sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-29 21:47:30 +03:00
Code

Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into cprovision

Browse Source 
(This used to be commit 9b8448c1e4567be26fa4890c647e0d4d46efbe20)
This commit is contained in:
Jelmer Vernooij 2008-04-13 22:49:08 +02:00
commit 60a6682c85
24 changed files with 1559 additions and 709 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
source4/libnet/config.mk
View File

@ -1,5 +1,6 @@
[SUBSYSTEM::LIBSAMBA-NET]
PRIVATE_PROTO_HEADER = libnet_proto.h
PRIVATE_DEPENDENCIES = PROVISION
OBJ_FILES = \
libnet.o \
libnet_passwd.o \
@ -10,6 +11,7 @@ OBJ_FILES = \
libnet_become_dc.o \
libnet_unbecome_dc.o \
libnet_vampire.o \
libnet_samsync.o \
libnet_samdump.o \
libnet_samdump_keytab.o \
libnet_samsync_ldb.o \

1
source4/libnet/libnet.h
View File

@ -68,6 +68,7 @@ struct libnet_context {
#include "libnet/libnet_site.h"
#include "libnet/libnet_become_dc.h"
#include "libnet/libnet_unbecome_dc.h"
#include "libnet/libnet_samsync.h"
#include "libnet/libnet_vampire.h"
#include "libnet/libnet_user.h"
#include "libnet/libnet_group.h"

