// Trust.cpp : Implementation of CTrustMgrApp and DLL registration.
#include "stdafx.h"
//#import "\bin\McsVarSetMin.tlb" no_namespace, named_guids
#import "VarSet.tlb" no_namespace, named_guids rename("property", "aproperty")
#include "TrustMgr.h"
#include "Trust.h"
#include "Common.hpp"
#include "UString.hpp"
#include "ResStr.h"
#include "ErrDct.hpp"
#include "EaLen.hpp"
#include "LSAUtils.h"
#include <lm.h>
#include <dsgetdc.h>
#include <iads.h>
#include <adshlp.h>
#include "ntsecapi.h"
#include "SecPI.h"
#include "cipher.hpp"
#ifndef TRUST_ATTRIBUTE_FOREST_TRANSITIVE
#define TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0x00000008 // This link may contain forest trust information
#endif
StringLoader gString;
TErrorDct err;
// This method is called by the dispatcher to verify that this is a valid plug-in
// Only valid plug-ins will be sent out with the agents
// The purpose of this check is to make it more difficult for unauthorized parties
// to use our plug-in interface, since it is currently undocumented.
STDMETHODIMP CTrust::Verify(/*[in,out]*/ULONG * pData,/*[in]*/ULONG size)
{
McsChallenge * pMcsChallenge;
long lTemp1;
long lTemp2;
if( size == sizeof(McsChallenge) )
{
pMcsChallenge = (McsChallenge*)(pData);
SimpleCipher((LPBYTE)pMcsChallenge,size);
pMcsChallenge->MCS[0] = 'M';
pMcsChallenge->MCS[1] = 'C';
pMcsChallenge->MCS[2] = 'S';
pMcsChallenge->MCS[3] = 0;
lTemp1 = pMcsChallenge->lRand1 + pMcsChallenge->lRand2;
lTemp2 = pMcsChallenge->lRand2 - pMcsChallenge->lRand1;
pMcsChallenge->lRand1 = lTemp1;
pMcsChallenge->lRand2 = lTemp2;
pMcsChallenge->lTime += 100;
SimpleCipher((LPBYTE)pMcsChallenge,size);
}
else
return E_FAIL;
return S_OK;
}
/////////////////////////////////////////////////////////////////////////////
//
STDMETHODIMP CTrust::QueryTrust(BSTR domTrusting, BSTR domTrusted, IUnknown **pVarSet)
{
HRESULT hr = S_OK;
return hr;
}
STDMETHODIMP CTrust::CreateTrust(BSTR domTrusting, BSTR domTrusted, BOOL bBidirectional)
{
HRESULT hr = S_OK;
hr = CheckAndCreate(domTrusting,domTrusted,NULL,NULL,NULL,NULL,NULL,NULL,TRUE,bBidirectional);
return HRESULT_FROM_WIN32(hr);
}
STDMETHODIMP
CTrust::CreateTrustWithCreds(
BSTR domTrusting,
BSTR domTrusted,
BSTR credTrustingDomain,
BSTR credTrustingAccount,
BSTR credTrustingPassword,
BSTR credTrustedDomain,
BSTR credTrustedAccount,
BSTR credTrustedPassword,
BOOL bBidirectional
)
{
HRESULT hr = S_OK;
hr = CheckAndCreate(domTrusting,domTrusted,credTrustingDomain,credTrustingAccount,credTrustingPassword,
credTrustedDomain,credTrustedAccount,credTrustedPassword,TRUE,bBidirectional);
return hr;
}
STDMETHODIMP CTrust::GetRegisterableFiles(/* [out] */SAFEARRAY ** pArray)
{
SAFEARRAYBOUND bound[1] = { 0, 0 };
// this plug-in runs locally, no files to distribute
(*pArray) = SafeArrayCreate(VT_BSTR,1,bound);
return S_OK;
}
STDMETHODIMP CTrust::GetRequiredFiles(/* [out] */SAFEARRAY ** pArray)
{
SAFEARRAYBOUND bound[1] = { 0, 0 };
// this plug-in runs locally, no files to distribute
(*pArray) = SafeArrayCreate(VT_BSTR,1,bound);
return S_OK;
}
STDMETHODIMP CTrust::GetDescription(/* [out] */ BSTR * description)
{
(*description) = SysAllocString(L"Sets up needed trusts between domains.");
return S_OK;
}
BOOL IsDownLevel(WCHAR * sComputer)
{
BOOL bDownlevel = TRUE;
WKSTA_INFO_100 * pInfo;
long rc = NetWkstaGetInfo(sComputer,100,(LPBYTE*)&pInfo);
if ( ! rc )
{
if ( pInfo->wki100_ver_major >= 5 )
{
bDownlevel = FALSE;
}
NetApiBufferFree(pInfo);
}
return bDownlevel;
}
// Helper function that finds a trusts in our varset list
LONG CTrust::FindInboundTrust(IVarSet * pVarSet,WCHAR * sName,LONG max)
{
LONG ndx = -1;
LONG curr = 0;
WCHAR key[100];
_bstr_t tName;
for ( curr = 0 ; curr < max ; curr++ )
{
swprintf(key,L"Trusts.%ld",curr);
tName = pVarSet->get(key);
if ( ! UStrICmp(tName,sName) )
{
// found it!
