source/rpc_client/cli_netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    NT Domain Authentication SMB / MSRPC client
   4    Copyright (C) Andrew Tridgell 1992-2000
   5    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
   6    Copyright (C) Tim Potter 2001
   7    Copyright (C) Paul Ashton                       1997.
   8    Copyright (C) Jeremy Allison                    1998.
   9    Copyright (C) Andrew Bartlett                   2001.
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 2 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program; if not, write to the Free Software
  23    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24 */
  25
  26 #include "includes.h"
  27
  28 /* LSA Request Challenge. Sends our challenge to server, then gets
  29    server response. These are used to generate the credentials. */
  30
  31 NTSTATUS cli_net_req_chal(struct cli_state *cli, DOM_CHAL *clnt_chal,
  32                           DOM_CHAL *srv_chal)
  33 {
  34         prs_struct qbuf, rbuf;
  35         NET_Q_REQ_CHAL q;
  36         NET_R_REQ_CHAL r;
  37         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  38
  39         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
  40         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
  41
  42         /* create and send a MSRPC command with api NET_REQCHAL */
  43
  44         DEBUG(4,("cli_net_req_chal: LSA Request Challenge from %s to %s: %s\n",
  45                  global_myname(), cli->desthost, credstr(clnt_chal->data)));
  46
  47         /* store the parameters */
  48         init_q_req_chal(&q, cli->srv_name_slash, global_myname(), clnt_chal);
  49
  50         /* Marshall data and send request */
  51
  52         if (!net_io_q_req_chal("", &q,  &qbuf, 0) ||
  53             !rpc_api_pipe_req(cli, NET_REQCHAL, &qbuf, &rbuf)) {
  54                 goto done;
  55         }
  56
  57         /* Unmarhall response */
  58
  59         if (!net_io_r_req_chal("", &r, &rbuf, 0)) {
  60                 goto done;
  61         }
  62
  63         result = r.status;
  64
  65         /* Return result */
  66
  67         if (NT_STATUS_IS_OK(result)) {
  68                 memcpy(srv_chal, r.srv_chal.data, sizeof(srv_chal->data));
  69         }
  70
  71  done:
  72         prs_mem_free(&qbuf);
  73         prs_mem_free(&rbuf);
  74
  75         return result;
  76 }
  77
  78 /****************************************************************************
  79 LSA Authenticate 2
  80
  81 Send the client credential, receive back a server credential.
  82 Ensure that the server credential returned matches the session key
  83 encrypt of the server challenge originally received. JRA.
  84 ****************************************************************************/
  85
  86 NTSTATUS cli_net_auth2(struct cli_state *cli,
  87                        uint16 sec_chan,
  88                        uint32 *neg_flags, DOM_CHAL *srv_chal)
  89 {
  90         prs_struct qbuf, rbuf;
  91         NET_Q_AUTH_2 q;
  92         NET_R_AUTH_2 r;
  93         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  94
  95         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
  96         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
  97
  98         /* create and send a MSRPC command with api NET_AUTH2 */
  99
 100         DEBUG(4,("cli_net_auth2: srv:%s acct:%s sc:%x mc: %s chal %s neg: %x\n",
 101                  cli->srv_name_slash, cli->mach_acct, sec_chan, global_myname(),
 102                  credstr(cli->clnt_cred.challenge.data), *neg_flags));
 103
 104         /* store the parameters */
 105         init_q_auth_2(&q, cli->srv_name_slash, cli->mach_acct,
 106                       sec_chan, global_myname(), &cli->clnt_cred.challenge,
 107                       *neg_flags);
 108
 109         /* turn parameters into data stream */
 110
 111         if (!net_io_q_auth_2("", &q,  &qbuf, 0) ||
 112             !rpc_api_pipe_req(cli, NET_AUTH2, &qbuf, &rbuf)) {
 113                 goto done;
 114         }
 115
 116         /* Unmarshall response */
 117
 118         if (!net_io_r_auth_2("", &r, &rbuf, 0)) {
 119                 goto done;
 120         }
 121
 122         result = r.status;
 123
 124         if (NT_STATUS_IS_OK(result)) {
 125                 UTIME zerotime;
 126
 127                 /*
 128                  * Check the returned value using the initial
 129                  * server received challenge.
