?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r11684: freezing 3.0.21rc1 (current with SAMBA_3_0 r11667)
[Samba.git] / source / rpc_server / srv_netlog_nt.c
blob7903adff6d59a91185ae4f26371565a7d3f4de5b
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997.
7 * Copyright (C) Jeremy Allison 1998-2001.
8 * Copyright (C) Andrew Bartlett 2001.
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 */
24
25 /* This is the implementation of the netlogon pipe. */
26
27 #include "includes.h"
28
29 extern userdom_struct current_user_info;
30
31 #undef DBGC_CLASS
32 #define DBGC_CLASS DBGC_RPC_SRV
33
34 /*************************************************************************
35 init_net_r_req_chal:
36 *************************************************************************/
37
38 static void init_net_r_req_chal(NET_R_REQ_CHAL *r_c,
39 DOM_CHAL *srv_chal, NTSTATUS status)
40 {
41 DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__));
42 memcpy(r_c->srv_chal.data, srv_chal->data, sizeof(srv_chal->data));
43 r_c->status = status;
44 }
45
46 /*************************************************************************
47 error messages cropping up when using nltest.exe...
48 *************************************************************************/
49
50 #define ERROR_NO_SUCH_DOMAIN 0x54b
51 #define ERROR_NO_LOGON_SERVERS 0x51f
52 #define NO_ERROR 0x0
53
54 /*************************************************************************
55 net_reply_logon_ctrl:
56 *************************************************************************/
57
58 NTSTATUS _net_logon_ctrl(pipes_struct *p, NET_Q_LOGON_CTRL *q_u,
59 NET_R_LOGON_CTRL *r_u)
60 {
61 uint32 flags = 0x0;
62 uint32 pdc_connection_status = 0x00; /* Maybe a win32 error code? */
63
64 /* Setup the Logon Control response */
65
66 init_net_r_logon_ctrl(r_u, q_u->query_level, flags,
67 pdc_connection_status);
68
69 return r_u->status;
70 }
71
72 /****************************************************************************
73 Send a message to smbd to do a sam synchronisation
74 **************************************************************************/
75
76 static void send_sync_message(void)
77 {
78 TDB_CONTEXT *tdb;
79
80 tdb = tdb_open_log(lock_path("connections.tdb"), 0,
81 TDB_DEFAULT, O_RDONLY, 0);
82
83 if (!tdb) {
84 DEBUG(3, ("send_sync_message(): failed to open connections "
85 "database\n"));
86 return;
87 }
88
89 DEBUG(3, ("sending sam synchronisation message\n"));
90
91 message_send_all(tdb, MSG_SMB_SAM_SYNC, NULL, 0, False, NULL);
92
93 tdb_close(tdb);
94 }
95
96 /*************************************************************************
97 net_reply_logon_ctrl2:
98 *************************************************************************/
99
100 NTSTATUS _net_logon_ctrl2(pipes_struct *p, NET_Q_LOGON_CTRL2 *q_u, NET_R_LOGON_CTRL2 *r_u)
101 {
102 uint32 flags = 0x0;
103 uint32 pdc_connection_status = 0x0;
104 uint32 logon_attempts = 0x0;
105 uint32 tc_status;
106 fstring servername, domain, dc_name, dc_name2;
107 struct in_addr dc_ip;
108
109 /* this should be \\global_myname() */
110 unistr2_to_ascii(servername, &q_u->uni_server_name, sizeof(servername));
111
112 r_u->status = NT_STATUS_OK;
113
114 tc_status = ERROR_NO_SUCH_DOMAIN;
115 fstrcpy( dc_name, "" );
116
117 switch ( q_u->function_code ) {
118 case NETLOGON_CONTROL_TC_QUERY:
119 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
120
121 if ( !is_trusted_domain( domain ) )
122 break;
123
124 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ip ) ) {
