2096 lines
48 KiB
C
2096 lines
48 KiB
C
/*++
|
|
|
|
Copyright (c) 1997 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
setutl.c
|
|
|
|
Abstract:
|
|
|
|
Miscellaneous helper functions
|
|
|
|
Author:
|
|
|
|
Mac McLain (MacM) Feb 10, 1997
|
|
|
|
Environment:
|
|
|
|
User Mode
|
|
|
|
Revision History:
|
|
|
|
--*/
|
|
#include <setpch.h>
|
|
#include <dssetp.h>
|
|
#include <lsarpc.h>
|
|
#include <samrpc.h>
|
|
#include <samisrv.h>
|
|
#include <db.h>
|
|
#include <confname.h>
|
|
#include <loadfn.h>
|
|
#include <ntdsa.h>
|
|
#include <dsconfig.h>
|
|
#include <attids.h>
|
|
#include <samisrv.h>
|
|
#include <dsp.h>
|
|
#include <lsaisrv.h>
|
|
#include <malloc.h>
|
|
#include <dsgetdc.h>
|
|
#include <lmcons.h>
|
|
#include <lmaccess.h>
|
|
#include <lmapibuf.h>
|
|
#include <lmerr.h>
|
|
#include <netsetp.h>
|
|
#include <winsock2.h>
|
|
#include <nspapi.h>
|
|
#include <dsgetdcp.h>
|
|
#include <lmremutl.h>
|
|
#include <spmgr.h> // For SetupPhase definition
|
|
#include <ntdsetup.h>
|
|
#include <shlwapi.h>
|
|
|
|
#include "secure.h"
|
|
#include "cancel.h"
|
|
|
|
#if DBG
|
|
DEFINE_DEBUG2(DsRole);
|
|
|
|
DEBUG_KEY DsRoleDebugKeys[] = {
|
|
{DEB_ERROR, "Error"},
|
|
{DEB_WARN, "Warn"},
|
|
{DEB_TRACE, "Trace"},
|
|
{DEB_TRACE_DS, "NtDs"},
|
|
{DEB_TRACE_UPDATE, "Update"},
|
|
{DEB_TRACE_LOCK, "Lock"},
|
|
{DEB_TRACE_SERVICES,"Services"},
|
|
{DEB_TRACE_NET, "Net"},
|
|
{0, NULL }
|
|
};
|
|
|
|
VOID
|
|
DsRoleDebugInitialize()
|
|
{
|
|
DsRoleInitDebug(DsRoleDebugKeys);
|
|
}
|
|
|
|
#endif // DBG
|
|
|
|
|
|
BOOL
|
|
DsRolepShutdownNotification(
|
|
DWORD dwCtrlType
|
|
);
|
|
|
|
|
|
//
|
|
// Global data for this module
|
|
//
|
|
BOOLEAN GlobalOpLockHeld = FALSE;
|
|
|
|
|
|
|
|
NTSTATUS
|
|
DsRolepInitialize(
|
|
VOID
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Initializes the server portion of the DsRole APIs. Called from LsaSrv
|
|
DsRolerGetDcOperationProgress return init
|
|
|
|
Arguments:
|
|
|
|
VOID
|
|
|
|
|
|
Returns:
|
|
|
|
STATUS_SUCCESS - Success
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
RPC_STATUS RPCError = RPC_S_OK;
|
|
PWSTR KerbPrinc;
|
|
|
|
//
|
|
// Zero out global operation handle
|
|
//
|
|
RtlZeroMemory( &DsRolepCurrentOperationHandle, sizeof(DsRolepCurrentOperationHandle));
|
|
|
|
//
|
|
// Init the lock
|
|
//
|
|
RtlInitializeResource( &DsRolepCurrentOperationHandle.CurrentOpLock );
|
|
|
|
|
|
//
|
|
// Grab the lock
|
|
//
|
|
LockOpHandle();
|
|
GlobalOpLockHeld = TRUE;
|
|
|
|
DsRolepResetOperationHandleLockHeld();
|
|
|
|
DsRoleDebugInitialize();
|
|
|
|
RPCError = RpcServerRegisterIf( dssetup_ServerIfHandle,
|
|
NULL,
|
|
NULL );
|
|
if (RPC_S_OK != RPCError) {
|
|
DsRoleDebugOut(( DEB_ERROR,
|
|
"RpcServerRegisterIf failed %d\n",
|
|
RPCError ));
|
|
}
|
|
|
|
|
|
DsRolepInitSetupFunctions();
|
|
|
|
//
|
|
// Create the SD's that are used to perform access checks for DsRoler
|
|
// callers
|
|
//
|
|
if ( !DsRolepCreateInterfaceSDs() ) {
|
|
|
|
return STATUS_NO_MEMORY;
|
|
|
|
}
|
|
|
|
try {
|
|
|
|
Status = RtlInitializeCriticalSection( &LogFileCriticalSection );
|
|
|
|
} except ( 1 ) {
|
|
|
|
Status = STATUS_NO_MEMORY;
|
|
}
|
|
|
|
if(NT_SUCCESS(Status)) {
|
|
//
|
|
// Register our shutdown routine
|
|
//
|
|
|
|
if (!SetConsoleCtrlHandler(DsRolepShutdownNotification, TRUE)) {
|
|
DsRoleDebugOut(( DEB_ERROR,
|
|
"SetConsoleCtrlHandler failed %d\n",
|
|
GetLastError() ));
|
|
}
|
|
|
|
if (!SetProcessShutdownParameters(480, SHUTDOWN_NORETRY)) {
|
|
DsRoleDebugOut(( DEB_ERROR,
|
|
"SetProcessShutdownParameters failed %d\n",
|
|
GetLastError() ));
|
|
}
|
|
}
|
|
|
|
|
|
|
|
return( Status );
|
|
}
|
|
|
|
|
|
|
|
|
|
NTSTATUS
|
|
DsRolepInitializePhase2(
|
|
VOID
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Second phase of the promotion/demotion api initialization. This initialization is slated
|
|
to happen after the Lsa has finished all of it's initializations
|
|
|
|
Arguments:
|
|
|
|
VOID
|
|
|
|
|
|
Returns:
|
|
|
|
STATUS_SUCCESS - Success
|
|
|
|
STATUS_UNSUCCESSFUL -- The function was called when the global lock wasn't held
|
|
|
|
--*/
|
|
{
|
|
ULONG RpcStatus = STATUS_SUCCESS;
|
|
PWSTR KerbPrinc;
|
|
|
|
ASSERT( GlobalOpLockHeld );
|
|
|
|
if ( !GlobalOpLockHeld ) {
|
|
|
|
return( STATUS_UNSUCCESSFUL );
