2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997.
7 * Copyright (C) Jeremy Allison 1998-2001.
8 * Copyright (C) Andrew Bartlett 2001.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 /* This is the implementation of the netlogon pipe. */
29 extern struct dcinfo last_dcinfo
;
30 extern BOOL server_auth2_negotiated
;
31 extern userdom_struct current_user_info
;
34 #define DBGC_CLASS DBGC_RPC_SRV
36 /*************************************************************************
38 *************************************************************************/
40 static void init_net_r_req_chal(NET_R_REQ_CHAL
*r_c
,
41 DOM_CHAL
*srv_chal
, NTSTATUS status
)
43 DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__
));
44 memcpy(r_c
->srv_chal
.data
, srv_chal
->data
, sizeof(srv_chal
->data
));
48 /*************************************************************************
49 error messages cropping up when using nltest.exe...
50 *************************************************************************/
52 #define ERROR_NO_SUCH_DOMAIN 0x54b
53 #define ERROR_NO_LOGON_SERVERS 0x51f
56 /*************************************************************************
58 *************************************************************************/
60 NTSTATUS
_net_logon_ctrl(pipes_struct
*p
, NET_Q_LOGON_CTRL
*q_u
,
61 NET_R_LOGON_CTRL
*r_u
)
64 uint32 pdc_connection_status
= 0x00; /* Maybe a win32 error code? */
66 /* Setup the Logon Control response */
68 init_net_r_logon_ctrl(r_u
, q_u
->query_level
, flags
,
69 pdc_connection_status
);
74 /****************************************************************************
75 Send a message to smbd to do a sam synchronisation
76 **************************************************************************/
77 static void send_sync_message(void)
81 tdb
= tdb_open_log(lock_path("connections.tdb"), 0,
82 TDB_DEFAULT
, O_RDONLY
, 0);
85 DEBUG(3, ("send_sync_message(): failed to open connections "
90 DEBUG(3, ("sending sam synchronisation message\n"));
92 message_send_all(tdb
, MSG_SMB_SAM_SYNC
, NULL
, 0, False
, NULL
);
97 /*************************************************************************
98 net_reply_logon_ctrl2:
99 *************************************************************************/
101 NTSTATUS
_net_logon_ctrl2(pipes_struct
*p
, NET_Q_LOGON_CTRL2
*q_u
, NET_R_LOGON_CTRL2
*r_u
)
104 uint32 pdc_connection_status
= 0x0;
105 uint32 logon_attempts
= 0x0;
107 fstring servername
, domain
, dc_name
, dc_name2
;
108 struct in_addr dc_ip
;
110 /* this should be \\global_myname() */
111 unistr2_to_ascii(servername
, &q_u
->uni_server_name
, sizeof(servername
));
113 r_u
->status
= NT_STATUS_OK
;
115 tc_status
= ERROR_NO_SUCH_DOMAIN
;
116 fstrcpy( dc_name
, "" );
118 switch ( q_u
->function_code
) {
119 case NETLOGON_CONTROL_TC_QUERY
:
120 unistr2_to_ascii(domain
, &q_u
->info
.info6
.domain
, sizeof(domain
));
122 if ( !is_trusted_domain( domain
) )
125 if ( !get_dc_name( domain
, NULL
, dc_name2
, &dc_ip
) ) {
126 tc_status
= ERROR_NO_LOGON_SERVERS
;
130 fstr_sprintf( dc_name
, "\\\\%s", dc_name2
);
132 tc_status
= NO_ERROR
;
136 case NETLOGON_CONTROL_REDISCOVER
:
137 unistr2_to_ascii(domain
, &q_u
->info
.info6
.domain
, sizeof(domain
));
139 if ( !is_trusted_domain( domain
