1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
samba-mirror/source3/libnet/libnet_samsync.c
2010-08-08 11:05:18 +02:00

412 lines
9.4 KiB
C

/*
Unix SMB/CIFS implementation.
Extract the user/system database from a remote SamSync server
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
Copyright (C) Guenther Deschner <gd@samba.org> 2008
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "libnet/libnet_samsync.h"
#include "../lib/crypto/crypto.h"
#include "../libcli/samsync/samsync.h"
#include "../libcli/auth/libcli_auth.h"
#include "../librpc/gen_ndr/ndr_netlogon.h"
#include "../librpc/gen_ndr/cli_netlogon.h"
/**
* Fix up the delta, dealing with encryption issues so that the final
* callback need only do the printing or application logic
*/
static NTSTATUS samsync_fix_delta_array(TALLOC_CTX *mem_ctx,
struct netlogon_creds_CredentialState *creds,
enum netr_SamDatabaseID database_id,
struct netr_DELTA_ENUM_ARRAY *r)
{
NTSTATUS status;
int i;
for (i = 0; i < r->num_deltas; i++) {
status = samsync_fix_delta(mem_ctx,
creds,
database_id,
&r->delta_enum[i]);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
}
return NT_STATUS_OK;
}
/**
* libnet_samsync_init_context
*/
NTSTATUS libnet_samsync_init_context(TALLOC_CTX *mem_ctx,
const struct dom_sid *domain_sid,
struct samsync_context **ctx_p)
{
struct samsync_context *ctx;
*ctx_p = NULL;
ctx = TALLOC_ZERO_P(mem_ctx, struct samsync_context);
NT_STATUS_HAVE_NO_MEMORY(ctx);
if (domain_sid) {
ctx->domain_sid = sid_dup_talloc(mem_ctx, domain_sid);
NT_STATUS_HAVE_NO_MEMORY(ctx->domain_sid);
ctx->domain_sid_str = sid_string_talloc(mem_ctx, ctx->domain_sid);
NT_STATUS_HAVE_NO_MEMORY(ctx->domain_sid_str);
}
*ctx_p = ctx;
return NT_STATUS_OK;
}
/**
* samsync_database_str
*/
static const char *samsync_database_str(enum netr_SamDatabaseID database_id)
{
switch (database_id) {
case SAM_DATABASE_DOMAIN:
return "DOMAIN";
case SAM_DATABASE_BUILTIN:
return "BUILTIN";
case SAM_DATABASE_PRIVS:
return "PRIVS";
default:
return "unknown";
}
}
/**
* samsync_debug_str
*/
static const char *samsync_debug_str(TALLOC_CTX *mem_ctx,
enum net_samsync_mode mode,
enum netr_SamDatabaseID database_id)
{
const char *action = NULL;
switch (mode) {
case NET_SAMSYNC_MODE_DUMP:
action = "Dumping (to stdout)";
break;
case NET_SAMSYNC_MODE_FETCH_PASSDB:
action = "Fetching (to passdb)";
break;
case NET_SAMSYNC_MODE_FETCH_LDIF:
action = "Fetching (to ldif)";
break;
case NET_SAMSYNC_MODE_FETCH_KEYTAB:
action = "Fetching (to keytab)";
break;
default:
action = "Unknown";
break;
}
return talloc_asprintf(mem_ctx, "%s %s database",
action, samsync_database_str(database_id));
}
/**
* libnet_samsync
*/
static void libnet_init_netr_ChangeLogEntry(struct samsync_object *o,
struct netr_ChangeLogEntry *e)
{
ZERO_STRUCTP(e);
e->db_index = o->database_id;
e->delta_type = o->object_type;
switch (e->delta_type) {
case NETR_DELTA_DOMAIN:
case NETR_DELTA_DELETE_GROUP:
case NETR_DELTA_RENAME_GROUP:
case NETR_DELTA_DELETE_USER:
case NETR_DELTA_RENAME_USER:
case NETR_DELTA_DELETE_ALIAS:
case NETR_DELTA_RENAME_ALIAS:
case NETR_DELTA_DELETE_TRUST:
case NETR_DELTA_DELETE_ACCOUNT:
case NETR_DELTA_DELETE_SECRET:
case NETR_DELTA_DELETE_GROUP2:
case NETR_DELTA_DELETE_USER2:
case NETR_DELTA_MODIFY_COUNT:
break;
case NETR_DELTA_USER:
case NETR_DELTA_GROUP:
case NETR_DELTA_GROUP_MEMBER:
case NETR_DELTA_ALIAS:
case NETR_DELTA_ALIAS_MEMBER:
e->object_rid = o->object_identifier.rid;
break;
case NETR_DELTA_SECRET:
e->object.object_name = o->object_identifier.name;
e->flags = NETR_CHANGELOG_NAME_INCLUDED;
break;
case NETR_DELTA_TRUSTED_DOMAIN:
case NETR_DELTA_ACCOUNT:
case NETR_DELTA_POLICY:
e->object.object_sid = o->object_identifier.sid;
e->flags = NETR_CHANGELOG_SID_INCLUDED;
break;
default:
break;
}
}
/**
* libnet_samsync_delta
*/
static NTSTATUS libnet_samsync_delta(TALLOC_CTX *mem_ctx,
enum netr_SamDatabaseID database_id,
uint64_t *sequence_num,
struct samsync_context *ctx,
struct netr_ChangeLogEntry *e)
{
NTSTATUS result;
NTSTATUS callback_status;
const char *logon_server = ctx->cli->desthost;
const char *computername = global_myname();
