?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
packaging(RHEL-CTDB): package the manpage of "ldbrename"
[Samba.git] / source3 / rpc_server / srv_netlog_nt.c
blob39912ac7e40694ef7b454cbb757be26856b45c47
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997.
7 * Copyright (C) Jeremy Allison 1998-2001.
8 * Copyright (C) Andrew Bartlett 2001.
9 * Copyright (C) Guenther Deschner 2008-2009.
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 /* This is the implementation of the netlogon pipe. */
26
27 #include "includes.h"
28 #include "../libcli/auth/libcli_auth.h"
29 #include "../libcli/auth/schannel_state.h"
30 #include "../libcli/auth/schannel.h"
31
32 extern userdom_struct current_user_info;
33
34 #undef DBGC_CLASS
35 #define DBGC_CLASS DBGC_RPC_SRV
36
37 struct netlogon_server_pipe_state {
38 struct netr_Credential client_challenge;
39 struct netr_Credential server_challenge;
40 };
41
42 /*************************************************************************
43 _netr_LogonControl
44 *************************************************************************/
45
46 WERROR _netr_LogonControl(pipes_struct *p,
47 struct netr_LogonControl *r)
48 {
49 struct netr_LogonControl2Ex l;
50
51 switch (r->in.level) {
52 case 1:
53 break;
54 case 2:
55 return WERR_NOT_SUPPORTED;
56 default:
57 return WERR_UNKNOWN_LEVEL;
58 }
59
60 l.in.logon_server = r->in.logon_server;
61 l.in.function_code = r->in.function_code;
62 l.in.level = r->in.level;
63 l.in.data = NULL;
64 l.out.query = r->out.query;
65
66 return _netr_LogonControl2Ex(p, &l);
67 }
68
69 /****************************************************************************
70 Send a message to smbd to do a sam synchronisation
71 **************************************************************************/
72
73 static void send_sync_message(void)
74 {
75 DEBUG(3, ("sending sam synchronisation message\n"));
76 message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
77 NULL);
78 }
79
80 /*************************************************************************
81 _netr_LogonControl2
82 *************************************************************************/
83
84 WERROR _netr_LogonControl2(pipes_struct *p,
85 struct netr_LogonControl2 *r)
86 {
87 struct netr_LogonControl2Ex l;
88
89 l.in.logon_server = r->in.logon_server;
90 l.in.function_code = r->in.function_code;
91 l.in.level = r->in.level;
92 l.in.data = r->in.data;
93 l.out.query = r->out.query;
94
95 return _netr_LogonControl2Ex(p, &l);
96 }
97
98 /*************************************************************************
99 *************************************************************************/
100
101 static bool wb_change_trust_creds(const char *domain, WERROR *tc_status)
102 {
103 wbcErr result;
104 struct wbcAuthErrorInfo *error = NULL;
105
106 result = wbcChangeTrustCredentials(domain, &error);
107 switch (result) {
108 case WBC_ERR_WINBIND_NOT_AVAILABLE:
109 return false;
110 case WBC_ERR_DOMAIN_NOT_FOUND:
111 *tc_status = WERR_NO_SUCH_DOMAIN;
112 return true;
113 case WBC_ERR_SUCCESS:
114 *tc_status = WERR_OK;
115 return true;
116 default:
117 break;
118 }
119
120 if (error && error->nt_status != 0) {
121 *tc_status = ntstatus_to_werror(NT_STATUS(error->nt_status));
122 } else {
123 *tc_status = WERR_TRUST_FAILURE;
124 }
125 wbcFreeMemory(error);
126 return true;
127 }
128
129 /*************************************************************************
130 *************************************************************************/
131
132 static bool wb_check_trust_creds(const char *domain, WERROR *tc_status)
133 {
134 wbcErr result;
135 struct wbcAuthErrorInfo *error = NULL;
136
137 result = wbcCheckTrustCredentials(domain, &error);
138 switch (result) {
139 case WBC_ERR_WINBIND_NOT_AVAILABLE:
140 return false;
141 case WBC_ERR_DOMAIN_NOT_FOUND:
142 *tc_status = WERR_NO_SUCH_DOMAIN;
143 return true;
144 case WBC_ERR_SUCCESS:
145 *tc_status = WERR_OK;
146 return true;
147 default:
148 break;
149 }
150
151 if (error && error->nt_status != 0) {
152 *tc_status = ntstatus_to_werror(NT_STATUS(error->nt_status));
153 } else {
154 *tc_status = WERR_TRUST_FAILURE;
155 }
156 wbcFreeMemory(error);
157 return true;
158 }
159
160 /****************************************************************
161 _netr_LogonControl2Ex
162 ****************************************************************/
163
164 WERROR _netr_LogonControl2Ex(pipes_struct *p,
165 struct netr_LogonControl2Ex *r)
166 {
167 uint32_t flags = 0x0;
168 WERROR pdc_connection_status = WERR_OK;
169 uint32_t logon_attempts = 0x0;
170 WERROR tc_status;
171 fstring dc_name2;
172 const char *dc_name = NULL;
173 struct sockaddr_storage dc_ss;
174 const char *domain = NULL;
175 struct netr_NETLOGON_INFO_1 *info1;
176 struct netr_NETLOGON_INFO_2 *info2;
177 struct netr_NETLOGON_INFO_3 *info3;
178 struct netr_NETLOGON_INFO_4 *info4;
179 const char *fn;
180 uint32_t acct_ctrl;
181
182 switch (p->hdr_req.opnum) {
183 case NDR_NETR_LOGONCONTROL:
184 fn = "_netr_LogonControl";
185 break;
186 case NDR_NETR_LOGONCONTROL2:
187 fn = "_netr_LogonControl2";
188 break;
189 case NDR_NETR_LOGONCONTROL2EX:
190 fn = "_netr_LogonControl2Ex";
191 break;
192 default:
193 return WERR_INVALID_PARAM;
194 }
195
196 acct_ctrl = pdb_get_acct_ctrl(p->server_info->sam_account);
197
198 switch (r->in.function_code) {
199 case NETLOGON_CONTROL_TC_VERIFY:
200 case NETLOGON_CONTROL_CHANGE_PASSWORD:
201 case NETLOGON_CONTROL_REDISCOVER:
202 if ((geteuid() != sec_initial_uid()) &&
203 !nt_token_check_domain_rid(p->server_info->ptok, DOMAIN_RID_ADMINS) &&
204 !nt_token_check_sid(&global_sid_Builtin_Administrators, p->server_info->ptok) &&
205 !(acct_ctrl & (ACB_WSTRUST | ACB_SVRTRUST))) {
206 return WERR_ACCESS_DENIED;
207 }
208 break;
209 default:
210 break;
211 }
212
213 tc_status = WERR_NO_SUCH_DOMAIN;
214
215 switch (r->in.function_code) {
216 case NETLOGON_CONTROL_QUERY:
217 tc_status = WERR_OK;
218 break;
219 case NETLOGON_CONTROL_REPLICATE:
220 case NETLOGON_CONTROL_SYNCHRONIZE:
221 case NETLOGON_CONTROL_PDC_REPLICATE:
222 case NETLOGON_CONTROL_BACKUP_CHANGE_LOG:
223 case NETLOGON_CONTROL_BREAKPOINT:
224 if (acct_ctrl & ACB_NORMAL) {
225 return WERR_NOT_SUPPORTED;
226 } else if (acct_ctrl & (ACB_WSTRUST | ACB_SVRTRUST)) {
227 return WERR_ACCESS_DENIED;
228 } else {
229 return WERR_ACCESS_DENIED;
230 }
231 case NETLOGON_CONTROL_TRUNCATE_LOG:
232 if (acct_ctrl & ACB_NORMAL) {
233 break;
234 } else if (acct_ctrl & (ACB_WSTRUST | ACB_SVRTRUST)) {
235 return WERR_ACCESS_DENIED;
236 } else {
237 return WERR_ACCESS_DENIED;
238 }
239
240 case NETLOGON_CONTROL_TRANSPORT_NOTIFY:
241 case NETLOGON_CONTROL_FORCE_DNS_REG:
242 case NETLOGON_CONTROL_QUERY_DNS_REG:
243 return WERR_NOT_SUPPORTED;
244 case NETLOGON_CONTROL_FIND_USER:
245 if (!r->in.data || !r->in.data->user) {
246 return WERR_NOT_SUPPORTED;
247 }
248 break;
249 case NETLOGON_CONTROL_SET_DBFLAG:
250 if (!r->in.data) {
251 return WERR_NOT_SUPPORTED;
252 }
253 break;
254 case NETLOGON_CONTROL_TC_VERIFY:
255 if (!r->in.data || !r->in.data->domain) {
256 return WERR_NOT_SUPPORTED;
257 }
258
259 if (!wb_check_trust_creds(r->in.data->domain, &tc_status)) {
260 return WERR_NOT_SUPPORTED;
261 }
262 break;
263 case NETLOGON_CONTROL_TC_QUERY:
264 if (!r->in.data || !r->in.data->domain) {
265 return WERR_NOT_SUPPORTED;
266 }
267
268 domain = r->in.data->domain;
269
270 if (!is_trusted_domain(domain)) {
271 break;
272 }
273
274 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
275 tc_status = WERR_NO_LOGON_SERVERS;
276 break;
277 }
278
279 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
280 if (!dc_name) {
281 return WERR_NOMEM;
282 }
283
284 tc_status = WERR_OK;
285
286 break;
287
288 case NETLOGON_CONTROL_REDISCOVER:
289 if (!r->in.data || !r->in.data->domain) {
290 return WERR_NOT_SUPPORTED;
291 }
292
293 domain = r->in.data->domain;
294
295 if (!is_trusted_domain(domain)) {
296 break;
297 }
298
299 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
300 tc_status = WERR_NO_LOGON_SERVERS;
301 break;
302 }
303
304 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
305 if (!dc_name) {
306 return WERR_NOMEM;
307 }
308
309 tc_status = WERR_OK;
310
311 break;
312
313 case NETLOGON_CONTROL_CHANGE_PASSWORD:
314 if (!r->in.data || !r->in.data->domain) {
315 return WERR_NOT_SUPPORTED;
316 }
317
318 if (!wb_change_trust_creds(r->in.data->domain, &tc_status)) {
319 return WERR_NOT_SUPPORTED;
320 }
321 break;
322
323 default:
324 /* no idea what this should be */
325 DEBUG(0,("%s: unimplemented function level [%d]\n",
326 fn, r->in.function_code));
327 return WERR_UNKNOWN_LEVEL;
328 }
329
330 /* prepare the response */
331
332 switch (r->in.level) {
333 case 1:
334 info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
335 W_ERROR_HAVE_NO_MEMORY(info1);
336
337 info1->flags = flags;
338 info1->pdc_connection_status = pdc_connection_status;
339
340 r->out.query->info1 = info1;
341 break;
342 case 2:
343 info2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_2);
344 W_ERROR_HAVE_NO_MEMORY(info2);
345
346 info2->flags = flags;
347 info2->pdc_connection_status = pdc_connection_status;
348 info2->trusted_dc_name = dc_name;
349 info2->tc_connection_status = tc_status;
350
351 r->out.query->info2 = info2;
352 break;
353 case 3:
354 info3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_3);
355 W_ERROR_HAVE_NO_MEMORY(info3);
356
357 info3->flags = flags;
358 info3->logon_attempts = logon_attempts;
359
360 r->out.query->info3 = info3;
361 break;
362 case 4:
363 info4 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_4);
364 W_ERROR_HAVE_NO_MEMORY(info4);
365
366 info4->trusted_dc_name = dc_name;
367 info4->trusted_domain_name = r->in.data->domain;
368
369 r->out.query->info4 = info4;
370 break;
371 default:
372 return WERR_UNKNOWN_LEVEL;
373 }
374
375 if (lp_server_role() == ROLE_DOMAIN_BDC) {
376 send_sync_message();
377 }
378
379 return WERR_OK;
380 }
381
382 /*************************************************************************
383 _netr_NetrEnumerateTrustedDomains
384 *************************************************************************/
385
386 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
387 struct netr_NetrEnumerateTrustedDomains *r)
388 {
389 NTSTATUS status;
390 DATA_BLOB blob;
391 struct trustdom_info **domains;
392 uint32_t num_domains;
393 const char **trusted_domains;
394 int i;
395
396 DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
397
398 /* set up the Trusted Domain List response */
399
400 become_root();
401 status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
402 unbecome_root();
403
404 if (!NT_STATUS_IS_OK(status)) {
405 return ntstatus_to_werror(status);
406 }
407
408 trusted_domains = talloc_zero_array(p->mem_ctx, const char *, num_domains + 1);
409 if (!trusted_domains) {
410 return WERR_NOMEM;
411 }
412
413 for (i = 0; i < num_domains; i++) {
414 trusted_domains[i] = talloc_strdup(trusted_domains, domains[i]->name);
415 if (!trusted_domains[i]) {
416 TALLOC_FREE(trusted_domains);
417 return WERR_NOMEM;
418 }
419 }
420
421 if (!push_reg_multi_sz(trusted_domains, &blob, trusted_domains)) {
422 TALLOC_FREE(trusted_domains);
423 return WERR_NOMEM;
424 }
425
426 r->out.trusted_domains_blob->data = blob.data;
427 r->out.trusted_domains_blob->length = blob.length;
428
429 DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
430
431 return WERR_OK;
432 }
433
434 /******************************************************************
435 gets a machine password entry. checks access rights of the host.
436 ******************************************************************/
437
438 static NTSTATUS get_md4pw(struct samr_Password *md4pw, const char *mach_acct,
439 enum netr_SchannelType sec_chan_type, struct dom_sid *sid)
440 {
441 struct samu *sampass = NULL;
442 const uint8 *pass;
443 bool ret;
444 uint32 acct_ctrl;
445
446 #if 0
447 char addr[INET6_ADDRSTRLEN];
448
449 /*
450 * Currently this code is redundent as we already have a filter
451 * by hostname list. What this code really needs to do is to
452 * get a hosts allowed/hosts denied list from the SAM database
453 * on a per user basis, and make the access decision there.
454 * I will leave this code here for now as a reminder to implement
455 * this at a later date. JRA.