) )
142 if ( !get_dc_name( domain
, NULL
, dc_name2
, &dc_ip
) ) {
143 tc_status
= ERROR_NO_LOGON_SERVERS
;
147 fstr_sprintf( dc_name
, "\\\\%s", dc_name2
);
149 tc_status
= NO_ERROR
;
154 /* no idea what this should be */
155 DEBUG(0,("_net_logon_ctrl2: unimplemented function level [%d]\n",
156 q_u
->function_code
));
159 /* prepare the response */
161 init_net_r_logon_ctrl2( r_u
, q_u
->query_level
, flags
,
162 pdc_connection_status
, logon_attempts
, tc_status
, dc_name
);
164 if (lp_server_role() == ROLE_DOMAIN_BDC
)
170 /*************************************************************************
171 net_reply_trust_dom_list:
172 *************************************************************************/
174 NTSTATUS
_net_trust_dom_list(pipes_struct
*p
, NET_Q_TRUST_DOM_LIST
*q_u
, NET_R_TRUST_DOM_LIST
*r_u
)
176 const char *trusted_domain
= "test_domain";
177 uint32 num_trust_domains
= 1;
179 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__
));
181 /* set up the Trusted Domain List response */
182 init_r_trust_dom(r_u
, num_trust_domains
, trusted_domain
);
184 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__
));
189 /***********************************************************************************
190 init_net_r_srv_pwset:
191 ***********************************************************************************/
193 static void init_net_r_srv_pwset(NET_R_SRV_PWSET
*r_s
,
194 DOM_CRED
*srv_cred
, NTSTATUS status
)
196 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__
));
198 memcpy(&r_s
->srv_cred
, srv_cred
, sizeof(r_s
->srv_cred
));
199 r_s
->status
= status
;
201 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__
));
204 /******************************************************************
205 gets a machine password entry. checks access rights of the host.
206 ******************************************************************/
208 static BOOL
get_md4pw(char *md4pw
, char *mach_acct
)
210 SAM_ACCOUNT
*sampass
= NULL
;
217 * Currently this code is redundent as we already have a filter
218 * by hostname list. What this code really needs to do is to
219 * get a hosts allowed/hosts denied list from the SAM database
220 * on a per user basis, and make the access decision there.
221 * I will leave this code here for now as a reminder to implement
222 * this at a later date. JRA.
225 if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
226 client_name(), client_addr()))
228 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct
));
233 if(!NT_STATUS_IS_OK(pdb_init_sam(&sampass
)))
236 /* JRA. This is ok as it is only used for generating the challenge. */
238 ret
=pdb_getsampwnam(sampass
, mach_acct
);
242 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct
));
243 pdb_free_sam(&sampass
);
247 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
248 if (!(acct_ctrl
& ACB_DISABLED
) &&
249 ((acct_ctrl
& ACB_DOMTRUST
) ||
250 (acct_ctrl
& ACB_WSTRUST
) ||
251 (acct_ctrl
& ACB_SVRTRUST
)) &&
252 ((pass
=pdb_get_nt_passwd(sampass
)) != NULL
)) {
253 memcpy(md4pw
, pass
, 16);
254 dump_data(5, md4pw
, 16);
255 pdb_free_sam(&sampass
);
259 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct
));
260 pdb_free_sam(&sampass
);