|
|
}
|
|
|
|
if ( !SetupPhase ) {
|
|
|
|
//
|
|
// Register the Rpc authenticated server info
|
|
//
|
|
RpcStatus = RpcServerInqDefaultPrincName(RPC_C_AUTHN_GSS_KERBEROS,
|
|
&KerbPrinc);
|
|
|
|
if ( RpcStatus == RPC_S_OK ) {
|
|
|
|
DsRoleDebugOut(( DEB_TRACE_DS, "Kerberos Principal name: %ws\n",
|
|
KerbPrinc ));
|
|
|
|
RpcStatus = RpcServerRegisterAuthInfo(KerbPrinc,
|
|
RPC_C_AUTHN_GSS_NEGOTIATE,
|
|
NULL,
|
|
NULL);
|
|
RpcStringFree( &KerbPrinc );
|
|
|
|
} else {
|
|
|
|
DsRoleDebugOut(( DEB_TRACE_DS, "RpcServerInqDefaultPrincName failed with %lu\n",
|
|
RpcStatus ));
|
|
|
|
RpcStatus = RPC_S_OK;
|
|
|
|
}
|
|
|
|
if ( RpcStatus == RPC_S_OK) {
|
|
|
|
RpcStatus = RpcServerRegisterAuthInfo( DSROLEP_SERVER_PRINCIPAL_NAME,
|
|
RPC_C_AUTHN_GSS_NEGOTIATE,
|
|
NULL,
|
|
NULL );
|
|
|
|
if ( RpcStatus != RPC_S_OK ) {
|
|
|
|
DsRoleDebugOut(( DEB_ERROR,
|
|
"RpcServerRegisterAuthInfo for %ws failed with 0x%lx\n",
|
|
DSROLEP_SERVER_PRINCIPAL_NAME,
|
|
RpcStatus ));
|
|
RpcStatus = RPC_S_OK;
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
|
|
//
|
|
// Release the lock, as was opened in Initialization, phase 1
|
|
//
|
|
GlobalOpLockHeld = FALSE;
|
|
RtlReleaseResource( &DsRolepCurrentOperationHandle.CurrentOpLock );
|
|
|
|
return( RpcStatus == RPC_S_OK ? STATUS_SUCCESS : RPC_NT_UNKNOWN_AUTHZ_SERVICE );
|
|
}
|
|
|
|
|
|
|
|
|
|
DWORD
|
|
DsRolepGetMachineType(
|
|
IN OUT PDSROLEP_MACHINE_TYPE MachineType
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Determines the type of machine this is being run on.
|
|
|
|
Arguments:
|
|
|
|
MachineType - Where the machine type is being returned
|
|
|
|
Returns:
|
|
|
|
STATUS_SUCCESS - Success
|
|
|
|
--*/
|
|
{
|
|
DWORD Win32Err = ERROR_SUCCESS;
|
|
|
|
if ( LsapProductType == NtProductWinNt ) {
|
|
|
|
*MachineType = DSROLEP_MT_CLIENT;
|
|
|
|
} else if ( LsapProductType == NtProductServer ) {
|
|
|
|
*MachineType = DSROLEP_MT_STANDALONE;
|
|
|
|
} else {
|
|
|
|
*MachineType = DSROLEP_MT_MEMBER;
|
|
|
|
}
|
|
|
|
return( Win32Err );
|
|
}
|
|
|
|
|
|
DWORD
|
|
DsRolepSetProductType(
|
|
IN DSROLEP_MACHINE_TYPE MachineType
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Changes the role of the product to the type specified.
|
|
|
|
Arguments:
|
|
|
|
MachineType - Type of ProductRole to set
|
|
|
|
Returns:
|
|
|
|
ERROR_SUCCESS - Success
|
|
|
|
ERROR_INVALID_PARAMETER - A bad service option was given
|
|
|
|
--*/
|
|
{
|
|
DWORD Win32Err = ERROR_SUCCESS;
|
|
PWSTR MachineSz = NULL;
|
|
HKEY ProductHandle;
|
|
ULONG Size = 0;
|
|
|
|
switch ( MachineType ) {
|
|
case DSROLEP_MT_STANDALONE:
|
|
MachineSz = L"ServerNT";
|
|
Size = sizeof( L"ServerNT" );
|
|
break;
|
|
|
|
case DSROLEP_MT_MEMBER:
|
|
MachineSz = L"LanmanNT";
|
|
Size = sizeof( L"LanmanNT");
|
|
break;
|
|
|
|
case DSROLEP_MT_CLIENT:
|
|
default:
|
|
|
|
Win32Err = ERROR_INVALID_PARAMETER;
|
|
break;
|
|
}
|
|
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
Win32Err = RegOpenKeyEx( HKEY_LOCAL_MACHINE,
|
|
DSROLEP_PROD_KEY_PATH,
|
|
REG_OPTION_NON_VOLATILE,
|
|
KEY_WRITE, // desired access
|
|
&ProductHandle );
|
|
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
Win32Err = RegSetValueEx( ProductHandle,
|
|
(LPCWSTR)DSROLEP_PROD_VALUE,
|
|
0,
|
|
REG_SZ,
|
|
(CONST BYTE *)MachineSz,
|
|
Size );
|
|
|
|
|
|
RegCloseKey( ProductHandle );
|
|
}
|
|
}
|
|
|
|
DsRoleDebugOut(( DEB_TRACE_DS, "SetProductType to %ws returned %lu\n",
|
|
MachineSz, Win32Err ));
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"SetProductType to %lu [%ws] returned %lu\n",
|
|
MachineType,
|
|
DsRolepDisplayOptional(MachineSz),
|
|
Win32Err ));
|
|
|
|
DSROLEP_FAIL1( Win32Err, DSROLERES_PRODUCT_TYPE, MachineSz );
|
|
|
|
|
|
return( Win32Err );
|
|
}
|
|
|
|
DWORD
|
|
DsRolepCreateAuthIdentForCreds(
|
|
IN PWSTR Account,
|
|
IN PWSTR Password,
|
|
OUT PSEC_WINNT_AUTH_IDENTITY *AuthIdent
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Internal routine to create an AuthIdent structure for the given creditentials
|
|
|
|
Arguments:
|
|
|
|
Account - Account name
|
|
|
|
Password - Password for the account
|
|
|
|
AuthIdent - AuthIdentity struct to allocate and fill in.
|
|
|
|
|
|
Returns:
|
|
|
|
ERROR_SUCCESS - Success
|
|
|
|
ERROR_NOT_ENOUGH_MEMORY - A memory allocation failed.