456 */
457
458 if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
459 client_name(get_client_fd()),
460 client_addr(get_client_fd(),addr,sizeof(addr)))) {
461 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
462 return False;
463 }
464 #endif /* 0 */
465
466 if ( !(sampass = samu_new( NULL )) ) {
467 return NT_STATUS_NO_MEMORY;
468 }
469
470 /* JRA. This is ok as it is only used for generating the challenge. */
471 become_root();
472 ret = pdb_getsampwnam(sampass, mach_acct);
473 unbecome_root();
474
475 if (!ret) {
476 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
477 TALLOC_FREE(sampass);
478 return NT_STATUS_ACCESS_DENIED;
479 }
480
481 acct_ctrl = pdb_get_acct_ctrl(sampass);
482 if (acct_ctrl & ACB_DISABLED) {
483 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
484 TALLOC_FREE(sampass);
485 return NT_STATUS_ACCOUNT_DISABLED;
486 }
487
488 if (!(acct_ctrl & ACB_SVRTRUST) &&
489 !(acct_ctrl & ACB_WSTRUST) &&
490 !(acct_ctrl & ACB_DOMTRUST))
491 {
492 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
493 TALLOC_FREE(sampass);
494 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
495 }
496
497 switch (sec_chan_type) {
498 case SEC_CHAN_BDC:
499 if (!(acct_ctrl & ACB_SVRTRUST)) {
500 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
501 "but not a server trust account\n", mach_acct));
502 TALLOC_FREE(sampass);
503 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
504 }
505 break;
506 case SEC_CHAN_WKSTA:
507 if (!(acct_ctrl & ACB_WSTRUST)) {
508 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
509 "but not a workstation trust account\n", mach_acct));
510 TALLOC_FREE(sampass);
511 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
512 }
513 break;
514 case SEC_CHAN_DOMAIN:
515 if (!(acct_ctrl & ACB_DOMTRUST)) {
516 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
517 "but not a interdomain trust account\n", mach_acct));
518 TALLOC_FREE(sampass);
519 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
520 }
521 break;
522 default:
523 break;
524 }
525
526 if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
527 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
528 TALLOC_FREE(sampass);
529 return NT_STATUS_LOGON_FAILURE;
530 }
531
532 memcpy(md4pw->hash, pass, 16);
533 dump_data(5, md4pw->hash, 16);
534
535 sid_copy(sid, pdb_get_user_sid(sampass));
536
537 TALLOC_FREE(sampass);
538
539 return NT_STATUS_OK;
540
541
542 }
543
544 /*************************************************************************
545 _netr_ServerReqChallenge
546 *************************************************************************/
547
548 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
549 struct netr_ServerReqChallenge *r)
550 {
551 struct netlogon_server_pipe_state *pipe_state =
552 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
553
554 if (pipe_state) {
555 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
556 talloc_free(pipe_state);
557 p->private_data = NULL;
558 }
559
560 pipe_state = talloc(p, struct netlogon_server_pipe_state);
561 NT_STATUS_HAVE_NO_MEMORY(pipe_state);
562
563 pipe_state->client_challenge = *r->in.credentials;
564
565 generate_random_buffer(pipe_state->server_challenge.data,
566 sizeof(pipe_state->server_challenge.data));
567
568 *r->out.return_credentials = pipe_state->server_challenge;
569
570 p->private_data = pipe_state;
571
572 return NT_STATUS_OK;
573 }
574
575 /*************************************************************************
576 _netr_ServerAuthenticate
577 Create the initial credentials.
578 *************************************************************************/
579
580 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
581 struct netr_ServerAuthenticate *r)
582 {
583 struct netr_ServerAuthenticate3 a;
584 uint32_t negotiate_flags = 0;
585 uint32_t rid;
586
587 a.in.server_name = r->in.server_name;
588 a.in.account_name = r->in.account_name;
589 a.in.secure_channel_type = r->in.secure_channel_type;
590 a.in.computer_name = r->in.computer_name;
591 a.in.credentials = r->in.credentials;
592 a.in.negotiate_flags = &negotiate_flags;
593
594 a.out.return_credentials = r->out.return_credentials;
595 a.out.rid = &rid;
596 a.out.negotiate_flags = &negotiate_flags;
597
598 return _netr_ServerAuthenticate3(p, &a);
599
600 }
601
602 /*************************************************************************
603 _netr_ServerAuthenticate3
604 *************************************************************************/
605
606 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
607 struct netr_ServerAuthenticate3 *r)
608 {
609 NTSTATUS status;
610 uint32_t srv_flgs;
611 /* r->in.negotiate_flags is an aliased pointer to r->out.negotiate_flags,
612 * so use a copy to avoid destroying the client values. */
613 uint32_t in_neg_flags = *r->in.negotiate_flags;
614 const char *fn;
615 struct dom_sid sid;
616 struct samr_Password mach_pwd;
617 struct netlogon_creds_CredentialState *creds;
618 struct netlogon_server_pipe_state *pipe_state =
619 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
620
621 /* According to Microsoft (see bugid #6099)
622 * Windows 7 looks at the negotiate_flags
623 * returned in this structure *even if the
624 * call fails with access denied* ! So in order
625 * to allow Win7 to connect to a Samba NT style
626 * PDC we set the flags before we know if it's
627 * an error or not.
628 */
629
630 /* 0x000001ff */
631 srv_flgs = NETLOGON_NEG_ACCOUNT_LOCKOUT |
632 NETLOGON_NEG_PERSISTENT_SAMREPL |
633 NETLOGON_NEG_ARCFOUR |
634 NETLOGON_NEG_PROMOTION_COUNT |
635 NETLOGON_NEG_CHANGELOG_BDC |
636 NETLOGON_NEG_FULL_SYNC_REPL |
637 NETLOGON_NEG_MULTIPLE_SIDS |
638 NETLOGON_NEG_REDO |
639 NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL |
640 NETLOGON_NEG_PASSWORD_SET2;
641
642 /* Ensure we support strong (128-bit) keys. */
643 if (in_neg_flags & NETLOGON_NEG_STRONG_KEYS) {
644 srv_flgs |= NETLOGON_NEG_STRONG_KEYS;
645 }
646
647 if (lp_server_schannel() != false) {
648 srv_flgs |= NETLOGON_NEG_SCHANNEL;
649 }
650
651 switch (p->hdr_req.opnum) {
652 case NDR_NETR_SERVERAUTHENTICATE:
653 fn = "_netr_ServerAuthenticate";
654 break;
655 case NDR_NETR_SERVERAUTHENTICATE2:
656 fn = "_netr_ServerAuthenticate2";
657 break;
658 case NDR_NETR_SERVERAUTHENTICATE3:
659 fn = "_netr_ServerAuthenticate3";
660 break;
661 default:
662 return NT_STATUS_INTERNAL_ERROR;
663 }
664
665 /* We use this as the key to store the creds: */
666 /* r->in.computer_name */
667
668 if (!pipe_state) {
669 DEBUG(0,("%s: no challenge sent to client %s\n", fn,
670 r->in.computer_name));
671 status = NT_STATUS_ACCESS_DENIED;
672 goto out;
673 }
674
675 if ( (lp_server_schannel() == true) &&
676 ((in_neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
677
678 /* schannel must be used, but client did not offer it. */
679 DEBUG(0,("%s: schannel required but client failed "
680 "to offer it. Client was %s\n",