265 /*************************************************************************
267 *************************************************************************/
269 NTSTATUS
_net_req_chal(pipes_struct
*p
, NET_Q_REQ_CHAL
*q_u
, NET_R_REQ_CHAL
*r_u
)
271 NTSTATUS status
= NT_STATUS_OK
;
273 rpcstr_pull(p
->dc
.remote_machine
,q_u
->uni_logon_clnt
.buffer
,sizeof(fstring
),q_u
->uni_logon_clnt
.uni_str_len
*2,0);
275 /* create a server challenge for the client */
276 /* Set these to random values. */
277 generate_random_buffer(p
->dc
.srv_chal
.data
, 8);
279 memcpy(p
->dc
.srv_cred
.challenge
.data
, p
->dc
.srv_chal
.data
, 8);
281 memcpy(p
->dc
.clnt_chal
.data
, q_u
->clnt_chal
.data
, sizeof(q_u
->clnt_chal
.data
));
282 memcpy(p
->dc
.clnt_cred
.challenge
.data
, q_u
->clnt_chal
.data
, sizeof(q_u
->clnt_chal
.data
));
284 memset((char *)p
->dc
.sess_key
, '\0', sizeof(p
->dc
.sess_key
));
286 p
->dc
.challenge_sent
= True
;
287 /* set up the LSA REQUEST CHALLENGE response */
288 init_net_r_req_chal(r_u
, &p
->dc
.srv_chal
, status
);
293 /*************************************************************************
295 *************************************************************************/
297 static void init_net_r_auth(NET_R_AUTH
*r_a
, DOM_CHAL
*resp_cred
, NTSTATUS status
)
299 memcpy(r_a
->srv_chal
.data
, resp_cred
->data
, sizeof(resp_cred
->data
));
300 r_a
->status
= status
;
303 /*************************************************************************
305 *************************************************************************/
307 NTSTATUS
_net_auth(pipes_struct
*p
, NET_Q_AUTH
*q_u
, NET_R_AUTH
*r_u
)
309 NTSTATUS status
= NT_STATUS_OK
;
316 rpcstr_pull(mach_acct
, q_u
->clnt_id
.uni_acct_name
.buffer
,sizeof(fstring
),q_u
->clnt_id
.uni_acct_name
.uni_str_len
*2,0);
318 if (p
->dc
.challenge_sent
&& get_md4pw((char *)p
->dc
.md4pw
, mach_acct
)) {
320 /* from client / server challenges and md4 password, generate sess key */
321 cred_session_key(&p
->dc
.clnt_chal
, &p
->dc
.srv_chal
,
322 p
->dc
.md4pw
, p
->dc
.sess_key
);
324 /* check that the client credentials are valid */
325 if (cred_assert(&q_u
->clnt_chal
, p
->dc
.sess_key
, &p
->dc
.clnt_cred
.challenge
, srv_time
)) {
327 /* create server challenge for inclusion in the reply */
328 cred_create(p
->dc
.sess_key
, &p
->dc
.srv_cred
.challenge
, srv_time
, &srv_cred
);
330 /* copy the received client credentials for use next time */
331 memcpy(p
->dc
.clnt_cred
.challenge
.data
, q_u
->clnt_chal
.data
, sizeof(q_u
->clnt_chal
.data
));
332 memcpy(p
->dc
.srv_cred
.challenge
.data
, q_u
->clnt_chal
.data
, sizeof(q_u
->clnt_chal
.data
));
334 /* Save the machine account name. */
335 fstrcpy(p
->dc
.mach_acct
, mach_acct
);
337 p
->dc
.authenticated
= True
;
340 status
= NT_STATUS_ACCESS_DENIED
;
343 status
= NT_STATUS_ACCESS_DENIED
;
346 /* set up the LSA AUTH response */
347 init_net_r_auth(r_u
, &srv_cred
, status
);
352 /*************************************************************************
354 *************************************************************************/
356 static void init_net_r_auth_2(NET_R_AUTH_2
*r_a
,
357 DOM_CHAL
*resp_cred
, NEG_FLAGS
*flgs
, NTSTATUS status
)
359 memcpy(r_a
->srv_chal
.data
, resp_cred
->data
, sizeof(resp_cred
->data
