?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r12018: more 3.0.21 changes. This is a full sync except for changes to rpc-server...
[Samba.git] / source / rpc_server / srv_netlog_nt.c
blobd0d47be9f298b38a469f3a8332cbae0be63227db
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997.
7 * Copyright (C) Jeremy Allison 1998-2001.
8 * Copyright (C) Andrew Bartlett 2001.
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 */
24
25 /* This is the implementation of the netlogon pipe. */
26
27 #include "includes.h"
28
29 extern userdom_struct current_user_info;
30
31 #undef DBGC_CLASS
32 #define DBGC_CLASS DBGC_RPC_SRV
33
34 /*************************************************************************
35 init_net_r_req_chal:
36 *************************************************************************/
37
38 static void init_net_r_req_chal(NET_R_REQ_CHAL *r_c,
39 DOM_CHAL *srv_chal, NTSTATUS status)
40 {
41 DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__));
42 memcpy(r_c->srv_chal.data, srv_chal->data, sizeof(srv_chal->data));
43 r_c->status = status;
44 }
45
46 /*************************************************************************
47 error messages cropping up when using nltest.exe...
48 *************************************************************************/
49
50 #define ERROR_NO_SUCH_DOMAIN 0x54b
51 #define ERROR_NO_LOGON_SERVERS 0x51f
52 #define NO_ERROR 0x0
53
54 /*************************************************************************
55 net_reply_logon_ctrl:
56 *************************************************************************/
57
58 NTSTATUS _net_logon_ctrl(pipes_struct *p, NET_Q_LOGON_CTRL *q_u,
59 NET_R_LOGON_CTRL *r_u)
60 {
61 uint32 flags = 0x0;
62 uint32 pdc_connection_status = 0x00; /* Maybe a win32 error code? */
63
64 /* Setup the Logon Control response */
65
66 init_net_r_logon_ctrl(r_u, q_u->query_level, flags,
67 pdc_connection_status);
68
69 return r_u->status;
70 }
71
72 /****************************************************************************
73 Send a message to smbd to do a sam synchronisation
74 **************************************************************************/
75
76 static void send_sync_message(void)
77 {
78 TDB_CONTEXT *tdb;
79
80 tdb = tdb_open_log(lock_path("connections.tdb"), 0,
81 TDB_DEFAULT, O_RDONLY, 0);
82
83 if (!tdb) {
84 DEBUG(3, ("send_sync_message(): failed to open connections "
85 "database\n"));
86 return;
87 }
88
89 DEBUG(3, ("sending sam synchronisation message\n"));
90
91 message_send_all(tdb, MSG_SMB_SAM_SYNC, NULL, 0, False, NULL);
92
93 tdb_close(tdb);
94 }
95
96 /*************************************************************************
97 net_reply_logon_ctrl2:
98 *************************************************************************/
99
100 NTSTATUS _net_logon_ctrl2(pipes_struct *p, NET_Q_LOGON_CTRL2 *q_u, NET_R_LOGON_CTRL2 *r_u)
101 {
102 uint32 flags = 0x0;
103 uint32 pdc_connection_status = 0x0;
104 uint32 logon_attempts = 0x0;
105 uint32 tc_status;
106 fstring servername, domain, dc_name, dc_name2;
107 struct in_addr dc_ip;
108
109 /* this should be \\global_myname() */
110 unistr2_to_ascii(servername, &q_u->uni_server_name, sizeof(servername));
111
112 r_u->status = NT_STATUS_OK;
113
114 tc_status = ERROR_NO_SUCH_DOMAIN;
115 fstrcpy( dc_name, "" );
116
117 switch ( q_u->function_code ) {
118 case NETLOGON_CONTROL_TC_QUERY:
119 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
120
121 if ( !is_trusted_domain( domain ) )
122 break;
123
124 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ip ) ) {
125 tc_status = ERROR_NO_LOGON_SERVERS;
126 break;
127 }
128
129 fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
