1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
24 */
25
26 #include <sys/param.h>
27 #include <ldap.h>
28 #include <stdlib.h>
29 #include <sys/types.h>
30 #include <sys/socket.h>
31 #include <netinet/in.h>
32 #include <arpa/inet.h>
33 #include <sys/time.h>
34 #include <netdb.h>
35 #include <pthread.h>
36 #include <unistd.h>
37 #include <arpa/nameser.h>
38 #include <resolv.h>
39 #include <sys/synch.h>
40 #include <string.h>
41 #include <strings.h>
42 #include <fcntl.h>
43 #include <sys/types.h>
44 #include <sys/stat.h>
45 #include <assert.h>
46 #include <sasl/sasl.h>
47 #include <note.h>
48 #include <errno.h>
49 #include <cryptoutil.h>
50
51 #include <smbsrv/libsmbns.h>
52 #include <smbns_dyndns.h>
53 #include <smbns_krb.h>
54
55 #define SMB_ADS_AF_UNKNOWN(x) (((x)->ipaddr.a_family != AF_INET) && \
56 ((x)->ipaddr.a_family != AF_INET6))
57
58 #define SMB_ADS_MAXBUFLEN 100
59 #define SMB_ADS_DN_MAX 300
60 #define SMB_ADS_MAXMSGLEN 512
61 #define SMB_ADS_COMPUTERS_CN "Computers"
62 #define SMB_ADS_COMPUTER_NUM_ATTR 8
63 #define SMB_ADS_SHARE_NUM_ATTR 3
64 #define SMB_ADS_SITE_MAX MAXHOSTNAMELEN
65
66 #define SMB_ADS_MSDCS_SRV_DC_RR "_ldap._tcp.dc._msdcs"
67 #define SMB_ADS_MSDCS_SRV_SITE_RR "_ldap._tcp.%s._sites.dc._msdcs"
68
69 /*
70 * domainControllerFunctionality
71 *
72 * This rootDSE attribute indicates the functional level of the DC.
73 */
74 #define SMB_ADS_ATTR_DCLEVEL "domainControllerFunctionality"
75 #define SMB_ADS_DCLEVEL_W2K 0
76 #define SMB_ADS_DCLEVEL_W2K3 2
77 #define SMB_ADS_DCLEVEL_W2K8 3
78 #define SMB_ADS_DCLEVEL_W2K8_R2 4
79
80 /*
81 * msDs-supportedEncryptionTypes (Windows Server 2008 only)
82 *
83 * This attribute defines the encryption types supported by the system.
84 * Encryption Types:
85 * - DES cbc mode with CRC-32
86 * - DES cbc mode with RSA-MD5
87 * - ArcFour with HMAC/md5
88 * - AES-128
89 * - AES-256
90 */
91 #define SMB_ADS_ATTR_ENCTYPES "msDs-supportedEncryptionTypes"
92 #define SMB_ADS_ENC_DES_CRC 1
93 #define SMB_ADS_ENC_DES_MD5 2
94 #define SMB_ADS_ENC_RC4 4
95 #define SMB_ADS_ENC_AES128 8
96 #define SMB_ADS_ENC_AES256 16
97
98 static krb5_enctype w2k8enctypes[] = {
99 ENCTYPE_AES256_CTS_HMAC_SHA1_96,
100 ENCTYPE_AES128_CTS_HMAC_SHA1_96,
101 ENCTYPE_ARCFOUR_HMAC,
102 ENCTYPE_DES_CBC_CRC,
103 ENCTYPE_DES_CBC_MD5,
104 };
105
106 static krb5_enctype pre_w2k8enctypes[] = {
107 ENCTYPE_ARCFOUR_HMAC,
108 ENCTYPE_DES_CBC_CRC,
109 ENCTYPE_DES_CBC_MD5,
110 };
111
112 #define SMB_ADS_ATTR_SAMACCT "sAMAccountName"
113 #define SMB_ADS_ATTR_UPN "userPrincipalName"
114 #define SMB_ADS_ATTR_SPN "servicePrincipalName"
115 #define SMB_ADS_ATTR_CTL "userAccountControl"
116 #define SMB_ADS_ATTR_DNSHOST "dNSHostName"
117 #define SMB_ADS_ATTR_KVNO "msDS-KeyVersionNumber"
118 #define SMB_ADS_ATTR_DN "distinguishedName"
119
120 /*
121 * UserAccountControl flags: manipulate user account properties.
122 *
123 * The hexadecimal value of the following property flags are based on MSDN
124 * article # 305144.
125 */
126 #define SMB_ADS_USER_ACCT_CTL_SCRIPT 0x00000001
127 #define SMB_ADS_USER_ACCT_CTL_ACCOUNTDISABLE 0x00000002
128 #define SMB_ADS_USER_ACCT_CTL_HOMEDIR_REQUIRED 0x00000008
129 #define SMB_ADS_USER_ACCT_CTL_LOCKOUT 0x00000010
130 #define SMB_ADS_USER_ACCT_CTL_PASSWD_NOTREQD 0x00000020
131 #define SMB_ADS_USER_ACCT_CTL_PASSWD_CANT_CHANGE 0x00000040
132 #define SMB_ADS_USER_ACCT_CTL_ENCRYPTED_TEXT_PWD_ALLOWED 0x00000080
133 #define SMB_ADS_USER_ACCT_CTL_TMP_DUP_ACCT 0x00000100
134 #define SMB_ADS_USER_ACCT_CTL_NORMAL_ACCT 0x00000200
135 #define SMB_ADS_USER_ACCT_CTL_INTERDOMAIN_TRUST_ACCT 0x00000800
136 #define SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT 0x00001000
137 #define SMB_ADS_USER_ACCT_CTL_SRV_TRUST_ACCT 0x00002000
138 #define SMB_ADS_USER_ACCT_CTL_DONT_EXPIRE_PASSWD 0x00010000
139 #define SMB_ADS_USER_ACCT_CTL_MNS_LOGON_ACCT 0x00020000
140 #define SMB_ADS_USER_ACCT_CTL_SMARTCARD_REQUIRED 0x00040000
141 #define SMB_ADS_USER_ACCT_CTL_TRUSTED_FOR_DELEGATION 0x00080000
142 #define SMB_ADS_USER_ACCT_CTL_NOT_DELEGATED 0x00100000
143 #define SMB_ADS_USER_ACCT_CTL_USE_DES_KEY_ONLY 0x00200000
144 #define SMB_ADS_USER_ACCT_CTL_DONT_REQ_PREAUTH 0x00400000
145 #define SMB_ADS_USER_ACCT_CTL_PASSWD_EXPIRED 0x00800000
146 #define SMB_ADS_USER_ACCT_CTL_TRUSTED_TO_AUTH_FOR_DELEGATION 0x01000000
147
148 /*
149 * Length of "dc=" prefix.
150 */
151 #define SMB_ADS_DN_PREFIX_LEN 3
152
153 static char *smb_ads_computer_objcls[] = {
154 "top", "person", "organizationalPerson",
155 "user", "computer", NULL
156 };
157
158 static char *smb_ads_share_objcls[] = {
159 "top", "leaf", "connectionPoint", "volume", NULL
160 };
161
162 /* Cached ADS server to communicate with */
163 static smb_ads_host_info_t *smb_ads_cached_host_info = NULL;
164 static mutex_t smb_ads_cached_host_mtx;
165
166 /*
167 * SMB ADS config cache is maintained to facilitate the detection of
168 * changes in configuration that is relevant to AD selection.
169 */
170 typedef struct smb_ads_config {
171 char c_site[SMB_ADS_SITE_MAX];
172 smb_inaddr_t c_pdc;
173 mutex_t c_mtx;
174 } smb_ads_config_t;
175
176 static smb_ads_config_t smb_ads_cfg;
177
178
179 /* attribute/value pair */
180 typedef struct smb_ads_avpair {
181 char *avp_attr;
182 char *avp_val;
183 } smb_ads_avpair_t;
184
185 /* query status */
186 typedef enum smb_ads_qstat {
187 SMB_ADS_STAT_ERR = -2,
188 SMB_ADS_STAT_DUP,
189 SMB_ADS_STAT_NOT_FOUND,
190 SMB_ADS_STAT_FOUND
191 } smb_ads_qstat_t;
192
193 typedef struct smb_ads_host_list {
194 int ah_cnt;
195 smb_ads_host_info_t *ah_list;
196 } smb_ads_host_list_t;
197
198 static smb_ads_handle_t *smb_ads_open_main(char *, char *, char *);
199 static int smb_ads_add_computer(smb_ads_handle_t *, int, char *);
200 static int smb_ads_modify_computer(smb_ads_handle_t *, int, char *);
201 static int smb_ads_computer_op(smb_ads_handle_t *, int, int, char *);
202 static smb_ads_qstat_t smb_ads_lookup_computer_n_attr(smb_ads_handle_t *,
203 smb_ads_avpair_t *, int, char *);
204 static int smb_ads_update_computer_cntrl_attr(smb_ads_handle_t *, int, char *);
205 static krb5_kvno smb_ads_lookup_computer_attr_kvno(smb_ads_handle_t *, char *);
206 static void smb_ads_free_cached_host(void);
207 static int smb_ads_alloc_attr(LDAPMod **, int);
208 static void smb_ads_free_attr(LDAPMod **);
209 static int smb_ads_get_dc_level(smb_ads_handle_t *);
210 static smb_ads_host_info_t *smb_ads_select_dc(smb_ads_host_list_t *);
211 static smb_ads_qstat_t smb_ads_find_computer(smb_ads_handle_t *, char *);
212 static smb_ads_qstat_t smb_ads_getattr(LDAP *, LDAPMessage *,
213 smb_ads_avpair_t *);
214 static smb_ads_qstat_t smb_ads_get_qstat(smb_ads_handle_t *, LDAPMessage *,
215 smb_ads_avpair_t *);
216 static boolean_t smb_ads_match_pdc(smb_ads_host_info_t *);
217 static boolean_t smb_ads_is_sought_host(smb_ads_host_info_t *, char *);
218 static boolean_t smb_ads_is_same_domain(char *, char *);
219 static boolean_t smb_ads_is_pdc_configured(void);
220 static smb_ads_host_info_t *smb_ads_dup_host_info(smb_ads_host_info_t *);
221 static char *smb_ads_get_sharedn(const char *, const char *, const char *);
222 static krb5_enctype *smb_ads_get_enctypes(int, int *);
223
224 /*
225 * smb_ads_init
226 *
227 * Initializes the ADS config cache.
228 */
229 void
smb_ads_init(void)230 smb_ads_init(void)
231 {
232 (void) mutex_lock(&smb_ads_cfg.c_mtx);
233 (void) smb_config_getstr(SMB_CI_ADS_SITE,
234 smb_ads_cfg.c_site, SMB_ADS_SITE_MAX);
235 (void) smb_config_getip(SMB_CI_DOMAIN_SRV, &smb_ads_cfg.c_pdc);
236 (void) mutex_unlock(&smb_ads_cfg.c_mtx);
237 }
238
239 void
smb_ads_fini(void)240 smb_ads_fini(void)
241 {
242 smb_ads_free_cached_host();
243 }
244
245 /*
246 * smb_ads_refresh
247 *
248 * This function will be called when smb/server SMF service is refreshed.
249 * Clearing the smb_ads_cached_host_info would allow the next DC
250 * discovery process to pick up an AD based on the new AD configuration.
251 */
252 void
smb_ads_refresh(void)253 smb_ads_refresh(void)
254 {
255 char new_site[SMB_ADS_SITE_MAX];
256 smb_inaddr_t new_pdc;
257 boolean_t purge = B_FALSE;
258
259 (void) smb_config_getstr(SMB_CI_ADS_SITE, new_site, SMB_ADS_SITE_MAX);
260 (void) smb_config_getip(SMB_CI_DOMAIN_SRV, &new_pdc);
261 (void) mutex_lock(&smb_ads_cfg.c_mtx);
262 if (smb_strcasecmp(smb_ads_cfg.c_site, new_site, 0)) {
263 (void) strlcpy(smb_ads_cfg.c_site, new_site, SMB_ADS_SITE_MAX);
264 purge = B_TRUE;
265 }
266
267 smb_ads_cfg.c_pdc = new_pdc;
268 (void) mutex_unlock(&smb_ads_cfg.c_mtx);
269
270 (void) mutex_lock(&smb_ads_cached_host_mtx);
271 if (smb_ads_cached_host_info &&
272 smb_ads_is_pdc_configured() &&
273 !smb_ads_match_pdc(smb_ads_cached_host_info))
274 purge = B_TRUE;
275 (void) mutex_unlock(&smb_ads_cached_host_mtx);
276
277 if (purge)
278 smb_ads_free_cached_host();
279 }
280
281
282
283 static boolean_t
smb_ads_is_pdc_configured(void)284 smb_ads_is_pdc_configured(void)
285 {
286 boolean_t configured;
287
288 (void) mutex_lock(&smb_ads_cfg.c_mtx);
289 configured = !smb_inet_iszero(&smb_ads_cfg.c_pdc);
290 (void) mutex_unlock(&smb_ads_cfg.c_mtx);
291
292 return (configured);
293 }
294
295 /*
296 * smb_ads_build_unc_name
297 *
298 * Construct the UNC name of the share object in the format of
299 * \\hostname.domain\shareUNC
300 *
301 * Returns 0 on success, -1 on error.