476
source4/libnet/libnet_join.c
View File

@ -839,13 +839,11 @@ NTSTATUS libnet_JoinDomain(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, stru
return status;
}
static NTSTATUS libnet_Join_primary_domain(struct libnet_context *ctx,
TALLOC_CTX *mem_ctx,
struct libnet_Join *r)
NTSTATUS libnet_set_join_secrets(struct libnet_context *ctx,
TALLOC_CTX *mem_ctx,
struct libnet_set_join_secrets *r)
{
NTSTATUS status;
TALLOC_CTX *tmp_mem;
struct libnet_JoinDomain *r2;
int ret, rtn;
struct ldb_context *ldb;
struct ldb_dn *base_dn;
@ -860,6 +858,243 @@ static NTSTATUS libnet_Join_primary_domain(struct libnet_context *ctx,
"privateKeytab",
NULL
};
tmp_mem = talloc_new(mem_ctx);
if (!tmp_mem) {
return NT_STATUS_NO_MEMORY;
}
/* Open the secrets database */
ldb = secrets_db_connect(tmp_mem, ctx->lp_ctx);
if (!ldb) {
r->out.error_string
= talloc_asprintf(mem_ctx,
"Could not open secrets database");
talloc_free(tmp_mem);
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
}
/*
* now prepare the record for secrets.ldb
*/
sct = talloc_asprintf(tmp_mem, "%d", r->in.join_type);
if (!sct) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
msg = ldb_msg_new(tmp_mem);
if (!msg) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
base_dn = ldb_dn_new(tmp_mem, ldb, "cn=Primary Domains");
if (!base_dn) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
msg->dn = ldb_dn_copy(tmp_mem, base_dn);
if ( ! ldb_dn_add_child_fmt(msg->dn, "flatname=%s", r->in.domain_name)) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "flatname", r->in.domain_name);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
if (r->in.realm) {
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "realm", r->in.realm);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "objectClass", "primaryDomain");
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "objectClass", "primaryDomain");
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "secret", r->in.join_password);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "samAccountName", r->in.account_name);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "secureChannelType", sct);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
if (r->in.kvno) {
rtn = samdb_msg_add_uint(ldb, tmp_mem, msg, "msDS-KeyVersionNumber",
r->in.kvno);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
if (r->in.domain_sid) {
rtn = samdb_msg_add_dom_sid(ldb, tmp_mem, msg, "objectSid",
r->in.domain_sid);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
/*
* search for the secret record
* - remove the records we find
* - and fetch the old secret and store it under priorSecret
*/
ret = gendb_search(ldb,
tmp_mem, base_dn,
&msgs, attrs,
"(|" SECRETS_PRIMARY_DOMAIN_FILTER "(realm=%s))",
r->in.domain_name, r->in.realm);
if (ret == 0) {
rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secretsKeytab", "secrets.keytab");
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
} else if (ret == -1) {
r->out.error_string
= talloc_asprintf(mem_ctx,
"Search for domain: %s and realm: %s failed: %s",
r->in.domain_name, r->in.realm, ldb_errstring(ldb));
talloc_free(tmp_mem);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
} else {
const struct ldb_val *private_keytab;
const struct ldb_val *krb5_main_keytab;
const struct ldb_val *prior_secret;
const struct ldb_val *prior_modified_time;
int i;
for (i = 0; i < ret; i++) {
ldb_delete(ldb, msgs[i]->dn);
}
prior_secret = ldb_msg_find_ldb_val(msgs[0], "secret");
if (prior_secret) {
rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "priorSecret", prior_secret);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secret", r->in.join_password);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
prior_modified_time = ldb_msg_find_ldb_val(msgs[0],
"whenChanged");
if (prior_modified_time) {
rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "priorWhenChanged",
prior_modified_time);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "samAccountName", r->in.account_name);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secureChannelType", sct);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
/* We will want to keep the keytab names */
private_keytab = ldb_msg_find_ldb_val(msgs[0], "privateKeytab");
if (private_keytab) {
rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "privateKeytab", private_keytab);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
krb5_main_keytab = ldb_msg_find_ldb_val(msgs[0], "krb5Keytab");
if (krb5_main_keytab) {
rtn = samdb_msg_set_value(ldb, tmp_mem, msg,
"krb5Keytab", krb5_main_keytab);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
}
/* create the secret */
ret = ldb_add(ldb, msg);
if (ret != 0) {
r->out.error_string = talloc_asprintf(mem_ctx, "Failed to create secret record %s",
ldb_dn_get_linearized(msg->dn));
talloc_free(tmp_mem);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
return NT_STATUS_OK;
}
static NTSTATUS libnet_Join_primary_domain(struct libnet_context *ctx,
TALLOC_CTX *mem_ctx,
struct libnet_Join *r)
{
NTSTATUS status;
TALLOC_CTX *tmp_mem;
struct libnet_JoinDomain *r2;
struct libnet_set_join_secrets *r3;
uint32_t acct_type = 0;
const char *account_name;
const char *netbios_name;
@ -906,19 +1141,6 @@ static NTSTATUS libnet_Join_primary_domain(struct libnet_context *ctx,
return NT_STATUS_NO_MEMORY;
}
/*
* Local secrets are stored in secrets.ldb
* open it to make sure we can write the info into it after the join
*/
ldb = secrets_db_connect(tmp_mem, ctx->lp_ctx);
if (!ldb) {
r->out.error_string
= talloc_asprintf(mem_ctx,
"Could not open secrets database");
talloc_free(tmp_mem);
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
}
/*
* join the domain
*/
@ -935,215 +1157,29 @@ static NTSTATUS libnet_Join_primary_domain(struct libnet_context *ctx,
talloc_free(tmp_mem);
return status;
}
/*
* now prepare the record for secrets.ldb
*/
sct = talloc_asprintf(tmp_mem, "%d", r->in.join_type);
if (!sct) {
r3 = talloc(tmp_mem, struct libnet_set_join_secrets);
if (!r3) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
msg = ldb_msg_new(tmp_mem);
if (!msg) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
base_dn = ldb_dn_new(tmp_mem, ldb, "cn=Primary Domains");
if (!base_dn) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
msg->dn = ldb_dn_copy(tmp_mem, base_dn);
if ( ! ldb_dn_add_child_fmt(msg->dn, "flatname=%s", r2->out.domain_name)) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
ZERO_STRUCTP(r3);
r3->in.domain_name = r2->out.domain_name;
r3->in.realm = r2->out.realm;
r3->in.account_name = account_name;
r3->in.netbios_name = netbios_name;
r3->in.join_type = r->in.join_type;
r3->in.join_password = r2->out.join_password;
r3->in.kvno = r2->out.kvno;
r3->in.domain_sid = r2->out.domain_sid;
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "flatname", r2->out.domain_name);
if (rtn == -1) {
r->out.error_string = NULL;
status = libnet_set_join_secrets(ctx, r3, r3);
if (!NT_STATUS_IS_OK(status)) {
r->out.error_string = talloc_steal(mem_ctx, r3->out.error_string);
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
if (r2->out.realm) {
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "realm", r2->out.realm);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "objectClass", "primaryDomain");
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "objectClass", "primaryDomain");
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "secret", r2->out.join_password);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "samAccountName", r2->in.account_name);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "secureChannelType", sct);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
if (r2->out.kvno) {
rtn = samdb_msg_add_uint(ldb, tmp_mem, msg, "msDS-KeyVersionNumber",
r2->out.kvno);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
if (r2->out.domain_sid) {
rtn = samdb_msg_add_dom_sid(ldb, tmp_mem, msg, "objectSid",
r2->out.domain_sid);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
/*
* search for the secret record
* - remove the records we find
* - and fetch the old secret and store it under priorSecret
*/
ret = gendb_search(ldb,
tmp_mem, base_dn,
&msgs, attrs,
"(|" SECRETS_PRIMARY_DOMAIN_FILTER "(realm=%s))",
r2->out.domain_name, r2->out.realm);
if (ret == 0) {
rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secretsKeytab", "secrets.keytab");
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
} else if (ret == -1) {
r->out.error_string
= talloc_asprintf(mem_ctx,
"Search for domain: %s and realm: %s failed: %s",
r2->out.domain_name, r2->out.realm, ldb_errstring(ldb));
talloc_free(tmp_mem);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
} else {
const struct ldb_val *private_keytab;
const struct ldb_val *krb5_main_keytab;
const struct ldb_val *prior_secret;
const struct ldb_val *prior_modified_time;
int i;
for (i = 0; i < ret; i++) {
ldb_delete(ldb, msgs[i]->dn);
}
prior_secret = ldb_msg_find_ldb_val(msgs[0], "secret");
if (prior_secret) {
rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "priorSecret", prior_secret);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secret", r2->out.join_password);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
prior_modified_time = ldb_msg_find_ldb_val(msgs[0],
"whenChanged");
if (prior_modified_time) {
rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "priorWhenChanged",
prior_modified_time);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "samAccountName", r2->in.account_name);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secureChannelType", sct);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
/* We will want to keep the keytab names */
private_keytab = ldb_msg_find_ldb_val(msgs[0], "privateKeytab");
if (private_keytab) {
rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "privateKeytab", private_keytab);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
krb5_main_keytab = ldb_msg_find_ldb_val(msgs[0], "krb5Keytab");
if (krb5_main_keytab) {
rtn = samdb_msg_set_value(ldb, tmp_mem, msg,
"krb5Keytab", krb5_main_keytab);
if (rtn == -1) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
}
}
/* create the secret */
ret = ldb_add(ldb, msg);
if (ret != 0) {
r->out.error_string = talloc_asprintf(mem_ctx, "Failed to create secret record %s",
ldb_dn_get_linearized(msg->dn));
talloc_free(tmp_mem);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
return status;
}
/* move all out parameter to the callers TALLOC_CTX */

17
source4/libnet/libnet_join.h
View File

@ -79,5 +79,22 @@ struct libnet_Join {
} out;
};
struct libnet_set_join_secrets {
struct {
const char *domain_name;
const char *realm;
const char *netbios_name;
const char *account_name;
enum netr_SchannelType join_type;
const char *join_password;
int kvno;
struct dom_sid *domain_sid;
} in;
struct {
const char *error_string;
} out;
};
#endif /* __LIBNET_JOIN_H__ */