681 fn, r->in.account_name));
682 status = NT_STATUS_ACCESS_DENIED;
683 goto out;
684 }
685
686 status = get_md4pw(&mach_pwd,
687 r->in.account_name,
688 r->in.secure_channel_type,
689 &sid);
690 if (!NT_STATUS_IS_OK(status)) {
691 DEBUG(0,("%s: failed to get machine password for "
692 "account %s: %s\n",
693 fn, r->in.account_name, nt_errstr(status) ));
694 /* always return NT_STATUS_ACCESS_DENIED */
695 status = NT_STATUS_ACCESS_DENIED;
696 goto out;
697 }
698
699 /* From the client / server challenges and md4 password, generate sess key */
700 /* Check client credentials are valid. */
701 creds = netlogon_creds_server_init(p->mem_ctx,
702 r->in.account_name,
703 r->in.computer_name,
704 r->in.secure_channel_type,
705 &pipe_state->client_challenge,
706 &pipe_state->server_challenge,
707 &mach_pwd,
708 r->in.credentials,
709 r->out.return_credentials,
710 *r->in.negotiate_flags);
711 if (!creds) {
712 DEBUG(0,("%s: netlogon_creds_server_check failed. Rejecting auth "
713 "request from client %s machine account %s\n",
714 fn, r->in.computer_name,
715 r->in.account_name));
716 status = NT_STATUS_ACCESS_DENIED;
717 goto out;
718 }
719
720 creds->sid = sid_dup_talloc(creds, &sid);
721 if (!creds->sid) {
722 status = NT_STATUS_NO_MEMORY;
723 goto out;
724 }
725
726 /* Store off the state so we can continue after client disconnect. */
727 become_root();
728 status = schannel_store_session_key(p->mem_ctx, creds);
729 unbecome_root();
730
731 if (!NT_STATUS_IS_OK(status)) {
732 goto out;
733 }
734
735 sid_peek_rid(&sid, r->out.rid);
736
737 status = NT_STATUS_OK;
738
739 out:
740
741 *r->out.negotiate_flags = srv_flgs;
742 return status;
743 }
744
745 /*************************************************************************
746 _netr_ServerAuthenticate2
747 *************************************************************************/
748
749 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
750 struct netr_ServerAuthenticate2 *r)
751 {
752 struct netr_ServerAuthenticate3 a;
753 uint32_t rid;
754
755 a.in.server_name = r->in.server_name;
756 a.in.account_name = r->in.account_name;
757 a.in.secure_channel_type = r->in.secure_channel_type;
758 a.in.computer_name = r->in.computer_name;
759 a.in.credentials = r->in.credentials;
760 a.in.negotiate_flags = r->in.negotiate_flags;
761
762 a.out.return_credentials = r->out.return_credentials;
763 a.out.rid = &rid;
764 a.out.negotiate_flags = r->out.negotiate_flags;
765
766 return _netr_ServerAuthenticate3(p, &a);
767 }
768
769 /*************************************************************************
770 *************************************************************************/
771
772 static NTSTATUS netr_creds_server_step_check(pipes_struct *p,
773 TALLOC_CTX *mem_ctx,
774 const char *computer_name,
775 struct netr_Authenticator *received_authenticator,
776 struct netr_Authenticator *return_authenticator,
777 struct netlogon_creds_CredentialState **creds_out)
778 {
779 NTSTATUS status;
780 struct tdb_context *tdb;
781 bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
782 bool schannel_in_use = (p->auth.auth_type == PIPE_AUTH_TYPE_SCHANNEL) ? true:false; /* &&
783 (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY ||
784 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY); */
785
786 tdb = open_schannel_session_store(mem_ctx);
787 if (!tdb) {
788 return NT_STATUS_ACCESS_DENIED;
789 }
790
791 status = schannel_creds_server_step_check_tdb(tdb, mem_ctx,
792 computer_name,
793 schannel_global_required,
794 schannel_in_use,
795 received_authenticator,
796 return_authenticator,
797 creds_out);
798 tdb_close(tdb);
799
800 return status;
801 }
802
803 /*************************************************************************
804 *************************************************************************/
805
806 static NTSTATUS netr_find_machine_account(TALLOC_CTX *mem_ctx,
807 const char *account_name,
808 struct samu **sampassp)
809 {
810 struct samu *sampass;
811 bool ret = false;
812 uint32_t acct_ctrl;
813
814 sampass = samu_new(mem_ctx);
815 if (!sampass) {
816 return NT_STATUS_NO_MEMORY;
817 }
818
819 become_root();
820 ret = pdb_getsampwnam(sampass, account_name);
821 unbecome_root();
822
823 if (!ret) {
824 TALLOC_FREE(sampass);
825 return NT_STATUS_ACCESS_DENIED;
826 }
827
828 /* Ensure the account exists and is a machine account. */
829
830 acct_ctrl = pdb_get_acct_ctrl(sampass);
831
832 if (!(acct_ctrl & ACB_WSTRUST ||
833 acct_ctrl & ACB_SVRTRUST ||
834 acct_ctrl & ACB_DOMTRUST)) {
835 TALLOC_FREE(sampass);
836 return NT_STATUS_NO_SUCH_USER;
837 }
838
839 if (acct_ctrl & ACB_DISABLED) {
840 TALLOC_FREE(sampass);
841 return NT_STATUS_ACCOUNT_DISABLED;
842 }
843
844 *sampassp = sampass;
845
846 return NT_STATUS_OK;
847 }
848
849 /*************************************************************************
850 *************************************************************************/
851
852 static NTSTATUS netr_set_machine_account_password(TALLOC_CTX *mem_ctx,
853 struct samu *sampass,
854 DATA_BLOB *plaintext_blob,
855 struct samr_Password *nt_hash,
856 struct samr_Password *lm_hash)
857 {
858 NTSTATUS status;
859 const uchar *old_pw;
860 const char *plaintext = NULL;
861 size_t plaintext_len;
862 struct samr_Password nt_hash_local;
863
864 if (!sampass) {
865 return NT_STATUS_INVALID_PARAMETER;
866 }
867
868 if (plaintext_blob) {
869 if (!convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
870 plaintext_blob->data, plaintext_blob->length,
871 &plaintext, &plaintext_len, false))
872 {
873 plaintext = NULL;
874 mdfour(nt_hash_local.hash, plaintext_blob->data, plaintext_blob->length);
875 nt_hash = &nt_hash_local;
876 }
877 }
878
879 if (plaintext) {
880 if (!pdb_set_plaintext_passwd(sampass, plaintext)) {
881 return NT_STATUS_ACCESS_DENIED;
882 }
883
884 goto done;
885 }
886
887 if (nt_hash) {
888 old_pw = pdb_get_nt_passwd(sampass);
889
890 if (old_pw && memcmp(nt_hash->hash, old_pw, 16) == 0) {
891 /* Avoid backend modificiations and other fun if the
892 client changed the password to the *same thing* */
893 } else {
894 /* LM password should be NULL for machines */
895 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
896 return NT_STATUS_NO_MEMORY;
897 }
898 if (!pdb_set_nt_passwd(sampass, nt_hash->hash, PDB_CHANGED)) {
899 return NT_STATUS_NO_MEMORY;
900 }
901
902 if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
903 /* Not quite sure what this one qualifies as, but this will do */
904 return NT_STATUS_UNSUCCESSFUL;
905 }
906 }
907 }
908
909 done:
910 become_root();
911 status = pdb_update_sam_account(sampass);
912 unbecome_root();
913
914 return status;
915 }
916
917 /*************************************************************************
918 _netr_ServerPasswordSet
919 *************************************************************************/
920