302 */
303 int
smb_ads_build_unc_name(char * unc_name,int maxlen,const char * hostname,const char * shareUNC)304 smb_ads_build_unc_name(char *unc_name, int maxlen,
305 const char *hostname, const char *shareUNC)
306 {
307 char my_domain[MAXHOSTNAMELEN];
308
309 if (smb_getfqdomainname(my_domain, sizeof (my_domain)) != 0)
310 return (-1);
311
312 (void) snprintf(unc_name, maxlen, "\\\\%s.%s\\%s",
313 hostname, my_domain, shareUNC);
314 return (0);
315 }
316
317 /*
318 * smb_ads_ldap_ping
319 *
320 * This is used to bind to an ADS server to see
321 * if it is still alive.
322 *
323 * Returns:
324 * -1: error
325 * 0: successful
326 */
327 /*ARGSUSED*/
328 static int
smb_ads_ldap_ping(smb_ads_host_info_t * ads_host)329 smb_ads_ldap_ping(smb_ads_host_info_t *ads_host)
330 {
331 int ldversion = LDAP_VERSION3, status, timeoutms = 5 * 1000;
332 LDAP *ld = NULL;
333
334 ld = ldap_init(ads_host->name, ads_host->port);
335 if (ld == NULL)
336 return (-1);
337
338 ldversion = LDAP_VERSION3;
339 (void) ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &ldversion);
340 /* setup TCP/IP connect timeout */
341 (void) ldap_set_option(ld, LDAP_X_OPT_CONNECT_TIMEOUT, &timeoutms);
342
343 status = ldap_bind_s(ld, "", NULL, LDAP_AUTH_SIMPLE);
344
345 if (status != LDAP_SUCCESS) {
346 (void) ldap_unbind(ld);
347 return (-1);
348 }
349
350 (void) ldap_unbind(ld);
351
352 return (0);
353 }
354
355 /*
356 * The cached ADS host is no longer valid if one of the following criteria
357 * is satisfied:
358 *
359 * 1) not in the specified domain
360 * 2) not the sought host (if specified)
361 * 3) not reachable
362 *
363 * The caller is responsible for acquiring the smb_ads_cached_host_mtx lock
364 * prior to calling this function.
365 *
366 * Return B_TRUE if the cache host is still valid. Otherwise, return B_FALSE.
367 */
368 static boolean_t
smb_ads_validate_cache_host(char * domain,char * srv)369 smb_ads_validate_cache_host(char *domain, char *srv)
370 {
371 if (!smb_ads_cached_host_info)
372 return (B_FALSE);
373
374 if (!smb_ads_is_same_domain(smb_ads_cached_host_info->name, domain))
375 return (B_FALSE);
376
377 if (smb_ads_ldap_ping(smb_ads_cached_host_info) == 0) {
378 if (!srv)
379 return (B_TRUE);
380
381 if (smb_ads_is_sought_host(smb_ads_cached_host_info, srv))
382 return (B_TRUE);
383 }
384
385 return (B_FALSE);
386 }
387
388 /*
389 * smb_ads_is_sought_host
390 *
391 * Returns true, if the sought host name matches the input host (host) name.
392 * The sought host is expected to be in Fully Qualified Domain Name (FQDN)
393 * format.
394 */
395 static boolean_t
smb_ads_is_sought_host(smb_ads_host_info_t * host,char * sought_host_name)396 smb_ads_is_sought_host(smb_ads_host_info_t *host, char *sought_host_name)
397 {
398 if ((host == NULL) || (sought_host_name == NULL))
399 return (B_FALSE);
400
401 if (smb_strcasecmp(host->name, sought_host_name, 0))
402 return (B_FALSE);
403
404 return (B_TRUE);
405 }
406
407 /*
408 * smb_ads_match_hosts_same_domain
409 *
410 * Returns true, if the cached ADS host is in the same domain as the
411 * current (given) domain.
412 */
413 static boolean_t
smb_ads_is_same_domain(char * cached_host_name,char * current_domain)414 smb_ads_is_same_domain(char *cached_host_name, char *current_domain)
415 {
416 char *cached_host_domain;
417
418 if ((cached_host_name == NULL) || (current_domain == NULL))
419 return (B_FALSE);
420
421 cached_host_domain = strchr(cached_host_name, '.');
422 if (cached_host_domain == NULL)
423 return (B_FALSE);
424
425 ++cached_host_domain;
426 if (smb_strcasecmp(cached_host_domain, current_domain, 0))
427 return (B_FALSE);
428
429 return (B_TRUE);
430 }
431
432 /*
433 * smb_ads_skip_ques_sec
434 * Skips the question section.
435 */
436 static int
smb_ads_skip_ques_sec(int qcnt,uchar_t ** ptr,uchar_t * eom)437 smb_ads_skip_ques_sec(int qcnt, uchar_t **ptr, uchar_t *eom)
438 {
439 int i, len;
440
441 for (i = 0; i < qcnt; i++) {
442 if ((len = dn_skipname(*ptr, eom)) < 0)
443 return (-1);
444
445 *ptr += len + QFIXEDSZ;
446 }
447
448 return (0);
449 }
450
451 /*
452 * smb_ads_decode_host_ans_sec
453 * Decodes ADS hosts, priority, weight and port number from the answer
454 * section based on the current buffer pointer.
455 */
456 static int
smb_ads_decode_host_ans_sec(int ans_cnt,uchar_t ** ptr,uchar_t * eom,uchar_t * buf,smb_ads_host_info_t * ads_host_list)457 smb_ads_decode_host_ans_sec(int ans_cnt, uchar_t **ptr, uchar_t *eom,
458 uchar_t *buf, smb_ads_host_info_t *ads_host_list)
459 {
460 int i, len;
461 smb_ads_host_info_t *ads_host;
462
463 for (i = 0; i < ans_cnt; i++) {
464 ads_host = &ads_host_list[i];
465
466 if ((len = dn_skipname(*ptr, eom)) < 0)
467 return (-1);
468
469
470 *ptr += len;
471
472 /* skip type, class, ttl */
473 *ptr += 8;
474 /* data size */
475 *ptr += 2;
476
477 /* Get priority, weight */
478 /* LINTED: E_CONSTANT_CONDITION */
479 NS_GET16(ads_host->priority, *ptr);
480 /* LINTED: E_CONSTANT_CONDITION */
481 NS_GET16(ads_host->weight, *ptr);
482
483 /* port */
484 /* LINTED: E_CONSTANT_CONDITION */
485 NS_GET16(ads_host->port, *ptr);
486 /* domain name */
487 len = dn_expand(buf, eom, *ptr, ads_host->name, MAXHOSTNAMELEN);
488 if (len < 0)
489 return (-1);
490
491 *ptr += len;
492 }
493
494 return (0);
495 }
496
497 /*
498 * smb_ads_skip_auth_sec
499 * Skips the authority section.
500 */
501 static int
smb_ads_skip_auth_sec(int ns_cnt,uchar_t ** ptr,uchar_t * eom)502 smb_ads_skip_auth_sec(int ns_cnt, uchar_t **ptr, uchar_t *eom)
503 {
504 int i, len;
505 uint16_t size;
506
507 for (i = 0; i < ns_cnt; i++) {
508 if ((len = dn_skipname(*ptr, eom)) < 0)
509 return (-1);
510
511 *ptr += len;
512 /* skip type, class, ttl */
513 *ptr += 8;
514 /* get len of data */
515 /* LINTED: E_CONSTANT_CONDITION */
516 NS_GET16(size, *ptr);
517 if ((*ptr + size) > eom)
518 return (-1);
519
520 *ptr += size;
521 }
522
523 return (0);
524 }
525
526 /*
527 * smb_ads_decode_host_ip
528 *
529 * Decodes ADS hosts and IP Addresses from the additional section based
530 * on the current buffer pointer.
531 */
532 static int
smb_ads_decode_host_ip(int addit_cnt,int ans_cnt,uchar_t ** ptr,uchar_t * eom,uchar_t * buf,smb_ads_host_info_t * ads_host_list)533 smb_ads_decode_host_ip(int addit_cnt, int ans_cnt, uchar_t **ptr,
534 uchar_t *eom, uchar_t *buf, smb_ads_host_info_t *ads_host_list)
535 {
536 int i, j, len;
537 smb_inaddr_t ipaddr;
538 char hostname[MAXHOSTNAMELEN];
539 char *name;
540 uint16_t size = 0;
541
542 for (i = 0; i < addit_cnt; i++) {
543
544 /* domain name */
545 len = dn_expand(buf, eom, *ptr, hostname, MAXHOSTNAMELEN);
546 if (len < 0)
547 return (-1);
548
549 *ptr += len;
550
551 /* skip type, class, TTL, data len */
552 *ptr += 8;
553 /* LINTED: E_CONSTANT_CONDITION */
554 NS_GET16(size, *ptr);
555
556 if (size == NS_INADDRSZ) {
557 /* LINTED: E_CONSTANT_CONDITION */
558 NS_GET32(ipaddr.a_ipv4, *ptr);
559 ipaddr.a_ipv4 = htonl(ipaddr.a_ipv4);
560 ipaddr.a_family = AF_INET;
561 } else if (size == NS_IN6ADDRSZ) {
562 #ifdef BIG_ENDIAN
563 bcopy(*ptr, &ipaddr.a_ipv6, NS_IN6ADDRSZ);
564 #else
565 for (i = 0; i < NS_IN6ADDRSZ; i++)
566 (uint8_t *)(ipaddr.a_ipv6)
567 [NS_IN6ADDRSZ-1-i] = *(*ptr+i);
568 #endif
569 ipaddr.a_family = AF_INET6;
570 *ptr += size;
571 }
572
573 /*
574 * find the host in the list of DC records from
575 * the answer section, that matches the host in the
576 * additional section, and set its IP address.
577 */
578 for (j = 0; j < ans_cnt; j++) {
579 if ((name = ads_host_list[j].name) == NULL)
580 continue;
581 if (smb_strcasecmp(name, hostname, 0) == 0) {
582 ads_host_list[j].ipaddr = ipaddr;
583 }
584 }
585 }
586 return (0);
587 }
588
589 /*
590 * smb_ads_dup_host_info
591 *
592 * Duplicates the passed smb_ads_host_info_t structure.
593 * Caller must free memory allocated by this method.
594 *
595 * Returns a reference to the duplicated smb_ads_host_info_t structure.
596 * Returns NULL on error.
597 */
598 static smb_ads_host_info_t *
smb_ads_dup_host_info(smb_ads_host_info_t * ads_host)599 smb_ads_dup_host_info(smb_ads_host_info_t *ads_host)
600 {
601 smb_ads_host_info_t *dup_host;
602
603 if (ads_host == NULL)
604 return (NULL);
605
606 dup_host = malloc(sizeof (smb_ads_host_info_t));
607
608 if (dup_host != NULL)
609 bcopy(ads_host, dup_host, sizeof (smb_ads_host_info_t));
610
611 return (dup_host);
612 }
613
614 /*
615 * smb_ads_hlist_alloc
616 */
617 static smb_ads_host_list_t *
smb_ads_hlist_alloc(int count)618 smb_ads_hlist_alloc(int count)
619 {
620 int size;
621 smb_ads_host_list_t *hlist;
622
623 if (count == 0)
624 return (NULL);
625
626 size = sizeof (smb_ads_host_info_t) * count;
627 hlist = (smb_ads_host_list_t *)malloc(sizeof (smb_ads_host_list_t));
628 if (hlist == NULL)
629 return (NULL);
630
631 hlist->ah_cnt = count;
632 hlist->ah_list = (smb_ads_host_info_t *)malloc(size);
633 if (hlist->ah_list == NULL) {
634 free(hlist);
635 return (NULL);
636 }
637
638 bzero(hlist->ah_list, size);
639 return (hlist);
640 }
641
642 /*
643 * smb_ads_hlist_free
644 */
645 static void
smb_ads_hlist_free(smb_ads_host_list_t * host_list)646 smb_ads_hlist_free(smb_ads_host_list_t *host_list)
647 {
648 if (host_list == NULL)
649 return;
650
651 free(host_list->ah_list);
652 free(host_list);
653 }
654
655 /*
656 * smb_ads_query_dns_server
657 *
658 * This routine sends a DNS service location (SRV) query message to the
659 * DNS server via TCP to query it for a list of ADS server(s). Once a reply
660 * is received, the reply message is parsed to get the hostname. If there are IP
661 * addresses populated in the additional section then the additional section
662 * is parsed to obtain the IP addresses.