|
|
|
|
--*/
|
|
{
|
|
DWORD Win32Err = ERROR_SUCCESS;
|
|
PWSTR UserCredentialString = NULL;
|
|
|
|
ASSERT( AuthIdent );
|
|
|
|
//
|
|
// If there are no creds, just return
|
|
//
|
|
if ( Account == NULL ) {
|
|
|
|
*AuthIdent = NULL;
|
|
return( Win32Err );
|
|
}
|
|
|
|
*AuthIdent = RtlAllocateHeap( RtlProcessHeap(), 0, sizeof( SEC_WINNT_AUTH_IDENTITY ) );
|
|
|
|
if ( *AuthIdent == NULL ) {
|
|
|
|
Win32Err = ERROR_NOT_ENOUGH_MEMORY;
|
|
|
|
} else {
|
|
|
|
RtlZeroMemory( *AuthIdent, sizeof( SEC_WINNT_AUTH_IDENTITY ) );
|
|
UserCredentialString = RtlAllocateHeap( RtlProcessHeap(), 0,
|
|
( wcslen( Account ) + 1 ) * sizeof( WCHAR ) );
|
|
if ( UserCredentialString ) {
|
|
|
|
wcscpy( UserCredentialString, Account );
|
|
|
|
( *AuthIdent )->User = wcsstr( UserCredentialString, L"\\" );
|
|
|
|
if ( ( *AuthIdent )->User ) {
|
|
|
|
//
|
|
// There is a domain name
|
|
//
|
|
*( ( *AuthIdent )->User ) = L'\0';
|
|
( ( *AuthIdent )->User )++;
|
|
( *AuthIdent )->Domain = UserCredentialString;
|
|
|
|
} else {
|
|
|
|
( *AuthIdent )->User = UserCredentialString;
|
|
( *AuthIdent )->Domain = L"";
|
|
|
|
}
|
|
|
|
if ( ( *AuthIdent )->User ) {
|
|
|
|
( *AuthIdent )->UserLength = wcslen( ( *AuthIdent )->User );
|
|
}
|
|
|
|
if ( ( *AuthIdent )->Domain ) {
|
|
|
|
( *AuthIdent )->DomainLength = wcslen( ( *AuthIdent )->Domain );
|
|
}
|
|
|
|
( *AuthIdent )->Password = Password;
|
|
|
|
if ( Password ) {
|
|
|
|
( *AuthIdent )->PasswordLength = wcslen( Password );
|
|
}
|
|
|
|
( *AuthIdent )->Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
|
|
|
|
} else {
|
|
|
|
Win32Err = ERROR_NOT_ENOUGH_MEMORY;
|
|
|
|
//
|
|
// Free the memory allocated for the top level structure
|
|
//
|
|
RtlFreeHeap( RtlProcessHeap(), 0, *AuthIdent );
|
|
*AuthIdent = NULL;
|
|
}
|
|
}
|
|
|
|
return( Win32Err );
|
|
}
|
|
|
|
|
|
VOID
|
|
DsRolepFreeAuthIdentForCreds(
|
|
IN PSEC_WINNT_AUTH_IDENTITY AuthIdent
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Free the authident structure allocated above
|
|
|
|
Arguments:
|
|
|
|
AuthIdent - AuthIdentity struct to free
|
|
|
|
|
|
Returns:
|
|
|
|
VOID
|
|
|
|
--*/
|
|
{
|
|
|
|
if ( AuthIdent ) {
|
|
|
|
if ( AuthIdent->Domain == NULL ) {
|
|
|
|
RtlFreeHeap( RtlProcessHeap(), 0, AuthIdent->User );
|
|
|
|
} else {
|
|
|
|
if ( *AuthIdent->Domain != L'\0' ) {
|
|
|
|
RtlFreeHeap( RtlProcessHeap(), 0, AuthIdent->Domain );
|
|
}
|
|
}
|
|
|
|
RtlFreeHeap( RtlProcessHeap(), 0, AuthIdent );
|
|
}
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
ImpLsaOpenPolicy(
|
|
IN HANDLE CallerToken,
|
|
IN PLSA_UNICODE_STRING SystemName OPTIONAL,
|
|
IN PLSA_OBJECT_ATTRIBUTES ObjectAttributes,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN OUT PLSA_HANDLE PolicyHandle
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine impersonates CallerToken and then calls into LsaOpenPolicy.
|
|
|
|
This purpose of this routine is call into the LSA on a different machine
|
|
using the RDR session for the caller of the DsRole API. The caller is
|
|
represented by CallerToken. This is necessary because the RDR sessions
|
|
are keyed by (logon id/remote server name) and we don't want to use the
|
|
logon id of the lsass.exe process since this is a shared logon id for
|
|
lsass.exe and services.exe and will lead to unresolable credentials
|
|
conflict.
|
|
|
|
N.B. The LSA rpc calls that follow the (Imp)LsaOpenPolicy will use the
|
|
handle returned by this function and then magically uses the right RDR
|
|
session to make the RPC call.
|
|
|
|
Arguments:
|
|
|
|
CallerToken - the token of the DsRole involker
|
|
|
|
Others -- see LsaOpenPolicy
|
|
|
|
|
|
Returns:
|
|
|
|
STATUS_ACCESS_DENIED if the impersonattion fails.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
Status = LsaOpenPolicy( SystemName,
|
|
ObjectAttributes,
|
|
DesiredAccess,
|
|
PolicyHandle );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
Status = STATUS_ACCESS_DENIED;
|
|
}
|
|
|
|
return Status;
|
|
|
|
}
|
|
|
|
DWORD
|
|
ImpDsRolepDsGetDcForAccount(
|
|
IN HANDLE CallerToken,
|
|
IN LPWSTR Server OPTIONAL,
|
|
IN LPWSTR Domain,
|
|
IN LPWSTR Account,
|
|
IN ULONG Flags,
|
|
IN ULONG AccountBits,
|
|
OUT PDOMAIN_CONTROLLER_INFOW *DomainControllerInfo
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function will impersoniate logged on user and call DsRolepDsGetDcForAccount
|
|
|
|
Arguments:
|
|
|
|
CallerToken - The Token of the DsRole involker.
|
|
|
|
Server - The server to call GetDc on.
|
|
|
|
Domain - Domain to find the Dc for
|
|
|
|
Account - Account to look for. If NULL, the current computer name is used
|
|
|
|
Flags - Flags to bas in to the GetDc call
|
|
|
|
AccountBits - Account control bits to search for
|
|
|
|
DomainControllerInfo - Where the info is returned
|
|
|
|
Returns:
|
|
|
|
ERROR_SUCCESS - Success
|
|
|
|
--*/
|
|
{
|
|
DWORD WinError = ERROR_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
WinError = DsRolepDsGetDcForAccount(Server,
|
|
Domain,
|
|
Account,
|
|
Flags,
|
|
AccountBits,
|
|
DomainControllerInfo
|
|
);
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
WinError = ERROR_ACCESS_DENIED;
|
|
}
|
|
|
|
return WinError;
|
|
}
|
|
|
|
NET_API_STATUS
|
|
NET_API_FUNCTION
|
|
ImpNetpManageIPCConnect(
|
|
IN HANDLE CallerToken,
|
|
IN LPWSTR lpServer,
|
|
IN LPWSTR lpAccount,
|
|
IN LPWSTR lpPassword,
|
|
IN ULONG fOptions
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine impersonates CallerToken and then calls into
|
|
NetpManageIPCConnect.
|
|
|
|
This purpose of this routine is to create a RDR using the logon id of
|
|
the caller of the DsRole api's. The caller is represented by CallerToken.
|
|
This is necessary because the RDR sessions are keyed by
|
|
(logon id/remote server name) and we don't want to use the
|
|
logon id of the lsass.exe process since this is a shared logon id for
|
|
lsass.exe and services.exe and will lead to unresolable credentials
|
|
conflict.
