source3/rpc_client/cli_netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    NT Domain Authentication SMB / MSRPC client
   4    Copyright (C) Andrew Tridgell 1992-2000
   5    Copyright (C) Jeremy Allison                    1998.
   6    Largely re-written by Jeremy Allison (C)        2005.
   7    Copyright (C) Guenther Deschner                 2008.
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/filesys.h"
  25 #include "libsmb/libsmb.h"
  26 #include "rpc_client/rpc_client.h"
  27 #include "rpc_client/cli_pipe.h"
  28 #include "../libcli/auth/libcli_auth.h"
  29 #include "../libcli/auth/netlogon_creds_cli.h"
  30 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
  31 #include "../librpc/gen_ndr/schannel.h"
  32 #include "rpc_client/cli_netlogon.h"
  33 #include "rpc_client/init_netlogon.h"
  34 #include "rpc_client/util_netlogon.h"
  35 #include "../libcli/security/security.h"
  36 #include "lib/param/param.h"
  37 #include "libcli/smb/smbXcli_base.h"
  38 #include "dbwrap/dbwrap.h"
  39 #include "dbwrap/dbwrap_open.h"
  40 #include "util_tdb.h"
  41
  42
  43 NTSTATUS rpccli_pre_open_netlogon_creds(void)
  44 {
  45         static bool already_open = false;
  46         TALLOC_CTX *frame;
  47         struct loadparm_context *lp_ctx;
  48         char *fname;
  49         struct db_context *global_db;
  50         NTSTATUS status;
  51
  52         if (already_open) {
  53                 return NT_STATUS_OK;
  54         }
  55
  56         frame = talloc_stackframe();
  57
  58         lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());
  59         if (lp_ctx == NULL) {
  60                 TALLOC_FREE(frame);
  61                 return NT_STATUS_NO_MEMORY;
  62         }
  63
  64         fname = lpcfg_private_db_path(frame, lp_ctx, "netlogon_creds_cli");
  65         if (fname == NULL) {
  66                 TALLOC_FREE(frame);
  67                 return NT_STATUS_NO_MEMORY;
  68         }
  69
  70         global_db = db_open(talloc_autofree_context(), fname,
  71                             0, TDB_CLEAR_IF_FIRST|TDB_INCOMPATIBLE_HASH,
  72                             O_RDWR|O_CREAT, 0600, DBWRAP_LOCK_ORDER_2,
  73                             DBWRAP_FLAG_OPTIMIZE_READONLY_ACCESS);
  74         if (global_db == NULL) {
  75                 TALLOC_FREE(frame);
  76                 return NT_STATUS_NO_MEMORY;
  77         }
  78
  79         status = netlogon_creds_cli_set_global_db(&global_db);
  80         TALLOC_FREE(frame);
  81         if (!NT_STATUS_IS_OK(status)) {
  82                 return status;
  83         }
  84
  85         already_open = true;
  86         return NT_STATUS_OK;
  87 }
  88
  89 NTSTATUS rpccli_create_netlogon_creds(const char *server_computer,
  90                                       const char *server_netbios_domain,
  91                                       const char *client_account,
  92                                       enum netr_SchannelType sec_chan_type,
  93                                       struct messaging_context *msg_ctx,
  94                                       TALLOC_CTX *mem_ctx,
  95                                       struct netlogon_creds_cli_context **netlogon_creds)
  96 {
  97         TALLOC_CTX *frame = talloc_stackframe();
  98         struct loadparm_context *lp_ctx;
  99         NTSTATUS status;
 100
 101         status = rpccli_pre_open_netlogon_creds();
 102         if (!NT_STATUS_IS_OK(status)) {
 103                 TALLOC_FREE(frame);
 104                 return status;
 105         }
 106
 107         lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());
 108         if (lp_ctx == NULL) {
 109                 TALLOC_FREE(frame);
 110                 return NT_STATUS_NO_MEMORY;
 111         }
 112         status = netlogon_creds_cli_context_global(lp_ctx,
 113                                                    msg_ctx,
 114                                                    client_account,
 115                                                    sec_chan_type,
 116                                                    server_computer,
 117                                                    server_netbios_domain,
 118                                                    mem_ctx, netlogon_creds);
 119         TALLOC_FREE(frame);
 120         if (!NT_STATUS_IS_OK(status)) {
 121                 return status;
 122         }
 123
 124         return NT_STATUS_OK;
 125 }
 126
 127 NTSTATUS rpccli_create_netlogon_creds_with_creds(struct cli_credentials *creds,
 128                                                  const char *server_computer,
 129                                                  struct messaging_context *msg_ctx,