));
360 memcpy(&r_a
->srv_flgs
, flgs
, sizeof(r_a
->srv_flgs
));
361 r_a
->status
= status
;
364 /*************************************************************************
366 *************************************************************************/
368 NTSTATUS
_net_auth_2(pipes_struct
*p
, NET_Q_AUTH_2
*q_u
, NET_R_AUTH_2
*r_u
)
370 NTSTATUS status
= NT_STATUS_OK
;
378 if ( (lp_server_schannel() == True
) &&
379 ((q_u
->clnt_flgs
.neg_flags
& NETLOGON_NEG_SCHANNEL
) == 0) ) {
381 /* schannel must be used, but client did not offer it. */
382 status
= NT_STATUS_ACCESS_DENIED
;
385 rpcstr_pull(mach_acct
, q_u
->clnt_id
.uni_acct_name
.buffer
,sizeof(fstring
),q_u
->clnt_id
.uni_acct_name
.uni_str_len
*2,0);
387 if (p
->dc
.challenge_sent
&& get_md4pw((char *)p
->dc
.md4pw
, mach_acct
)) {
389 /* from client / server challenges and md4 password, generate sess key */
390 cred_session_key(&p
->dc
.clnt_chal
, &p
->dc
.srv_chal
,
391 p
->dc
.md4pw
, p
->dc
.sess_key
);
393 /* check that the client credentials are valid */
394 if (cred_assert(&q_u
->clnt_chal
, p
->dc
.sess_key
, &p
->dc
.clnt_cred
.challenge
, srv_time
)) {
396 /* create server challenge for inclusion in the reply */
397 cred_create(p
->dc
.sess_key
, &p
->dc
.srv_cred
.challenge
, srv_time
, &srv_cred
);
399 /* copy the received client credentials for use next time */
400 memcpy(p
->dc
.clnt_cred
.challenge
.data
, q_u
->clnt_chal
.data
, sizeof(q_u
->clnt_chal
.data
));
401 memcpy(p
->dc
.srv_cred
.challenge
.data
, q_u
->clnt_chal
.data
, sizeof(q_u
->clnt_chal
.data
));
403 /* Save the machine account name. */
404 fstrcpy(p
->dc
.mach_acct
, mach_acct
);
406 p
->dc
.authenticated
= True
;
409 status
= NT_STATUS_ACCESS_DENIED
;
412 status
= NT_STATUS_ACCESS_DENIED
;
415 srv_flgs
.neg_flags
= 0x000001ff;
417 if (lp_server_schannel() != False
) {
418 srv_flgs
.neg_flags
|= NETLOGON_NEG_SCHANNEL
;
421 /* set up the LSA AUTH 2 response */
422 init_net_r_auth_2(r_u
, &srv_cred
, &srv_flgs
, status
);
424 if (NT_STATUS_IS_OK(status
)) {
425 server_auth2_negotiated
= True
;
432 /*************************************************************************
434 *************************************************************************/
436 NTSTATUS
_net_srv_pwset(pipes_struct
*p
, NET_Q_SRV_PWSET
*q_u
, NET_R_SRV_PWSET
*r_u
)
438 NTSTATUS status
= NT_STATUS_ACCESS_DENIED
;
441 SAM_ACCOUNT
*sampass
=NULL
;
443 unsigned char pwd
[16];
448 /* checks and updates credentials. creates reply credentials */
449 if (!(p
->dc
.authenticated
&& deal_with_creds(p
->dc
.sess_key
, &p
->dc
.clnt_cred
, &q_u
->clnt_id
.cred
, &srv_cred
)))
450 return NT_STATUS_INVALID_HANDLE
;
452 memcpy(&p
->dc
.srv_cred
, &p
->dc
.clnt_cred
, sizeof(p
->dc
.clnt_cred
));
454 DEBUG(5,("_net_srv_pwset: %d\n", __LINE__
));
456 rpcstr_pull(workstation
,q_u
->clnt_id
.login
.uni_comp_name
.buffer
,
457 sizeof(workstation
),q_u
->clnt_id
.login
.uni_comp_name
.uni_str_len
*2,0);
459 DEBUG(3,("Server Password Set by Wksta:[%s] on account [%s]\n", workstation
, p
->dc
.mach_acct
));
461 pdb_init_sam(&sampass
);
464 ret
=pdb_getsampwnam(sampass
, p
->dc
.mach_acct
);
467 /* Ensure the account exists and is a machine account. */
469 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