|
|
|
|
Arguments:
|
|
|
|
CallerToken - the token of the DsRole involker
|
|
|
|
Others -- see LsaOpenPolicy
|
|
|
|
|
|
Returns:
|
|
|
|
STATUS_ACCESS_DENIED if the impersonattion fails.
|
|
|
|
--*/
|
|
{
|
|
DWORD WinError = ERROR_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
WinError = NetpManageIPCConnect( lpServer,
|
|
lpAccount,
|
|
lpPassword,
|
|
fOptions );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
WinError = ERROR_ACCESS_DENIED;
|
|
}
|
|
|
|
return WinError;
|
|
|
|
}
|
|
|
|
|
|
DWORD
|
|
DsRolepGenerateRandomPassword(
|
|
IN ULONG Length,
|
|
IN WCHAR *Buffer
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This local function is used to generate a random password of no more than the
|
|
specified length. It is assumed that the destination buffer is of sufficient length.
|
|
|
|
Arguments:
|
|
|
|
Length - Length of the buffer
|
|
|
|
Buffer - Buffer to fill
|
|
|
|
Return Values:
|
|
|
|
ERROR_SUCCESS - Success
|
|
|
|
--*/
|
|
{
|
|
DWORD Win32Err = ERROR_SUCCESS;
|
|
ULONG PwdLength, i;
|
|
LARGE_INTEGER Time;
|
|
HCRYPTPROV CryptProvider = 0;
|
|
|
|
|
|
PwdLength = Length;
|
|
|
|
//
|
|
// Generate a random password.
|
|
//
|
|
if ( CryptAcquireContext( &CryptProvider,
|
|
NULL,
|
|
NULL,
|
|
PROV_RSA_FULL,
|
|
CRYPT_VERIFYCONTEXT ) ) {
|
|
|
|
if ( CryptGenRandom( CryptProvider,
|
|
PwdLength * sizeof( WCHAR ),
|
|
( LPBYTE )Buffer ) ) {
|
|
|
|
Buffer[ PwdLength ] = UNICODE_NULL;
|
|
|
|
//
|
|
// Make sure there are no NULL's in the middle of the list
|
|
//
|
|
for ( i = 0; i < PwdLength; i++ ) {
|
|
|
|
if ( Buffer[ i ] == UNICODE_NULL ) {
|
|
|
|
Buffer[ i ] = 0xe;
|
|
}
|
|
}
|
|
|
|
} else {
|
|
|
|
Win32Err = GetLastError();
|
|
}
|
|
|
|
CryptReleaseContext( CryptProvider, 0 );
|
|
|
|
|
|
} else {
|
|
|
|
Win32Err = GetLastError();
|
|
}
|
|
|
|
return( Win32Err );
|
|
|
|
}
|
|
DWORD
|
|
DsRolepCopyDsDitFiles(
|
|
IN LPWSTR DsPath
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function copies the initial database files from the install point to the
|
|
specified Ds database directory
|
|
|
|
Arguments:
|
|
|
|
DsPath - Path where the Ds database files are to reside
|
|
|
|
Returns:
|
|
|
|
ERROR_SUCCESS - Success
|
|
|
|
--*/
|
|
{
|
|
DWORD Win32Err = ERROR_SUCCESS;
|
|
WCHAR Source[MAX_PATH + 1];
|
|
WCHAR Dest[MAX_PATH + 1];
|
|
ULONG SrcLen = 0, DestLen = 0;
|
|
PWSTR Current;
|
|
ULONG i;
|
|
PWSTR DsDitFiles[] = {
|
|
L"ntds.dit"
|
|
};
|
|
|
|
|
|
|
|
if( ExpandEnvironmentStrings( L"%WINDIR%\\system32\\", Source, MAX_PATH ) == FALSE ) {
|
|
|
|
Win32Err = GetLastError();
|
|
|
|
} else {
|
|
|
|
SrcLen = wcslen( Source );
|
|
wcscpy( Dest, DsPath );
|
|
|
|
if ( *(Dest + (wcslen( DsPath ) - 1 )) != L'\\' ) {
|
|
|
|
wcscat( Dest, L"\\" );
|
|
}
|
|
|
|
DestLen = wcslen( Dest );
|
|
|
|
}
|
|
|
|
//
|
|
// Then, create the destination directory
|
|
//
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
Current = wcschr( DsPath + 4, L'\\' );
|
|
|
|
while ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
if ( Current != NULL ) {
|
|
|
|
*Current = UNICODE_NULL;
|
|
|
|
}
|
|
|
|
if ( CreateDirectory( DsPath, NULL ) == FALSE ) {
|
|
|
|
|
|
Win32Err = GetLastError();
|
|
|
|
if ( Win32Err == ERROR_ALREADY_EXISTS) {
|
|
|
|
Win32Err = ERROR_SUCCESS;
|
|
|
|
} else if ( Win32Err == ERROR_ACCESS_DENIED ) {
|
|
|
|
if ( PathIsRoot(DsPath) ) {
|
|
|
|
//If the path given to CreateDirectory is a root path then
|
|
//it will fail with ERROR_ACCESS_DENIED instead of
|
|
//ERROR_ALREADY_EXISTS but the path is still a valid one for
|
|
//ntds.dit and the log files to be placed in.
|
|
|
|
Win32Err = ERROR_SUCCESS;
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
if ( Current != NULL ) {
|
|
|
|
*Current = L'\\';
|
|
|
|
Current = wcschr( Current + 1, L'\\' );
|
|
|
|
} else {
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
//
|
|
// Then copy them.