125 tc_status = ERROR_NO_LOGON_SERVERS;
126 break;
127 }
128
129 fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
130
131 tc_status = NO_ERROR;
132
133 break;
134
135 case NETLOGON_CONTROL_REDISCOVER:
136 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
137
138 if ( !is_trusted_domain( domain ) )
139 break;
140
141 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ip ) ) {
142 tc_status = ERROR_NO_LOGON_SERVERS;
143 break;
144 }
145
146 fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
147
148 tc_status = NO_ERROR;
149
150 break;
151
152 default:
153 /* no idea what this should be */
154 DEBUG(0,("_net_logon_ctrl2: unimplemented function level [%d]\n",
155 q_u->function_code));
156 }
157
158 /* prepare the response */
159
160 init_net_r_logon_ctrl2( r_u, q_u->query_level, flags,
161 pdc_connection_status, logon_attempts, tc_status, dc_name );
162
163 if (lp_server_role() == ROLE_DOMAIN_BDC)
164 send_sync_message();
165
166 return r_u->status;
167 }
168
169 /*************************************************************************
170 net_reply_trust_dom_list:
171 *************************************************************************/
172
173 NTSTATUS _net_trust_dom_list(pipes_struct *p, NET_Q_TRUST_DOM_LIST *q_u, NET_R_TRUST_DOM_LIST *r_u)
174 {
175 const char *trusted_domain = "test_domain";
176 uint32 num_trust_domains = 1;
177
178 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
179
180 /* set up the Trusted Domain List response */
181 init_r_trust_dom(r_u, num_trust_domains, trusted_domain);
182
183 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
184
185 return r_u->status;
186 }
187
188 /***********************************************************************************
189 init_net_r_srv_pwset:
190 ***********************************************************************************/
191
192 static void init_net_r_srv_pwset(NET_R_SRV_PWSET *r_s,
193 DOM_CRED *srv_cred, NTSTATUS status)
194 {
195 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
196
197 memcpy(&r_s->srv_cred, srv_cred, sizeof(r_s->srv_cred));
198 r_s->status = status;
199
200 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
201 }
202
203 /******************************************************************
204 gets a machine password entry. checks access rights of the host.
205 ******************************************************************/
206
207 static BOOL get_md4pw(char *md4pw, char *mach_acct)
208 {
209 SAM_ACCOUNT *sampass = NULL;
210 const uint8 *pass;
211 BOOL ret;
212 uint32 acct_ctrl;
213
214 #if 0
215 /*
216 * Currently this code is redundent as we already have a filter
217 * by hostname list. What this code really needs to do is to
218 * get a hosts allowed/hosts denied list from the SAM database
219 * on a per user basis, and make the access decision there.
220 * I will leave this code here for now as a reminder to implement
221 * this at a later date. JRA.
222 */
223
224 if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
225 client_name(), client_addr()))
226 {
227 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
228 return False;
229 }
230 #endif /* 0 */
231
232 if(!NT_STATUS_IS_OK(pdb_init_sam(&sampass)))
233 return False;
234
235 /* JRA. This is ok as it is only used for generating the challenge. */
236 become_root();
237 ret=pdb_getsampwnam(sampass, mach_acct);
238 unbecome_root();
239
240 if (ret==False) {
241 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
242 pdb_free_sam(&sampass);
243 return False;
244 }
245
246 acct_ctrl = pdb_get_acct_ctrl(sampass);