472 && (acct_ctrl
& ACB_WSTRUST
||
473 acct_ctrl
& ACB_SVRTRUST
||
474 acct_ctrl
& ACB_DOMTRUST
))) {
475 pdb_free_sam(&sampass
);
476 return NT_STATUS_NO_SUCH_USER
;
479 if (pdb_get_acct_ctrl(sampass
) & ACB_DISABLED
) {
480 pdb_free_sam(&sampass
);
481 return NT_STATUS_ACCOUNT_DISABLED
;
484 cred_hash3( pwd
, q_u
->pwd
, p
->dc
.sess_key
, 0);
486 DEBUG(100,("Server password set : new given value was :\n"));
487 for(i
= 0; i
< sizeof(pwd
); i
++)
488 DEBUG(100,("%02X ", pwd
[i
]));
491 old_pw
= pdb_get_nt_passwd(sampass
);
493 if (old_pw
&& memcmp(pwd
, old_pw
, 16) == 0) {
494 /* Avoid backend modificiations and other fun if the
495 client changed the password to the *same thing* */
500 /* LM password should be NULL for machines */
501 if (!pdb_set_lanman_passwd (sampass
, NULL
, PDB_CHANGED
)) {
502 pdb_free_sam(&sampass
);
503 return NT_STATUS_NO_MEMORY
;
506 if (!pdb_set_nt_passwd (sampass
, pwd
, PDB_CHANGED
)) {
507 pdb_free_sam(&sampass
);
508 return NT_STATUS_NO_MEMORY
;
511 if (!pdb_set_pass_changed_now (sampass
)) {
512 pdb_free_sam(&sampass
);
513 /* Not quite sure what this one qualifies as, but this will do */
514 return NT_STATUS_UNSUCCESSFUL
;
518 ret
= pdb_update_sam_account (sampass
);
522 status
= NT_STATUS_OK
;
524 /* set up the LSA Server Password Set response */
525 init_net_r_srv_pwset(r_u
, &srv_cred
, status
);
527 pdb_free_sam(&sampass
);
532 /*************************************************************************
534 *************************************************************************/
536 NTSTATUS
_net_sam_logoff(pipes_struct
*p
, NET_Q_SAM_LOGOFF
*q_u
, NET_R_SAM_LOGOFF
*r_u
)
540 if (!get_valid_user_struct(p
->vuid
))
541 return NT_STATUS_NO_SUCH_USER
;
543 /* checks and updates credentials. creates reply credentials */
544 if (!(p
->dc
.authenticated
&& deal_with_creds(p
->dc
.sess_key
, &p
->dc
.clnt_cred
,
545 &q_u
->sam_id
.client
.cred
, &srv_cred
)))
546 return NT_STATUS_INVALID_HANDLE
;
548 memcpy(&p
->dc
.srv_cred
, &p
->dc
.clnt_cred
, sizeof(p
->dc
.clnt_cred
));
550 /* XXXX maybe we want to say 'no', reject the client's credentials */
551 r_u
->buffer_creds
= 1; /* yes, we have valid server credentials */
552 memcpy(&r_u
->srv_creds
, &srv_cred
, sizeof(r_u
->srv_creds
));
554 r_u
->status
= NT_STATUS_OK
;
560 /*************************************************************************
562 *************************************************************************/
564 NTSTATUS
_net_sam_logon(pipes_struct
*p
, NET_Q_SAM_LOGON
*q_u
, NET_R_SAM_LOGON
*r_u
)
566 NTSTATUS status
= NT_STATUS_OK
;
567 NET_USER_INFO_3
*usr_info
= NULL
;
568 NET_ID_INFO_CTR
*ctr
= q_u
->sam_id
.ctr
;
570 UNISTR2
*uni_samlogon_user
= NULL
;
571 UNISTR2
*uni_samlogon_domain
= NULL
;
572 UNISTR2
*uni_samlogon_workstation
= NULL
;
573 fstring nt_username
, nt_domain
, nt_workstation
;
574 auth_usersupplied_info
*user_info
= NULL
;
575 auth_serversupplied_info
*server_info
= NULL
;
577 struct auth_context
*auth_context
= NULL
;
579 usr_info
= TALLOC_P(p
->mem_ctx
, NET_USER_INFO_3
);
581 return NT_STATUS_NO_MEMORY
;
583 ZERO_STRUCTP(usr_info
);
585 /* store the user information, if there is any. */
586 r_u
->user
= usr_info
;
587 r_u
->switch_value
= 0; /* indicates no info */
588 r_u