399
source4/libnet/libnet_samsync.c Normal file
View File

@ -0,0 +1,399 @@
/*
Unix SMB/CIFS implementation.
Extract the user/system database from a remote SamSync server
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "libnet/libnet.h"
#include "libcli/auth/libcli_auth.h"
#include "auth/gensec/gensec.h"
#include "auth/credentials/credentials.h"
#include "auth/gensec/schannel_proto.h"
#include "librpc/gen_ndr/ndr_netlogon.h"
#include "librpc/gen_ndr/ndr_netlogon_c.h"
#include "param/param.h"
/**
* Decrypt and extract the user's passwords.
*
* The writes decrypted (no longer 'RID encrypted' or arcfour encrypted) passwords back into the structure
*/
static NTSTATUS fix_user(TALLOC_CTX *mem_ctx,
struct creds_CredentialState *creds,
bool rid_crypt,
enum netr_SamDatabaseID database,
struct netr_DELTA_ENUM *delta,
char **error_string)
{
uint32_t rid = delta->delta_id_union.rid;
struct netr_DELTA_USER *user = delta->delta_union.user;
struct samr_Password lm_hash;
struct samr_Password nt_hash;
const char *username = user->account_name.string;
if (rid_crypt) {
if (user->lm_password_present) {
sam_rid_crypt(rid, user->lmpassword.hash, lm_hash.hash, 0);
user->lmpassword = lm_hash;
}
if (user->nt_password_present) {
sam_rid_crypt(rid, user->ntpassword.hash, nt_hash.hash, 0);
user->ntpassword = nt_hash;
}
}
if (user->user_private_info.SensitiveData) {
DATA_BLOB data;
struct netr_USER_KEYS keys;
enum ndr_err_code ndr_err;
data.data = user->user_private_info.SensitiveData;
data.length = user->user_private_info.DataLength;
creds_arcfour_crypt(creds, data.data, data.length);
user->user_private_info.SensitiveData = data.data;
user->user_private_info.DataLength = data.length;
ndr_err = ndr_pull_struct_blob(&data, mem_ctx, NULL, &keys, (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
*error_string = talloc_asprintf(mem_ctx, "Failed to parse Sensitive Data for %s:", username);
dump_data(10, data.data, data.length);
return ndr_map_error2ntstatus(ndr_err);
}
if (keys.keys.keys2.lmpassword.length == 16) {
if (rid_crypt) {
sam_rid_crypt(rid, keys.keys.keys2.lmpassword.pwd.hash, lm_hash.hash, 0);
user->lmpassword = lm_hash;
} else {
user->lmpassword = keys.keys.keys2.lmpassword.pwd;
}
user->lm_password_present = true;
}
if (keys.keys.keys2.ntpassword.length == 16) {
if (rid_crypt) {
sam_rid_crypt(rid, keys.keys.keys2.ntpassword.pwd.hash, nt_hash.hash, 0);
user->ntpassword = nt_hash;
} else {
user->ntpassword = keys.keys.keys2.ntpassword.pwd;
}
user->nt_password_present = true;
}
/* TODO: rid decrypt history fields */
}
return NT_STATUS_OK;
}
/**
* Decrypt and extract the secrets
*
* The writes decrypted secrets back into the structure
*/
static NTSTATUS fix_secret(TALLOC_CTX *mem_ctx,
struct creds_CredentialState *creds,
enum netr_SamDatabaseID database,
struct netr_DELTA_ENUM *delta,
char **error_string)
{
struct netr_DELTA_SECRET *secret = delta->delta_union.secret;
creds_arcfour_crypt(creds, secret->current_cipher.cipher_data,
secret->current_cipher.maxlen);
creds_arcfour_crypt(creds, secret->old_cipher.cipher_data,
secret->old_cipher.maxlen);
return NT_STATUS_OK;
}
/**
* Fix up the delta, dealing with encryption issues so that the final
* callback need only do the printing or application logic
*/
static NTSTATUS fix_delta(TALLOC_CTX *mem_ctx,
struct creds_CredentialState *creds,
bool rid_crypt,
enum netr_SamDatabaseID database,
struct netr_DELTA_ENUM *delta,
char **error_string)
{
NTSTATUS nt_status = NT_STATUS_OK;
*error_string = NULL;
switch (delta->delta_type) {
case NETR_DELTA_USER:
{
nt_status = fix_user(mem_ctx,
creds,
rid_crypt,
database,
delta,
error_string);
break;
}
case NETR_DELTA_SECRET:
{
nt_status = fix_secret(mem_ctx,
creds,
database,
delta,
error_string);
break;
}
default:
break;
}
return nt_status;
}
NTSTATUS libnet_SamSync_netlogon(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_SamSync *r)
{
NTSTATUS nt_status, dbsync_nt_status;
TALLOC_CTX *samsync_ctx, *loop_ctx, *delta_ctx;
struct creds_CredentialState *creds;
struct netr_DatabaseSync dbsync;
struct cli_credentials *machine_account;
struct dcerpc_pipe *p;
struct libnet_context *machine_net_ctx;
struct libnet_RpcConnect *c;
struct libnet_SamSync_state *state;
const enum netr_SamDatabaseID database_ids[] = {SAM_DATABASE_DOMAIN, SAM_DATABASE_BUILTIN, SAM_DATABASE_PRIVS};
int i;
samsync_ctx = talloc_named(mem_ctx, 0, "SamSync top context");
if (!r->in.machine_account) {
machine_account = cli_credentials_init(samsync_ctx);
if (!machine_account) {
talloc_free(samsync_ctx);
return NT_STATUS_NO_MEMORY;
}
cli_credentials_set_conf(machine_account, ctx->lp_ctx);
nt_status = cli_credentials_set_machine_account(machine_account, ctx->lp_ctx);
if (!NT_STATUS_IS_OK(nt_status)) {
r->out.error_string = talloc_strdup(mem_ctx, "Could not obtain machine account password - are we joined to the domain?");
talloc_free(samsync_ctx);
return nt_status;
}
} else {
machine_account = r->in.machine_account;
}
/* We cannot do this unless we are a BDC. Check, before we get odd errors later */
if (cli_credentials_get_secure_channel_type(machine_account) != SEC_CHAN_BDC) {
r->out.error_string
= talloc_asprintf(mem_ctx,
"Our join to domain %s is not as a BDC (%d), please rejoin as a BDC",
cli_credentials_get_domain(machine_account),
cli_credentials_get_secure_channel_type(machine_account));
talloc_free(samsync_ctx);
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
}
c = talloc(samsync_ctx, struct libnet_RpcConnect);
if (!c) {
r->out.error_string = NULL;
talloc_free(samsync_ctx);
return NT_STATUS_NO_MEMORY;
}