ndx = curr;
break;
}
}
return ndx;
}
HRESULT
CTrust::CheckAndCreateTrustingSide(
WCHAR * trustingDomain,
WCHAR * trustedDomain,
WCHAR * trustingComp,
WCHAR * trustedComp,
WCHAR * trustedDNSName,
BYTE * trustedSid,
BOOL bCreate,
BOOL bBidirectional
)
{
DWORD rc = S_OK;
// if credentials are specified, use them
LSA_HANDLE hTrusting = NULL;
NTSTATUS status;
LSA_AUTH_INFORMATION curr;
LSA_AUTH_INFORMATION prev;
WCHAR password[] = L"password";
if ( ! rc && bCreate )
{
status = OpenPolicy(trustingComp,POLICY_VIEW_LOCAL_INFORMATION
| POLICY_TRUST_ADMIN | POLICY_CREATE_SECRET,&hTrusting);
rc = LsaNtStatusToWinError(status);
if ( ! rc )
{
// set up the auth information for the trust relationship
curr.AuthInfo = (LPBYTE)password;
curr.AuthInfoLength = UStrLen(password) * sizeof(WCHAR);
curr.AuthType = TRUST_AUTH_TYPE_CLEAR;
curr.LastUpdateTime.QuadPart = 0;
prev.AuthInfo = (LPBYTE)password;
prev.AuthInfoLength = UStrLen(password) * sizeof(WCHAR);
prev.AuthType = TRUST_AUTH_TYPE_CLEAR;
prev.LastUpdateTime.QuadPart = 0;
// set up the trusting side of the relationship
if ( IsDownLevel(trustingComp) )
{
TRUSTED_DOMAIN_NAME_INFO nameInfo;
InitLsaString(&nameInfo.Name,const_cast<WCHAR*>(trustedDomain));
status = LsaSetTrustedDomainInformation(hTrusting,trustedSid,TrustedDomainNameInformation,&nameInfo);
rc = LsaNtStatusToWinError(status);
if ( ! rc || rc == ERROR_ALREADY_EXISTS )
{
// set the password for the new trust
TRUSTED_PASSWORD_INFO pwdInfo;
InitLsaString(&pwdInfo.Password,password);
InitLsaString(&pwdInfo.OldPassword,NULL);
status = LsaSetTrustedDomainInformation(hTrusting,trustedSid,TrustedPasswordInformation,&pwdInfo);
rc = LsaNtStatusToWinError(status);
}
}
else
{
// for Win2K domain, use LsaCreateTrustedDomainEx
// to create the trustedDomain object.
LSA_UNICODE_STRING sTemp;
TRUSTED_DOMAIN_INFORMATION_EX trustedInfo;
TRUSTED_DOMAIN_AUTH_INFORMATION trustAuth;
InitLsaString(&sTemp, const_cast<WCHAR*>(trustedDomain));
trustedInfo.FlatName = sTemp;
InitLsaString(&sTemp, trustedDNSName);
trustedInfo.Name = sTemp;
trustedInfo.Sid = trustedSid;
if ( IsDownLevel(trustedComp) )
{
trustedInfo.TrustAttributes = TRUST_TYPE_DOWNLEVEL;
}
else
{
trustedInfo.TrustAttributes = 0;
}
if ( bBidirectional )
trustedInfo.TrustDirection = TRUST_DIRECTION_BIDIRECTIONAL;
else
trustedInfo.TrustDirection = TRUST_DIRECTION_OUTBOUND;
trustedInfo.TrustType = TRUST_ATTRIBUTE_NON_TRANSITIVE;
trustAuth.IncomingAuthInfos = bBidirectional ? 1 : 0;
trustAuth.OutgoingAuthInfos = 1;
trustAuth.IncomingAuthenticationInformation = bBidirectional ? &curr : NULL;
trustAuth.IncomingPreviousAuthenticationInformation = NULL;
trustAuth.OutgoingAuthenticationInformation = &curr;
trustAuth.OutgoingPreviousAuthenticationInformation = NULL;
LSA_HANDLE hTemp = NULL;
status = LsaCreateTrustedDomainEx( hTrusting, &trustedInfo, &trustAuth, 0, &hTemp );
rc = LsaNtStatusToWinError(status);
// if the trust already exists, update its password
if ( status == STATUS_OBJECT_NAME_COLLISION )
{
TRUSTED_DOMAIN_INFORMATION_EX * pTrustedInfo = NULL;
status = LsaQueryTrustedDomainInfo(hTrusting,trustedSid,TrustedDomainInformationEx,(LPVOID*)&pTrustedInfo);
if ( ! status )
{
pTrustedInfo->TrustDirection |= trustedInfo.TrustDirection;
status = LsaSetTrustedDomainInfoByName(hTrusting,&trustedInfo.Name,TrustedDomainInformationEx,(LPVOID*)pTrustedInfo);
if ( ! status )
{
status = LsaSetTrustedDomainInfoByName(hTrusting,&trustedInfo.Name,TrustedDomainAuthInformation,(LPVOID*)&trustAuth);
}
}
rc = LsaNtStatusToWinError(status);
}
if( ! rc )
{
if (hTemp)
LsaClose(hTemp);
}
}
}
}
if ( hTrusting )
LsaClose(hTrusting);
return rc;
}
HRESULT
CTrust::CheckAndCreateTrustedSide(
WCHAR * trustingDomain,
WCHAR * trustedDomain,
WCHAR * trustingComp,
WCHAR * trustedComp,
WCHAR * trustingDNSName,
BYTE * trustingSid,
BOOL bCreate,
BOOL bBidirectional
)
{
DWORD rc = S_OK;
LSA_HANDLE hTrusted = NULL;
LSA_HANDLE hTrusting = NULL;
NTSTATUS status;
LSA_AUTH_INFORMATION curr;
LSA_AUTH_INFORMATION prev;
WCHAR password[] = L"password";
// if credentials are specified, use them
// open an LSA handle to the trusted domain
status = OpenPolicy(trustedComp,POLICY_VIEW_LOCAL_INFORMATION | POLICY_TRUST_ADMIN | POLICY_CREATE_SECRET,&hTrusted);
rc = LsaNtStatusToWinError(status);
if ( ! rc )
{
// set up the auth information for the trust relationship
curr.AuthInfo = (LPBYTE)password;
curr.AuthInfoLength = UStrLen(password) * sizeof(WCHAR);
curr.AuthType = TRUST_AUTH_TYPE_CLEAR;
curr.LastUpdateTime.QuadPart = 0;
prev.AuthInfo = (LPBYTE)password;
prev.AuthInfoLength = UStrLen(password) * sizeof(WCHAR);
prev.AuthType = TRUST_AUTH_TYPE_CLEAR;
prev.LastUpdateTime.QuadPart = 0;
// set up the trusted side of the relationship
if ( IsDownLevel(trustedComp) )
{
// create an inter-domain trust account for the trusting domain on the trusted domain
USER_INFO_1 uInfo;
DWORD parmErr;
WCHAR name[LEN_Account];
memset(&uInfo,0,(sizeof uInfo));
UStrCpy(name,trustingDomain);
name[UStrLen(name) + 1] = 0;
name[UStrLen(name)] = L'$';
if ( ! bCreate )
{
USER_INFO_1 * tempInfo = NULL;
rc = NetUserGetInfo(trustedComp,name,1,(LPBYTE*)&tempInfo);
if ( ! rc )
{
// the trust exists
NetApiBufferFree(tempInfo);
rc = NERR_UserExists;
}
else
{
if ( rc != NERR_UserNotFound )
{
err.SysMsgWrite(ErrE,rc,DCT_MSG_TRUSTING_DOM_GETINFO_FAILED_SSD,trustingDomain,trustedComp,rc);
}
}
}
else
{
// this creates the trust account if it doesn't already exist
// if the account does exist, reset its password
uInfo.usri1_flags = UF_SCRIPT | UF_INTERDOMAIN_TRUST_ACCOUNT;
uInfo.usri1_name = name;
uInfo.usri1_password = password;
uInfo.usri1_priv = 1;
rc = NetUserAdd(trustedComp,1,(LPBYTE)&uInfo,&parmErr);
if ( rc && rc != NERR_UserExists )
{
err.SysMsgWrite(ErrE,rc,DCT_MSG_TRUSTING_DOM_CREATE_FAILED_SSD,trustingDomain,trustedDomain,rc);
}
else if ( rc == NERR_UserExists )
{
// reset the password for the existing trust account
USER_INFO_1003 pwdInfo;
DWORD parmErr;
pwdInfo.usri1003_password = password;
rc = NetUserSetInfo(trustedComp,name,1003,(LPBYTE)&pwdInfo,&parmErr);
}
}
}
else
{
// Win2K, all trusts exist as trusted domain objects
// Create the trustedDomain object.