 130                  */
 131
 132                 zerotime.time = 0;
 133                 if (cred_assert( &r.srv_chal, cli->sess_key, srv_chal,
 134                                  zerotime) == 0) {
 135
 136                         /*
 137                          * Server replied with bad credential. Fail.
 138                          */
 139                         DEBUG(0,("cli_net_auth2: server %s replied with bad credential (bad machine \
 140 password ?).\n", cli->desthost ));
 141                         result = NT_STATUS_ACCESS_DENIED;
 142                         goto done;
 143                 }
 144                 *neg_flags = r.srv_flgs.neg_flags;
 145         }
 146
 147  done:
 148         prs_mem_free(&qbuf);
 149         prs_mem_free(&rbuf);
 150
 151         return result;
 152 }
 153
 154 /****************************************************************************
 155 LSA Authenticate 3
 156
 157 Send the client credential, receive back a server credential.
 158 Ensure that the server credential returned matches the session key
 159 encrypt of the server challenge originally received. JRA.
 160 ****************************************************************************/
 161
 162 NTSTATUS cli_net_auth3(struct cli_state *cli,
 163                        uint16 sec_chan,
 164                        uint32 *neg_flags, DOM_CHAL *srv_chal)
 165 {
 166         prs_struct qbuf, rbuf;
 167         NET_Q_AUTH_3 q;
 168         NET_R_AUTH_3 r;
 169         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 170
 171         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
 172         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
 173
 174         /* create and send a MSRPC command with api NET_AUTH2 */
 175
 176         DEBUG(4,("cli_net_auth3: srv:%s acct:%s sc:%x mc: %s chal %s neg: %x\n",
 177                  cli->srv_name_slash, cli->mach_acct, sec_chan, global_myname(),
 178                  credstr(cli->clnt_cred.challenge.data), *neg_flags));
 179
 180         /* store the parameters */
 181         init_q_auth_3(&q, cli->srv_name_slash, cli->mach_acct,
 182                       sec_chan, global_myname(), &cli->clnt_cred.challenge,
 183                       *neg_flags);
 184
 185         /* turn parameters into data stream */
 186
 187         if (!net_io_q_auth_3("", &q,  &qbuf, 0) ||
 188             !rpc_api_pipe_req(cli, NET_AUTH3, &qbuf, &rbuf)) {
 189                 goto done;
 190         }
 191
 192         /* Unmarshall response */
 193
 194         if (!net_io_r_auth_3("", &r, &rbuf, 0)) {
 195                 goto done;
 196         }
 197
 198         result = r.status;
 199
 200         if (NT_STATUS_IS_OK(result)) {
 201                 UTIME zerotime;
 202
 203                 /*
 204                  * Check the returned value using the initial
 205                  * server received challenge.
 206                  */
 207
 208                 zerotime.time = 0;
 209                 if (cred_assert( &r.srv_chal, cli->sess_key, srv_chal,
 210                                  zerotime) == 0) {
 211
 212                         /*
 213                          * Server replied with bad credential. Fail.
