source4/libcli/finddcs_cldap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    a composite API for finding a DC and its name via CLDAP
   5
   6    Copyright (C) Andrew Tridgell 2010
   7    Copyright (C) Andrew Bartlett 2010
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "include/includes.h"
  24 #include <tevent.h>
  25 #include "libcli/resolve/resolve.h"
  26 #include "libcli/cldap/cldap.h"
  27 #include "libcli/finddc.h"
  28 #include "libcli/security/security.h"
  29 #include "lib/util/tevent_ntstatus.h"
  30 #include "lib/tsocket/tsocket.h"
  31 #include "libcli/composite/composite.h"
  32 #include "lib/util/util_net.h"
  33 #include "source3/libads/netlogon_ping.h"
  34
  35 struct finddcs_cldap_state {
  36         struct tevent_context *ev;
  37         struct tevent_req *req;
  38         const char *domain_name;
  39         struct dom_sid *domain_sid;
  40         const char *srv_name;
  41         const char **srv_addresses;
  42         uint32_t minimum_dc_flags;
  43         enum client_netlogon_ping_protocol proto;
  44         uint32_t srv_address_index;
  45         struct netlogon_samlogon_response *response;
  46         NTSTATUS status;
  47 };
  48
  49 static void finddcs_cldap_srv_resolved(struct composite_context *ctx);
  50 static void finddcs_cldap_netlogon_replied(struct tevent_req *req);
  51 static bool finddcs_cldap_srv_lookup(struct finddcs_cldap_state *state,
  52                                      struct finddcs *io,
  53                                      struct resolve_context *resolve_ctx,
  54                                      struct tevent_context *event_ctx);
  55 static bool finddcs_cldap_nbt_lookup(struct finddcs_cldap_state *state,
  56                                      struct finddcs *io,
  57                                      struct resolve_context *resolve_ctx,
  58                                      struct tevent_context *event_ctx);
  59 static void finddcs_cldap_nbt_resolved(struct composite_context *ctx);
  60 static bool finddcs_cldap_name_lookup(struct finddcs_cldap_state *state,
  61                                       struct finddcs *io,
  62                                       struct resolve_context *resolve_ctx,
  63                                       struct tevent_context *event_ctx);
  64 static void finddcs_cldap_name_resolved(struct composite_context *ctx);
  65 static void finddcs_cldap_next_server(struct finddcs_cldap_state *state);
  66 static bool finddcs_cldap_ipaddress(struct finddcs_cldap_state *state, struct finddcs *io);
  67
  68
  69 /*
  70  * find a list of DCs via DNS/CLDAP
  71  */
  72 struct tevent_req *finddcs_cldap_send(TALLOC_CTX *mem_ctx,
  73                                       struct finddcs *io,
  74                                       struct resolve_context *resolve_ctx,
  75                                       struct tevent_context *event_ctx)
  76 {
  77         struct finddcs_cldap_state *state;
  78         struct tevent_req *req;
  79
  80         req = tevent_req_create(mem_ctx, &state, struct finddcs_cldap_state);
  81         if (req == NULL) {
  82                 return NULL;
  83         }
  84
  85         state->req = req;
  86         state->ev = event_ctx;
  87         state->minimum_dc_flags = io->in.minimum_dc_flags;
  88         state->proto = io->in.proto;
  89
  90         if (io->in.domain_name) {
  91                 state->domain_name = talloc_strdup(state, io->in.domain_name);
  92                 if (tevent_req_nomem(state->domain_name, req)) {
  93                         return tevent_req_post(req, event_ctx);
  94                 }
  95         } else {
  96                 state->domain_name = NULL;
  97         }
  98
  99         if (io->in.domain_sid) {
 100                 state->domain_sid = dom_sid_dup(state, io->in.domain_sid);
 101                 if (tevent_req_nomem(state->domain_sid, req)) {
 102                         return tevent_req_post(req, event_ctx);
 103                 }
 104         } else {
 105                 state->domain_sid = NULL;
 106         }
 107
 108         if (io->in.server_address) {
 109                 if (is_ipaddress(io->in.server_address)) {
 110                         DEBUG(4,("finddcs: searching for a DC by IP %s\n",
 111                                  io->in.server_address));
 112                         if (!finddcs_cldap_ipaddress(state, io)) {
 113                                 return tevent_req_post(req, event_ctx);
 114                         }
 115                 } else {