LSA_UNICODE_STRING sTemp;
TRUSTED_DOMAIN_INFORMATION_EX trustedInfo;
TRUSTED_DOMAIN_AUTH_INFORMATION trustAuth;
InitLsaString(&sTemp, const_cast<WCHAR*>(trustingDomain));
trustedInfo.FlatName = sTemp;
InitLsaString(&sTemp, trustingDNSName);
trustedInfo.Name = sTemp;
trustedInfo.Sid = trustingSid;
if ( IsDownLevel(trustingComp) )
{
trustedInfo.TrustAttributes = TRUST_TYPE_DOWNLEVEL;
}
else
{
trustedInfo.TrustAttributes = 0;
}
if ( bBidirectional )
trustedInfo.TrustDirection = TRUST_DIRECTION_BIDIRECTIONAL;
else
trustedInfo.TrustDirection = TRUST_DIRECTION_INBOUND;
trustedInfo.TrustType = TRUST_ATTRIBUTE_NON_TRANSITIVE;
trustAuth.IncomingAuthInfos = 1;
trustAuth.OutgoingAuthInfos = bBidirectional ? 1 : 0;
trustAuth.OutgoingAuthenticationInformation = bBidirectional ? &curr : NULL;
trustAuth.OutgoingPreviousAuthenticationInformation = NULL;
trustAuth.IncomingAuthenticationInformation = &curr;
trustAuth.IncomingPreviousAuthenticationInformation = NULL;
if ( bCreate )
{
status = LsaCreateTrustedDomainEx( hTrusted, &trustedInfo, &trustAuth, POLICY_VIEW_LOCAL_INFORMATION |
POLICY_TRUST_ADMIN | POLICY_CREATE_SECRET, &hTrusting );
if ( status == STATUS_OBJECT_NAME_COLLISION )
{
TRUSTED_DOMAIN_INFORMATION_EX * pTrustedInfo = NULL;
// Get the old information
status = LsaQueryTrustedDomainInfoByName(hTrusted,&sTemp,TrustedDomainInformationEx,(LPVOID*)&pTrustedInfo);
if ( ! status )
{
pTrustedInfo->TrustAttributes |= trustedInfo.TrustAttributes;
pTrustedInfo->TrustDirection |= trustedInfo.TrustDirection;
status = LsaSetTrustedDomainInfoByName(hTrusted,&sTemp,TrustedDomainInformationEx,pTrustedInfo);
if (! status )
{
status = LsaSetTrustedDomainInfoByName(hTrusted,&sTemp,TrustedDomainAuthInformation,&trustAuth);
}
LsaFreeMemory(pTrustedInfo);
}
}
}
else
{
TRUSTED_DOMAIN_INFORMATION_EX * pTrustedInfo = NULL;
status = LsaQueryTrustedDomainInfoByName(hTrusted,&sTemp,TrustedDomainInformationEx,(LPVOID*)&pTrustedInfo);
if ( ! status )
{
LsaFreeMemory(pTrustedInfo);
}
}
rc = LsaNtStatusToWinError(status);
if ( ! rc )
{
LsaClose(hTrusting);
hTrusting = NULL;
}
}
if ( bCreate && bBidirectional && IsDownLevel(trustingComp) )
{
// set up the trust account for the other side of the relationship
// For Win2K, both sides of the bidirectional trust are handled together,
// but NT4 bidirectional trusts require 2 separate actions
USER_INFO_1 uInfo;
DWORD parmErr;
WCHAR name2[LEN_Account];
memset(&uInfo,0,(sizeof uInfo));
UStrCpy(name2,trustedDomain);
name2[UStrLen(name2) + 1] = 0;
name2[UStrLen(name2)] = L'$';
uInfo.usri1_flags = UF_SCRIPT | UF_INTERDOMAIN_TRUST_ACCOUNT;
uInfo.usri1_name = name2;
uInfo.usri1_password = password;
uInfo.usri1_priv = 1;
rc = NetUserAdd(trustingComp,1,(LPBYTE)&uInfo,&parmErr);
if ( rc == NERR_UserExists )
{
LPUSER_INFO_1 puInfo;
rc = NetUserGetInfo(trustingComp, name2, 1, (LPBYTE*)&puInfo);
if ( !rc )
{
puInfo->usri1_flags &= UF_INTERDOMAIN_TRUST_ACCOUNT;
puInfo->usri1_password = password;
rc = NetUserSetInfo(trustingComp,name2,1,(LPBYTE)puInfo,&parmErr);
NetApiBufferFree(puInfo);
}
else
{
err.MsgWrite(0, DCT_MSG_INVALID_ACCOUNT_S, name2);
}
}
else if ( rc )
{
err.SysMsgWrite(ErrE,rc,DCT_MSG_TRUSTING_DOM_CREATE_FAILED_SSD,trustingDomain,trustedDomain,rc);
}
}
}
else
{
err.SysMsgWrite(ErrE,rc,DCT_MSG_LSA_OPEN_FAILED_SD,trustedComp,rc);
}
if( hTrusted )
LsaClose(hTrusted);
return rc;
}
// Helper function that gets DNS and NETBIOS domain names
void GetDnsAndNetbiosFromName(WCHAR const * name,WCHAR * netBios, WCHAR * dns)
{
IADs * pDomain = NULL;
WCHAR strText[1000];
_bstr_t distinguishedName;
// try to connect to the AD, using the specified name
swprintf(strText,L"LDAP://%ls",name);
netBios[0] = 0;
dns[0] = 0;
HRESULT hr = ADsGetObject(strText,IID_IADs,(void**)&pDomain);
if ( SUCCEEDED(hr) )
{
_variant_t var;
// get the DNS name from the LDAP provider
hr = pDomain->Get(L"distinguishedName",&var);
if ( SUCCEEDED(hr) )
{
WCHAR * dn = (WCHAR*)var.bstrVal;
WCHAR * curr = dns;
distinguishedName = dn;
if ( !UStrICmp(dn,L"DC=",3) )
{
// for each ",DC=" in the name, replace it with a .