 130                                                  TALLOC_CTX *mem_ctx,
 131                                                  struct netlogon_creds_cli_context **netlogon_creds)
 132 {
 133         enum netr_SchannelType sec_chan_type;
 134         const char *server_netbios_domain;
 135         const char *client_account;
 136
 137         sec_chan_type = cli_credentials_get_secure_channel_type(creds);
 138         if (sec_chan_type == SEC_CHAN_NULL) {
 139                 return NT_STATUS_INVALID_PARAMETER_MIX;
 140         }
 141
 142         client_account = cli_credentials_get_username(creds);
 143         server_netbios_domain = cli_credentials_get_domain(creds);
 144
 145         return rpccli_create_netlogon_creds(server_computer,
 146                                             server_netbios_domain,
 147                                             client_account,
 148                                             sec_chan_type,
 149                                             msg_ctx, mem_ctx,
 150                                             netlogon_creds);
 151 }
 152
 153 NTSTATUS rpccli_setup_netlogon_creds(struct cli_state *cli,
 154                                      enum dcerpc_transport_t transport,
 155                                      struct netlogon_creds_cli_context *netlogon_creds,
 156                                      bool force_reauth,
 157                                      struct samr_Password current_nt_hash,
 158                                      const struct samr_Password *previous_nt_hash)
 159 {
 160         TALLOC_CTX *frame = talloc_stackframe();
 161         struct rpc_pipe_client *netlogon_pipe = NULL;
 162         struct netlogon_creds_CredentialState *creds = NULL;
 163         NTSTATUS status;
 164
 165         status = netlogon_creds_cli_get(netlogon_creds,
 166                                         frame, &creds);
 167         if (NT_STATUS_IS_OK(status)) {
 168                 const char *action = "using";
 169
 170                 if (force_reauth) {
 171                         action = "overwrite";
 172                 }
 173
 174                 DEBUG(5,("%s: %s cached netlogon_creds cli[%s/%s] to %s\n",
 175                          __FUNCTION__, action,
 176                          creds->account_name, creds->computer_name,
 177                          smbXcli_conn_remote_name(cli->conn)));
 178                 if (!force_reauth) {
 179                         TALLOC_FREE(frame);
 180                         return NT_STATUS_OK;
 181                 }
 182                 TALLOC_FREE(creds);
 183         }
 184
 185         status = cli_rpc_pipe_open_noauth_transport(cli,
 186                                                     transport,
 187                                                     &ndr_table_netlogon,
 188                                                     &netlogon_pipe);
 189         if (!NT_STATUS_IS_OK(status)) {
 190                 DEBUG(5,("%s: failed to open noauth netlogon connection to %s - %s\n",
 191                          __FUNCTION__,
 192                          smbXcli_conn_remote_name(cli->conn),
 193                          nt_errstr(status)));
 194                 TALLOC_FREE(frame);
 195                 return status;
 196         }
 197         talloc_steal(frame, netlogon_pipe);
 198
 199         status = netlogon_creds_cli_auth(netlogon_creds,
 200                                          netlogon_pipe->binding_handle,
 201                                          current_nt_hash,
 202                                          previous_nt_hash);
 203         if (!NT_STATUS_IS_OK(status)) {
 204                 TALLOC_FREE(frame);
 205                 return status;
 206         }
 207
 208         status = netlogon_creds_cli_get(netlogon_creds,
 209                                         frame, &creds);
 210         if (!NT_STATUS_IS_OK(status)) {
 211                 TALLOC_FREE(frame);
 212                 return NT_STATUS_INTERNAL_ERROR;
 213         }
 214
 215         DEBUG(5,("%s: using new netlogon_creds cli[%s/%s] to %s\n",
 216                  __FUNCTION__,
 217                  creds->account_name, creds->computer_name,
 218                  smbXcli_conn_remote_name(cli->conn)));
 219
 220         TALLOC_FREE(frame);
 221         return NT_STATUS_OK;
 222 }
 223
 224 NTSTATUS rpccli_setup_netlogon_creds_with_creds(struct cli_state *cli,
 225                                                 enum dcerpc_transport_t transport,
 226                                                 struct netlogon_creds_cli_context *netlogon_creds,
 227                                                 bool force_reauth,