130
131 tc_status = NO_ERROR;
132
133 break;
134
135 case NETLOGON_CONTROL_REDISCOVER:
136 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
137
138 if ( !is_trusted_domain( domain ) )
139 break;
140
141 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ip ) ) {
142 tc_status = ERROR_NO_LOGON_SERVERS;
143 break;
144 }
145
146 fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
147
148 tc_status = NO_ERROR;
149
150 break;
151
152 default:
153 /* no idea what this should be */
154 DEBUG(0,("_net_logon_ctrl2: unimplemented function level [%d]\n",
155 q_u->function_code));
156 }
157
158 /* prepare the response */
159
160 init_net_r_logon_ctrl2( r_u, q_u->query_level, flags,
161 pdc_connection_status, logon_attempts, tc_status, dc_name );
162
163 if (lp_server_role() == ROLE_DOMAIN_BDC)
164 send_sync_message();
165
166 return r_u->status;
167 }
168
169 /*************************************************************************
170 net_reply_trust_dom_list:
171 *************************************************************************/
172
173 NTSTATUS _net_trust_dom_list(pipes_struct *p, NET_Q_TRUST_DOM_LIST *q_u, NET_R_TRUST_DOM_LIST *r_u)
174 {
175 const char *trusted_domain = "test_domain";
176 uint32 num_trust_domains = 1;
177
178 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
179
180 /* set up the Trusted Domain List response */
181 init_r_trust_dom(r_u, num_trust_domains, trusted_domain);
182
183 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
184
185 return r_u->status;
186 }
187
188 /***********************************************************************************
189 init_net_r_srv_pwset:
190 ***********************************************************************************/
191
192 static void init_net_r_srv_pwset(NET_R_SRV_PWSET *r_s,
193 DOM_CRED *srv_cred, NTSTATUS status)
194 {
195 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
196
197 memcpy(&r_s->srv_cred, srv_cred, sizeof(r_s->srv_cred));
198 r_s->status = status;
199
200 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
201 }
202
203 /******************************************************************
204 gets a machine password entry. checks access rights of the host.
205 ******************************************************************/
206
207 static BOOL get_md4pw(char *md4pw, char *mach_acct)
208 {
209 SAM_ACCOUNT *sampass = NULL;
210 const uint8 *pass;
211 BOOL ret;
212 uint32 acct_ctrl;
213
214 #if 0
215 /*
216 * Currently this code is redundent as we already have a filter
217 * by hostname list. What this code really needs to do is to
218 * get a hosts allowed/hosts denied list from the SAM database
219 * on a per user basis, and make the access decision there.
220 * I will leave this code here for now as a reminder to implement
221 * this at a later date. JRA.
222 */
223
224 if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
225 client_name(), client_addr()))
226 {
227 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
228 return False;
229 }
230 #endif /* 0 */
231
232 if(!NT_STATUS_IS_OK(pdb_init_sam(&sampass)))
233 return False;
234
235 /* JRA. This is ok as it is only used for generating the challenge. */
236 become_root();
237 ret=pdb_getsampwnam(sampass, mach_acct);
238 unbecome_root();
239
240 if (ret==False) {
241 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
242 pdb_free_sam(&sampass);
243 return False;
244 }
245
246 acct_ctrl = pdb_get_acct_ctrl(sampass);
247 if (!(acct_ctrl & ACB_DISABLED) &&
248 ((acct_ctrl & ACB_DOMTRUST) ||
249 (acct_ctrl & ACB_WSTRUST) ||
250 (acct_ctrl & ACB_SVRTRUST)) &&
251 ((pass=pdb_get_nt_passwd(sampass)) != NULL)) {