for ( curr = dns, dn = dn+3 ; // skip the leading "DC="
*dn ; // until the end of the string is reached
curr++ //
)
{
if ( (L',' == *dn) && (L'D' == *(dn+1)) && (L'C' == *(dn+2)) && (L'=' == *(dn+3)) )
{
(*curr) = L'.';
dn+=4;
}
else
{
// just copy the character
(*curr) = (*dn);
dn++;
}
}
*(curr) = 0;
}
// get the NETBIOS name from the LDAP provider
hr = pDomain->Get(L"nETBIOSName",&var);
if ( SUCCEEDED(hr) )
{
UStrCpy(netBios,(WCHAR*)var.bstrVal);
}
else
{
// currently, the netbiosName property is not filled in
// so we will use a different method to get the flat-name for the domain
// Here is our strategy to get the netbios name:
// Enumerate the partitions container under the configuration container
// look for a CrossRef object whose nCName property matches the distinguished name
// we have for the domain. This object's CN property is the flat-name for the domain
// get the name of the configuration container
IADs * pDSE = NULL;
swprintf(strText,L"LDAP://%ls/RootDSE",name);
hr = ADsGetObject(strText,IID_IADs,(void**)&pDSE);
if ( SUCCEEDED(hr) )
{
hr = pDSE->Get(L"configurationNamingContext",&var);
if ( SUCCEEDED(hr) )
{
IADsContainer * pPart = NULL;
swprintf(strText,L"LDAP://%ls/CN=Partitions,%ls",name,var.bstrVal);
hr = ADsGetObject(strText,IID_IADsContainer,(void**)&pPart);
if ( SUCCEEDED(hr) )
{
IUnknown * pUnk = NULL;
IEnumVARIANT * pEnum = NULL;
IADs * pItem = NULL;
ULONG lFetch = 0;
// enumerate the contents of the Partitions container
hr = pPart->get__NewEnum(&pUnk);
if ( SUCCEEDED(hr) )
{
hr = pUnk->QueryInterface(IID_IEnumVARIANT,(void**)&pEnum);
pUnk->Release();
}
if ( SUCCEEDED(hr) )
{
hr = pEnum->Next(1,&var,&lFetch);
}
while ( hr == S_OK )
{
if (lFetch == 1 )
{
IDispatch * pDisp = V_DISPATCH(&var);
BSTR bstr;
if ( pDisp )
{
hr = pDisp->QueryInterface(IID_IADs, (void**)&pItem);
pDisp->Release();
if ( SUCCEEDED(hr) )
{
hr = pItem->get_Class(&bstr);
if ( !UStrICmp(bstr,L"crossRef") )
{
// see if this is the one we are looking for
hr = pItem->Get(L"nCName",&var);
if ( SUCCEEDED(hr) )
{
if ( !UStrICmp(var.bstrVal,(WCHAR*)distinguishedName) )
{
// this is the one we want!
hr = pItem->Get(L"cn",&var);
if ( SUCCEEDED(hr) )
{
UStrCpy(netBios,var.bstrVal);
pItem->Release();
SysFreeString(bstr);
break;
}
}
}
}
SysFreeString(bstr);
pItem->Release();
}
}
}
hr = pEnum->Next(1, &var, &lFetch);
}
pPart->Release();
if ( pEnum )
pEnum->Release();
}
}
pDSE->Release();
}
}
}
pDomain->Release();
}
else
{
// default to using the specified name as both DNS and NETBIOS
// this will work for NT 4 domains
UStrCpy(netBios,name);
UStrCpy(dns,name);
}
if ( ! (*netBios) )
{
UStrCpy(netBios,name);
WCHAR * temp = wcschr(netBios,L'.');
if ( temp )
*temp = 0;
}
if (! (*dns) )
{
UStrCpy(dns,name);
}
}
// Main function used to create trusts
HRESULT
CTrust::CheckAndCreate(
WCHAR * trustingDomain,
WCHAR * trustedDomain,
WCHAR * credDomainTrusting,
WCHAR * credAccountTrusting,
WCHAR * credPasswordTrusting,
WCHAR * credDomainTrusted,
WCHAR * credAccountTrusted,
WCHAR * credPasswordTrusted,
BOOL bCreate,
BOOL bBidirectional
)
{
// HRESULT hr = S_OK;
DWORD rc = 0;
WCHAR trustingDom[LEN_Domain];
WCHAR trustedDom[LEN_Domain];
WCHAR trustingComp[LEN_Computer];
WCHAR trustedComp[LEN_Computer];
WCHAR trustingDNSName[LEN_Path];
WCHAR trustedDNSName[LEN_Path];
BYTE trustingSid[200];
BYTE trustedSid[200];
WCHAR name[LEN_Account];
DWORD lenName = DIM(name);
DWORD lenSid = DIM(trustingSid);
SID_NAME_USE snu;
DOMAIN_CONTROLLER_INFO * pInfo;
WCHAR * curr = NULL;
BOOL bConnectTrusted = FALSE;
BOOL bConnectTrusting = FALSE;
// Get the DC names, and domain SIDs for the source and target domains
GetDnsAndNetbiosFromName(trustingDomain,trustingDom,trustingDNSName);
GetDnsAndNetbiosFromName(trustedDomain,trustedDom,trustedDNSName);