 214                          */
 215                         DEBUG(0,("cli_net_auth3: server %s replied with bad credential (bad machine \
 216 password ?).\n", cli->desthost ));
 217                         result = NT_STATUS_ACCESS_DENIED;
 218                         goto done;
 219                 }
 220                 *neg_flags = r.srv_flgs.neg_flags;
 221         }
 222
 223  done:
 224         prs_mem_free(&qbuf);
 225         prs_mem_free(&rbuf);
 226
 227         return result;
 228 }
 229
 230 /* Initialize domain session credentials */
 231
 232 NTSTATUS cli_nt_setup_creds(struct cli_state *cli,
 233                             uint16 sec_chan,
 234                             const unsigned char mach_pwd[16], uint32 *neg_flags, int level)
 235 {
 236         DOM_CHAL clnt_chal;
 237         DOM_CHAL srv_chal;
 238         UTIME zerotime;
 239         NTSTATUS result;
 240
 241         /******************* Request Challenge ********************/
 242
 243         generate_random_buffer(clnt_chal.data, 8, False);
 244
 245         /* send a client challenge; receive a server challenge */
 246         result = cli_net_req_chal(cli, &clnt_chal, &srv_chal);
 247
 248         if (!NT_STATUS_IS_OK(result)) {
 249                 DEBUG(0,("cli_nt_setup_creds: request challenge failed\n"));
 250                 return result;
 251         }
 252
 253         /**************** Long-term Session key **************/
 254
 255         /* calculate the session key */
 256         cred_session_key(&clnt_chal, &srv_chal, mach_pwd,
 257                          cli->sess_key);
 258         memset((char *)cli->sess_key+8, '\0', 8);
 259
 260         /******************* Authenticate 2/3 ********************/
 261
 262         /* calculate auth-2/3 credentials */
 263         zerotime.time = 0;
 264         cred_create(cli->sess_key, &clnt_chal, zerotime, &cli->clnt_cred.challenge);
 265
 266         /*
 267          * Send client auth-2/3 challenge.
 268          * Receive an auth-2/3 challenge response and check it.
 269          */
 270         switch (level) {
 271                 case 2:
 272                         result = cli_net_auth2(cli, sec_chan, neg_flags, &srv_chal);
 273                         break;
 274                 case 3:
 275                         result = cli_net_auth3(cli, sec_chan, neg_flags, &srv_chal);
 276                         break;
 277                 default:
 278                         DEBUG(1,("cli_nt_setup_creds: unsupported auth level: %d\n", level));
 279                         break;
 280         }
 281
 282         if (!NT_STATUS_IS_OK(result))
 283                 DEBUG(3,("cli_nt_setup_creds: auth%d challenge failed %s\n", level, nt_errstr(result)));
 284
 285         return result;
 286 }
 287
 288 /* Logon Control 2 */
 289
 290 NTSTATUS cli_netlogon_logon_ctrl2(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 291                                   uint32 query_level)
 292 {
 293         prs_struct qbuf, rbuf;
 294         NET_Q_LOGON_CTRL2 q;
 295         NET_R_LOGON_CTRL2 r;
 296         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 297
 298         ZERO_STRUCT(q);
 299         ZERO_STRUCT(r);
 300
 301         /* Initialise parse structures */
 302
 303         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 304         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 305
 306         /* Initialise input parameters */
 307
 308         init_net_q_logon_ctrl2(&q, cli->srv_name_slash, query_level);
 309
 310         /* Marshall data and send request */
 311
 312         if (!net_io_q_logon_ctrl2("", &q, &qbuf, 0) ||
 313             !rpc_api_pipe_req(cli, NET_LOGON_CTRL2, &qbuf, &rbuf)) {
 314                 result = NT_STATUS_UNSUCCESSFUL;
 315                 goto done;
 316         }
 317
 318         /* Unmarshall response */
 319
 320         if (!net_io_r_logon_ctrl2("", &r, &rbuf, 0)) {
 321                 result = NT_STATUS_UNSUCCESSFUL;
 322                 goto done;
 323         }
 324
 325         result = r.status;
 326
 327  done:
 328         prs_mem_free(&qbuf);
 329         prs_mem_free(&rbuf);
 330
 331         return result;
 332 }
 333
 334 /* GetDCName */
 335
 336 NTSTATUS cli_netlogon_getdcname(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 337                                 const char *domainname, fstring dcname)
 338 {
 339         prs_struct qbuf, rbuf;
 340         NET_Q_GETDCNAME q;
 341         NET_R_GETDCNAME r;
 342         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 343
 344         ZERO_STRUCT(q);
 345         ZERO_STRUCT(r);
 346
 347         /* Initialise parse structures */
 348
 349         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 350         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 351
 352         /* Initialise input parameters */
 353
 354         init_net_q_getdcname(&q, cli->srv_name_slash, domainname);
 355
 356         /* Marshall data and send request */
 357
 358         if (!net_io_q_getdcname("", &q, &qbuf, 0) ||
 359             !rpc_api_pipe_req(cli, NET_GETDCNAME, &qbuf, &rbuf)) {
 360                 result = NT_STATUS_UNSUCCESSFUL;
 361                 goto done;
 362         }
 363
 364         /* Unmarshall response */
 365
 366         if (!net_io_r_getdcname("", &r, &rbuf, 0)) {
 367                 result = NT_STATUS_UNSUCCESSFUL;
 368                 goto done;
 369         }
 370
 371         result = r.status;
 372
 373         if (NT_STATUS_IS_OK(result))
 374                 rpcstr_pull_unistr2_fstring(dcname, &r.uni_dcname);
 375
 376  done:
 377         prs_mem_free(&qbuf);
 378         prs_mem_free(&rbuf);
 379
 380         return result;
 381 }
 382
 383 /****************************************************************************