252 memcpy(md4pw, pass, 16);
253 dump_data(5, md4pw, 16);
254 pdb_free_sam(&sampass);
255 return True;
256 }
257
258 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
259 pdb_free_sam(&sampass);
260 return False;
261
262 }
263
264 /*************************************************************************
265 _net_req_chal
266 *************************************************************************/
267
268 NTSTATUS _net_req_chal(pipes_struct *p, NET_Q_REQ_CHAL *q_u, NET_R_REQ_CHAL *r_u)
269 {
270 if (!p->dc) {
271 p->dc = TALLOC_ZERO_P(p->pipe_state_mem_ctx, struct dcinfo);
272 if (!p->dc) {
273 return NT_STATUS_NO_MEMORY;
274 }
275 } else {
276 DEBUG(10,("_net_req_chal: new challenge requested. Clearing old state.\n"));
277 ZERO_STRUCTP(p->dc);
278 }
279
280 rpcstr_pull(p->dc->remote_machine,
281 q_u->uni_logon_clnt.buffer,
282 sizeof(fstring),q_u->uni_logon_clnt.uni_str_len*2,0);
283
284 /* Save the client challenge to the server. */
285 memcpy(p->dc->clnt_chal.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data));
286
287 /* Create a server challenge for the client */
288 /* Set this to a random value. */
289 generate_random_buffer(p->dc->srv_chal.data, 8);
290
291 /* set up the LSA REQUEST CHALLENGE response */
292 init_net_r_req_chal(r_u, &p->dc->srv_chal, NT_STATUS_OK);
293
294 p->dc->challenge_sent = True;
295
296 return NT_STATUS_OK;
297 }
298
299 /*************************************************************************
300 init_net_r_auth:
301 *************************************************************************/
302
303 static void init_net_r_auth(NET_R_AUTH *r_a, DOM_CHAL *resp_cred, NTSTATUS status)
304 {
305 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
306 r_a->status = status;
307 }
308
309 /*************************************************************************
310 _net_auth. Create the initial credentials.
311 *************************************************************************/
312
313 NTSTATUS _net_auth(pipes_struct *p, NET_Q_AUTH *q_u, NET_R_AUTH *r_u)
314 {
315 fstring mach_acct;
316 fstring remote_machine;
317 DOM_CHAL srv_chal_out;
318
319 if (!p->dc || !p->dc->challenge_sent) {
320 return NT_STATUS_ACCESS_DENIED;
321 }
322
323 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
324 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
325 rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
326 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
327
328 if (!get_md4pw((char *)p->dc->mach_pw, mach_acct)) {
329 DEBUG(0,("_net_auth: creds_server_check failed. Failed to "
330 "get pasword for machine account %s "
331 "from client %s\n",
332 mach_acct, remote_machine ));
333 return NT_STATUS_ACCESS_DENIED;
334 }
335
336 /* From the client / server challenges and md4 password, generate sess key */
337 creds_server_init(p->dc,
338 &p->dc->clnt_chal, /* Stored client chal. */
339 &p->dc->srv_chal, /* Stored server chal. */
340 (const char *)p->dc->mach_pw,
341 &srv_chal_out);
342
343 /* Check client credentials are valid. */
344 if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
345 DEBUG(0,("_net_auth: creds_server_check failed. Rejecting auth "
346 "request from client %s machine account %s\n",
347 remote_machine, mach_acct ));
348 return NT_STATUS_ACCESS_DENIED;
349 }
350
351 fstrcpy(p->dc->mach_acct, mach_acct);
352 fstrcpy(p->dc->remote_machine, remote_machine);
353 p->dc->authenticated = True;
354
355 /* set up the LSA AUTH response */
356 /* Return the server credentials. */
357 init_net_r_auth(r_u, &srv_chal_out, NT_STATUS_OK);
358
359 return r_u->status;
360 }
361
362 /*************************************************************************