c->level = LIBNET_RPC_CONNECT_DC_INFO;
if (r->in.binding_string) {
c->in.binding = r->in.binding_string;
c->in.name = NULL;
} else {
c->in.binding = NULL;
c->in.name = cli_credentials_get_domain(machine_account);
}
/* prepare connect to the NETLOGON pipe of PDC */
c->in.dcerpc_iface = &ndr_table_netlogon;
/* We must do this as the machine, not as any command-line
* user. So we override the credentials in the
* libnet_context */
machine_net_ctx = talloc(samsync_ctx, struct libnet_context);
if (!machine_net_ctx) {
r->out.error_string = NULL;
talloc_free(samsync_ctx);
return NT_STATUS_NO_MEMORY;
}
*machine_net_ctx = *ctx;
machine_net_ctx->cred = machine_account;
/* connect to the NETLOGON pipe of the PDC */
nt_status = libnet_RpcConnect(machine_net_ctx, samsync_ctx, c);
if (!NT_STATUS_IS_OK(nt_status)) {
if (r->in.binding_string) {
r->out.error_string = talloc_asprintf(mem_ctx,
"Connection to NETLOGON pipe of DC %s failed: %s",
r->in.binding_string, c->out.error_string);
} else {
r->out.error_string = talloc_asprintf(mem_ctx,
"Connection to NETLOGON pipe of DC for %s failed: %s",
c->in.name, c->out.error_string);
}
talloc_free(samsync_ctx);
return nt_status;
}
/* This makes a new pipe, on which we can do schannel. We
* should do this in the RpcConnect code, but the abstaction
* layers do not suit yet */
nt_status = dcerpc_secondary_connection(c->out.dcerpc_pipe, &p,
c->out.dcerpc_pipe->binding);
if (!NT_STATUS_IS_OK(nt_status)) {
r->out.error_string = talloc_asprintf(mem_ctx,
"Secondary connection to NETLOGON pipe of DC %s failed: %s",
dcerpc_server_name(p), nt_errstr(nt_status));
talloc_free(samsync_ctx);
return nt_status;
}
nt_status = dcerpc_bind_auth_schannel(samsync_ctx, p, &ndr_table_netlogon,
machine_account, ctx->lp_ctx, DCERPC_AUTH_LEVEL_PRIVACY);
if (!NT_STATUS_IS_OK(nt_status)) {
r->out.error_string = talloc_asprintf(mem_ctx,
"SCHANNEL authentication to NETLOGON pipe of DC %s failed: %s",
dcerpc_server_name(p), nt_errstr(nt_status));
talloc_free(samsync_ctx);
return nt_status;
}
state = talloc(samsync_ctx, struct libnet_SamSync_state);
if (!state) {
r->out.error_string = NULL;
talloc_free(samsync_ctx);
return nt_status;
}
state->domain_name = c->out.domain_name;
state->domain_sid = c->out.domain_sid;
state->realm = c->out.realm;
state->domain_guid = c->out.guid;
state->machine_net_ctx = machine_net_ctx;
state->netlogon_pipe = p;
/* initialise the callback layer. It may wish to contact the
* server with ldap, now we know the name */
if (r->in.init_fn) {
char *error_string;
nt_status = r->in.init_fn(samsync_ctx,
r->in.fn_ctx,
state,
&error_string);
if (!NT_STATUS_IS_OK(nt_status)) {
r->out.error_string = talloc_steal(mem_ctx, error_string);
talloc_free(samsync_ctx);
return nt_status;
}
}
/* get NETLOGON credentials */
nt_status = dcerpc_schannel_creds(p->conn->security_state.generic_state, samsync_ctx, &creds);
if (!NT_STATUS_IS_OK(nt_status)) {
r->out.error_string = talloc_strdup(mem_ctx, "Could not obtain NETLOGON credentials from DCERPC/GENSEC layer");
talloc_free(samsync_ctx);
return nt_status;
}
/* Setup details for the synchronisation */
dbsync.in.logon_server = talloc_asprintf(samsync_ctx, "\\\\%s", dcerpc_server_name(p));
dbsync.in.computername = cli_credentials_get_workstation(machine_account);
dbsync.in.preferredmaximumlength = (uint32_t)-1;
ZERO_STRUCT(dbsync.in.return_authenticator);
for (i=0;i< ARRAY_SIZE(database_ids); i++) {
dbsync.in.sync_context = 0;
dbsync.in.database_id = database_ids[i];
do {
int d;
loop_ctx = talloc_named(samsync_ctx, 0, "DatabaseSync loop context");
creds_client_authenticator(creds, &dbsync.in.credential);
dbsync_nt_status = dcerpc_netr_DatabaseSync(p, loop_ctx, &dbsync);
if (!NT_STATUS_IS_OK(dbsync_nt_status) &&
!NT_STATUS_EQUAL(dbsync_nt_status, STATUS_MORE_ENTRIES)) {
r->out.error_string = talloc_asprintf(mem_ctx, "DatabaseSync failed - %s", nt_errstr(nt_status));
talloc_free(samsync_ctx);
return nt_status;
}
if (!creds_client_check(creds, &dbsync.out.return_authenticator.cred)) {
r->out.error_string = talloc_strdup(mem_ctx, "Credential chaining on incoming DatabaseSync failed");
talloc_free(samsync_ctx);
return NT_STATUS_ACCESS_DENIED;
}
dbsync.in.sync_context = dbsync.out.sync_context;
/* For every single remote 'delta' entry: */
for (d=0; d < dbsync.out.delta_enum_array->num_deltas; d++) {
char *error_string = NULL;
delta_ctx = talloc_named(loop_ctx, 0, "DatabaseSync delta context");
/* 'Fix' elements, by decrypting and
* de-obfuscating the data */
nt_status = fix_delta(delta_ctx,
creds,
r->in.rid_crypt,
dbsync.in.database_id,
&dbsync.out.delta_enum_array->delta_enum[d],
&error_string);
if (!NT_STATUS_IS_OK(nt_status)) {
r->out.error_string = talloc_steal(mem_ctx, error_string);
talloc_free(samsync_ctx);
return nt_status;
}
/* Now call the callback. This will
* do something like print the data or
* write to an ldb */
nt_status = r->in.delta_fn(delta_ctx,
r->in.fn_ctx,
dbsync.in.database_id,
&dbsync.out.delta_enum_array->delta_enum[d],
&error_string);
if (!NT_STATUS_IS_OK(nt_status)) {
r->out.error_string = talloc_steal(mem_ctx, error_string);
talloc_free(samsync_ctx);
return nt_status;
}
talloc_free(delta_ctx);
}
talloc_free(loop_ctx);
} while (NT_STATUS_EQUAL(dbsync_nt_status, STATUS_MORE_ENTRIES));
if (!NT_STATUS_IS_OK(dbsync_nt_status)) {
r->out.error_string = talloc_asprintf(mem_ctx, "libnet_SamSync_netlogon failed: unexpected inconsistancy. Should not get error %s here", nt_errstr(nt_status));
talloc_free(samsync_ctx);
return dbsync_nt_status;
}
nt_status = NT_STATUS_OK;
}
talloc_free(samsync_ctx);
return nt_status;
}