663 *
664 * The service location of _ldap._tcp.dc.msdcs.<ADS domain> is used to
665 * guarantee that Microsoft domain controllers are returned. Microsoft domain
666 * controllers are also ADS servers.
667 *
668 * The ADS hostnames are stored in the answer section of the DNS reply message.
669 * The IP addresses are stored in the additional section.
670 *
671 * The DNS reply message may be in compress formed. The compression is done
672 * on repeating domain name label in the message. i.e hostname.
673 *
674 * Upon successful completion, host list of ADS server(s) is returned.
675 */
676 static smb_ads_host_list_t *
smb_ads_query_dns_server(char * domain,char * msdcs_svc_name)677 smb_ads_query_dns_server(char *domain, char *msdcs_svc_name)
678 {
679 smb_ads_host_list_t *hlist = NULL;
680 int len, qcnt, ans_cnt, ns_cnt, addit_cnt;
681 uchar_t *ptr, *eom;
682 struct __res_state res_state;
683 union {
684 HEADER hdr;
685 uchar_t buf[NS_MAXMSG];
686 } msg;
687
688 bzero(&res_state, sizeof (struct __res_state));
689 if (res_ninit(&res_state) < 0)
690 return (NULL);
691
692 /* use TCP */
693 res_state.options |= RES_USEVC;
694
695 len = res_nquerydomain(&res_state, msdcs_svc_name, domain,
696 C_IN, T_SRV, msg.buf, sizeof (msg.buf));
697
698 if (len < 0) {
699 syslog(LOG_NOTICE, "DNS query for %s failed: %s",
700 msdcs_svc_name, hstrerror(res_state.res_h_errno));
701 res_ndestroy(&res_state);
702 return (NULL);
703 }
704
705 if (len > sizeof (msg.buf)) {
706 syslog(LOG_NOTICE,
707 "DNS query for %s failed: too big", msdcs_svc_name);
708 res_ndestroy(&res_state);
709 return (NULL);
710 }
711
712 /* parse the reply, skip header and question sections */
713 ptr = msg.buf + sizeof (msg.hdr);
714 eom = msg.buf + len;
715
716 /* check truncated message bit */
717 if (msg.hdr.tc)
718 syslog(LOG_NOTICE,
719 "DNS query for %s failed: truncated", msdcs_svc_name);
720
721 qcnt = ntohs(msg.hdr.qdcount);
722 ans_cnt = ntohs(msg.hdr.ancount);
723 ns_cnt = ntohs(msg.hdr.nscount);
724 addit_cnt = ntohs(msg.hdr.arcount);
725
726 if (smb_ads_skip_ques_sec(qcnt, &ptr, eom) != 0) {
727 res_ndestroy(&res_state);
728 return (NULL);
729 }
730
731 hlist = smb_ads_hlist_alloc(ans_cnt);
732 if (hlist == NULL) {
733 res_ndestroy(&res_state);
734 return (NULL);
735 }
736
737 /* walk through the answer section */
738 if (smb_ads_decode_host_ans_sec(ans_cnt, &ptr, eom, msg.buf,
739 hlist->ah_list) != 0) {
740 smb_ads_hlist_free(hlist);
741 res_ndestroy(&res_state);
742 return (NULL);
743 }
744
745 /* check authority section */
746 if (ns_cnt > 0) {
747 if (smb_ads_skip_auth_sec(ns_cnt, &ptr, eom) != 0) {
748 smb_ads_hlist_free(hlist);
749 res_ndestroy(&res_state);
750 return (NULL);
751 }
752 }
753
754 /*
755 * Check additional section to get IP address of ADS host.
756 */
757 if (addit_cnt > 0) {
758 if (smb_ads_decode_host_ip(addit_cnt, ans_cnt,
759 &ptr, eom, msg.buf, hlist->ah_list) != 0) {
760 smb_ads_hlist_free(hlist);
761 res_ndestroy(&res_state);
762 return (NULL);
763 }
764 }
765
766 res_ndestroy(&res_state);
767 return (hlist);
768 }
769
770 /*
771 * smb_ads_get_site_service
772 *
773 * Gets the msdcs SRV RR for the specified site.
774 */
775 static void
smb_ads_get_site_service(char * site_service,size_t len)776 smb_ads_get_site_service(char *site_service, size_t len)
777 {
778 (void) mutex_lock(&smb_ads_cfg.c_mtx);
779 if (*smb_ads_cfg.c_site == '\0')
780 *site_service = '\0';
781 else
782 (void) snprintf(site_service, len,
783 SMB_ADS_MSDCS_SRV_SITE_RR, smb_ads_cfg.c_site);
784
785 (void) mutex_unlock(&smb_ads_cfg.c_mtx);
786 }
787
788 /*
789 * smb_ads_getipnodebyname
790 *
791 * This method gets the IP address by doing a host name lookup.
792 */
793 static int
smb_ads_getipnodebyname(smb_ads_host_info_t * hentry)794 smb_ads_getipnodebyname(smb_ads_host_info_t *hentry)
795 {
796 struct hostent *h;
797 int error;
798
799 switch (hentry->ipaddr.a_family) {
800 case AF_INET6:
801 h = getipnodebyname(hentry->name, hentry->ipaddr.a_family,
802 AI_DEFAULT, &error);
803 if (h == NULL || h->h_length != NS_IN6ADDRSZ)
804 return (-1);
805 break;
806
807 case AF_INET:
808 h = getipnodebyname(hentry->name, hentry->ipaddr.a_family,
809 0, &error);
810 if (h == NULL || h->h_length != NS_INADDRSZ)
811 return (-1);
812 break;
813
814 default:
815 return (-1);
816 }
817 bcopy(*(h->h_addr_list), &hentry->ipaddr.a_ip, h->h_length);
818 freehostent(h);
819 return (0);
820 }
821
822 /*
823 * Checks the IP address to see if it is zero. If so, then do a host
824 * lookup by hostname to get the IP address based on the IP family.
825 *
826 * If the family is unknown then do a lookup by hostame based on the
827 * setting of the SMB_CI_IPV6_ENABLE property.
828 */
829 static int
smb_ads_set_ipaddr(smb_ads_host_info_t * hentry)830 smb_ads_set_ipaddr(smb_ads_host_info_t *hentry)
831 {
832 if (smb_inet_iszero(&hentry->ipaddr)) {
833 if (smb_ads_getipnodebyname(hentry) < 0)
834 return (-1);
835 } else if (SMB_ADS_AF_UNKNOWN(hentry)) {
836 hentry->ipaddr.a_family =
837 smb_config_getbool(SMB_CI_IPV6_ENABLE) ? AF_INET6 : AF_INET;
838
839 if (smb_ads_getipnodebyname(hentry) < 0) {
840 hentry->ipaddr.a_family = 0;
841 return (-1);
842 }
843 }
844
845 return (0);
846 }
847
848 /*
849 * smb_ads_find_host
850 *
851 * Finds an ADS host in a given domain.
852 *
853 * If the cached host is valid, it will be used. Otherwise, a DC will
854 * be selected based on the following criteria:
855 *
856 * 1) pdc (aka preferred DC) configuration
857 * 2) AD site configuration - the scope of the DNS lookup will be
858 * restricted to the specified site.
859 * 3) DC on the same subnet
860 * 4) DC with the lowest priority/highest weight
861 *
862 * The above items are listed in decreasing preference order. The selected
863 * DC must be online.
864 *
865 * If this function is called during domain join, the specified kpasswd server
866 * takes precedence over preferred DC, AD site, and so on.
867 *
868 * Parameters:
869 * domain: fully-qualified domain name.
870 * kpasswd_srv: fully-quailifed hostname of the kpasswd server.
871 *
872 * Returns:
873 * A copy of the cached host info is returned. The caller is responsible
874 * for deallocating the memory returned by this function.
875 */
876 /*ARGSUSED*/
877 smb_ads_host_info_t *
smb_ads_find_host(char * domain,char * kpasswd_srv)878 smb_ads_find_host(char *domain, char *kpasswd_srv)
879 {
880 int i;
881 char site_service[MAXHOSTNAMELEN];
882 smb_ads_host_list_t *hlist, *hlist2;
883 smb_ads_host_info_t *hlistp = NULL, *host = NULL;
884 smb_ads_host_info_t *found_kpasswd_srv = NULL;
885 smb_ads_host_info_t *found_pdc = NULL;
886
887 if ((kpasswd_srv) && (*kpasswd_srv == '\0'))
888 kpasswd_srv = NULL;
889
890 (void) mutex_lock(&smb_ads_cached_host_mtx);
891 if (smb_ads_validate_cache_host(domain, kpasswd_srv)) {
892 host = smb_ads_dup_host_info(smb_ads_cached_host_info);
893 (void) mutex_unlock(&smb_ads_cached_host_mtx);
894 return (host);
895 }
896
897 (void) mutex_unlock(&smb_ads_cached_host_mtx);
898 smb_ads_free_cached_host();
899
900 /*
901 * First look for ADS hosts in ADS site if configured. Then try
902 * without ADS site info.
903 */
904 hlist = NULL;
905 smb_ads_get_site_service(site_service, MAXHOSTNAMELEN);
906
907 /*
908 * If we're given an AD, the DNS SRV RR lookup should not be restricted
909 * to the specified site since there is no guarantee that the specified
910 * AD is in the specified site.
911 */
912 if (*site_service != '\0' && !kpasswd_srv &&
913 !smb_ads_is_pdc_configured())
914 hlist = smb_ads_query_dns_server(domain, site_service);
915
916 if (!hlist)
917 hlist = smb_ads_query_dns_server(domain,
918 SMB_ADS_MSDCS_SRV_DC_RR);
919
920 if ((hlist == NULL) || (hlist->ah_list == NULL) || (hlist->ah_cnt == 0))
921 return (NULL);
922
923 for (i = 0, hlistp = hlist->ah_list; i < hlist->ah_cnt; i++) {
924 if (smb_ads_set_ipaddr(&hlistp[i]) < 0)
925 continue;
926
927 if (smb_ads_is_sought_host(&hlistp[i], kpasswd_srv))
928 found_kpasswd_srv = &hlistp[i];
929
930 if (smb_ads_match_pdc(&hlistp[i]))
931 found_pdc = &hlistp[i];
932 }
933
934 if (found_kpasswd_srv && smb_ads_ldap_ping(found_kpasswd_srv) == 0) {
935 host = found_kpasswd_srv;
936 goto update_cache;
937 }
938
939 if (found_pdc && smb_ads_ldap_ping(found_pdc) == 0) {
940 host = found_pdc;
941 goto update_cache;
942 }
943
944 /*
945 * If the specified DC (kpasswd_srv or pdc) is not found, fallback
946 * to find a DC in the specified AD site.
947 */
948 if (*site_service != '\0' &&
949 (kpasswd_srv || smb_ads_is_pdc_configured())) {
950 hlist2 = smb_ads_query_dns_server(domain, site_service);
951 if (hlist2 && hlist2->ah_list && hlist2->ah_cnt != 0) {
952 smb_ads_hlist_free(hlist);
953 hlist = hlist2;
954 hlistp = hlist->ah_list;
955
956 for (i = 0; i < hlist->ah_cnt; i++)
957 (void) smb_ads_set_ipaddr(&hlistp[i]);
958 }
959 }
960
961 /* Select DC from DC list */
962 host = smb_ads_select_dc(hlist);
963
964 update_cache:
965 if (host) {
966 (void) mutex_lock(&smb_ads_cached_host_mtx);
967 if (!smb_ads_cached_host_info)
968 smb_ads_cached_host_info = smb_ads_dup_host_info(host);
969 host = smb_ads_dup_host_info(smb_ads_cached_host_info);
970 (void) mutex_unlock(&smb_ads_cached_host_mtx);
971 }
972
973 smb_ads_hlist_free(hlist);
974 return (host);
975 }
976
977 /*
978 * Return the number of dots in a string.
979 */
980 static int
smb_ads_count_dots(const char * s)981 smb_ads_count_dots(const char *s)
982 {
983 int ndots = 0;
984
985 while (*s) {
986 if (*s++ == '.')
987 ndots++;
988 }
989
990 return (ndots);
991 }
992
993 /*
994 * Convert a domain name in dot notation to distinguished name format,
995 * for example: sun.com -> dc=sun,dc=com.
996 *
997 * Returns a pointer to an allocated buffer containing the distinguished
998 * name.