247 if (!(acct_ctrl & ACB_DISABLED) &&
248 ((acct_ctrl & ACB_DOMTRUST) ||
249 (acct_ctrl & ACB_WSTRUST) ||
250 (acct_ctrl & ACB_SVRTRUST)) &&
251 ((pass=pdb_get_nt_passwd(sampass)) != NULL)) {
252 memcpy(md4pw, pass, 16);
253 dump_data(5, md4pw, 16);
254 pdb_free_sam(&sampass);
255 return True;
256 }
257
258 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
259 pdb_free_sam(&sampass);
260 return False;
261
262 }
263
264 /*************************************************************************
265 _net_req_chal
266 *************************************************************************/
267
268 NTSTATUS _net_req_chal(pipes_struct *p, NET_Q_REQ_CHAL *q_u, NET_R_REQ_CHAL *r_u)
269 {
270 if (!p->dc) {
271 p->dc = TALLOC_ZERO_P(p->pipe_state_mem_ctx, struct dcinfo);
272 if (!p->dc) {
273 return NT_STATUS_NO_MEMORY;
274 }
275 } else {
276 DEBUG(10,("_net_req_chal: new challenge requested. Clearing old state.\n"));
277 ZERO_STRUCTP(p->dc);
278 }
279
280 rpcstr_pull(p->dc->remote_machine,
281 q_u->uni_logon_clnt.buffer,
282 sizeof(fstring),q_u->uni_logon_clnt.uni_str_len*2,0);
283
284 /* Save the client challenge to the server. */
285 memcpy(p->dc->clnt_chal.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data));
286
287 /* Create a server challenge for the client */
288 /* Set this to a random value. */
289 generate_random_buffer(p->dc->srv_chal.data, 8);
290
291 /* set up the LSA REQUEST CHALLENGE response */
292 init_net_r_req_chal(r_u, &p->dc->srv_chal, NT_STATUS_OK);
293
294 p->dc->challenge_sent = True;
295
296 return NT_STATUS_OK;
297 }
298
299 /*************************************************************************
300 init_net_r_auth:
301 *************************************************************************/
302
303 static void init_net_r_auth(NET_R_AUTH *r_a, DOM_CHAL *resp_cred, NTSTATUS status)
304 {
305 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
306 r_a->status = status;
307 }
308
309 /*************************************************************************
310 _net_auth. Create the initial credentials.
311 *************************************************************************/
312
313 NTSTATUS _net_auth(pipes_struct *p, NET_Q_AUTH *q_u, NET_R_AUTH *r_u)
314 {
315 fstring mach_acct;
316 fstring remote_machine;
317 DOM_CHAL srv_chal_out;
318
319 if (!p->dc || !p->dc->challenge_sent) {
320 return NT_STATUS_ACCESS_DENIED;
321 }
322
323 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
324 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
325 rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
326 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
327
328 if (!get_md4pw((char *)p->dc->mach_pw, mach_acct)) {
329 DEBUG(0,("_net_auth: creds_server_check failed. Failed to "
330 "get pasword for machine account %s "
331 "from client %s\n",
332 mach_acct, remote_machine ));
333 return NT_STATUS_ACCESS_DENIED;
334 }
335
336 /* From the client / server challenges and md4 password, generate sess key */
337 creds_server_init(p->dc,
338 &p->dc->clnt_chal, /* Stored client chal. */
339 &p->dc->srv_chal, /* Stored server chal. */
340 (const char *)p->dc->mach_pw,
341 &srv_chal_out);
342
343 /* Check client credentials are valid. */
344 if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
345 DEBUG(0,("_net_auth: creds_server_check failed. Rejecting auth "
346 "request from client %s machine account %s\n",
347 remote_machine, mach_acct ));
348 return NT_STATUS_ACCESS_DENIED;
349 }
350
351 fstrcpy(p->dc->mach_acct, mach_acct);