->auth_resp
= 1; /* authoritative response */
589 r_u
->switch_value
= 3; /* indicates type of validation user info */
591 if (!get_valid_user_struct(p
->vuid
))
592 return NT_STATUS_NO_SUCH_USER
;
595 if ( (lp_server_schannel() == True
) && (!p
->netsec_auth_validated
) ) {
596 /* 'server schannel = yes' should enforce use of
597 schannel, the client did offer it in auth2, but
598 obviously did not use it. */
599 return NT_STATUS_ACCESS_DENIED
;
602 /* checks and updates credentials. creates reply credentials */
603 if (!(p
->dc
.authenticated
&& deal_with_creds(p
->dc
.sess_key
, &p
->dc
.clnt_cred
, &q_u
->sam_id
.client
.cred
, &srv_cred
)))
604 return NT_STATUS_INVALID_HANDLE
;
606 memcpy(&p
->dc
.srv_cred
, &p
->dc
.clnt_cred
, sizeof(p
->dc
.clnt_cred
));
608 r_u
->buffer_creds
= 1; /* yes, we have valid server credentials */
609 memcpy(&r_u
->srv_creds
, &srv_cred
, sizeof(r_u
->srv_creds
));
611 /* find the username */
613 switch (q_u
->sam_id
.logon_level
) {
614 case INTERACTIVE_LOGON_TYPE
:
615 uni_samlogon_user
= &ctr
->auth
.id1
.uni_user_name
;
616 uni_samlogon_domain
= &ctr
->auth
.id1
.uni_domain_name
;
618 uni_samlogon_workstation
= &ctr
->auth
.id1
.uni_wksta_name
;
620 DEBUG(3,("SAM Logon (Interactive). Domain:[%s]. ", lp_workgroup()));
623 uni_samlogon_user
= &ctr
->auth
.id2
.uni_user_name
;
624 uni_samlogon_domain
= &ctr
->auth
.id2
.uni_domain_name
;
625 uni_samlogon_workstation
= &ctr
->auth
.id2
.uni_wksta_name
;
627 DEBUG(3,("SAM Logon (Network). Domain:[%s]. ", lp_workgroup()));
630 DEBUG(2,("SAM Logon: unsupported switch value\n"));
631 return NT_STATUS_INVALID_INFO_CLASS
;
634 rpcstr_pull(nt_username
,uni_samlogon_user
->buffer
,sizeof(nt_username
),uni_samlogon_user
->uni_str_len
*2,0);
635 rpcstr_pull(nt_domain
,uni_samlogon_domain
->buffer
,sizeof(nt_domain
),uni_samlogon_domain
->uni_str_len
*2,0);
636 rpcstr_pull(nt_workstation
,uni_samlogon_workstation
->buffer
,sizeof(nt_workstation
),uni_samlogon_workstation
->uni_str_len
*2,0);
638 DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username
,
639 nt_workstation
, nt_domain
));
641 fstrcpy(current_user_info
.smb_name
, nt_username
);
642 sub_set_smb_name(nt_username
);
644 DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u
->sam_id
.ctr
->switch_value
, nt_username
));
646 status
= NT_STATUS_OK
;
648 switch (ctr
->switch_value
) {
651 const char *wksname
= nt_workstation
;
653 if (!NT_STATUS_IS_OK(status
= make_auth_context_fixed(&auth_context
, ctr
->auth
.id2
.lm_chal
))) {
657 /* For a network logon, the workstation name comes in with two
658 * backslashes in the front. Strip them if they are there. */
660 if (*wksname
== '\\') wksname
++;
661 if (*wksname
== '\\') wksname
++;
663 /* Standard challenge/response authenticaion */
664 if (!make_user_info_netlogon_network(&user_info
,
665 nt_username
, nt_domain
,
667 ctr
->auth
.id2
.lm_chal_resp
.buffer
,
668 ctr
->auth
.id2
.lm_chal_resp
.str_str_len
,
669 ctr
->auth
.id2
.nt_chal_resp
.buffer
,
670 ctr
->auth
.id2
.nt_chal_resp
.str_str_len
)) {
671 status
= NT_STATUS_NO_MEMORY
;
675 case INTERACTIVE_LOGON_TYPE
:
676 /* 'Interactive' autheticaion, supplies the password in its
677 MD4 form, encrypted with the session key. We will
