From b73a05e4e184238614d73c1519f2880cd946908d Mon Sep 17 00:00:00 2001 From: Kai Blin Date: Sat, 23 Oct 2010 19:27:26 -0700 Subject: s4 net: rename to samba-tool in order to not clash with s3 net Autobuild-User: Kai Blin Autobuild-Date: Thu Oct 28 07:25:16 UTC 2010 on sn-devel-104 --- source4/samba_tool/drs/drs.c | 361 ++++++++++++++++ source4/samba_tool/drs/drs.h | 87 ++++ source4/samba_tool/drs/drs_bind.c | 136 ++++++ source4/samba_tool/drs/drs_kcc.c | 170 ++++++++ source4/samba_tool/drs/drs_replicate.c | 252 ++++++++++++ source4/samba_tool/drs/drs_showrepl.c | 605 +++++++++++++++++++++++++++ source4/samba_tool/gpo.c | 618 ++++++++++++++++++++++++++++ source4/samba_tool/password.c | 171 ++++++++ source4/samba_tool/samba_tool.c | 387 +++++++++++++++++ source4/samba_tool/samba_tool.h | 39 ++ source4/samba_tool/vampire.c | 130 ++++++ source4/samba_tool/wscript_build | 17 + source4/selftest/skip | 2 +- source4/selftest/tests.py | 2 +- source4/setup/tests/blackbox_group.sh | 78 ++-- source4/setup/tests/blackbox_newuser.sh | 22 +- source4/setup/tests/blackbox_setpassword.sh | 10 +- source4/setup/tests/blackbox_spn.sh | 24 +- source4/torture/drs/python/delete_object.py | 8 +- source4/torture/drs/python/fsmo.py | 6 +- source4/utils/net/config.mk | 50 --- source4/utils/net/drs/net_drs.c | 361 ---------------- source4/utils/net/drs/net_drs.h | 87 ---- source4/utils/net/drs/net_drs_bind.c | 136 ------ source4/utils/net/drs/net_drs_kcc.c | 170 -------- source4/utils/net/drs/net_drs_replicate.c | 252 ------------ source4/utils/net/drs/net_drs_showrepl.c | 605 --------------------------- source4/utils/net/net.c | 387 ----------------- source4/utils/net/net.h | 39 -- source4/utils/net/net_gpo.c | 618 ---------------------------- source4/utils/net/net_password.c | 171 -------- source4/utils/net/net_vampire.c | 130 ------ source4/utils/net/wscript_build | 18 - source4/utils/tests/test_net.sh | 40 -- source4/utils/tests/test_samba_tool.sh | 40 ++ source4/wscript_build | 2 +- 36 files changed, 3090 insertions(+), 3141 deletions(-) create mode 100644 source4/samba_tool/drs/drs.c create mode 100644 source4/samba_tool/drs/drs.h create mode 100644 source4/samba_tool/drs/drs_bind.c create mode 100644 source4/samba_tool/drs/drs_kcc.c create mode 100644 source4/samba_tool/drs/drs_replicate.c create mode 100644 source4/samba_tool/drs/drs_showrepl.c create mode 100644 source4/samba_tool/gpo.c create mode 100644 source4/samba_tool/password.c create mode 100644 source4/samba_tool/samba_tool.c create mode 100644 source4/samba_tool/samba_tool.h create mode 100644 source4/samba_tool/vampire.c create mode 100644 source4/samba_tool/wscript_build delete mode 100644 source4/utils/net/config.mk delete mode 100644 source4/utils/net/drs/net_drs.c delete mode 100644 source4/utils/net/drs/net_drs.h delete mode 100644 source4/utils/net/drs/net_drs_bind.c delete mode 100644 source4/utils/net/drs/net_drs_kcc.c delete mode 100644 source4/utils/net/drs/net_drs_replicate.c delete mode 100644 source4/utils/net/drs/net_drs_showrepl.c delete mode 100644 source4/utils/net/net.c delete mode 100644 source4/utils/net/net.h delete mode 100644 source4/utils/net/net_gpo.c delete mode 100644 source4/utils/net/net_password.c delete mode 100644 source4/utils/net/net_vampire.c delete mode 100644 source4/utils/net/wscript_build delete mode 100755 source4/utils/tests/test_net.sh create mode 100755 source4/utils/tests/test_samba_tool.sh (limited to 'source4') diff --git a/source4/samba_tool/drs/drs.c b/source4/samba_tool/drs/drs.c new file mode 100644 index 00000000000..78f8c144c28 --- /dev/null +++ b/source4/samba_tool/drs/drs.c @@ -0,0 +1,361 @@ +/* + Samba Unix/Linux SMB client library + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "librpc/gen_ndr/ndr_drsuapi_c.h" +#include "samba_tool/drs/drs.h" +#include "lib/ldb/include/ldb.h" +#include "ldb_wrap.h" +#include "system/filesys.h" + + +/** + * 'samba-tool drs' supported sub-commands + */ +static const struct net_functable net_drs_functable[] = { + { "bind", "Display replication features for a domain controller\n", net_drs_bind_cmd, net_drs_bind_usage }, + { "kcc", "Forces the KCC to recalculate replication topology for a specified domain controller\n", + net_drs_kcc_cmd, net_drs_kcc_usage }, + { "replicate", "Triggers replication event for the specified naming context between the source and destination domain controllers.\n", + net_drs_replicate_cmd, net_drs_replicate_usage }, + { "showrepl", "Displays the replication partners for each directory partition on the specified domain controller.\n", + net_drs_showrepl_cmd, net_drs_showrepl_usage }, + { NULL, NULL } +}; + +/** + * 'samba-tool drs' entry point + */ +int net_drs(struct net_context *ctx, int argc, const char **argv) +{ + return net_run_function(ctx, argc, argv, net_drs_functable, net_drs_usage); +} + +/** + * 'samba-tool drs' usage message + */ +int net_drs_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("samba-tool drs [options]\n"); + d_printf("\n"); + d_printf("Currently implemented commands:\n"); + d_printf(" bind - Display DC replication features\n"); + d_printf(" kcc - Forces the KCC to recalculate replication topology for a specified domain controller\n"); + d_printf(" replicate - Triggers replication event for the specified naming context between the source and destination domain controllers.\n"); + d_printf(" showrepl - Displays the replication partners for each directory partition on the specified domain controller.\n"); + return 0; +} + +/** + * Create drsuapi connection to remote DC + * and fill-in DC capabilities + */ +static bool net_drs_DsBind(struct net_drs_context *drs_ctx, struct net_drs_connection *conn) +{ + NTSTATUS status; + struct GUID bind_guid; + struct drsuapi_DsBind req; + struct drsuapi_DsBindInfoCtr in_bind_ctr; + union drsuapi_DsBindInfo *bind_info; + + SMB_ASSERT(conn->binding != NULL); + + status = dcerpc_pipe_connect_b(conn, + &conn->drs_pipe, + conn->binding, + &ndr_table_drsuapi, + drs_ctx->net_ctx->credentials, + drs_ctx->net_ctx->event_ctx, + drs_ctx->net_ctx->lp_ctx); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Failed to connect to server: %s\n", nt_errstr(status)); + return false; + } + conn->drs_handle = conn->drs_pipe->binding_handle; + + ZERO_STRUCT(in_bind_ctr); + in_bind_ctr.length = 48; + in_bind_ctr.info.info48.pid = (uint32_t)getpid(); + GUID_from_string(DRSUAPI_DS_BIND_GUID, &bind_guid); + req.in.bind_guid = &bind_guid; + req.in.bind_info = &in_bind_ctr; + req.out.bind_handle = &conn->bind_handle; + + status = dcerpc_drsuapi_DsBind_r(conn->drs_handle, conn, &req); + if (!NT_STATUS_IS_OK(status)) { + const char *errstr = nt_errstr(status); + d_printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr); + return false; + } else if (!W_ERROR_IS_OK(req.out.result)) { + d_printf("DsBind failed - %s\n", win_errstr(req.out.result)); + return false; + } + + /* fill-in remote DC capabilities */ + ZERO_STRUCT(conn->info48); + bind_info = &req.out.bind_info->info; + conn->bind_info_len = req.out.bind_info->length; + switch (conn->bind_info_len) { + case 48: + conn->info48.supported_extensions_ext = bind_info->info48.supported_extensions_ext; + conn->info48.config_dn_guid = bind_info->info48.config_dn_guid; + case 28: + conn->info48.repl_epoch = bind_info->info28.repl_epoch; + case 24: + conn->info48.supported_extensions = bind_info->info24.supported_extensions; + conn->info48.site_guid = bind_info->info24.site_guid; + conn->info48.pid = bind_info->info24.pid; + break; + default: + d_printf("Error: server returned BindInfo length %d", req.out.bind_info->length); + return false; + } + + return true; +} + +/** + * Close DRSUAPI connection to remote DC + */ +static bool net_drs_DsUnbind(struct net_drs_connection *conn) +{ + struct drsuapi_DsUnbind r; + struct policy_handle bind_handle; + + SMB_ASSERT(conn->drs_pipe); + + ZERO_STRUCT(r); + r.out.bind_handle = &bind_handle; + + r.in.bind_handle = &conn->bind_handle; + dcerpc_drsuapi_DsUnbind_r(conn->drs_handle, conn, &r); + + /* free dcerpc pipe in case we get called more than once */ + talloc_free(conn->drs_pipe); + conn->drs_pipe = NULL; + conn->drs_handle = NULL; + + return true; +} + +/** + * Destroy drsuapi connection + */ +static int net_drs_connection_destructor(struct net_drs_connection *conn) +{ + if (conn->drs_pipe) { + net_drs_DsUnbind(conn); + } + return 0; +} + +/** + * Create DRSUAPI connection to target DC + * @return ptr to net_drs_connection or NULL on failure + */ +struct net_drs_connection * net_drs_connect_dc(struct net_drs_context *drs_ctx, const char *dc_name) +{ + struct net_drs_connection *conn = NULL; + + conn = talloc_zero(drs_ctx, struct net_drs_connection); + NET_DRS_NOMEM_GOTO(conn, failed); + + /* init binding */ + conn->binding = talloc_zero(conn, struct dcerpc_binding); + conn->binding->transport = NCACN_IP_TCP; + conn->binding->flags = drs_ctx->drs_conn->binding->flags; + conn->binding->host = talloc_strdup(conn, dc_name); + conn->binding->target_hostname = conn->binding->host; + + if (!net_drs_DsBind(drs_ctx, conn)) { + goto failed; + } + + talloc_set_destructor(conn, net_drs_connection_destructor); + + return conn; + +failed: + talloc_free(conn); + return NULL; +} + +/** + * Open secured LDAP connection to remote DC + */ +static bool net_drs_ldap_connect(struct net_drs_context *drs_ctx) +{ + char *url; + bool bret = true; + + url = talloc_asprintf(drs_ctx, "ldap://%s/", drs_ctx->dc_name); + if (!url) { + d_printf(__location__ ": Have no memory"); + return false; + } + + drs_ctx->ldap.ldb = ldb_wrap_connect(drs_ctx, + drs_ctx->net_ctx->event_ctx, drs_ctx->net_ctx->lp_ctx, + url, + NULL, + drs_ctx->net_ctx->credentials, + 0); + if (drs_ctx->ldap.ldb == NULL) { + d_printf("Unable to connect to LDAP %s", url); + bret = false; + } + + talloc_free(url); + + return bret; +} + +/** + * fetch RootDSE record + */ +static bool net_drs_ldap_rootdse(struct net_drs_context *drs_ctx) +{ + int ret; + struct ldb_result *r; + struct ldb_dn *basedn; + static const char *attrs[] = { + "*", + NULL + }; + + SMB_ASSERT(drs_ctx->ldap.ldb != NULL); + + basedn = ldb_dn_new(drs_ctx, drs_ctx->ldap.ldb, NULL); + if (!basedn) { + d_printf(__location__ ": No memory"); + return false; + } + + ret = ldb_search(drs_ctx->ldap.ldb, drs_ctx, &r, + basedn, LDB_SCOPE_BASE, attrs, + "(objectClass=*)"); + talloc_free(basedn); + if (ret != LDB_SUCCESS) { + d_printf("RootDSE search failed: %s", ldb_errstring(drs_ctx->ldap.ldb)); + talloc_free(r); + return false; + } else if (r->count != 1) { + d_printf("RootDSE search returned more than one record!"); + talloc_free(r); + return false; + } + + drs_ctx->ldap.rootdse = r->msgs[0]; + + return true; +} + +/** + * parses binding from command line + * and gets target DC name + */ +static bool net_drs_parse_binding(struct net_drs_context *drs_ctx, const char *dc_binding) +{ + NTSTATUS status; + struct dcerpc_binding *b; + + status = dcerpc_parse_binding(drs_ctx->drs_conn, dc_binding, &b); + if (!NT_STATUS_IS_OK(status)) { + d_printf("Bad binding supplied %s\n", dc_binding); + return false; + } + + b->transport = NCACN_IP_TCP; + b->flags |= DCERPC_SIGN | DCERPC_SEAL; + + /* cache target DC name */ + drs_ctx->dc_name = b->target_hostname; + + drs_ctx->drs_conn->binding = b; + + return true; +} + +/** + * Free DRSUAPI connection upon net_drs_context + * destruction + */ +static int net_drs_context_destructor(struct net_drs_context *drs_ctx) +{ + if (drs_ctx->drs_conn && drs_ctx->drs_conn->drs_pipe) { + net_drs_DsUnbind(drs_ctx->drs_conn); + } + return 0; +} + +/** + * Create net_drs_context context to be used + * by 'samba-tool drs' sub-commands + */ +bool net_drs_create_context(struct net_context *net_ctx, + const char *dc_binding, + struct net_drs_context **_drs_ctx) +{ + struct net_drs_context *drs_ctx; + + drs_ctx = talloc_zero(net_ctx, struct net_drs_context); + if (!drs_ctx) { + d_printf(__location__ ": No memory"); + return false; + } + + drs_ctx->drs_conn = talloc_zero(drs_ctx, struct net_drs_connection); + if (!drs_ctx->drs_conn) { + d_printf(__location__ ": No memory"); + return false; + } + + drs_ctx->net_ctx = net_ctx; + + if (!net_drs_parse_binding(drs_ctx, dc_binding)) { + goto failed; + } + + /* LDAP connect */ + if (!net_drs_ldap_connect(drs_ctx)) { + goto failed; + } + /* fetch RootDSE */ + if (!net_drs_ldap_rootdse(drs_ctx)) { + goto failed; + } + + /* DRSUAPI connection */ + if (!net_drs_DsBind(drs_ctx, drs_ctx->drs_conn)) { + goto failed; + } + + /* set destructor to free any open connections */ + talloc_set_destructor(drs_ctx, net_drs_context_destructor); + + *_drs_ctx = drs_ctx; + return true; + +failed: + talloc_free(drs_ctx); + return false; +} diff --git a/source4/samba_tool/drs/drs.h b/source4/samba_tool/drs/drs.h new file mode 100644 index 00000000000..1e4cccc5385 --- /dev/null +++ b/source4/samba_tool/drs/drs.h @@ -0,0 +1,87 @@ +/* + Unix SMB/CIFS implementation. + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#ifndef SAMBA_TOOL_DRS_H_ +#define SAMBA_TOOL_DRS_H_ + +#include "librpc/gen_ndr/ndr_drsuapi_c.h" + + +/** + * Check for critical error + */ +#define NET_DRS_CHECK_GOTO(_condition,_label,_msg) \ + do { \ + if (!(_condition)) { \ + d_printf(__location__": "#_condition" - %s\n", _msg); \ + goto _label; \ + } \ + } while (0) + +/** + * check allocated memory macro + */ +#define NET_DRS_NOMEM_GOTO(_ptr,_label) \ + NET_DRS_CHECK_GOTO(_ptr, _label, "Not enough memory!") + + +/** + * DRSUAPI binding context + */ +struct net_drs_connection { + /* DRSUAPI connection context */ + struct dcerpc_binding *binding; + struct dcerpc_pipe *drs_pipe; + struct dcerpc_binding_handle *drs_handle; + struct policy_handle bind_handle; + + /* length of bind info structure returned by remote DC + * 'net drs bind' command make use of this value */ + uint32_t bind_info_len; + + /* remote DC DRSUAPI capabilities */ + struct drsuapi_DsBindInfo48 info48; +}; + + +/** + * net drs commands context + */ +struct net_drs_context { + struct net_context *net_ctx; + + /* remote DC name supplied from command line */ + const char *dc_name; + + /* DRSUAPI connection to target DC */ + struct net_drs_connection *drs_conn; + + /* LDAP connection to DC */ + struct net_drs_ldap { + struct ldb_context *ldb; + const struct ldb_message *rootdse; + } ldap; +}; + + +#include "samba_tool/drs/drs_proto.h" + +#endif /* SAMBA_TOOL_DRS_H_ */ diff --git a/source4/samba_tool/drs/drs_bind.c b/source4/samba_tool/drs/drs_bind.c new file mode 100644 index 00000000000..cc2ad87df4b --- /dev/null +++ b/source4/samba_tool/drs/drs_bind.c @@ -0,0 +1,136 @@ +/* + Unix SMB/CIFS implementation. + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "samba_tool/drs/drs.h" + + +#define DEFINE_FLAG(_flag, _win_name) {_flag, #_flag, _win_name} + +struct drs_extension_flag { + uint32_t flag; + const char *samba_name; + const char *win_name; +}; + +static const struct drs_extension_flag drs_repl_flags[] = { + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_BASE, "DRS_EXT_BASE"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION, "DRS_EXT_ASYNCREPL"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI, "DRS_EXT_REMOVEAPI"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2, "DRS_EXT_MOVEREQ_V2"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS, "DRS_EXT_GETCHG_DEFLATE"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1, "DRS_EXT_DCINFO_V1"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION, "DRS_EXT_RESTORE_USN_OPTIMIZATION"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY, "DRS_EXT_ADDENTRY"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE, "DRS_EXT_KCC_EXECUTE"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2, "DRS_EXT_ADDENTRY_V2"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION, "DRS_EXT_LINKED_VALUE_REPLICATION"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2, "DRS_EXT_DCINFO_V2"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD, "DRS_EXT_INSTANCE_TYPE_NOT_REQ_ON_MOD"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND, "DRS_EXT_CRYPTO_BIND"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO, "DRS_EXT_GET_REPL_INFO"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION, "DRS_EXT_STRONG_ENCRYPTION"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01, "DRS_EXT_DCINFO_VFFFFFFFF"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP, "DRS_EXT_TRANSITIVE_MEMBERSHIP"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY, "DRS_EXT_ADD_SID_HISTORY"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3, "DRS_EXT_POST_BETA3"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5, "DRS_EXT_GETCHGREQ_V5"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2, "DRS_EXT_GETMEMBERSHIPS2"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6, "DRS_EXT_GETCHGREQ_V6"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS, "DRS_EXT_NONDOMAIN_NCS"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8, "DRS_EXT_GETCHGREQ_V8"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5, "DRS_EXT_GETCHGREPLY_V5"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6, "DRS_EXT_GETCHGREPLY_V6"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3, "DRS_EXT_WHISTLER_BETA3"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7, "DRS_EXT_WHISTLER_BETA3"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT, "DRS_EXT_WHISTLER_BETA3"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS, "DRS_EXT_W2K3_DEFLATE"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V10, "DRS_EXT_GETCHGREQ_V10"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_RESERVED_PART2, "DRS_EXT_RESERVED_FOR_WIN2K_OR_DOTNET_PART2"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_RESERVED_PART3, "DRS_EXT_RESERVED_FOR_WIN2K_OR_DOTNET_PART3") +}; + +static const struct drs_extension_flag drs_repl_flags_ex[] = { + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADAM, "DRS_EXT_ADAM"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_LH_BETA2, "DRS_EXT_LH_BETA2"), + DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_RECYCLE_BIN, "DRS_EXT_RECYCLE_BIN") +}; + + + +int net_drs_bind_cmd(struct net_context *ctx, int argc, const char **argv) +{ + int i; + struct net_drs_context *drs_ctx; + struct drsuapi_DsBindInfo48 *info48; + + /* only one arg expected */ + if (argc != 1) { + return net_drs_bind_usage(ctx, argc, argv); + } + + if (!net_drs_create_context(ctx, argv[0], &drs_ctx)) { + return -1; + } + + d_printf("Bind to %s succeeded.\n", drs_ctx->dc_name); + d_printf("Extensions supported (cb=%d):\n", drs_ctx->drs_conn->bind_info_len); + + /* Print standard flags */ + info48 = &drs_ctx->drs_conn->info48; + for (i = 0; i < ARRAY_SIZE(drs_repl_flags); i++) { + const struct drs_extension_flag *repl_flag = &drs_repl_flags[i]; + d_printf(" %-60s: %-3s (%s)\n", repl_flag->samba_name, + info48->supported_extensions & repl_flag->flag ? "Yes" : "No", + repl_flag->win_name); + } + + /* Print Extended flags */ + d_printf("\n"); + d_printf("Extended Extensions supported:\n"); + for (i = 0; i < ARRAY_SIZE(drs_repl_flags_ex); i++) { + const struct drs_extension_flag *repl_flag_ex = &drs_repl_flags_ex[i]; + d_printf(" %-60s: %-3s (%s)\n", repl_flag_ex->samba_name, + info48->supported_extensions_ext & repl_flag_ex->flag ? "Yes" : "No", + repl_flag_ex->win_name); + } + + /* print additional info */ + d_printf("\n"); + d_printf("Site GUID: %s\n", GUID_string(drs_ctx, &info48->site_guid)); + d_printf("Repl epoch: %d\n", info48->repl_epoch); + if (GUID_all_zero(&info48->config_dn_guid)) { + d_printf("Forest GUID: (none)\n"); + } else { + d_printf("Forest GUID: %s\n", GUID_string(drs_ctx, &info48->config_dn_guid)); + } + + talloc_free(drs_ctx); + + return 0; +} + +int net_drs_bind_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("samba-tool drs bind \n"); + return 0; +} diff --git a/source4/samba_tool/drs/drs_kcc.c b/source4/samba_tool/drs/drs_kcc.c new file mode 100644 index 00000000000..fa8ea407dff --- /dev/null +++ b/source4/samba_tool/drs/drs_kcc.c @@ -0,0 +1,170 @@ +/* + Unix SMB/CIFS implementation. + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "samba_tool/drs/drs.h" +#include "lib/ldb/include/ldb.h" + + +static bool net_drs_kcc_site_info(struct net_drs_context *drs_ctx, + const char **site_name, + uint32_t *site_options) +{ + struct ldb_dn *dn; + const struct ldb_val *ldb_val; + TALLOC_CTX *mem_ctx; + int ret; + struct ldb_result *ldb_res; + static const char *attrs[] = { + "options", + "whenChanged", + NULL + }; + + mem_ctx = talloc_new(drs_ctx); + + /* get dsServiceName, which is NTDS Settings + * object for the server + * e.g.: CN=NTDS Settings,CN=,CN=Servers,CN=,CN=Sites, */ + dn = ldb_msg_find_attr_as_dn(drs_ctx->ldap.ldb, mem_ctx, drs_ctx->ldap.rootdse, "dsServiceName"); + if (!dn) { + d_printf("No dsServiceName value in RootDSE!\n"); + goto failed; + } + + /* work out site name */ + if (!ldb_dn_remove_child_components(dn, 3)) { + d_printf("Failed to find Site DN.\n"); + goto failed; + } + + ldb_val = ldb_dn_get_rdn_val(dn); + if (!ldb_val) { + d_printf("Failed to get site name.\n"); + goto failed; + } + *site_name = talloc_strndup(drs_ctx, (const char*)ldb_val->data, ldb_val->length); + + /* get 'NTDS Site Settings' */ + if (!ldb_dn_add_child_fmt(dn, "CN=NTDS Site Settings")) { + d_printf("Failed to create NTDS Site Settings DN.\n"); + goto failed; + } + + ret = ldb_search(drs_ctx->ldap.ldb, mem_ctx, &ldb_res, + dn, LDB_SCOPE_BASE, attrs, "(objectClass=*)"); + if (ret != LDB_SUCCESS) { + d_printf("Failed to get Site object\n"); + goto failed; + } + if (ldb_res->count != 1) { + d_printf("Error: returned %d messages for Site object.\n", ldb_res->count); + goto failed; + } + *site_options = ldb_msg_find_attr_as_uint(ldb_res->msgs[0], "options", 0); + + talloc_free(mem_ctx); + return true; + +failed: + talloc_free(mem_ctx); + return false; +} + +/** + * 'samba-tool drs kcc' command entry point + */ +int net_drs_kcc_cmd(struct net_context *ctx, int argc, const char **argv) +{ + NTSTATUS status; + struct net_drs_context *drs_ctx; + struct net_drs_connection *drs_conn; + struct drsuapi_DsBindInfo48 *info48; + struct drsuapi_DsExecuteKCC req; + union drsuapi_DsExecuteKCCRequest kcc_req; + const char *site_name; + uint32_t site_options; + + /* only one arg expected */ + if (argc != 1) { + return net_drs_kcc_usage(ctx, argc, argv); + } + + if (!net_drs_create_context(ctx, argv[0], &drs_ctx)) { + return -1; + } + drs_conn = drs_ctx->drs_conn; + info48 = &drs_conn->info48; + + /* check if target DC supports ExecuteKCC */ + if (!