2 Unix SMB/CIFS implementation.
3 NT Domain Authentication SMB / MSRPC client
4 Copyright (C) Andrew Tridgell 1992-2000
5 Copyright (C) Jeremy Allison 1998.
6 Largely re-written by Jeremy Allison (C) 2005.
7 Copyright (C) Guenther Deschner 2008.
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/filesys.h"
25 #include "libsmb/libsmb.h"
26 #include "rpc_client/rpc_client.h"
27 #include "rpc_client/cli_pipe.h"
28 #include "../libcli/auth/libcli_auth.h"
29 #include "../libcli/auth/netlogon_creds_cli.h"
30 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
31 #include "../librpc/gen_ndr/schannel.h"
32 #include "rpc_client/cli_netlogon.h"
33 #include "rpc_client/init_netlogon.h"
34 #include "rpc_client/util_netlogon.h"
35 #include "../libcli/security/security.h"
36 #include "lib/param/param.h"
37 #include "libcli/smb/smbXcli_base.h"
38 #include "dbwrap/dbwrap.h"
39 #include "dbwrap/dbwrap_open.h"
43 NTSTATUS
rpccli_pre_open_netlogon_creds(void)
45 static bool already_open
= false;
47 struct loadparm_context
*lp_ctx
;
49 struct db_context
*global_db
;
56 frame
= talloc_stackframe();
58 lp_ctx
= loadparm_init_s3(frame
, loadparm_s3_helpers());
61 return NT_STATUS_NO_MEMORY
;
64 fname
= lpcfg_private_db_path(frame
, lp_ctx
, "netlogon_creds_cli");
67 return NT_STATUS_NO_MEMORY
;
70 global_db
= db_open(talloc_autofree_context(), fname
,
71 0, TDB_CLEAR_IF_FIRST
|TDB_INCOMPATIBLE_HASH
,
72 O_RDWR
|O_CREAT
, 0600, DBWRAP_LOCK_ORDER_2
,
73 DBWRAP_FLAG_OPTIMIZE_READONLY_ACCESS
);
74 if (global_db
== NULL
) {
76 return NT_STATUS_NO_MEMORY
;
79 status
= netlogon_creds_cli_set_global_db(&global_db
);
81 if (!NT_STATUS_IS_OK(status
)) {
89 NTSTATUS
rpccli_create_netlogon_creds(const char *server_computer
,
90 const char *server_netbios_domain
,
91 const char *client_account
,
92 enum netr_SchannelType sec_chan_type
,
93 struct messaging_context
*msg_ctx
,
95 struct netlogon_creds_cli_context
**netlogon_creds
)
97 TALLOC_CTX
*frame
= talloc_stackframe();
98 struct loadparm_context
*lp_ctx
;
101 status
= rpccli_pre_open_netlogon_creds();
102 if (!NT_STATUS_IS_OK(status
)) {
107 lp_ctx
= loadparm_init_s3(frame
, loadparm_s3_helpers());
108 if (lp_ctx
== NULL
) {
110 return NT_STATUS_NO_MEMORY
;
112 status
= netlogon_creds_cli_context_global(lp_ctx
,
117 server_netbios_domain
,
118 mem_ctx
, netlogon_creds
);
120 if (!NT_STATUS_IS_OK(status
)) {
127 NTSTATUS
rpccli_setup_netlogon_creds(struct cli_state
*cli
,
128 struct netlogon_creds_cli_context
*netlogon_creds
,
130 struct samr_Password current_nt_hash
,
131 const struct samr_Password
*previous_nt_hash
)
133 TALLOC_CTX
*frame
= talloc_stackframe();
134 struct rpc_pipe_client
*netlogon_pipe
= NULL
;
135 struct netlogon_creds_CredentialState
*creds
= NULL
;
138 status
= netlogon_creds_cli_get(netlogon_creds
,
140 if (NT_STATUS_IS_OK(status
)) {
141 const char *action
= "using";
144 action
= "overwrite";
147 DEBUG(5,("%s: %s cached netlogon_creds cli[%s/%s] to %s\n",
148 __FUNCTION__
, action
,
149 creds
->account_name
, creds
->computer_name
,
150 smbXcli_conn_remote_name(cli
->conn
)));
158 status
= cli_rpc_pipe_open_noauth(cli
,
161 if (!NT_STATUS_IS_OK(status
)) {
162 DEBUG(5,("%s: failed to open noauth netlogon connection to %s - %s\n",
164 smbXcli_conn_remote_name(cli
->conn
),
169 talloc_steal(frame
, netlogon_pipe
);
171 status
= netlogon_creds_cli_auth(netlogon_creds
,
172 netlogon_pipe