// make sure the NETBIOS domain names are in lower case
for ( curr = trustingDom ; *curr ; curr++ )
{
(*curr) = towupper(*curr);
}
for ( curr = trustedDom ; *curr ; curr++ )
{
(*curr) = towupper(*curr);
}
rc = DsGetDcName(NULL, trustingDom, NULL, NULL, DS_PDC_REQUIRED, &pInfo);
if ( !rc )
{
wcscpy(trustingComp,pInfo->DomainControllerName);
//wcscpy(trustingDNSName,pInfo->DomainName);
NetApiBufferFree(pInfo);
}
else
{
err.SysMsgWrite(ErrE,rc,DCT_MSG_GET_DCNAME_FAILED_SD,trustingDom,rc);
}
if ( ! rc )
{
rc = DsGetDcName(NULL, trustedDom, NULL, NULL, DS_PDC_REQUIRED, &pInfo);
if ( !rc )
{
wcscpy(trustedComp,pInfo->DomainControllerName);
// wcscpy(trustedDNSName,pInfo->DomainName);
NetApiBufferFree(pInfo);
}
else
{
err.SysMsgWrite(ErrE,rc,DCT_MSG_GET_DCNAME_FAILED_SD,trustedDom,rc);
}
}
if ( credAccountTrusted && *credAccountTrusted )
{
if ( EstablishSession(trustedComp,credDomainTrusted,credAccountTrusted,credPasswordTrusted,TRUE) )
{
bConnectTrusted = TRUE;
}
else
{
rc = GetLastError();
}
}
if ( credAccountTrusting && *credAccountTrusting )
{
if ( EstablishSession(trustingComp,credDomainTrusting,credAccountTrusting,credPasswordTrusting,TRUE) )
{
bConnectTrusting = TRUE;
}
else
{
rc = GetLastError();
}
}
// Need to get the computer name and the SIDs for the domains.
if ( ! rc && ! LookupAccountName(trustingComp,trustingDom,trustingSid,&lenSid,name,&lenName,&snu) )
{
rc = GetLastError();
err.SysMsgWrite(ErrE,rc,DCT_MSG_GET_DOMAIN_SID_FAILED_1,trustingDom,rc);
}
lenSid = DIM(trustedSid);
lenName = DIM(name);
if (! rc && ! LookupAccountName(trustedComp,trustedDom,trustedSid,&lenSid,name,&lenName,&snu) )
{
rc = GetLastError();
err.SysMsgWrite(ErrE,rc,DCT_MSG_GET_DOMAIN_SID_FAILED_1,trustedDom,rc);
}
// check the trusted side of the trust first
if ( ! rc )
{
rc = CheckAndCreateTrustedSide(trustingDom,trustedDom,trustingComp,trustedComp,trustingDNSName,trustingSid,
bCreate,bBidirectional);
}
if ( ! rc )
{
rc = CheckAndCreateTrustingSide(trustingDom,trustedDom,trustingComp,trustedComp,trustedDNSName,trustedSid,
bCreate,bBidirectional);
}
if ( bConnectTrusted )
{
EstablishSession(trustedComp,credDomainTrusted,credAccountTrusted,credPasswordTrusted,FALSE);
}
if ( bConnectTrusting )
{
EstablishSession(trustingComp,credDomainTrusting,credAccountTrusting,credPasswordTrusting,FALSE);
}
return HRESULT_FROM_WIN32(rc);
}
long CTrust::EnumerateTrustedDomains(WCHAR * domain,BOOL bIsTarget,IVarSet * pVarSet,long ndxStart)
{
DWORD rcOs; // OS return code
LSA_HANDLE hPolicy;
NTSTATUS status;
WCHAR computer[LEN_Computer];
DOMAIN_CONTROLLER_INFO * pInfo;
WCHAR sName[LEN_Domain];
WCHAR key[100];
long ndxTrust = ndxStart;
/* PDS_DOMAIN_TRUSTS *ChildDomains;
ULONG numChilds;
*/
err.MsgWrite(0,DCT_MSG_ENUMERATING_TRUSTED_DOMAINS_S,domain);
// open a handle to the source domain
rcOs = DsGetDcName(NULL, domain, NULL, NULL, 0, &pInfo);
if ( !rcOs )
{
wcscpy(computer,pInfo->DomainControllerName);
NetApiBufferFree(pInfo);
}
else
{
err.SysMsgWrite(ErrE,rcOs,DCT_MSG_GET_DCNAME_FAILED_SD,domain,rcOs);
}
if ( ! rcOs )
{
if ( IsDownLevel(computer) )
{
//Enumerate the trusted domains until there are no more to return.
status = OpenPolicy(computer,POLICY_ALL_ACCESS | POLICY_VIEW_LOCAL_INFORMATION ,&hPolicy);
if ( status == STATUS_SUCCESS )
{
LSA_ENUMERATION_HANDLE lsaEnumHandle=0; // start an enum
PLSA_TRUST_INFORMATION trustInfo = NULL;
ULONG ulReturned; // number of items returned
NTSTATUS status;
DWORD rc;
do {
status = LsaEnumerateTrustedDomains(
hPolicy, // open policy handle
&lsaEnumHandle, // enumeration tracker
(void**)&trustInfo, // buffer to receive data
32000, // recommended buffer size
&ulReturned // number of items returned
);
//Check the return status for error.