352 fstrcpy(p->dc->remote_machine, remote_machine);
353 p->dc->authenticated = True;
354
355 /* set up the LSA AUTH response */
356 /* Return the server credentials. */
357 init_net_r_auth(r_u, &srv_chal_out, NT_STATUS_OK);
358
359 return r_u->status;
360 }
361
362 /*************************************************************************
363 init_net_r_auth_2:
364 *************************************************************************/
365
366 static void init_net_r_auth_2(NET_R_AUTH_2 *r_a,
367 DOM_CHAL *resp_cred, NEG_FLAGS *flgs, NTSTATUS status)
368 {
369 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
370 memcpy(&r_a->srv_flgs, flgs, sizeof(r_a->srv_flgs));
371 r_a->status = status;
372 }
373
374 /*************************************************************************
375 _net_auth_2
376 *************************************************************************/
377
378 NTSTATUS _net_auth_2(pipes_struct *p, NET_Q_AUTH_2 *q_u, NET_R_AUTH_2 *r_u)
379 {
380 NEG_FLAGS srv_flgs;
381 fstring mach_acct;
382 fstring remote_machine;
383 DOM_CHAL srv_chal_out;
384
385 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
386 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
387 rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
388 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
389
390 if (!p->dc || !p->dc->challenge_sent) {
391 DEBUG(0,("_net_auth2: no challenge sent to client %s\n",
392 remote_machine ));
393 return NT_STATUS_ACCESS_DENIED;
394 }
395
396 if ( (lp_server_schannel() == True) &&
397 ((q_u->clnt_flgs.neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
398
399 /* schannel must be used, but client did not offer it. */
400 DEBUG(0,("_net_auth2: schannel required but client failed "
401 "to offer it. Client was %s\n",
402 mach_acct ));
403 return NT_STATUS_ACCESS_DENIED;
404 }
405
406 if (!get_md4pw((char *)p->dc->mach_pw, mach_acct)) {
407 DEBUG(0,("_net_auth2: failed to get machine password for "
408 "account %s\n",
409 mach_acct ));
410 return NT_STATUS_ACCESS_DENIED;
411 }
412
413 /* From the client / server challenges and md4 password, generate sess key */
414 creds_server_init(p->dc,
415 &p->dc->clnt_chal, /* Stored client chal. */
416 &p->dc->srv_chal, /* Stored server chal. */
417 (const char *)p->dc->mach_pw,
418 &srv_chal_out);
419
420 /* Check client credentials are valid. */
421 if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
422 DEBUG(0,("_net_auth2: creds_server_check failed. Rejecting auth "
423 "request from client %s machine account %s\n",
424 remote_machine, mach_acct ));
425 return NT_STATUS_ACCESS_DENIED;
426 }
427
428 srv_flgs.neg_flags = 0x000001ff;
429
430 if (lp_server_schannel() != False) {
431 srv_flgs.neg_flags |= NETLOGON_NEG_SCHANNEL;
432 }
433
434 /* set up the LSA AUTH 2 response */
435 init_net_r_auth_2(r_u, &srv_chal_out, &srv_flgs, NT_STATUS_OK);
436
437 fstrcpy(p->dc->mach_acct, mach_acct);
438 fstrcpy(p->dc->remote_machine, remote_machine);
439 fstrcpy(p->dc->domain, lp_workgroup() );
440
441 p->dc->authenticated = True;
442
443 /* Store off the state so we can continue after client disconnect. */
444 become_root();
445 secrets_store_schannel_session_info(p->mem_ctx, p->dc);
446 unbecome_root();
447
448 return r_u->status;
449 }
450
451 /*************************************************************************
452 _net_srv_pwset
453 *************************************************************************/
454
455 NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *r_u)
456 {