84
source4/libnet/libnet_samsync.h Normal file
View File

@ -0,0 +1,84 @@
/*
Unix SMB/CIFS implementation.
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "librpc/gen_ndr/netlogon.h"
struct libnet_SamSync_state {
struct libnet_context *machine_net_ctx;
struct dcerpc_pipe *netlogon_pipe;
const char *domain_name;
const struct dom_sid *domain_sid;
const char *realm;
struct GUID *domain_guid;
};
/* struct and enum for doing a remote domain vampire dump */
struct libnet_SamSync {
struct {
const char *binding_string;
bool rid_crypt;
NTSTATUS (*init_fn)(TALLOC_CTX *mem_ctx,
void *private,
struct libnet_SamSync_state *samsync_state,
char **error_string);
NTSTATUS (*delta_fn)(TALLOC_CTX *mem_ctx,
void *private,
enum netr_SamDatabaseID database,
struct netr_DELTA_ENUM *delta,
char **error_string);
void *fn_ctx;
struct cli_credentials *machine_account;
} in;
struct {
const char *error_string;
} out;
};
struct libnet_SamDump {
struct {
const char *binding_string;
struct cli_credentials *machine_account;
} in;
struct {
const char *error_string;
} out;
};
struct libnet_SamDump_keytab {
struct {
const char *binding_string;
const char *keytab_name;
struct cli_credentials *machine_account;
} in;
struct {
const char *error_string;
} out;
};
struct libnet_samsync_ldb {
struct {
const char *binding_string;
struct cli_credentials *machine_account;
struct auth_session_info *session_info;
} in;
struct {
const char *error_string;
} out;
};

1010
source4/libnet/libnet_vampire.c
View File

File diff suppressed because it is too large Load Diff

70
source4/libnet/libnet_vampire.h
View File

@ -1,7 +1,9 @@
/*
Unix SMB/CIFS implementation.
Copyright (C) Stefan Metzmacher 2004
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
Copyright (C) Brad Henry 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@ -17,68 +19,22 @@
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "librpc/gen_ndr/netlogon.h"
#ifndef __LIBNET_VAMPIRE_H__
#define __LIBNET_VAMPIRE_H__
struct libnet_SamSync_state {
struct libnet_context *machine_net_ctx;
struct dcerpc_pipe *netlogon_pipe;
const char *domain_name;
const struct dom_sid *domain_sid;
const char *realm;
struct GUID *domain_guid;
};
/* struct and enum for doing a remote domain vampire dump */
struct libnet_SamSync {
struct libnet_Vampire {
struct {
const char *binding_string;
bool rid_crypt;
NTSTATUS (*init_fn)(TALLOC_CTX *mem_ctx,
void *private,
struct libnet_SamSync_state *samsync_state,
char **error_string);
NTSTATUS (*delta_fn)(TALLOC_CTX *mem_ctx,
void *private,
enum netr_SamDatabaseID database,
struct netr_DELTA_ENUM *delta,
char **error_string);
void *fn_ctx;
struct cli_credentials *machine_account;
const char *domain_name;
const char *netbios_name;
const char *targetdir;
} in;
struct {
struct dom_sid *domain_sid;
const char *domain_name;
const char *error_string;
} out;
};
struct libnet_SamDump {
struct {
const char *binding_string;
struct cli_credentials *machine_account;
} in;
struct {
const char *error_string;
} out;
};
struct libnet_SamDump_keytab {
struct {
const char *binding_string;
const char *keytab_name;
struct cli_credentials *machine_account;
} in;
struct {
const char *error_string;
} out;
};
struct libnet_samsync_ldb {
struct {
const char *binding_string;
struct cli_credentials *machine_account;
struct auth_session_info *session_info;
} in;
struct {
const char *error_string;
} out;
};
#endif /* __LIBNET_VAMPIRE_H__ */

6
source4/param/provision.c
View File

@ -64,14 +64,12 @@ NTSTATUS provision_bare(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx,
return NT_STATUS_UNSUCCESSFUL;
}
DEBUG(0,("New Server[%s] in Site[%s]\n", settings->dns_name,
settings->site_name));
DEBUG(0,("New Server in Site[%s]\n",
settings->site_name));
DEBUG(0,("DSA Instance [%s]\n"
"\tobjectGUID[%s]\n"
"\tinvocationId[%s]\n",
settings->ntds_dn_str,
settings->ntds_guid == NULL?"None":GUID_string(mem_ctx, settings->ntds_guid),
settings->invocation_id == NULL?"None":GUID_string(mem_ctx, settings->invocation_id)));
DEBUG(0,("Pathes under targetdir[%s]\n",