(info48->supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE)) { + d_printf("%s does not support EXECUTE_KCC extension.\n", drs_ctx->dc_name); + goto failed; + } + + /* gather some Site info */ + if (!net_drs_kcc_site_info(drs_ctx, &site_name, &site_options)) { + goto failed; + } + + d_printf("%s\n", site_name); + if (site_options) { + /* TODO: print meaningfull site options here */ + d_printf("Current Site Options: 0x%X\n", site_options); + } else { + d_printf("Current Site Options: (none)\n"); + } + + /* execute KCC */ + ZERO_STRUCT(req); + ZERO_STRUCT(kcc_req); + req.in.bind_handle = &drs_conn->bind_handle; + req.in.level = 1; + req.in.req = &kcc_req; + status = dcerpc_drsuapi_DsExecuteKCC_r(drs_conn->drs_handle, drs_ctx, &req); + if (!NT_STATUS_IS_OK(status)) { + const char *errstr = nt_errstr(status); + d_printf("dcerpc_drsuapi_DsExecuteKCC failed - %s.\n", errstr); + goto failed; + } else if (!W_ERROR_IS_OK(req.out.result)) { + d_printf("DsExecuteKCC failed - %s.\n", win_errstr(req.out.result)); + goto failed; + } + + d_printf("Consistency check on %s successful.\n", drs_ctx->dc_name); + + talloc_free(drs_ctx); + return 0; + +failed: + talloc_free(drs_ctx); + return -1; +} + +/** + * 'samba-tool drs kcc' usage + */ +int net_drs_kcc_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("samba-tool drs kcc \n"); + return 0; +} diff --git a/source4/samba_tool/drs/drs_replicate.c b/source4/samba_tool/drs/drs_replicate.c new file mode 100644 index 00000000000..36e0792e958 --- /dev/null +++ b/source4/samba_tool/drs/drs_replicate.c @@ -0,0 +1,252 @@ +/* + Unix SMB/CIFS implementation. + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "samba_tool/drs/drs.h" +#include "lib/ldb/include/ldb.h" +#include "dsdb/samdb/samdb.h" + + +/** + * Figure out what is the NDTS Settings objectGUID + * when DC_NAME is given + */ +static struct ldb_dn * +net_drs_server_dn_from_dc_name(struct net_drs_context *drs_ctx, + const char *dc_name) +{ + int ldb_err; + char *filter; + struct ldb_dn *dn; + struct ldb_dn *server_dn = NULL; + struct ldb_result *ldb_res; + static const char *attrs[] = { + "objectGUID", + "name", + "dNSHostName", + NULL + }; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_new(drs_ctx); + + /* Make DN for Sites container */ + dn = ldb_msg_find_attr_as_dn(drs_ctx->ldap.ldb, mem_ctx, drs_ctx->ldap.rootdse, "dsServiceName"); + NET_DRS_CHECK_GOTO(dn != NULL, failed, "RootDSE doesn't have dsServiceName!?\n"); + if (!ldb_dn_remove_child_components(dn, 4)) { + d_printf("Failed to make DN for Sites container.\n"); + goto failed; + } + + /* search for Server in Sites container */ + filter = talloc_asprintf(mem_ctx, + "(&(objectCategory=server)(|(name=%1$s)(dNSHostName=%1$s)))", + dc_name); + ldb_err = ldb_search(drs_ctx->ldap.ldb, mem_ctx, &ldb_res, + dn, LDB_SCOPE_SUBTREE, attrs, + "%s", + filter); + if (ldb_err != LDB_SUCCESS) { + d_printf("ldb_seach(base=%s, filter=%s) failed: %d (%s).\n", + ldb_dn_get_linearized(dn), + filter, + ldb_err, ldb_errstring(drs_ctx->ldap.ldb)); + goto failed; + } + if (ldb_res->count != 1) { + d_printf("ldb_search(base=%s, filter=%s) returned %d records, expected 1!\n", + ldb_dn_get_linearized(dn), + filter, + ldb_res->count); + goto failed; + } + + server_dn = talloc_steal(drs_ctx, ldb_res->msgs[0]->dn); + +failed: + talloc_free(mem_ctx); + return server_dn; +} + + +/** + * Figure out what is the NDTS Settings objectGUID + * when DC_NAME is given + */ +static bool net_drs_ntds_guid_from_dc_name(struct net_drs_context *drs_ctx, + const char *dc_name, + struct GUID *_ntds_guid) +{ + int ldb_err; + struct ldb_dn *server_dn; + struct ldb_result *ldb_res; + static const char *attrs[] = { + "objectGUID", + "msDS-portLDAP", + "name", + "objectCategory", + NULL + }; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_new(drs_ctx); + + /* resolve Server_DN for dc_name */ + server_dn = net_drs_server_dn_from_dc_name(drs_ctx, dc_name); + if (!server_dn) { + d_printf("DSA object for %s could not be found.\n", dc_name); + goto failed; + } + + /* move server_dn mem to local context */ + server_dn = talloc_steal(mem_ctx, server_dn); + + /* search ntdsDsa object under Server container */ + ldb_err = ldb_search(drs_ctx->ldap.ldb, mem_ctx, &ldb_res, + server_dn, LDB_SCOPE_ONELEVEL, attrs, + "%s", "(|(objectCategory=nTDSDSA)(objectCategory=nTDSDSARO))"); + if (ldb_err != LDB_SUCCESS) { + d_printf("ldb_seach() failed with err: %d (%s).\n", + ldb_err, ldb_errstring(drs_ctx->ldap.ldb)); + goto failed; + } + if (ldb_res->count != 1) { + d_printf("ldb_search() should return exactly one record!\n"); + goto failed; + } + + *_ntds_guid = samdb_result_guid(ldb_res->msgs[0], "objectGUID"); + + talloc_free(mem_ctx); + return true; + +failed: + talloc_free(mem_ctx); + return false; +} + +/** + * Sends DsReplicaSync to dc_name_dest to + * replicate naming context nc_dn_str from + * server with ntds_guid_src GUID + */ +static bool net_drs_replicate_sync_nc(struct net_drs_context *drs_ctx, + struct GUID ntds_guid_src, + const char *nc_dn_str, + uint32_t options) +{ + NTSTATUS status; + struct net_drs_connection *drs_conn; + struct drsuapi_DsReplicaSync req; + union drsuapi_DsReplicaSyncRequest sync_req; + struct drsuapi_DsReplicaObjectIdentifier nc; + + /* use already opened connection */ + drs_conn = drs_ctx->drs_conn; + + /* construct naming context object */ + ZERO_STRUCT(nc); + nc.dn = nc_dn_str; + + /* construct request object for DsReplicaSync */ + req.in.bind_handle = &drs_conn->bind_handle; + req.in.level = 1; + req.in.req = &sync_req; + req.in.req->req1.naming_context = &nc; + req.in.req->req1.options = options; + req.in.req->req1.source_dsa_dns = NULL; + req.in.req->req1.source_dsa_guid = ntds_guid_src; + + /* send DsReplicaSync request */ + status = dcerpc_drsuapi_DsReplicaSync_r(drs_conn->drs_handle, drs_ctx, &req); + if (!NT_STATUS_IS_OK(status)) { + const char *errstr = nt_errstr(status); + d_printf("DsReplicaSync RPC failed - %s.\n", errstr); + return false; + } else if (!W_ERROR_IS_OK(req.out.result)) { + d_printf("DsReplicaSync failed - %s (nc=[%s], dsa_guid=[%s]).\n", + win_errstr(req.out.result), + nc.dn, GUID_string(drs_ctx, &ntds_guid_src)); + return false; + } + + return true; +} + +/** + * 'samba-tool drs replicate' command entry point + */ +int net_drs_replicate_cmd(struct net_context *ctx, int argc, const char **argv) +{ + bool bret; + struct net_drs_context *drs_ctx; + struct GUID ntds_guid_src; + const char *dc_name_dest; + const char *dc_name_src; + const char *nc_dn_str; + + /* only one arg expected */ + if (argc != 3) { + return net_drs_replicate_usage(ctx, argc, argv); + } + + dc_name_dest = argv[0]; + dc_name_src = argv[1]; + nc_dn_str = argv[2]; + + if (!net_drs_create_context(ctx, dc_name_dest, &drs_ctx)) { + return -1; + } + + /* Resolve source DC_NAME to its NDTS Settings GUID */ + if (!net_drs_ntds_guid_from_dc_name(drs_ctx, dc_name_src, &ntds_guid_src)) { + d_printf("Error: DSA object for %s could not be found.\n", dc_name_src); + goto failed; + } + + /* Synchronize given Naming Context */ + bret = net_drs_replicate_sync_nc(drs_ctx, + ntds_guid_src, nc_dn_str, + DRSUAPI_DRS_WRIT_REP); + if (!bret) { + goto failed; + } + + d_printf("Replicate from %s to %s was successful.\n", dc_name_src, drs_ctx->dc_name); + + talloc_free(drs_ctx); + return 0; + +failed: + d_printf("Replicate terminated with errors.\n"); + talloc_free(drs_ctx); + return -1; +} + +/** + * 'samba-tool drs replicate' usage + */ +int net_drs_replicate_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("samba-tool drs replicate \n"); + return 0; +} diff --git a/source4/samba_tool/drs/drs_showrepl.c b/source4/samba_tool/drs/drs_showrepl.c new file mode 100644 index 00000000000..f399097008a --- /dev/null +++ b/source4/samba_tool/drs/drs_showrepl.c @@ -0,0 +1,605 @@ +/* + Unix SMB/CIFS implementation. + + Implements functions offered by repadmin.exe tool under Windows + + Copyright (C) Kamen Mazdrashki 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "samba_tool/drs/drs.h" +#include "lib/ldb/include/ldb.h" +#include "dsdb/samdb/samdb.h" +#include "lib/util/util_ldb.h" + + +/** + * Parses NTDS Settings DN to find out: + * - DC name + * - Site name + * - Domain DNS name + */ +static bool net_drs_parse_ntds_dn(struct ldb_dn *ntds_dn, + TALLOC_CTX *mem_ctx, + const char **_dc_name, + const char **_site_name, + const char **_domain_dns_name) +{ + struct ldb_dn *dn = NULL; + const struct ldb_val *val; + + dn = ldb_dn_copy(mem_ctx, ntds_dn); + NET_DRS_NOMEM_GOTO(dn, failed); + + /* remove NTDS Settings component */ + ldb_dn_remove_child_components(dn, 1); + if (_dc_name) { + val = ldb_dn_get_rdn_val(dn); + *_dc_name = talloc_strdup(mem_ctx, (const char *)val->data); + } + + /* remove DC and Servers components */ + ldb_dn_remove_child_components(dn, 2); + if (_site_name) { + val = ldb_dn_get_rdn_val(dn); + *_site_name = talloc_strdup(mem_ctx, (const char *)val->data); + } + + if (_domain_dns_name) { + char *pstr; + char *dns_name; + + dns_name = ldb_dn_canonical_string(mem_ctx, dn); + NET_DRS_NOMEM_GOTO(dns_name, failed); + + pstr = strchr(dns_name, '/'); + if (pstr) { + *pstr = '\0'; + } + + *_domain_dns_name = dns_name; + } + + talloc_free(dn); + return true; + +failed: + talloc_free(dn); + return false; +} + +static char * net_drs_dc_canonical_string(struct ldb_dn *ntds_dn, TALLOC_CTX *mem_ctx) +{ + const char *dc_name; + const char *site_name; + char *canonical_name; + + if (!net_drs_parse_ntds_dn(ntds_dn, mem_ctx, &dc_name, &site_name, NULL)) { + return NULL; + } + + canonical_name = talloc_asprintf(mem_ctx, "%s\\%s", site_name, dc_name); + + talloc_free(discard_const(dc_name)); + talloc_free(discard_const(site_name)); + + return canonical_name; +} + +/** + * Prints DC information for showrepl command + */ +static bool net_drs_showrepl_print_dc_info(struct net_drs_context *drs_ctx) +{ + int ret; + const char *dc_name; + const char *site_name; + struct ldb_dn *dn; + struct ldb_message **ntds_msgs; + struct ldb_message **site_msgs; + uint32_t options; + struct GUID guid; + TALLOC_CTX *mem_ctx; + const char *ntds_attr[] = {"options", "objectGuid", "invocationId", NULL}; + const char *site_ntds_attr[] = {"options", "whenChanged", NULL}; + + mem_ctx = talloc_new(drs_ctx); + + /* Get NTDS Settings DN string for the DC */ + dn = samdb_result_dn(drs_ctx->ldap.ldb, mem_ctx, + drs_ctx->ldap.rootdse, "dsServiceName", NULL); + NET_DRS_CHECK_GOTO(dn, failed, "No dsServiceName value in RootDSE!\n"); + + /* parse NTDS Settings DN */ + if (!net_drs_parse_ntds_dn(dn, mem_ctx, &dc_name, &site_name, NULL)) { + d_printf("Unexpected: Failed to parse %s DN!\n", + ldb_dn_get_linearized(dn)); + goto failed; + } + + /* Query DC record for DSA's NTDS Settings DN */ + ret = gendb_search_dn(drs_ctx->ldap.ldb, mem_ctx, dn, &ntds_msgs, ntds_attr); + if (ret != 1) { + d_printf("Error while fetching %s, Possible error: %s\n", + ldb_dn_get_linearized(dn), + ldb_errstring(drs_ctx->ldap.ldb)); + goto failed; + } + + /* find out NTDS Site Settings DN */ + if (!ldb_dn_remove_child_components(dn, 3)) { + d_printf("Unexpected: ldb_dn_remove_child_components() failed!\n"); + goto failed; + } + if (!ldb_dn_add_child_fmt(dn, "CN=%s", "NTDS Site Settings")) { + d_printf("Unexpected: ldb_dn_add_child_fmt() failed!\n"); + goto failed; + } + /* Query Site record for DSA's NTDS Settings DN */ + ret = gendb_search_dn(drs_ctx->ldap.ldb, mem_ctx, dn, &site_msgs, site_ntds_attr); + if (ret != 1) { + d_printf("Error while fetching %s, Possible error: %s\n", + ldb_dn_get_linearized(dn), + ldb_errstring(drs_ctx->ldap.ldb)); + goto failed; + } + + /* Site-name\DC-name */ + d_printf("%s\\%s\n", site_name, dc_name); + /* DSA Options */ + options = ldb_msg_find_attr_as_uint(ntds_msgs[0], "options", 0); + if (options) { + /* TODO: Print options as string in IS_GC... etc form */ + d_printf("DSA Options: 0x%08X\n", options); + } else { + d_printf("DSA Options: (none)\n"); + } + /* Site Options */ + options = ldb_msg_find_attr_as_uint(site_msgs[0], "options", 0); + if (options) { + /* TODO: Print options in string */ + d_printf("DSA Options: 0x%08X\n", options); + } else { + d_printf("Site Options: (none)\n"); + } + /* DSA GUID */ + guid = samdb_result_guid(ntds_msgs[0], "objectGUID"); + d_printf("DSA object GUID: %s\n", GUID_string(mem_ctx, &guid)); + /* DSA invocationId */ + guid = samdb_result_guid(ntds_msgs[0], "invocationId"); + d_printf("DSA invocationID: %s\n", GUID_string(mem_ctx, &guid)); + + talloc_free(mem_ctx); + return true; + +failed: + talloc_free(mem_ctx); + return false; +} + +/** + * Convenience function to call DsReplicaGetInfo + */ +static bool net_drs_exec_DsReplicaGetInfo(struct net_drs_context *drs_ctx, + enum drsuapi_DsReplicaInfoType info_type, + union drsuapi_DsReplicaInfo *_replica_info) +{ + NTSTATUS status; + struct drsuapi_DsReplicaGetInfo r; + union drsuapi_DsReplicaGetInfoRequest req; + enum drsuapi_DsReplicaInfoType info_type_got; + struct net_drs_connection *drs_conn = drs_ctx->drs_conn; + + ZERO_STRUCT(req); + req.req1.info_type = info_type; + + r.in.bind_handle = &drs_conn->bind_handle; + r.in.level = 1; + r.in.req = &req; + r.out.info = _replica_info; + r.out.info_type = &info_type_got; + + status = dcerpc_drsuapi_DsReplicaGetInfo_r(drs_conn->drs_handle, drs_ctx, &r); + if (!NT_STATUS_IS_OK(status)) { + const char *errstr = nt_errstr(status); + d_printf("DsReplicaGetInfo failed - %s.\n", errstr); + return false; + } else if (!W_ERROR_IS_OK(r.out.result)) { + d_printf("DsReplicaGetInfo failed - %s.\n", win_errstr(r.out.result)); + return false; + } + + if (info_type != info_type_got) { + d_printf("DsReplicaGetInfo: Error requested info %d, got info %d.\n", + info_type, info_type_got); + return false; + } + + return true; +} + +/** + * Return transport type string for given transport object DN. + * Currently always return 'RPC'. + * + * TODO: Implement getting transport type for all kind of transports + */ +static const char * +net_drs_transport_type_str(struct net_drs_context *drs_ctx, const char *transport_obj_dn) +{ + return "RPC"; +} + +/** + * Prints most of the info we got about + * a replication partner + */ +static bool net_drs_showrepl_print_heighbor(struct net_drs_context *drs_ctx, + struct drsuapi_DsReplicaNeighbour *neighbor) +{ + struct ldb_dn *ntds_dn; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_new(drs_ctx); + + ntds_dn = ldb_dn_new(drs_ctx, drs_ctx->ldap.ldb, neighbor->source_dsa_obj_dn); + NET_DRS_NOMEM_GOTO(ntds_dn, failed); + + d_printf("%s\n", neighbor->naming_context_dn); + /* TODO: Determine connection type */ + d_printf("\t%s via %s\n", + net_drs_dc_canonical_string(ntds_dn, mem_ctx), + net_drs_transport_type_str(drs_ctx, neighbor->transport_obj_dn)); + d_printf("\t\tDSA object GUID: %s\n", GUID_string(mem_ctx, &neighbor->source_dsa_obj_guid)); + if (W_ERROR_IS_OK(neighbor->result_last_attempt)) { + d_printf("\t\tLast attempt @ %s was successful.\n", + nt_time_string(mem_ctx, neighbor->last_attempt)); + } else { + d_printf("\t\tLast attempt @ %s failed, result %d (%s):\n", + nt_time_string(mem_ctx, neighbor->last_attempt), + W_ERROR_V(neighbor->result_last_attempt), + win_errstr(neighbor->result_last_attempt)); + d_printf("\t\t\t%s\n", get_friendly_werror_msg(neighbor->result_last_attempt)); + } + d_printf("\t\t%d consecutive failure(s).\n", neighbor->consecutive_sync_failures); + d_printf("\t\tLast success @ %s\n", nt_time_string(mem_ctx, neighbor->last_success)); + + talloc_free(mem_ctx); + return true; + +failed: + talloc_free(mem_ctx); + return false; +} + +/** + * Prints list of all servers that target DC + * replicates from + */ +static bool net_drs_showrepl_print_inbound_neihbors(struct net_drs_context *drs_ctx) +{ + int i; + bool bret; + struct drsuapi_DsReplicaNeighbourCtr *reps_from; + union drsuapi_DsReplicaInfo replica_info; + + d_printf("\n==== INBOUND NEIGHBORS ====\n"); + + bret = net_drs_exec_DsReplicaGetInfo(drs_ctx, + DRSUAPI_DS_REPLICA_INFO_NEIGHBORS, &replica_info); + if (!bret) { + d_printf("DsReplicaGetInfo() failed for DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES.\n"); + return false; + } + reps_from = replica_info.neighbours; + + for (i = 0; i < reps_from->count; i++) { + d_printf("\n"); + net_drs_showrepl_print_heighbor(drs_ctx, &reps_from->array[i]); + } + + return true; +} + +/** + * Prints list of all servers that target DC + * notifies for changes + */ +static bool net_drs_showrepl_print_outbound_neihbors(struct net_drs_context *drs_ctx) +{ + int i; + bool bret; + struct drsuapi_DsReplicaNeighbourCtr *reps_to; + union drsuapi_DsReplicaInfo replica_info; + + d_printf("\n==== OUTBOUND NEIGHBORS ====\n"); + + bret = net_drs_exec_DsReplicaGetInfo(drs_ctx, + DRSUAPI_DS_REPLICA_INFO_REPSTO, &replica_info); + if (!bret) { + d_printf("DsReplicaGetInfo() failed for DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES.\n"); + return false; + } + reps_to = replica_info.repsto; + + for (i = 0; i < reps_to->count; i++) { + d_printf("\n"); + net_drs_showrepl_print_heighbor(drs_ctx, &reps_to->array[i]); + } + + return true; +} + +/** + * Prints all connections under + * NTDS Settings for target DC. + * + * NOTE: All connections are printed + * no matter what their status is + */ +static bool net_drs_showrepl_print_connection_objects(struct net_drs_context *drs_ctx) +{ + int i; + int conn_count; + struct ldb_message **conn_msgs; + struct ldb_dn *dn; + uint32_t options; + const char *dc_dns_name; + TALLOC_CTX *mem_ctx; + const char *conn_attr[] = { + "name", + "enabledConnection", + "fromServer", + "mS-DS-ReplicatesNCReason", + "options", + "schedule", + "transportType", + "whenChanged", + "whenCreated", + NULL + }; + + mem_ctx = talloc_new(drs_ctx); + + d_printf("\n==== KCC CONNECTION OBJECTS ====\n"); + + /* Get NTDS Settings DN string for the DC */ + dn = samdb_result_dn(drs_ctx->ldap.ldb, mem_ctx, + drs_ctx->ldap.rootdse, "dsServiceName", NULL); + NET_DRS_CHECK_GOTO(dn, failed, "No dsServiceName value in RootDSE!\n"); + + /* DNS host name for target DC */ + dc_dns_name = ldb_msg_find_attr_as_string(drs_ctx->ldap.rootdse , "dnsHostName", NULL); + NET_DRS_CHECK_GOTO(dc_dns_name, failed, "No dsServiceName value in dnsHostName!\n"); + + /* Enum. Connection objects under NTDS Settings */ + conn_count = gendb_search(drs_ctx->ldap.ldb, mem_ctx, dn, + &conn_msgs, conn_attr, "(objectClass=nTDSConnection)"); + if (conn_count == -1) { + d_printf("Error searching Connections for %s, Possible error: %s\n", + ldb_dn_get_linearized(dn), + ldb_errstring(drs_ctx->ldap.ldb)); + goto failed; + } + + for (i = 0; i < conn_count; i++) { + int k; + const char *transport_type; + struct ldb_message_element *msg_elem; + struct ldb_message *conn_msg = conn_msgs[i]; + + d_printf("Connection --\n"); + d_printf("\tConnection name : %s\n", + ldb_msg_find_attr_as_string(conn_msg, "name", NULL)); + d_printf("\tEnabled : %s\n", + ldb_msg_find_attr_as_string(conn_msg, "enabledConnection", "TRUE")); + d_printf("\tServer DNS name : %s\n", dc_dns_name); + d_printf("\tServer DN name : %s\n", + ldb_msg_find_attr_as_string(conn_msg, "fromServer", NULL)); + transport_type = ldb_msg_find_attr_as_string(conn_msg, "transportType", NULL); + d_printf("\t\tTransportType: %s\n", + net_drs_transport_type_str(drs_ctx, transport_type)); + /* TODO: print Connection options in friendly format */ + options = ldb_msg_find_attr_as_uint(conn_msg, "options", 0); + d_printf("\t\toptions: 0x%08X\n", options); + + /* print replicated NCs for this connection */ + msg_elem = ldb_msg_find_element(conn_msg, "mS-DS-ReplicatesNCReason"); + if (!msg_elem) { + d_printf("Warning: No NC replicated for Connection!\n"); + continue; + } + for (k = 0; k < msg_elem->num_values; k++) { + struct dsdb_dn *bin_dn; + + bin_dn = dsdb_dn_parse(mem_ctx, drs_ctx->ldap.ldb, + &msg_elem->values[k], DSDB_SYNTAX_BINARY_DN); + if (!bin_dn) { + d_printf("Unexpected: Failed to parse DN - %s\n", + msg_elem->values[k].data); + } + d_printf("\t\tReplicatesNC: %s\n", ldb_dn_get_linearized(bin_dn->dn)); + /* TODO: print Reason flags in friendly format */ + options = RIVAL(bin_dn->extra_part.data, 0); + d_printf("\t\tReason: 0x%08X\n", options); + d_printf("\t\t\tReplica link has been added.\n"); + } + } + + talloc_free(mem_ctx); + return true; + +failed: + talloc_free(mem_ctx); + return false; +} + +/** + * Prints all DC's connections failure. + * + * NOTE: Still don't know exactly what + * this information means + */ +static bool net_drs_showrepl_print_connect_failures(struct net_drs_context *drs_ctx) +{ + int i; + bool bret; + struct ldb_dn *ntds_dn; + struct drsuapi_DsReplicaKccDsaFailure *failure; + struct drsuapi_DsReplicaKccDsaFailuresCtr *connect_failures; + union drsuapi_DsReplicaInfo replica_info; + TALLOC_CTX *mem_ctx; + + d_printf("\n==== CONNECION FAILURES ====\n"); + + bret = net_drs_exec_DsReplicaGetInfo(drs_ctx, + DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES, + &replica_info); + if (!bret) { + d_printf("DsReplicaGetInfo() failed for DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES.\n"); + return false; + } + connect_failures = replica_info.connectfailures; + + mem_ctx = talloc_new(drs_ctx); + + for (i = 0; i < connect_failures->count; i++) { + failure = &connect_failures->array[i]; + + ntds_dn = ldb_dn_new(mem_ctx, drs_ctx->ldap.ldb, failure->dsa_obj_dn); + d_printf("Source: %s\n", net_drs_dc_canonical_string(ntds_dn, mem_ctx)); + d_printf("******* %d CONSECUTIVE FAILURES since %s\n", + failure->num_failures, + nt_time_string(mem_ctx, failure->first_failure)); + d_printf("Last error: %d (%s):\n", + W_ERROR_V(failure->last_result), + win_errstr(failure->last_result)); + d_printf("\t\t\t%s\n", get_friendly_werror_msg(failure->last_result)); + } + + talloc_free(mem_ctx); + return true; +} + +/** + * Prints all DC's link failures + */ +static bool net_drs_showrepl_print_link_failures(struct net_drs_context *drs_ctx) +{ + int i; + bool bret; + struct ldb_dn *ntds_dn; + struct drsuapi_DsReplicaKccDsaFailure *failure; + struct drsuapi_DsReplicaKccDsaFailuresCtr *link_failures; + union drsuapi_DsReplicaInfo replica_info; + TALLOC_CTX *mem_ctx; + + d_printf("\n==== LINK FAILURES ====\n"); + + bret = net_drs_exec_DsReplicaGetInfo(drs_ctx, + DRSUAPI_DS_REPLICA_INFO_KCC_DSA_LINK_FAILURES, &replica_info); + if (!bret) { + d_printf("DsReplicaGetInfo() failed for DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES.\n"); + return false; + } + link_failures = replica_info.linkfailures; + + mem_ctx = talloc_new(drs_ctx); + + for (i = 0; i < link_failures->count; i++) { + failure = &link_failures->array[i]; + + ntds_dn = ldb_dn_new(mem_ctx, drs_ctx->ldap.ldb, failure->dsa_obj_dn); + d_printf("Source: %s\n", net_drs_dc_canonical_string(ntds_dn, mem_ctx)); + d_printf("******* %d CONSECUTIVE FAILURES since %s\n", + failure->num_failures, + nt_time_string(mem_ctx, failure->first_failure)); + d_printf("Last error: %d (%s):\n", + W_ERROR_V(failure->last_result), + win_errstr(failure->last_result)); + d_printf("\t\t\t%s\n", get_friendly_werror_msg(failure->last_result)); + } + + talloc_free(mem_ctx); + return true; +} + +/** + * 'samba-tool drs showrepl' command entry point + */ +int net_drs_showrepl_cmd(struct net_context *ctx, int argc, const char **argv) +{ + const char *dc_name; + struct net_drs_context *drs_ctx = NULL; + + /* only one arg expected */ + if (argc != 1) { + return net_drs_showrepl_usage(ctx, argc, argv); + } + + dc_name = argv[0]; + + if (!net_drs_create_context(ctx, dc_name, &drs_ctx)) { + goto failed; + } + + /* Print DC and Site info */ + if (!net_drs_showrepl_print_dc_info(drs_ctx)) { + goto failed; + } + + /* INBOUND Neighbors */ + if (!net_drs_showrepl_print_inbound_neihbors(drs_ctx)) { + goto failed; + } + + /* OUTBOUND Neighbors */ + if (!net_drs_showrepl_print_outbound_neihbors(drs_ctx)) { + goto failed; + } + + /* Connection objects for DC */ + if (!net_drs_showrepl_print_connection_objects(drs_ctx)) { + goto failed; + } + + /* Connection failures */ + if (!net_drs_showrepl_print_connect_failures(drs_ctx)) { + goto failed; + } + + /* Link failures */ + if (!net_drs_showrepl_print_link_failures(drs_ctx)) { + goto failed; + } + + talloc_free(drs_ctx); + return 0; + +failed: + talloc_free(drs_ctx); + return -1; +} + +/** + * 'samba-tool drs showrepl' usage + */ +int net_drs_showrepl_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("samba-tool drs showrepl \n"); + return 0; +} diff --git a/source4/samba_tool/gpo.c b/source4/samba_tool/gpo.c new file mode 100644 index 00000000000..65838d07123 --- /dev/null +++ b/source4/samba_tool/gpo.c @@ -0,0 +1,618 @@ +/* + Samba Unix/Linux SMB client library + net ads commands for Group Policy + + Copyright (C) 2005-2008 Guenther Deschner + Copyright (C) 2009 Wilco Baan Hofman + + Based on Guenther's work in net_ads_gpo.h (samba 3) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "lib/ldb/include/ldb.h" +#include "auth/auth.h" +#include "param/param.h" +#include "libcli/security/sddl.h" +#include "dsdb/samdb/samdb.h" +#include "dsdb/common/util.h" +#include "lib/policy/policy.h" + +static int net_gpo_list_all_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo listall [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo listall --help\n"); + return 0; +} + +static int net_gpo_list_all(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + struct gp_object **gpo; + const char **gpo_flags; + unsigned int i, j; + NTSTATUS rv; + + rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); + return 1; + } + + rv = gp_list_all_gpos(gp_ctx, &gpo); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to list all GPO's: %s\n", get_friendly_nt_error_msg(rv))); + talloc_free(gp_ctx); + return 1; + } + + for (i = 0; gpo[i] != NULL; i++) { + gp_get_gpo_flags(gp_ctx, gpo[i]->flags, &gpo_flags); + + d_printf("GPO : %s\n", gpo[i]->name); + d_printf("display name : %s\n", gpo[i]->display_name); + d_printf("path : %s\n", gpo[i]->file_sys_path); + d_printf("dn : %s\n", gpo[i]->dn); + d_printf("version : %d\n", gpo[i]->version); + if (gpo_flags[0] == NULL) { + d_printf("flags : NONE\n"); + } else { + d_printf("flags : %s\n", gpo_flags[0]); + for (j = 1; gpo_flags[j] != NULL; j++) { + d_printf(" %s\n", gpo_flags[i]); + } + } + d_printf("\n"); + talloc_free(gpo_flags); + } + talloc_free(gp_ctx); + + return 0; +} + +static int net_gpo_get_gpo_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo show [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo show --help\n"); + return 0; +} + +static int net_gpo_get_gpo(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + struct gp_object *gpo; + const char **gpo_flags; + char *sddl; + int i; + NTSTATUS rv; + + if (argc != 1) { + return net_gpo_get_gpo_usage(ctx, argc, argv); + } + + + rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); + return 1; + } + + rv = gp_get_gpo_info(gp_ctx, argv[0], &gpo); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to get GPO: %s\n", get_friendly_nt_error_msg(rv))); + talloc_free(gp_ctx); + return 1; + } + + gp_get_gpo_flags(gp_ctx, gpo->flags, &gpo_flags); + + d_printf("GPO : %s\n", gpo->name); + d_printf("display name : %s\n", gpo->display_name); + d_printf("path : %s\n", gpo->file_sys_path); + d_printf("dn : %s\n", gpo->dn); + d_printf("version : %d\n", gpo->version); + if (gpo_flags[0] == NULL) { + d_printf("flags : NONE\n"); + } else { + d_printf("flags : %s\n", gpo_flags[0]); + for (i = 1; gpo_flags[i] != NULL; i++) { + d_printf(" %s\n", gpo_flags[i]); + } + } + sddl = sddl_encode(gp_ctx, gpo->security_descriptor, samdb_domain_sid(gp_ctx->ldb_ctx)); + if (sddl != NULL) { + d_printf("ACL : %s\n", sddl); + } + + d_printf("\n"); + + talloc_free(gp_ctx); + return 0; +} + +static int net_gpo_link_get_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo getlink [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo getlink --help\n"); + return 0; +} + +static int net_gpo_link_get(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + struct gp_link **links; + NTSTATUS rv; + unsigned int i,j; + const char **options; + + if (argc != 1) { + return net_gpo_link_get_usage(ctx, argc, argv); + } + + rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); + return 1; + } + + rv = gp_get_gplinks(gp_ctx, argv[0], &links); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to get gplinks: %s\n", get_friendly_nt_error_msg(rv))); + talloc_free(gp_ctx); + return 1; + } + + for (i = 0; links[i] != NULL; i++) { + gp_get_gplink_options(gp_ctx, links[i]->options, &options); + + d_printf("GPO DN : %s\n", links[i]->dn); + if (options[0] == NULL) { + d_printf("Options : NONE\n"); + } else { + d_printf("Options : %s\n", options[0]); + for (j = 1; options[j] != NULL; j++) { + d_printf(" : %s\n", options[j]); + } + } + d_printf("\n"); + + talloc_free(options); + } + + talloc_free(gp_ctx); + + return 0; +} + +static int net_gpo_list_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo list [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo list --help\n"); + return 0; +} + +static int net_gpo_list(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + struct ldb_result *result; + struct auth_serversupplied_info *server_info; + struct auth_session_info *session_info; + DATA_BLOB dummy = { NULL, 0 }; + const char **gpos; + NTSTATUS status; + int rv; + unsigned int i; + struct auth_context *auth_context; + + if (argc != 1) { + return net_gpo_list_usage(ctx, argc, argv); + } + + status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); + return 1; + } + + /* Find the user in the directory. We need extended DN's for group expansion + * in authsam_make_server_info */ + rv = dsdb_search(gp_ctx->ldb_ctx, + gp_ctx, + &result, + ldb_get_default_basedn(gp_ctx->ldb_ctx), + LDB_SCOPE_SUBTREE, + NULL, + DSDB_SEARCH_SHOW_EXTENDED_DN, + "(&(objectClass=user)(sAMAccountName=%s))", argv[0]); + if (rv != LDB_SUCCESS) { + DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv),ldb_errstring(gp_ctx->ldb_ctx))); + talloc_free(gp_ctx); + return 1; + } + + /* We expect exactly one record */ + if (result->count != 1) { + DEBUG(0, ("Could not find SAM account with name %s\n", argv[0])); + talloc_free(gp_ctx); + return 1; + } + + /* We need the server info, as this will contain the groups of this + * user, needed for a token */ + status = authsam_make_server_info(gp_ctx, + gp_ctx->ldb_ctx, + lpcfg_netbios_name(gp_ctx->lp_ctx), + lpcfg_sam_name(gp_ctx->lp_ctx), + ldb_get_default_basedn(gp_ctx->ldb_ctx), + result->msgs[0], + dummy, + dummy, + &server_info); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to make server information: %s\n", get_friendly_nt_error_msg(status))); + talloc_free(gp_ctx); + return 1; + } + + /* We do now need an auth context to create a session */ + status = auth_context_create_from_ldb(gp_ctx, gp_ctx->ldb_ctx, &auth_context); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to get an auth context: %s\n", get_friendly_nt_error_msg(status))); + talloc_free(gp_ctx); + return 1; + } + + /* The session info will contain the security token for this user */ + status = auth_generate_session_info(gp_ctx, auth_context, server_info, 0, &session_info); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to generate session information: %s\n", get_friendly_nt_error_msg(status))); + talloc_free(gp_ctx); + return 1; + } + + status = gp_list_gpos(gp_ctx, session_info->security_token, &gpos); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to list gpos for user %s: %s\n", argv[0], + get_friendly_nt_error_msg(status))); + talloc_free(gp_ctx); + return 1; + } + + d_printf("GPO's for user %s:\n", argv[0]); + for (i = 0; gpos[i] != NULL; i++) { + d_printf("\t%s\n", gpos[i]); + } + + talloc_free(gp_ctx); + return 0; +} + +static int net_gpo_link_set_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo setlink ['disable'] ['enforce'] [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo setlink --help\n"); + return 0; +} + +static int net_gpo_link_set(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_link *gplink = talloc_zero(ctx, struct gp_link); + struct gp_context *gp_ctx; + unsigned int i; + NTSTATUS status; + + if (argc < 2) { + return net_gpo_link_set_usage(ctx, argc, argv); + } + + if (argc >= 3) { + for (i = 2; i < argc; i++) { + if (strcmp(argv[i], "disable") == 0) { + gplink->options |= GPLINK_OPT_DISABLE; + } + if (strcmp(argv[i], "enforce") == 0) { + gplink->options |= GPLINK_OPT_ENFORCE; + } + } + } + gplink->dn = argv[1]; + + status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); + return 1; + } + + status = gp_set_gplink(gp_ctx, argv[0], gplink); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status))); + return 1; + } + d_printf("Set link on container.\nCurrent Group Policy links:\n"); + + /* Display current links */ + net_gpo_link_get(ctx, 1, argv); + + talloc_free(gp_ctx); + return 0; +} + +static int net_gpo_link_del_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo dellink [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo dellink --help\n"); + return 0; +} + +static int net_gpo_link_del(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + NTSTATUS status; + + if (argc != 2) { + return net_gpo_link_del_usage(ctx, argc, argv); + } + + status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); + return 1; + } + + status = gp_del_gplink(gp_ctx, argv[0], argv[1]); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to delete gplink: %s\n", get_friendly_nt_error_msg(status))); + talloc_free(gp_ctx); + return 1; + } + d_printf("Deleted gplink.\nCurrent Group Policy links:\n\n"); + + /* Display current links */ + net_gpo_link_get(ctx, 1, argv); + + talloc_free(gp_ctx); + return 0; +} + +static int net_gpo_inheritance_get_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo getinheritance [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo getinheritance --help\n"); + return 0; +} + +static int net_gpo_inheritance_get(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + enum gpo_inheritance inheritance; + NTSTATUS status; + + if (argc != 1) { + return net_gpo_inheritance_get_usage(ctx, argc, argv); + } + + status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); + return 1; + } + + status = gp_get_inheritance(gp_ctx, argv[0], &inheritance); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status))); + talloc_free(gp_ctx); + return 1; + } + + if (inheritance == GPO_BLOCK_INHERITANCE) { + d_printf("container has GPO_BLOCK_INHERITANCE\n"); + } else { + d_printf("container has GPO_INHERIT\n"); + } + + talloc_free(gp_ctx); + return 0; +} + +static int net_gpo_inheritance_set_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo setinheritance <\"block\"|\"inherit\"> [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo setinheritance --help\n"); + return 0; +} + +static int net_gpo_inheritance_set(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + enum gpo_inheritance inheritance; + NTSTATUS status; + + if (argc != 2) { + return net_gpo_inheritance_set_usage(ctx, argc, argv); + } + + if (strcmp(argv[1], "inherit") == 0) { + inheritance = GPO_INHERIT; + } else if (strcmp(argv[1], "block") == 0) { + inheritance = GPO_BLOCK_INHERITANCE; + } else { + return net_gpo_inheritance_set_usage(ctx, argc, argv); + } + + status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); + return 1; + } + + status = gp_set_inheritance(gp_ctx, argv[0], inheritance); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status))); + talloc_free(gp_ctx); + return 1; + } + + /* Display current links */ + net_gpo_inheritance_get(ctx, 1, argv); + + return 0; +} + +static int net_gpo_fetch_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo fetch [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo fetch --help\n"); + return 0; +} + +static int net_gpo_fetch(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + struct gp_object *gpo; + const char *path; + NTSTATUS rv; + + if (argc != 1) { + return net_gpo_fetch_usage(ctx, argc, argv); + } + + rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); + return 1; + } + + rv = gp_get_gpo_info(gp_ctx, argv[0], &gpo); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to get GPO: %s\n", get_friendly_nt_error_msg(rv))); + talloc_free(gp_ctx); + return 1; + } + + rv = gp_fetch_gpt(gp_ctx, gpo, &path); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to fetch GPO: %s\n", get_friendly_nt_error_msg(rv))); + talloc_free(gp_ctx); + return 1; + } + d_printf("%s\n", path); + + return 0; +} +static int net_gpo_create_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo create [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo create --help\n"); + return 0; +} + +static int net_gpo_create(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + struct gp_object *gpo; + NTSTATUS rv; + + if (argc != 1) { + return net_gpo_create_usage(ctx, argc, argv); + } + + rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); + return 1; + } + + rv = gp_create_gpo(gp_ctx, argv[0], &gpo); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to create GPO: %s\n", get_friendly_nt_error_msg(rv))); + talloc_free(gp_ctx); + return 1; + } + + + return 0; +} + +static int net_gpo_set_acl_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo setacl [options]\n"); + d_printf("For a list of available options, please type samba-tool gpo setacl --help\n"); + return 0; +} + +static int net_gpo_set_acl(struct net_context *ctx, int argc, const char **argv) +{ + struct gp_context *gp_ctx; + struct security_descriptor *sd; + NTSTATUS rv; + + if (argc != 2) { + return net_gpo_set_acl_usage(ctx, argc, argv); + } + + rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); + return 1; + } + + /* Convert sddl to security descriptor */ + sd = sddl_decode(gp_ctx, argv[1], samdb_domain_sid(gp_ctx->ldb_ctx)); + if (sd == NULL) { + DEBUG(0, ("Invalid SDDL\n")); + talloc_free(gp_ctx); + return 1; + } + + rv = gp_set_acl(gp_ctx, argv[0], sd); + if (!NT_STATUS_IS_OK(rv)) { + DEBUG(0, ("Failed to set ACL on GPO: %s\n", get_friendly_nt_error_msg(rv))); + talloc_free(gp_ctx); + return 1; + } + + talloc_free(gp_ctx); + return 0; +} + + + +static const struct net_functable net_gpo_functable[] = { + { "listall", "List all GPO's on a DC\n", net_gpo_list_all, net_gpo_list_all_usage }, + { "list", "List all active GPO's for a machine/user\n", net_gpo_list, net_gpo_list_usage }, + { "show", "Show information for a GPO\n", net_gpo_get_gpo, net_gpo_get_gpo_usage }, + { "getlink", "List gPLink of container\n", net_gpo_link_get, net_gpo_link_get_usage }, + { "setlink", "Link a GPO to a container\n", net_gpo_link_set, net_gpo_link_set_usage }, + { "dellink", "Delete GPO link from a container\n", net_gpo_link_del, net_gpo_link_del_usage }, + { "getinheritance", "Get inheritance flag from a container\n", net_gpo_inheritance_get, net_gpo_inheritance_get_usage }, + { "setinheritance", "Set inheritance flag on a container\n", net_gpo_inheritance_set, net_gpo_inheritance_set_usage }, + { "fetch", "Download a GPO\n", net_gpo_fetch, net_gpo_fetch_usage }, + { "create", "Create a GPO\n", net_gpo_create, net_gpo_create_usage }, + { "setacl", "Set ACL on a GPO\n", net_gpo_set_acl, net_gpo_set_acl_usage }, + { NULL, NULL } +}; + +int net_gpo_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Syntax: samba-tool gpo [options]\n"); + d_printf("For available commands, please type samba-tool gpo help\n"); + return 0; +} + +int net_gpo(struct net_context *ctx, int argc, const char **argv) +{ + return net_run_function(ctx, argc, argv, net_gpo_functable, net_gpo_usage); +} diff --git a/source4/samba_tool/password.c b/source4/samba_tool/password.c new file mode 100644 index 00000000000..96b845b69d1 --- /dev/null +++ b/source4/samba_tool/password.c @@ -0,0 +1,171 @@ +/* + Samba Unix/Linux SMB client library + Distributed SMB/CIFS Server Management Utility + + Copyright (C) 2004 Stefan Metzmacher (metze@samba.org) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "libnet/libnet.h" +#include "system/filesys.h" +#include "lib/events/events.h" +#include "auth/credentials/credentials.h" + +/* + * Code for Changing and setting a password + */ + +static int net_password_change_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("net_password_change_usage: TODO\n"); + return 0; +} + + +static int net_password_change(struct net_context *ctx, int argc, const char **argv) +{ + NTSTATUS status; + struct libnet_context *libnetctx; + union libnet_ChangePassword r; + char *password_prompt = NULL; + const char *new_password; + + if (argc > 0 && argv[0]) { + new_password = argv[0]; + } else { + password_prompt = talloc_asprintf(ctx, "Enter new password for account [%s\\%s]:", + cli_credentials_get_domain(ctx->credentials), + cli_credentials_get_username(ctx->credentials)); + new_password = getpass(password_prompt); + } + + libnetctx = libnet_context_init(ctx->event_ctx, ctx->lp_ctx); + if (!libnetctx) { + return -1; + } + libnetctx->cred = ctx->credentials; + + /* prepare password change */ + r.generic.level = LIBNET_CHANGE_PASSWORD_GENERIC; + r.generic.in.account_name = cli_credentials_get_username(ctx->credentials); + r.generic.in.domain_name = cli_credentials_get_domain(ctx->credentials); + r.generic.in.oldpassword = cli_credentials_get_password(ctx->credentials); + r.generic.in.newpassword = new_password; + + /* do password change */ + status = libnet_ChangePassword(libnetctx, ctx, &r); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("net_password_change: %s\n",r.generic.out.error_string)); + return -1; + } + + talloc_free(libnetctx); + + return 0; +} + + +static int net_password_set_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("net_password_set_usage: TODO\n"); + return 0; +} + + +static int net_password_set(struct net_context *ctx, int argc, const char **argv) +{ + NTSTATUS status; + struct libnet_context *libnetctx; + union libnet_SetPassword r; + char *password_prompt = NULL; + char *p; + char *tmp; + const char *account_name; + const char *domain_name; + const char *new_password = NULL; + + switch (argc) { + case 0: /* no args -> fail */ + return net_password_set_usage(ctx, argc, argv); + case 1: /* only DOM\\user; prompt for password */ + tmp = talloc_strdup(ctx, argv[0]); + break; + case 2: /* DOM\\USER and password */ + tmp = talloc_strdup(ctx, argv[0]); + new_password = argv[1]; + break; + default: /* too mayn args -> fail */ + DEBUG(0,("net_password_set: too many args [%d]\n",argc)); + return net_password_usage(ctx, argc, argv); + } + + if ((p = strchr_m(tmp,'\\'))) { + *p = 0; + domain_name = tmp; + account_name = talloc_strdup(ctx, p+1); + } else { + account_name = tmp; + domain_name = cli_credentials_get_domain(ctx->credentials); + } + + if (!new_password) { + password_prompt = talloc_asprintf(ctx, "Enter new password for account [%s\\%s]:", + domain_name, account_name); + new_password = getpass(password_prompt); + } + + libnetctx = libnet_context_init(ctx->event_ctx, ctx->lp_ctx); + if (!libnetctx) { + return -1; + } + libnetctx->cred = ctx->credentials; + + /* prepare password change */ + r.generic.level = LIBNET_SET_PASSWORD_GENERIC; + r.generic.in.account_name = account_name; + r.generic.in.domain_name = domain_name; + r.generic.in.newpassword = new_password; + + /* do password change */ + status = libnet_SetPassword(libnetctx, ctx, &r); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("net_password_set: %s\n",r.generic.out.error_string)); + return -1; + } + + talloc_free(libnetctx); + + return 0; +} + + +static const struct net_functable net_password_functable[] = { + {"change", "change password (old password required)\n", net_password_change, net_password_change_usage }, + {"set", "set password\n", net_password_set, net_password_set_usage }, + {NULL, NULL} +}; + +int net_password(struct net_context *ctx, int argc, const char **argv) +{ + return net_run_function(ctx, argc, argv, net_password_functable, net_password_usage); +} + +int net_password_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("samba-tool password [options]\n"); + return 0; +} diff --git a/source4/samba_tool/samba_tool.c b/source4/samba_tool/samba_tool.c new file mode 100644 index 00000000000..fd9e0e51d37 --- /dev/null +++ b/source4/samba_tool/samba_tool.c @@ -0,0 +1,387 @@ +/* + Samba Unix/Linux SMB client library + Distributed SMB/CIFS Server Management Utility + Copyright (C) 2001 Steve French (sfrench@us.ibm.com) + Copyright (C) 2001 Jim McDonough (jmcd@us.ibm.com) + Copyright (C) 2001 Andrew Tridgell (tridge@samba.org) + Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org) + Copyright (C) 2004 Stefan Metzmacher (metze@samba.org) + Copyright (C) 2009 Jelmer Vernooij (jelmer@samba.org) + + Largely rewritten by metze in August 2004 + + Originally written by Steve and Jim. Largely rewritten by tridge in + November 2001. + + Reworked again by abartlet in December 2001 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +/*****************************************************/ +/* */ +/* Distributed SMB/CIFS Server Management Utility */ +/* */ +/* The intent was to make the syntax similar */ +/* to the NET utility (first developed in DOS */ +/* with additional interesting & useful functions */ +/* added in later SMB server network operating */ +/* systems). */ +/* */ +/*****************************************************/ + +#include +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "lib/cmdline/popt_common.h" +#include "lib/ldb/include/ldb.h" +#include "librpc/rpc/dcerpc.h" +#include "param/param.h" +#include "lib/events/events.h" +#include "auth/credentials/credentials.h" +#include "scripting/python/modules.h" +#include "samba_tool/drs/drs.h" + +/* There's no Py_ssize_t in 2.4, apparently */ +#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5 +typedef int Py_ssize_t; +#endif + +static PyObject *py_tuple_from_argv(int argc, const char *argv[]) +{ + PyObject *l; + Py_ssize_t i; + + l = PyTuple_New(argc); + if (l == NULL) { + return NULL; + } + + for (i = 0; i < argc; i++) { + PyTuple_SetItem(l, i, PyString_FromString(argv[i])); + } + + return l; +} + +static int py_call_with_string_args(PyObject *self, const char *method, int argc, const char *argv[]) +{ + PyObject *ret, *args, *py_method; + + args = py_tuple_from_argv(argc, argv); + if (args == NULL) { + PyErr_Print(); + return 1; + } + + py_method = PyObject_GetAttrString(self, method); + if (py_method == NULL) { + PyErr_Print(); + return 1; + } + + ret = PyObject_CallObject(py_method, args); + + Py_DECREF(args); + + if (ret == NULL) { + PyErr_Print(); + return 1; + } + + if (ret == Py_None) { + return 0; + } else if (PyInt_Check(ret)) { + return PyInt_AsLong(ret); + } else { + fprintf(stderr, "Function return value type unexpected.