|
|
//
|
|
for ( i = 0; i < sizeof( DsDitFiles) / sizeof( PWSTR ) && Win32Err == ERROR_SUCCESS ; i++ ) {
|
|
|
|
wcscpy( Source + SrcLen, DsDitFiles[i] );
|
|
wcscpy( Dest + DestLen, DsDitFiles[i] );
|
|
|
|
DSROLEP_CURRENT_OP2( DSROLEEVT_COPY_DIT, Source, Dest );
|
|
if ( CopyFile( Source, Dest, TRUE ) == FALSE ) {
|
|
|
|
Win32Err = GetLastError();
|
|
|
|
if ( Win32Err == ERROR_ALREADY_EXISTS ||
|
|
Win32Err == ERROR_FILE_EXISTS ) {
|
|
|
|
Win32Err = ERROR_SUCCESS;
|
|
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_ERROR, "Failed to copy install file %ws to %ws: %lu\n",
|
|
Source, Dest, Win32Err ));
|
|
}
|
|
}
|
|
}
|
|
|
|
return( Win32Err );
|
|
}
|
|
|
|
|
|
#define DSROLEP_SEC_SYSVOL L"SYSVOL"
|
|
#define DSROLEP_SEC_DSDIT L"DSDIT"
|
|
#define DSROLEP_SEC_DSLOG L"DSLOG"
|
|
|
|
DWORD
|
|
DsRolepSetDcSecurity(
|
|
IN HANDLE ClientToken,
|
|
IN LPWSTR SysVolRootPath,
|
|
IN LPWSTR DsDatabasePath,
|
|
IN LPWSTR DsLogPath,
|
|
IN BOOLEAN Upgrade,
|
|
IN BOOLEAN Replica
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function will invoke the security editor to set the security on the Dc install files
|
|
|
|
Arguments:
|
|
|
|
SysVolRootPath - Root used for the system volume
|
|
|
|
DsDatabasePath - Path to where the Ds database files go
|
|
|
|
DsLogPath - Path to where the Ds log files go
|
|
|
|
Upgrade - If TRUE, the machine is undergoing an upgrade
|
|
|
|
Replica - If TRUE, the machine is going through an upgrade
|
|
|
|
Returns:
|
|
|
|
ERROR_SUCCESS - Success
|
|
|
|
--*/
|
|
{
|
|
|
|
DWORD Win32Err = ERROR_SUCCESS, i;
|
|
WCHAR InfPath[ MAX_PATH + 1 ];
|
|
PWSTR Paths[ 3 ], Tags[ 3 ];
|
|
ULONG Options = 0;
|
|
|
|
Paths[ 0 ] = SysVolRootPath;
|
|
Paths[ 1 ] = DsDatabasePath;
|
|
Paths[ 2 ] = DsLogPath;
|
|
Tags[ 0 ] = DSROLEP_SEC_SYSVOL;
|
|
Tags[ 1 ] = DSROLEP_SEC_DSDIT;
|
|
Tags[ 2 ] = DSROLEP_SEC_DSLOG;
|
|
|
|
//
|
|
// Set the environment variables. secedt uses the environment variables to pass around
|
|
// information, so we will set the for the duration of this function
|
|
//
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
|
|
ASSERT( sizeof( Paths ) / sizeof( PWSTR ) == sizeof( Tags ) / sizeof( PWSTR ) );
|
|
for ( i = 0; i < sizeof( Paths ) / sizeof( PWSTR ) && Win32Err == ERROR_SUCCESS; i++ ) {
|
|
|
|
if ( SetEnvironmentVariable( Tags[ i ], Paths[ i ] ) == FALSE ) {
|
|
|
|
Win32Err = GetLastError();
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"SetEnvironmentVariable %ws = %ws failed with %lu\n",
|
|
Tags[ i ],
|
|
Paths[ i ],
|
|
Win32Err ));
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
//
|
|
// Now, invoke the security editing code
|
|
//
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
DsRolepSetAndClearLog();
|
|
DSROLEP_CURRENT_OP0( DSROLEEVT_SETTING_SECURITY );
|
|
|
|
Options |= Upgrade ? SCE_PROMOTE_FLAG_UPGRADE : 0;
|
|
Options |= Replica ? SCE_PROMOTE_FLAG_REPLICA : 0;
|
|
|
|
Win32Err = ( *DsrSceDcPromoteSecurityEx )( ClientToken,
|
|
Options,
|
|
DsRolepStringUpdateCallback );
|
|
DsRolepSetAndClearLog();
|
|
DsRolepLogOnFailure( Win32Err,
|
|
DsRolepLogPrint(( DEB_ERROR,
|
|
"Setting security on Dc files failed with %lu\n",
|
|
Win32Err )) );
|
|
}
|
|
|
|
|
|
//
|
|
// Delete the environment variables
|
|
//
|
|
for ( i = 0; i < sizeof( Paths ) / sizeof( PWSTR ); i++ ) {
|
|
|
|
if ( SetEnvironmentVariable( Tags[ i ], NULL ) == FALSE ) {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"SetEnvironmentVariable %ws = NULL failed with %lu\n",
|
|
Tags[ i ],
|
|
GetLastError() ));
|
|
}
|
|
}
|
|
|
|
//
|
|
// Currently, setting the security will not cause the promote to fail
|
|
//
|
|
if ( Win32Err != ERROR_SUCCESS ) {
|
|
|
|
//
|
|
// Raise an event
|
|
//
|
|
SpmpReportEvent( TRUE,
|
|
EVENTLOG_WARNING_TYPE,
|
|
DSROLERES_FAIL_SET_SECURITY,
|
|
0,
|
|
sizeof( ULONG ),
|
|
&Win32Err,
|
|
1,
|
|
SCE_DCPROMO_LOG_PATH );
|
|
|
|
DSROLEP_SET_NON_FATAL_ERROR( Win32Err );
|
|
|
|
}
|
|
|
|
Win32Err = ERROR_SUCCESS;
|
|
|
|
return( Win32Err );
|
|
}
|
|
|
|
|
|
|
|
|
|
DWORD
|
|
DsRolepDsGetDcForAccount(
|
|
IN LPWSTR Server OPTIONAL,
|
|
IN LPWSTR Domain,
|
|
IN LPWSTR Account,
|
|
IN ULONG Flags,
|
|
IN ULONG AccountBits,
|
|
OUT PDOMAIN_CONTROLLER_INFOW *DomainControllerInfo
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function is equivalent to DsGetDcName but will search for the Dc that holds the
|
|
specified account.
|
|
|
|
Arguments:
|
|
|
|
ReplicaServer - The server to call GetDc on.
|
|
|
|
Domain - Domain to find the Dc for
|
|
|
|
Account - Account to look for. If NULL, the current computer name is used
|
|
|
|
Flags - Flags to bas in to the GetDc call
|
|
|
|
AccountBits - Account control bits to search for
|
|
|
|
DomainControllerInfo - Where the info is returned
|
|
|
|
Returns:
|
|
|
|
ERROR_SUCCESS - Success
|
|
|
|
--*/
|
|
{
|
|
DWORD Win32Err = ERROR_SUCCESS;
|
|
WCHAR ComputerName[ MAX_COMPUTERNAME_LENGTH + 2 ];
|
|
ULONG Length = MAX_COMPUTERNAME_LENGTH + 1;
|
|
|
|
//
|
|
// If we have no account, use the computer name
|
|
//
|
|
if ( Account == NULL ) {
|
|
|
|
if ( GetComputerName( ComputerName, &Length ) == FALSE ) {
|
|
|
|
Win32Err = GetLastError();
|
|
|
|
} else {
|
|
|
|
wcscat( ComputerName, SSI_SECRET_PREFIX );
|
|
Account = ComputerName;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Now, do the find
|
|
//
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
DSROLEP_CURRENT_OP2( DSROLEEVT_FIND_DC_FOR_ACCOUNT, Domain, Account );
|
|
Win32Err = DsGetDcNameWithAccountW( Server,
|
|
Account,
|
|
AccountBits,
|
|
Domain,
|
|
NULL,
|
|
NULL,
|
|
Flags,
|
|
DomainControllerInfo );
|
|
|
|
if ( ERROR_NO_SUCH_USER == Win32Err ) {
|
|
|
|
//
|
|
// The error should read "no machine account", not "no user"
|
|
// since we are searching for a machine account.