457 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
458 fstring workstation;
459 SAM_ACCOUNT *sampass=NULL;
460 BOOL ret = False;
461 unsigned char pwd[16];
462 int i;
463 uint32 acct_ctrl;
464 DOM_CRED cred_out;
465 const uchar *old_pw;
466
467 if (!p->dc || !p->dc->authenticated) {
468 return NT_STATUS_INVALID_HANDLE;
469 }
470
471 /* Step the creds chain forward. */
472 if (!creds_server_step(p->dc, &q_u->clnt_id.cred, &cred_out)) {
473 DEBUG(0,("_net_srv_pwset: creds_server_step failed. Rejecting auth "
474 "request from client %s machine account %s\n",
475 p->dc->remote_machine, p->dc->mach_acct ));
476 return NT_STATUS_ACCESS_DENIED;
477 }
478
479 DEBUG(5,("_net_srv_pwset: %d\n", __LINE__));
480
481 rpcstr_pull(workstation,q_u->clnt_id.login.uni_comp_name.buffer,
482 sizeof(workstation),q_u->clnt_id.login.uni_comp_name.uni_str_len*2,0);
483
484 DEBUG(3,("_net_srv_pwset: Server Password Set by Wksta:[%s] on account [%s]\n",
485 workstation, p->dc->mach_acct));
486
487 pdb_init_sam(&sampass);
488
489 become_root();
490 ret=pdb_getsampwnam(sampass, p->dc->mach_acct);
491 unbecome_root();
492
493 /* Ensure the account exists and is a machine account. */
494
495 acct_ctrl = pdb_get_acct_ctrl(sampass);
496
497 if (!(ret
498 && (acct_ctrl & ACB_WSTRUST ||
499 acct_ctrl & ACB_SVRTRUST ||
500 acct_ctrl & ACB_DOMTRUST))) {
501 pdb_free_sam(&sampass);
502 return NT_STATUS_NO_SUCH_USER;
503 }
504
505 if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
506 pdb_free_sam(&sampass);
507 return NT_STATUS_ACCOUNT_DISABLED;
508 }
509
510 /* Woah - what does this to to the credential chain ? JRA */
511 cred_hash3( pwd, q_u->pwd, p->dc->sess_key, 0);
512
513 DEBUG(100,("Server password set : new given value was :\n"));
514 for(i = 0; i < sizeof(pwd); i++)
515 DEBUG(100,("%02X ", pwd[i]));
516 DEBUG(100,("\n"));
517
518 old_pw = pdb_get_nt_passwd(sampass);
519
520 if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
521 /* Avoid backend modificiations and other fun if the
522 client changed the password to the *same thing* */
523
524 ret = True;
525 } else {
526
527 /* LM password should be NULL for machines */
528 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
529 pdb_free_sam(&sampass);
530 return NT_STATUS_NO_MEMORY;
531 }
532
533 if (!pdb_set_nt_passwd(sampass, pwd, PDB_CHANGED)) {
534 pdb_free_sam(&sampass);
535 return NT_STATUS_NO_MEMORY;
536 }
537
538 if (!pdb_set_pass_changed_now(sampass)) {
539 pdb_free_sam(&sampass);
540 /* Not quite sure what this one qualifies as, but this will do */
541 return NT_STATUS_UNSUCCESSFUL;
542 }
543
544 become_root();
545 ret = pdb_update_sam_account (sampass);
546 unbecome_root();
547 }
548 if (ret) {
549 status = NT_STATUS_OK;
550 }
551
552 /* set up the LSA Server Password Set response */
553 init_net_r_srv_pwset(r_u, &cred_out, status);
554
555 pdb_free_sam(&sampass);
556 return r_u->status;
557 }
558
559 /*************************************************************************
560 _net_sam_logoff:
561 *************************************************************************/
562
563 NTSTATUS _net_sam_logoff(pipes_struct *p, NET_Q_SAM_LOGOFF *q_u, NET_R_SAM_LOGOFF *r_u)
564 {
565 if (!get_valid_user_struct(p->vuid))
566 return NT_STATUS_NO_SUCH_USER;
567
568 if (!p->dc || !p->dc->authenticated) {
569 return NT_STATUS_INVALID_HANDLE;
570 }
571
572 r_u->buffer_creds = 1; /* yes, we have valid server credentials */
573
574 /* checks and updates credentials. creates reply credentials */
575 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