 228                                                 struct cli_credentials *creds)
 229 {
 230         struct samr_Password *current_nt_hash = NULL;
 231         struct samr_Password *previous_nt_hash = NULL;
 232         NTSTATUS status;
 233
 234         current_nt_hash = cli_credentials_get_nt_hash(creds, talloc_tos());
 235         if (current_nt_hash == NULL) {
 236                 return NT_STATUS_NO_MEMORY;
 237         }
 238
 239         previous_nt_hash = cli_credentials_get_old_nt_hash(creds, talloc_tos());
 240
 241         status = rpccli_setup_netlogon_creds(cli, transport,
 242                                              netlogon_creds,
 243                                              force_reauth,
 244                                              *current_nt_hash,
 245                                              previous_nt_hash);
 246         TALLOC_FREE(current_nt_hash);
 247         TALLOC_FREE(previous_nt_hash);
 248         if (!NT_STATUS_IS_OK(status)) {
 249                 return status;
 250         }
 251
 252         return NT_STATUS_OK;
 253 }
 254
 255 static NTSTATUS map_validation_to_info3(TALLOC_CTX *mem_ctx,
 256                                         uint16_t validation_level,
 257                                         union netr_Validation *validation,
 258                                         struct netr_SamInfo3 **info3_p)
 259 {
 260         struct netr_SamInfo3 *info3;
 261         NTSTATUS status;
 262
 263         if (validation == NULL) {
 264                 return NT_STATUS_INVALID_PARAMETER;
 265         }
 266
 267         switch (validation_level) {
 268         case 3:
 269                 if (validation->sam3 == NULL) {
 270                         return NT_STATUS_INVALID_PARAMETER;
 271                 }
 272
 273                 info3 = talloc_move(mem_ctx, &validation->sam3);
 274                 break;
 275         case 6:
 276                 if (validation->sam6 == NULL) {
 277                         return NT_STATUS_INVALID_PARAMETER;
 278                 }
 279
 280                 info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 281                 if (info3 == NULL) {
 282                         return NT_STATUS_NO_MEMORY;
 283                 }
 284                 status = copy_netr_SamBaseInfo(info3, &validation->sam6->base, &info3->base);
 285                 if (!NT_STATUS_IS_OK(status)) {
 286                         TALLOC_FREE(info3);
 287                         return status;
 288                 }
 289
 290                 info3->sidcount = validation->sam6->sidcount;
 291                 info3->sids = talloc_move(info3, &validation->sam6->sids);
 292                 break;
 293         default:
 294                 return NT_STATUS_BAD_VALIDATION_CLASS;
 295         }
 296
 297         *info3_p = info3;
 298
 299         return NT_STATUS_OK;
 300 }
 301
 302 /* Logon domain user */
 303
 304 NTSTATUS rpccli_netlogon_password_logon(struct netlogon_creds_cli_context *creds,
 305                                         struct dcerpc_binding_handle *binding_handle,
 306                                         TALLOC_CTX *mem_ctx,
 307                                         uint32_t logon_parameters,
 308                                         const char *domain,
 309                                         const char *username,
 310                                         const char *password,
 311                                         const char *workstation,
 312                                         enum netr_LogonInfoClass logon_type,
 313                                         struct netr_SamInfo3 **info3)
 314 {
 315         TALLOC_CTX *frame = talloc_stackframe();
 316         NTSTATUS status;
 317         union netr_LogonLevel *logon;
 318         uint16_t validation_level = 0;
 319         union netr_Validation *validation = NULL;
 320         uint8_t authoritative = 0;
 321         uint32_t flags = 0;
 322         char *workstation_slash = NULL;
 323
 324         logon = talloc_zero(frame, union netr_LogonLevel);
 325         if (logon == NULL) {
 326                 TALLOC_FREE(frame);
 327                 return NT_STATUS_NO_MEMORY;
 328         }
 329
 330         if (workstation == NULL) {
 331                 workstation = lp_netbios_name();
 332         }
 333
 334         workstation_slash = talloc_asprintf(frame, "\\\\%s", workstation);
 335         if (workstation_slash == NULL) {
 336                 TALLOC_FREE(frame);
 337                 return NT_STATUS_NO_MEMORY;
 338         }
 339
 340         /* Initialise input parameters */
 341
 342         switch (logon_type) {
 343         case NetlogonInteractiveInformation: {
 344