921 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
922 struct netr_ServerPasswordSet *r)
923 {
924 NTSTATUS status = NT_STATUS_OK;
925 struct samu *sampass=NULL;
926 int i;
927 struct netlogon_creds_CredentialState *creds;
928
929 DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
930
931 become_root();
932 status = netr_creds_server_step_check(p, p->mem_ctx,
933 r->in.computer_name,
934 r->in.credential,
935 r->out.return_authenticator,
936 &creds);
937 unbecome_root();
938
939 if (!NT_STATUS_IS_OK(status)) {
940 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
941 "request from client %s machine account %s\n",
942 r->in.computer_name, creds->computer_name));
943 TALLOC_FREE(creds);
944 return status;
945 }
946
947 DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
948 r->in.computer_name, creds->computer_name));
949
950 netlogon_creds_des_decrypt(creds, r->in.new_password);
951
952 DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
953 for(i = 0; i < sizeof(r->in.new_password->hash); i++)
954 DEBUG(100,("%02X ", r->in.new_password->hash[i]));
955 DEBUG(100,("\n"));
956
957 status = netr_find_machine_account(p->mem_ctx,
958 creds->account_name,
959 &sampass);
960 if (!NT_STATUS_IS_OK(status)) {
961 return status;
962 }
963
964 status = netr_set_machine_account_password(sampass,
965 sampass,
966 NULL,
967 r->in.new_password,
968 NULL);
969 TALLOC_FREE(sampass);
970 return status;
971 }
972
973 /****************************************************************
974 _netr_ServerPasswordSet2
975 ****************************************************************/
976
977 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
978 struct netr_ServerPasswordSet2 *r)
979 {
980 NTSTATUS status;
981 struct netlogon_creds_CredentialState *creds;
982 struct samu *sampass;
983 DATA_BLOB plaintext;
984 struct samr_CryptPassword password_buf;
985 struct samr_Password nt_hash;
986
987 become_root();
988 status = netr_creds_server_step_check(p, p->mem_ctx,
989 r->in.computer_name,
990 r->in.credential,
991 r->out.return_authenticator,
992 &creds);
993 unbecome_root();
994
995 if (!NT_STATUS_IS_OK(status)) {
996 DEBUG(2,("_netr_ServerPasswordSet2: netlogon_creds_server_step "
997 "failed. Rejecting auth request from client %s machine account %s\n",
998 r->in.computer_name, creds->computer_name));
999 TALLOC_FREE(creds);
1000 return status;
1001 }
1002
1003 memcpy(password_buf.data, r->in.new_password->data, 512);
1004 SIVAL(password_buf.data, 512, r->in.new_password->length);
1005 netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
1006
1007 if (!extract_pw_from_buffer(p->mem_ctx, password_buf.data, &plaintext)) {
1008 return NT_STATUS_WRONG_PASSWORD;
1009 }
1010
1011 mdfour(nt_hash.hash, plaintext.data, plaintext.length);
1012
1013 status = netr_find_machine_account(p->mem_ctx,
1014 creds->account_name,
1015 &sampass);
1016 if (!NT_STATUS_IS_OK(status)) {
1017 return status;
1018 }
1019
1020 status = netr_set_machine_account_password(sampass,
1021 sampass,
1022 NULL,
1023 &nt_hash,
1024 NULL);
1025 TALLOC_FREE(sampass);
1026 return status;
1027 }
1028
1029 /*************************************************************************
1030 _netr_LogonSamLogoff
1031 *************************************************************************/
1032
1033 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
1034 struct netr_LogonSamLogoff *r)
1035 {
1036 NTSTATUS status;
1037 struct netlogon_creds_CredentialState *creds;
1038
1039 become_root();
1040 status = netr_creds_server_step_check(p, p->mem_ctx,
1041 r->in.computer_name,
1042 r->in.credential,
1043 r->out.return_authenticator,
1044 &creds);
1045 unbecome_root();
1046
1047 return status;
1048 }
1049
1050 /*************************************************************************
1051 _netr_LogonSamLogon_base
1052 *************************************************************************/
1053
1054 static NTSTATUS _netr_LogonSamLogon_base(pipes_struct *p,
1055 struct netr_LogonSamLogonEx *r,
1056 struct netlogon_creds_CredentialState *creds)
1057 {
1058 NTSTATUS status = NT_STATUS_OK;
1059 union netr_LogonLevel *logon = r->in.logon;
1060 const char *nt_username, *nt_domain, *nt_workstation;
1061 auth_usersupplied_info *user_info = NULL;
1062 auth_serversupplied_info *server_info = NULL;
1063 struct auth_context *auth_context = NULL;
1064 uint8_t pipe_session_key[16];
1065 bool process_creds = true;
1066 const char *fn;
1067
1068 switch (p->hdr_req.opnum) {
1069 case NDR_NETR_LOGONSAMLOGON:
1070 process_creds = true;
1071 fn = "_netr_LogonSamLogon";
1072 break;
1073 case NDR_NETR_LOGONSAMLOGONWITHFLAGS:
1074 process_creds = true;
1075 fn = "_netr_LogonSamLogonWithFlags";
1076 break;
1077 case NDR_NETR_LOGONSAMLOGONEX:
1078 process_creds = false;
1079 fn = "_netr_LogonSamLogonEx";
1080 break;
1081 default:
1082 return NT_STATUS_INTERNAL_ERROR;
1083 }
1084
1085 *r->out.authoritative = true; /* authoritative response */
1086
1087 switch (r->in.validation_level) {
1088 case 2:
1089 r->out.validation->sam2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo2);
1090 if (!r->out.validation->sam2) {
1091 return NT_STATUS_NO_MEMORY;
1092 }
1093 break;
1094 case 3:
1095 r->out.validation->sam3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo3);
1096 if (!r->out.validation->sam3) {
1097 return NT_STATUS_NO_MEMORY;
1098 }
1099 break;
1100 case 6:
1101 r->out.validation->sam6 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo6);
1102 if (!r->out.validation->sam6) {
1103 return NT_STATUS_NO_MEMORY;
1104 }
1105 break;
1106 default:
1107 DEBUG(0,("%s: bad validation_level value %d.\n",
1108 fn, (int)r->in.validation_level));
1109 return NT_STATUS_INVALID_INFO_CLASS;
1110 }
1111
1112 switch (r->in.logon_level) {
1113 case NetlogonInteractiveInformation:
1114 case NetlogonServiceInformation:
1115 case NetlogonInteractiveTransitiveInformation:
1116 case NetlogonServiceTransitiveInformation:
1117 nt_username = logon->password->identity_info.account_name.string;
1118 nt_domain = logon->password->identity_info.domain_name.string;
1119 nt_workstation = logon->password->identity_info.workstation.string;
1120
1121 DEBUG(3,("SAM Logon (Interactive). Domain:[%s]. ", lp_workgroup()));
1122 break;
1123 case NetlogonNetworkInformation:
1124 case NetlogonNetworkTransitiveInformation:
1125 nt_username = logon->network->identity_info.account_name.string;
1126 nt_domain = logon->network->identity_info.domain_name.string;
1127 nt_workstation = logon->network->identity_info.workstation.string;
1128
1129 DEBUG(3,("SAM Logon (Network). Domain:[%s]. ", lp_workgroup()));
1130 break;
1131 default:
1132 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1133 return NT_STATUS_INVALID_INFO_CLASS;
1134 } /* end switch */
1135
1136 DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
1137 fstrcpy(current_user_info.smb_name, nt_username);
1138 sub_set_smb_name(nt_username);