 384 Generate the next creds to use.
 385 ****************************************************************************/
 386
 387 static void gen_next_creds( struct cli_state *cli, DOM_CRED *new_clnt_cred)
 388 {
 389         /*
 390          * Create the new client credentials.
 391          */
 392
 393         cli->clnt_cred.timestamp.time = time(NULL);
 394
 395         memcpy(new_clnt_cred, &cli->clnt_cred, sizeof(*new_clnt_cred));
 396
 397         /* Calculate the new credentials. */
 398         cred_create(cli->sess_key, &(cli->clnt_cred.challenge),
 399                     new_clnt_cred->timestamp, &(new_clnt_cred->challenge));
 400 }
 401
 402 /* Sam synchronisation */
 403
 404 NTSTATUS cli_netlogon_sam_sync(struct cli_state *cli, TALLOC_CTX *mem_ctx, DOM_CRED *ret_creds,
 405                                uint32 database_id, uint32 next_rid, uint32 *num_deltas,
 406                                SAM_DELTA_HDR **hdr_deltas,
 407                                SAM_DELTA_CTR **deltas)
 408 {
 409         prs_struct qbuf, rbuf;
 410         NET_Q_SAM_SYNC q;
 411         NET_R_SAM_SYNC r;
 412         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 413         DOM_CRED clnt_creds;
 414
 415         ZERO_STRUCT(q);
 416         ZERO_STRUCT(r);
 417
 418         /* Initialise parse structures */
 419
 420         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 421         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 422
 423         /* Initialise input parameters */
 424
 425         gen_next_creds(cli, &clnt_creds);
 426
 427         init_net_q_sam_sync(&q, cli->srv_name_slash, cli->clnt_name_slash + 2,
 428                             &clnt_creds, ret_creds, database_id, next_rid);
 429
 430         /* Marshall data and send request */
 431
 432         if (!net_io_q_sam_sync("", &q, &qbuf, 0) ||
 433             !rpc_api_pipe_req(cli, NET_SAM_SYNC, &qbuf, &rbuf)) {
 434                 result = NT_STATUS_UNSUCCESSFUL;
 435                 goto done;
 436         }
 437
 438         /* Unmarshall response */
 439
 440         if (!net_io_r_sam_sync("", cli->sess_key, &r, &rbuf, 0)) {
 441                 result = NT_STATUS_UNSUCCESSFUL;
 442                 goto done;
 443         }
 444
 445         /* Return results */
 446
 447         result = r.status;
 448         *num_deltas = r.num_deltas2;
 449         *hdr_deltas = r.hdr_deltas;
 450         *deltas = r.deltas;
 451
 452         memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
 453
 454  done:
 455         prs_mem_free(&qbuf);
 456         prs_mem_free(&rbuf);
 457
 458         return result;
 459 }
 460
 461 /* Sam synchronisation */
 462
 463 NTSTATUS cli_netlogon_sam_deltas(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 464                                  uint32 database_id, UINT64_S seqnum,
 465                                  uint32 *num_deltas,
 466                                  SAM_DELTA_HDR **hdr_deltas,
 467                                  SAM_DELTA_CTR **deltas)
 468 {
 469         prs_struct qbuf, rbuf;
 470         NET_Q_SAM_DELTAS q;
 471         NET_R_SAM_DELTAS r;
 472         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 473         DOM_CRED clnt_creds;
 474
 475         ZERO_STRUCT(q);
 476         ZERO_STRUCT(r);
 477
 478         /* Initialise parse structures */
 479
 480         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 481         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 482
 483         /* Initialise input parameters */
 484
 485         gen_next_creds(cli, &clnt_creds);
 486
 487         init_net_q_sam_deltas(&q, cli->srv_name_slash,
 488                               cli->clnt_name_slash + 2, &clnt_creds,
 489                               database_id, seqnum);
 490
 491         /* Marshall data and send request */
 492
 493         if (!net_io_q_sam_deltas("", &q, &qbuf, 0) ||
 494             !rpc_api_pipe_req(cli, NET_SAM_DELTAS, &qbuf, &rbuf)) {
 495                 result = NT_STATUS_UNSUCCESSFUL;