999 */
1000 static char *
smb_ads_convert_domain(const char * domain_name)1001 smb_ads_convert_domain(const char *domain_name)
1002 {
1003 const char *s;
1004 char *dn_name;
1005 char buf[2];
1006 int ndots;
1007 int len;
1008
1009 if (domain_name == NULL || *domain_name == 0)
1010 return (NULL);
1011
1012 ndots = smb_ads_count_dots(domain_name);
1013 ++ndots;
1014 len = strlen(domain_name) + (ndots * SMB_ADS_DN_PREFIX_LEN) + 1;
1015
1016 if ((dn_name = malloc(len)) == NULL)
1017 return (NULL);
1018
1019 bzero(dn_name, len);
1020 (void) strlcpy(dn_name, "dc=", len);
1021
1022 buf[1] = '\0';
1023 s = domain_name;
1024
1025 while (*s) {
1026 if (*s == '.') {
1027 (void) strlcat(dn_name, ",dc=", len);
1028 } else {
1029 buf[0] = *s;
1030 (void) strlcat(dn_name, buf, len);
1031 }
1032 ++s;
1033 }
1034
1035 return (dn_name);
1036 }
1037
1038 /*
1039 * smb_ads_free_cached_host
1040 *
1041 * Free the memory use by the global smb_ads_cached_host_info & set it to NULL.
1042 */
1043 static void
smb_ads_free_cached_host(void)1044 smb_ads_free_cached_host(void)
1045 {
1046 (void) mutex_lock(&smb_ads_cached_host_mtx);
1047 if (smb_ads_cached_host_info) {
1048 free(smb_ads_cached_host_info);
1049 smb_ads_cached_host_info = NULL;
1050 }
1051 (void) mutex_unlock(&smb_ads_cached_host_mtx);
1052 }
1053
1054 /*
1055 * smb_ads_open
1056 * Open a LDAP connection to an ADS server if the system is in domain mode.
1057 * Acquire both Kerberos TGT and LDAP service tickets for the host principal.
1058 *
1059 * This function should only be called after the system is successfully joined
1060 * to a domain.
1061 */
1062 smb_ads_handle_t *
smb_ads_open(void)1063 smb_ads_open(void)
1064 {
1065 char domain[MAXHOSTNAMELEN];
1066
1067 if (smb_config_get_secmode() != SMB_SECMODE_DOMAIN)
1068 return (NULL);
1069
1070 if (smb_getfqdomainname(domain, MAXHOSTNAMELEN) != 0)
1071 return (NULL);
1072
1073 return (smb_ads_open_main(domain, NULL, NULL));
1074 }
1075
1076 static int
smb_ads_saslcallback(LDAP * ld,unsigned flags,void * defaults,void * prompts)1077 smb_ads_saslcallback(LDAP *ld, unsigned flags, void *defaults, void *prompts)
1078 {
1079 NOTE(ARGUNUSED(ld, defaults));
1080 sasl_interact_t *interact;
1081
1082 if (prompts == NULL || flags != LDAP_SASL_INTERACTIVE)
1083 return (LDAP_PARAM_ERROR);
1084
1085 /* There should be no extra arguemnts for SASL/GSSAPI authentication */
1086 for (interact = prompts; interact->id != SASL_CB_LIST_END;
1087 interact++) {
1088 interact->result = NULL;
1089 interact->len = 0;
1090 }
1091 return (LDAP_SUCCESS);
1092 }
1093
1094 /*
1095 * smb_ads_open_main
1096 * Open a LDAP connection to an ADS server.
1097 * If ADS is enabled and the administrative username, password, and
1098 * ADS domain are defined then query DNS to find an ADS server if this is the
1099 * very first call to this routine. After an ADS server is found then this
1100 * server will be used everytime this routine is called until the system is
1101 * rebooted or the ADS server becomes unavailable then an ADS server will
1102 * be queried again. After the connection is made then an ADS handle
1103 * is created to be returned.
1104 *
1105 * After the LDAP connection, the LDAP version will be set to 3 using
1106 * ldap_set_option().
1107 *
1108 * The LDAP connection is bound before the ADS handle is returned.
1109 * Parameters:
1110 * domain - fully-qualified domain name
1111 * user - the user account for whom the Kerberos TGT ticket and ADS
1112 * service tickets are acquired.
1113 * password - password of the specified user
1114 *
1115 * Returns:
1116 * NULL : can't connect to ADS server or other errors
1117 * smb_ads_handle_t* : handle to ADS server
1118 */
1119 static smb_ads_handle_t *
smb_ads_open_main(char * domain,char * user,char * password)1120 smb_ads_open_main(char *domain, char *user, char *password)
1121 {
1122 smb_ads_handle_t *ah;
1123 LDAP *ld;
1124 int version = 3;
1125 smb_ads_host_info_t *ads_host = NULL;
1126 int rc;
1127
1128 if (user != NULL) {
1129 if (smb_kinit(user, password) == 0)
1130 return (NULL);
1131 user = NULL;
1132 password = NULL;
1133 }
1134
1135 ads_host = smb_ads_find_host(domain, NULL);
1136 if (ads_host == NULL)
1137 return (NULL);
1138
1139 ah = (smb_ads_handle_t *)malloc(sizeof (smb_ads_handle_t));
1140 if (ah == NULL) {
1141 free(ads_host);
1142 return (NULL);
1143 }
1144
1145 (void) memset(ah, 0, sizeof (smb_ads_handle_t));
1146
1147 if ((ld = ldap_init(ads_host->name, ads_host->port)) == NULL) {
1148 smb_ads_free_cached_host();
1149 free(ah);
1150 free(ads_host);
1151 return (NULL);
1152 }
1153
1154 if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version)
1155 != LDAP_SUCCESS) {
1156 smb_ads_free_cached_host();
1157 free(ah);
1158 free(ads_host);
1159 (void) ldap_unbind(ld);
1160 return (NULL);
1161 }
1162
1163 (void) ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
1164 ah->ld = ld;
1165 ah->domain = strdup(domain);
1166
1167 if (ah->domain == NULL) {
1168 smb_ads_close(ah);
1169 free(ads_host);
1170 return (NULL);
1171 }
1172
1173 /*
1174 * ah->domain is often used for generating service principal name.
1175 * Convert it to lower case for RFC 4120 section 6.2.1 conformance.
1176 */
1177 (void) smb_strlwr(ah->domain);
1178 ah->domain_dn = smb_ads_convert_domain(domain);
1179 if (ah->domain_dn == NULL) {
1180 smb_ads_close(ah);
1181 free(ads_host);
1182 return (NULL);
1183 }
1184
1185 ah->hostname = strdup(ads_host->name);
1186 if (ah->hostname == NULL) {
1187 smb_ads_close(ah);
1188 free(ads_host);
1189 return (NULL);
1190 }
1191 (void) mutex_lock(&smb_ads_cfg.c_mtx);
1192 if (*smb_ads_cfg.c_site != '\0') {
1193 if ((ah->site = strdup(smb_ads_cfg.c_site)) == NULL) {
1194 smb_ads_close(ah);
1195 (void) mutex_unlock(&smb_ads_cfg.c_mtx);
1196 free(ads_host);
1197 return (NULL);
1198 }
1199 } else {
1200 ah->site = NULL;
1201 }
1202 (void) mutex_unlock(&smb_ads_cfg.c_mtx);
1203
1204 rc = ldap_sasl_interactive_bind_s(ah->ld, "", "GSSAPI", NULL, NULL,
1205 LDAP_SASL_INTERACTIVE, &smb_ads_saslcallback, NULL);
1206 if (rc != LDAP_SUCCESS) {
1207 syslog(LOG_ERR, "ldal_sasl_interactive_bind_s failed (%s)",
1208 ldap_err2string(rc));
1209 smb_ads_close(ah);
1210 free(ads_host);
1211 return (NULL);
1212 }
1213
1214 free(ads_host);
1215 return (ah);
1216 }
1217
1218 /*
1219 * smb_ads_close
1220 * Close connection to ADS server and free memory allocated for ADS handle.
1221 * LDAP unbind is called here.
1222 * Parameters:
1223 * ah: handle to ADS server
1224 * Returns:
1225 * void
1226 */
1227 void
smb_ads_close(smb_ads_handle_t * ah)1228 smb_ads_close(smb_ads_handle_t *ah)
1229 {
1230 if (ah == NULL)
1231 return;
1232 /* close and free connection resources */
1233 if (ah->ld)
1234 (void) ldap_unbind(ah->ld);
1235
1236 free(ah->domain);
1237 free(ah->domain_dn);
1238 free(ah->hostname);
1239 free(ah->site);
1240 free(ah);
1241 }
1242
1243 /*
1244 * smb_ads_alloc_attr
1245 *
1246 * Since the attrs is a null-terminated array, all elements
1247 * in the array (except the last one) will point to allocated
1248 * memory.
1249 */
1250 static int
smb_ads_alloc_attr(LDAPMod * attrs[],int num)1251 smb_ads_alloc_attr(LDAPMod *attrs[], int num)
1252 {
1253 int i;
1254
1255 bzero(attrs, num * sizeof (LDAPMod *));
1256 for (i = 0; i < (num - 1); i++) {
1257 attrs[i] = (LDAPMod *)malloc(sizeof (LDAPMod));
1258 if (attrs[i] == NULL) {
1259 smb_ads_free_attr(attrs);
1260 return (-1);
1261 }
1262 }
1263
1264 return (0);
1265 }
1266
1267 /*
1268 * smb_ads_free_attr
1269 * Free memory allocated when publishing a share.
1270 * Parameters:
1271 * attrs: an array of LDAPMod pointers
1272 * Returns:
1273 * None
1274 */
1275 static void
smb_ads_free_attr(LDAPMod * attrs[])1276 smb_ads_free_attr(LDAPMod *attrs[])
1277 {
1278 int i;
1279 for (i = 0; attrs[i]; i++) {
1280 free(attrs[i]);
1281 }
1282 }
1283
1284 /*
1285 * Returns share DN in an allocated buffer. The format of the DN is
1286 * cn=<sharename>,<container RDNs>,<domain DN>
1287 *
1288 * If the domain DN is not included in the container parameter,
1289 * then it will be appended to create the share DN.
1290 *
1291 * The caller must free the allocated buffer.
1292 */
1293 static char *
smb_ads_get_sharedn(const char * sharename,const char * container,const char * domain_dn)1294 smb_ads_get_sharedn(const char *sharename, const char *container,
1295 const char *domain_dn)
1296 {
1297 char *share_dn;
1298 int rc, offset, container_len, domain_len;
1299 boolean_t append_domain = B_TRUE;
1300
1301 container_len = strlen(container);
1302 domain_len = strlen(domain_dn);
1303
1304 if (container_len >= domain_len) {
1305
1306 /* offset to last domain_len characters */
1307 offset = container_len - domain_len;
1308
1309 if (smb_strcasecmp(container + offset,
1310 domain_dn, domain_len) == 0)
1311 append_domain = B_FALSE;
1312 }
1313
1314 if (append_domain)
1315 rc = asprintf(&share_dn, "cn=%s,%s,%s", sharename,
1316 container, domain_dn);
1317 else
1318 rc = asprintf(&share_dn, "cn=%s,%s", sharename,
1319 container);
1320
1321 return ((rc == -1) ? NULL : share_dn);
1322 }
1323
1324 /*
1325 * smb_ads_add_share
1326 * Call by smb_ads_publish_share to create share object in ADS.
1327 * This routine specifies the attributes of an ADS LDAP share object. The first
1328 * attribute and values define the type of ADS object, the share object. The
1329 * second attribute and value define the UNC of the share data for the share
1330 * object. The LDAP synchronous add command is used to add the object into ADS.
1331 * The container location to add the object needs to specified.
1332 * Parameters:
1333 * ah : handle to ADS server
1334 * adsShareName: name of share object to be created in ADS
1335 * shareUNC : share name on NetForce
1336 * adsContainer: location in ADS to create share object
1337 *
1338 * Returns:
1339 * -1 : error
1340 * 0 : success
1341 */
1342 int
smb_ads_add_share(smb_ads_handle_t * ah,const char * adsShareName,const char * unc_name,const char * adsContainer)1343 smb_ads_add_share(smb_ads_handle_t *ah, const char *adsShareName,
1344 const char *unc_name, const char *adsContainer)
1345 {
1346 LDAPMod *attrs[SMB_ADS_SHARE_NUM_ATTR];
1347 int j = 0;
1348 char *share_dn;
1349 int ret;
1350 char *unc_names[] = {(char *)unc_name, NULL};
1351
1352 if ((share_dn = smb_ads_get_sharedn(adsShareName, adsContainer,
1353 ah->domain_dn)) == NULL)
1354 return (-1);
1355
1356 if (smb_ads_alloc_attr(attrs, SMB_ADS_SHARE_NUM_ATTR) != 0) {
1357 free(share_dn);
1358 return (-1);
1359 }
1360
1361 attrs[j]->mod_op = LDAP_MOD_ADD;
1362 attrs[j]->mod_type = "objectClass";
1363 attrs[j]->mod_values = smb_ads_share_objcls;
1364
1365 attrs[++j]->mod_op = LDAP_MOD_ADD;
1366 attrs[j]->mod_type = "uNCName";
1367 attrs[j]->mod_values = unc_names;
1368
1369 if ((ret = ldap_add_s(ah->ld, share_dn, attrs)) != LDAP_SUCCESS) {
1370 if (ret == LDAP_NO_SUCH_OBJECT) {
1371 syslog(LOG_ERR, "Failed to publish share %s in" \
1372 " AD. Container does not exist: %s.\n",
1373 adsShareName, share_dn);
1374
1375 } else {
1376 syslog(LOG_ERR, "Failed to publish share %s in" \
1377 " AD: %s (%s).\n", adsShareName, share_dn,
1378 ldap_err2string(ret));
1379 }
1380 smb_ads_free_attr(attrs);
1381 free(share_dn);
1382 return (ret);
1383 }
1384 free(share_dn);
1385 smb_ads_free_attr(attrs);
1386
1387 return (0);
1388 }
1389
1390 /*
1391 * smb_ads_del_share
1392 * Call by smb_ads_remove_share to remove share object from ADS. The container
1393 * location to remove the object needs to specified. The LDAP synchronous
1394 * delete command is used.