1139
1140 DEBUG(5,("Attempting validation level %d for unmapped username %s.\n",
1141 r->in.validation_level, nt_username));
1142
1143 status = NT_STATUS_OK;
1144
1145 switch (r->in.logon_level) {
1146 case NetlogonNetworkInformation:
1147 case NetlogonNetworkTransitiveInformation:
1148 {
1149 const char *wksname = nt_workstation;
1150
1151 status = make_auth_context_fixed(&auth_context,
1152 logon->network->challenge);
1153 if (!NT_STATUS_IS_OK(status)) {
1154 return status;
1155 }
1156
1157 /* For a network logon, the workstation name comes in with two
1158 * backslashes in the front. Strip them if they are there. */
1159
1160 if (*wksname == '\\') wksname++;
1161 if (*wksname == '\\') wksname++;
1162
1163 /* Standard challenge/response authenticaion */
1164 if (!make_user_info_netlogon_network(&user_info,
1165 nt_username, nt_domain,
1166 wksname,
1167 logon->network->identity_info.parameter_control,
1168 logon->network->lm.data,
1169 logon->network->lm.length,
1170 logon->network->nt.data,
1171 logon->network->nt.length)) {
1172 status = NT_STATUS_NO_MEMORY;
1173 }
1174 break;
1175 }
1176 case NetlogonInteractiveInformation:
1177 case NetlogonServiceInformation:
1178 case NetlogonInteractiveTransitiveInformation:
1179 case NetlogonServiceTransitiveInformation:
1180
1181 /* 'Interactive' authentication, supplies the password in its
1182 MD4 form, encrypted with the session key. We will convert
1183 this to challenge/response for the auth subsystem to chew
1184 on */
1185 {
1186 uint8_t chal[8];
1187
1188 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
1189 return status;
1190 }
1191
1192 auth_context->get_ntlm_challenge(auth_context, chal);
1193
1194 if (!make_user_info_netlogon_interactive(&user_info,
1195 nt_username, nt_domain,
1196 nt_workstation,
1197 logon->password->identity_info.parameter_control,
1198 chal,
1199 logon->password->lmpassword.hash,
1200 logon->password->ntpassword.hash,
1201 creds->session_key)) {
1202 status = NT_STATUS_NO_MEMORY;
1203 }
1204 break;
1205 }
1206 default:
1207 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1208 return NT_STATUS_INVALID_INFO_CLASS;
1209 } /* end switch */
1210
1211 if ( NT_STATUS_IS_OK(status) ) {
1212 status = auth_context->check_ntlm_password(auth_context,
1213 user_info, &server_info);
1214 }
1215
1216 (auth_context->free)(&auth_context);
1217 free_user_info(&user_info);
1218
1219 DEBUG(5,("%s: check_password returned status %s\n",
1220 fn, nt_errstr(status)));
1221
1222 /* Check account and password */
1223
1224 if (!NT_STATUS_IS_OK(status)) {
1225 /* If we don't know what this domain is, we need to
1226 indicate that we are not authoritative. This
1227 allows the client to decide if it needs to try
1228 a local user. Fix by jpjanosi@us.ibm.com, #2976 */
1229 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
1230 && !strequal(nt_domain, get_global_sam_name())
1231 && !is_trusted_domain(nt_domain) )
1232 *r->out.authoritative = false; /* We are not authoritative */
1233
1234 TALLOC_FREE(server_info);
1235 return status;
1236 }
1237
1238 if (server_info->guest) {
1239 /* We don't like guest domain logons... */
1240 DEBUG(5,("%s: Attempted domain logon as GUEST "
1241 "denied.\n", fn));
1242 TALLOC_FREE(server_info);
1243 return NT_STATUS_LOGON_FAILURE;
1244 }
1245
1246 /* This is the point at which, if the login was successful, that
1247 the SAM Local Security Authority should record that the user is
1248 logged in to the domain. */
1249
1250 if (process_creds) {
1251 /* Get the pipe session key from the creds. */
1252 memcpy(pipe_session_key, creds->session_key, 16);
1253 } else {
1254 /* Get the pipe session key from the schannel. */
1255 if ((p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL)
1256 || (p->auth.a_u.schannel_auth == NULL)) {
1257 return NT_STATUS_INVALID_HANDLE;
1258 }
1259 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->creds->session_key, 16);
1260 }
1261
1262 switch (r->in.validation_level) {
1263 case 2:
1264 status = serverinfo_to_SamInfo2(server_info, pipe_session_key, 16,
1265 r->out.validation->sam2);
1266 break;
1267 case 3:
1268 status = serverinfo_to_SamInfo3(server_info, pipe_session_key, 16,
1269 r->out.validation->sam3);
1270 break;
1271 case 6:
1272 status = serverinfo_to_SamInfo6(server_info, pipe_session_key, 16,
1273 r->out.validation->sam6);
1274 break;
1275 }
1276
1277 TALLOC_FREE(server_info);
1278
1279 return status;
1280 }
1281
1282 /****************************************************************
1283 _netr_LogonSamLogonWithFlags
1284 ****************************************************************/
1285
1286 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1287 struct netr_LogonSamLogonWithFlags *r)
1288 {
1289 NTSTATUS status;
1290 struct netlogon_creds_CredentialState *creds;
1291 struct netr_LogonSamLogonEx r2;
1292 struct netr_Authenticator return_authenticator;
1293
1294 become_root();
1295 status = netr_creds_server_step_check(p, p->mem_ctx,
1296 r->in.computer_name,
1297 r->in.credential,
1298 &return_authenticator,
1299 &creds);
1300 unbecome_root();
1301 if (!NT_STATUS_IS_OK(status)) {
1302 return status;
1303 }
1304
1305 r2.in.server_name = r->in.server_name;
1306 r2.in.computer_name = r->in.computer_name;
1307 r2.in.logon_level = r->in.logon_level;
1308 r2.in.logon = r->in.logon;
1309 r2.in.validation_level = r->in.validation_level;
1310 r2.in.flags = r->in.flags;
1311 r2.out.validation = r->out.validation;
1312 r2.out.authoritative = r->out.authoritative;
1313 r2.out.flags = r->out.flags;
1314
1315 status = _netr_LogonSamLogon_base(p, &r2, creds);
1316
1317 *r->out.return_authenticator = return_authenticator;
1318
1319 return status;
1320 }
1321
1322 /*************************************************************************
1323 _netr_LogonSamLogon
1324 *************************************************************************/
1325
1326 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
1327 struct netr_LogonSamLogon *r)
1328 {
1329 NTSTATUS status;
1330 struct netr_LogonSamLogonWithFlags r2;
1331 uint32_t flags = 0;
1332
1333 r2.in.server_name = r->in.server_name;
1334 r2.in.computer_name = r->in.computer_name;
1335 r2.in.credential = r->in.credential;
1336 r2.in.logon_level = r->in.logon_level;
1337 r2.in.logon = r->in.logon;
1338 r2.in.validation_level = r->in.validation_level;
1339 r2.in.return_authenticator = r->in.return_authenticator;
1340 r2.in.flags = &flags;
1341 r2.out.validation = r->out.validation;
1342 r2.out.authoritative = r->out.authoritative;
1343 r2.out.flags = &flags;
1344 r2.out.return_authenticator = r->out.return_authenticator;
1345
1346 status = _netr_LogonSamLogonWithFlags(p, &r2);
1347
1348 return status;
1349 }
1350
1351 /*************************************************************************
1352 _netr_LogonSamLogonEx
1353 - no credential chaining. Map into net sam logon.
