKGROUND_ONLY|DS_FORCE_REDISCOVERY)) { return false; } #if 0 if ((flags & DS_RETURN_DNS_NAME) && (!(flags & DS_IP_REQUIRED))) { printf("gd: here5 \n"); return false; } #endif return true; } /**************************************************************** ****************************************************************/ static NTSTATUS discover_dc_netbios(TALLOC_CTX *mem_ctx, const char *domain_name, uint32_t flags, struct ip_service_name **returned_dclist, int *return_count) { if (lp_disable_netbios()) { return NT_STATUS_NOT_SUPPORTED; } /* FIXME: code here */ return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND; } /**************************************************************** ****************************************************************/ static NTSTATUS discover_dc_dns(TALLOC_CTX *mem_ctx, const char *domain_name, struct GUID *domain_guid, uint32_t flags, const char *site_name, struct ip_service_name **returned_dclist, int *return_count) { int i, j; NTSTATUS status; struct dns_rr_srv *dcs = NULL; int numdcs = 0; int numaddrs = 0; struct ip_service_name *dclist = NULL; int count = 0; if ((!(flags & DS_DIRECTORY_SERVICE_REQUIRED)) && (!(flags & DS_KDC_REQUIRED)) && (!(flags & DS_GC_SERVER_REQUIRED)) && (!(flags & DS_PDC_REQUIRED))) { DEBUG(1,("discover_dc_dns: invalid flags\n")); return NT_STATUS_INVALID_PARAMETER; } if (flags & DS_PDC_REQUIRED) { status = ads_dns_query_pdc(mem_ctx, domain_name, &dcs, &numdcs); } else if (flags & DS_GC_SERVER_REQUIRED) { status = ads_dns_query_gcs(mem_ctx, domain_name, site_name, &dcs, &numdcs); } else if (flags & DS_KDC_REQUIRED) { status = ads_dns_query_kdcs(mem_ctx, domain_name, site_name, &dcs, &numdcs); } else if (flags & DS_DIRECTORY_SERVICE_REQUIRED) { status = ads_dns_query_dcs(mem_ctx, domain_name, site_name, &dcs, &numdcs); } else if (domain_guid) { status = ads_dns_query_dcs_guid(mem_ctx, domain_name, domain_guid, &dcs, &numdcs); } else { /* FIXME: ? */ DEBUG(1,("discover_dc_dns: not enough input\n")); status = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND; } if (!NT_STATUS_IS_OK(status)) { return status; } if (numdcs == 0) { return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND; } for (i=0;iport = dcs[i].port; r->hostname = dcs[i].hostname; if (!(flags & DS_IP_REQUIRED)) { count++; continue; } /* If we don't have an IP list for a name, lookup it up */ if (!dcs[i].ss_s) { interpret_string_addr(&r->ss, dcs[i].hostname, 0); i++; j = 0; } else { /* use the IP addresses from the SRV sresponse */ if (j >= dcs[i].num_ips) { i++; j = 0; continue; } r->ss = dcs[i].ss_s[j]; j++; } /* make sure it is a valid IP. I considered checking the * negative connection cache, but this is the wrong place for * it. Maybe only as a hac. After think about it, if all of * the IP addresses retuend from DNS are dead, what hope does a * netbios name lookup have? The standard reason for falling * back to netbios lookups is that our DNS server doesn't know * anything about the DC's -- jerry */ if (!is_zero_addr(&r->ss)) { count++; continue; } } *returned_dclist = dclist; *return_count = count; if (count > 0) { return NT_STATUS_OK; } return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND; } /**************************************************************** ****************************************************************/ static NTSTATUS make_domain_controller_info(TALLOC_CTX *mem_ctx, const char *dc_unc, const char *dc_address, uint32_t dc_address_type, const struct GUID *domain_guid, const char *domain_name, const char *forest_name, uint32_t flags, const char *dc_site_name, const char *client_site_name, struct netr_DsRGetDCNameInfo **info_out) { struct netr_DsRGetDCNameInfo *info; info = TALLOC_ZERO_P(mem_ctx, struct netr_DsRGetDCNameInfo); NT_STATUS_HAVE_NO_MEMORY(info); if (dc_unc) { info->dc_unc = talloc_strdup(mem_ctx, dc_unc); NT_STATUS_HAVE_NO_MEMORY(info->dc_unc); } if (dc_address) { info->dc_address = talloc_strdup(mem_ctx, dc_address); NT_STATUS_HAVE_NO_MEMORY(info->dc_address); } info->dc_address_type = dc_address_type; if (domain_guid) { info->domain_guid = *domain_guid; } if (domain_name) { info->domain_name = talloc_strdup(mem_ctx, domain_name); NT_STATUS_HAVE_NO_MEMORY(info->domain_name); } if (forest_name) { info->forest_name = talloc_strdup(mem_ctx, forest_name); NT_STATUS_HAVE_NO_MEMORY(info->forest_name); } info->dc_flags = flags; if (dc_site_name) { info->dc_site_name = talloc_strdup(mem_ctx, dc_site_name); NT_STATUS_HAVE_NO_MEMORY(info->dc_site_name); } if (client_site_name) { info->client_site_name = talloc_strdup(mem_ctx, client_site_name); NT_STATUS_HAVE_NO_MEMORY(info->client_site_name); } *info_out = info; return NT_STATUS_OK; } /**************************************************************** ****************************************************************/ static NTSTATUS process_dc_dns(TALLOC_CTX *mem_ctx, const char *domain_name, uint32_t flags, struct ip_service_name *dclist, int num_dcs, struct netr_DsRGetDCNameInfo **info) { int i = 0; bool valid_dc = false; struct cldap_netlogon_reply r; const char *dc_hostname, *dc_domain_name; const char *dc_address; uint32_t dc_address_type; uint32_t dc_flags; struct GUID dc_guid; for (i=0; i