\n"); + return -1; + } +} + +static PyObject *py_commands(void) +{ + PyObject *netcmd_module, *py_cmds; + netcmd_module = PyImport_ImportModule("samba.netcmd"); + if (netcmd_module == NULL) { + PyErr_Print(); + return NULL; + } + + py_cmds = PyObject_GetAttrString(netcmd_module, "commands"); + if (py_cmds == NULL) { + PyErr_Print(); + return NULL; + } + + if (!PyDict_Check(py_cmds)) { + d_printf("Python net commands is not a dictionary\n"); + return NULL; + } + + return py_cmds; +} + +/* + run a function from a function table. If not found then + call the specified usage function +*/ +int net_run_function(struct net_context *ctx, + int argc, const char **argv, + const struct net_functable *functable, + int (*usage_fn)(struct net_context *ctx, int argc, const char **argv)) +{ + int i; + + if (argc == 0) { + return usage_fn(ctx, argc, argv); + + } else if (argc == 1 && strequal(argv[0], "help")) { + return net_help(ctx, functable); + } + + for (i=0; functable[i].name; i++) { + if (strcasecmp_m(argv[0], functable[i].name) == 0) + return functable[i].fn(ctx, argc-1, argv+1); + } + + d_printf("No command: '%s'\n", argv[0]); + return usage_fn(ctx, argc, argv); +} + +/* + run a usage function from a function table. If not found then fail +*/ +int net_run_usage(struct net_context *ctx, + int argc, const char **argv, + const struct net_functable *functable) +{ + int i; + PyObject *py_cmds, *py_cmd; + + for (i=0; functable[i].name; i++) { + if (strcasecmp_m(argv[0], functable[i].name) == 0) + if (functable[i].usage) { + return functable[i].usage(ctx, argc-1, argv+1); + } + } + + py_cmds = py_commands(); + if (py_cmds == NULL) { + return 1; + } + + py_cmd = PyDict_GetItemString(py_cmds, argv[0]); + if (py_cmd != NULL) { + return py_call_with_string_args(py_cmd, "usage", argc-1, + argv+1); + } + + d_printf("No usage information for command: %s\n", argv[0]); + + return 1; +} + + +/* main function table */ +static const struct net_functable net_functable[] = { + {"password", "Changes/Sets the password on a user account [server connection needed]\n", net_password, net_password_usage}, + {"samdump", "dump the sam of a domain\n", net_samdump, net_samdump_usage}, + {"samsync", "synchronise into the local ldb the sam of an NT4 domain\n", net_samsync_ldb, net_samsync_ldb_usage}, + {"drs", "Implements functionality offered by repadmin.exe utility in Windows\n", net_drs, net_drs_usage}, + {"gpo", "Administer group policies\n", net_gpo, net_gpo_usage}, + {NULL, NULL, NULL, NULL} +}; + +static int net_help_builtin(const struct net_functable *ftable) +{ + int i = 0; + const char *name = ftable[i].name; + const char *desc = ftable[i].desc; + + while (name && desc) { + if (strlen(name) > 7) { + d_printf("\t%s\t%s", name, desc); + } else { + d_printf("\t%s\t\t%s", name, desc); + } + name = ftable[++i].name; + desc = ftable[i].desc; + } + return 0; +} + +static int net_help_python(void) +{ + PyObject *py_cmds; + PyObject *key, *value; + Py_ssize_t pos = 0; + + py_cmds = py_commands(); + if (py_cmds == NULL) { + return 1; + } + + while (PyDict_Next(py_cmds, &pos, &key, &value)) { + char *name, *desc; + PyObject *py_desc; + if (!PyString_Check(key)) { + d_printf("Command name not a string\n"); + return 1; + } + name = PyString_AsString(key); + py_desc = PyObject_GetAttrString(value, "description"); + if (py_desc == NULL) { + PyErr_Print(); + return 1; + } + if (!PyString_Check(py_desc)) { + d_printf("Command description for %s not a string\n", + name); + return 1; + } + desc = PyString_AsString(py_desc); + if (strlen(name) > 7) { + d_printf("\t%s\t%s\n", name, desc); + } else { + d_printf("\t%s\t\t%s\n", name, desc); + } + } + return 0; +} + +int net_help(struct net_context *ctx, const struct net_functable *ftable) +{ + d_printf("Available commands:\n"); + net_help_builtin(ftable); + net_help_python(); + return 0; +} + +static int net_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Usage:\n"); + d_printf("samba-tool [options]\n"); + net_help(ctx, net_functable); + return -1; +} + +/**************************************************************************** + main program +****************************************************************************/ +static int binary_net(int argc, const char **argv) +{ + int opt,i; + int rc; + int argc_new; + PyObject *py_cmds, *py_cmd; + const char **argv_new; + struct tevent_context *ev; + struct net_context *ctx = NULL; + poptContext pc; + struct poptOption long_options[] = { + POPT_AUTOHELP + POPT_COMMON_SAMBA + POPT_COMMON_CONNECTION + POPT_COMMON_CREDENTIALS + POPT_COMMON_VERSION + { NULL } + }; + + setlinebuf(stdout); + + dcerpc_init(cmdline_lp_ctx); + + ev = s4_event_context_init(NULL); + if (!ev) { + d_printf("Failed to create an event context\n"); + exit(1); + } + Py_Initialize(); + PySys_SetArgv(argc, discard_const_p(char *, argv)); + py_update_path("bin"); /* FIXME: Can't assume this is always the case */ + + py_cmds = py_commands(); + if (py_cmds == NULL) { + return 1; + } + + for (i=1; ilp_ctx = cmdline_lp_ctx; + ctx->credentials = cmdline_credentials; + ctx->event_ctx = ev; + + + + rc = net_run_function(ctx, argc_new-1, argv_new+1, net_functable, + net_usage); + + if (rc != 0) { + DEBUG(0,("return code = %d\n", rc)); + } + + talloc_free(ev); + return rc; +} + + int main(int argc, const char **argv) +{ + return binary_net(argc, argv); +} diff --git a/source4/samba_tool/samba_tool.h b/source4/samba_tool/samba_tool.h new file mode 100644 index 00000000000..c8492e613bd --- /dev/null +++ b/source4/samba_tool/samba_tool.h @@ -0,0 +1,39 @@ +/* + Samba Unix/Linux SMB client library + Distributed SMB/CIFS Server Management Utility + + Copyright (C) Stefan Metzmacher 2004 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#ifndef _SAMBA_TOOL_H +#define _SAMBA_TOOL_H + +struct net_context { + struct cli_credentials *credentials; + struct loadparm_context *lp_ctx; + struct tevent_context *event_ctx; +}; + +struct net_functable { + const char *name; + const char *desc; + int (*fn)(struct net_context *ctx, int argc, const char **argv); + int (*usage)(struct net_context *ctx, int argc, const char **argv); +}; + +#include "samba_tool/proto.h" + +#endif /* _SAMBA_TOOL_H */ diff --git a/source4/samba_tool/vampire.c b/source4/samba_tool/vampire.c new file mode 100644 index 00000000000..7f16c82668b --- /dev/null +++ b/source4/samba_tool/vampire.c @@ -0,0 +1,130 @@ +/* + Samba Unix/Linux SMB client library + Distributed SMB/CIFS Server Management Utility + + Copyright (C) 2004 Stefan Metzmacher + Copyright (C) 2005 Andrew Bartlett + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "samba_tool/samba_tool.h" +#include "libnet/libnet.h" +#include "librpc/gen_ndr/samr.h" +#include "auth/auth.h" +#include "libcli/security/security.h" +#include "param/param.h" +#include "lib/events/events.h" + +/* main function table */ +static const struct net_functable net_samdump_functable[] = { + {NULL, NULL, NULL, NULL} +}; + +int net_samdump(struct net_context *ctx, int argc, const char **argv) +{ + NTSTATUS status; + struct libnet_context *libnetctx; + struct libnet_SamDump r; + int rc; + + switch (argc) { + case 0: + break; + case 1: + default: + rc = net_run_function(ctx, argc, argv, net_samdump_functable, + net_samdump_usage); + return rc; + } + + libnetctx = libnet_context_init(ctx->event_ctx, ctx->lp_ctx); + if (!libnetctx) { + return -1; + } + libnetctx->cred = ctx->credentials; + + r.out.error_string = NULL; + r.in.machine_account = NULL; + r.in.binding_string = NULL; + + status = libnet_SamDump(libnetctx, ctx, &r); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("libnet_SamDump returned %s: %s\n", + nt_errstr(status), + r.out.error_string)); + return -1; + } + + talloc_free(libnetctx); + + return 0; +} + +int net_samdump_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("samba-tool samdump\n"); + return 0; +} + +int net_samdump_help(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Dumps the sam of the domain we are joined to.\n"); + return 0; +} + +int net_samsync_ldb(struct net_context *ctx, int argc, const char **argv) +{ + NTSTATUS status; + struct libnet_context *libnetctx; + struct libnet_samsync_ldb r; + + libnetctx = libnet_context_init(ctx->event_ctx, ctx->lp_ctx); + if (!libnetctx) { + return -1; + } + libnetctx->cred = ctx->credentials; + + r.out.error_string = NULL; + r.in.machine_account = NULL; + r.in.binding_string = NULL; + + /* Needed to override the ACLs on ldb */ + r.in.session_info = system_session(ctx->lp_ctx); + + status = libnet_samsync_ldb(libnetctx, libnetctx, &r); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("libnet_samsync_ldb returned %s: %s\n", + nt_errstr(status), + r.out.error_string)); + return -1; + } + + talloc_free(libnetctx); + + return 0; +} + +int net_samsync_ldb_usage(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("samba-tool samsync\n"); + return 0; +} + +int net_samsync_ldb_help(struct net_context *ctx, int argc, const char **argv) +{ + d_printf("Synchronise into the local ldb the SAM of a domain.\n"); + return 0; +} diff --git a/source4/samba_tool/wscript_build b/source4/samba_tool/wscript_build new file mode 100644 index 00000000000..df4d2de58f1 --- /dev/null +++ b/source4/samba_tool/wscript_build @@ -0,0 +1,17 @@ +#!/usr/bin/env python + +bld.SAMBA_MODULE('samba_tool_drs', + source='drs/drs.c drs/drs_bind.c drs/drs_kcc.c drs/drs_replicate.c drs/drs_showrepl.c', + autoproto='drs/drs_proto.h', + subsystem='samba-tool', + deps='LIBCLI_DRSUAPI ldb LDBSAMBA', + internal_module=True + ) + + +bld.SAMBA_BINARY('samba-tool', + source='samba_tool.c password.c vampire.c gpo.c', + autoproto='proto.h', + deps='samba-hostconfig samba-util samba-net popt POPT_SAMBA POPT_CREDENTIALS samba_tool_drs policy auth', + pyembed=True + ) diff --git a/source4/selftest/skip b/source4/selftest/skip index e43fefebdad..e03234b3ca0 100644 --- a/source4/selftest/skip +++ b/source4/selftest/skip @@ -62,7 +62,7 @@ rpc.lsa.forest # Not provided by Samba 4 ^samba4.ntvfs.cifs.raw.samba3.* # Samba3-specific test samba4.ntvfs.cifs.raw. ^samba4.rpc..*samba3.* # Samba3-specific test -^samba4.net.domopen.*$ # Hangs for some reason +^samba4.samba-tool.domopen.*$ # Hangs for some reason nss.test # Fails raw.offline # Samba 4 doesn't have much offline support yet rpc.autoidl # this one just generates a lot of noise, and is no longer useful diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py index 5877f4f02cb..a252a87d081 100755 --- a/source4/selftest/tests.py +++ b/source4/selftest/tests.py @@ -355,7 +355,7 @@ planperltestsuite("selftest.samba4", os.path.normpath(os.path.join(samba4srcdir, # work correctly. planpythontestsuite("none", "samba.tests.blackbox.ndrdump") -plantestsuite("samba4.blackbox.net(dc:local)", "dc:local", [os.path.join(samba4srcdir, "utils/tests/test_net.sh"), '$SERVER', "$USERNAME", "$PASSWORD", "$DOMAIN"]) +plantestsuite("samba4.blackbox.samba_tool(dc:local)", "dc:local", [os.path.join(samba4srcdir, "utils/tests/test_net.sh"), '$SERVER', "$USERNAME", "$PASSWORD", "$DOMAIN"]) plantestsuite("samba4.blackbox.pkinit(dc:local)", "dc:local", [os.path.join(bbdir, "test_pkinit.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$PREFIX', "aes256-cts-hmac-sha1-96", configuration]) plantestsuite("samba4.blackbox.kinit(dc:local)", "dc:local", [os.path.join(bbdir, "test_kinit.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$PREFIX', "aes256-cts-hmac-sha1-96", configuration]) plantestsuite("samba4.blackbox.kinit(fl2000dc:local)", "fl2000dc:local", [os.path.join(bbdir, "test_kinit.sh"), '$SERVER', '$USERNAME', '$PASSWORD', '$REALM', '$DOMAIN', '$PREFIX', "arcfour-hmac-md5", configuration]) diff --git a/source4/setup/tests/blackbox_group.sh b/source4/setup/tests/blackbox_group.sh index adffad1cc72..451ae9d6418 100755 --- a/source4/setup/tests/blackbox_group.sh +++ b/source4/setup/tests/blackbox_group.sh @@ -15,60 +15,60 @@ shift 1 rm -rf $PREFIX/simple-dc testit "simple-dc" $PYTHON ./setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc -net="./bin/net" +samba_tool="./bin/samba-tool" CONFIG="--configfile=$PREFIX/simple-dc/etc/smb.conf" #creation of two test subjects -testit "newuser" $net newuser $CONFIG --given-name="User" --surname="Tester" --initial="UT" testuser testp@ssw0Rd -testit "newuser" $net newuser $CONFIG --given-name="User1" --surname="Tester" --initial="UT" testuser1 testp@ssw0Rd +testit "newuser" $samba_tool newuser $CONFIG --given-name="User" --surname="Tester" --initial="UT" testuser testp@ssw0Rd +testit "newuser" $samba_tool newuser $CONFIG --given-name="User1" --surname="Tester" --initial="UT" testuser1 testp@ssw0Rd #test creation of six different groups -testit "group add" $net group add $CONFIG --group-scope='Domain' --group-type='Security' --description='DomainSecurityGroup' --mail-address='dsg@samba.org' --notes='Notes' dsg -testit "group add" $net group add $CONFIG --group-scope='Global' --group-type='Security' --description='GlobalSecurityGroup' --mail-address='gsg@samba.org' --notes='Notes' gsg -testit "group add" $net group add $CONFIG --group-scope='Universal' --group-type='Security' --description='UniversalSecurityGroup' --mail-address='usg@samba.org' --notes='Notes' usg -testit "group add" $net group add $CONFIG --group-scope='Domain' --group-type='Distribution' --description='DomainDistributionGroup' --mail-address='ddg@samba.org' --notes='Notes' ddg -testit "group add" $net group add $CONFIG --group-scope='Global' --group-type='Distribution' --description='GlobalDistributionGroup' --mail-address='gdg@samba.org' --notes='Notes' gdg -testit "group add" $net group add $CONFIG --group-scope='Universal' --group-type='Distribution' --description='UniversalDistributionGroup' --mail-address='udg@samba.org' --notes='Notes' udg +testit "group add" $samba_tool group add $CONFIG --group-scope='Domain' --group-type='Security' --description='DomainSecurityGroup' --mail-address='dsg@samba.org' --notes='Notes' dsg +testit "group add" $samba_tool group add $CONFIG --group-scope='Global' --group-type='Security' --description='GlobalSecurityGroup' --mail-address='gsg@samba.org' --notes='Notes' gsg +testit "group add" $samba_tool group add $CONFIG --group-scope='Universal' --group-type='Security' --description='UniversalSecurityGroup' --mail-address='usg@samba.org' --notes='Notes' usg +testit "group add" $samba_tool group add $CONFIG --group-scope='Domain' --group-type='Distribution' --description='DomainDistributionGroup' --mail-address='ddg@samba.org' --notes='Notes' ddg +testit "group add" $samba_tool group add $CONFIG --group-scope='Global' --group-type='Distribution' --description='GlobalDistributionGroup' --mail-address='gdg@samba.org' --notes='Notes' gdg +testit "group add" $samba_tool group add $CONFIG --group-scope='Universal' --group-type='Distribution' --description='UniversalDistributionGroup' --mail-address='udg@samba.org' --notes='Notes' udg #test adding test users to all groups by their username -testit "group addmembers" $net group addmembers $CONFIG dsg newuser,newuser1 -testit "group addmembers" $net group addmembers $CONFIG gsg newuser,newuser1 -testit "group addmembers" $net group addmembers $CONFIG usg newuser,newuser1 -testit "group addmembers" $net group addmembers $CONFIG ddg newuser,newuser1 -testit "group addmembers" $net group addmembers $CONFIG gdg newuser,newuser1 -testit "group addmembers" $net group addmembers $CONFIG udg newuser,newuser1 +testit "group addmembers" $samba_tool group addmembers $CONFIG dsg newuser,newuser1 +testit "group addmembers" $samba_tool group addmembers $CONFIG gsg newuser,newuser1 +testit "group addmembers" $samba_tool group addmembers $CONFIG usg newuser,newuser1 +testit "group addmembers" $samba_tool group addmembers $CONFIG ddg newuser,newuser1 +testit "group addmembers" $samba_tool group addmembers $CONFIG gdg newuser,newuser1 +testit "group addmembers" $samba_tool group addmembers $CONFIG udg newuser,newuser1 #test removing test users from all groups by their username -testit "group removemembers" $net group removemembers $CONFIG dsg newuser,newuser1 -testit "group removemembers" $net group removemembers $CONFIG gsg newuser,newuser1 -testit "group removemembers" $net group removemembers $CONFIG usg newuser,newuser1 -testit "group removemembers" $net group removemembers $CONFIG ddg newuser,newuser1 -testit "group removemembers" $net group removemembers $CONFIG gdg newuser,newuser1 -testit "group removemembers" $net group removemembers $CONFIG udg newuser,newuser1 +testit "group removemembers" $samba_tool group removemembers $CONFIG dsg newuser,newuser1 +testit "group removemembers" $samba_tool group removemembers $CONFIG gsg newuser,newuser1 +testit "group removemembers" $samba_tool group removemembers $CONFIG usg newuser,newuser1 +testit "group removemembers" $samba_tool group removemembers $CONFIG ddg newuser,newuser1 +testit "group removemembers" $samba_tool group removemembers $CONFIG gdg newuser,newuser1 +testit "group removemembers" $samba_tool group removemembers $CONFIG udg newuser,newuser1 #test adding test users to all groups by their cn -#testit "group addmembers" $net group addmembers $CONFIG dsg "User UT. Tester,User1 UT. Tester" -#testit "group addmembers" $net group addmembers $CONFIG gsg "User UT. Tester,User1 UT. Tester" -#testit "group addmembers" $net group addmembers $CONFIG usg "User UT. Tester,User1 UT. Tester" -#testit "group addmembers" $net group addmembers $CONFIG ddg "User UT. Tester,User1 UT. Tester" -#testit "group addmembers" $net group addmembers $CONFIG gdg "User UT. Tester,User1 UT. Tester" -#testit "group addmembers" $net group addmembers $CONFIG udg "User UT. Tester,User1 UT. Tester" +#testit "group addmembers" $samba_tool group addmembers $CONFIG dsg "User UT. Tester,User1 UT. Tester" +#testit "group addmembers" $samba_tool group addmembers $CONFIG gsg "User UT. Tester,User1 UT. Tester" +#testit "group addmembers" $samba_tool group addmembers $CONFIG usg "User UT. Tester,User1 UT. Tester" +#testit "group addmembers" $samba_tool group addmembers $CONFIG ddg "User UT. Tester,User1 UT. Tester" +#testit "group addmembers" $samba_tool group addmembers $CONFIG gdg "User UT. Tester,User1 UT. Tester" +#testit "group addmembers" $samba_tool group addmembers $CONFIG udg "User UT. Tester,User1 UT. Tester" #test removing test users from all groups by their cn -#testit "group removemembers" $net group removemembers $CONFIG dsg "User UT. Tester,User1 UT. Tester" -#testit "group removemembers" $net group removemembers $CONFIG gsg "User UT. Tester,User1 UT. Tester" -#testit "group removemembers" $net group removemembers $CONFIG usg "User UT. Tester,User1 UT. Tester" -#testit "group removemembers" $net group removemembers $CONFIG ddg "User UT. Tester,User1 UT. Tester" -#testit "group removemembers" $net group removemembers $CONFIG gdg "User UT. Tester,User1 UT. Tester" -#testit "group removemembers" $net group removemembers $CONFIG ugg "User UT. Tester,User1 UT. Tester" +#testit "group removemembers" $samba_tool group removemembers $CONFIG dsg "User UT. Tester,User1 UT. Tester" +#testit "group removemembers" $samba_tool group removemembers $CONFIG gsg "User UT. Tester,User1 UT. Tester" +#testit "group removemembers" $samba_tool group removemembers $CONFIG usg "User UT. Tester,User1 UT. Tester" +#testit "group removemembers" $samba_tool group removemembers $CONFIG ddg "User UT. Tester,User1 UT. Tester" +#testit "group removemembers" $samba_tool group removemembers $CONFIG gdg "User UT. Tester,User1 UT. Tester" +#testit "group removemembers" $samba_tool group removemembers $CONFIG ugg "User UT. Tester,User1 UT. Tester" #test deletion of the groups -testit "group delete" $net group delete $CONFIG dsg -testit "group delete" $net group delete $CONFIG gsg -testit "group delete" $net group delete $CONFIG usg -testit "group delete" $net group delete $CONFIG ddg -testit "group delete" $net group delete $CONFIG gdg -testit "group delete" $net group delete $CONFIG udg +testit "group delete" $samba_tool group delete $CONFIG dsg +testit "group delete" $samba_tool group delete $CONFIG gsg +testit "group delete" $samba_tool group delete $CONFIG usg +testit "group delete" $samba_tool group delete $CONFIG ddg +testit "group delete" $samba_tool group delete $CONFIG gdg +testit "group delete" $samba_tool group delete $CONFIG udg exit $failed diff --git a/source4/setup/tests/blackbox_newuser.sh b/source4/setup/tests/blackbox_newuser.sh index e74950d25df..aa45964f003 100755 --- a/source4/setup/tests/blackbox_newuser.sh +++ b/source4/setup/tests/blackbox_newuser.sh @@ -15,28 +15,28 @@ shift 1 rm -rf $PREFIX/simple-dc testit "simple-dc" $PYTHON ./setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc -net="./bin/net" +samba_tool="./bin/samba-tool" CONFIG="--configfile=$PREFIX/simple-dc/etc/smb.conf" #two test for creating new user #newuser account is created with cn=Given Name Initials. Surname #newuser1 account is created using cn=username -testit "newuser" $net newuser $CONFIG --given-name="User" --surname="Tester" --initials="T" --profile-path="\\\\myserver\\my\\profile" --script-path="\\\\myserver\\my\\script" --home-directory="\\\\myserver\\my\\homedir" --job-title="Tester" --department="Testing" --company="Samba.org" --description="Description" --mail-address="tester@samba.org" --internet-address="http://samba.org" --telephone-number="001122334455" --physical-delivery-office="101" --home-drive="H:" NewUser testp@ssw0Rd -testit "newuser" $net newuser $CONFIG --use-username-as-cn --given-name="User1" --surname="Tester1" --initials="UT1" --profile-path="\\\\myserver\\my\\profile" --script-path="\\\\myserver\\my\\script" --home-directory="\\\\myserver\\my\\homedir" --job-title="Tester" --department="Testing" --company="Samba.org" --description="Description" --mail-address="tester@samba.org" --internet-address="http://samba.org" --telephone-number="001122334455" --physical-delivery-office="101" --home-drive="H:" NewUser1 testp@ssw0Rd +testit "newuser" $samba_tool newuser $CONFIG --given-name="User" --surname="Tester" --initials="T" --profile-path="\\\\myserver\\my\\profile" --script-path="\\\\myserver\\my\\script" --home-directory="\\\\myserver\\my\\homedir" --job-title="Tester" --department="Testing" --company="Samba.org" --description="Description" --mail-address="tester@samba.org" --internet-address="http://samba.org" --telephone-number="001122334455" --physical-delivery-office="101" --home-drive="H:" NewUser testp@ssw0Rd +testit "newuser" $samba_tool newuser $CONFIG --use-username-as-cn --given-name="User1" --surname="Tester1" --initials="UT1" --profile-path="\\\\myserver\\my\\profile" --script-path="\\\\myserver\\my\\script" --home-directory="\\\\myserver\\my\\homedir" --job-title="Tester" --department="Testing" --company="Samba.org" --description="Description" --mail-address="tester@samba.org" --internet-address="http://samba.org" --telephone-number="001122334455" --physical-delivery-office="101" --home-drive="H:" NewUser1 testp@ssw0Rd # check the enable account script -testit "enableaccount" $net enableaccount $CONFIG NewUser -testit "enableaccount" $net enableaccount $CONFIG NewUser1 +testit "enableaccount" $samba_tool enableaccount $CONFIG NewUser +testit "enableaccount" $samba_tool enableaccount $CONFIG NewUser1 # check the enable account script -testit "setpassword" $net setpassword $CONFIG NewUser --newpassword=testp@ssw0Rd2 -testit "setpassword" $net setpassword $CONFIG NewUser1 --newpassword=testp@ssw0Rd2 +testit "setpassword" $samba_tool setpassword $CONFIG NewUser --newpassword=testp@ssw0Rd2 +testit "setpassword" $samba_tool setpassword $CONFIG NewUser1 --newpassword=testp@ssw0Rd2 # check the setexpiry script -testit "noexpiry" $net setexpiry $CONFIG NewUser --noexpiry -testit "noexpiry" $net setexpiry $CONFIG NewUser1 --noexpiry -testit "expiry" $net setexpiry $CONFIG NewUser --days=7 -testit "expiry" $net setexpiry $CONFIG NewUser1 --days=7 +testit "noexpiry" $samba_tool setexpiry $CONFIG NewUser --noexpiry +testit "noexpiry" $samba_tool setexpiry $CONFIG NewUser1 --noexpiry +testit "expiry" $samba_tool setexpiry $CONFIG NewUser --days=7 +testit "expiry" $samba_tool setexpiry $CONFIG NewUser1 --days=7 exit $failed diff --git a/source4/setup/tests/blackbox_setpassword.sh b/source4/setup/tests/blackbox_setpassword.sh index da815531799..6c405674c1a 100755 --- a/source4/setup/tests/blackbox_setpassword.sh +++ b/source4/setup/tests/blackbox_setpassword.sh @@ -12,17 +12,17 @@ shift 1 . `dirname $0`/../../../testprogs/blackbox/subunit.sh -net="./bin/net" +samba_tool="./bin/samba-tool" rm -rf $PREFIX/simple-dc testit "simple-dc" $PYTHON ./setup/provision --server-role="dc" --domain=FOO --realm=foo.example.com --domain-sid=S-1-5-21-4177067393-1453636373-93818738 --targetdir=$PREFIX/simple-dc -testit "newuser" $net newuser --configfile=$PREFIX/simple-dc/etc/smb.conf testuser testp@ssw0Rd +testit "newuser" $samba_tool newuser --configfile=$PREFIX/simple-dc/etc/smb.conf testuser testp@ssw0Rd -testit "setpassword" $net setpassword --configfile=$PREFIX/simple-dc/etc/smb.conf testuser --newpassword=testp@ssw0Rd +testit "setpassword" $samba_tool setpassword --configfile=$PREFIX/simple-dc/etc/smb.conf testuser --newpassword=testp@ssw0Rd -testit "setpassword" $net setpassword --configfile=$PREFIX/simple-dc/etc/smb.conf testuser --newpassword=testp@ssw0Rd --must-change-at-next-login +testit "setpassword" $samba_tool setpassword --configfile=$PREFIX/simple-dc/etc/smb.conf testuser --newpassword=testp@ssw0Rd --must-change-at-next-login -testit "pwsettings" $net pwsettings --quiet set --configfile=$PREFIX/simple-dc/etc/smb.conf --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default +testit "pwsettings" $samba_tool pwsettings --quiet set --configfile=$PREFIX/simple-dc/etc/smb.conf --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default exit $failed diff --git a/source4/setup/tests/blackbox_spn.sh b/source4/setup/tests/blackbox_spn.sh index f2fd8acfbb3..515a06e437e 100755 --- a/source4/setup/tests/blackbox_spn.sh +++ b/source4/setup/tests/blackbox_spn.sh @@ -13,21 +13,21 @@ shift 1 . `dirname $0`/../../../testprogs/blackbox/subunit.sh -net="./bin/net" +samba_tool="./bin/samba-tool" CONFIG="--configfile=$PREFIX/etc/smb.conf" #creation of two test subjects -testit "addspn" $net spn add FOO/bar Administrator $CONFIG -testit "delspn" $net spn delete FOO/bar $CONFIG -testit "readdspn" $net spn add FOO/bar Administrator $CONFIG -testit_expect_failure "failexistingspn" $net spn add FOO/bar Guest $CONFIG -testit "existingspnforce" $net spn add --force FOO/bar Guest $CONFIG -testit_expect_failure "faildelspnnotgooduser" $net spn delete FOO/bar krbtgt $CONFIG -testit_expect_failure "faildelspnmoreoneuser" $net spn delete FOO/bar $CONFIG -testit "deluserspn" $net spn delete FOO/bar Guest $CONFIG -testit "dellastuserspn" $net spn delete FOO/bar $CONFIG -testit_expect_failure "faildelspn" $net spn delete FOO/bar $CONFIG -testit_expect_failure "failaddspn" $net spn add FOO/bar nonexistinguser $CONFIG +testit "addspn" $samba_tool spn add FOO/bar Administrator $CONFIG +testit "delspn" $samba_tool spn delete FOO/bar $CONFIG +testit "readdspn" $samba_tool spn add FOO/bar Administrator $CONFIG +testit_expect_failure "failexistingspn" $samba_tool spn add FOO/bar Guest $CONFIG +testit "existingspnforce" $samba_tool spn add --force FOO/bar Guest $CONFIG +testit_expect_failure "faildelspnnotgooduser" $samba_tool spn delete FOO/bar krbtgt $CONFIG +testit_expect_failure "faildelspnmoreoneuser" $samba_tool spn delete FOO/bar $CONFIG +testit "deluserspn" $samba_tool spn delete FOO/bar Guest $CONFIG +testit "dellastuserspn" $samba_tool spn delete FOO/bar $CONFIG +testit_expect_failure "faildelspn" $samba_tool spn delete FOO/bar $CONFIG +testit_expect_failure "failaddspn" $samba_tool spn add FOO/bar nonexistinguser $CONFIG exit $failed diff --git a/source4/torture/drs/python/delete_object.py b/source4/torture/drs/python/delete_object.py index 0cf648f5a06..2936a5717f5 100644 --- a/source4/torture/drs/python/delete_object.py +++ b/source4/torture/drs/python/delete_object.py @@ -77,7 +77,7 @@ class DrsDeleteObjectTestCase(samba.tests.TestCase): self.config_dn = self.info_dc1["configurationNamingContext"][0] self.forest_level = int(self.info_dc1["forestFunctionality"][0]) - # we will need DCs DNS names for 'net drs' command + # we will need DCs DNS names for 'samba-tool drs' command self.dnsname_dc1 = self.info_dc1["dnsHostName"][0] self.dnsname_dc2 = self.info_dc2["dnsHostName"][0] @@ -127,13 +127,13 @@ class DrsDeleteObjectTestCase(samba.tests.TestCase): def _net_drs_replicate(self, DC, fromDC): # find out where is net command - net_cmd = os.path.abspath("./bin/net") + samba_tool_cmd = os.path.abspath("./bin/samba-tool") # make command line credentials string creds = samba.tests.cmdline_credentials cmd_line_auth = "-U%s/%s%%%s" % (creds.get_domain(), creds.get_username(), creds.get_password()) - # bin/net drs replicate - cmd_line = "%s drs replicate %s %s %s %s" % (net_cmd, DC, fromDC, + # bin/samba-tool drs replicate + cmd_line = "%s drs replicate %s %s %s %s" % (samba_tool_cmd, DC, fromDC, self.domain_dn, cmd_line_auth) ret = os.system(cmd_line) self.assertEquals(ret, 0, "Replicating %s from %s has failed!" % (DC, fromDC)) diff --git a/source4/torture/drs/python/fsmo.py b/source4/torture/drs/python/fsmo.py index 251507413d3..067ee2accb8 100644 --- a/source4/torture/drs/python/fsmo.py +++ b/source4/torture/drs/python/fsmo.py @@ -91,13 +91,13 @@ class DrsFsmoTestCase(samba.tests.TestCase): super(DrsFsmoTestCase, self).tearDown() def _net_fsmo_role_transfer(self, DC, role): - # find out where is net command - net_cmd = os.path.abspath("./bin/net") + # find out where is samba-tool command + net_cmd = os.path.abspath("./bin/samba-tool") # make command line credentials string creds = samba.tests.cmdline_credentials cmd_line_auth = "-U%s/%s%%%s" % (creds.get_domain(), creds.get_username(), creds.get_password()) - # bin/net fsmo transfer --role=role --host=ldap://DC:389 + # bin/samba-tool fsmo transfer --role=role --host=ldap://DC:389 cmd_line = "%s fsmo transfer --role=%s --host=ldap://%s:389 %s" % (net_cmd, role, DC, cmd_line_auth) ret = os.system(cmd_line) diff --git a/source4/utils/net/config.mk b/source4/utils/net/config.mk deleted file mode 100644 index 032f68555a8..00000000000 --- a/source4/utils/net/config.mk +++ /dev/null @@ -1,50 +0,0 @@ -# $(utilssrcdir)/net subsystem - - -################################# -# Start MODULE net_drs -[MODULE::net_drs] -SUBSYSTEM = net -OUTPUT_TYPE = MERGED_OBJ -PRIVATE_DEPENDENCIES = \ - LIBCLI_DRSUAPI \ - LIBLDB -# End MODULE net_drs -################################# - -net_drs_OBJ_FILES = $(addprefix $(utilssrcdir)/net/drs/, \ - net_drs.o \ - net_drs_bind.o \ - net_drs_kcc.o \ - net_drs_replicate.o \ - net_drs_showrepl.o) - -$(eval $(call proto_header_template,$(utilssrcdir)/net/drs/net_drs_proto.h,$(net_drs_OBJ_FILES:.o=.c))) - - -################################# -# Start BINARY net -[BINARY::net] -INSTALLDIR = BINDIR -PRIVATE_DEPENDENCIES = \ - LIBSAMBA-HOSTCONFIG \ - LIBSAMBA-UTIL \ - LIBSAMBA-NET \ - LIBPOPT \ - POPT_SAMBA \ - POPT_CREDENTIALS \ - policy \ - net_drs -# End BINARY net -################################# - -net_OBJ_FILES = $(addprefix $(utilssrcdir)/net/, \ - net.o \ - net_password.o \ - net_join.o \ - net_vampire.o \ - net_gpo.o) - - -$(eval $(call proto_header_template,$(utilssrcdir)/net/net_proto.h,$(net_OBJ_FILES:.o=.c))) - diff --git a/source4/utils/net/drs/net_drs.c b/source4/utils/net/drs/net_drs.c deleted file mode 100644 index 578b6f2fc30..00000000000 --- a/source4/utils/net/drs/net_drs.c +++ /dev/null @@ -1,361 +0,0 @@ -/* - Samba Unix/Linux SMB client library - - Implements functions offered by repadmin.exe tool under Windows - - Copyright (C) Kamen Mazdrashki 2010 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "utils/net/net.h" -#include "librpc/gen_ndr/ndr_drsuapi_c.h" -#include "utils/net/drs/net_drs.h" -#include "lib/ldb/include/ldb.h" -#include "ldb_wrap.h" -#include "system/filesys.h" - - -/** - * 'net drs' supported sub-commands - */ -static const struct net_functable net_drs_functable[] = { - { "bind", "Display replication features for a domain controller\n", net_drs_bind_cmd, net_drs_bind_usage }, - { "kcc", "Forces the KCC to recalculate replication topology for a specified domain controller\n", - net_drs_kcc_cmd, net_drs_kcc_usage }, - { "replicate", "Triggers replication event for the specified naming context between the source and destination domain controllers.\n", - net_drs_replicate_cmd, net_drs_replicate_usage }, - { "showrepl", "Displays the replication partners for each directory partition on the specified domain controller.\n", - net_drs_showrepl_cmd, net_drs_showrepl_usage }, - { NULL, NULL } -}; - -/** - * 'net drs' entry point - */ -int net_drs(struct net_context *ctx, int argc, const char **argv) -{ - return net_run_function(ctx, argc, argv, net_drs_functable, net_drs_usage); -} - -/** - * 'net drs' usage message - */ -int net_drs_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net drs [options]\n"); - d_printf("\n"); - d_printf("Currently implemented commands:\n"); - d_printf(" bind - Display DC replication features\n"); - d_printf(" kcc - Forces the KCC to recalculate replication topology for a specified domain controller\n"); - d_printf(" replicate - Triggers replication event for the specified naming context between the source and destination domain controllers.\n"); - d_printf(" showrepl - Displays the replication partners for each directory partition on the specified domain controller.\n"); - return 0; -} - -/** - * Create drsuapi connection to remote DC - * and fill-in DC capabilities - */ -static bool net_drs_DsBind(struct net_drs_context *drs_ctx, struct net_drs_connection *conn) -{ - NTSTATUS status; - struct GUID bind_guid; - struct drsuapi_DsBind req; - struct drsuapi_DsBindInfoCtr in_bind_ctr; - union drsuapi_DsBindInfo *bind_info; - - SMB_ASSERT(conn->binding != NULL); - - status = dcerpc_pipe_connect_b(conn, - &conn->drs_pipe, - conn->binding, - &ndr_table_drsuapi, - drs_ctx->net_ctx->credentials, - drs_ctx->net_ctx->event_ctx, - drs_ctx->net_ctx->lp_ctx); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Failed to connect to server: %s\n", nt_errstr(status)); - return false; - } - conn->drs_handle = conn->drs_pipe->binding_handle; - - ZERO_STRUCT(in_bind_ctr); - in_bind_ctr.length = 48; - in_bind_ctr.info.info48.pid = (uint32_t)getpid(); - GUID_from_string(DRSUAPI_DS_BIND_GUID, &bind_guid); - req.in.bind_guid = &bind_guid; - req.in.bind_info = &in_bind_ctr; - req.out.bind_handle = &conn->bind_handle; - - status = dcerpc_drsuapi_DsBind_r(conn->drs_handle, conn, &req); - if (!NT_STATUS_IS_OK(status)) { - const char *errstr = nt_errstr(status); - d_printf("dcerpc_drsuapi_DsBind failed - %s\n", errstr); - return false; - } else if (!W_ERROR_IS_OK(req.out.result)) { - d_printf("DsBind failed - %s\n", win_errstr(req.out.result)); - return false; - } - - /* fill-in remote DC capabilities */ - ZERO_STRUCT(conn->info48); - bind_info = &req.out.bind_info->info; - conn->bind_info_len = req.out.bind_info->length; - switch (conn->bind_info_len) { - case 48: - conn->info48.supported_extensions_ext = bind_info->info48.supported_extensions_ext; - conn->info48.config_dn_guid = bind_info->info48.config_dn_guid; - case 28: - conn->info48.repl_epoch = bind_info->info28.repl_epoch; - case 24: - conn->info48.supported_extensions = bind_info->info24.supported_extensions; - conn->info48.site_guid = bind_info->info24.site_guid; - conn->info48.pid = bind_info->info24.pid; - break; - default: - d_printf("Error: server returned BindInfo length %d", req.out.bind_info->length); - return false; - } - - return true; -} - -/** - * Close DRSUAPI connection to remote DC - */ -static bool net_drs_DsUnbind(struct net_drs_connection *conn) -{ - struct drsuapi_DsUnbind r; - struct policy_handle bind_handle; - - SMB_ASSERT(conn->drs_pipe); - - ZERO_STRUCT(r); - r.out.bind_handle = &bind_handle; - - r.in.bind_handle = &conn->bind_handle; - dcerpc_drsuapi_DsUnbind_r(conn->drs_handle, conn, &r); - - /* free dcerpc pipe in case we get called more than once */ - talloc_free(conn->drs_pipe); - conn->drs_pipe = NULL; - conn->drs_handle = NULL; - - return true; -} - -/** - * Destroy drsuapi connection - */ -static int net_drs_connection_destructor(struct net_drs_connection *conn) -{ - if (conn->drs_pipe) { - net_drs_DsUnbind(conn); - } - return 0; -} - -/** - * Create DRSUAPI connection to target DC - * @return ptr to net_drs_connection or NULL on failure - */ -struct net_drs_connection * net_drs_connect_dc(struct net_drs_context *drs_ctx, const char *dc_name) -{ - struct net_drs_connection *conn = NULL; - - conn = talloc_zero(drs_ctx, struct net_drs_connection); - NET_DRS_NOMEM_GOTO(conn, failed); - - /* init binding */ - conn->binding = talloc_zero(conn, struct dcerpc_binding); - conn->binding->transport = NCACN_IP_TCP; - conn->binding->flags = drs_ctx->drs_conn->binding->flags; - conn->binding->host = talloc_strdup(conn, dc_name); - conn->binding->target_hostname = conn->binding->host; - - if (!net_drs_DsBind(drs_ctx, conn)) { - goto failed; - } - - talloc_set_destructor(conn, net_drs_connection_destructor); - - return conn; - -failed: - talloc_free(conn); - return NULL; -} - -/** - * Open secured LDAP connection to remote DC - */ -static bool net_drs_ldap_connect(struct net_drs_context *drs_ctx) -{ - char *url; - bool bret = true; - - url = talloc_asprintf(drs_ctx, "ldap://%s/", drs_ctx->dc_name); - if (!url) { - d_printf(__location__ ": Have no memory"); - return false; - } - - drs_ctx->ldap.ldb = ldb_wrap_connect(drs_ctx, - drs_ctx->net_ctx->event_ctx, drs_ctx->net_ctx->lp_ctx, - url, - NULL, - drs_ctx->net_ctx->credentials, - 0); - if (drs_ctx->ldap.ldb == NULL) { - d_printf("Unable to connect to LDAP %s", url); - bret = false; - } - - talloc_free(url); - - return bret; -} - -/** - * fetch RootDSE record - */ -static bool net_drs_ldap_rootdse(struct net_drs_context *drs_ctx) -{ - int ret; - struct ldb_result *r; - struct ldb_dn *basedn; - static const char *attrs[] = { - "*", - NULL - }; - - SMB_ASSERT(drs_ctx->ldap.ldb != NULL); - - basedn = ldb_dn_new(drs_ctx, drs_ctx->ldap.ldb, NULL); - if (!basedn) { - d_printf(__location__ ": No memory"); - return false; - } - - ret = ldb_search(drs_ctx->ldap.ldb, drs_ctx, &r, - basedn, LDB_SCOPE_BASE, attrs, - "(objectClass=*)"); - talloc_free(basedn); - if (ret != LDB_SUCCESS) { - d_printf("RootDSE search failed: %s", ldb_errstring(drs_ctx->ldap.ldb)); - talloc_free(r); - return false; - } else if (r->count != 1) { - d_printf("RootDSE search returned more than one record!"); - talloc_free(r); - return false; - } - - drs_ctx->ldap.rootdse = r->msgs[0]; - - return true; -} - -/** - * parses binding from command line - * and gets target DC name - */ -static bool net_drs_parse_binding(struct net_drs_context *drs_ctx, const char *dc_binding) -{ - NTSTATUS status; - struct dcerpc_binding *b; - - status = dcerpc_parse_binding(drs_ctx->drs_conn, dc_binding, &b); - if (!NT_STATUS_IS_OK(status)) { - d_printf("Bad binding supplied %s\n", dc_binding); - return false; - } - - b->transport = NCACN_IP_TCP; - b->flags |= DCERPC_SIGN | DCERPC_SEAL; - - /* cache target DC name */ - drs_ctx->dc_name = b->target_hostname; - - drs_ctx->drs_conn->binding = b; - - return true; -} - -/** - * Free DRSUAPI connection upon net_drs_context - * destruction - */ -static int net_drs_context_destructor(struct net_drs_context *drs_ctx) -{ - if (drs_ctx->drs_conn && drs_ctx->drs_conn->drs_pipe) { - net_drs_DsUnbind(drs_ctx->drs_conn); - } - return 0; -} - -/** - * Create net_drs_context context to be used - * by 'net drs' sub-commands - */ -bool net_drs_create_context(struct net_context *net_ctx, - const char *dc_binding, - struct net_drs_context **_drs_ctx) -{ - struct net_drs_context *drs_ctx; - - drs_ctx = talloc_zero(net_ctx, struct net_drs_context); - if (!drs_ctx) { - d_printf(__location__ ": No memory"); - return false; - } - - drs_ctx->drs_conn = talloc_zero(drs_ctx, struct net_drs_connection); - if (!drs_ctx->drs_conn) { - d_printf(__location__ ": No memory"); - return false; - } - - drs_ctx->net_ctx = net_ctx; - - if (!net_drs_parse_binding(drs_ctx, dc_binding)) { - goto failed; - } - - /* LDAP connect */ - if (!net_drs_ldap_connect(drs_ctx)) { - goto failed; - } - /* fetch RootDSE */ - if (!net_drs_ldap_rootdse(drs_ctx)) { - goto failed; - } - - /* DRSUAPI connection */ - if (!net_drs_DsBind(drs_ctx, drs_ctx->drs_conn)) { - goto failed; - } - - /* set destructor to free any open connections */ - talloc_set_destructor(drs_ctx, net_drs_context_destructor); - - *_drs_ctx = drs_ctx; - return true; - -failed: - talloc_free(drs_ctx); - return false; -} diff --git a/source4/utils/net/drs/net_drs.h b/source4/utils/net/drs/net_drs.h deleted file mode 100644 index 310bb06cdef..00000000000 --- a/source4/utils/net/drs/net_drs.h +++ /dev/null @@ -1,87 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - Implements functions offered by repadmin.exe tool under Windows - - Copyright (C) Kamen Mazdrashki 2010 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#ifndef NET_DRS_H_ -#define NET_DRS_H_ - -#include "librpc/gen_ndr/ndr_drsuapi_c.h" - - -/** - * Check for critical error - */ -#define NET_DRS_CHECK_GOTO(_condition,_label,_msg) \ - do { \ - if (!