2
source4/param/provision.h
View File

@ -21,7 +21,6 @@
#define _PROVISION_H_
struct provision_settings {
const char *dns_name;
const char *site_name;
const char *root_dn_str;
const char *domain_dn_str;
@ -33,7 +32,6 @@ struct provision_settings {
const char *host_ip;
const char *realm;
const char *domain;
const struct GUID *ntds_guid;
const char *ntds_dn_str;
const char *machine_password;
const char *targetdir;

49
source4/scripting/python/samba/provision.py
View File

@ -87,6 +87,7 @@ class ProvisionNames:
self.domain = None
self.hostname = None
self.sitename = None
self.smbconf = None
class ProvisionResult:
def __init__(self):
@ -262,6 +263,8 @@ def provision_paths_from_lp(lp, dnsdomain):
paths.netlogon = lp.get("path", "netlogon")
paths.smbconf = lp.configfile()
return paths
@ -690,6 +693,7 @@ def setup_self_join(samdb, names,
"CONFIGDN": names.configdn,
"SCHEMADN": names.schemadn,
"DOMAINDN": names.domaindn,
"SERVERDN": names.serverdn,
"INVOCATIONID": invocationid,
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": names.sitename,
@ -737,8 +741,6 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
return samdb
message("Pre-loading the Samba 4 and AD schema")
samdb = SamDB(path, session_info=session_info,
credentials=credentials, lp=lp)
samdb.set_domain_sid(domainsid)
if serverrole == "domain controller":
samdb.set_invocation_id(invocationid)
@ -773,6 +775,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": names.sitename,
"CONFIGDN": names.configdn,
"SERVERDN": names.serverdn,
"POLICYGUID": policyguid,
"DOMAINDN": names.domaindn,
"DOMAINGUID_MOD": domainguid_mod,
@ -803,6 +806,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": names.sitename,
"CONFIGDN": names.configdn,
"SERVERDN": names.serverdn
})
message("Setting up sam.ldb Samba4 schema")
@ -821,6 +825,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
"DOMAIN": names.domain,
"SCHEMADN": names.schemadn,
"DOMAINDN": names.domaindn,
"SERVERDN": names.serverdn
})
message("Setting up display specifiers")
@ -845,6 +850,7 @@ def setup_samdb(path, setup_path, session_info, credentials, lp,
"NETBIOSNAME": names.netbiosname,
"DEFAULTSITE": names.sitename,
"CONFIGDN": names.configdn,
"SERVERDN": names.serverdn
})
if fill == FILL_FULL:
@ -1004,20 +1010,25 @@ def provision(setup_dir, message, session_info,
ldap_backend_type=ldap_backend_type)
if lp.get("server role") == "domain controller":
policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
"{" + policyguid + "}")
os.makedirs(policy_path, 0755)
os.makedirs(os.path.join(policy_path, "Machine"), 0755)
os.makedirs(os.path.join(policy_path, "User"), 0755)
if not os.path.isdir(paths.netlogon):
if paths.netlogon is None:
message("Existing smb.conf does not have a [netlogon] share, but you are configuring a DC.")
message("Please either remove %s or see the template at %s" %
( paths.smbconf, setup_path("provision.smb.conf.dc")))
assert(paths.netlogon is not None)
if paths.sysvol is None:
message("Existing smb.conf does not have a [sysvol] share, but you are configuring a DC.")
message("Please either remove %s or see the template at %s" %
(paths.smbconf, setup_path("provision.smb.conf.dc")))
assert(paths.sysvol is not None)
policy_path = os.path.join(paths.sysvol, names.dnsdomain, "Policies",
"{" + policyguid + "}")
os.makedirs(policy_path, 0755)
os.makedirs(os.path.join(policy_path, "Machine"), 0755)
os.makedirs(os.path.join(policy_path, "User"), 0755)
if not os.path.isdir(paths.netlogon):
os.makedirs(paths.netlogon, 0755)
secrets_ldb = Ldb(paths.secrets, session_info=session_info,
credentials=credentials, lp=lp)
secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
netbiosname=names.netbiosname, domainsid=domainsid,
keytab_path=paths.keytab, samdb_url=paths.samdb,
dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
machinepass=machinepass, dnsdomain=names.dnsdomain)
if samdb_fill == FILL_FULL:
setup_name_mappings(samdb, idmap, str(domainsid), names.domaindn,
@ -1029,6 +1040,14 @@ def provision(setup_dir, message, session_info,
# Only make a zone file on the first DC, it should be replicated with DNS replication
if serverrole == "domain controller":
secrets_ldb = Ldb(paths.secrets, session_info=session_info,
credentials=credentials, lp=lp)
secretsdb_become_dc(secrets_ldb, setup_path, domain=domain, realm=names.realm,
netbiosname=names.netbiosname, domainsid=domainsid,
keytab_path=paths.keytab, samdb_url=paths.samdb,
dns_keytab_path=paths.dns_keytab, dnspass=dnspass,
machinepass=machinepass, dnsdomain=names.dnsdomain)
samdb = SamDB(paths.samdb, session_info=session_info,
credentials=credentials, lp=lp)

4
source4/setup/provision.ldif
View File

@ -30,7 +30,7 @@ objectclass: rIDManager
cn: RID Manager$
systemFlags: 2348810240
isCriticalSystemObject: TRUE
fSMORoleOwner: CN=NTDS Settings,CN=${NETBIOSNAME},CN=Servers,CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
fSMORoleOwner: CN=NTDS Settings,${SERVERDN}
rIDAvailablePool: 4611686014132423217
dn: CN=DomainUpdates,CN=System,${DOMAINDN}
@ -50,7 +50,7 @@ objectclass: infrastructureUpdate
cn: Infrastructure
systemFlags: 2348810240
isCriticalSystemObject: TRUE
fSMORoleOwner: CN=NTDS Settings,CN=${NETBIOSNAME},CN=Servers,CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
fSMORoleOwner: CN=NTDS Settings,${SERVERDN}
dn: CN=Builtin,${DOMAINDN}
objectClass: top