 496                 goto done;
 497         }
 498
 499         /* Unmarshall response */
 500
 501         if (!net_io_r_sam_deltas("", cli->sess_key, &r, &rbuf, 0)) {
 502                 result = NT_STATUS_UNSUCCESSFUL;
 503                 goto done;
 504         }
 505
 506         /* Return results */
 507
 508         result = r.status;
 509         *num_deltas = r.num_deltas2;
 510         *hdr_deltas = r.hdr_deltas;
 511         *deltas = r.deltas;
 512
 513  done:
 514         prs_mem_free(&qbuf);
 515         prs_mem_free(&rbuf);
 516
 517         return result;
 518 }
 519
 520 /* Logon domain user */
 521
 522 NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 523                                 DOM_CRED *ret_creds,
 524                                 const char *username, const char *password,
 525                                 int logon_type)
 526 {
 527         prs_struct qbuf, rbuf;
 528         NET_Q_SAM_LOGON q;
 529         NET_R_SAM_LOGON r;
 530         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 531         DOM_CRED clnt_creds, dummy_rtn_creds;
 532         NET_ID_INFO_CTR ctr;
 533         NET_USER_INFO_3 user;
 534         int validation_level = 3;
 535
 536         ZERO_STRUCT(q);
 537         ZERO_STRUCT(r);
 538         ZERO_STRUCT(dummy_rtn_creds);
 539
 540         /* Initialise parse structures */
 541
 542         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 543         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 544
 545         /* Initialise input parameters */
 546
 547         gen_next_creds(cli, &clnt_creds);
 548
 549         q.validation_level = validation_level;
 550
 551         if (ret_creds == NULL)
 552                 ret_creds = &dummy_rtn_creds;
 553
 554         ctr.switch_value = logon_type;
 555
 556         switch (logon_type) {
 557         case INTERACTIVE_LOGON_TYPE: {
 558                 unsigned char lm_owf_user_pwd[16], nt_owf_user_pwd[16];
 559
 560                 nt_lm_owf_gen(password, nt_owf_user_pwd, lm_owf_user_pwd);
 561
 562                 init_id_info1(&ctr.auth.id1, lp_workgroup(),
 563                               0, /* param_ctrl */
 564                               0xdead, 0xbeef, /* LUID? */
 565                               username, cli->clnt_name_slash,
 566                               (const char *)cli->sess_key, lm_owf_user_pwd,
 567                               nt_owf_user_pwd);
 568
 569                 break;
 570         }
 571         case NET_LOGON_TYPE: {
 572                 uint8 chal[8];
 573                 unsigned char local_lm_response[24];
 574                 unsigned char local_nt_response[24];
 575
 576                 generate_random_buffer(chal, 8, False);
 577
 578                 SMBencrypt(password, chal, local_lm_response);
 579                 SMBNTencrypt(password, chal, local_nt_response);
 580
 581                 init_id_info2(&ctr.auth.id2, lp_workgroup(),
 582                               0, /* param_ctrl */
 583                               0xdead, 0xbeef, /* LUID? */
 584                               username, cli->clnt_name_slash, chal,
 585                               local_lm_response, 24, local_nt_response, 24);
 586                 break;
 587         }
 588         default:
 589                 DEBUG(0, ("switch value %d not supported\n",
 590                           ctr.switch_value));
 591                 goto done;
 592         }
 593
 594         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname(),
 595                       &clnt_creds, ret_creds, logon_type,
 596                       &ctr);
 597
 598         /* Marshall data and send request */
 599
 600         if (!net_io_q_sam_logon("", &q, &qbuf, 0) ||
 601             !rpc_api_pipe_req(cli, NET_SAMLOGON, &qbuf, &rbuf)) {
 602                 goto done;
 603         }
 604
 605         /* Unmarshall response */
 606
 607         r.user = &user;
 608
 609         if (!net_io_r_sam_logon("", &r, &rbuf, 0)) {