(_condition)) { \ - d_printf(__location__": "#_condition" - %s\n", _msg); \ - goto _label; \ - } \ - } while (0) - -/** - * check allocated memory macro - */ -#define NET_DRS_NOMEM_GOTO(_ptr,_label) \ - NET_DRS_CHECK_GOTO(_ptr, _label, "Not enough memory!") - - -/** - * DRSUAPI binding context - */ -struct net_drs_connection { - /* DRSUAPI connection context */ - struct dcerpc_binding *binding; - struct dcerpc_pipe *drs_pipe; - struct dcerpc_binding_handle *drs_handle; - struct policy_handle bind_handle; - - /* length of bind info structure returned by remote DC - * 'net drs bind' command make use of this value */ - uint32_t bind_info_len; - - /* remote DC DRSUAPI capabilities */ - struct drsuapi_DsBindInfo48 info48; -}; - - -/** - * net drs commands context - */ -struct net_drs_context { - struct net_context *net_ctx; - - /* remote DC name supplied from command line */ - const char *dc_name; - - /* DRSUAPI connection to target DC */ - struct net_drs_connection *drs_conn; - - /* LDAP connection to DC */ - struct net_drs_ldap { - struct ldb_context *ldb; - const struct ldb_message *rootdse; - } ldap; -}; - - -#include "utils/net/drs/net_drs_proto.h" - -#endif /* NET_DRS_H_ */ diff --git a/source4/utils/net/drs/net_drs_bind.c b/source4/utils/net/drs/net_drs_bind.c deleted file mode 100644 index 6daac7a60d8..00000000000 --- a/source4/utils/net/drs/net_drs_bind.c +++ /dev/null @@ -1,136 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - Implements functions offered by repadmin.exe tool under Windows - - Copyright (C) Kamen Mazdrashki 2010 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "utils/net/net.h" -#include "utils/net/drs/net_drs.h" - - -#define DEFINE_FLAG(_flag, _win_name) {_flag, #_flag, _win_name} - -struct drs_extension_flag { - uint32_t flag; - const char *samba_name; - const char *win_name; -}; - -static const struct drs_extension_flag drs_repl_flags[] = { - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_BASE, "DRS_EXT_BASE"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION, "DRS_EXT_ASYNCREPL"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI, "DRS_EXT_REMOVEAPI"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_MOVEREQ_V2, "DRS_EXT_MOVEREQ_V2"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHG_COMPRESS, "DRS_EXT_GETCHG_DEFLATE"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V1, "DRS_EXT_DCINFO_V1"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_RESTORE_USN_OPTIMIZATION, "DRS_EXT_RESTORE_USN_OPTIMIZATION"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY, "DRS_EXT_ADDENTRY"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE, "DRS_EXT_KCC_EXECUTE"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADDENTRY_V2, "DRS_EXT_ADDENTRY_V2"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_LINKED_VALUE_REPLICATION, "DRS_EXT_LINKED_VALUE_REPLICATION"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V2, "DRS_EXT_DCINFO_V2"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_INSTANCE_TYPE_NOT_REQ_ON_MOD, "DRS_EXT_INSTANCE_TYPE_NOT_REQ_ON_MOD"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_CRYPTO_BIND, "DRS_EXT_CRYPTO_BIND"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GET_REPL_INFO, "DRS_EXT_GET_REPL_INFO"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_STRONG_ENCRYPTION, "DRS_EXT_STRONG_ENCRYPTION"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_DCINFO_V01, "DRS_EXT_DCINFO_VFFFFFFFF"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_TRANSITIVE_MEMBERSHIP, "DRS_EXT_TRANSITIVE_MEMBERSHIP"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADD_SID_HISTORY, "DRS_EXT_ADD_SID_HISTORY"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_POST_BETA3, "DRS_EXT_POST_BETA3"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V5, "DRS_EXT_GETCHGREQ_V5"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GET_MEMBERSHIPS2, "DRS_EXT_GETMEMBERSHIPS2"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V6, "DRS_EXT_GETCHGREQ_V6"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_NONDOMAIN_NCS, "DRS_EXT_NONDOMAIN_NCS"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8, "DRS_EXT_GETCHGREQ_V8"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V5, "DRS_EXT_GETCHGREPLY_V5"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V6, "DRS_EXT_GETCHGREPLY_V6"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADDENTRYREPLY_V3, "DRS_EXT_WHISTLER_BETA3"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREPLY_V7, "DRS_EXT_WHISTLER_BETA3"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_VERIFY_OBJECT, "DRS_EXT_WHISTLER_BETA3"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_XPRESS_COMPRESS, "DRS_EXT_W2K3_DEFLATE"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V10, "DRS_EXT_GETCHGREQ_V10"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_RESERVED_PART2, "DRS_EXT_RESERVED_FOR_WIN2K_OR_DOTNET_PART2"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_RESERVED_PART3, "DRS_EXT_RESERVED_FOR_WIN2K_OR_DOTNET_PART3") -}; - -static const struct drs_extension_flag drs_repl_flags_ex[] = { - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_ADAM, "DRS_EXT_ADAM"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_LH_BETA2, "DRS_EXT_LH_BETA2"), - DEFINE_FLAG(DRSUAPI_SUPPORTED_EXTENSION_RECYCLE_BIN, "DRS_EXT_RECYCLE_BIN") -}; - - - -int net_drs_bind_cmd(struct net_context *ctx, int argc, const char **argv) -{ - int i; - struct net_drs_context *drs_ctx; - struct drsuapi_DsBindInfo48 *info48; - - /* only one arg expected */ - if (argc != 1) { - return net_drs_bind_usage(ctx, argc, argv); - } - - if (!net_drs_create_context(ctx, argv[0], &drs_ctx)) { - return -1; - } - - d_printf("Bind to %s succeeded.\n", drs_ctx->dc_name); - d_printf("Extensions supported (cb=%d):\n", drs_ctx->drs_conn->bind_info_len); - - /* Print standard flags */ - info48 = &drs_ctx->drs_conn->info48; - for (i = 0; i < ARRAY_SIZE(drs_repl_flags); i++) { - const struct drs_extension_flag *repl_flag = &drs_repl_flags[i]; - d_printf(" %-60s: %-3s (%s)\n", repl_flag->samba_name, - info48->supported_extensions & repl_flag->flag ? "Yes" : "No", - repl_flag->win_name); - } - - /* Print Extended flags */ - d_printf("\n"); - d_printf("Extended Extensions supported:\n"); - for (i = 0; i < ARRAY_SIZE(drs_repl_flags_ex); i++) { - const struct drs_extension_flag *repl_flag_ex = &drs_repl_flags_ex[i]; - d_printf(" %-60s: %-3s (%s)\n", repl_flag_ex->samba_name, - info48->supported_extensions_ext & repl_flag_ex->flag ? "Yes" : "No", - repl_flag_ex->win_name); - } - - /* print additional info */ - d_printf("\n"); - d_printf("Site GUID: %s\n", GUID_string(drs_ctx, &info48->site_guid)); - d_printf("Repl epoch: %d\n", info48->repl_epoch); - if (GUID_all_zero(&info48->config_dn_guid)) { - d_printf("Forest GUID: (none)\n"); - } else { - d_printf("Forest GUID: %s\n", GUID_string(drs_ctx, &info48->config_dn_guid)); - } - - talloc_free(drs_ctx); - - return 0; -} - -int net_drs_bind_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net drs bind \n"); - return 0; -} diff --git a/source4/utils/net/drs/net_drs_kcc.c b/source4/utils/net/drs/net_drs_kcc.c deleted file mode 100644 index eaf550e64d9..00000000000 --- a/source4/utils/net/drs/net_drs_kcc.c +++ /dev/null @@ -1,170 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - Implements functions offered by repadmin.exe tool under Windows - - Copyright (C) Kamen Mazdrashki 2010 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "utils/net/net.h" -#include "utils/net/drs/net_drs.h" -#include "lib/ldb/include/ldb.h" - - -static bool net_drs_kcc_site_info(struct net_drs_context *drs_ctx, - const char **site_name, - uint32_t *site_options) -{ - struct ldb_dn *dn; - const struct ldb_val *ldb_val; - TALLOC_CTX *mem_ctx; - int ret; - struct ldb_result *ldb_res; - static const char *attrs[] = { - "options", - "whenChanged", - NULL - }; - - mem_ctx = talloc_new(drs_ctx); - - /* get dsServiceName, which is NTDS Settings - * object for the server - * e.g.: CN=NTDS Settings,CN=,CN=Servers,CN=,CN=Sites, */ - dn = ldb_msg_find_attr_as_dn(drs_ctx->ldap.ldb, mem_ctx, drs_ctx->ldap.rootdse, "dsServiceName"); - if (!dn) { - d_printf("No dsServiceName value in RootDSE!\n"); - goto failed; - } - - /* work out site name */ - if (!ldb_dn_remove_child_components(dn, 3)) { - d_printf("Failed to find Site DN.\n"); - goto failed; - } - - ldb_val = ldb_dn_get_rdn_val(dn); - if (!ldb_val) { - d_printf("Failed to get site name.\n"); - goto failed; - } - *site_name = talloc_strndup(drs_ctx, (const char*)ldb_val->data, ldb_val->length); - - /* get 'NTDS Site Settings' */ - if (!ldb_dn_add_child_fmt(dn, "CN=NTDS Site Settings")) { - d_printf("Failed to create NTDS Site Settings DN.\n"); - goto failed; - } - - ret = ldb_search(drs_ctx->ldap.ldb, mem_ctx, &ldb_res, - dn, LDB_SCOPE_BASE, attrs, "(objectClass=*)"); - if (ret != LDB_SUCCESS) { - d_printf("Failed to get Site object\n"); - goto failed; - } - if (ldb_res->count != 1) { - d_printf("Error: returned %d messages for Site object.\n", ldb_res->count); - goto failed; - } - *site_options = ldb_msg_find_attr_as_uint(ldb_res->msgs[0], "options", 0); - - talloc_free(mem_ctx); - return true; - -failed: - talloc_free(mem_ctx); - return false; -} - -/** - * 'net drs kcc' command entry point - */ -int net_drs_kcc_cmd(struct net_context *ctx, int argc, const char **argv) -{ - NTSTATUS status; - struct net_drs_context *drs_ctx; - struct net_drs_connection *drs_conn; - struct drsuapi_DsBindInfo48 *info48; - struct drsuapi_DsExecuteKCC req; - union drsuapi_DsExecuteKCCRequest kcc_req; - const char *site_name; - uint32_t site_options; - - /* only one arg expected */ - if (argc != 1) { - return net_drs_kcc_usage(ctx, argc, argv); - } - - if (!net_drs_create_context(ctx, argv[0], &drs_ctx)) { - return -1; - } - drs_conn = drs_ctx->drs_conn; - info48 = &drs_conn->info48; - - /* check if target DC supports ExecuteKCC */ - if (!(info48->supported_extensions & DRSUAPI_SUPPORTED_EXTENSION_KCC_EXECUTE)) { - d_printf("%s does not support EXECUTE_KCC extension.\n", drs_ctx->dc_name); - goto failed; - } - - /* gather some Site info */ - if (!net_drs_kcc_site_info(drs_ctx, &site_name, &site_options)) { - goto failed; - } - - d_printf("%s\n", site_name); - if (site_options) { - /* TODO: print meaningfull site options here */ - d_printf("Current Site Options: 0x%X\n", site_options); - } else { - d_printf("Current Site Options: (none)\n"); - } - - /* execute KCC */ - ZERO_STRUCT(req); - ZERO_STRUCT(kcc_req); - req.in.bind_handle = &drs_conn->bind_handle; - req.in.level = 1; - req.in.req = &kcc_req; - status = dcerpc_drsuapi_DsExecuteKCC_r(drs_conn->drs_handle, drs_ctx, &req); - if (!NT_STATUS_IS_OK(status)) { - const char *errstr = nt_errstr(status); - d_printf("dcerpc_drsuapi_DsExecuteKCC failed - %s.\n", errstr); - goto failed; - } else if (!W_ERROR_IS_OK(req.out.result)) { - d_printf("DsExecuteKCC failed - %s.\n", win_errstr(req.out.result)); - goto failed; - } - - d_printf("Consistency check on %s successful.\n", drs_ctx->dc_name); - - talloc_free(drs_ctx); - return 0; - -failed: - talloc_free(drs_ctx); - return -1; -} - -/** - * 'net drs kcc' usage - */ -int net_drs_kcc_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net drs kcc \n"); - return 0; -} diff --git a/source4/utils/net/drs/net_drs_replicate.c b/source4/utils/net/drs/net_drs_replicate.c deleted file mode 100644 index a661d2b70e4..00000000000 --- a/source4/utils/net/drs/net_drs_replicate.c +++ /dev/null @@ -1,252 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - Implements functions offered by repadmin.exe tool under Windows - - Copyright (C) Kamen Mazdrashki 2010 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "utils/net/net.h" -#include "net_drs.h" -#include "lib/ldb/include/ldb.h" -#include "dsdb/samdb/samdb.h" - - -/** - * Figure out what is the NDTS Settings objectGUID - * when DC_NAME is given - */ -static struct ldb_dn * -net_drs_server_dn_from_dc_name(struct net_drs_context *drs_ctx, - const char *dc_name) -{ - int ldb_err; - char *filter; - struct ldb_dn *dn; - struct ldb_dn *server_dn = NULL; - struct ldb_result *ldb_res; - static const char *attrs[] = { - "objectGUID", - "name", - "dNSHostName", - NULL - }; - TALLOC_CTX *mem_ctx; - - mem_ctx = talloc_new(drs_ctx); - - /* Make DN for Sites container */ - dn = ldb_msg_find_attr_as_dn(drs_ctx->ldap.ldb, mem_ctx, drs_ctx->ldap.rootdse, "dsServiceName"); - NET_DRS_CHECK_GOTO(dn != NULL, failed, "RootDSE doesn't have dsServiceName!?\n"); - if (!ldb_dn_remove_child_components(dn, 4)) { - d_printf("Failed to make DN for Sites container.\n"); - goto failed; - } - - /* search for Server in Sites container */ - filter = talloc_asprintf(mem_ctx, - "(&(objectCategory=server)(|(name=%1$s)(dNSHostName=%1$s)))", - dc_name); - ldb_err = ldb_search(drs_ctx->ldap.ldb, mem_ctx, &ldb_res, - dn, LDB_SCOPE_SUBTREE, attrs, - "%s", - filter); - if (ldb_err != LDB_SUCCESS) { - d_printf("ldb_seach(base=%s, filter=%s) failed: %d (%s).\n", - ldb_dn_get_linearized(dn), - filter, - ldb_err, ldb_errstring(drs_ctx->ldap.ldb)); - goto failed; - } - if (ldb_res->count != 1) { - d_printf("ldb_search(base=%s, filter=%s) returned %d records, expected 1!\n", - ldb_dn_get_linearized(dn), - filter, - ldb_res->count); - goto failed; - } - - server_dn = talloc_steal(drs_ctx, ldb_res->msgs[0]->dn); - -failed: - talloc_free(mem_ctx); - return server_dn; -} - - -/** - * Figure out what is the NDTS Settings objectGUID - * when DC_NAME is given - */ -static bool net_drs_ntds_guid_from_dc_name(struct net_drs_context *drs_ctx, - const char *dc_name, - struct GUID *_ntds_guid) -{ - int ldb_err; - struct ldb_dn *server_dn; - struct ldb_result *ldb_res; - static const char *attrs[] = { - "objectGUID", - "msDS-portLDAP", - "name", - "objectCategory", - NULL - }; - TALLOC_CTX *mem_ctx; - - mem_ctx = talloc_new(drs_ctx); - - /* resolve Server_DN for dc_name */ - server_dn = net_drs_server_dn_from_dc_name(drs_ctx, dc_name); - if (!server_dn) { - d_printf("DSA object for %s could not be found.\n", dc_name); - goto failed; - } - - /* move server_dn mem to local context */ - server_dn = talloc_steal(mem_ctx, server_dn); - - /* search ntdsDsa object under Server container */ - ldb_err = ldb_search(drs_ctx->ldap.ldb, mem_ctx, &ldb_res, - server_dn, LDB_SCOPE_ONELEVEL, attrs, - "%s", "(|(objectCategory=nTDSDSA)(objectCategory=nTDSDSARO))"); - if (ldb_err != LDB_SUCCESS) { - d_printf("ldb_seach() failed with err: %d (%s).\n", - ldb_err, ldb_errstring(drs_ctx->ldap.ldb)); - goto failed; - } - if (ldb_res->count != 1) { - d_printf("ldb_search() should return exactly one record!\n"); - goto failed; - } - - *_ntds_guid = samdb_result_guid(ldb_res->msgs[0], "objectGUID"); - - talloc_free(mem_ctx); - return true; - -failed: - talloc_free(mem_ctx); - return false; -} - -/** - * Sends DsReplicaSync to dc_name_dest to - * replicate naming context nc_dn_str from - * server with ntds_guid_src GUID - */ -static bool net_drs_replicate_sync_nc(struct net_drs_context *drs_ctx, - struct GUID ntds_guid_src, - const char *nc_dn_str, - uint32_t options) -{ - NTSTATUS status; - struct net_drs_connection *drs_conn; - struct drsuapi_DsReplicaSync req; - union drsuapi_DsReplicaSyncRequest sync_req; - struct drsuapi_DsReplicaObjectIdentifier nc; - - /* use already opened connection */ - drs_conn = drs_ctx->drs_conn; - - /* construct naming context object */ - ZERO_STRUCT(nc); - nc.dn = nc_dn_str; - - /* construct request object for DsReplicaSync */ - req.in.bind_handle = &drs_conn->bind_handle; - req.in.level = 1; - req.in.req = &sync_req; - req.in.req->req1.naming_context = &nc; - req.in.req->req1.options = options; - req.in.req->req1.source_dsa_dns = NULL; - req.in.req->req1.source_dsa_guid = ntds_guid_src; - - /* send DsReplicaSync request */ - status = dcerpc_drsuapi_DsReplicaSync_r(drs_conn->drs_handle, drs_ctx, &req); - if (!NT_STATUS_IS_OK(status)) { - const char *errstr = nt_errstr(status); - d_printf("DsReplicaSync RPC failed - %s.\n", errstr); - return false; - } else if (!W_ERROR_IS_OK(req.out.result)) { - d_printf("DsReplicaSync failed - %s (nc=[%s], dsa_guid=[%s]).\n", - win_errstr(req.out.result), - nc.dn, GUID_string(drs_ctx, &ntds_guid_src)); - return false; - } - - return true; -} - -/** - * 'net drs replicate' command entry point - */ -int net_drs_replicate_cmd(struct net_context *ctx, int argc, const char **argv) -{ - bool bret; - struct net_drs_context *drs_ctx; - struct GUID ntds_guid_src; - const char *dc_name_dest; - const char *dc_name_src; - const char *nc_dn_str; - - /* only one arg expected */ - if (argc != 3) { - return net_drs_replicate_usage(ctx, argc, argv); - } - - dc_name_dest = argv[0]; - dc_name_src = argv[1]; - nc_dn_str = argv[2]; - - if (!net_drs_create_context(ctx, dc_name_dest, &drs_ctx)) { - return -1; - } - - /* Resolve source DC_NAME to its NDTS Settings GUID */ - if (!net_drs_ntds_guid_from_dc_name(drs_ctx, dc_name_src, &ntds_guid_src)) { - d_printf("Error: DSA object for %s could not be found.\n", dc_name_src); - goto failed; - } - - /* Synchronize given Naming Context */ - bret = net_drs_replicate_sync_nc(drs_ctx, - ntds_guid_src, nc_dn_str, - DRSUAPI_DRS_WRIT_REP); - if (!bret) { - goto failed; - } - - d_printf("Replicate from %s to %s was successful.\n", dc_name_src, drs_ctx->dc_name); - - talloc_free(drs_ctx); - return 0; - -failed: - d_printf("Replicate terminated with errors.\n"); - talloc_free(drs_ctx); - return -1; -} - -/** - * 'net drs replicate' usage - */ -int net_drs_replicate_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net drs replicate \n"); - return 0; -} diff --git a/source4/utils/net/drs/net_drs_showrepl.c b/source4/utils/net/drs/net_drs_showrepl.c deleted file mode 100644 index 584c2947078..00000000000 --- a/source4/utils/net/drs/net_drs_showrepl.c +++ /dev/null @@ -1,605 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - Implements functions offered by repadmin.exe tool under Windows - - Copyright (C) Kamen Mazdrashki 2010 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "utils/net/net.h" -#include "net_drs.h" -#include "lib/ldb/include/ldb.h" -#include "dsdb/samdb/samdb.h" -#include "lib/util/util_ldb.h" - - -/** - * Parses NTDS Settings DN to find out: - * - DC name - * - Site name - * - Domain DNS name - */ -static bool net_drs_parse_ntds_dn(struct ldb_dn *ntds_dn, - TALLOC_CTX *mem_ctx, - const char **_dc_name, - const char **_site_name, - const char **_domain_dns_name) -{ - struct ldb_dn *dn = NULL; - const struct ldb_val *val; - - dn = ldb_dn_copy(mem_ctx, ntds_dn); - NET_DRS_NOMEM_GOTO(dn, failed); - - /* remove NTDS Settings component */ - ldb_dn_remove_child_components(dn, 1); - if (_dc_name) { - val = ldb_dn_get_rdn_val(dn); - *_dc_name = talloc_strdup(mem_ctx, (const char *)val->data); - } - - /* remove DC and Servers components */ - ldb_dn_remove_child_components(dn, 2); - if (_site_name) { - val = ldb_dn_get_rdn_val(dn); - *_site_name = talloc_strdup(mem_ctx, (const char *)val->data); - } - - if (_domain_dns_name) { - char *pstr; - char *dns_name; - - dns_name = ldb_dn_canonical_string(mem_ctx, dn); - NET_DRS_NOMEM_GOTO(dns_name, failed); - - pstr = strchr(dns_name, '/'); - if (pstr) { - *pstr = '\0'; - } - - *_domain_dns_name = dns_name; - } - - talloc_free(dn); - return true; - -failed: - talloc_free(dn); - return false; -} - -static char * net_drs_dc_canonical_string(struct ldb_dn *ntds_dn, TALLOC_CTX *mem_ctx) -{ - const char *dc_name; - const char *site_name; - char *canonical_name; - - if (!net_drs_parse_ntds_dn(ntds_dn, mem_ctx, &dc_name, &site_name, NULL)) { - return NULL; - } - - canonical_name = talloc_asprintf(mem_ctx, "%s\\%s", site_name, dc_name); - - talloc_free(discard_const(dc_name)); - talloc_free(discard_const(site_name)); - - return canonical_name; -} - -/** - * Prints DC information for showrepl command - */ -static bool net_drs_showrepl_print_dc_info(struct net_drs_context *drs_ctx) -{ - int ret; - const char *dc_name; - const char *site_name; - struct ldb_dn *dn; - struct ldb_message **ntds_msgs; - struct ldb_message **site_msgs; - uint32_t options; - struct GUID guid; - TALLOC_CTX *mem_ctx; - const char *ntds_attr[] = {"options", "objectGuid", "invocationId", NULL}; - const char *site_ntds_attr[] = {"options", "whenChanged", NULL}; - - mem_ctx = talloc_new(drs_ctx); - - /* Get NTDS Settings DN string for the DC */ - dn = samdb_result_dn(drs_ctx->ldap.ldb, mem_ctx, - drs_ctx->ldap.rootdse, "dsServiceName", NULL); - NET_DRS_CHECK_GOTO(dn, failed, "No dsServiceName value in RootDSE!\n"); - - /* parse NTDS Settings DN */ - if (!net_drs_parse_ntds_dn(dn, mem_ctx, &dc_name, &site_name, NULL)) { - d_printf("Unexpected: Failed to parse %s DN!\n", - ldb_dn_get_linearized(dn)); - goto failed; - } - - /* Query DC record for DSA's NTDS Settings DN */ - ret = gendb_search_dn(drs_ctx->ldap.ldb, mem_ctx, dn, &ntds_msgs, ntds_attr); - if (ret != 1) { - d_printf("Error while fetching %s, Possible error: %s\n", - ldb_dn_get_linearized(dn), - ldb_errstring(drs_ctx->ldap.ldb)); - goto failed; - } - - /* find out NTDS Site Settings DN */ - if (!ldb_dn_remove_child_components(dn, 3)) { - d_printf("Unexpected: ldb_dn_remove_child_components() failed!\n"); - goto failed; - } - if (!ldb_dn_add_child_fmt(dn, "CN=%s", "NTDS Site Settings")) { - d_printf("Unexpected: ldb_dn_add_child_fmt() failed!\n"); - goto failed; - } - /* Query Site record for DSA's NTDS Settings DN */ - ret = gendb_search_dn(drs_ctx->ldap.ldb, mem_ctx, dn, &site_msgs, site_ntds_attr); - if (ret != 1) { - d_printf("Error while fetching %s, Possible error: %s\n", - ldb_dn_get_linearized(dn), - ldb_errstring(drs_ctx->ldap.ldb)); - goto failed; - } - - /* Site-name\DC-name */ - d_printf("%s\\%s\n", site_name, dc_name); - /* DSA Options */ - options = ldb_msg_find_attr_as_uint(ntds_msgs[0], "options", 0); - if (options) { - /* TODO: Print options as string in IS_GC... etc form */ - d_printf("DSA Options: 0x%08X\n", options); - } else { - d_printf("DSA Options: (none)\n"); - } - /* Site Options */ - options = ldb_msg_find_attr_as_uint(site_msgs[0], "options", 0); - if (options) { - /* TODO: Print options in string */ - d_printf("DSA Options: 0x%08X\n", options); - } else { - d_printf("Site Options: (none)\n"); - } - /* DSA GUID */ - guid = samdb_result_guid(ntds_msgs[0], "objectGUID"); - d_printf("DSA object GUID: %s\n", GUID_string(mem_ctx, &guid)); - /* DSA invocationId */ - guid = samdb_result_guid(ntds_msgs[0], "invocationId"); - d_printf("DSA invocationID: %s\n", GUID_string(mem_ctx, &guid)); - - talloc_free(mem_ctx); - return true; - -failed: - talloc_free(mem_ctx); - return false; -} - -/** - * Convenience function to call DsReplicaGetInfo - */ -static bool net_drs_exec_DsReplicaGetInfo(struct net_drs_context *drs_ctx, - enum drsuapi_DsReplicaInfoType info_type, - union drsuapi_DsReplicaInfo *_replica_info) -{ - NTSTATUS status; - struct drsuapi_DsReplicaGetInfo r; - union drsuapi_DsReplicaGetInfoRequest req; - enum drsuapi_DsReplicaInfoType info_type_got; - struct net_drs_connection *drs_conn = drs_ctx->drs_conn; - - ZERO_STRUCT(req); - req.req1.info_type = info_type; - - r.in.bind_handle = &drs_conn->bind_handle; - r.in.level = 1; - r.in.req = &req; - r.out.info = _replica_info; - r.out.info_type = &info_type_got; - - status = dcerpc_drsuapi_DsReplicaGetInfo_r(drs_conn->drs_handle, drs_ctx, &r); - if (!NT_STATUS_IS_OK(status)) { - const char *errstr = nt_errstr(status); - d_printf("DsReplicaGetInfo failed - %s.\n", errstr); - return false; - } else if (!W_ERROR_IS_OK(r.out.result)) { - d_printf("DsReplicaGetInfo failed - %s.\n", win_errstr(r.out.result)); - return false; - } - - if (info_type != info_type_got) { - d_printf("DsReplicaGetInfo: Error requested info %d, got info %d.\n", - info_type, info_type_got); - return false; - } - - return true; -} - -/** - * Return transport type string for given transport object DN. - * Currently always return 'RPC'. - * - * TODO: Implement getting transport type for all kind of transports - */ -static const char * -net_drs_transport_type_str(struct net_drs_context *drs_ctx, const char *transport_obj_dn) -{ - return "RPC"; -} - -/** - * Prints most of the info we got about - * a replication partner - */ -static bool net_drs_showrepl_print_heighbor(struct net_drs_context *drs_ctx, - struct drsuapi_DsReplicaNeighbour *neighbor) -{ - struct ldb_dn *ntds_dn; - TALLOC_CTX *mem_ctx; - - mem_ctx = talloc_new(drs_ctx); - - ntds_dn = ldb_dn_new(drs_ctx, drs_ctx->ldap.ldb, neighbor->source_dsa_obj_dn); - NET_DRS_NOMEM_GOTO(ntds_dn, failed); - - d_printf("%s\n", neighbor->naming_context_dn); - /* TODO: Determine connection type */ - d_printf("\t%s via %s\n", - net_drs_dc_canonical_string(ntds_dn, mem_ctx), - net_drs_transport_type_str(drs_ctx, neighbor->transport_obj_dn)); - d_printf("\t\tDSA object GUID: %s\n", GUID_string(mem_ctx, &neighbor->source_dsa_obj_guid)); - if (W_ERROR_IS_OK(neighbor->result_last_attempt)) { - d_printf("\t\tLast attempt @ %s was successful.