576 DEBUG(0,("_net_sam_logoff: creds_server_step failed. Rejecting auth "
577 "request from client %s machine account %s\n",
578 p->dc->remote_machine, p->dc->mach_acct ));
579 return NT_STATUS_ACCESS_DENIED;
580 }
581
582 r_u->status = NT_STATUS_OK;
583 return r_u->status;
584 }
585
586
587 /*************************************************************************
588 _net_sam_logon
589 *************************************************************************/
590
591 NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *r_u)
592 {
593 NTSTATUS status = NT_STATUS_OK;
594 NET_USER_INFO_3 *usr_info = NULL;
595 NET_ID_INFO_CTR *ctr = q_u->sam_id.ctr;
596 UNISTR2 *uni_samlogon_user = NULL;
597 UNISTR2 *uni_samlogon_domain = NULL;
598 UNISTR2 *uni_samlogon_workstation = NULL;
599 fstring nt_username, nt_domain, nt_workstation;
600 auth_usersupplied_info *user_info = NULL;
601 auth_serversupplied_info *server_info = NULL;
602 SAM_ACCOUNT *sampw;
603 struct auth_context *auth_context = NULL;
604
605 usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
606 if (!usr_info)
607 return NT_STATUS_NO_MEMORY;
608
609 ZERO_STRUCTP(usr_info);
610
611 /* store the user information, if there is any. */
612 r_u->user = usr_info;
613 r_u->switch_value = 0; /* indicates no info */
614 r_u->auth_resp = 1; /* authoritative response */
615 r_u->switch_value = 3; /* indicates type of validation user info */
616 r_u->buffer_creds = 1; /* Ensure we always return server creds. */
617
618 if (!get_valid_user_struct(p->vuid))
619 return NT_STATUS_NO_SUCH_USER;
620
621 if (!p->dc || !p->dc->authenticated) {
622 return NT_STATUS_INVALID_HANDLE;
623 }
624
625 if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
626 /* 'server schannel = yes' should enforce use of
627 schannel, the client did offer it in auth2, but
628 obviously did not use it. */
629 DEBUG(0,("_net_sam_logoff: client %s not using schannel for netlogon\n",
630 p->dc->remote_machine ));
631 return NT_STATUS_ACCESS_DENIED;
632 }
633
634 /* checks and updates credentials. creates reply credentials */
635 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
636 DEBUG(0,("_net_sam_logon: creds_server_step failed. Rejecting auth "
637 "request from client %s machine account %s\n",
638 p->dc->remote_machine, p->dc->mach_acct ));
639 return NT_STATUS_ACCESS_DENIED;
640 }
641
642 /* find the username */
643
644 switch (q_u->sam_id.logon_level) {
645 case INTERACTIVE_LOGON_TYPE:
646 uni_samlogon_user = &ctr->auth.id1.uni_user_name;
647 uni_samlogon_domain = &ctr->auth.id1.uni_domain_name;
648
649 uni_samlogon_workstation = &ctr->auth.id1.uni_wksta_name;
650
651 DEBUG(3,("SAM Logon (Interactive). Domain:[%s]. ", lp_workgroup()));
652 break;
653 case NET_LOGON_TYPE:
654 uni_samlogon_user = &ctr->auth.id2.uni_user_name;
655 uni_samlogon_domain = &ctr->auth.id2.uni_domain_name;
656 uni_samlogon_workstation = &ctr->auth.id2.uni_wksta_name;
657
658 DEBUG(3,("SAM Logon (Network). Domain:[%s]. ", lp_workgroup()));
659 break;
660 default:
661 DEBUG(2,("SAM Logon: unsupported switch value\n"));
662 return NT_STATUS_INVALID_INFO_CLASS;
663 } /* end switch */
664
665 rpcstr_pull(nt_username,uni_samlogon_user->buffer,sizeof(nt_username),uni_samlogon_user->uni_str_len*2,0);
666 rpcstr_pull(nt_domain,uni_samlogon_domain->buffer,sizeof(nt_domain),uni_samlogon_domain->uni_str_len*2,0);
667 rpcstr_pull(nt_workstation,uni_samlogon_workstation->buffer,sizeof(nt_workstation),uni_samlogon_workstation->uni_str_len*2,0);
668
669 DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username,