2
source4/setup/provision_basedn_modify.ldif
View File

@ -65,7 +65,7 @@ replace: objectCategory
objectCategory: CN=Domain-DNS,${SCHEMADN}
-
replace: fSMORoleOwner
fSMORoleOwner: CN=NTDS Settings,CN=${NETBIOSNAME},CN=Servers,CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
fSMORoleOwner: CN=NTDS Settings,${SERVERDN}
-
replace: isCriticalSystemObject
isCriticalSystemObject: TRUE

2
source4/setup/provision_configuration.ldif
View File

@ -7,7 +7,7 @@ objectClass: crossRefContainer
cn: Partitions
systemFlags: 2147483648
msDS-Behavior-Version: 0
fSMORoleOwner: CN=NTDS Settings,CN=${NETBIOSNAME},CN=Servers,CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
fSMORoleOwner: CN=NTDS Settings,${SERVERDN}
dn: CN=Enterprise Configuration,CN=Partitions,${CONFIGDN}
objectClass: top

2
source4/setup/provision_schema_basedn_modify.ldif
View File

@ -4,7 +4,7 @@
dn: ${SCHEMADN}
changetype: modify
replace: fSMORoleOwner
fSMORoleOwner: CN=NTDS Settings,CN=${NETBIOSNAME},CN=Servers,CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
fSMORoleOwner: CN=NTDS Settings,${SERVERDN}
-
replace: objectVersion
objectVersion: 30

4
source4/setup/provision_self_join.ldif
View File

@ -36,7 +36,7 @@ isCriticalSystemObject: TRUE
sambaPassword:: ${DNSPASS_B64}
showInAdvancedViewOnly: TRUE
dn: CN=${NETBIOSNAME},CN=Servers,CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
dn: ${SERVERDN}
objectClass: top
objectClass: server
cn: ${NETBIOSNAME}
@ -44,7 +44,7 @@ systemFlags: 1375731712
dNSHostName: ${DNSNAME}
serverReference: CN=${NETBIOSNAME},OU=Domain Controllers,${DOMAINDN}
dn: CN=NTDS Settings,CN=${NETBIOSNAME},CN=Servers,CN=${DEFAULTSITE},CN=Sites,${CONFIGDN}
dn: CN=NTDS Settings,${SERVERDN}
objectClass: top
objectClass: applicationSettings
objectClass: nTDSDSA

2
source4/setup/tests/blackbox_provision.sh
View File

@ -31,6 +31,8 @@ testit "simple-default" $PYTHON ./setup/provision $CONFIGURATION --domain=FOO --
testit "simple-dc" $PYTHON ./setup/provision $CONFIGURATION --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc
testit "simple-member" $PYTHON ./setup/provision $CONFIGURATION --server-role="member" --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple-member
testit "simple-standalone" $PYTHON ./setup/provision $CONFIGURATION --server-role="standalone" --domain=FOO --realm=foo.example.com --targetdir=$PREFIX/simple-standalone
testit "blank-dc" $PYTHON ./setup/provision $CONFIGURATION --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc --blank
testit "partitions-only-dc" $PYTHON ./setup/provision $CONFIGURATION --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc --partitions-only
reprovision() {
$PYTHON ./setup/provision $CONFIGURATION --domain=FOO --realm=foo.example.com --targetdir="$PREFIX/reprovision"

39
source4/torture/libnet/libnet_BecomeDC.c
View File

@ -69,15 +69,7 @@ static NTSTATUS test_become_dc_prepare_db(void *private_data,
struct provision_settings settings;
struct provision_result result;
NTSTATUS status;
bool ok;
struct loadparm_context *lp_ctx = loadparm_init(s);
char *smbconf;
if (!lp_ctx) {
return NT_STATUS_NO_MEMORY;
}
settings.dns_name = p->dest_dsa->dns_name;
settings.site_name = p->dest_dsa->site_name;
settings.root_dn_str = p->forest->root_dn_str;
settings.domain_dn_str = p->domain->dn_str;
@ -92,35 +84,8 @@ static NTSTATUS test_become_dc_prepare_db(void *private_data,
status = provision_bare(s, s->lp_ctx, &settings, &result);
smbconf = talloc_asprintf(lp_ctx, "%s/%s", s->targetdir, "/etc/smb.conf");
ok = lp_load(lp_ctx, smbconf);
if (!ok) {
DEBUG(0,("Failed load freshly generated smb.conf '%s'\n", smbconf));
return NT_STATUS_INVALID_PARAMETER;
}
s->ldb = ldb_wrap_connect(s, lp_ctx, lp_sam_url(lp_ctx),
system_session(s, lp_ctx),
NULL, 0, NULL);
if (!s->ldb) {
DEBUG(0,("Failed to open '%s'\n", lp_sam_url(lp_ctx)));
return NT_STATUS_INTERNAL_DB_ERROR;
}
ok = samdb_set_ntds_invocation_id(s->ldb, &p->dest_dsa->invocation_id);
if (!ok) {
DEBUG(0,("Failed to set cached ntds invocationId\n"));
return NT_STATUS_FOOBAR;
}
ok = samdb_set_ntds_objectGUID(s->ldb, &p->dest_dsa->ntds_guid);
if (!ok) {
DEBUG(0,("Failed to set cached ntds objectGUID\n"));
return NT_STATUS_FOOBAR;
}
s->lp_ctx = lp_ctx;
s->ldb = result.samdb;
s->lp_ctx = result.lp_ctx;
return NT_STATUS_OK;