 345                 struct netr_PasswordInfo *password_info;
 346
 347                 struct samr_Password lmpassword;
 348                 struct samr_Password ntpassword;
 349
 350                 password_info = talloc_zero(frame, struct netr_PasswordInfo);
 351                 if (password_info == NULL) {
 352                         TALLOC_FREE(frame);
 353                         return NT_STATUS_NO_MEMORY;
 354                 }
 355
 356                 nt_lm_owf_gen(password, ntpassword.hash, lmpassword.hash);
 357
 358                 password_info->identity_info.domain_name.string         = domain;
 359                 password_info->identity_info.parameter_control          = logon_parameters;
 360                 password_info->identity_info.logon_id_low               = 0xdead;
 361                 password_info->identity_info.logon_id_high              = 0xbeef;
 362                 password_info->identity_info.account_name.string        = username;
 363                 password_info->identity_info.workstation.string         = workstation_slash;
 364
 365                 password_info->lmpassword = lmpassword;
 366                 password_info->ntpassword = ntpassword;
 367
 368                 logon->password = password_info;
 369
 370                 break;
 371         }
 372         case NetlogonNetworkInformation: {
 373                 struct netr_NetworkInfo *network_info;
 374                 uint8 chal[8];
 375                 unsigned char local_lm_response[24];
 376                 unsigned char local_nt_response[24];
 377                 struct netr_ChallengeResponse lm;
 378                 struct netr_ChallengeResponse nt;
 379
 380                 ZERO_STRUCT(lm);
 381                 ZERO_STRUCT(nt);
 382
 383                 network_info = talloc_zero(frame, struct netr_NetworkInfo);
 384                 if (network_info == NULL) {
 385                         TALLOC_FREE(frame);
 386                         return NT_STATUS_NO_MEMORY;
 387                 }
 388
 389                 generate_random_buffer(chal, 8);
 390
 391                 SMBencrypt(password, chal, local_lm_response);
 392                 SMBNTencrypt(password, chal, local_nt_response);
 393
 394                 lm.length = 24;
 395                 lm.data = local_lm_response;
 396
 397                 nt.length = 24;
 398                 nt.data = local_nt_response;
 399
 400                 network_info->identity_info.domain_name.string          = domain;
 401                 network_info->identity_info.parameter_control           = logon_parameters;
 402                 network_info->identity_info.logon_id_low                = 0xdead;
 403                 network_info->identity_info.logon_id_high               = 0xbeef;
 404                 network_info->identity_info.account_name.string         = username;
 405                 network_info->identity_info.workstation.string          = workstation_slash;
 406
 407                 memcpy(network_info->challenge, chal, 8);
 408                 network_info->nt = nt;
 409                 network_info->lm = lm;
 410
 411                 logon->network = network_info;
 412
 413                 break;
 414         }
 415         default:
 416                 DEBUG(0, ("switch value %d not supported\n",
 417                         logon_type));
 418                 TALLOC_FREE(frame);
 419                 return NT_STATUS_INVALID_INFO_CLASS;
 420         }
 421
 422         status = netlogon_creds_cli_LogonSamLogon(creds,
 423                                                   binding_handle,
 424                                                   logon_type,
 425                                                   logon,
 426                                                   frame,
 427                                                   &validation_level,
 428                                                   &validation,
 429                                                   &authoritative,
 430                                                   &flags);
 431         if (!NT_STATUS_IS_OK(status)) {
 432                 TALLOC_FREE(frame);
 433                 return status;
 434         }
 435
 436         status = map_validation_to_info3(mem_ctx,
 437                                          validation_level, validation,
 438                                          info3);
 439         TALLOC_FREE(frame);
 440         if (!NT_STATUS_IS_OK(status)) {
 441                 return status;
 442         }
 443
 444
 445         return NT_STATUS_OK;
 446 }
 447
 448 /**
 449  * Logon domain user with an 'network' SAM logon
 450  *
 451  * @param info3 Pointer to a NET_USER_INFO_3 already allocated by the caller.