363 init_net_r_auth_2:
364 *************************************************************************/
365
366 static void init_net_r_auth_2(NET_R_AUTH_2 *r_a,
367 DOM_CHAL *resp_cred, NEG_FLAGS *flgs, NTSTATUS status)
368 {
369 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
370 memcpy(&r_a->srv_flgs, flgs, sizeof(r_a->srv_flgs));
371 r_a->status = status;
372 }
373
374 /*************************************************************************
375 _net_auth_2
376 *************************************************************************/
377
378 NTSTATUS _net_auth_2(pipes_struct *p, NET_Q_AUTH_2 *q_u, NET_R_AUTH_2 *r_u)
379 {
380 NEG_FLAGS srv_flgs;
381 fstring mach_acct;
382 fstring remote_machine;
383 DOM_CHAL srv_chal_out;
384
385 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
386 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
387 rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
388 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
389
390 if (!p->dc || !p->dc->challenge_sent) {
391 DEBUG(0,("_net_auth2: no challenge sent to client %s\n",
392 remote_machine ));
393 return NT_STATUS_ACCESS_DENIED;
394 }
395
396 if ( (lp_server_schannel() == True) &&
397 ((q_u->clnt_flgs.neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
398
399 /* schannel must be used, but client did not offer it. */
400 DEBUG(0,("_net_auth2: schannel required but client failed "
401 "to offer it. Client was %s\n",
402 mach_acct ));
403 return NT_STATUS_ACCESS_DENIED;
404 }
405
406 if (!get_md4pw((char *)p->dc->mach_pw, mach_acct)) {
407 DEBUG(0,("_net_auth2: failed to get machine password for "
408 "account %s\n",
409 mach_acct ));
410 return NT_STATUS_ACCESS_DENIED;
411 }
412
413 /* From the client / server challenges and md4 password, generate sess key */
414 creds_server_init(p->dc,
415 &p->dc->clnt_chal, /* Stored client chal. */
416 &p->dc->srv_chal, /* Stored server chal. */
417 (const char *)p->dc->mach_pw,
418 &srv_chal_out);
419
420 /* Check client credentials are valid. */
421 if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
422 DEBUG(0,("_net_auth2: creds_server_check failed. Rejecting auth "
423 "request from client %s machine account %s\n",
424 remote_machine, mach_acct ));
425 return NT_STATUS_ACCESS_DENIED;
426 }
427
428 srv_flgs.neg_flags = 0x000001ff;
429
430 if (lp_server_schannel() != False) {
431 srv_flgs.neg_flags |= NETLOGON_NEG_SCHANNEL;
432 }
433
434 /* set up the LSA AUTH 2 response */
435 init_net_r_auth_2(r_u, &srv_chal_out, &srv_flgs, NT_STATUS_OK);
436
437 fstrcpy(p->dc->mach_acct, mach_acct);
438 fstrcpy(p->dc->remote_machine, remote_machine);
439 fstrcpy(p->dc->domain, lp_workgroup() );
440
441 p->dc->authenticated = True;
442
443 /* Store off the state so we can continue after client disconnect. */
444 become_root();
445 secrets_store_schannel_session_info(p->mem_ctx, p->dc);
446 unbecome_root();
447
448 return r_u->status;
449 }
450
451 /*************************************************************************
452 _net_srv_pwset
453 *************************************************************************/
454
455 NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *r_u)
456 {
457 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
458 fstring workstation;
459 SAM_ACCOUNT *sampass=NULL;
460 BOOL ret = False;
461 unsigned char pwd[16];
462 int i;
463 uint32 acct_ctrl;
464 DOM_CRED cred_out;
465 const uchar *old_pw;
466
467 if (!p->dc || !p->dc->authenticated) {
468 return NT_STATUS_INVALID_HANDLE;
469 }
470
471 /* Step the creds chain forward. */
472 if (!creds_server_step(p->dc, &q_u->clnt_id.cred, &cred_out)) {
473 DEBUG(0,("_net_srv_pwset: creds_server_step failed. Rejecting auth "