 610                 goto done;
 611         }
 612
 613         /* Return results */
 614
 615         result = r.status;
 616         memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
 617
 618  done:
 619         prs_mem_free(&qbuf);
 620         prs_mem_free(&rbuf);
 621
 622         return result;
 623 }
 624
 625
 626 /**
 627  * Logon domain user with an 'network' SAM logon
 628  *
 629  * @param info3 Pointer to a NET_USER_INFO_3 already allocated by the caller.
 630  **/
 631
 632 NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 633                                         DOM_CRED *ret_creds,
 634                                         const char *username, const char *domain, const char *workstation,
 635                                         const uint8 chal[8],
 636                                         DATA_BLOB lm_response, DATA_BLOB nt_response,
 637                                         NET_USER_INFO_3 *info3)
 638
 639 {
 640         prs_struct qbuf, rbuf;
 641         NET_Q_SAM_LOGON q;
 642         NET_R_SAM_LOGON r;
 643         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 644         DOM_CRED clnt_creds, dummy_rtn_creds;
 645         NET_ID_INFO_CTR ctr;
 646         int validation_level = 3;
 647         char *workstation_name_slash;
 648         uint8 netlogon_sess_key[16];
 649         static uint8 zeros[16];
 650
 651         ZERO_STRUCT(q);
 652         ZERO_STRUCT(r);
 653         ZERO_STRUCT(dummy_rtn_creds);
 654
 655         workstation_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", workstation);
 656
 657         if (!workstation_name_slash) {
 658                 DEBUG(0, ("talloc_asprintf failed!\n"));
 659                 return NT_STATUS_NO_MEMORY;
 660         }
 661
 662         /* Initialise parse structures */
 663
 664         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 665         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 666
 667         /* Initialise input parameters */
 668
 669         gen_next_creds(cli, &clnt_creds);
 670
 671         q.validation_level = validation_level;
 672
 673         if (ret_creds == NULL)
 674                 ret_creds = &dummy_rtn_creds;
 675
 676         ctr.switch_value = NET_LOGON_TYPE;
 677
 678         init_id_info2(&ctr.auth.id2, domain,
 679                       0, /* param_ctrl */
 680                       0xdead, 0xbeef, /* LUID? */
 681                       username, workstation_name_slash, (const uchar*)chal,
 682                       lm_response.data, lm_response.length, nt_response.data, nt_response.length);
 683
 684         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname(),
 685                       &clnt_creds, ret_creds, NET_LOGON_TYPE,
 686                       &ctr);
 687
 688         /* Marshall data and send request */
 689
 690         if (!net_io_q_sam_logon("", &q, &qbuf, 0) ||
 691             !rpc_api_pipe_req(cli, NET_SAMLOGON, &qbuf, &rbuf)) {
 692                 goto done;
 693         }
 694
 695         /* Unmarshall response */
 696
 697         r.user = info3;
 698
 699         if (!net_io_r_sam_logon("", &r, &rbuf, 0)) {
 700                 goto done;
 701         }
 702
 703         ZERO_STRUCT(netlogon_sess_key);
 704         memcpy(netlogon_sess_key, cli->sess_key, 8);
 705
 706         if (memcmp(zeros, info3->user_sess_key, 16) != 0) {
 707                 SamOEMhash(info3->user_sess_key, netlogon_sess_key, 16);
 708         } else {
 709                 memset(info3->user_sess_key, '\0', 16);
 710         }
 711
 712         if (memcmp(zeros, info3->padding, 16) != 0) {
 713                 SamOEMhash(info3->padding, netlogon_sess_key, 16);
 714         } else {
 715                 memset(info3->padding, '\0', 16);
 716         }
 717
 718         /* Return results */
 719
 720         result = r.status;
 721         memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
 722
 723  done:
 724         prs_mem_free(&qbuf);
 725         prs_mem_free(&rbuf);
 726
 727         return result;