670 nt_workstation, nt_domain));
671
672 fstrcpy(current_user_info.smb_name, nt_username);
673 sub_set_smb_name(nt_username);
674
675 DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u->sam_id.ctr->switch_value, nt_username));
676
677 status = NT_STATUS_OK;
678
679 switch (ctr->switch_value) {
680 case NET_LOGON_TYPE:
681 {
682 const char *wksname = nt_workstation;
683
684 if (!NT_STATUS_IS_OK(status = make_auth_context_fixed(&auth_context, ctr->auth.id2.lm_chal))) {
685 return status;
686 }
687
688 /* For a network logon, the workstation name comes in with two
689 * backslashes in the front. Strip them if they are there. */
690
691 if (*wksname == '\\') wksname++;
692 if (*wksname == '\\') wksname++;
693
694 /* Standard challenge/response authenticaion */
695 if (!make_user_info_netlogon_network(&user_info,
696 nt_username, nt_domain,
697 wksname,
698 ctr->auth.id2.param_ctrl,
699 ctr->auth.id2.lm_chal_resp.buffer,
700 ctr->auth.id2.lm_chal_resp.str_str_len,
701 ctr->auth.id2.nt_chal_resp.buffer,
702 ctr->auth.id2.nt_chal_resp.str_str_len)) {
703 status = NT_STATUS_NO_MEMORY;
704 }
705 break;
706 }
707 case INTERACTIVE_LOGON_TYPE:
708 /* 'Interactive' autheticaion, supplies the password in its
709 MD4 form, encrypted with the session key. We will
710 convert this to chellange/responce for the auth
711 subsystem to chew on */
712 {
713 const uint8 *chal;
714
715 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
716 return status;
717 }
718
719 chal = auth_context->get_ntlm_challenge(auth_context);
720
721 if (!make_user_info_netlogon_interactive(&user_info,
722 nt_username, nt_domain,
723 nt_workstation,
724 ctr->auth.id1.param_ctrl,
725 chal,
726 ctr->auth.id1.lm_owf.data,
727 ctr->auth.id1.nt_owf.data,
728 p->dc->sess_key)) {
729 status = NT_STATUS_NO_MEMORY;
730 }
731 break;
732 }
733 default:
734 DEBUG(2,("SAM Logon: unsupported switch value\n"));
735 return NT_STATUS_INVALID_INFO_CLASS;
736 } /* end switch */
737
738 if ( NT_STATUS_IS_OK(status) ) {
739 status = auth_context->check_ntlm_password(auth_context,
740 user_info, &server_info);
741 }
742
743 (auth_context->free)(&auth_context);
744 free_user_info(&user_info);
745
746 DEBUG(5, ("_net_sam_logon: check_password returned status %s\n",
747 nt_errstr(status)));
748
749 /* Check account and password */
750
751 if (!NT_STATUS_IS_OK(status)) {
752 /* If we don't know what this domain is, we need to
753 indicate that we are not authoritative. This
754 allows the client to decide if it needs to try
755 a local user. Fix by jpjanosi@us.ibm.com, #2976 */
756 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
757 && !strequal(nt_domain, get_global_sam_name())
758 && !is_trusted_domain(nt_domain) )
759 r_u->auth_resp = 0; /* We are not authoritative */
760
761 free_server_info(&server_info);
762 return status;
763 }
764
765 if (server_info->guest) {
766 /* We don't like guest domain logons... */
767 DEBUG(5,("_net_sam_logon: Attempted domain logon as GUEST denied.\n"));
768 free_server_info(&server_info);
769 return NT_STATUS_LOGON_FAILURE;
770 }
771
772 /* This is the point at which, if the login was successful, that
773 the SAM Local Security Authority should record that the user is
774 logged in to the domain. */
775
776 {
777 DOM_GID *gids = NULL;
778 const DOM_SID *user_sid = NULL;
779 const DOM_SID *group_sid = NULL;
780 DOM_SID domain_sid;
781 uint32 user_rid, group_rid;
782
783 int num_gids = 0;
784 pstring my_name;
785 fstring user_sid_string;
786 fstring group_sid_string;