474 "request from client %s machine account %s\n",
475 p->dc->remote_machine, p->dc->mach_acct ));
476 return NT_STATUS_ACCESS_DENIED;
477 }
478
479 DEBUG(5,("_net_srv_pwset: %d\n", __LINE__));
480
481 rpcstr_pull(workstation,q_u->clnt_id.login.uni_comp_name.buffer,
482 sizeof(workstation),q_u->clnt_id.login.uni_comp_name.uni_str_len*2,0);
483
484 DEBUG(3,("_net_srv_pwset: Server Password Set by Wksta:[%s] on account [%s]\n",
485 workstation, p->dc->mach_acct));
486
487 pdb_init_sam(&sampass);
488
489 become_root();
490 ret=pdb_getsampwnam(sampass, p->dc->mach_acct);
491 unbecome_root();
492
493 /* Ensure the account exists and is a machine account. */
494
495 acct_ctrl = pdb_get_acct_ctrl(sampass);
496
497 if (!(ret
498 && (acct_ctrl & ACB_WSTRUST ||
499 acct_ctrl & ACB_SVRTRUST ||
500 acct_ctrl & ACB_DOMTRUST))) {
501 pdb_free_sam(&sampass);
502 return NT_STATUS_NO_SUCH_USER;
503 }
504
505 if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
506 pdb_free_sam(&sampass);
507 return NT_STATUS_ACCOUNT_DISABLED;
508 }
509
510 /* Woah - what does this to to the credential chain ? JRA */
511 cred_hash3( pwd, q_u->pwd, p->dc->sess_key, 0);
512
513 DEBUG(100,("Server password set : new given value was :\n"));
514 for(i = 0; i < sizeof(pwd); i++)
515 DEBUG(100,("%02X ", pwd[i]));
516 DEBUG(100,("\n"));
517
518 old_pw = pdb_get_nt_passwd(sampass);
519
520 if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
521 /* Avoid backend modificiations and other fun if the
522 client changed the password to the *same thing* */
523
524 ret = True;
525 } else {
526
527 /* LM password should be NULL for machines */
528 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
529 pdb_free_sam(&sampass);
530 return NT_STATUS_NO_MEMORY;
531 }
532
533 if (!pdb_set_nt_passwd(sampass, pwd, PDB_CHANGED)) {
534 pdb_free_sam(&sampass);
535 return NT_STATUS_NO_MEMORY;
536 }
537
538 if (!pdb_set_pass_changed_now(sampass)) {
539 pdb_free_sam(&sampass);
540 /* Not quite sure what this one qualifies as, but this will do */
541 return NT_STATUS_UNSUCCESSFUL;
542 }
543
544 become_root();
545 ret = pdb_update_sam_account (sampass);
546 unbecome_root();
547 }
548 if (ret) {
549 status = NT_STATUS_OK;
550 }
551
552 /* set up the LSA Server Password Set response */
553 init_net_r_srv_pwset(r_u, &cred_out, status);
554
555 pdb_free_sam(&sampass);
556 return r_u->status;
557 }
558
559 /*************************************************************************
560 _net_sam_logoff:
561 *************************************************************************/
562
563 NTSTATUS _net_sam_logoff(pipes_struct *p, NET_Q_SAM_LOGOFF *q_u, NET_R_SAM_LOGOFF *r_u)
564 {
565 if (!get_valid_user_struct(p->vuid))
566 return NT_STATUS_NO_SUCH_USER;
567
568 if (!p->dc || !p->dc->authenticated) {
569 return NT_STATUS_INVALID_HANDLE;
570 }
571
572 r_u->buffer_creds = 1; /* yes, we have valid server credentials */
573
574 /* checks and updates credentials. creates reply credentials */
575 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
576 DEBUG(0,("_net_sam_logoff: creds_server_step failed. Rejecting auth "
577 "request from client %s machine account %s\n",
578 p->dc->remote_machine, p->dc->mach_acct ));
579 return NT_STATUS_ACCESS_DENIED;
580 }
581
582 r_u->status = NT_STATUS_OK;
583 return r_u->status;
584 }
585
586
587 /*******************************************************************
588 gets a domain user's groups from their already-calculated NT_USER_TOKEN
589 ********************************************************************/
590 static NTSTATUS nt_token_to_group_list(TALLOC_CTX *mem_ctx, const DOM_SID *domain_sid,