1395 * Parameters:
1396 * ah : handle to ADS server
1397 * adsShareName: name of share object in ADS to be removed
1398 * adsContainer: location of share object in ADS
1399 * Returns:
1400 * -1 : error
1401 * 0 : success
1402 */
1403 static int
smb_ads_del_share(smb_ads_handle_t * ah,const char * adsShareName,const char * adsContainer)1404 smb_ads_del_share(smb_ads_handle_t *ah, const char *adsShareName,
1405 const char *adsContainer)
1406 {
1407 char *share_dn;
1408 int ret;
1409
1410 if ((share_dn = smb_ads_get_sharedn(adsShareName, adsContainer,
1411 ah->domain_dn)) == NULL)
1412 return (-1);
1413
1414 if ((ret = ldap_delete_s(ah->ld, share_dn)) != LDAP_SUCCESS) {
1415 smb_tracef("ldap_delete: %s", ldap_err2string(ret));
1416 free(share_dn);
1417 return (-1);
1418 }
1419 free(share_dn);
1420
1421 return (0);
1422 }
1423
1424
1425 /*
1426 * smb_ads_escape_search_filter_chars
1427 *
1428 * This routine will escape the special characters found in a string
1429 * that will later be passed to the ldap search filter.
1430 *
1431 * RFC 1960 - A String Representation of LDAP Search Filters
1432 * 3. String Search Filter Definition
1433 * If a value must contain one of the characters '*' OR '(' OR ')',
1434 * these characters
1435 * should be escaped by preceding them with the backslash '\' character.
1436 *
1437 * RFC 2252 - LDAP Attribute Syntax Definitions
1438 * a backslash quoting mechanism is used to escape
1439 * the following separator symbol character (such as "'", "$" or "#") if
1440 * it should occur in that string.
1441 */
1442 static int
smb_ads_escape_search_filter_chars(const char * src,char * dst)1443 smb_ads_escape_search_filter_chars(const char *src, char *dst)
1444 {
1445 int avail = SMB_ADS_MAXBUFLEN - 1; /* reserve a space for NULL char */
1446
1447 if (src == NULL || dst == NULL)
1448 return (-1);
1449
1450 while (*src) {
1451 if (!avail) {
1452 *dst = 0;
1453 return (-1);
1454 }
1455
1456 switch (*src) {
1457 case '\\':
1458 case '\'':
1459 case '$':
1460 case '#':
1461 case '*':
1462 case '(':
1463 case ')':
1464 *dst++ = '\\';
1465 avail--;
1466 /* fall through */
1467
1468 default:
1469 *dst++ = *src++;
1470 avail--;
1471 }
1472 }
1473
1474 *dst = 0;
1475
1476 return (0);
1477 }
1478
1479 /*
1480 * smb_ads_lookup_share
1481 * The search filter is set to search for a specific share name in the
1482 * specified ADS container. The LDSAP synchronous search command is used.
1483 * Parameters:
1484 * ah : handle to ADS server
1485 * adsShareName: name of share object in ADS to be searched
1486 * adsContainer: location of share object in ADS
1487 * Returns:
1488 * -1 : error
1489 * 0 : not found
1490 * 1 : found
1491 */
1492 int
smb_ads_lookup_share(smb_ads_handle_t * ah,const char * adsShareName,const char * adsContainer,char * unc_name)1493 smb_ads_lookup_share(smb_ads_handle_t *ah, const char *adsShareName,
1494 const char *adsContainer, char *unc_name)
1495 {
1496 char *attrs[4], filter[SMB_ADS_MAXBUFLEN];
1497 char *share_dn;
1498 int ret;
1499 LDAPMessage *res;
1500 char tmpbuf[SMB_ADS_MAXBUFLEN];
1501
1502 if (adsShareName == NULL || adsContainer == NULL)
1503 return (-1);
1504
1505 if ((share_dn = smb_ads_get_sharedn(adsShareName, adsContainer,
1506 ah->domain_dn)) == NULL)
1507 return (-1);
1508
1509 res = NULL;
1510 attrs[0] = "cn";
1511 attrs[1] = "objectClass";
1512 attrs[2] = "uNCName";
1513 attrs[3] = NULL;
1514
1515 if (smb_ads_escape_search_filter_chars(unc_name, tmpbuf) != 0) {
1516 free(share_dn);
1517 return (-1);
1518 }
1519
1520 (void) snprintf(filter, sizeof (filter),
1521 "(&(objectClass=volume)(uNCName=%s))", tmpbuf);
1522
1523 if ((ret = ldap_search_s(ah->ld, share_dn,
1524 LDAP_SCOPE_BASE, filter, attrs, 0, &res)) != LDAP_SUCCESS) {
1525 if (ret != LDAP_NO_SUCH_OBJECT)
1526 smb_tracef("%s: ldap_search: %s", share_dn,
1527 ldap_err2string(ret));
1528
1529 (void) ldap_msgfree(res);
1530 free(share_dn);
1531 return (0);
1532 }
1533
1534 (void) free(share_dn);
1535
1536 /* no match is found */
1537 if (ldap_count_entries(ah->ld, res) == 0) {
1538 (void) ldap_msgfree(res);
1539 return (0);
1540 }
1541
1542 /* free the search results */
1543 (void) ldap_msgfree(res);
1544
1545 return (1);
1546 }
1547
1548 /*
1549 * smb_ads_publish_share
1550 * Publish share into ADS. If a share name already exist in ADS in the same
1551 * container then the existing share object is removed before adding the new
1552 * share object.
1553 * Parameters:
1554 * ah : handle return from smb_ads_open
1555 * adsShareName: name of share to be added to ADS directory
1556 * shareUNC : name of share on client, can be NULL to use the same name
1557 * as adsShareName
1558 * adsContainer: location for share to be added in ADS directory, ie
1559 * ou=share_folder
1560 * uncType : use UNC_HOSTNAME to use hostname for UNC, use UNC_HOSTADDR
1561 * to use host ip addr for UNC.
1562 * Returns:
1563 * -1 : error
1564 * 0 : success
1565 */
1566 int
smb_ads_publish_share(smb_ads_handle_t * ah,const char * adsShareName,const char * shareUNC,const char * adsContainer,const char * hostname)1567 smb_ads_publish_share(smb_ads_handle_t *ah, const char *adsShareName,
1568 const char *shareUNC, const char *adsContainer, const char *hostname)
1569 {
1570 int ret;
1571 char unc_name[SMB_ADS_MAXBUFLEN];
1572
1573 if (adsShareName == NULL || adsContainer == NULL)
1574 return (-1);
1575
1576 if (shareUNC == 0 || *shareUNC == 0)
1577 shareUNC = adsShareName;
1578
1579 if (smb_ads_build_unc_name(unc_name, sizeof (unc_name),
1580 hostname, shareUNC) < 0)
1581 return (-1);
1582
1583 ret = smb_ads_lookup_share(ah, adsShareName, adsContainer, unc_name);
1584
1585 switch (ret) {
1586 case 1:
1587 (void) smb_ads_del_share(ah, adsShareName, adsContainer);
1588 ret = smb_ads_add_share(ah, adsShareName, unc_name,
1589 adsContainer);
1590 break;
1591
1592 case 0:
1593 ret = smb_ads_add_share(ah, adsShareName, unc_name,
1594 adsContainer);
1595 if (ret == LDAP_ALREADY_EXISTS)
1596 ret = -1;
1597
1598 break;
1599
1600 case -1:
1601 default:
1602 /* return with error code */
1603 ret = -1;
1604 }
1605
1606 return (ret);
1607 }
1608
1609 /*
1610 * smb_ads_remove_share
1611 * Remove share from ADS. A search is done first before explicitly removing
1612 * the share.
1613 * Parameters:
1614 * ah : handle return from smb_ads_open
1615 * adsShareName: name of share to be removed from ADS directory
1616 * adsContainer: location for share to be removed from ADS directory, ie
1617 * ou=share_folder
1618 * Returns:
1619 * -1 : error
1620 * 0 : success
1621 */
1622 int
smb_ads_remove_share(smb_ads_handle_t * ah,const char * adsShareName,const char * shareUNC,const char * adsContainer,const char * hostname)1623 smb_ads_remove_share(smb_ads_handle_t *ah, const char *adsShareName,
1624 const char *shareUNC, const char *adsContainer, const char *hostname)
1625 {
1626 int ret;
1627 char unc_name[SMB_ADS_MAXBUFLEN];
1628
1629 if (adsShareName == NULL || adsContainer == NULL)
1630 return (-1);
1631 if (shareUNC == 0 || *shareUNC == 0)
1632 shareUNC = adsShareName;
1633
1634 if (smb_ads_build_unc_name(unc_name, sizeof (unc_name),
1635 hostname, shareUNC) < 0)
1636 return (-1);
1637
1638 ret = smb_ads_lookup_share(ah, adsShareName, adsContainer, unc_name);
1639 if (ret == 0)
1640 return (0);
1641 if (ret == -1)
1642 return (-1);
1643
1644 return (smb_ads_del_share(ah, adsShareName, adsContainer));
1645 }
1646
1647 /*
1648 * smb_ads_get_default_comp_container_dn
1649 *
1650 * Build the distinguished name for the default computer conatiner (i.e. the
1651 * pre-defined Computers container).
1652 */
1653 static void
smb_ads_get_default_comp_container_dn(smb_ads_handle_t * ah,char * buf,size_t buflen)1654 smb_ads_get_default_comp_container_dn(smb_ads_handle_t *ah, char *buf,
1655 size_t buflen)
1656 {
1657 (void) snprintf(buf, buflen, "cn=%s,%s", SMB_ADS_COMPUTERS_CN,
1658 ah->domain_dn);
1659 }
1660
1661 /*
1662 * smb_ads_get_default_comp_dn
1663 *
1664 * Build the distinguished name for this system.
1665 */
1666 static void
smb_ads_get_default_comp_dn(smb_ads_handle_t * ah,char * buf,size_t buflen)1667 smb_ads_get_default_comp_dn(smb_ads_handle_t *ah, char *buf, size_t buflen)
1668 {
1669 char nbname[NETBIOS_NAME_SZ];
1670 char container_dn[SMB_ADS_DN_MAX];
1671
1672 (void) smb_getnetbiosname(nbname, sizeof (nbname));
1673 smb_ads_get_default_comp_container_dn(ah, container_dn, SMB_ADS_DN_MAX);
1674 (void) snprintf(buf, buflen, "cn=%s,%s", nbname, container_dn);
1675 }
1676
1677 /*
1678 * smb_ads_add_computer
1679 *
1680 * Returns 0 upon success. Otherwise, returns -1.
1681 */
1682 static int
smb_ads_add_computer(smb_ads_handle_t * ah,int dclevel,char * dn)1683 smb_ads_add_computer(smb_ads_handle_t *ah, int dclevel, char *dn)
1684 {
1685 return (smb_ads_computer_op(ah, LDAP_MOD_ADD, dclevel, dn));
1686 }
1687
1688 /*
1689 * smb_ads_modify_computer
1690 *
1691 * Returns 0 upon success. Otherwise, returns -1.
1692 */
1693 static int
smb_ads_modify_computer(smb_ads_handle_t * ah,int dclevel,char * dn)1694 smb_ads_modify_computer(smb_ads_handle_t *ah, int dclevel, char *dn)
1695 {
1696 return (smb_ads_computer_op(ah, LDAP_MOD_REPLACE, dclevel, dn));
1697 }
1698
1699 /*
1700 * smb_ads_get_dc_level
1701 *
1702 * Returns the functional level of the DC upon success.
1703 * Otherwise, -1 is returned.