787 uchar user_session_key[16];
788 uchar lm_session_key[16];
789 uchar netlogon_sess_key[16];
790
791 sampw = server_info->sam_account;
792
793 /* set up pointer indicating user/password failed to be found */
794 usr_info->ptr_user_info = 0;
795
796 user_sid = pdb_get_user_sid(sampw);
797 group_sid = pdb_get_group_sid(sampw);
798
799 sid_copy(&domain_sid, user_sid);
800 sid_split_rid(&domain_sid, &user_rid);
801
802 if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
803 DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid %s\n but group sid %s.\nThe conflicting domain portions are not supported for NETLOGON calls\n",
804 pdb_get_domain(sampw), pdb_get_username(sampw),
805 sid_to_string(user_sid_string, user_sid),
806 sid_to_string(group_sid_string, group_sid)));
807 return NT_STATUS_UNSUCCESSFUL;
808 }
809
810
811 if(server_info->login_server) {
812 pstrcpy(my_name, server_info->login_server);
813 } else {
814 pstrcpy(my_name, global_myname());
815 }
816
817 if (!NT_STATUS_IS_OK(status
818 = nt_token_to_group_list(p->mem_ctx,
819 &domain_sid,
820 server_info->ptok,
821 &num_gids,
822 &gids))) {
823 return status;
824 }
825
826 ZERO_STRUCT(netlogon_sess_key);
827 memcpy(netlogon_sess_key, p->dc->sess_key, 8);
828 if (server_info->user_session_key.length) {
829 memcpy(user_session_key, server_info->user_session_key.data,
830 MIN(sizeof(user_session_key), server_info->user_session_key.length));
831 SamOEMhash(user_session_key, netlogon_sess_key, 16);
832 }
833 if (server_info->lm_session_key.length) {
834 memcpy(lm_session_key, server_info->lm_session_key.data,
835 MIN(sizeof(lm_session_key), server_info->lm_session_key.length));
836 SamOEMhash(lm_session_key, netlogon_sess_key, 16);
837 }
838 ZERO_STRUCT(netlogon_sess_key);
839
840 init_net_user_info3(p->mem_ctx, usr_info,
841 user_rid,
842 group_rid,
843 pdb_get_username(sampw),
844 pdb_get_fullname(sampw),
845 pdb_get_homedir(sampw),
846 pdb_get_dir_drive(sampw),
847 pdb_get_logon_script(sampw),
848 pdb_get_profile_path(sampw),
849 pdb_get_logon_time(sampw),
850 get_time_t_max(),
851 get_time_t_max(),
852 pdb_get_pass_last_set_time(sampw),
853 pdb_get_pass_can_change_time(sampw),
854 pdb_get_pass_must_change_time(sampw),
855
856 0, /* logon_count */
857 0, /* bad_pw_count */
858 num_gids, /* uint32 num_groups */
859 gids , /* DOM_GID *gids */
860 0x20 , /* uint32 user_flgs (?) */
861 server_info->user_session_key.length ? user_session_key : NULL,
862 server_info->lm_session_key.length ? lm_session_key : NULL,
863 my_name , /* char *logon_srv */
864 pdb_get_domain(sampw),
865 &domain_sid, /* DOM_SID *dom_sid */
866 /* Should be users domain sid, not servers - for trusted domains */
867
868 NULL); /* char *other_sids */
869 ZERO_STRUCT(user_session_key);
870 ZERO_STRUCT(lm_session_key);
871 }
872 free_server_info(&server_info);
873 return status;
874 }
875
876 /*************************************************************************
877 _ds_enum_dom_trusts
878 *************************************************************************/
879 #if 0 /* JERRY -- not correct */
880 NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
881 DS_R_ENUM_DOM_TRUSTS *r_u)
882 {
883 NTSTATUS status = NT_STATUS_OK;
884
885 /* TODO: According to MSDN, the can only be executed against a
886 DC or domain member running Windows 2000 or later. Need
887 to test against a standalone 2k server and see what it
888 does. A windows 2000 DC includes its own domain in the
889 list. --jerry */
890
891 return status;
892 }
893 #endif /* JERRY */
Samba GIT mirror