591 const NT_USER_TOKEN *nt_token,
592 int *numgroups, DOM_GID **pgids)
593 {
594 DOM_GID *gids;
595 int i;
596
597 gids = TALLOC_ARRAY(mem_ctx, DOM_GID, nt_token->num_sids);
598
599 if (!gids) {
600 return NT_STATUS_NO_MEMORY;
601 }
602
603 *numgroups=0;
604
605 for (i=PRIMARY_GROUP_SID_INDEX; i < nt_token->num_sids; i++) {
606 if (sid_compare_domain(domain_sid, &nt_token->user_sids[i])==0) {
607 sid_peek_rid(&nt_token->user_sids[i], &(gids[*numgroups].g_rid));
608 gids[*numgroups].attr= (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|SE_GROUP_ENABLED);
609 (*numgroups)++;
610 }
611 }
612 *pgids = gids;
613 return NT_STATUS_OK;
614 }
615
616 /*************************************************************************
617 _net_sam_logon
618 *************************************************************************/
619
620 NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *r_u)
621 {
622 NTSTATUS status = NT_STATUS_OK;
623 NET_USER_INFO_3 *usr_info = NULL;
624 NET_ID_INFO_CTR *ctr = q_u->sam_id.ctr;
625 UNISTR2 *uni_samlogon_user = NULL;
626 UNISTR2 *uni_samlogon_domain = NULL;
627 UNISTR2 *uni_samlogon_workstation = NULL;
628 fstring nt_username, nt_domain, nt_workstation;
629 auth_usersupplied_info *user_info = NULL;
630 auth_serversupplied_info *server_info = NULL;
631 SAM_ACCOUNT *sampw;
632 struct auth_context *auth_context = NULL;
633
634 usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
635 if (!usr_info)
636 return NT_STATUS_NO_MEMORY;
637
638 ZERO_STRUCTP(usr_info);
639
640 /* store the user information, if there is any. */
641 r_u->user = usr_info;
642 r_u->switch_value = 0; /* indicates no info */
643 r_u->auth_resp = 1; /* authoritative response */
644 r_u->switch_value = 3; /* indicates type of validation user info */
645 r_u->buffer_creds = 1; /* Ensure we always return server creds. */
646
647 if (!get_valid_user_struct(p->vuid))
648 return NT_STATUS_NO_SUCH_USER;
649
650 if (!p->dc || !p->dc->authenticated) {
651 return NT_STATUS_INVALID_HANDLE;
652 }
653
654 if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
655 /* 'server schannel = yes' should enforce use of
656 schannel, the client did offer it in auth2, but
657 obviously did not use it. */
658 DEBUG(0,("_net_sam_logoff: client %s not using schannel for netlogon\n",
659 p->dc->remote_machine ));
660 return NT_STATUS_ACCESS_DENIED;
661 }
662
663 /* checks and updates credentials. creates reply credentials */
664 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
665 DEBUG(0,("_net_sam_logon: creds_server_step failed. Rejecting auth "
666 "request from client %s machine account %s\n",
667 p->dc->remote_machine, p->dc->mach_acct ));
668 return NT_STATUS_ACCESS_DENIED;
669 }
670
671 /* find the username */
672
673 switch (q_u->sam_id.logon_level) {
674 case INTERACTIVE_LOGON_TYPE:
675 uni_samlogon_user = &ctr->auth.id1.uni_user_name;
676 uni_samlogon_domain = &ctr->auth.id1.uni_domain_name;
677
678 uni_samlogon_workstation = &ctr->auth.id1.uni_wksta_name;
679
680 DEBUG(3,("SAM Logon (Interactive). Domain:[%s]. ", lp_workgroup()));
681 break;
682 case NET_LOGON_TYPE:
683 uni_samlogon_user = &ctr->auth.id2.uni_user_name;
684 uni_samlogon_domain = &ctr->auth.id2.uni_domain_name;
685 uni_samlogon_workstation = &ctr->auth.id2.uni_wksta_name;
686
687 DEBUG(3,("SAM Logon (Network). Domain:[%s]. ", lp_workgroup()));
688 break;
689 default:
690 DEBUG(2,("SAM Logon: unsupported switch value\n"));
691 return NT_STATUS_INVALID_INFO_CLASS;
692 } /* end switch */
693
694 rpcstr_pull(nt_username,uni_samlogon_user->buffer,sizeof(nt_username),uni_samlogon_user->uni_str_len*2,0);