1354 *************************************************************************/
1355
1356 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1357 struct netr_LogonSamLogonEx *r)
1358 {
1359 NTSTATUS status;
1360 struct netlogon_creds_CredentialState *creds = NULL;
1361
1362 become_root();
1363 status = schannel_fetch_session_key(p->mem_ctx, r->in.computer_name, &creds);
1364 unbecome_root();
1365 if (!NT_STATUS_IS_OK(status)) {
1366 return status;
1367 }
1368
1369 /* Only allow this if the pipe is protected. */
1370 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1371 DEBUG(0,("_netr_LogonSamLogonEx: client %s not using schannel for netlogon\n",
1372 get_remote_machine_name() ));
1373 return NT_STATUS_INVALID_PARAMETER;
1374 }
1375
1376 status = _netr_LogonSamLogon_base(p, r, creds);
1377 TALLOC_FREE(creds);
1378
1379 return status;
1380 }
1381
1382 /*************************************************************************
1383 _ds_enum_dom_trusts
1384 *************************************************************************/
1385 #if 0 /* JERRY -- not correct */
1386 NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1387 DS_R_ENUM_DOM_TRUSTS *r_u)
1388 {
1389 NTSTATUS status = NT_STATUS_OK;
1390
1391 /* TODO: According to MSDN, the can only be executed against a
1392 DC or domain member running Windows 2000 or later. Need
1393 to test against a standalone 2k server and see what it
1394 does. A windows 2000 DC includes its own domain in the
1395 list. --jerry */
1396
1397 return status;
1398 }
1399 #endif /* JERRY */
1400
1401
1402 /****************************************************************
1403 ****************************************************************/
1404
1405 WERROR _netr_LogonUasLogon(pipes_struct *p,
1406 struct netr_LogonUasLogon *r)
1407 {
1408 p->rng_fault_state = true;
1409 return WERR_NOT_SUPPORTED;
1410 }
1411
1412 /****************************************************************
1413 ****************************************************************/
1414
1415 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1416 struct netr_LogonUasLogoff *r)
1417 {
1418 p->rng_fault_state = true;
1419 return WERR_NOT_SUPPORTED;
1420 }
1421
1422 /****************************************************************
1423 ****************************************************************/
1424
1425 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1426 struct netr_DatabaseDeltas *r)
1427 {
1428 p->rng_fault_state = true;
1429 return NT_STATUS_NOT_IMPLEMENTED;
1430 }
1431
1432 /****************************************************************
1433 ****************************************************************/
1434
1435 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1436 struct netr_DatabaseSync *r)
1437 {
1438 p->rng_fault_state = true;
1439 return NT_STATUS_NOT_IMPLEMENTED;
1440 }
1441
1442 /****************************************************************
1443 ****************************************************************/
1444
1445 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1446 struct netr_AccountDeltas *r)
1447 {
1448 p->rng_fault_state = true;
1449 return NT_STATUS_NOT_IMPLEMENTED;
1450 }
1451
1452 /****************************************************************
1453 ****************************************************************/
1454
1455 NTSTATUS _netr_AccountSync(pipes_struct *p,
1456 struct netr_AccountSync *r)
1457 {
1458 p->rng_fault_state = true;
1459 return NT_STATUS_NOT_IMPLEMENTED;
1460 }
1461
1462 /****************************************************************
1463 ****************************************************************/
1464
1465 static bool wb_getdcname(TALLOC_CTX *mem_ctx,
1466 const char *domain,
1467 const char **dcname,
1468 uint32_t flags,
1469 WERROR *werr)
1470 {
1471 wbcErr result;
1472 struct wbcDomainControllerInfo *dc_info = NULL;
1473
1474 result = wbcLookupDomainController(domain,
1475 flags,
1476 &dc_info);
1477 switch (result) {
1478 case WBC_ERR_SUCCESS:
1479 break;
1480 case WBC_ERR_WINBIND_NOT_AVAILABLE:
1481 return false;
1482 case WBC_ERR_DOMAIN_NOT_FOUND:
1483 *werr = WERR_NO_SUCH_DOMAIN;
1484 return true;
1485 default:
1486 *werr = WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1487 return true;
1488 }
1489
1490 *dcname = talloc_strdup(mem_ctx, dc_info->dc_name);
1491 wbcFreeMemory(dc_info);
1492 if (!*dcname) {
1493 *werr = WERR_NOMEM;
1494 return false;
1495 }
1496
1497 *werr = WERR_OK;
1498
1499 return true;
1500 }
1501
1502 /****************************************************************
1503 _netr_GetDcName
1504 ****************************************************************/
1505
1506 WERROR _netr_GetDcName(pipes_struct *p,
1507 struct netr_GetDcName *r)
1508 {
1509 NTSTATUS status;
1510 WERROR werr;
1511 uint32_t flags;
1512 struct netr_DsRGetDCNameInfo *info;
1513 bool ret;
1514
1515 ret = wb_getdcname(p->mem_ctx,
1516 r->in.domainname,
1517 r->out.dcname,
1518 WBC_LOOKUP_DC_IS_FLAT_NAME |
1519 WBC_LOOKUP_DC_RETURN_FLAT_NAME |
1520 WBC_LOOKUP_DC_PDC_REQUIRED,
1521 &werr);
1522 if (ret == true) {
1523 return werr;
1524 }
1525
1526 flags = DS_PDC_REQUIRED | DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME;
1527
1528 status = dsgetdcname(p->mem_ctx,
1529 smbd_messaging_context(),
1530 r->in.domainname,
1531 NULL,
1532 NULL,
1533 flags,
1534 &info);
1535 if (!NT_STATUS_IS_OK(status)) {
1536 return ntstatus_to_werror(status);
1537 }
1538
1539 *r->out.dcname = talloc_strdup(p->mem_ctx, info->dc_unc);
1540 talloc_free(info);
1541 if (!*r->out.dcname) {
1542 return WERR_NOMEM;
1543 }
1544
1545 return WERR_OK;
1546 }
1547
1548 /****************************************************************
1549 _netr_GetAnyDCName
1550 ****************************************************************/
1551
1552 WERROR _netr_GetAnyDCName(pipes_struct *p,
1553 struct netr_GetAnyDCName *r)
1554 {
1555 NTSTATUS status;
1556 WERROR werr;
1557 uint32_t flags;
1558 struct netr_DsRGetDCNameInfo *info;
1559 bool ret;
1560
1561 ret = wb_getdcname(p->mem_ctx,
1562 r->in.domainname,
1563 r->out.dcname,
1564 WBC_LOOKUP_DC_IS_FLAT_NAME |
1565 WBC_LOOKUP_DC_RETURN_FLAT_NAME,
1566 &werr);
1567 if (ret == true) {
1568 return werr;
1569 }
1570
1571 flags = DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME;
1572
1573 status = dsgetdcname(p->mem_ctx,
1574 smbd_messaging_context(),
1575 r->in.domainname,
1576 NULL,
1577 NULL,
1578 flags,
1579 &info);
1580 if (!NT_STATUS_IS_OK(status)) {
1581 return ntstatus_to_werror(status);
1582 }
1583
1584 *r->out.dcname = talloc_strdup(p->mem_ctx, info->dc_unc);
1585 talloc_free(info);
1586 if (!*r->out.dcname) {
1587 return WERR_NOMEM;
1588 }
1589
1590 return WERR_OK;
1591 }
1592
1593 /****************************************************************
1594 ****************************************************************/
1595
1596 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1597 struct netr_DatabaseSync2 *r)
1598 {
1599 p->rng_fault_state = true;
1600 return NT_STATUS_NOT_IMPLEMENTED;
1601 }
1602
1603 /****************************************************************
1604 ****************************************************************/
1605
1606 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1607 struct netr_DatabaseRedo *r)
1608 {
1609 p->rng_fault_state = true;
1610 return NT_STATUS_NOT_IMPLEMENTED;
1611 }
1612
1613 /****************************************************************
1614 ****************************************************************/