 728 }
 729
 730 /***************************************************************************
 731 LSA Server Password Set.
 732 ****************************************************************************/
 733
 734 NTSTATUS cli_net_srv_pwset(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 735                            const char *machine_name, uint8 hashed_mach_pwd[16])
 736 {
 737         prs_struct rbuf;
 738         prs_struct qbuf;
 739         DOM_CRED new_clnt_cred;
 740         NET_Q_SRV_PWSET q_s;
 741         uint16 sec_chan_type = 2;
 742         NTSTATUS nt_status;
 743
 744         gen_next_creds( cli, &new_clnt_cred);
 745
 746         prs_init(&qbuf , 1024, mem_ctx, MARSHALL);
 747         prs_init(&rbuf, 0,    mem_ctx, UNMARSHALL);
 748
 749         DEBUG(4,("cli_net_srv_pwset: srv:%s acct:%s sc: %d mc: %s clnt %s %x\n",
 750                  cli->srv_name_slash, cli->mach_acct, sec_chan_type, machine_name,
 751                  credstr(new_clnt_cred.challenge.data), new_clnt_cred.timestamp.time));
 752
 753         /* store the parameters */
 754         init_q_srv_pwset(&q_s, cli->srv_name_slash, (const char *)cli->sess_key,
 755                          cli->mach_acct, sec_chan_type, machine_name,
 756                          &new_clnt_cred, hashed_mach_pwd);
 757
 758         /* turn parameters into data stream */
 759         if(!net_io_q_srv_pwset("", &q_s,  &qbuf, 0)) {
 760                 DEBUG(0,("cli_net_srv_pwset: Error : failed to marshall NET_Q_SRV_PWSET struct.\n"));
 761                 nt_status = NT_STATUS_UNSUCCESSFUL;
 762                 goto done;
 763         }
 764
 765         /* send the data on \PIPE\ */
 766         if (rpc_api_pipe_req(cli, NET_SRVPWSET, &qbuf, &rbuf))
 767         {
 768                 NET_R_SRV_PWSET r_s;
 769
 770                 if (!net_io_r_srv_pwset("", &r_s, &rbuf, 0)) {
 771                         nt_status =  NT_STATUS_UNSUCCESSFUL;
 772                         goto done;
 773                 }
 774
 775                 nt_status = r_s.status;
 776
 777                 if (!NT_STATUS_IS_OK(r_s.status))
 778                 {
 779                         /* report error code */
 780                         DEBUG(0,("cli_net_srv_pwset: %s\n", nt_errstr(nt_status)));
 781                         goto done;
 782                 }
 783
 784                 /* Update the credentials. */
 785                 if (!clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &(r_s.srv_cred)))
 786                 {
 787                         /*
 788                          * Server replied with bad credential. Fail.
 789                          */
 790                         DEBUG(0,("cli_net_srv_pwset: server %s replied with bad credential (bad machine \
 791 password ?).\n", cli->desthost ));
 792                         nt_status = NT_STATUS_UNSUCCESSFUL;
 793                 }
 794         }
 795
 796  done:
 797         prs_mem_free(&qbuf);
 798         prs_mem_free(&rbuf);
 799
 800         return nt_status;
 801 }
 802