1704 */
1705 static int
smb_ads_get_dc_level(smb_ads_handle_t * ah)1706 smb_ads_get_dc_level(smb_ads_handle_t *ah)
1707 {
1708 LDAPMessage *res, *entry;
1709 char *attr[2];
1710 char **vals;
1711 int rc = -1;
1712
1713 res = NULL;
1714 attr[0] = SMB_ADS_ATTR_DCLEVEL;
1715 attr[1] = NULL;
1716 if (ldap_search_s(ah->ld, "", LDAP_SCOPE_BASE, NULL, attr,
1717 0, &res) != LDAP_SUCCESS) {
1718 (void) ldap_msgfree(res);
1719 return (-1);
1720 }
1721
1722 /* no match for the specified attribute is found */
1723 if (ldap_count_entries(ah->ld, res) == 0) {
1724 (void) ldap_msgfree(res);
1725 return (-1);
1726 }
1727
1728 entry = ldap_first_entry(ah->ld, res);
1729 if (entry) {
1730 if ((vals = ldap_get_values(ah->ld, entry,
1731 SMB_ADS_ATTR_DCLEVEL)) == NULL) {
1732 /*
1733 * Observed the values aren't populated
1734 * by the Windows 2000 server.
1735 */
1736 (void) ldap_msgfree(res);
1737 return (SMB_ADS_DCLEVEL_W2K);
1738 }
1739
1740 if (vals[0] != NULL)
1741 rc = atoi(vals[0]);
1742
1743 ldap_value_free(vals);
1744 }
1745
1746 (void) ldap_msgfree(res);
1747 return (rc);
1748 }
1749
1750 /*
1751 * The fully-qualified hostname returned by this function is often used for
1752 * constructing service principal name. Return the fully-qualified hostname
1753 * in lower case for RFC 4120 section 6.2.1 conformance.
1754 */
1755 static int
smb_ads_getfqhostname(smb_ads_handle_t * ah,char * fqhost,int len)1756 smb_ads_getfqhostname(smb_ads_handle_t *ah, char *fqhost, int len)
1757 {
1758 if (smb_gethostname(fqhost, len, SMB_CASE_LOWER) != 0)
1759 return (-1);
1760
1761 (void) snprintf(fqhost, len, "%s.%s", fqhost,
1762 ah->domain);
1763
1764 return (0);
1765 }
1766
1767 static int
smb_ads_computer_op(smb_ads_handle_t * ah,int op,int dclevel,char * dn)1768 smb_ads_computer_op(smb_ads_handle_t *ah, int op, int dclevel, char *dn)
1769 {
1770 LDAPMod *attrs[SMB_ADS_COMPUTER_NUM_ATTR];
1771 char *sam_val[2];
1772 char *ctl_val[2], *fqh_val[2];
1773 char *encrypt_val[2];
1774 int j = -1;
1775 int ret, usrctl_flags = 0;
1776 char sam_acct[SMB_SAMACCT_MAXLEN];
1777 char fqhost[MAXHOSTNAMELEN];
1778 char usrctl_buf[16];
1779 char encrypt_buf[16];
1780 int max;
1781 smb_krb5_pn_set_t spn, upn;
1782
1783 if (smb_getsamaccount(sam_acct, sizeof (sam_acct)) != 0)
1784 return (-1);
1785
1786 if (smb_ads_getfqhostname(ah, fqhost, MAXHOSTNAMELEN))
1787 return (-1);
1788
1789 /* The SPN attribute is multi-valued and must be 1 or greater */
1790 if (smb_krb5_get_pn_set(&spn, SMB_PN_SPN_ATTR, ah->domain) == 0)
1791 return (-1);
1792
1793 /* The UPN attribute is single-valued and cannot be zero */
1794 if (smb_krb5_get_pn_set(&upn, SMB_PN_UPN_ATTR, ah->domain) != 1) {
1795 smb_krb5_free_pn_set(&spn);
1796 smb_krb5_free_pn_set(&upn);
1797 return (-1);
1798 }
1799
1800 max = (SMB_ADS_COMPUTER_NUM_ATTR - ((op != LDAP_MOD_ADD) ? 1 : 0))
1801 - (dclevel >= SMB_ADS_DCLEVEL_W2K8 ? 0 : 1);
1802
1803 if (smb_ads_alloc_attr(attrs, max) != 0) {
1804 smb_krb5_free_pn_set(&spn);
1805 smb_krb5_free_pn_set(&upn);
1806 return (-1);
1807 }
1808
1809 /* objectClass attribute is not modifiable. */
1810 if (op == LDAP_MOD_ADD) {
1811 attrs[++j]->mod_op = op;
1812 attrs[j]->mod_type = "objectClass";
1813 attrs[j]->mod_values = smb_ads_computer_objcls;
1814 }
1815
1816 attrs[++j]->mod_op = op;
1817 attrs[j]->mod_type = SMB_ADS_ATTR_SAMACCT;
1818 sam_val[0] = sam_acct;
1819 sam_val[1] = 0;
1820 attrs[j]->mod_values = sam_val;
1821
1822 attrs[++j]->mod_op = op;
1823 attrs[j]->mod_type = SMB_ADS_ATTR_UPN;
1824 attrs[j]->mod_values = upn.s_pns;
1825
1826 attrs[++j]->mod_op = op;
1827 attrs[j]->mod_type = SMB_ADS_ATTR_SPN;
1828 attrs[j]->mod_values = spn.s_pns;
1829
1830 attrs[++j]->mod_op = op;
1831 attrs[j]->mod_type = SMB_ADS_ATTR_CTL;
1832 usrctl_flags |= (SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT |
1833 SMB_ADS_USER_ACCT_CTL_PASSWD_NOTREQD |
1834 SMB_ADS_USER_ACCT_CTL_ACCOUNTDISABLE);
1835 (void) snprintf(usrctl_buf, sizeof (usrctl_buf), "%d", usrctl_flags);
1836 ctl_val[0] = usrctl_buf;
1837 ctl_val[1] = 0;
1838 attrs[j]->mod_values = ctl_val;
1839
1840 attrs[++j]->mod_op = op;
1841 attrs[j]->mod_type = SMB_ADS_ATTR_DNSHOST;
1842 fqh_val[0] = fqhost;
1843 fqh_val[1] = 0;
1844 attrs[j]->mod_values = fqh_val;
1845
1846 /* enctypes support starting in Windows Server 2008 */
1847 if (dclevel > SMB_ADS_DCLEVEL_W2K3) {
1848 attrs[++j]->mod_op = op;
1849 attrs[j]->mod_type = SMB_ADS_ATTR_ENCTYPES;
1850 (void) snprintf(encrypt_buf, sizeof (encrypt_buf), "%d",
1851 SMB_ADS_ENC_AES256 + SMB_ADS_ENC_AES128 + SMB_ADS_ENC_RC4 +
1852 SMB_ADS_ENC_DES_MD5 + SMB_ADS_ENC_DES_CRC);
1853 encrypt_val[0] = encrypt_buf;
1854 encrypt_val[1] = 0;
1855 attrs[j]->mod_values = encrypt_val;
1856 }
1857
1858 switch (op) {
1859 case LDAP_MOD_ADD:
1860 if ((ret = ldap_add_s(ah->ld, dn, attrs)) != LDAP_SUCCESS) {
1861 syslog(LOG_NOTICE, "ldap_add: %s",
1862 ldap_err2string(ret));
1863 ret = -1;
1864 }
1865 break;
1866
1867 case LDAP_MOD_REPLACE:
1868 if ((ret = ldap_modify_s(ah->ld, dn, attrs)) != LDAP_SUCCESS) {
1869 syslog(LOG_NOTICE, "ldap_modify: %s",
1870 ldap_err2string(ret));
1871 ret = -1;
1872 }
1873 break;
1874
1875 default:
1876 ret = -1;
1877
1878 }
1879
1880 smb_ads_free_attr(attrs);
1881 smb_krb5_free_pn_set(&spn);
1882 smb_krb5_free_pn_set(&upn);
1883
1884 return (ret);
1885 }
1886
1887 /*
1888 * Delete an ADS computer account.
1889 */
1890 static void
smb_ads_del_computer(smb_ads_handle_t * ah,char * dn)1891 smb_ads_del_computer(smb_ads_handle_t *ah, char *dn)
1892 {
1893 int rc;
1894
1895 if ((rc = ldap_delete_s(ah->ld, dn)) != LDAP_SUCCESS)
1896 smb_tracef("ldap_delete: %s", ldap_err2string(rc));
1897 }
1898
1899 /*
1900 * Gets the value of the given attribute.
1901 */
1902 static smb_ads_qstat_t
smb_ads_getattr(LDAP * ld,LDAPMessage * entry,smb_ads_avpair_t * avpair)1903 smb_ads_getattr(LDAP *ld, LDAPMessage *entry, smb_ads_avpair_t *avpair)
1904 {
1905 char **vals;
1906 smb_ads_qstat_t rc = SMB_ADS_STAT_FOUND;
1907
1908 assert(avpair);
1909 avpair->avp_val = NULL;
1910 vals = ldap_get_values(ld, entry, avpair->avp_attr);
1911 if (!vals)
1912 return (SMB_ADS_STAT_NOT_FOUND);
1913
1914 if (!vals[0]) {
1915 ldap_value_free(vals);
1916 return (SMB_ADS_STAT_NOT_FOUND);
1917 }
1918
1919 avpair->avp_val = strdup(vals[0]);
1920 if (!avpair->avp_val)
1921 rc = SMB_ADS_STAT_ERR;
1922
1923 ldap_value_free(vals);
1924 return (rc);
1925 }
1926
1927 /*
1928 * Process query's result.
1929 */
1930 static smb_ads_qstat_t
smb_ads_get_qstat(smb_ads_handle_t * ah,LDAPMessage * res,smb_ads_avpair_t * avpair)1931 smb_ads_get_qstat(smb_ads_handle_t *ah, LDAPMessage *res,
1932 smb_ads_avpair_t *avpair)
1933 {
1934 char fqhost[MAXHOSTNAMELEN];
1935 smb_ads_avpair_t dnshost_avp;
1936 smb_ads_qstat_t rc = SMB_ADS_STAT_FOUND;
1937 LDAPMessage *entry;
1938
1939 if (smb_ads_getfqhostname(ah, fqhost, MAXHOSTNAMELEN))
1940 return (SMB_ADS_STAT_ERR);
1941
1942 if (ldap_count_entries(ah->ld, res) == 0)
1943 return (SMB_ADS_STAT_NOT_FOUND);
1944
1945 if ((entry = ldap_first_entry(ah->ld, res)) == NULL)
1946 return (SMB_ADS_STAT_ERR);
1947
1948 dnshost_avp.avp_attr = SMB_ADS_ATTR_DNSHOST;
1949 rc = smb_ads_getattr(ah->ld, entry, &dnshost_avp);
1950
1951 switch (rc) {
1952 case SMB_ADS_STAT_FOUND:
1953 /*
1954 * Returns SMB_ADS_STAT_DUP to avoid overwriting
1955 * the computer account of another system whose
1956 * NetBIOS name collides with that of the current
1957 * system.
1958 */
1959 if (strcasecmp(dnshost_avp.avp_val, fqhost))
1960 rc = SMB_ADS_STAT_DUP;
1961
1962 free(dnshost_avp.avp_val);
1963 break;
1964
1965 case SMB_ADS_STAT_NOT_FOUND:
1966 /*
1967 * Pre-created computer account doesn't have
1968 * the dNSHostname attribute. It's been observed
1969 * that the dNSHostname attribute is only set after
1970 * a successful domain join.
1971 * Returns SMB_ADS_STAT_FOUND as the account is
1972 * pre-created for the current system.
1973 */
1974 rc = SMB_ADS_STAT_FOUND;
1975 break;
1976
1977 default:
1978 break;
1979 }
1980
1981 if (rc != SMB_ADS_STAT_FOUND)
1982 return (rc);
1983
1984 if (avpair)
1985 rc = smb_ads_getattr(ah->ld, entry, avpair);
1986
1987 return (rc);
1988
1989 }
1990
1991 /*
1992 * smb_ads_lookup_computer_n_attr
1993 *
1994 * If avpair is NULL, checks the status of the specified computer account.
1995 * Otherwise, looks up the value of the specified computer account's attribute.
1996 * If found, the value field of the avpair will be allocated and set. The
1997 * caller should free the allocated buffer.
1998 *
1999 * Return:
2000 * SMB_ADS_STAT_FOUND - if both the computer and the specified attribute is
2001 * found.
2002 * SMB_ADS_STAT_NOT_FOUND - if either the computer or the specified attribute
2003 * is not found.
2004 * SMB_ADS_STAT_DUP - if the computer account is already used by other systems
2005 * in the AD. This could happen if the hostname of multiple
2006 * systems resolved to the same NetBIOS name.
2007 * SMB_ADS_STAT_ERR - any failure.