->binding_handle
,
175 if (!NT_STATUS_IS_OK(status
)) {
180 status
= netlogon_creds_cli_get(netlogon_creds
,
182 if (!NT_STATUS_IS_OK(status
)) {
184 return NT_STATUS_INTERNAL_ERROR
;
187 DEBUG(5,("%s: using new netlogon_creds cli[%s/%s] to %s\n",
189 creds
->account_name
, creds
->computer_name
,
190 smbXcli_conn_remote_name(cli
->conn
)));
196 /* Logon domain user */
198 NTSTATUS
rpccli_netlogon_password_logon(struct netlogon_creds_cli_context
*creds
,
199 struct dcerpc_binding_handle
*binding_handle
,
200 uint32_t logon_parameters
,
202 const char *username
,
203 const char *password
,
204 const char *workstation
,
205 enum netr_LogonInfoClass logon_type
)
207 TALLOC_CTX
*frame
= talloc_stackframe();
209 union netr_LogonLevel
*logon
;
210 uint16_t validation_level
= 0;
211 union netr_Validation
*validation
= NULL
;
212 uint8_t authoritative
= 0;
214 char *workstation_slash
= NULL
;
216 logon
= talloc_zero(frame
, union netr_LogonLevel
);
219 return NT_STATUS_NO_MEMORY
;
222 if (workstation
== NULL
) {
223 workstation
= lp_netbios_name();
226 workstation_slash
= talloc_asprintf(frame
, "\\\\%s", workstation
);
227 if (workstation_slash
== NULL
) {
229 return NT_STATUS_NO_MEMORY
;
232 /* Initialise input parameters */
234 switch (logon_type
) {
235 case NetlogonInteractiveInformation
: {
237 struct netr_PasswordInfo
*password_info
;
239 struct samr_Password lmpassword
;
240 struct samr_Password ntpassword
;
242 password_info
= talloc_zero(frame
, struct netr_PasswordInfo
);
243 if (password_info
== NULL
) {
245 return NT_STATUS_NO_MEMORY
;
248 nt_lm_owf_gen(password
, ntpassword
.hash
, lmpassword
.hash
);
250 password_info
->identity_info
.domain_name
.string
= domain
;
251 password_info
->identity_info
.parameter_control
= logon_parameters
;
252 password_info
->identity_info
.logon_id_low
= 0xdead;
253 password_info
->identity_info
.logon_id_high
= 0xbeef;
254 password_info
->identity_info
.account_name
.string
= username
;
255 password_info
->identity_info
.workstation
.string
= workstation_slash
;
257 password_info
->lmpassword
= lmpassword
;
258 password_info
->ntpassword
= ntpassword
;
260 logon
->password
= password_info
;
264 case NetlogonNetworkInformation
: {
265 struct netr_NetworkInfo
*network_info
;
267 unsigned char local_lm_response
[24];
268 unsigned char local_nt_response
[24];
269 struct netr_ChallengeResponse lm
;
270 struct netr_ChallengeResponse nt
;
275 network_info
= talloc_zero(frame
, struct netr_NetworkInfo
);
276 if (network_info
== NULL
) {
278 return NT_STATUS_NO_MEMORY
;
281 generate_random_buffer(chal
, 8);
283 SMBencrypt(password
, chal
, local_lm_response
);
284 SMBNTencrypt(password
, chal
, local_nt_response
);
287 lm
.data
= local_lm_response
;
290 nt
.data
= local_nt_response
;
292 network_info
->identity_info
.domain_name
.string
= domain
;
293 network_info
->identity_info
.parameter_control
= logon_parameters
;
294 network_info
->identity_info
.logon_id_low
= 0xdead;
295 network_info
->identity_info
.logon_id_high
= 0xbeef;
296 network_info
->identity_info
.account_name
.string
= username
;
297 network_info
->identity_info
.workstation
.string
= workstation_slash
;
299 memcpy(network_info
->challenge
, chal
, 8);
300 network_info
->nt
= nt
;
301 network_info
->lm
= lm
;
303 logon
->network
= network_info
;
308 DEBUG(0, ("switch value %d not supported\n",
311 return NT_STATUS_INVALID_INFO_CLASS