|
|
//
|
|
|
|
Win32Err = ERROR_NO_TRUST_SAM_ACCOUNT;
|
|
}
|
|
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
DSROLEP_CURRENT_OP2( DSROLEEVT_FOUND_DC,
|
|
( PWSTR ) ( ( *DomainControllerInfo )->DomainControllerName + 2 ),
|
|
Domain );
|
|
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_ERROR, "Failed to find a DC for domain %ws: %lu\n",
|
|
Domain, Win32Err ));
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
return( Win32Err );
|
|
}
|
|
|
|
|
|
|
|
|
|
DWORD
|
|
DsRolepSetMachineAccountType(
|
|
IN LPWSTR Dc,
|
|
IN HANDLE ClientToken,
|
|
IN LPWSTR User,
|
|
IN LPWSTR Password,
|
|
IN LPWSTR AccountName,
|
|
IN ULONG AccountBits,
|
|
IN OUT WCHAR** AccountDn
|
|
)
|
|
{
|
|
DWORD Win32Err = ERROR_SUCCESS, Win32Err2;
|
|
USER_INFO_1 *CurrentUI1;
|
|
WCHAR ComputerName[ MAX_COMPUTERNAME_LENGTH + 2 ];
|
|
ULONG Length = MAX_COMPUTERNAME_LENGTH + 1;
|
|
PSEC_WINNT_AUTH_IDENTITY AuthIdent = NULL;
|
|
|
|
//
|
|
// If we have no account, use the computer name
|
|
//
|
|
if ( AccountName == NULL ) {
|
|
|
|
if ( GetComputerName( ComputerName, &Length ) == FALSE ) {
|
|
|
|
Win32Err = GetLastError();
|
|
|
|
} else {
|
|
|
|
wcscat( ComputerName, SSI_SECRET_PREFIX );
|
|
AccountName = ComputerName;
|
|
}
|
|
}
|
|
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
Win32Err = DsRolepCreateAuthIdentForCreds( User, Password, &AuthIdent );
|
|
}
|
|
|
|
//
|
|
// Call the support dll
|
|
//
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE, "Searching for the machine account for %ws on %ws...\n",
|
|
AccountName, Dc ));
|
|
|
|
DSROLEP_CURRENT_OP0( DSROLEEVT_MACHINE_ACCT );
|
|
|
|
DSROLE_GET_SETUP_FUNC( Win32Err, DsrNtdsSetReplicaMachineAccount );
|
|
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
if ( Dc && *Dc == L'\\' ) {
|
|
|
|
Dc += 2;
|
|
}
|
|
|
|
Win32Err = (*DsrNtdsSetReplicaMachineAccount)( AuthIdent,
|
|
ClientToken,
|
|
Dc,
|
|
AccountName,
|
|
AccountBits,
|
|
AccountDn );
|
|
}
|
|
|
|
DsRolepLogPrint(( DEB_TRACE, "NtdsSetReplicaMachineAccount returned %d\n", Win32Err ));
|
|
|
|
DsRolepFreeAuthIdentForCreds( AuthIdent );
|
|
}
|
|
|
|
return( Win32Err );
|
|
}
|
|
|
|
|
|
|
|
DWORD
|
|
DsRolepForceTimeSync(
|
|
IN HANDLE ImpToken,
|
|
IN PWSTR TimeSource
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function forces a time sync with the specified server
|
|
|
|
Arguments:
|
|
|
|
TimeSource - Server to use for the time source
|
|
|
|
Returns:
|
|
|
|
ERROR_SUCCESS - Success
|
|
|
|
--*/
|
|
{
|
|
DWORD Win32Err = ERROR_SUCCESS;
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
PWSTR ServerName = NULL;
|
|
PTIME_OF_DAY_INFO TOD;
|
|
HANDLE ThreadToken = 0;
|
|
TOKEN_PRIVILEGES Enabled, Previous;
|
|
DWORD PreviousSize;
|
|
TIME_FIELDS TimeFields;
|
|
LARGE_INTEGER SystemTime;
|
|
|
|
BOOL connected=FALSE;
|
|
NETRESOURCE NetResource;
|
|
WCHAR *remotename=NULL;
|
|
|
|
BOOL fSuccess = FALSE;
|
|
|
|
if ( !TimeSource ) {
|
|
Win32Err = ERROR_INVALID_PARAMETER;
|
|
goto cleanup;
|
|
}
|
|
|
|
//
|
|
// Build the server name with preceeding \\'s
|
|
//
|
|
if ( *TimeSource != L'\\' ) {
|
|
|
|
ServerName = RtlAllocateHeap( RtlProcessHeap(), 0,
|
|
( wcslen( TimeSource ) + 3 ) * sizeof( WCHAR ) );
|
|
|
|
if ( ServerName == NULL ) {
|
|
|
|
Win32Err = ERROR_NOT_ENOUGH_MEMORY;
|
|
DsRolepLogPrint(( DEB_ERROR, "Failed to open a NULL session with %ws for time sync. Out of Memory. Failed with %d\n",
|
|
TimeSource,
|
|
Win32Err ));
|
|
goto cleanup;
|
|
|
|
} else {
|
|
|
|
swprintf( ServerName, L"\\\\%ws", TimeSource );
|
|
}
|
|
|
|
} else {
|
|
|
|
ServerName = TimeSource;
|
|
}
|
|
|
|
//
|
|
// Enable the systemtime privilege
|
|
//
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
Status = NtOpenThreadToken( NtCurrentThread(),
|
|
TOKEN_READ | TOKEN_WRITE,
|
|
TRUE,
|
|
&ThreadToken );
|
|
|
|
if ( Status == STATUS_NO_TOKEN ) {
|
|
|
|
Status = NtOpenProcessToken( NtCurrentProcess(),
|
|
TOKEN_WRITE | TOKEN_READ,
|
|
&ThreadToken );
|
|
}
|
|
|
|
if ( NT_SUCCESS( Status ) ) {
|
|
|
|
Enabled.PrivilegeCount = 1;
|
|
Enabled.Privileges[0].Luid.LowPart = SE_SYSTEMTIME_PRIVILEGE;
|
|
Enabled.Privileges[0].Luid.HighPart = 0;
|
|
Enabled.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
|
|
PreviousSize = sizeof( Previous );
|
|
|
|
Status = NtAdjustPrivilegesToken( ThreadToken,
|
|
FALSE,
|
|
&Enabled,
|
|
sizeof( Enabled ),
|
|
&Previous,
|
|
&PreviousSize );
|
|
//
|
|
// Since we modified the thread token and the thread is shortlived, we won't bother
|
|
// restoring it later.
