xref: /titanic_50/usr/src/lib/smbsrv/libmlsvc/common/mlsvc_util.c (revision 5c51f1241dbbdf2656d0e10011981411ed0c9673)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * Utility functions to support the RPC interface library.
28  */
29 
30 #include <stdio.h>
31 #include <stdarg.h>
32 #include <strings.h>
33 #include <unistd.h>
34 #include <netdb.h>
35 #include <stdlib.h>
36 #include <sys/time.h>
37 #include <sys/systm.h>
38 #include <syslog.h>
39 
40 #include <smbsrv/libsmb.h>
41 #include <smbsrv/libsmbrdr.h>
42 #include <smbsrv/libsmbns.h>
43 #include <smbsrv/libmlsvc.h>
44 #include <smbsrv/smbinfo.h>
45 #include <lsalib.h>
46 #include <samlib.h>
47 #include <smbsrv/netrauth.h>
48 
49 /* Domain join support (using MS-RPC) */
50 static boolean_t mlsvc_ntjoin_support = B_FALSE;
51 
52 extern int netr_open(char *, char *, mlsvc_handle_t *);
53 extern int netr_close(mlsvc_handle_t *);
54 extern DWORD netlogon_auth(char *, mlsvc_handle_t *, DWORD);
55 extern int mlsvc_user_getauth(char *, char *, smb_auth_info_t *);
56 
57 /*
58  * mlsvc_lookup_name
59  *
60  * This is just a wrapper for lsa_lookup_name.
61  *
62  * The memory for the sid is allocated using malloc so the caller should
63  * call free when it is no longer required.
64  */
65 uint32_t
66 mlsvc_lookup_name(char *name, smb_sid_t **sid, uint16_t *sid_type)
67 {
68 	smb_account_t account;
69 	uint32_t status;
70 
71 	status = lsa_lookup_name(name, *sid_type, &account);
72 	if (status == NT_STATUS_SUCCESS) {
73 		*sid = account.a_sid;
74 		account.a_sid = NULL;
75 		*sid_type = account.a_type;
76 		smb_account_free(&account);
77 	}
78 
79 	return (status);
80 }
81 
82 /*
83  * mlsvc_lookup_sid
84  *
85  * This is just a wrapper for lsa_lookup_sid.
86  *
87  * The allocated memory for the returned name must be freed by caller upon
88  * successful return.
89  */
90 uint32_t
91 mlsvc_lookup_sid(smb_sid_t *sid, char **name)
92 {
93 	smb_account_t ainfo;
94 	uint32_t status;
95 	int namelen;
96 
97 	if ((status = lsa_lookup_sid(sid, &ainfo)) == NT_STATUS_SUCCESS) {
98 		namelen = strlen(ainfo.a_domain) + strlen(ainfo.a_name) + 2;
99 		if ((*name = malloc(namelen)) != NULL)
100 			(void) snprintf(*name, namelen, "%s\\%s",
101 			    ainfo.a_domain, ainfo.a_name);
102 		else
103 			status = NT_STATUS_NO_MEMORY;
104 
105 		smb_account_free(&ainfo);
106 	}
107 
108 	return (status);
109 }
110 
111 DWORD
112 mlsvc_netlogon(char *server, char *domain)
113 {
114 	mlsvc_handle_t netr_handle;
115 	DWORD status;
116 
117 	if (netr_open(server, domain, &netr_handle) == 0) {
118 		if ((status = netlogon_auth(server, &netr_handle,
119 		    NETR_FLG_INIT)) != NT_STATUS_SUCCESS)
120 			syslog(LOG_NOTICE, "Failed to establish NETLOGON "
121 			    "credential chain");
122 		(void) netr_close(&netr_handle);
123 	} else {
124 		status = NT_STATUS_OPEN_FAILED;
125 	}
126 
127 	return (status);
128 }
129 
130 /*
131  * Joins the specified domain by creating a machine account on
132  * the selected domain controller.
133  *
134  * Disconnect any existing connection with the domain controller.
135  * This will ensure that no stale connection will be used, it will
136  * also pickup any configuration changes in either side by trying
137  * to establish a new connection.
138  *
139  * Returns NT status codes.
140  */
141 DWORD
142 mlsvc_join(smb_domain_t *dinfo, char *user, char *plain_text)
143 {
144 	smb_auth_info_t auth;
145 	int erc;
146 	DWORD status;
147 	char machine_passwd[NETR_MACHINE_ACCT_PASSWD_MAX];
148 	smb_adjoin_status_t err;
149 
150 	machine_passwd[0] = '\0';
151 
152 	(void) utf8_strupr(dinfo->d_nbdomain);
153 
154 	mlsvc_disconnect(dinfo->d_dc);
155 
156 	erc = mlsvc_logon(dinfo->d_dc, dinfo->d_nbdomain, user);
157 
158 	if (erc == AUTH_USER_GRANT) {
159 		if (mlsvc_ntjoin_support == B_FALSE) {
160 
161 			if ((err = smb_ads_join(dinfo->d_fqdomain, user,
162 			    plain_text, machine_passwd,
163 			    sizeof (machine_passwd))) == SMB_ADJOIN_SUCCESS) {
164 				status = NT_STATUS_SUCCESS;
165 			} else {
166 				smb_ads_join_errmsg(err);
167 				status = NT_STATUS_UNSUCCESSFUL;
168 			}
169 		} else {
170 			if (mlsvc_user_getauth(dinfo->d_dc, user, &auth)
171 			    != 0) {
172 				status = NT_STATUS_INVALID_PARAMETER;
173 				return (status);
174 			}
175 
176 			status = sam_create_trust_account(dinfo->d_dc,
177 			    dinfo->d_nbdomain, &auth);
178 			if (status == NT_STATUS_SUCCESS) {
179 				(void) smb_getnetbiosname(machine_passwd,
180 				    sizeof (machine_passwd));
181 				(void) utf8_strlwr(machine_passwd);
182 			}
183 		}
184 
185 		if (status == NT_STATUS_SUCCESS) {
186 			erc = smb_setdomainprops(NULL, dinfo->d_dc,
187 			    machine_passwd);
188 			if (erc != 0) {
189 				syslog(LOG_NOTICE, "Failed to update CIFS "
190 				    "configuration");
191 				return (NT_STATUS_UNSUCCESSFUL);
192 			}
193 
194 			status = mlsvc_netlogon(dinfo->d_dc, dinfo->d_nbdomain);
195 		}
196 	} else {
197 		status = NT_STATUS_LOGON_FAILURE;
198 	}
199 
200 	return (status);
201 }
202