 116                         if (!finddcs_cldap_name_lookup(state, io, resolve_ctx,
 117                                                        event_ctx)) {
 118                                 return tevent_req_post(req, event_ctx);
 119                         }
 120                 }
 121         } else if (io->in.domain_name) {
 122                 if (strchr(state->domain_name, '.')) {
 123                         /* looks like a DNS name */
 124                         DEBUG(4,("finddcs: searching for a DC by DNS domain %s\n", state->domain_name));
 125                         if (!finddcs_cldap_srv_lookup(state, io, resolve_ctx,
 126                                                       event_ctx)) {
 127                                 return tevent_req_post(req, event_ctx);
 128                         }
 129                 } else {
 130                         DEBUG(4,("finddcs: searching for a DC by NBT lookup %s\n", state->domain_name));
 131                         if (!finddcs_cldap_nbt_lookup(state, io, resolve_ctx,
 132                                                       event_ctx)) {
 133                                 return tevent_req_post(req, event_ctx);
 134                         }
 135                 }
 136         } else {
 137                 /* either we have the domain name or the IP address */
 138                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
 139                 DEBUG(2,("finddcs: Please specify at least the domain name or the IP address! \n"));
 140                 return tevent_req_post(req, event_ctx);
 141         }
 142
 143         return req;
 144 }
 145
 146
 147 /*
 148   we've been told the IP of the server, bypass name
 149   resolution and go straight to CLDAP
 150 */
 151 static bool finddcs_cldap_ipaddress(struct finddcs_cldap_state *state, struct finddcs *io)
 152 {
 153         NTSTATUS status;
 154
 155         state->srv_addresses = talloc_array(state, const char *, 2);
 156         if (tevent_req_nomem(state->srv_addresses, state->req)) {
 157                 return false;
 158         }
 159         state->srv_addresses[0] = talloc_strdup(state->srv_addresses, io->in.server_address);
 160         if (tevent_req_nomem(state->srv_addresses[0], state->req)) {
 161                 return false;
 162         }
 163         state->srv_addresses[1] = NULL;
 164         state->srv_address_index = 0;
 165
 166         finddcs_cldap_next_server(state);
 167         return tevent_req_is_nterror(state->req, &status);
 168 }
 169
 170 /*
 171   start a SRV DNS lookup
 172  */
 173 static bool finddcs_cldap_srv_lookup(struct finddcs_cldap_state *state,
 174                                      struct finddcs *io,
 175                                      struct resolve_context *resolve_ctx,
 176                                      struct tevent_context *event_ctx)
 177 {
 178         struct composite_context *creq;
 179         struct nbt_name name;
 180
 181         if (io->in.site_name) {
 182                 state->srv_name = talloc_asprintf(state, "_ldap._tcp.%s._sites.%s",
 183                                            io->in.site_name, io->in.domain_name);
 184         } else {
 185                 state->srv_name = talloc_asprintf(state, "_ldap._tcp.%s", io->in.domain_name);
 186         }
 187
 188         DEBUG(4,("finddcs: looking for SRV records for %s\n", state->srv_name));
 189
 190         make_nbt_name(&name, state->srv_name, 0);
 191
 192         creq = resolve_name_ex_send(resolve_ctx, state,
 193                                     RESOLVE_NAME_FLAG_FORCE_DNS | RESOLVE_NAME_FLAG_DNS_SRV,
 194                                     0, &name, event_ctx);
 195         if (tevent_req_nomem(creq, state->req)) {
 196                 return false;
 197         }
 198         creq->async.fn = finddcs_cldap_srv_resolved;
 199         creq->async.private_data = state;
 200
 201         return true;
 202 }
 203
 204 /*
 205   start a NBT name lookup for domain<1C>
 206  */
 207 static bool finddcs_cldap_nbt_lookup(struct finddcs_cldap_state *state,
 208                                      struct finddcs *io,
 209                                      struct resolve_context *resolve_ctx,
 210                                      struct tevent_context *event_ctx)
 211 {
 212         struct composite_context *creq;
 213         struct nbt_name name;
 214
 215         make_nbt_name(&name, state->domain_name, NBT_NAME_LOGON);
 216         creq = resolve_name_send(resolve_ctx, state, &name, event_ctx);
 217         if (tevent_req_nomem(creq, state->req)) {
 218                 return false;