rc = LsaNtStatusToWinError(status);
if( (rc != ERROR_SUCCESS) &&
(rc != ERROR_MORE_DATA) &&
(rc != ERROR_NO_MORE_ITEMS)
)
{
err.SysMsgWrite(ErrE,rcOs,DCT_MSG_TRUSTED_ENUM_FAILED_SD,domain,rcOs);
}
else
{
// . . . Code to use the Trusted Domain information
for ( ULONG ndx = 0 ; ndx < ulReturned ; ndx++ )
{
_bstr_t direction;
UStrCpy(sName,trustInfo[ndx].Name.Buffer, ( trustInfo[ndx].Name.Length / (sizeof WCHAR)) + 1);
TRUSTED_DOMAIN_INFORMATION_EX * pTrustedInfo = NULL;
status = LsaQueryTrustedDomainInfo(hPolicy,trustInfo[ndx].Sid,TrustedDomainInformationEx,(LPVOID*)&pTrustedInfo);
if ( ! status )
{
switch ( pTrustedInfo->TrustDirection )
{
case TRUST_DIRECTION_DISABLED:
direction = GET_BSTR(IDS_TRUST_DIRECTION_DISABLED);
break;
case TRUST_DIRECTION_INBOUND:
direction = GET_BSTR(IDS_TRUST_DIRECTION_INBOUND);
break;
case TRUST_DIRECTION_OUTBOUND:
direction = GET_BSTR(IDS_TRUST_DIRECTION_OUTBOUND);
break;
case TRUST_DIRECTION_BIDIRECTIONAL:
direction = GET_BSTR(IDS_TRUST_DIRECTION_BIDIRECTIONAL);
break;
default:
break;
};
if ( ! bIsTarget )
{
swprintf(key,L"Trusts.%ld.Type",ndxTrust);
pVarSet->put(key, GET_BSTR(IDS_TRUST_RELATION_EXTERNAL));
}
LsaFreeMemory(pTrustedInfo);
}
else
{
rcOs = LsaNtStatusToWinError(status);
// My logic here is that we are checking Trusted domains here so this is atleast true
// check whether this trust is already listed as an inbound trust
//* direction = L"Outbound";
direction = GET_BSTR(IDS_TRUST_DIRECTION_OUTBOUND);
}
if ( ! bIsTarget )
{
swprintf(key,L"Trusts.%ld",ndxTrust);
pVarSet->put(key,sName);
swprintf(key,L"Trusts.%ld.Direction",ndxTrust);
pVarSet->put(key,direction);
swprintf(key,L"Trusts.%ld.ExistsForTarget",ndxTrust);
//* pVarSet->put(key,L"No");
pVarSet->put(key,GET_BSTR(IDS_No));
err.MsgWrite(0,DCT_MSG_SOURCE_TRUSTS_THIS_SS,sName,domain);
}
long ndx2 = FindInboundTrust(pVarSet,sName,ndxTrust);
if ( ndx2 != -1 )
{
if ( ! bIsTarget )
{
// we've already seen this trust as an inbound trust
// update the existing record!
WCHAR key2[1000];
swprintf(key2,L"Trusts.%ld.Direction",ndx2);
//* pVarSet->put(key2,L"Bidirectional");
pVarSet->put(key2,GET_BSTR(IDS_TRUST_DIRECTION_BIDIRECTIONAL));
continue; // don't update the trust entry index, since we used the existing
// entry instead of creating a new one
}
else
{
swprintf(key,L"Trusts.%ld.ExistsForTarget",ndx2);
//* pVarSet->put(key,L"Yes");
pVarSet->put(key,GET_BSTR(IDS_YES));
err.MsgWrite(0,DCT_MSG_TARGET_TRUSTS_THIS_SS,domain,sName);
}
}
swprintf(key,L"Trusts.%ld.ExistsForTarget",ndxTrust);
// check the trusted domain, to see if the target already trusts it
//if ( UStrICmp(sName,target) )
// {
// continue;
// }
if ( ! bIsTarget )
ndxTrust++;
}
// Free the buffer.
LsaFreeMemory(trustInfo);
}
} while (rc == ERROR_SUCCESS || rc == ERROR_MORE_DATA );
LsaClose(hPolicy);
}
}
else
{
ULONG ulCount;
PDS_DOMAIN_TRUSTS pDomainTrusts;
DWORD dwError = DsEnumerateDomainTrusts(
computer,
DS_DOMAIN_IN_FOREST|DS_DOMAIN_DIRECT_INBOUND|DS_DOMAIN_DIRECT_OUTBOUND,
&pDomainTrusts,
&ulCount
);
if (dwError == NO_ERROR)
{
ULONG ulIndex;
ULONG ulDomainIndex = (ULONG)-1L;
ULONG ulParentIndex = (ULONG)-1L;
// find local domain
for (ulIndex = 0; ulIndex < ulCount; ulIndex++)
{
if (pDomainTrusts[ulIndex].Flags & DS_DOMAIN_PRIMARY)
{
ulDomainIndex = ulIndex;
if (!(pDomainTrusts[ulIndex].Flags & DS_DOMAIN_TREE_ROOT))
{
ulParentIndex = pDomainTrusts[ulIndex].ParentIndex;
}
break;
}
}
for (ulIndex = 0; ulIndex < ulCount; ulIndex++)
{
DS_DOMAIN_TRUSTS& rDomainTrust = pDomainTrusts[ulIndex];
// filter out indirect trusts
if (!(rDomainTrust.Flags & (DS_DOMAIN_DIRECT_INBOUND|DS_DOMAIN_DIRECT_OUTBOUND)))
{
continue;
}
// trusted or trusting domain name
_bstr_t bstrName(rDomainTrust.NetbiosDomainName);
// trust direction
_bstr_t bstrDirection;
switch (rDomainTrust.Flags & (DS_DOMAIN_DIRECT_INBOUND|DS_DOMAIN_DIRECT_OUTBOUND))
{
case DS_DOMAIN_DIRECT_INBOUND:
bstrDirection = GET_BSTR(IDS_TRUST_DIRECTION_INBOUND);
break;
case DS_DOMAIN_DIRECT_OUTBOUND:
bstrDirection = GET_BSTR(IDS_TRUST_DIRECTION_OUTBOUND);
break;
case DS_DOMAIN_DIRECT_INBOUND|DS_DOMAIN_DIRECT_OUTBOUND:
bstrDirection = GET_BSTR(IDS_TRUST_DIRECTION_BIDIRECTIONAL);
break;
default:
// bstrDirection = ;
break;
}
// trust relationship
_bstr_t bstrRelationship;
if (ulIndex == ulParentIndex)
{
bstrRelationship = GET_BSTR(IDS_TRUST_RELATION_PARENT);
}
else if (rDomainTrust.Flags & DS_DOMAIN_IN_FOREST)
{
if (rDomainTrust.ParentIndex == ulDomainIndex)
{
bstrRelationship = GET_BSTR(IDS_TRUST_RELATION_CHILD);
}
else if ((rDomainTrust.Flags & DS_DOMAIN_TREE_ROOT) && (pDomainTrusts[ulDomainIndex].Flags & DS_DOMAIN_TREE_ROOT))
{
bstrRelationship = GET_BSTR(IDS_TRUST_RELATION_ROOT);
}
else
{
bstrRelationship = GET_BSTR(IDS_TRUST_RELATION_SHORTCUT);
}
}
else
{
switch (rDomainTrust.TrustType)
{
case TRUST_TYPE_DOWNLEVEL:
case TRUST_TYPE_UPLEVEL:
bstrRelationship = (rDomainTrust.TrustAttributes & TRUST_ATTRIBUTE_FOREST_TRANSITIVE) ? GET_BSTR(IDS_TRUST_RELATION_FOREST) : GET_BSTR(IDS_TRUST_RELATION_EXTERNAL);
break;
case TRUST_TYPE_MIT:
bstrRelationship = GET_BSTR(IDS_TRUST_RELATION_MIT);
break;
case TRUST_TYPE_DCE:
bstrRelationship = GET_BSTR(IDS_TRUST_RELATION_DCE);
break;
default:
bstrRelationship = GET_BSTR(IDS_TRUST_RELATION_UNKNOWN);
break;
}
}
if (bIsTarget)
{
// if same trust was found on source domain and the trust
// directions match update exists for target to yes
LONG lSourceIndex = FindInboundTrust(pVarSet, bstrName, ndxTrust);
if (lSourceIndex >= 0)
{
// get source trust direction
swprintf(key, L"Trusts.%ld.Direction", lSourceIndex);
_bstr_t bstrSourceDirection = pVarSet->get(key);
// if target trust direction is bi-directional or
// target trust direction equals source trust direction
// then set exists for target to yes
bool bExists = false;
if (bstrDirection == GET_BSTR(IDS_TRUST_DIRECTION_BIDIRECTIONAL))
{
bExists = true;
}
else if (bstrDirection == bstrSourceDirection)
{
bExists = true;
}
if (bExists)
{
swprintf(key, L"Trusts.%ld.ExistsForTarget", lSourceIndex);
pVarSet->put(key, GET_BSTR(IDS_YES));
// write trust directions to log
if (rDomainTrust.Flags & DS_DOMAIN_DIRECT_OUTBOUND)
{
err.MsgWrite(0, DCT_MSG_TARGET_TRUSTS_THIS_SS, domain, (LPCTSTR)bstrName);
}
if (rDomainTrust.Flags & DS_DOMAIN_DIRECT_INBOUND)
{
err.MsgWrite(0, DCT_MSG_TARGET_TRUSTED_BY_THIS_SS, domain, (LPCTSTR)bstrName);
}
}
}
}
else
{
// domain name
swprintf(key, L"Trusts.%ld", ndxTrust);
pVarSet->put(key, bstrName);
// trust direction
swprintf(key, L"Trusts.%ld.Direction", ndxTrust);
pVarSet->put(key, bstrDirection);
// trust relationship
if (bstrRelationship.length() > 0)
{
swprintf(key, L"Trusts.%ld.Type", ndxTrust);
pVarSet->put(key, bstrRelationship);
}
// trust exists on target
// initially set to no until target domain is enumerated
swprintf(key, L"Trusts.%ld.ExistsForTarget", ndxTrust);
pVarSet->put(key, GET_BSTR(IDS_No));
// write trust directions to log
if (rDomainTrust.Flags & DS_DOMAIN_DIRECT_OUTBOUND)
{
err.MsgWrite(0, DCT_MSG_SOURCE_TRUSTS_THIS_SS, (LPCTSTR)bstrName, domain);
}
if (rDomainTrust.Flags & DS_DOMAIN_DIRECT_INBOUND)
{
err.MsgWrite(0, DCT_MSG_SOURCE_IS_TRUSTED_BY_THIS_SS, (LPCTSTR)bstrName, domain);
}
++ndxTrust;
}
}
NetApiBufferFree(pDomainTrusts);
}
else
{
err.SysMsgWrite(ErrE, dwError, DCT_MSG_TRUSTED_ENUM_FAILED_SD, domain, dwError);
}
}
}
if ( bIsTarget )
{
// make sure we have "Yes" for the target domain itself
long ndx2 = FindInboundTrust(pVarSet,domain,ndxTrust);
if ( ndx2 != -1 )
{
swprintf(key,L"Trusts.%ld.ExistsForTarget",ndx2);
//* pVarSet->put(key,L"Yes");
pVarSet->put(key,GET_BSTR(IDS_YES));
}
}
return ndxTrust;
}
long CTrust::EnumerateTrustingDomains(WCHAR * domain,BOOL bIsTarget,IVarSet * pVarSet,long ndxStart)
{
DWORD rcOs; // OS return code
DWORD hEnum=0; // enumeration handle
USER_INFO_1 * pNetUsers=NULL; // NetUserEnum array buffer
USER_INFO_1 * pNetUser; // NetUserEnum array item
DWORD nRead; // Entries read.
DWORD nTotal; // Entries total.