|
|
//
|
|
}
|
|
|
|
if ( ThreadToken ) {
|
|
|
|
NtClose( ThreadToken );
|
|
|
|
}
|
|
|
|
|
|
|
|
Win32Err = RtlNtStatusToDosError( Status );
|
|
DsRolepLogOnFailure( Win32Err,
|
|
DsRolepLogPrint(( DEB_ERROR,
|
|
"Failed to enable the SE_SYSTEMTIME_PRIVILEGE: %lu\n",
|
|
Win32Err )) );
|
|
|
|
}
|
|
|
|
|
|
//
|
|
// Get the remote time
|
|
//
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
DSROLEP_CURRENT_OP1( DSROLEEVT_TIMESYNC, TimeSource );
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( ImpToken );
|
|
if ( !fSuccess ) {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
|
|
|
|
// We will continue anyway
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
remotename = RtlAllocateHeap(
|
|
RtlProcessHeap(), 0,
|
|
sizeof(WCHAR)*(wcslen(L"\\ipc$")+wcslen(ServerName)+1));
|
|
if ( remotename == NULL ) {
|
|
|
|
Win32Err = ERROR_NOT_ENOUGH_MEMORY;
|
|
DsRolepLogPrint(( DEB_ERROR, "Failed to open a NULL session with %ws for time sync. Out of Memory. Failed with %d\n",
|
|
ServerName,
|
|
Win32Err ));
|
|
|
|
}
|
|
|
|
wsprintf(remotename,L"%s\\ipc$",ServerName);
|
|
|
|
NetResource.dwType=RESOURCETYPE_ANY;
|
|
NetResource.lpLocalName=NULL;
|
|
NetResource.lpRemoteName=remotename;
|
|
NetResource.lpProvider=NULL;
|
|
|
|
//get permission to access the server
|
|
Win32Err=WNetAddConnection2W(&NetResource,
|
|
L"",
|
|
L"",
|
|
0);
|
|
if ( Win32Err == NO_ERROR ) {
|
|
connected=TRUE;
|
|
}
|
|
else {
|
|
DsRolepLogPrint(( DEB_WARN, "Failed to open a NULL session with %ws for time sync. Failed with %d\n",
|
|
ServerName,
|
|
Win32Err ));
|
|
//We will attempt to Time sync anyway
|
|
}
|
|
|
|
Win32Err = NetRemoteTOD( ServerName, ( LPBYTE * )&TOD );
|
|
|
|
if ( Win32Err == ERROR_SUCCESS ) {
|
|
|
|
TimeFields.Hour = ( WORD )TOD->tod_hours;
|
|
TimeFields.Minute = ( WORD )TOD->tod_mins;
|
|
TimeFields.Second = ( WORD )TOD->tod_secs;
|
|
TimeFields.Milliseconds = ( WORD )TOD->tod_hunds * 10;
|
|
TimeFields.Day = ( WORD )TOD->tod_day;
|
|
TimeFields.Month = ( WORD )TOD->tod_month;
|
|
TimeFields.Year = ( WORD )TOD->tod_year;
|
|
|
|
if ( !RtlTimeFieldsToTime( &TimeFields, &SystemTime ) ) {
|
|
|
|
Status = STATUS_INVALID_PARAMETER;
|
|
|
|
} else {
|
|
|
|
if ( connected ) {
|
|
WNetCancelConnection2(remotename,
|
|
0,
|
|
TRUE);
|
|
}
|
|
|
|
if( remotename ) {
|
|
|
|
RtlFreeHeap( RtlProcessHeap(), 0, remotename );
|
|
|
|
}
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
connected=FALSE;
|
|
|
|
Status = NtSetSystemTime( &SystemTime, NULL );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
|
|
DsRolepLogPrint(( DEB_ERROR, "NtSetSystemTime failed with 0x%lx\n", Status ));
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
Win32Err = RtlNtStatusToDosError( Status );
|
|
|
|
NetApiBufferFree( TOD );
|
|
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_ERROR, "Failed to get the current time on %ws: %lu\n",
|
|
TimeSource, Win32Err ));
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
//
|
|
// For the IDS, consider a failure here non-fatal
|
|
//
|
|
if ( Win32Err != ERROR_SUCCESS ) {
|
|
|
|
DsRolepLogPrint(( DEB_ERROR, "NON-FATAL error forcing a time sync (%lu). Ignoring\n",
|
|
Win32Err ));
|
|
Win32Err = ERROR_SUCCESS;
|
|
|
|
}
|
|
|
|
cleanup:
|
|
|
|
if ( connected ) {
|
|
WNetCancelConnection2(remotename,
|
|
0,
|
|
TRUE);
|
|
|
|
|
|
if( remotename ) {
|
|
|
|
RtlFreeHeap( RtlProcessHeap(), 0, remotename );
|
|
|
|
}
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
}
|
|
|
|
|
|
return( Win32Err );
|
|
}
|
|
|
|
|
|
|
|
|
|
NTSTATUS
|
|
DsRolepGetMixedModeFlags(
|
|
IN PSID DomainSid,
|
|
OUT PULONG Flags
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine will determine whether the machine is currently in mixed mode or not
|
|
|
|
Arguments:
|
|
|
|
Flags - Pointer to a flags value to be altered. If the machine is a mixed mode, we simply
|
|
or in the proper value.
|
|
|
|
Return Values:
|
|
|
|
NTSTATUS
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOLEAN mixedDomain;
|
|
|
|
Status = SamIMixedDomain2( DomainSid, &mixedDomain );
|
|
|
|
if ( NT_SUCCESS( Status ) && mixedDomain) {
|
|
*Flags |= DSROLE_PRIMARY_DS_MIXED_MODE;
|
|
}
|
|
|
|
return( Status );
|
|
}
|
|
|
|
|
|
BOOL
|
|
DsRolepShutdownNotification(
|
|
DWORD dwCtrlType
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is called by the system when system shutdown is occuring.
|
|
|
|
It stops a role change if one is in progress.
|
|
|
|
Arguments:
|
|
|
|
dwCtrlType -- the notification
|
|
|
|
|
|
Return Value:
|
|
|
|
FALSE - to allow any other shutdown routines in this process to
|
|
also be called.
|
|
|
|
--*/
|
|
{
|
|
if ( dwCtrlType == CTRL_SHUTDOWN_EVENT ) {
|
|
|
|
//
|
|
// Cancel the operation
|
|
//
|
|
(VOID) DsRolepCancel( FALSE ); // Don't block
|
|
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
DWORD
|
|
DsRolepDeregisterNetlogonDnsRecords(
|
|
PNTDS_DNS_RR_INFO pInfo
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is called during demotion to call netlogon to deregister
|
|
its the service DNS records for this domain controller
|
|
|
|
Arguments:
|
|
|
|
pInfo -- structure containing the parameters for the deregistration
|
|
|
|
Return Value:
|
|
|
|
An error from DsDeregisterDnsHostRecordsW
|
|
|
|
--*/
|
|
{
|
|
|
|
DWORD WinError = ERROR_SUCCESS;
|
|
HKEY hNetlogonParms = NULL;
|
|
BOOL fDoDeregistration = TRUE;
|
|
|
|
if ( !pInfo ) {
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
#define NETLOGON_PATH L"SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters"
|
|
#define AVOID_DNS_DEREG_KEY L"AvoidDnsDeregOnShutdown"
|
|
|
|
WinError = RegOpenKeyEx( HKEY_LOCAL_MACHINE,
|
|
NETLOGON_PATH,
|
|
0,
|
|
KEY_READ,
|
|
&hNetlogonParms );
|
|
|
|
if ( ERROR_SUCCESS == WinError ) {
|
|
|
|
DWORD val = 0;
|
|
DWORD len = sizeof(DWORD);
|
|
DWORD type;
|
|
|
|
WinError = RegQueryValueEx( hNetlogonParms,
|
|
AVOID_DNS_DEREG_KEY,
|
|
0,
|
|
&type,
|
|
(BYTE*)&val,
|
|
&len );
|
|
|
|
if ( (ERROR_SUCCESS == WinError)
|
|
&& (type == REG_DWORD)
|
|
&& (val == 0) ) {
|
|
|
|
//
|
|
// Don't bother; netlogon has already done the deregistration.