 219         }
 220         creq->async.fn = finddcs_cldap_nbt_resolved;
 221         creq->async.private_data = state;
 222         return true;
 223 }
 224
 225 static bool finddcs_cldap_name_lookup(struct finddcs_cldap_state *state,
 226                                       struct finddcs *io,
 227                                       struct resolve_context *resolve_ctx,
 228                                       struct tevent_context *event_ctx)
 229 {
 230         struct composite_context *creq;
 231         struct nbt_name name;
 232
 233         make_nbt_name(&name, io->in.server_address, NBT_NAME_SERVER);
 234         creq = resolve_name_send(resolve_ctx, state, &name, event_ctx);
 235         if (tevent_req_nomem(creq, state->req)) {
 236                 return false;
 237         }
 238         creq->async.fn = finddcs_cldap_name_resolved;
 239         creq->async.private_data = state;
 240         return true;
 241 }
 242
 243 /*
 244   fire off a CLDAP query to the next server
 245  */
 246 static void finddcs_cldap_next_server(struct finddcs_cldap_state *state)
 247 {
 248         struct tevent_req *subreq;
 249         struct tsocket_address **servers = NULL;
 250         const char *realm = NULL;
 251         size_t i, num_servers;
 252         int ret;
 253
 254         num_servers = str_list_length(state->srv_addresses);
 255
 256         servers = talloc_array(state, struct tsocket_address *, num_servers);
 257         if (tevent_req_nomem(servers, state->req)) {
 258                 return;
 259         }
 260
 261         for (i = 0; i < num_servers; i++) {
 262                 ret = tsocket_address_inet_from_strings(
 263                         servers,
 264                         "ip",
 265                         state->srv_addresses[i],
 266                         389,
 267                         &servers[i]);
 268                 if (ret == -1) {
 269                         NTSTATUS status = map_nt_error_from_unix_common(errno);
 270                         tevent_req_nterror(state->req, status);
 271                         return;
 272                 }
 273         }
 274
 275         if ((state->domain_name != NULL) && (strchr(state->domain_name, '.'))) {
 276                 realm = state->domain_name;
 277         }
 278
 279         subreq = netlogon_pings_send(
 280                 state,
 281                 state->ev,
 282                 state->proto,
 283                 servers,
 284                 num_servers,
 285                 (struct netlogon_ping_filter){
 286                         .ntversion = NETLOGON_NT_VERSION_5 |
 287                                      NETLOGON_NT_VERSION_5EX |
 288                                      NETLOGON_NT_VERSION_IP,
 289
 290                         .acct_ctrl = -1,
 291                         .domain = realm,
 292                         .domain_sid = state->domain_sid,
 293                         .required_flags = state->minimum_dc_flags,
 294                 },
 295                 1, /* min_servers */
 296                 tevent_timeval_current_ofs(2, 0));
 297         if (tevent_req_nomem(subreq, state->req)) {
 298                 return;
 299         }
 300         tevent_req_set_callback(subreq, finddcs_cldap_netlogon_replied, state);
 301 }
 302
 303
 304 /*
 305   we have a response from a CLDAP server for a netlogon request
 306  */
 307 static void finddcs_cldap_netlogon_replied(struct tevent_req *subreq)
 308 {
 309         struct finddcs_cldap_state *state;
 310         struct netlogon_samlogon_response **responses = NULL;
 311         size_t i, num_responses;
 312         NTSTATUS status;
 313
 314         state = tevent_req_callback_data(subreq, struct finddcs_cldap_state);
 315
 316         status = netlogon_pings_recv(subreq, state, &responses);
 317         TALLOC_FREE(subreq);
 318         if (tevent_req_nterror(state->req, status)) {
 319                 return;
 320         }
 321
 322         num_responses = talloc_array_length(responses);
 323
 324         for (i = 0; i < num_responses; i++) {
 325                 if (responses[i] != NULL) {
 326                         state->srv_address_index = i;
 327                         state->response = responses[i];
 328                 }
 329         }
 330
 331         if (state->response == NULL) {
 332                 tevent_req_nterror(state->req,
 333                                    NT_STATUS_OBJECT_NAME_NOT_FOUND);
 334                 return;
 335         }
 336
 337         map_netlogon_samlogon_response(state->response);
 338