\n", - nt_time_string(mem_ctx, neighbor->last_attempt)); - } else { - d_printf("\t\tLast attempt @ %s failed, result %d (%s):\n", - nt_time_string(mem_ctx, neighbor->last_attempt), - W_ERROR_V(neighbor->result_last_attempt), - win_errstr(neighbor->result_last_attempt)); - d_printf("\t\t\t%s\n", get_friendly_werror_msg(neighbor->result_last_attempt)); - } - d_printf("\t\t%d consecutive failure(s).\n", neighbor->consecutive_sync_failures); - d_printf("\t\tLast success @ %s\n", nt_time_string(mem_ctx, neighbor->last_success)); - - talloc_free(mem_ctx); - return true; - -failed: - talloc_free(mem_ctx); - return false; -} - -/** - * Prints list of all servers that target DC - * replicates from - */ -static bool net_drs_showrepl_print_inbound_neihbors(struct net_drs_context *drs_ctx) -{ - int i; - bool bret; - struct drsuapi_DsReplicaNeighbourCtr *reps_from; - union drsuapi_DsReplicaInfo replica_info; - - d_printf("\n==== INBOUND NEIGHBORS ====\n"); - - bret = net_drs_exec_DsReplicaGetInfo(drs_ctx, - DRSUAPI_DS_REPLICA_INFO_NEIGHBORS, &replica_info); - if (!bret) { - d_printf("DsReplicaGetInfo() failed for DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES.\n"); - return false; - } - reps_from = replica_info.neighbours; - - for (i = 0; i < reps_from->count; i++) { - d_printf("\n"); - net_drs_showrepl_print_heighbor(drs_ctx, &reps_from->array[i]); - } - - return true; -} - -/** - * Prints list of all servers that target DC - * notifies for changes - */ -static bool net_drs_showrepl_print_outbound_neihbors(struct net_drs_context *drs_ctx) -{ - int i; - bool bret; - struct drsuapi_DsReplicaNeighbourCtr *reps_to; - union drsuapi_DsReplicaInfo replica_info; - - d_printf("\n==== OUTBOUND NEIGHBORS ====\n"); - - bret = net_drs_exec_DsReplicaGetInfo(drs_ctx, - DRSUAPI_DS_REPLICA_INFO_REPSTO, &replica_info); - if (!bret) { - d_printf("DsReplicaGetInfo() failed for DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES.\n"); - return false; - } - reps_to = replica_info.repsto; - - for (i = 0; i < reps_to->count; i++) { - d_printf("\n"); - net_drs_showrepl_print_heighbor(drs_ctx, &reps_to->array[i]); - } - - return true; -} - -/** - * Prints all connections under - * NTDS Settings for target DC. - * - * NOTE: All connections are printed - * no matter what their status is - */ -static bool net_drs_showrepl_print_connection_objects(struct net_drs_context *drs_ctx) -{ - int i; - int conn_count; - struct ldb_message **conn_msgs; - struct ldb_dn *dn; - uint32_t options; - const char *dc_dns_name; - TALLOC_CTX *mem_ctx; - const char *conn_attr[] = { - "name", - "enabledConnection", - "fromServer", - "mS-DS-ReplicatesNCReason", - "options", - "schedule", - "transportType", - "whenChanged", - "whenCreated", - NULL - }; - - mem_ctx = talloc_new(drs_ctx); - - d_printf("\n==== KCC CONNECTION OBJECTS ====\n"); - - /* Get NTDS Settings DN string for the DC */ - dn = samdb_result_dn(drs_ctx->ldap.ldb, mem_ctx, - drs_ctx->ldap.rootdse, "dsServiceName", NULL); - NET_DRS_CHECK_GOTO(dn, failed, "No dsServiceName value in RootDSE!\n"); - - /* DNS host name for target DC */ - dc_dns_name = ldb_msg_find_attr_as_string(drs_ctx->ldap.rootdse , "dnsHostName", NULL); - NET_DRS_CHECK_GOTO(dc_dns_name, failed, "No dsServiceName value in dnsHostName!\n"); - - /* Enum. Connection objects under NTDS Settings */ - conn_count = gendb_search(drs_ctx->ldap.ldb, mem_ctx, dn, - &conn_msgs, conn_attr, "(objectClass=nTDSConnection)"); - if (conn_count == -1) { - d_printf("Error searching Connections for %s, Possible error: %s\n", - ldb_dn_get_linearized(dn), - ldb_errstring(drs_ctx->ldap.ldb)); - goto failed; - } - - for (i = 0; i < conn_count; i++) { - int k; - const char *transport_type; - struct ldb_message_element *msg_elem; - struct ldb_message *conn_msg = conn_msgs[i]; - - d_printf("Connection --\n"); - d_printf("\tConnection name : %s\n", - ldb_msg_find_attr_as_string(conn_msg, "name", NULL)); - d_printf("\tEnabled : %s\n", - ldb_msg_find_attr_as_string(conn_msg, "enabledConnection", "TRUE")); - d_printf("\tServer DNS name : %s\n", dc_dns_name); - d_printf("\tServer DN name : %s\n", - ldb_msg_find_attr_as_string(conn_msg, "fromServer", NULL)); - transport_type = ldb_msg_find_attr_as_string(conn_msg, "transportType", NULL); - d_printf("\t\tTransportType: %s\n", - net_drs_transport_type_str(drs_ctx, transport_type)); - /* TODO: print Connection options in friendly format */ - options = ldb_msg_find_attr_as_uint(conn_msg, "options", 0); - d_printf("\t\toptions: 0x%08X\n", options); - - /* print replicated NCs for this connection */ - msg_elem = ldb_msg_find_element(conn_msg, "mS-DS-ReplicatesNCReason"); - if (!msg_elem) { - d_printf("Warning: No NC replicated for Connection!\n"); - continue; - } - for (k = 0; k < msg_elem->num_values; k++) { - struct dsdb_dn *bin_dn; - - bin_dn = dsdb_dn_parse(mem_ctx, drs_ctx->ldap.ldb, - &msg_elem->values[k], DSDB_SYNTAX_BINARY_DN); - if (!bin_dn) { - d_printf("Unexpected: Failed to parse DN - %s\n", - msg_elem->values[k].data); - } - d_printf("\t\tReplicatesNC: %s\n", ldb_dn_get_linearized(bin_dn->dn)); - /* TODO: print Reason flags in friendly format */ - options = RIVAL(bin_dn->extra_part.data, 0); - d_printf("\t\tReason: 0x%08X\n", options); - d_printf("\t\t\tReplica link has been added.\n"); - } - } - - talloc_free(mem_ctx); - return true; - -failed: - talloc_free(mem_ctx); - return false; -} - -/** - * Prints all DC's connections failure. - * - * NOTE: Still don't know exactly what - * this information means - */ -static bool net_drs_showrepl_print_connect_failures(struct net_drs_context *drs_ctx) -{ - int i; - bool bret; - struct ldb_dn *ntds_dn; - struct drsuapi_DsReplicaKccDsaFailure *failure; - struct drsuapi_DsReplicaKccDsaFailuresCtr *connect_failures; - union drsuapi_DsReplicaInfo replica_info; - TALLOC_CTX *mem_ctx; - - d_printf("\n==== CONNECION FAILURES ====\n"); - - bret = net_drs_exec_DsReplicaGetInfo(drs_ctx, - DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES, - &replica_info); - if (!bret) { - d_printf("DsReplicaGetInfo() failed for DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES.\n"); - return false; - } - connect_failures = replica_info.connectfailures; - - mem_ctx = talloc_new(drs_ctx); - - for (i = 0; i < connect_failures->count; i++) { - failure = &connect_failures->array[i]; - - ntds_dn = ldb_dn_new(mem_ctx, drs_ctx->ldap.ldb, failure->dsa_obj_dn); - d_printf("Source: %s\n", net_drs_dc_canonical_string(ntds_dn, mem_ctx)); - d_printf("******* %d CONSECUTIVE FAILURES since %s\n", - failure->num_failures, - nt_time_string(mem_ctx, failure->first_failure)); - d_printf("Last error: %d (%s):\n", - W_ERROR_V(failure->last_result), - win_errstr(failure->last_result)); - d_printf("\t\t\t%s\n", get_friendly_werror_msg(failure->last_result)); - } - - talloc_free(mem_ctx); - return true; -} - -/** - * Prints all DC's link failures - */ -static bool net_drs_showrepl_print_link_failures(struct net_drs_context *drs_ctx) -{ - int i; - bool bret; - struct ldb_dn *ntds_dn; - struct drsuapi_DsReplicaKccDsaFailure *failure; - struct drsuapi_DsReplicaKccDsaFailuresCtr *link_failures; - union drsuapi_DsReplicaInfo replica_info; - TALLOC_CTX *mem_ctx; - - d_printf("\n==== LINK FAILURES ====\n"); - - bret = net_drs_exec_DsReplicaGetInfo(drs_ctx, - DRSUAPI_DS_REPLICA_INFO_KCC_DSA_LINK_FAILURES, &replica_info); - if (!bret) { - d_printf("DsReplicaGetInfo() failed for DRSUAPI_DS_REPLICA_INFO_KCC_DSA_CONNECT_FAILURES.\n"); - return false; - } - link_failures = replica_info.linkfailures; - - mem_ctx = talloc_new(drs_ctx); - - for (i = 0; i < link_failures->count; i++) { - failure = &link_failures->array[i]; - - ntds_dn = ldb_dn_new(mem_ctx, drs_ctx->ldap.ldb, failure->dsa_obj_dn); - d_printf("Source: %s\n", net_drs_dc_canonical_string(ntds_dn, mem_ctx)); - d_printf("******* %d CONSECUTIVE FAILURES since %s\n", - failure->num_failures, - nt_time_string(mem_ctx, failure->first_failure)); - d_printf("Last error: %d (%s):\n", - W_ERROR_V(failure->last_result), - win_errstr(failure->last_result)); - d_printf("\t\t\t%s\n", get_friendly_werror_msg(failure->last_result)); - } - - talloc_free(mem_ctx); - return true; -} - -/** - * 'net drs showrepl' command entry point - */ -int net_drs_showrepl_cmd(struct net_context *ctx, int argc, const char **argv) -{ - const char *dc_name; - struct net_drs_context *drs_ctx = NULL; - - /* only one arg expected */ - if (argc != 1) { - return net_drs_showrepl_usage(ctx, argc, argv); - } - - dc_name = argv[0]; - - if (!net_drs_create_context(ctx, dc_name, &drs_ctx)) { - goto failed; - } - - /* Print DC and Site info */ - if (!net_drs_showrepl_print_dc_info(drs_ctx)) { - goto failed; - } - - /* INBOUND Neighbors */ - if (!net_drs_showrepl_print_inbound_neihbors(drs_ctx)) { - goto failed; - } - - /* OUTBOUND Neighbors */ - if (!net_drs_showrepl_print_outbound_neihbors(drs_ctx)) { - goto failed; - } - - /* Connection objects for DC */ - if (!net_drs_showrepl_print_connection_objects(drs_ctx)) { - goto failed; - } - - /* Connection failures */ - if (!net_drs_showrepl_print_connect_failures(drs_ctx)) { - goto failed; - } - - /* Link failures */ - if (!net_drs_showrepl_print_link_failures(drs_ctx)) { - goto failed; - } - - talloc_free(drs_ctx); - return 0; - -failed: - talloc_free(drs_ctx); - return -1; -} - -/** - * 'net drs showrepl' usage - */ -int net_drs_showrepl_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net drs showrepl \n"); - return 0; -} diff --git a/source4/utils/net/net.c b/source4/utils/net/net.c deleted file mode 100644 index 95b70ef01d2..00000000000 --- a/source4/utils/net/net.c +++ /dev/null @@ -1,387 +0,0 @@ -/* - Samba Unix/Linux SMB client library - Distributed SMB/CIFS Server Management Utility - Copyright (C) 2001 Steve French (sfrench@us.ibm.com) - Copyright (C) 2001 Jim McDonough (jmcd@us.ibm.com) - Copyright (C) 2001 Andrew Tridgell (tridge@samba.org) - Copyright (C) 2001 Andrew Bartlett (abartlet@samba.org) - Copyright (C) 2004 Stefan Metzmacher (metze@samba.org) - Copyright (C) 2009 Jelmer Vernooij (jelmer@samba.org) - - Largely rewritten by metze in August 2004 - - Originally written by Steve and Jim. Largely rewritten by tridge in - November 2001. - - Reworked again by abartlet in December 2001 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -/*****************************************************/ -/* */ -/* Distributed SMB/CIFS Server Management Utility */ -/* */ -/* The intent was to make the syntax similar */ -/* to the NET utility (first developed in DOS */ -/* with additional interesting & useful functions */ -/* added in later SMB server network operating */ -/* systems). */ -/* */ -/*****************************************************/ - -#include -#include "includes.h" -#include "utils/net/net.h" -#include "lib/cmdline/popt_common.h" -#include "lib/ldb/include/ldb.h" -#include "librpc/rpc/dcerpc.h" -#include "param/param.h" -#include "lib/events/events.h" -#include "auth/credentials/credentials.h" -#include "scripting/python/modules.h" -#include "utils/net/drs/net_drs.h" - -/* There's no Py_ssize_t in 2.4, apparently */ -#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5 -typedef int Py_ssize_t; -#endif - -static PyObject *py_tuple_from_argv(int argc, const char *argv[]) -{ - PyObject *l; - Py_ssize_t i; - - l = PyTuple_New(argc); - if (l == NULL) { - return NULL; - } - - for (i = 0; i < argc; i++) { - PyTuple_SetItem(l, i, PyString_FromString(argv[i])); - } - - return l; -} - -static int py_call_with_string_args(PyObject *self, const char *method, int argc, const char *argv[]) -{ - PyObject *ret, *args, *py_method; - - args = py_tuple_from_argv(argc, argv); - if (args == NULL) { - PyErr_Print(); - return 1; - } - - py_method = PyObject_GetAttrString(self, method); - if (py_method == NULL) { - PyErr_Print(); - return 1; - } - - ret = PyObject_CallObject(py_method, args); - - Py_DECREF(args); - - if (ret == NULL) { - PyErr_Print(); - return 1; - } - - if (ret == Py_None) { - return 0; - } else if (PyInt_Check(ret)) { - return PyInt_AsLong(ret); - } else { - fprintf(stderr, "Function return value type unexpected.\n"); - return -1; - } -} - -static PyObject *py_commands(void) -{ - PyObject *netcmd_module, *py_cmds; - netcmd_module = PyImport_ImportModule("samba.netcmd"); - if (netcmd_module == NULL) { - PyErr_Print(); - return NULL; - } - - py_cmds = PyObject_GetAttrString(netcmd_module, "commands"); - if (py_cmds == NULL) { - PyErr_Print(); - return NULL; - } - - if (!PyDict_Check(py_cmds)) { - d_printf("Python net commands is not a dictionary\n"); - return NULL; - } - - return py_cmds; -} - -/* - run a function from a function table. If not found then - call the specified usage function -*/ -int net_run_function(struct net_context *ctx, - int argc, const char **argv, - const struct net_functable *functable, - int (*usage_fn)(struct net_context *ctx, int argc, const char **argv)) -{ - int i; - - if (argc == 0) { - return usage_fn(ctx, argc, argv); - - } else if (argc == 1 && strequal(argv[0], "help")) { - return net_help(ctx, functable); - } - - for (i=0; functable[i].name; i++) { - if (strcasecmp_m(argv[0], functable[i].name) == 0) - return functable[i].fn(ctx, argc-1, argv+1); - } - - d_printf("No command: '%s'\n", argv[0]); - return usage_fn(ctx, argc, argv); -} - -/* - run a usage function from a function table. If not found then fail -*/ -int net_run_usage(struct net_context *ctx, - int argc, const char **argv, - const struct net_functable *functable) -{ - int i; - PyObject *py_cmds, *py_cmd; - - for (i=0; functable[i].name; i++) { - if (strcasecmp_m(argv[0], functable[i].name) == 0) - if (functable[i].usage) { - return functable[i].usage(ctx, argc-1, argv+1); - } - } - - py_cmds = py_commands(); - if (py_cmds == NULL) { - return 1; - } - - py_cmd = PyDict_GetItemString(py_cmds, argv[0]); - if (py_cmd != NULL) { - return py_call_with_string_args(py_cmd, "usage", argc-1, - argv+1); - } - - d_printf("No usage information for command: %s\n", argv[0]); - - return 1; -} - - -/* main function table */ -static const struct net_functable net_functable[] = { - {"password", "Changes/Sets the password on a user account [server connection needed]\n", net_password, net_password_usage}, - {"samdump", "dump the sam of a domain\n", net_samdump, net_samdump_usage}, - {"samsync", "synchronise into the local ldb the sam of an NT4 domain\n", net_samsync_ldb, net_samsync_ldb_usage}, - {"drs", "Implements functionality offered by repadmin.exe utility in Windows\n", net_drs, net_drs_usage}, - {"gpo", "Administer group policies\n", net_gpo, net_gpo_usage}, - {NULL, NULL, NULL, NULL} -}; - -static int net_help_builtin(const struct net_functable *ftable) -{ - int i = 0; - const char *name = ftable[i].name; - const char *desc = ftable[i].desc; - - while (name && desc) { - if (strlen(name) > 7) { - d_printf("\t%s\t%s", name, desc); - } else { - d_printf("\t%s\t\t%s", name, desc); - } - name = ftable[++i].name; - desc = ftable[i].desc; - } - return 0; -} - -static int net_help_python(void) -{ - PyObject *py_cmds; - PyObject *key, *value; - Py_ssize_t pos = 0; - - py_cmds = py_commands(); - if (py_cmds == NULL) { - return 1; - } - - while (PyDict_Next(py_cmds, &pos, &key, &value)) { - char *name, *desc; - PyObject *py_desc; - if (!PyString_Check(key)) { - d_printf("Command name not a string\n"); - return 1; - } - name = PyString_AsString(key); - py_desc = PyObject_GetAttrString(value, "description"); - if (py_desc == NULL) { - PyErr_Print(); - return 1; - } - if (!PyString_Check(py_desc)) { - d_printf("Command description for %s not a string\n", - name); - return 1; - } - desc = PyString_AsString(py_desc); - if (strlen(name) > 7) { - d_printf("\t%s\t%s\n", name, desc); - } else { - d_printf("\t%s\t\t%s\n", name, desc); - } - } - return 0; -} - -int net_help(struct net_context *ctx, const struct net_functable *ftable) -{ - d_printf("Available commands:\n"); - net_help_builtin(ftable); - net_help_python(); - return 0; -} - -static int net_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Usage:\n"); - d_printf("net [options]\n"); - net_help(ctx, net_functable); - return -1; -} - -/**************************************************************************** - main program -****************************************************************************/ -static int binary_net(int argc, const char **argv) -{ - int opt,i; - int rc; - int argc_new; - PyObject *py_cmds, *py_cmd; - const char **argv_new; - struct tevent_context *ev; - struct net_context *ctx = NULL; - poptContext pc; - struct poptOption long_options[] = { - POPT_AUTOHELP - POPT_COMMON_SAMBA - POPT_COMMON_CONNECTION - POPT_COMMON_CREDENTIALS - POPT_COMMON_VERSION - { NULL } - }; - - setlinebuf(stdout); - - dcerpc_init(cmdline_lp_ctx); - - ev = s4_event_context_init(NULL); - if (!ev) { - d_printf("Failed to create an event context\n"); - exit(1); - } - Py_Initialize(); - PySys_SetArgv(argc, discard_const_p(char *, argv)); - py_update_path("bin"); /* FIXME: Can't assume this is always the case */ - - py_cmds = py_commands(); - if (py_cmds == NULL) { - return 1; - } - - for (i=1; ilp_ctx = cmdline_lp_ctx; - ctx->credentials = cmdline_credentials; - ctx->event_ctx = ev; - - - - rc = net_run_function(ctx, argc_new-1, argv_new+1, net_functable, - net_usage); - - if (rc != 0) { - DEBUG(0,("return code = %d\n", rc)); - } - - talloc_free(ev); - return rc; -} - - int main(int argc, const char **argv) -{ - return binary_net(argc, argv); -} diff --git a/source4/utils/net/net.h b/source4/utils/net/net.h deleted file mode 100644 index 16223a15bb9..00000000000 --- a/source4/utils/net/net.h +++ /dev/null @@ -1,39 +0,0 @@ -/* - Samba Unix/Linux SMB client library - Distributed SMB/CIFS Server Management Utility - - Copyright (C) Stefan Metzmacher 2004 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#ifndef _UTIL_NET_H -#define _UTIL_NET_H - -struct net_context { - struct cli_credentials *credentials; - struct loadparm_context *lp_ctx; - struct tevent_context *event_ctx; -}; - -struct net_functable { - const char *name; - const char *desc; - int (*fn)(struct net_context *ctx, int argc, const char **argv); - int (*usage)(struct net_context *ctx, int argc, const char **argv); -}; - -#include "utils/net/net_proto.h" - -#endif /* _UTIL_NET_H */ diff --git a/source4/utils/net/net_gpo.c b/source4/utils/net/net_gpo.c deleted file mode 100644 index 6cddd975088..00000000000 --- a/source4/utils/net/net_gpo.c +++ /dev/null @@ -1,618 +0,0 @@ -/* - Samba Unix/Linux SMB client library - net ads commands for Group Policy - - Copyright (C) 2005-2008 Guenther Deschner - Copyright (C) 2009 Wilco Baan Hofman - - Based on Guenther's work in net_ads_gpo.h (samba 3) - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "utils/net/net.h" -#include "lib/ldb/include/ldb.h" -#include "auth/auth.h" -#include "param/param.h" -#include "libcli/security/sddl.h" -#include "dsdb/samdb/samdb.h" -#include "dsdb/common/util.h" -#include "lib/policy/policy.h" - -static int net_gpo_list_all_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo listall [options]\n"); - d_printf("For a list of available options, please type net gpo listall --help\n"); - return 0; -} - -static int net_gpo_list_all(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - struct gp_object **gpo; - const char **gpo_flags; - unsigned int i, j; - NTSTATUS rv; - - rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); - return 1; - } - - rv = gp_list_all_gpos(gp_ctx, &gpo); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to list all GPO's: %s\n", get_friendly_nt_error_msg(rv))); - talloc_free(gp_ctx); - return 1; - } - - for (i = 0; gpo[i] != NULL; i++) { - gp_get_gpo_flags(gp_ctx, gpo[i]->flags, &gpo_flags); - - d_printf("GPO : %s\n", gpo[i]->name); - d_printf("display name : %s\n", gpo[i]->display_name); - d_printf("path : %s\n", gpo[i]->file_sys_path); - d_printf("dn : %s\n", gpo[i]->dn); - d_printf("version : %d\n", gpo[i]->version); - if (gpo_flags[0] == NULL) { - d_printf("flags : NONE\n"); - } else { - d_printf("flags : %s\n", gpo_flags[0]); - for (j = 1; gpo_flags[j] != NULL; j++) { - d_printf(" %s\n", gpo_flags[i]); - } - } - d_printf("\n"); - talloc_free(gpo_flags); - } - talloc_free(gp_ctx); - - return 0; -} - -static int net_gpo_get_gpo_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo show [options]\n"); - d_printf("For a list of available options, please type net gpo show --help\n"); - return 0; -} - -static int net_gpo_get_gpo(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - struct gp_object *gpo; - const char **gpo_flags; - char *sddl; - int i; - NTSTATUS rv; - - if (argc != 1) { - return net_gpo_get_gpo_usage(ctx, argc, argv); - } - - - rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); - return 1; - } - - rv = gp_get_gpo_info(gp_ctx, argv[0], &gpo); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to get GPO: %s\n", get_friendly_nt_error_msg(rv))); - talloc_free(gp_ctx); - return 1; - } - - gp_get_gpo_flags(gp_ctx, gpo->flags, &gpo_flags); - - d_printf("GPO : %s\n", gpo->name); - d_printf("display name : %s\n", gpo->display_name); - d_printf("path : %s\n", gpo->file_sys_path); - d_printf("dn : %s\n", gpo->dn); - d_printf("version : %d\n", gpo->version); - if (gpo_flags[0] == NULL) { - d_printf("flags : NONE\n"); - } else { - d_printf("flags : %s\n", gpo_flags[0]); - for (i = 1; gpo_flags[i] != NULL; i++) { - d_printf(" %s\n", gpo_flags[i]); - } - } - sddl = sddl_encode(gp_ctx, gpo->security_descriptor, samdb_domain_sid(gp_ctx->ldb_ctx)); - if (sddl != NULL) { - d_printf("ACL : %s\n", sddl); - } - - d_printf("\n"); - - talloc_free(gp_ctx); - return 0; -} - -static int net_gpo_link_get_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo getlink [options]\n"); - d_printf("For a list of available options, please type net gpo getlink --help\n"); - return 0; -} - -static int net_gpo_link_get(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - struct gp_link **links; - NTSTATUS rv; - unsigned int i,j; - const char **options; - - if (argc != 1) { - return net_gpo_link_get_usage(ctx, argc, argv); - } - - rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); - return 1; - } - - rv = gp_get_gplinks(gp_ctx, argv[0], &links); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to get gplinks: %s\n", get_friendly_nt_error_msg(rv))); - talloc_free(gp_ctx); - return 1; - } - - for (i = 0; links[i] != NULL; i++) { - gp_get_gplink_options(gp_ctx, links[i]->options, &options); - - d_printf("GPO DN : %s\n", links[i]->dn); - if (options[0] == NULL) { - d_printf("Options : NONE\n"); - } else { - d_printf("Options : %s\n", options[0]); - for (j = 1; options[j] != NULL; j++) { - d_printf(" : %s\n", options[j]); - } - } - d_printf("\n"); - - talloc_free(options); - } - - talloc_free(gp_ctx); - - return 0; -} - -static int net_gpo_list_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo list [options]\n"); - d_printf("For a list of available options, please type net gpo list --help\n"); - return 0; -} - -static int net_gpo_list(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - struct ldb_result *result; - struct auth_serversupplied_info *server_info; - struct auth_session_info *session_info; - DATA_BLOB dummy = { NULL, 0 }; - const char **gpos; - NTSTATUS status; - int rv; - unsigned int i; - struct auth_context *auth_context; - - if (argc != 1) { - return net_gpo_list_usage(ctx, argc, argv); - } - - status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); - return 1; - } - - /* Find the user in the directory. We need extended DN's for group expansion - * in authsam_make_server_info */ - rv = dsdb_search(gp_ctx->ldb_ctx, - gp_ctx, - &result, - ldb_get_default_basedn(gp_ctx->ldb_ctx), - LDB_SCOPE_SUBTREE, - NULL, - DSDB_SEARCH_SHOW_EXTENDED_DN, - "(&(objectClass=user)(sAMAccountName=%s))", argv[0]); - if (rv != LDB_SUCCESS) { - DEBUG(0, ("LDB search failed: %s\n%s\n", ldb_strerror(rv),ldb_errstring(gp_ctx->ldb_ctx))); - talloc_free(gp_ctx); - return 1; - } - - /* We expect exactly one record */ - if (result->count != 1) { - DEBUG(0, ("Could not find SAM account with name %s\n", argv[0])); - talloc_free(gp_ctx); - return 1; - } - - /* We need the server info, as this will contain the groups of this - * user, needed for a token */ - status = authsam_make_server_info(gp_ctx, - gp_ctx->ldb_ctx, - lpcfg_netbios_name(gp_ctx->lp_ctx), - lpcfg_sam_name(gp_ctx->lp_ctx), - ldb_get_default_basedn(gp_ctx->ldb_ctx), - result->msgs[0], - dummy, - dummy, - &server_info); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to make server information: %s\n", get_friendly_nt_error_msg(status))); - talloc_free(gp_ctx); - return 1; - } - - /* We do now need an auth context to create a session */ - status = auth_context_create_from_ldb(gp_ctx, gp_ctx->ldb_ctx, &auth_context); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to get an auth context: %s\n", get_friendly_nt_error_msg(status))); - talloc_free(gp_ctx); - return 1; - } - - /* The session info will contain the security token for this user */ - status = auth_generate_session_info(gp_ctx, auth_context, server_info, 0, &session_info); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to generate session information: %s\n", get_friendly_nt_error_msg(status))); - talloc_free(gp_ctx); - return 1; - } - - status = gp_list_gpos(gp_ctx, session_info->security_token, &gpos); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to list gpos for user %s: %s\n", argv[0], - get_friendly_nt_error_msg(status))); - talloc_free(gp_ctx); - return 1; - } - - d_printf("GPO's for user %s:\n", argv[0]); - for (i = 0; gpos[i] != NULL; i++) { - d_printf("\t%s\n", gpos[i]); - } - - talloc_free(gp_ctx); - return 0; -} - -static int net_gpo_link_set_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo setlink ['disable'] ['enforce'] [options]\n"); - d_printf("For a list of available options, please type net gpo setlink --help\n"); - return 0; -} - -static int net_gpo_link_set(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_link *gplink = talloc_zero(ctx, struct gp_link); - struct gp_context *gp_ctx; - unsigned int i; - NTSTATUS status; - - if (argc < 2) { - return net_gpo_link_set_usage(ctx, argc, argv); - } - - if (argc >= 3) { - for (i = 2; i < argc; i++) { - if (strcmp(argv[i], "disable") == 0) { - gplink->options |= GPLINK_OPT_DISABLE; - } - if (strcmp(argv[i], "enforce") == 0) { - gplink->options |= GPLINK_OPT_ENFORCE; - } - } - } - gplink->dn = argv[1]; - - status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); - return 1; - } - - status = gp_set_gplink(gp_ctx, argv[0], gplink); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status))); - return 1; - } - d_printf("Set link on container.\nCurrent Group Policy links:\n"); - - /* Display current links */ - net_gpo_link_get(ctx, 1, argv); - - talloc_free(gp_ctx); - return 0; -} - -static int net_gpo_link_del_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo dellink [options]\n"); - d_printf("For a list of available options, please type net gpo dellink --help\n"); - return 0; -} - -static int net_gpo_link_del(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - NTSTATUS status; - - if (argc != 2) { - return net_gpo_link_del_usage(ctx, argc, argv); - } - - status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); - return 1; - } - - status = gp_del_gplink(gp_ctx, argv[0], argv[1]); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to delete gplink: %s\n", get_friendly_nt_error_msg(status))); - talloc_free(gp_ctx); - return 1; - } - d_printf("Deleted gplink.\nCurrent Group Policy links:\n\n"); - - /* Display current links */ - net_gpo_link_get(ctx, 1, argv); - - talloc_free(gp_ctx); - return 0; -} - -static int net_gpo_inheritance_get_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo getinheritance [options]\n"); - d_printf("For a list of available options, please type net gpo getinheritance --help\n"); - return 0; -} - -static int net_gpo_inheritance_get(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - enum gpo_inheritance inheritance; - NTSTATUS status; - - if (argc != 1) { - return net_gpo_inheritance_get_usage(ctx, argc, argv); - } - - status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); - return 1; - } - - status = gp_get_inheritance(gp_ctx, argv[0], &inheritance); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status))); - talloc_free(gp_ctx); - return 1; - } - - if (inheritance == GPO_BLOCK_INHERITANCE) { - d_printf("container has GPO_BLOCK_INHERITANCE\n"); - } else { - d_printf("container has GPO_INHERIT\n"); - } - - talloc_free(gp_ctx); - return 0; -} - -static int net_gpo_inheritance_set_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo setinheritance <\"block\"|\"inherit\"> [options]\n"); - d_printf("For a list of available options, please type net gpo setinheritance --help\n"); - return 0; -} - -static int net_gpo_inheritance_set(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - enum gpo_inheritance inheritance; - NTSTATUS status; - - if (argc != 2) { - return net_gpo_inheritance_set_usage(ctx, argc, argv); - } - - if (strcmp(argv[1], "inherit") == 0) { - inheritance = GPO_INHERIT; - } else if (strcmp(argv[1], "block") == 0) { - inheritance = GPO_BLOCK_INHERITANCE; - } else { - return net_gpo_inheritance_set_usage(ctx, argc, argv); - } - - status = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(status))); - return 1; - } - - status = gp_set_inheritance(gp_ctx, argv[0], inheritance); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0, ("Failed to set GPO link on container: %s\n", get_friendly_nt_error_msg(status))); - talloc_free(gp_ctx); - return 1; - } - - /* Display current links */ - net_gpo_inheritance_get(ctx, 1, argv); - - return 0; -} - -static int net_gpo_fetch_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo fetch [options]\n"); - d_printf("For a list of available options, please type net gpo fetch --help\n"); - return 0; -} - -static int net_gpo_fetch(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - struct gp_object *gpo; - const char *path; - NTSTATUS rv; - - if (argc != 1) { - return net_gpo_fetch_usage(ctx, argc, argv); - } - - rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); - return 1; - } - - rv = gp_get_gpo_info(gp_ctx, argv[0], &gpo); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to get GPO: %s\n", get_friendly_nt_error_msg(rv))); - talloc_free(gp_ctx); - return 1; - } - - rv = gp_fetch_gpt(gp_ctx, gpo, &path); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to fetch GPO: %s\n", get_friendly_nt_error_msg(rv))); - talloc_free(gp_ctx); - return 1; - } - d_printf("%s\n", path); - - return 0; -} -static int net_gpo_create_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo create [options]\n"); - d_printf("For a list of available options, please type net gpo create --help\n"); - return 0; -} - -static int net_gpo_create(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - struct gp_object *gpo; - NTSTATUS rv; - - if (argc != 1) { - return net_gpo_create_usage(ctx, argc, argv); - } - - rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); - return 1; - } - - rv = gp_create_gpo(gp_ctx, argv[0], &gpo); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to create GPO: %s\n", get_friendly_nt_error_msg(rv))); - talloc_free(gp_ctx); - return 1; - } - - - return 0; -} - -static int net_gpo_set_acl_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo setacl [options]\n"); - d_printf("For a list of available options, please type net gpo setacl --help\n"); - return 0; -} - -static int net_gpo_set_acl(struct net_context *ctx, int argc, const char **argv) -{ - struct gp_context *gp_ctx; - struct security_descriptor *sd; - NTSTATUS rv; - - if (argc != 2) { - return net_gpo_set_acl_usage(ctx, argc, argv); - } - - rv = gp_init(ctx, ctx->lp_ctx, ctx->credentials, ctx->event_ctx, &gp_ctx); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to connect to DC's LDAP: %s\n", get_friendly_nt_error_msg(rv))); - return 1; - } - - /* Convert sddl to security descriptor */ - sd = sddl_decode(gp_ctx, argv[1], samdb_domain_sid(gp_ctx->ldb_ctx)); - if (sd == NULL) { - DEBUG(0, ("Invalid SDDL\n")); - talloc_free(gp_ctx); - return 1; - } - - rv = gp_set_acl(gp_ctx, argv[0], sd); - if (!NT_STATUS_IS_OK(rv)) { - DEBUG(0, ("Failed to set ACL on GPO: %s\n", get_friendly_nt_error_msg(rv))); - talloc_free(gp_ctx); - return 1; - } - - talloc_free(gp_ctx); - return 0; -} - - - -static const struct net_functable net_gpo_functable[] = { - { "listall", "List all GPO's on a DC\n", net_gpo_list_all, net_gpo_list_all_usage }, - { "list", "List all active GPO's for a machine/user\n", net_gpo_list, net_gpo_list_usage }, - { "show", "Show information for a GPO\n", net_gpo_get_gpo, net_gpo_get_gpo_usage }, - { "getlink", "List gPLink of container\n", net_gpo_link_get, net_gpo_link_get_usage }, - { "setlink", "Link a GPO to a container\n", net_gpo_link_set, net_gpo_link_set_usage }, - { "dellink", "Delete GPO link from a container\n", net_gpo_link_del, net_gpo_link_del_usage }, - { "getinheritance", "Get inheritance flag from a container\n", net_gpo_inheritance_get, net_gpo_inheritance_get_usage }, - { "setinheritance", "Set inheritance flag on a container\n", net_gpo_inheritance_set, net_gpo_inheritance_set_usage }, - { "fetch", "Download a GPO\n", net_gpo_fetch, net_gpo_fetch_usage }, - { "create", "Create a GPO\n", net_gpo_create, net_gpo_create_usage }, - { "setacl", "Set ACL on a GPO\n", net_gpo_set_acl, net_gpo_set_acl_usage }, - { NULL, NULL } -}; - -int net_gpo_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Syntax: net gpo [options]\n"); - d_printf("For available commands, please type net gpo help\n"); - return 0; -} - -int net_gpo(struct net_context *ctx, int argc, const char **argv) -{ - return net_run_function(ctx, argc, argv, net_gpo_functable, net_gpo_usage); -} diff --git a/source4/utils/net/net_password.c b/source4/utils/net/net_password.c deleted file mode 100644 index 55f7c3c31d6..00000000000 --- a/source4/utils/net/net_password.c +++ /dev/null @@ -1,171 +0,0 @@ -/* - Samba Unix/Linux SMB client library - Distributed SMB/CIFS Server Management Utility - - Copyright (C) 2004 Stefan Metzmacher (metze@samba.org) - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "utils/net/net.h" -#include "libnet/libnet.h" -#include "system/filesys.h" -#include "lib/events/events.h" -#include "auth/credentials/credentials.h" - -/* - * Code for Changing and setting a password - */ - -static int net_password_change_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net_password_change_usage: TODO\n"); - return 0; -} - - -static int net_password_change(struct net_context *ctx, int argc, const char **argv) -{ - NTSTATUS status; - struct libnet_context *libnetctx; - union libnet_ChangePassword r; - char *password_prompt = NULL; - const char *new_password; - - if (argc > 0 && argv[0]) { - new_password = argv[0]; - } else { - password_prompt = talloc_asprintf(ctx, "Enter new password for account [%s\\%s]:", - cli_credentials_get_domain(ctx->credentials), - cli_credentials_get_username(ctx->credentials)); - new_password = getpass(password_prompt); - } - - libnetctx = libnet_context_init(ctx->event_ctx, ctx->lp_ctx); - if (!libnetctx) { - return -1; - } - libnetctx->cred = ctx->credentials; - - /* prepare password change */ - r.generic.level = LIBNET_CHANGE_PASSWORD_GENERIC; - r.generic.in.account_name = cli_credentials_get_username(ctx->credentials); - r.generic.in.domain_name = cli_credentials_get_domain(ctx->credentials); - r.generic.in.oldpassword = cli_credentials_get_password(ctx->credentials); - r.generic.in.newpassword = new_password; - - /* do password change */ - status = libnet_ChangePassword(libnetctx, ctx, &r); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0,("net_password_change: %s\n",r.generic.out.error_string)); - return -1; - } - - talloc_free(libnetctx); - - return 0; -} - - -static int net_password_set_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net_password_set_usage: TODO\n"); - return 0; -} - - -static int net_password_set(struct net_context *ctx, int argc, const char **argv) -{ - NTSTATUS status; - struct libnet_context *libnetctx; - union libnet_SetPassword r; - char *password_prompt = NULL; - char *p; - char *tmp; - const char *account_name; - const char *domain_name; - const char *new_password = NULL; - - switch (argc) { - case 0: /* no args -> fail */ - return net_password_set_usage(ctx, argc, argv); - case 1: /* only DOM\\user; prompt for password */ - tmp = talloc_strdup(ctx, argv[0]); - break; - case 2: /* DOM\\USER and password */ - tmp = talloc_strdup(ctx, argv[0]); - new_password = argv[1]; - break; - default: /* too mayn args -> fail */ - DEBUG(0,("net_password_set: too many args [%d]\n",argc)); - return net_password_usage(ctx, argc, argv); - } - - if ((p = strchr_m(tmp,'\\'))) { - *p = 0; - domain_name = tmp; - account_name = talloc_strdup(ctx, p+1); - } else { - account_name = tmp; - domain_name = cli_credentials_get_domain(ctx->credentials); - } - - if (!new_password) { - password_prompt = talloc_asprintf(ctx, "Enter new password for account [%s\\%s]:", - domain_name, account_name); - new_password = getpass(password_prompt); - } - - libnetctx = libnet_context_init(ctx->event_ctx, ctx->lp_ctx); - if (!libnetctx) { - return -1; - } - libnetctx->cred = ctx->credentials; - - /* prepare password change */ - r.generic.level = LIBNET_SET_PASSWORD_GENERIC; - r.generic.in.account_name = account_name; - r.generic.in.domain_name = domain_name; - r.generic.in.newpassword = new_password; - - /* do password change */ - status = libnet_SetPassword(libnetctx, ctx, &r); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0,("net_password_set: %s\n",r.generic.out.error_string)); - return -1; - } - - talloc_free(libnetctx); - - return 0; -} - - -static const struct net_functable net_password_functable[] = { - {"change", "change password (old password required)\n", net_password_change, net_password_change_usage }, - {"set", "set password\n", net_password_set, net_password_set_usage }, - {NULL, NULL} -}; - -int net_password(struct net_context *ctx, int argc, const char **argv) -{ - return net_run_function(ctx, argc, argv, net_password_functable, net_password_usage); -} - -int net_password_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net password [options]\n"); - return 0; -} diff --git a/source4/utils/net/net_vampire.c b/source4/utils/net/net_vampire.c deleted file mode 100644 index c113ad70019..00000000000 --- a/source4/utils/net/net_vampire.c +++ /dev/null @@ -1,130 +0,0 @@ -/* - Samba Unix/Linux SMB client library - Distributed SMB/CIFS Server Management Utility - - Copyright (C) 2004 Stefan Metzmacher - Copyright (C) 2005 Andrew Bartlett - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . -*/ - -#include "includes.h" -#include "utils/net/net.h" -#include "libnet/libnet.h" -#include "librpc/gen_ndr/samr.h" -#include "auth/auth.h" -#include "libcli/security/security.h" -#include "param/param.h" -#include "lib/events/events.h" - -/* main function table */ -static const struct net_functable net_samdump_functable[] = { - {NULL, NULL, NULL, NULL} -}; - -int net_samdump(struct net_context *ctx, int argc, const char **argv) -{ - NTSTATUS status; - struct libnet_context *libnetctx; - struct libnet_SamDump r; - int rc; - - switch (argc) { - case 0: - break; - case 1: - default: - rc = net_run_function(ctx, argc, argv, net_samdump_functable, - net_samdump_usage); - return rc; - } - - libnetctx = libnet_context_init(ctx->event_ctx, ctx->lp_ctx); - if (!libnetctx) { - return -1; - } - libnetctx->cred = ctx->credentials; - - r.out.error_string = NULL; - r.in.machine_account = NULL; - r.in.binding_string = NULL; - - status = libnet_SamDump(libnetctx, ctx, &r); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0,("libnet_SamDump returned %s: %s\n", - nt_errstr(status), - r.out.error_string)); - return -1; - } - - talloc_free(libnetctx); - - return 0; -} - -int net_samdump_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net samdump\n"); - return 0; -} - -int net_samdump_help(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Dumps the sam of the domain we are joined to.\n"); - return 0; -} - -int net_samsync_ldb(struct net_context *ctx, int argc, const char **argv) -{ - NTSTATUS status; - struct libnet_context *libnetctx; - struct libnet_samsync_ldb r; - - libnetctx = libnet_context_init(ctx->event_ctx, ctx->lp_ctx); - if (!libnetctx) { - return -1; - } - libnetctx->cred = ctx->credentials; - - r.out.error_string = NULL; - r.in.machine_account = NULL; - r.in.binding_string = NULL; - - /* Needed to override the ACLs on ldb */ - r.in.session_info = system_session(ctx->lp_ctx); - - status = libnet_samsync_ldb(libnetctx, libnetctx, &r); - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0,("libnet_samsync_ldb returned %s: %s\n", - nt_errstr(status), - r.out.error_string)); - return -1; - } - - talloc_free(libnetctx); - - return 0; -} - -int net_samsync_ldb_usage(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("net samsync\n"); - return 0; -} - -int net_samsync_ldb_help(struct net_context *ctx, int argc, const char **argv) -{ - d_printf("Synchronise into the local ldb the SAM of a domain.\n"); - return 0; -} diff --git a/source4/utils/net/wscript_build b/source4/utils/net/wscript_build deleted file mode 100644 index 48c766336dd..00000000000 --- a/source4/utils/net/wscript_build +++ /dev/null @@ -1,18 +0,0 @@ -#!/usr/bin/env python - -bld.SAMBA_MODULE('net_drs', - source='drs/net_drs.c drs/net_drs_bind.c drs/net_drs_kcc.c drs/net_drs_replicate.c drs/net_drs_showrepl.c', - autoproto='drs/net_drs_proto.h', - subsystem='net', - deps='LIBCLI_DRSUAPI ldb LDBSAMBA', - internal_module=True - ) - - -bld.SAMBA_BINARY('net', - source='net.c net_password.c net_vampire.c net_gpo.c', - autoproto='net_proto.h', - deps='samba-hostconfig samba-util samba-net popt POPT_SAMBA POPT_CREDENTIALS net_drs policy auth', - pyembed=True - ) - diff --git a/source4/utils/tests/test_net.sh b/source4/utils/tests/test_net.sh deleted file mode 100755 index 09394f41be7..00000000000 --- a/source4/utils/tests/test_net.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/sh -# Blackbox tests for net - -SERVER=$1 -USERNAME=$2 -PASSWORD=$3 -DOMAIN=$4 -shift 4 - -failed=0 - -samba4bindir="$BUILDDIR/bin" -smbclient="$samba4bindir/smbclient$EXEEXT" -net="$samba4bindir/net$EXEEXT" - -testit() { - name="$1" - shift - cmdline="$*" - echo "test: $name" - $cmdline - status=$? - if [ x$status = x0 ]; then - echo "success: $name" - else - echo "failure: $name" - failed=`expr $failed + 1` - fi - return $status -} - -testit "Test login with --machine-pass without kerberos" $VALGRIND $smbclient -c 'ls' $CONFIGURATION //$SERVER/tmp --machine-pass -k no - -testit "Test login with --machine-pass and kerberos" $VALGRIND $smbclient -c 'ls' $CONFIGURATION //$SERVER/tmp --machine-pass -k yes - -testit "time" $VALGRIND $net time $SERVER $CONFIGURATION -W "$DOMAIN" -U"$USERNAME%$PASSWORD" $@ - -# FIXME: testit "domainlevel.show" $VALGRIND $net domainlevel show $CONFIGURATION - -exit $failed diff --git a/source4/utils/tests/test_samba_tool.sh b/source4/utils/tests/test_samba_tool.sh new file mode 100755 index 00000000000..0fb4c2afa85 --- /dev/null +++ b/source4/utils/tests/test_samba_tool.sh @@ -0,0 +1,40 @@ +#!/bin/sh +# Blackbox tests for samba-tool + +SERVER=$1 +USERNAME=$2 +PASSWORD=$3 +DOMAIN=$4 +shift 4 + +failed=0 + +samba4bindir="$BUILDDIR/bin" +smbclient="$samba4bindir/smbclient$EXEEXT" +samba_tool="$samba4bindir/samba-tool$EXEEXT" + +testit() { + name="$1" + shift + cmdline="$*" + echo "test: $name" + $cmdline + status=$? + if [ x$status = x0 ]; then + echo "success: $name" + else + echo "failure: $name" + failed=`expr $failed + 1` + fi + return $status +} + +testit "Test login with --machine-pass without kerberos" $VALGRIND $smbclient -c 'ls' $CONFIGURATION //$SERVER/tmp --machine-pass -k no + +testit "Test login with --machine-pass and kerberos" $VALGRIND $smbclient -c 'ls' $CONFIGURATION //$SERVER/tmp --machine-pass -k yes + +testit "time" $VALGRIND $samba_tool time $SERVER $CONFIGURATION -W "$DOMAIN" -U"$USERNAME%$PASSWORD" $@ + +# FIXME: testit "domainlevel.show" $VALGRIND $samba_tool domainlevel show $CONFIGURATION + +exit $failed diff --git a/source4/wscript_build b/source4/wscript_build index 80675c9895b..9b22132940c 100644 --- a/source4/wscript_build +++ b/source4/wscript_build @@ -64,7 +64,7 @@ bld.RECURSE('nbt_server') bld.RECURSE('wrepl_server') bld.RECURSE('cldap_server') bld.RECURSE('ntp_signd') -bld.RECURSE('utils/net') +bld.RECURSE('samba_tool') bld.RECURSE('utils') bld.RECURSE('ntvfs') bld.RECURSE('ntptr') -- cgit v1.2.1