2008 */
2009 static smb_ads_qstat_t
smb_ads_lookup_computer_n_attr(smb_ads_handle_t * ah,smb_ads_avpair_t * avpair,int scope,char * dn)2010 smb_ads_lookup_computer_n_attr(smb_ads_handle_t *ah, smb_ads_avpair_t *avpair,
2011 int scope, char *dn)
2012 {
2013 char *attrs[3], filter[SMB_ADS_MAXBUFLEN];
2014 LDAPMessage *res;
2015 char sam_acct[SMB_SAMACCT_MAXLEN], sam_acct2[SMB_SAMACCT_MAXLEN];
2016 smb_ads_qstat_t rc;
2017
2018 if (smb_getsamaccount(sam_acct, sizeof (sam_acct)) != 0)
2019 return (SMB_ADS_STAT_ERR);
2020
2021 res = NULL;
2022 attrs[0] = SMB_ADS_ATTR_DNSHOST;
2023 attrs[1] = NULL;
2024 attrs[2] = NULL;
2025
2026 if (avpair) {
2027 if (!avpair->avp_attr)
2028 return (SMB_ADS_STAT_ERR);
2029
2030 attrs[1] = avpair->avp_attr;
2031 }
2032
2033 if (smb_ads_escape_search_filter_chars(sam_acct, sam_acct2) != 0)
2034 return (SMB_ADS_STAT_ERR);
2035
2036 (void) snprintf(filter, sizeof (filter),
2037 "(&(objectClass=computer)(%s=%s))", SMB_ADS_ATTR_SAMACCT,
2038 sam_acct2);
2039
2040 if (ldap_search_s(ah->ld, dn, scope, filter, attrs, 0,
2041 &res) != LDAP_SUCCESS) {
2042 (void) ldap_msgfree(res);
2043 return (SMB_ADS_STAT_NOT_FOUND);
2044 }
2045
2046 rc = smb_ads_get_qstat(ah, res, avpair);
2047 /* free the search results */
2048 (void) ldap_msgfree(res);
2049 return (rc);
2050 }
2051
2052 /*
2053 * smb_ads_find_computer
2054 *
2055 * Starts by searching for the system's AD computer object in the default
2056 * container (i.e. cn=Computers). If not found, searches the entire directory.
2057 * If found, 'dn' will be set to the distinguished name of the system's AD
2058 * computer object.
2059 */
2060 static smb_ads_qstat_t
smb_ads_find_computer(smb_ads_handle_t * ah,char * dn)2061 smb_ads_find_computer(smb_ads_handle_t *ah, char *dn)
2062 {
2063 smb_ads_qstat_t stat;
2064 smb_ads_avpair_t avpair;
2065
2066 avpair.avp_attr = SMB_ADS_ATTR_DN;
2067 smb_ads_get_default_comp_container_dn(ah, dn, SMB_ADS_DN_MAX);
2068 stat = smb_ads_lookup_computer_n_attr(ah, &avpair, LDAP_SCOPE_ONELEVEL,
2069 dn);
2070
2071 if (stat == SMB_ADS_STAT_NOT_FOUND) {
2072 (void) strlcpy(dn, ah->domain_dn, SMB_ADS_DN_MAX);
2073 stat = smb_ads_lookup_computer_n_attr(ah, &avpair,
2074 LDAP_SCOPE_SUBTREE, dn);
2075 }
2076
2077 if (stat == SMB_ADS_STAT_FOUND) {
2078 (void) strlcpy(dn, avpair.avp_val, SMB_ADS_DN_MAX);
2079 free(avpair.avp_val);
2080 }
2081
2082 return (stat);
2083 }
2084
2085 /*
2086 * smb_ads_update_computer_cntrl_attr
2087 *
2088 * Modify the user account control attribute of an existing computer
2089 * object on AD.
2090 *
2091 * Returns LDAP error code.
2092 */
2093 static int
smb_ads_update_computer_cntrl_attr(smb_ads_handle_t * ah,int flags,char * dn)2094 smb_ads_update_computer_cntrl_attr(smb_ads_handle_t *ah, int flags, char *dn)
2095 {
2096 LDAPMod *attrs[2];
2097 char *ctl_val[2];
2098 int ret = 0;
2099 char usrctl_buf[16];
2100
2101 if (smb_ads_alloc_attr(attrs, sizeof (attrs) / sizeof (LDAPMod *)) != 0)
2102 return (LDAP_NO_MEMORY);
2103
2104 attrs[0]->mod_op = LDAP_MOD_REPLACE;
2105 attrs[0]->mod_type = SMB_ADS_ATTR_CTL;
2106
2107 (void) snprintf(usrctl_buf, sizeof (usrctl_buf), "%d", flags);
2108 ctl_val[0] = usrctl_buf;
2109 ctl_val[1] = 0;
2110 attrs[0]->mod_values = ctl_val;
2111 if ((ret = ldap_modify_s(ah->ld, dn, attrs)) != LDAP_SUCCESS) {
2112 syslog(LOG_NOTICE, "ldap_modify: %s", ldap_err2string(ret));
2113 }
2114
2115 smb_ads_free_attr(attrs);
2116 return (ret);
2117 }
2118
2119 /*
2120 * smb_ads_lookup_computer_attr_kvno
2121 *
2122 * Lookup the value of the Kerberos version number attribute of the computer
2123 * account.
2124 */
2125 static krb5_kvno
smb_ads_lookup_computer_attr_kvno(smb_ads_handle_t * ah,char * dn)2126 smb_ads_lookup_computer_attr_kvno(smb_ads_handle_t *ah, char *dn)
2127 {
2128 smb_ads_avpair_t avpair;
2129 int kvno = 1;
2130
2131 avpair.avp_attr = SMB_ADS_ATTR_KVNO;
2132 if (smb_ads_lookup_computer_n_attr(ah, &avpair,
2133 LDAP_SCOPE_BASE, dn) == SMB_ADS_STAT_FOUND) {
2134 kvno = atoi(avpair.avp_val);
2135 free(avpair.avp_val);
2136 }
2137
2138 return (kvno);
2139 }
2140
2141 /*
2142 * smb_ads_join
2143 *
2144 * Besides the NT-4 style domain join (using MS-RPC), CIFS server also
2145 * provides the domain join using Kerberos Authentication, Keberos
2146 * Change & Set password, and LDAP protocols. Basically, AD join
2147 * operation would require the following tickets to be acquired for the
2148 * the user account that is provided for the domain join.
2149 *
2150 * 1) a Keberos TGT ticket,
2151 * 2) a ldap service ticket, and
2152 * 3) kadmin/changpw service ticket
2153 *
2154 * The ADS client first sends a ldap search request to find out whether
2155 * or not the workstation trust account already exists in the Active Directory.
2156 * The existing computer object for this workstation will be removed and
2157 * a new one will be added. The machine account password is randomly
2158 * generated and set for the newly created computer object using KPASSWD
2159 * protocol (See RFC 3244). Once the password is set, our ADS client
2160 * finalizes the machine account by modifying the user acount control
2161 * attribute of the computer object. Kerberos keys derived from the machine
2162 * account password will be stored locally in /etc/krb5/krb5.keytab file.
2163 * That would be needed while acquiring Kerberos TGT ticket for the host
2164 * principal after the domain join operation.
2165 */
2166 smb_adjoin_status_t
smb_ads_join(char * domain,char * user,char * usr_passwd,char * machine_passwd)2167 smb_ads_join(char *domain, char *user, char *usr_passwd, char *machine_passwd)
2168 {
2169 smb_ads_handle_t *ah = NULL;
2170 krb5_context ctx = NULL;
2171 krb5_principal *krb5princs = NULL;
2172 krb5_kvno kvno;
2173 boolean_t des_only, delete = B_TRUE;
2174 smb_adjoin_status_t rc = SMB_ADJOIN_SUCCESS;
2175 boolean_t new_acct;
2176 int dclevel, num, usrctl_flags = 0;
2177 smb_ads_qstat_t qstat;
2178 char dn[SMB_ADS_DN_MAX];
2179 char tmpfile[] = SMBNS_KRB5_KEYTAB_TMP;
2180 int cnt;
2181 smb_krb5_pn_set_t spns;
2182
2183 krb5_enctype *encptr;
2184
2185 if ((ah = smb_ads_open_main(domain, user, usr_passwd)) == NULL) {
2186 smb_ccache_remove(SMB_CCACHE_PATH);
2187 return (SMB_ADJOIN_ERR_GET_HANDLE);
2188 }
2189
2190 if ((dclevel = smb_ads_get_dc_level(ah)) == -1) {
2191 smb_ads_close(ah);
2192 smb_ccache_remove(SMB_CCACHE_PATH);
2193 return (SMB_ADJOIN_ERR_GET_DCLEVEL);
2194 }
2195
2196 qstat = smb_ads_find_computer(ah, dn);
2197 switch (qstat) {
2198 case SMB_ADS_STAT_FOUND:
2199 new_acct = B_FALSE;
2200 if (smb_ads_modify_computer(ah, dclevel, dn) != 0) {
2201 smb_ads_close(ah);
2202 smb_ccache_remove(SMB_CCACHE_PATH);
2203 return (SMB_ADJOIN_ERR_MOD_TRUST_ACCT);
2204 }
2205 break;
2206
2207 case SMB_ADS_STAT_NOT_FOUND:
2208 new_acct = B_TRUE;
2209 smb_ads_get_default_comp_dn(ah, dn, SMB_ADS_DN_MAX);
2210 if (smb_ads_add_computer(ah, dclevel, dn) != 0) {
2211 smb_ads_close(ah);
2212 smb_ccache_remove(SMB_CCACHE_PATH);
2213 return (SMB_ADJOIN_ERR_ADD_TRUST_ACCT);
2214 }
2215 break;
2216
2217 default:
2218 if (qstat == SMB_ADS_STAT_DUP)
2219 rc = SMB_ADJOIN_ERR_DUP_TRUST_ACCT;
2220 else
2221 rc = SMB_ADJOIN_ERR_TRUST_ACCT;
2222 smb_ads_close(ah);
2223 smb_ccache_remove(SMB_CCACHE_PATH);
2224 return (rc);
2225 }
2226
2227 des_only = B_FALSE;
2228
2229 if (smb_krb5_ctx_init(&ctx) != 0) {
2230 rc = SMB_ADJOIN_ERR_INIT_KRB_CTX;
2231 goto adjoin_cleanup;
2232 }
2233
2234 if (smb_krb5_get_pn_set(&spns, SMB_PN_KEYTAB_ENTRY, ah->domain) == 0) {
2235 rc = SMB_ADJOIN_ERR_GET_SPNS;
2236 goto adjoin_cleanup;
2237 }
2238
2239 if (smb_krb5_get_kprincs(ctx, spns.s_pns, spns.s_cnt, &krb5princs)
2240 != 0) {
2241 smb_krb5_free_pn_set(&spns);
2242 rc = SMB_ADJOIN_ERR_GET_SPNS;
2243 goto adjoin_cleanup;
2244 }
2245
2246 cnt = spns.s_cnt;
2247 smb_krb5_free_pn_set(&spns);
2248
2249 /* New machine_passwd was filled in by our caller. */
2250 if (smb_krb5_setpwd(ctx, ah->domain, machine_passwd) != 0) {
2251 rc = SMB_ADJOIN_ERR_KSETPWD;
2252 goto adjoin_cleanup;
2253 }
2254
2255 kvno = smb_ads_lookup_computer_attr_kvno(ah, dn);
2256
2257 /*
2258 * Only members of Domain Admins and Enterprise Admins can set
2259 * the TRUSTED_FOR_DELEGATION userAccountControl flag.
2260 */
2261 if (smb_ads_update_computer_cntrl_attr(ah,
2262 SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT |
2263 SMB_ADS_USER_ACCT_CTL_TRUSTED_FOR_DELEGATION, dn)
2264 == LDAP_INSUFFICIENT_ACCESS) {
2265 usrctl_flags |= (SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT |
2266 SMB_ADS_USER_ACCT_CTL_DONT_EXPIRE_PASSWD);
2267
2268 syslog(LOG_NOTICE, "Unable to set the "
2269 "TRUSTED_FOR_DELEGATION userAccountControl flag on "
2270 "the machine account in Active Directory. Please refer "
2271 "to the Troubleshooting guide for more information.");
2272
2273 } else {
2274 usrctl_flags |= (SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT |
2275 SMB_ADS_USER_ACCT_CTL_TRUSTED_FOR_DELEGATION |
2276 SMB_ADS_USER_ACCT_CTL_DONT_EXPIRE_PASSWD);
2277 }
2278
2279 if (des_only)
2280 usrctl_flags |= SMB_ADS_USER_ACCT_CTL_USE_DES_KEY_ONLY;
2281
2282 if (smb_ads_update_computer_cntrl_attr(ah, usrctl_flags, dn)
2283 != 0) {
2284 rc = SMB_ADJOIN_ERR_UPDATE_CNTRL_ATTR;
2285 goto adjoin_cleanup;
2286 }
2287
2288 if (mktemp(tmpfile) == NULL) {
2289 rc = SMB_ADJOIN_ERR_WRITE_KEYTAB;
2290 goto adjoin_cleanup;
2291 }
2292
2293 encptr = smb_ads_get_enctypes(dclevel, &num);
2294 if (smb_krb5_kt_populate(ctx, ah->domain, krb5princs, cnt,
2295 tmpfile, kvno, machine_passwd, encptr, num) != 0) {
2296 rc = SMB_ADJOIN_ERR_WRITE_KEYTAB;
2297 goto adjoin_cleanup;
2298 }
2299
2300 delete = B_FALSE;
2301 adjoin_cleanup:
2302 if (new_acct && delete)
2303 smb_ads_del_computer(ah, dn);
2304
2305 if (rc != SMB_ADJOIN_ERR_INIT_KRB_CTX) {
2306 if (rc != SMB_ADJOIN_ERR_GET_SPNS)
2307 smb_krb5_free_kprincs(ctx, krb5princs, cnt);
2308 smb_krb5_ctx_fini(ctx);
2309 }
2310
2311 /* commit keytab file */
2312 if (rc == SMB_ADJOIN_SUCCESS) {
2313 if (rename(tmpfile, SMBNS_KRB5_KEYTAB) != 0) {
2314 (void) unlink(tmpfile);
2315 rc = SMB_ADJOIN_ERR_COMMIT_KEYTAB;
2316 }
2317 } else {
2318 (void) unlink(tmpfile);
2319 }
2320
2321 smb_ads_close(ah);
2322 smb_ccache_remove(SMB_CCACHE_PATH);
2323 return (rc);
2324 }
2325
2326 /*
2327 * smb_ads_join_errmsg
2328 *
2329 * Display error message for the specific adjoin error code.