5
source4/torture/local/torture.c
View File

@ -43,7 +43,7 @@ static bool test_tempdir(struct torture_context *tctx)
static bool test_provision(struct torture_context *tctx)
{
NTSTATUS status;
struct provision_settings *settings = talloc(tctx, struct provision_settings);
struct provision_settings *settings = talloc_zero(tctx, struct provision_settings);
struct provision_result result;
char *targetdir = NULL;
@ -51,7 +51,6 @@ static bool test_provision(struct torture_context *tctx)
"torture_temp_dir should return NT_STATUS_OK" );
settings->targetdir = talloc_steal(settings, targetdir);
settings->dns_name = "example.com";
settings->site_name = "SOME-SITE-NAME";
settings->root_dn_str = "DC=EXAMPLE,DC=COM";
settings->domain_dn_str = "DC=EXAMPLE,DC=COM";
@ -61,7 +60,7 @@ static bool test_provision(struct torture_context *tctx)
settings->netbios_name = "FOO";
settings->realm = "EXAMPLE.COM";
settings->domain = "EXAMPLE";
settings->ntds_guid = NULL;
settings->netbios_name = "torture";
settings->ntds_dn_str = NULL;
settings->machine_password = "geheim";

3
source4/utils/net/net.c
View File

@ -102,7 +102,8 @@ static const struct net_functable net_functable[] = {
{"time", "get remote server's time\n", net_time, net_time_usage},
{"join", "join a domain\n", net_join, net_join_usage},
{"samdump", "dump the sam of a domain\n", net_samdump, net_samdump_usage},
{"samsync", "synchronise into the local ldb the sam of a domain\n", net_samsync_ldb, net_samsync_ldb_usage},
{"vampire", "join and syncronise an AD domain onto the local server\n", net_vampire, net_vampire_usage},
{"samsync", "synchronise into the local ldb the sam of an NT4 domain\n", net_samsync_ldb, net_samsync_ldb_usage},
{"user", "manage user accounts\n", net_user, net_user_usage},
{NULL, NULL, NULL, NULL}
};

67
source4/utils/net/net_join.c
View File

@ -100,3 +100,70 @@ int net_join_help(struct net_context *ctx, int argc, const char **argv)
d_printf("Joins domain as either member or backup domain controller.\n");
return 0;
}
int net_vampire(struct net_context *ctx, int argc, const char **argv)
{
NTSTATUS status;
struct libnet_context *libnetctx;
struct libnet_Vampire *r;
char *tmp, *targetdir = NULL;
const char *domain_name;
switch (argc) {
case 0: /* no args -> fail */
return net_vampire_usage(ctx, argc, argv);
case 1: /* only DOMAIN */
tmp = talloc_strdup(ctx->mem_ctx, argv[0]);
break;
case 2: /* domain and target dir */
tmp = talloc_strdup(ctx->mem_ctx, argv[0]);
targetdir = talloc_strdup(ctx->mem_ctx, argv[1]);
break;
default: /* too many args -> fail */
return net_vampire_usage(ctx, argc, argv);
}
domain_name = tmp;
libnetctx = libnet_context_init(NULL, ctx->lp_ctx);
if (!libnetctx) {
return -1;
}
libnetctx->cred = ctx->credentials;
r = talloc(ctx->mem_ctx, struct libnet_Vampire);
if (!r) {
return -1;
}
/* prepare parameters for the vampire */
r->in.netbios_name = lp_netbios_name(ctx->lp_ctx);
r->in.domain_name = domain_name;
r->in.targetdir = targetdir;
r->out.error_string = NULL;
/* do the domain vampire */
status = libnet_Vampire(libnetctx, r, r);
if (!NT_STATUS_IS_OK(status)) {
d_fprintf(stderr, "Vampire of domain failed: %s\n",
r->out.error_string ? r->out.error_string : nt_errstr(status));
talloc_free(r);
talloc_free(libnetctx);
return -1;
}
d_printf("Vampired domain %s (%s)\n", r->out.domain_name, dom_sid_string(ctx->mem_ctx, r->out.domain_sid));
talloc_free(libnetctx);
return 0;
}
int net_vampire_usage(struct net_context *ctx, int argc, const char **argv)
{
d_printf("net vampire <domain> [options]\n");
return 0;
}
int net_vampire_help(struct net_context *ctx, int argc, const char **argv)
{
d_printf("Vampires domain as either member or backup domain controller.\n");
return 0;
}

2
source4/utils/net/net_vampire.c
View File

@ -169,7 +169,7 @@ int net_samsync_ldb(struct net_context *ctx, int argc, const char **argv)
int net_samsync_ldb_usage(struct net_context *ctx, int argc, const char **argv)
{
d_printf("net samsync_ldb\n");
d_printf("net samsync\n");
return 0;
}

10
source4/winbind/wb_sids2xids.c
View File

@ -67,15 +67,13 @@ NTSTATUS wb_sids2xids_recv(struct composite_context *ctx,
struct id_mapping **ids)
{
NTSTATUS status = composite_wait(ctx);
struct sids2xids_state *state = talloc_get_type(ctx->private_data,
struct sids2xids_state);
DEBUG(5, ("wb_sids2xids_recv called\n"));
if (NT_STATUS_IS_OK(status)) {
struct sids2xids_state *state =
talloc_get_type(ctx->private_data,
struct sids2xids_state);
*ids = state->ids;
}
*ids = state->ids;
talloc_free(ctx);
return status;
}

10
source4/winbind/wb_xids2sids.c
View File

@ -67,15 +67,13 @@ NTSTATUS wb_xids2sids_recv(struct composite_context *ctx,
struct id_mapping **ids)
{
NTSTATUS status = composite_wait(ctx);
struct xids2sids_state *state = talloc_get_type(ctx->private_data,
struct xids2sids_state);
DEBUG(5, ("wb_xids2sids_recv called.\n"));
if (NT_STATUS_IS_OK(status)) {
struct xids2sids_state *state =
talloc_get_type(ctx->private_data,
struct xids2sids_state);
*ids = state->ids;
}
*ids = state->ids;
talloc_free(ctx);
return status;
}