695 rpcstr_pull(nt_domain,uni_samlogon_domain->buffer,sizeof(nt_domain),uni_samlogon_domain->uni_str_len*2,0);
696 rpcstr_pull(nt_workstation,uni_samlogon_workstation->buffer,sizeof(nt_workstation),uni_samlogon_workstation->uni_str_len*2,0);
697
698 DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username,
699 nt_workstation, nt_domain));
700
701 fstrcpy(current_user_info.smb_name, nt_username);
702 sub_set_smb_name(nt_username);
703
704 DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u->sam_id.ctr->switch_value, nt_username));
705
706 status = NT_STATUS_OK;
707
708 switch (ctr->switch_value) {
709 case NET_LOGON_TYPE:
710 {
711 const char *wksname = nt_workstation;
712
713 if (!NT_STATUS_IS_OK(status = make_auth_context_fixed(&auth_context, ctr->auth.id2.lm_chal))) {
714 return status;
715 }
716
717 /* For a network logon, the workstation name comes in with two
718 * backslashes in the front. Strip them if they are there. */
719
720 if (*wksname == '\\') wksname++;
721 if (*wksname == '\\') wksname++;
722
723 /* Standard challenge/response authenticaion */
724 if (!make_user_info_netlogon_network(&user_info,
725 nt_username, nt_domain,
726 wksname,
727 ctr->auth.id2.param_ctrl,
728 ctr->auth.id2.lm_chal_resp.buffer,
729 ctr->auth.id2.lm_chal_resp.str_str_len,
730 ctr->auth.id2.nt_chal_resp.buffer,
731 ctr->auth.id2.nt_chal_resp.str_str_len)) {
732 status = NT_STATUS_NO_MEMORY;
733 }
734 break;
735 }
736 case INTERACTIVE_LOGON_TYPE:
737 /* 'Interactive' autheticaion, supplies the password in its
738 MD4 form, encrypted with the session key. We will
739 convert this to chellange/responce for the auth
740 subsystem to chew on */
741 {
742 const uint8 *chal;
743
744 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
745 return status;
746 }
747
748 chal = auth_context->get_ntlm_challenge(auth_context);
749
750 if (!make_user_info_netlogon_interactive(&user_info,
751 nt_username, nt_domain,
752 nt_workstation,
753 ctr->auth.id1.param_ctrl,
754 chal,
755 ctr->auth.id1.lm_owf.data,
756 ctr->auth.id1.nt_owf.data,
757 p->dc->sess_key)) {
758 status = NT_STATUS_NO_MEMORY;
759 }
760 break;
761 }
762 default:
763 DEBUG(2,("SAM Logon: unsupported switch value\n"));
764 return NT_STATUS_INVALID_INFO_CLASS;
765 } /* end switch */
766
767 if ( NT_STATUS_IS_OK(status) ) {
768 status = auth_context->check_ntlm_password(auth_context,
769 user_info, &server_info);
770 }
771
772 (auth_context->free)(&auth_context);
773 free_user_info(&user_info);
774
775 DEBUG(5, ("_net_sam_logon: check_password returned status %s\n",
776 nt_errstr(status)));
777
778 /* Check account and password */
779
780 if (!NT_STATUS_IS_OK(status)) {
781 /* If we don't know what this domain is, we need to
782 indicate that we are not authoritative. This
783 allows the client to decide if it needs to try
784 a local user. Fix by jpjanosi@us.ibm.com, #2976 */
785 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
786 && !strequal(nt_domain, get_global_sam_name())
787 && !is_trusted_domain(nt_domain) )
788 r_u->auth_resp = 0; /* We are not authoritative */
789
790 free_server_info(&server_info);
791 return status;
792 }
793
794 if (server_info->guest) {
795 /* We don't like guest domain logons... */
796 DEBUG(5,("_net_sam_logon: Attempted domain logon as GUEST denied.\n"));
797 free_server_info(&server_info);
798 return NT_STATUS_LOGON_FAILURE;
799 }
800
801 /* This is the point at which, if the login was successful, that
802 the SAM Local Security Authority should record that the user is
803 logged in to the domain. */
804
805 {
806 DOM_GID *gids = NULL;
807 const DOM_SID *user_sid = NULL;
808 const DOM_SID *group_sid = NULL;
809 DOM_SID domain_sid;
810 uint32 user_rid, group_rid;