 339         DEBUG(4,("finddcs: Found matching DC %s with server_type=0x%08x\n",
 340                  state->srv_addresses[state->srv_address_index],
 341                  state->response->data.nt5_ex.server_type));
 342
 343         tevent_req_done(state->req);
 344 }
 345
 346 static void finddcs_cldap_name_resolved(struct composite_context *ctx)
 347 {
 348         struct finddcs_cldap_state *state =
 349                 talloc_get_type(ctx->async.private_data, struct finddcs_cldap_state);
 350         NTSTATUS status;
 351         unsigned i;
 352
 353         status = resolve_name_multiple_recv(ctx, state, &state->srv_addresses);
 354         if (tevent_req_nterror(state->req, status)) {
 355                 DEBUG(2,("finddcs: No matching server found\n"));
 356                 return;
 357         }
 358
 359         for (i=0; state->srv_addresses[i]; i++) {
 360                 DEBUG(4,("finddcs: response %u at '%s'\n",
 361                          i, state->srv_addresses[i]));
 362         }
 363
 364         state->srv_address_index = 0;
 365
 366         state->status = NT_STATUS_OK;
 367         finddcs_cldap_next_server(state);
 368 }
 369
 370 /*
 371    handle NBT name lookup reply
 372  */
 373 static void finddcs_cldap_nbt_resolved(struct composite_context *ctx)
 374 {
 375         struct finddcs_cldap_state *state =
 376                 talloc_get_type(ctx->async.private_data, struct finddcs_cldap_state);
 377         NTSTATUS status;
 378         unsigned i;
 379
 380         status = resolve_name_multiple_recv(ctx, state, &state->srv_addresses);
 381         if (tevent_req_nterror(state->req, status)) {
 382                 DEBUG(2,("finddcs: No matching NBT <1c> server found\n"));
 383                 return;
 384         }
 385
 386         for (i=0; state->srv_addresses[i]; i++) {
 387                 DEBUG(4,("finddcs: NBT <1c> response %u at '%s'\n",
 388                          i, state->srv_addresses[i]));
 389         }
 390
 391         state->srv_address_index = 0;
 392
 393         finddcs_cldap_next_server(state);
 394 }
 395
 396
 397 /*
 398  * Having got a DNS SRV answer, fire off the first CLDAP request
 399  */
 400 static void finddcs_cldap_srv_resolved(struct composite_context *ctx)
 401 {
 402         struct finddcs_cldap_state *state =
 403                 talloc_get_type(ctx->async.private_data, struct finddcs_cldap_state);
 404         NTSTATUS status;
 405         unsigned i;
 406
 407         status = resolve_name_multiple_recv(ctx, state, &state->srv_addresses);
 408         if (tevent_req_nterror(state->req, status)) {
 409                 DEBUG(2,("finddcs: Failed to find SRV record for %s\n", state->srv_name));
 410                 return;
 411         }
 412
 413         for (i=0; state->srv_addresses[i]; i++) {
 414                 DEBUG(4,("finddcs: DNS SRV response %u at '%s'\n", i, state->srv_addresses[i]));
 415         }
 416
 417         state->srv_address_index = 0;
 418
 419         state->status = NT_STATUS_OK;
 420         finddcs_cldap_next_server(state);
 421 }
 422
 423
 424 NTSTATUS finddcs_cldap_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx, struct finddcs *io)
 425 {
 426         struct finddcs_cldap_state *state = tevent_req_data(req, struct finddcs_cldap_state);
 427         bool ok;
 428         NTSTATUS status;
 429
 430         ok = tevent_req_poll(req, state->ev);
 431         if (!ok) {
 432                 talloc_free(req);
 433                 return NT_STATUS_INTERNAL_ERROR;
 434         }
 435         if (tevent_req_is_nterror(req, &status)) {
 436                 tevent_req_received(req);
 437                 return status;
 438         }
 439
 440         io->out.netlogon = talloc_move(mem_ctx, &state->response);
 441         io->out.address = talloc_steal(
 442                 mem_ctx, state->srv_addresses[state->srv_address_index]);
 443
 444         tevent_req_received(req);
 445         return NT_STATUS_OK;
 446 }
 447
 448 NTSTATUS finddcs_cldap(TALLOC_CTX *mem_ctx,
 449                        struct finddcs *io,
 450                        struct resolve_context *resolve_ctx,
 451                        struct tevent_context *event_ctx)
 452 {
 453         NTSTATUS status;
 454         struct tevent_req *req = finddcs_cldap_send(mem_ctx,
 455                                                     io,
 456                                                     resolve_ctx,
 457                                                     event_ctx);
 458         status = finddcs_cldap_recv(req, mem_ctx, io);
 459         talloc_free(req);
 460         return status;
 461 }