WCHAR sName[LEN_Domain]; // Domain name
WCHAR * pNameEnd; // Null at end
WCHAR computer[LEN_Computer];
DOMAIN_CONTROLLER_INFO * pInfo;
long ndx = ndxStart;
WCHAR key[100];
err.MsgWrite(0,DCT_MSG_ENUMERATING_TRUSTING_DOMAINS_S,domain);
do
{
rcOs = DsGetDcName(NULL, domain, NULL, NULL, 0, &pInfo);
if ( !rcOs )
{
wcscpy(computer,pInfo->DomainControllerName);
NetApiBufferFree(pInfo);
}
else
{
break;
}
// get the trusting domains for the NT 4 domain
// for Win2K domains, the trusting domains will be listed as Incoming in the Trusted Domain enumeration
if ( IsDownLevel(computer) )
{
nRead = 0;
nTotal = 0;
rcOs = NetUserEnum(
computer,
1,
FILTER_INTERDOMAIN_TRUST_ACCOUNT,
(BYTE **) &pNetUsers,
10240,
&nRead,
&nTotal,
&hEnum );
switch ( rcOs )
{
case 0:
case ERROR_MORE_DATA:
for ( pNetUser = pNetUsers;
pNetUser < pNetUsers + nRead;
pNetUser++ )
{
// skip trust accounts whose password age is older than 30 days to avoid
// delays caused by trying to enumerate defunct trusts
if ( pNetUser->usri1_password_age > 60 * 60 * 24 * 30 ) // 30 days (age is in seconds)
{
err.MsgWrite(0,DCT_MSG_SKIPPING_OLD_TRUST_SD,pNetUser->usri1_name,
pNetUser->usri1_password_age / ( 60*60*24) );
continue;
}
safecopy( sName, pNetUser->usri1_name );
pNameEnd = sName + UStrLen( sName );
if ( (pNameEnd > sName) && (pNameEnd[-1] == L'$') )
{
pNameEnd[-1] = L'\0';
}
if ( *sName )
{
// Found a (probably) valid trust!
if ( ! bIsTarget )
{
// for the source domain, simply add the trusts to the list in the varset
swprintf(key,L"Trusts.%ld",ndx);
pVarSet->put(key,sName);
swprintf(key,L"Trusts.%ld.Direction",ndx);
//* pVarSet->put(key,L"Inbound");
pVarSet->put(key,GET_BSTR(IDS_TRUST_DIRECTION_INBOUND));
swprintf(key,L"Trusts.%ld.Type",ndx);
pVarSet->put(key, GET_BSTR(IDS_TRUST_RELATION_EXTERNAL));
swprintf(key,L"Trusts.%ld.ExistsForTarget",ndx);
//* pVarSet->put(key,L"No");
pVarSet->put(key,GET_BSTR(IDS_No));
err.MsgWrite(0,DCT_MSG_SOURCE_IS_TRUSTED_BY_THIS_SS,sName,domain);
ndx++;
}
else
{
// for the target domain, look for this trust in the varset
// and if it is there, mark that it exists on the target
long ndxTemp = FindInboundTrust(pVarSet,sName,ndxStart);
if ( ndxTemp != -1 )
{
swprintf(key,L"Trusts.%ld.ExistsForTarget",ndxTemp);
//* pVarSet->put(key,L"Yes");
pVarSet->put(key,GET_BSTR(IDS_YES));
err.MsgWrite(0,DCT_MSG_TARGET_TRUSTS_THIS_SS,sName,domain);
}
}
}
}
break;
default:
break;
}
if ( pNetUsers )
{
NetApiBufferFree( pNetUsers );
pNetUsers = NULL;
}
}
else // if IsDownLevel()
{
// Win2K domain, don't need to enumerate the trusting domains here - they will all be included in the
// trusted domain enum
break;
}
} while ( rcOs == ERROR_MORE_DATA );
return ndx;
}
/*void CheckProc(void * arg,void * data)
{
CTrust * tr = (CTrust*)arg;
}*/
STDMETHODIMP CTrust::PreMigrationTask(/* [in] */IUnknown * pVarSet)
{
/* IVarSetPtr pVS = pVarSet;
BOOL bCreate;
_bstr_t source = pVS->get(GET_BSTR(DCTVS_Options_SourceDomain));
_bstr_t target = pVS->get(GET_BSTR(DCTVS_Options_TargetDomain));
_bstr_t logfile = pVS->get(GET_BSTR(DCTVS_Options_Logfile));
_bstr_t localOnly = pVS->get(GET_BSTR(DCTVS_Options_LocalProcessingOnly));
_bstr_t docreate = pVS->get(L"Options.CreateTrusts");
if ( !UStrICmp(localOnly,GET_STRING(IDS_YES)) )
{
// don't do anything in local agent mode
return S_OK;
}
if ( !UStrICmp(docreate,GET_STRING(IDS_YES)) )
{
bCreate = TRUE;
}
else
{
bCreate = FALSE;
}
pVS->put(GET_BSTR(DCTVS_CurrentOperation),L"Verifying trust relationships");
err.LogOpen(logfile,1);
err.LevelBeepSet(1000);
err.LogClose();
*/
return S_OK;
}
STDMETHODIMP CTrust::PostMigrationTask(/* [in] */IUnknown * pVarSet)
{
return S_OK;
}
STDMETHODIMP CTrust::GetName(/* [out] */BSTR * name)
{
(*name) = SysAllocString(L"Trust Manager");
return S_OK;
}
STDMETHODIMP CTrust::GetResultString(/* [in] */IUnknown * pVarSet,/* [out] */ BSTR * text)
{
WCHAR buffer[100] = L"";
IVarSetPtr pVS;
pVS = pVarSet;
(*text) = SysAllocString(buffer);
return S_OK;
}
STDMETHODIMP CTrust::StoreResults(/* [in] */IUnknown * pVarSet)
{
return S_OK;
}
STDMETHODIMP CTrust::ConfigureSettings(/*[in]*/IUnknown * pVarSet)
{
return S_OK;
}
STDMETHODIMP CTrust::QueryTrusts(BSTR domainSource,BSTR domainTarget, BSTR sLogFile, IUnknown **pVarSet)
{
HRESULT hr = S_OK;
IVarSetPtr pVS(CLSID_VarSet);
long ndx;
_bstr_t sFile = sLogFile;
err.LogOpen((WCHAR*) sFile, 1);
err.LevelBeepSet(1000);
hr = pVS.QueryInterface(IID_IUnknown,(long**)pVarSet);
// Add a blank line to help differentiate different runs
err.MsgWrite(0,DCT_MSG_GENERIC_S,L"");
ndx = EnumerateTrustingDomains(domainSource,FALSE,pVS,0);
EnumerateTrustingDomains(domainTarget,TRUE,pVS,0);
ndx = EnumerateTrustedDomains(domainSource,FALSE,pVS,ndx);
EnumerateTrustedDomains(domainTarget,TRUE,pVS,ndx);
//err.LogClose();
pVS->put(L"Trusts",ndx);
return hr;
}