811
812 int num_gids = 0;
813 pstring my_name;
814 fstring user_sid_string;
815 fstring group_sid_string;
816 uchar user_session_key[16];
817 uchar lm_session_key[16];
818 uchar netlogon_sess_key[16];
819
820 sampw = server_info->sam_account;
821
822 /* set up pointer indicating user/password failed to be found */
823 usr_info->ptr_user_info = 0;
824
825 user_sid = pdb_get_user_sid(sampw);
826 group_sid = pdb_get_group_sid(sampw);
827
828 sid_copy(&domain_sid, user_sid);
829 sid_split_rid(&domain_sid, &user_rid);
830
831 if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
832 DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid %s\n but group sid %s.\nThe conflicting domain portions are not supported for NETLOGON calls\n",
833 pdb_get_domain(sampw), pdb_get_username(sampw),
834 sid_to_string(user_sid_string, user_sid),
835 sid_to_string(group_sid_string, group_sid)));
836 return NT_STATUS_UNSUCCESSFUL;
837 }
838
839
840 if(server_info->login_server) {
841 pstrcpy(my_name, server_info->login_server);
842 } else {
843 pstrcpy(my_name, global_myname());
844 }
845
846 if (!NT_STATUS_IS_OK(status
847 = nt_token_to_group_list(p->mem_ctx,
848 &domain_sid,
849 server_info->ptok,
850 &num_gids,
851 &gids))) {
852 return status;
853 }
854
855 ZERO_STRUCT(netlogon_sess_key);
856 memcpy(netlogon_sess_key, p->dc->sess_key, 8);
857 if (server_info->user_session_key.length) {
858 memcpy(user_session_key, server_info->user_session_key.data,
859 MIN(sizeof(user_session_key), server_info->user_session_key.length));
860 SamOEMhash(user_session_key, netlogon_sess_key, 16);
861 }
862 if (server_info->lm_session_key.length) {
863 memcpy(lm_session_key, server_info->lm_session_key.data,
864 MIN(sizeof(lm_session_key), server_info->lm_session_key.length));
865 SamOEMhash(lm_session_key, netlogon_sess_key, 16);
866 }
867 ZERO_STRUCT(netlogon_sess_key);
868
869 init_net_user_info3(p->mem_ctx, usr_info,
870 user_rid,
871 group_rid,
872 pdb_get_username(sampw),
873 pdb_get_fullname(sampw),
874 pdb_get_homedir(sampw),
875 pdb_get_dir_drive(sampw),
876 pdb_get_logon_script(sampw),
877 pdb_get_profile_path(sampw),
878 pdb_get_logon_time(sampw),
879 get_time_t_max(),
880 get_time_t_max(),
881 pdb_get_pass_last_set_time(sampw),
882 pdb_get_pass_can_change_time(sampw),
883 pdb_get_pass_must_change_time(sampw),
884
885 0, /* logon_count */
886 0, /* bad_pw_count */
887 num_gids, /* uint32 num_groups */
888 gids , /* DOM_GID *gids */
889 0x20 , /* uint32 user_flgs (?) */
890 server_info->user_session_key.length ? user_session_key : NULL,
891 server_info->lm_session_key.length ? lm_session_key : NULL,
892 my_name , /* char *logon_srv */
893 pdb_get_domain(sampw),
894 &domain_sid, /* DOM_SID *dom_sid */
895 /* Should be users domain sid, not servers - for trusted domains */
896
897 NULL); /* char *other_sids */
898 ZERO_STRUCT(user_session_key);
899 ZERO_STRUCT(lm_session_key);
900 }
901 free_server_info(&server_info);
902 return status;
903 }
904
905 /*************************************************************************
906 _ds_enum_dom_trusts
907 *************************************************************************/
908 #if 0 /* JERRY -- not correct */
909 NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
910 DS_R_ENUM_DOM_TRUSTS *r_u)
911 {
912 NTSTATUS status = NT_STATUS_OK;
913
914 /* TODO: According to MSDN, the can only be executed against a
915 DC or domain member running Windows 2000 or later. Need
916 to test against a standalone 2k server and see what it
917 does. A windows 2000 DC includes its own domain in the
918 list. --jerry */
919
920 return status;
921 }
922 #endif /* JERRY */
Samba GIT mirror