 452  **/
 453
 454
 455 NTSTATUS rpccli_netlogon_network_logon(struct netlogon_creds_cli_context *creds,
 456                                        struct dcerpc_binding_handle *binding_handle,
 457                                        TALLOC_CTX *mem_ctx,
 458                                        uint32_t logon_parameters,
 459                                        const char *username,
 460                                        const char *domain,
 461                                        const char *workstation,
 462                                        const uint8 chal[8],
 463                                        DATA_BLOB lm_response,
 464                                        DATA_BLOB nt_response,
 465                                        uint8_t *authoritative,
 466                                        uint32_t *flags,
 467                                        struct netr_SamInfo3 **info3)
 468 {
 469         NTSTATUS status;
 470         const char *workstation_name_slash;
 471         union netr_LogonLevel *logon = NULL;
 472         struct netr_NetworkInfo *network_info;
 473         uint16_t validation_level = 0;
 474         union netr_Validation *validation = NULL;
 475         uint8_t _authoritative = 0;
 476         uint32_t _flags = 0;
 477         struct netr_ChallengeResponse lm;
 478         struct netr_ChallengeResponse nt;
 479
 480         *info3 = NULL;
 481
 482         if (authoritative == NULL) {
 483                 authoritative = &_authoritative;
 484         }
 485         if (flags == NULL) {
 486                 flags = &_flags;
 487         }
 488
 489         ZERO_STRUCT(lm);
 490         ZERO_STRUCT(nt);
 491
 492         logon = talloc_zero(mem_ctx, union netr_LogonLevel);
 493         if (!logon) {
 494                 return NT_STATUS_NO_MEMORY;
 495         }
 496
 497         network_info = talloc_zero(mem_ctx, struct netr_NetworkInfo);
 498         if (!network_info) {
 499                 return NT_STATUS_NO_MEMORY;
 500         }
 501
 502         if (workstation[0] != '\\' && workstation[1] != '\\') {
 503                 workstation_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", workstation);
 504         } else {
 505                 workstation_name_slash = workstation;
 506         }
 507
 508         if (!workstation_name_slash) {
 509                 DEBUG(0, ("talloc_asprintf failed!\n"));
 510                 return NT_STATUS_NO_MEMORY;
 511         }
 512
 513         /* Initialise input parameters */
 514
 515         lm.data = lm_response.data;
 516         lm.length = lm_response.length;
 517         nt.data = nt_response.data;
 518         nt.length = nt_response.length;
 519
 520         network_info->identity_info.domain_name.string          = domain;
 521         network_info->identity_info.parameter_control           = logon_parameters;
 522         network_info->identity_info.logon_id_low                = 0xdead;
 523         network_info->identity_info.logon_id_high               = 0xbeef;
 524         network_info->identity_info.account_name.string         = username;
 525         network_info->identity_info.workstation.string          = workstation_name_slash;
 526
 527         memcpy(network_info->challenge, chal, 8);
 528         network_info->nt = nt;
 529         network_info->lm = lm;
 530
 531         logon->network = network_info;
 532
 533         /* Marshall data and send request */
 534
 535         status = netlogon_creds_cli_LogonSamLogon(creds,
 536                                                   binding_handle,
 537                                                   NetlogonNetworkInformation,
 538                                                   logon,
 539                                                   mem_ctx,
 540                                                   &validation_level,
 541                                                   &validation,
 542                                                   authoritative,
 543                                                   flags);
 544         if (!NT_STATUS_IS_OK(status)) {
 545                 return status;
 546         }
 547
 548         status = map_validation_to_info3(mem_ctx,
 549                                          validation_level, validation,
 550                                          info3);
 551         if (!NT_STATUS_IS_OK(status)) {
 552                 return status;
 553         }
 554
 555         return NT_STATUS_OK;
 556 }