2330 */
2331 void
smb_ads_join_errmsg(smb_adjoin_status_t status)2332 smb_ads_join_errmsg(smb_adjoin_status_t status)
2333 {
2334 int i;
2335 struct xlate_table {
2336 smb_adjoin_status_t status;
2337 char *msg;
2338 } adjoin_table[] = {
2339 { SMB_ADJOIN_ERR_GET_HANDLE, "Failed to connect to an "
2340 "Active Directory server." },
2341 { SMB_ADJOIN_ERR_GEN_PWD, "Failed to generate machine "
2342 "password." },
2343 { SMB_ADJOIN_ERR_GET_DCLEVEL, "Unknown functional level of "
2344 "the domain controller. The rootDSE attribute named "
2345 "\"domainControllerFunctionality\" is missing from the "
2346 "Active Directory." },
2347 { SMB_ADJOIN_ERR_ADD_TRUST_ACCT, "Failed to create the "
2348 "workstation trust account." },
2349 { SMB_ADJOIN_ERR_MOD_TRUST_ACCT, "Failed to modify the "
2350 "workstation trust account." },
2351 { SMB_ADJOIN_ERR_DUP_TRUST_ACCT, "Failed to create the "
2352 "workstation trust account because its name is already "
2353 "in use." },
2354 { SMB_ADJOIN_ERR_TRUST_ACCT, "Error in querying the "
2355 "workstation trust account" },
2356 { SMB_ADJOIN_ERR_INIT_KRB_CTX, "Failed to initialize Kerberos "
2357 "context." },
2358 { SMB_ADJOIN_ERR_GET_SPNS, "Failed to get Kerberos "
2359 "principals." },
2360 { SMB_ADJOIN_ERR_KSETPWD, "Failed to set machine password." },
2361 { SMB_ADJOIN_ERR_UPDATE_CNTRL_ATTR, "Failed to modify "
2362 "userAccountControl attribute of the workstation trust "
2363 "account." },
2364 { SMB_ADJOIN_ERR_WRITE_KEYTAB, "Error in writing to local "
2365 "keytab file (i.e /etc/krb5/krb5.keytab)." },
2366 { SMB_ADJOIN_ERR_IDMAP_SET_DOMAIN, "Failed to update idmap "
2367 "configuration." },
2368 { SMB_ADJOIN_ERR_IDMAP_REFRESH, "Failed to refresh idmap "
2369 "service." },
2370 { SMB_ADJOIN_ERR_COMMIT_KEYTAB, "Failed to commit changes to "
2371 "local keytab file (i.e. /etc/krb5/krb5.keytab)." }
2372 };
2373
2374 for (i = 0; i < sizeof (adjoin_table) / sizeof (adjoin_table[0]); i++) {
2375 if (adjoin_table[i].status == status)
2376 syslog(LOG_NOTICE, "%s", adjoin_table[i].msg);
2377 }
2378 }
2379
2380 /*
2381 * smb_ads_match_pdc
2382 *
2383 * Returns B_TRUE if the given host's IP address matches the preferred DC's
2384 * IP address. Otherwise, returns B_FALSE.
2385 */
2386 static boolean_t
smb_ads_match_pdc(smb_ads_host_info_t * host)2387 smb_ads_match_pdc(smb_ads_host_info_t *host)
2388 {
2389 boolean_t match = B_FALSE;
2390
2391 if (!host)
2392 return (match);
2393
2394 (void) mutex_lock(&smb_ads_cfg.c_mtx);
2395 if (smb_inet_equal(&host->ipaddr, &smb_ads_cfg.c_pdc))
2396 match = B_TRUE;
2397 (void) mutex_unlock(&smb_ads_cfg.c_mtx);
2398
2399 return (match);
2400 }
2401
2402 /*
2403 * smb_ads_select_dcfromsubnet
2404 *
2405 * This method walks the list of DCs and returns the first DC record that
2406 * responds to ldap ping and is in the same subnet as the host.
2407 *
2408 * Returns a pointer to the found DC record.
2409 * Returns NULL, on error or if no DC record is found.
2410 */
2411 static smb_ads_host_info_t *
smb_ads_select_dcfromsubnet(smb_ads_host_list_t * hlist)2412 smb_ads_select_dcfromsubnet(smb_ads_host_list_t *hlist)
2413 {
2414 smb_ads_host_info_t *hentry;
2415 smb_nic_t *lnic;
2416 smb_niciter_t ni;
2417 size_t cnt;
2418 int i;
2419
2420 if (smb_nic_getfirst(&ni) != SMB_NIC_SUCCESS)
2421 return (NULL);
2422 do {
2423 lnic = &ni.ni_nic;
2424 cnt = hlist->ah_cnt;
2425
2426 for (i = 0; i < cnt; i++) {
2427 hentry = &hlist->ah_list[i];
2428 if ((hentry->ipaddr.a_family == AF_INET) &&
2429 (lnic->nic_ip.a_family == AF_INET)) {
2430 if ((hentry->ipaddr.a_ipv4 &
2431 lnic->nic_mask) ==
2432 (lnic->nic_ip.a_ipv4 &
2433 lnic->nic_mask))
2434 if (smb_ads_ldap_ping(hentry) == 0)
2435 return (hentry);
2436 }
2437 }
2438 } while (smb_nic_getnext(&ni) == SMB_NIC_SUCCESS);
2439
2440 return (NULL);
2441 }
2442
2443 /*
2444 * smb_ads_select_dcfromlist
2445 *
2446 * This method walks the list of DCs and returns the first DC that
2447 * responds to ldap ping.
2448 *
2449 * Returns a pointer to the found DC record.
2450 * Returns NULL if no DC record is found.
2451 */
2452 static smb_ads_host_info_t *
smb_ads_select_dcfromlist(smb_ads_host_list_t * hlist)2453 smb_ads_select_dcfromlist(smb_ads_host_list_t *hlist)
2454 {
2455 smb_ads_host_info_t *hentry;
2456 size_t cnt;
2457 int i;
2458
2459 cnt = hlist->ah_cnt;
2460 for (i = 0; i < cnt; i++) {
2461 hentry = &hlist->ah_list[i];
2462 if (smb_ads_ldap_ping(hentry) == 0)
2463 return (hentry);
2464 }
2465
2466 return (NULL);
2467 }
2468
2469 /*
2470 * smb_ads_dc_compare
2471 *
2472 * Comparision function for sorting host entries (SRV records of DC) via qsort.
2473 * RFC 2052/2782 are taken as reference, while implementing this algorithm.
2474 *
2475 * Domain Controllers(DCs) with lowest priority in their SRV DNS records
2476 * are selected first. If they have equal priorities, then DC with highest
2477 * weight in its SRV DNS record is selected. If the priority and weight are
2478 * both equal, then the DC at the top of the list is selected.
2479 */
2480 static int
smb_ads_dc_compare(const void * p,const void * q)2481 smb_ads_dc_compare(const void *p, const void *q)
2482 {
2483 smb_ads_host_info_t *h1 = (smb_ads_host_info_t *)p;
2484 smb_ads_host_info_t *h2 = (smb_ads_host_info_t *)q;
2485
2486 if (h1->priority < h2->priority)
2487 return (-1);
2488 if (h1->priority > h2->priority)
2489 return (1);
2490
2491 /* Priorities are equal */
2492 if (h1->weight < h2->weight)
2493 return (1);
2494 if (h1->weight > h2->weight)
2495 return (-1);
2496
2497 return (0);
2498 }
2499
2500 /*
2501 * smb_ads_select_dc
2502 *
2503 * The list of ADS hosts returned by ADS lookup, is sorted by lowest priority
2504 * and highest weight. On this sorted list, following additional rules are
2505 * applied, to select a DC.
2506 *
2507 * - If there is a DC in the same subnet, then return the DC,
2508 * if it responds to ldap ping.
2509 * - Else, return first DC that responds to ldap ping.
2510 *
2511 * A reference to the host entry from input host list is returned.
2512 *
2513 * Returns NULL on error.
2514 */
2515 static smb_ads_host_info_t *
smb_ads_select_dc(smb_ads_host_list_t * hlist)2516 smb_ads_select_dc(smb_ads_host_list_t *hlist)
2517 {
2518 smb_ads_host_info_t *hentry = NULL;
2519
2520 if (hlist->ah_cnt == 0)
2521 return (NULL);
2522
2523 if (hlist->ah_cnt == 1) {
2524 hentry = hlist->ah_list;
2525 if (smb_ads_ldap_ping(hentry) == 0)
2526 return (hentry);
2527 }
2528
2529 /* Sort the list by priority and weight */
2530 qsort(hlist->ah_list, hlist->ah_cnt,
2531 sizeof (smb_ads_host_info_t), smb_ads_dc_compare);
2532
2533 if ((hentry = smb_ads_select_dcfromsubnet(hlist)) != NULL)
2534 return (hentry);
2535
2536 if ((hentry = smb_ads_select_dcfromlist(hlist)) != NULL)
2537 return (hentry);
2538
2539 return (NULL);
2540 }
2541
2542 /*
2543 * smb_ads_lookup_msdcs
2544 *
2545 * If server argument is set, try to locate the specified DC.
2546 * If it is set to empty string, locate any DCs in the specified domain.
2547 * Returns the discovered DC via buf.
2548 *
2549 * fqdn - fully-qualified domain name
2550 * server - fully-qualifed hostname of a DC
2551 * buf - the hostname of the discovered DC
2552 */
2553 boolean_t
smb_ads_lookup_msdcs(char * fqdn,char * server,char * buf,uint32_t buflen)2554 smb_ads_lookup_msdcs(char *fqdn, char *server, char *buf, uint32_t buflen)
2555 {
2556 smb_ads_host_info_t *hinfo = NULL;
2557 char *p;
2558 char *sought_host;
2559 char ipstr[INET6_ADDRSTRLEN];
2560
2561 if (!fqdn || !buf)
2562 return (B_FALSE);
2563
2564 ipstr[0] = '\0';
2565 *buf = '\0';
2566 sought_host = (*server == 0 ? NULL : server);
2567 if ((hinfo = smb_ads_find_host(fqdn, sought_host)) == NULL)
2568 return (B_FALSE);
2569
2570 (void) smb_inet_ntop(&hinfo->ipaddr, ipstr,
2571 SMB_IPSTRLEN(hinfo->ipaddr.a_family));
2572 smb_tracef("msdcsLookupADS: %s [%s]", hinfo->name, ipstr);
2573
2574 (void) strlcpy(buf, hinfo->name, buflen);
2575 /*
2576 * Remove the domain extension
2577 */
2578 if ((p = strchr(buf, '.')) != 0)
2579 *p = '\0';
2580
2581 free(hinfo);
2582 return (B_TRUE);
2583 }
2584
2585 static krb5_enctype *
smb_ads_get_enctypes(int dclevel,int * num)2586 smb_ads_get_enctypes(int dclevel, int *num)
2587 {
2588 krb5_enctype *encptr;
2589
2590 if (dclevel >= SMB_ADS_DCLEVEL_W2K8) {
2591 *num = sizeof (w2k8enctypes) / sizeof (krb5_enctype);
2592 encptr = w2k8enctypes;
2593 } else {
2594 *num = sizeof (pre_w2k8enctypes) / sizeof (krb5_enctype);
2595 encptr = pre_w2k8enctypes;
2596 }
2597
2598 return (encptr);
2599 }
2600