1615
1616 WERROR _netr_DsRGetDCName(pipes_struct *p,
1617 struct netr_DsRGetDCName *r)
1618 {
1619 p->rng_fault_state = true;
1620 return WERR_NOT_SUPPORTED;
1621 }
1622
1623 /****************************************************************
1624 ****************************************************************/
1625
1626 NTSTATUS _netr_LogonGetCapabilities(pipes_struct *p,
1627 struct netr_LogonGetCapabilities *r)
1628 {
1629 return NT_STATUS_NOT_IMPLEMENTED;
1630 }
1631
1632 /****************************************************************
1633 ****************************************************************/
1634
1635 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1636 struct netr_NETRLOGONSETSERVICEBITS *r)
1637 {
1638 p->rng_fault_state = true;
1639 return WERR_NOT_SUPPORTED;
1640 }
1641
1642 /****************************************************************
1643 ****************************************************************/
1644
1645 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1646 struct netr_LogonGetTrustRid *r)
1647 {
1648 p->rng_fault_state = true;
1649 return WERR_NOT_SUPPORTED;
1650 }
1651
1652 /****************************************************************
1653 ****************************************************************/
1654
1655 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1656 struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1657 {
1658 p->rng_fault_state = true;
1659 return WERR_NOT_SUPPORTED;
1660 }
1661
1662 /****************************************************************
1663 ****************************************************************/
1664
1665 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1666 struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1667 {
1668 p->rng_fault_state = true;
1669 return WERR_NOT_SUPPORTED;
1670 }
1671
1672 /****************************************************************
1673 ****************************************************************/
1674
1675 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1676 struct netr_DsRGetDCNameEx *r)
1677 {
1678 p->rng_fault_state = true;
1679 return WERR_NOT_SUPPORTED;
1680 }
1681
1682 /****************************************************************
1683 ****************************************************************/
1684
1685 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1686 struct netr_DsRGetSiteName *r)
1687 {
1688 p->rng_fault_state = true;
1689 return WERR_NOT_SUPPORTED;
1690 }
1691
1692 /****************************************************************
1693 ****************************************************************/
1694
1695 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1696 struct netr_LogonGetDomainInfo *r)
1697 {
1698 p->rng_fault_state = true;
1699 return NT_STATUS_NOT_IMPLEMENTED;
1700 }
1701
1702 /****************************************************************
1703 ****************************************************************/
1704
1705 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1706 struct netr_ServerPasswordGet *r)
1707 {
1708 p->rng_fault_state = true;
1709 return WERR_NOT_SUPPORTED;
1710 }
1711
1712 /****************************************************************
1713 ****************************************************************/
1714
1715 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1716 struct netr_NETRLOGONSENDTOSAM *r)
1717 {
1718 p->rng_fault_state = true;
1719 return WERR_NOT_SUPPORTED;
1720 }
1721
1722 /****************************************************************
1723 ****************************************************************/
1724
1725 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1726 struct netr_DsRAddressToSitenamesW *r)
1727 {
1728 p->rng_fault_state = true;
1729 return WERR_NOT_SUPPORTED;
1730 }
1731
1732 /****************************************************************
1733 ****************************************************************/
1734
1735 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1736 struct netr_DsRGetDCNameEx2 *r)
1737 {
1738 p->rng_fault_state = true;
1739 return WERR_NOT_SUPPORTED;
1740 }
1741
1742 /****************************************************************
1743 ****************************************************************/
1744
1745 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1746 struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1747 {
1748 p->rng_fault_state = true;
1749 return WERR_NOT_SUPPORTED;
1750 }
1751
1752 /****************************************************************
1753 ****************************************************************/
1754
1755 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1756 struct netr_NetrEnumerateTrustedDomainsEx *r)
1757 {
1758 p->rng_fault_state = true;
1759 return WERR_NOT_SUPPORTED;
1760 }
1761
1762 /****************************************************************
1763 ****************************************************************/
1764
1765 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1766 struct netr_DsRAddressToSitenamesExW *r)
1767 {
1768 p->rng_fault_state = true;
1769 return WERR_NOT_SUPPORTED;
1770 }
1771
1772 /****************************************************************
1773 ****************************************************************/
1774
1775 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1776 struct netr_DsrGetDcSiteCoverageW *r)
1777 {
1778 p->rng_fault_state = true;
1779 return WERR_NOT_SUPPORTED;
1780 }
1781
1782 /****************************************************************
1783 ****************************************************************/
1784
1785 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1786 struct netr_DsrEnumerateDomainTrusts *r)
1787 {
1788 p->rng_fault_state = true;
1789 return WERR_NOT_SUPPORTED;
1790 }
1791
1792 /****************************************************************
1793 ****************************************************************/
1794
1795 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1796 struct netr_DsrDeregisterDNSHostRecords *r)
1797 {
1798 p->rng_fault_state = true;
1799 return WERR_NOT_SUPPORTED;
1800 }
1801
1802 /****************************************************************
1803 ****************************************************************/
1804
1805 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1806 struct netr_ServerTrustPasswordsGet *r)
1807 {
1808 p->rng_fault_state = true;
1809 return NT_STATUS_NOT_IMPLEMENTED;
1810 }
1811
1812 /****************************************************************
1813 ****************************************************************/
1814
1815 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1816 struct netr_DsRGetForestTrustInformation *r)
1817 {
1818 p->rng_fault_state = true;
1819 return WERR_NOT_SUPPORTED;
1820 }
1821
1822 /****************************************************************
1823 ****************************************************************/
1824
1825 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1826 struct netr_GetForestTrustInformation *r)
1827 {
1828 p->rng_fault_state = true;
1829 return WERR_NOT_SUPPORTED;
1830 }
1831
1832 /****************************************************************
1833 ****************************************************************/
1834
1835 NTSTATUS _netr_ServerGetTrustInfo(pipes_struct *p,
1836 struct netr_ServerGetTrustInfo *r)
1837 {
1838 p->rng_fault_state = true;
1839 return NT_STATUS_NOT_IMPLEMENTED;
1840 }
1841
Samba GIT mirror