struct netr_Authenticator credential;
struct netr_Authenticator return_authenticator;
uint16_t restart_state = 0;
uint32_t sync_context = 0;
ZERO_STRUCT(return_authenticator);
do {
struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
netlogon_creds_client_authenticator(ctx->cli->dc, &credential);
if (ctx->single_object_replication &&
!ctx->force_full_replication) {
result = rpccli_netr_DatabaseRedo(ctx->cli, mem_ctx,
logon_server,
computername,
&credential,
&return_authenticator,
*e,
0,
&delta_enum_array);
} else if (!ctx->force_full_replication &&
sequence_num && (*sequence_num > 0)) {
result = rpccli_netr_DatabaseDeltas(ctx->cli, mem_ctx,
logon_server,
computername,
&credential,
&return_authenticator,
database_id,
sequence_num,
&delta_enum_array,
0xffff);
} else {
result = rpccli_netr_DatabaseSync2(ctx->cli, mem_ctx,
logon_server,
computername,
&credential,
&return_authenticator,
database_id,
restart_state,
&sync_context,
&delta_enum_array,
0xffff);
}
if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) {
return result;
}
/* Check returned credentials. */
if (!netlogon_creds_client_check(ctx->cli->dc,
&return_authenticator.cred)) {
DEBUG(0,("credentials chain check failed\n"));
return NT_STATUS_ACCESS_DENIED;
}
if (NT_STATUS_IS_ERR(result)) {
break;
}
samsync_fix_delta_array(mem_ctx,
ctx->cli->dc,
database_id,
delta_enum_array);
/* Process results */
callback_status = ctx->ops->process_objects(mem_ctx, database_id,
delta_enum_array,
sequence_num,
ctx);
if (!NT_STATUS_IS_OK(callback_status)) {
result = callback_status;
goto out;
}
TALLOC_FREE(delta_enum_array);
} while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
out:
return result;
}
/**
* libnet_samsync
*/
NTSTATUS libnet_samsync(enum netr_SamDatabaseID database_id,
struct samsync_context *ctx)
{
NTSTATUS status = NT_STATUS_OK;
NTSTATUS callback_status;
TALLOC_CTX *mem_ctx;
const char *debug_str;
uint64_t sequence_num = 0;
int i = 0;
if (!(mem_ctx = talloc_new(ctx))) {
return NT_STATUS_NO_MEMORY;
}
if (!ctx->ops) {
return NT_STATUS_INVALID_PARAMETER;
}
if (ctx->ops->startup) {
status = ctx->ops->startup(mem_ctx, ctx,
database_id, &sequence_num);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
}
debug_str = samsync_debug_str(mem_ctx, ctx->mode, database_id);
if (debug_str) {
d_fprintf(stderr, "%s\n", debug_str);
}
if (!ctx->single_object_replication) {
status = libnet_samsync_delta(mem_ctx, database_id,
&sequence_num, ctx, NULL);
goto done;
}
for (i=0; i<ctx->num_objects; i++) {
struct netr_ChangeLogEntry e;
if (ctx->objects[i].database_id != database_id) {
continue;
}
libnet_init_netr_ChangeLogEntry(&ctx->objects[i], &e);
status = libnet_samsync_delta(mem_ctx, database_id,
&sequence_num, ctx, &e);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
}
done:
if (NT_STATUS_IS_OK(status) && ctx->ops->finish) {
callback_status = ctx->ops->finish(mem_ctx, ctx,
database_id, sequence_num);
if (!NT_STATUS_IS_OK(callback_status)) {
status = callback_status;
}
}
if (NT_STATUS_IS_ERR(status) && !ctx->error_message) {
ctx->error_message = talloc_asprintf(ctx,
"Failed to fetch %s database: %s",
samsync_database_str(database_id),
nt_errstr(status));
if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
ctx->error_message =
talloc_asprintf_append(ctx->error_message,
"\nPerhaps %s is a Windows native mode domain?",
ctx->domain_name);
}
}
talloc_destroy(mem_ctx);
return status;
}
/**
* pull_netr_AcctLockStr
*/
NTSTATUS pull_netr_AcctLockStr(TALLOC_CTX *mem_ctx,
struct lsa_BinaryString *r,
struct netr_AcctLockStr **str_p)
{
struct netr_AcctLockStr *str;
enum ndr_err_code ndr_err;
DATA_BLOB blob;
if (!mem_ctx || !r || !str_p) {
return NT_STATUS_INVALID_PARAMETER;
}
*str_p = NULL;
str = TALLOC_ZERO_P(mem_ctx, struct netr_AcctLockStr);
if (!str) {
return NT_STATUS_NO_MEMORY;
}
blob = data_blob_const(r->array, r->length);
ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, str,
(ndr_pull_flags_fn_t)ndr_pull_netr_AcctLockStr);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return ndr_map_error2ntstatus(ndr_err);
}
*str_p = str;
return NT_STATUS_OK;
}