;
314 status
= netlogon_creds_cli_LogonSamLogon(creds
,
324 if (!NT_STATUS_IS_OK(status
)) {
331 static NTSTATUS
map_validation_to_info3(TALLOC_CTX
*mem_ctx
,
332 uint16_t validation_level
,
333 union netr_Validation
*validation
,
334 struct netr_SamInfo3
**info3_p
)
336 struct netr_SamInfo3
*info3
;
339 if (validation
== NULL
) {
340 return NT_STATUS_INVALID_PARAMETER
;
343 switch (validation_level
) {
345 if (validation
->sam3
== NULL
) {
346 return NT_STATUS_INVALID_PARAMETER
;
349 info3
= talloc_move(mem_ctx
, &validation
->sam3
);
352 if (validation
->sam6
== NULL
) {
353 return NT_STATUS_INVALID_PARAMETER
;
356 info3
= talloc_zero(mem_ctx
, struct netr_SamInfo3
);
358 return NT_STATUS_NO_MEMORY
;
360 status
= copy_netr_SamBaseInfo(info3
, &validation
->sam6
->base
, &info3
->base
);
361 if (!NT_STATUS_IS_OK(status
)) {
366 info3
->sidcount
= validation
->sam6
->sidcount
;
367 info3
->sids
= talloc_move(info3
, &validation
->sam6
->sids
);
370 return NT_STATUS_BAD_VALIDATION_CLASS
;
379 * Logon domain user with an 'network' SAM logon
381 * @param info3 Pointer to a NET_USER_INFO_3 already allocated by the caller.
385 NTSTATUS
rpccli_netlogon_network_logon(struct netlogon_creds_cli_context
*creds
,
386 struct dcerpc_binding_handle
*binding_handle
,
388 uint32_t logon_parameters
,
389 const char *username
,
391 const char *workstation
,
393 DATA_BLOB lm_response
,
394 DATA_BLOB nt_response
,
395 uint8_t *authoritative
,
397 struct netr_SamInfo3
**info3
)
400 const char *workstation_name_slash
;
401 union netr_LogonLevel
*logon
= NULL
;
402 struct netr_NetworkInfo
*network_info
;
403 uint16_t validation_level
= 0;
404 union netr_Validation
*validation
= NULL
;
405 uint8_t _authoritative
= 0;
407 struct netr_ChallengeResponse lm
;
408 struct netr_ChallengeResponse nt
;
412 if (authoritative
== NULL
) {
413 authoritative
= &_authoritative
;
422 logon
= talloc_zero(mem_ctx
, union netr_LogonLevel
);
424 return NT_STATUS_NO_MEMORY
;
427 network_info
= talloc_zero(mem_ctx
, struct netr_NetworkInfo
);
429 return NT_STATUS_NO_MEMORY
;
432 if (workstation
[0] != '\\' && workstation
[1] != '\\') {
433 workstation_name_slash
= talloc_asprintf(mem_ctx
, "\\\\%s", workstation
);
435 workstation_name_slash
= workstation
;
438 if (!workstation_name_slash
) {
439 DEBUG(0, ("talloc_asprintf failed!\n"));
440 return NT_STATUS_NO_MEMORY
;
443 /* Initialise input parameters */
445 lm
.data
= lm_response
.data
;
446 lm
.length
= lm_response
.length
;
447 nt
.data
= nt_response
.data
;
448 nt
.length
= nt_response
.length
;
450 network_info
->identity_info
.domain_name
.string
= domain
;
451 network_info
->identity_info
.parameter_control
= logon_parameters
;
452 network_info
->identity_info
.logon_id_low
= 0xdead;
453 network_info
->identity_info
.logon_id_high
= 0xbeef;
454 network_info
->identity_info
.account_name
.string
= username
;
455 network_info
->identity_info
.workstation
.string
= workstation_name_slash
;
457 memcpy(network_info
->challenge
, chal
, 8);
458 network_info
->nt
= nt
;
459 network_info
->lm
= lm
;
461 logon
->network
= network_info
;
463 /* Marshall data and send request */
465 status
= netlogon_creds_cli_LogonSamLogon(creds
,
467 NetlogonNetworkInformation
,
474 if (!NT_STATUS_IS_OK(status
)) {
478 status
= map_validation_to_info3(mem_ctx
,
479 validation_level
, validation
,
481 if (!NT_STATUS_IS_OK(status
)) {