|
|
//
|
|
fDoDeregistration = FALSE;
|
|
}
|
|
|
|
RegCloseKey( hNetlogonParms );
|
|
}
|
|
|
|
if ( fDoDeregistration ) {
|
|
|
|
//
|
|
// Ask netlogon to do the deregistration
|
|
//
|
|
WinError = DsDeregisterDnsHostRecordsW( NULL, // go local
|
|
pInfo->DnsDomainName,
|
|
&pInfo->DomainGuid,
|
|
&pInfo->DsaGuid,
|
|
pInfo->DnsHostName );
|
|
} else {
|
|
|
|
WinError = ERROR_SUCCESS;
|
|
|
|
}
|
|
|
|
return WinError;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
ImpLsaDelete(
|
|
IN HANDLE CallerToken,
|
|
IN LSA_HANDLE ObjectHandle
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is a wrapper for the Lsa call. See The comments for
|
|
ImpOpenLsaPolicy for details.
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
Status = LsaDelete( ObjectHandle );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
Status = STATUS_ACCESS_DENIED;
|
|
}
|
|
|
|
return Status;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
ImpLsaQueryInformationPolicy(
|
|
IN HANDLE CallerToken,
|
|
IN LSA_HANDLE PolicyHandle,
|
|
IN POLICY_INFORMATION_CLASS InformationClass,
|
|
OUT PVOID *Buffer
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is a wrapper for the Lsa call. See The comments for
|
|
ImpOpenLsaPolicy for details.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
Status = LsaQueryInformationPolicy( PolicyHandle,
|
|
InformationClass,
|
|
Buffer );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
Status = STATUS_ACCESS_DENIED;
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
ImpLsaOpenTrustedDomainByName(
|
|
IN HANDLE CallerToken,
|
|
IN LSA_HANDLE PolicyHandle,
|
|
IN PLSA_UNICODE_STRING TrustedDomainName,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
OUT PLSA_HANDLE TrustedDomainHandle
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is a wrapper for the Lsa call. See The comments for
|
|
ImpOpenLsaPolicy for details.
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
Status = LsaOpenTrustedDomainByName( PolicyHandle,
|
|
TrustedDomainName,
|
|
DesiredAccess,
|
|
TrustedDomainHandle );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
Status = STATUS_ACCESS_DENIED;
|
|
}
|
|
|
|
return Status;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
ImpLsaOpenTrustedDomain(
|
|
IN HANDLE CallerToken,
|
|
IN LSA_HANDLE PolicyHandle,
|
|
IN PSID TrustedDomainSid,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
OUT PLSA_HANDLE TrustedDomainHandle
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is a wrapper for the Lsa call. See The comments for
|
|
ImpOpenLsaPolicy for details.
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
Status = LsaOpenTrustedDomain( PolicyHandle,
|
|
TrustedDomainSid,
|
|
DesiredAccess,
|
|
TrustedDomainHandle );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
Status = STATUS_ACCESS_DENIED;
|
|
}
|
|
|
|
return Status;
|
|
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
ImpLsaCreateTrustedDomainEx(
|
|
IN HANDLE CallerToken,
|
|
IN LSA_HANDLE PolicyHandle,
|
|
IN PTRUSTED_DOMAIN_INFORMATION_EX TrustedDomainInformation,
|
|
IN PTRUSTED_DOMAIN_AUTH_INFORMATION AuthenticationInformation,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
OUT PLSA_HANDLE TrustedDomainHandle
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is a wrapper for the Lsa call. See The comments for
|
|
ImpOpenLsaPolicy for details.
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
Status = LsaCreateTrustedDomainEx( PolicyHandle,
|
|
TrustedDomainInformation,
|
|
AuthenticationInformation,
|
|
DesiredAccess,
|
|
TrustedDomainHandle );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
Status = STATUS_ACCESS_DENIED;
|
|
}
|
|
|
|
return Status;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
ImpLsaQueryTrustedDomainInfoByName(
|
|
IN HANDLE CallerToken,
|
|
IN LSA_HANDLE PolicyHandle,
|
|
IN PLSA_UNICODE_STRING TrustedDomainName,
|
|
IN TRUSTED_INFORMATION_CLASS InformationClass,
|
|
OUT PVOID *Buffer
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is a wrapper for the Lsa call. See The comments for
|
|
ImpOpenLsaPolicy for details.
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
Status = LsaQueryTrustedDomainInfoByName( PolicyHandle,
|
|
TrustedDomainName,
|
|
InformationClass,
|
|
Buffer );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
Status = STATUS_ACCESS_DENIED;
|
|
}
|
|
|
|
return Status;
|
|
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
ImpLsaQueryDomainInformationPolicy(
|
|
IN HANDLE CallerToken,
|
|
IN LSA_HANDLE PolicyHandle,
|
|
IN POLICY_DOMAIN_INFORMATION_CLASS InformationClass,
|
|
OUT PVOID *Buffer
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is a wrapper for the Lsa call. See The comments for
|
|
ImpOpenLsaPolicy for details.
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
Status = LsaQueryDomainInformationPolicy( PolicyHandle,
|
|
InformationClass,
|
|
Buffer );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
Status = STATUS_ACCESS_DENIED;
|
|
}
|
|
|
|
return Status;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
ImpLsaClose(
|
|
IN HANDLE CallerToken,
|
|
IN LSA_HANDLE ObjectHandle
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine is a wrapper for the Lsa call. See The comments for
|
|
ImpOpenLsaPolicy for details.
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
BOOL fSuccess;
|
|
|
|
fSuccess = ImpersonateLoggedOnUser( CallerToken );
|
|
if ( fSuccess ) {
|
|
|
|
Status = LsaClose( ObjectHandle );
|
|
|
|
fSuccess = RevertToSelf();
|
|
ASSERT( fSuccess );
|
|
} else {
|
|
|
|
DsRolepLogPrint(( DEB_TRACE,
|
|
"Failed to impersonate caller, error %lu\n",
|
|
GetLastError() ));
|
|
|
|
//
|
|
// We couldn't impersonate?
|
|
//
|
|
Status = STATUS_ACCESS_DENIED;
|
|
}
|
|
|
|
return Status;
|
|
|
|
}
|