678 convert this to chellange/responce for the auth
679 subsystem to chew on */
683 if (!NT_STATUS_IS_OK(status
= make_auth_context_subsystem(&auth_context
))) {
687 chal
= auth_context
->get_ntlm_challenge(auth_context
);
689 if (!make_user_info_netlogon_interactive(&user_info
,
690 nt_username
, nt_domain
,
691 nt_workstation
, chal
,
692 ctr
->auth
.id1
.lm_owf
.data
,
693 ctr
->auth
.id1
.nt_owf
.data
,
695 status
= NT_STATUS_NO_MEMORY
;
700 DEBUG(2,("SAM Logon: unsupported switch value\n"));
701 return NT_STATUS_INVALID_INFO_CLASS
;
704 if ( NT_STATUS_IS_OK(status
) ) {
705 status
= auth_context
->check_ntlm_password(auth_context
,
706 user_info
, &server_info
);
709 (auth_context
->free
)(&auth_context
);
710 free_user_info(&user_info
);
712 DEBUG(5, ("_net_sam_logon: check_password returned status %s\n",
715 /* Check account and password */
717 if (!NT_STATUS_IS_OK(status
)) {
718 free_server_info(&server_info
);
722 if (server_info
->guest
) {
723 /* We don't like guest domain logons... */
724 DEBUG(5,("_net_sam_logon: Attempted domain logon as GUEST denied.\n"));
725 free_server_info(&server_info
);
726 return NT_STATUS_LOGON_FAILURE
;
729 /* This is the point at which, if the login was successful, that
730 the SAM Local Security Authority should record that the user is
731 logged in to the domain. */
734 DOM_GID
*gids
= NULL
;
735 const DOM_SID
*user_sid
= NULL
;
736 const DOM_SID
*group_sid
= NULL
;
738 uint32 user_rid
, group_rid
;
742 fstring user_sid_string
;
743 fstring group_sid_string
;
744 uchar user_session_key
[16];
745 uchar lm_session_key
[16];
746 uchar netlogon_sess_key
[16];
748 sampw
= server_info
->sam_account
;
750 /* set up pointer indicating user/password failed to be found */
751 usr_info
->ptr_user_info
= 0;
753 user_sid
= pdb_get_user_sid(sampw
);
754 group_sid
= pdb_get_group_sid(sampw
);
756 sid_copy(&domain_sid
, user_sid
);
757 sid_split_rid(&domain_sid
, &user_rid
);
759 if (!sid_peek_check_rid(&domain_sid
, group_sid
, &group_rid
)) {
760 DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid %s\n but group sid %s.\nThe conflicting domain portions are not supported for NETLOGON calls\n",
761 pdb_get_domain(sampw
), pdb_get_username(sampw
),
762 sid_to_string(user_sid_string
, user_sid
),
763 sid_to_string(group_sid_string
, group_sid
)));
764 return NT_STATUS_UNSUCCESSFUL
;
767 pstrcpy(my_name
, global_myname());
769 if (!NT_STATUS_IS_OK(status
770 = nt_token_to_group_list(p
->mem_ctx
,
778 ZERO_STRUCT(netlogon_sess_key
);
779 memcpy(netlogon_sess_key
, p
->dc
.sess_key
, 8);
780 if (server_info
->user_session_key
.length
) {
781 memcpy(user_session_key
, server_info
->user_session_key
.data
,
782 MIN(sizeof(user_session_key
), server_info
->user_session_key
.length
));
783 SamOEMhash(user_session_key
, netlogon_sess_key
, 16);
785 if (server_info
->lm_session_key
.length
) {
786 memcpy(lm_session_key
, server_info
->lm_session_key
.data
,
787 MIN(sizeof(lm_session_key
), server_info
->lm_session_key
.length
));
788 SamOEMhash(lm_session_key
, netlogon_sess_key
, 16);
790 ZERO_STRUCT(netlogon_sess_key
);
792 init_net_user_info3(p
->mem_ctx
, usr_info
,
795 pdb_get_username(sampw
),
796 pdb_get_fullname(sampw
),
797 pdb_get_homedir(sampw
),
798 pdb_get_dir_drive(sampw
),
799 pdb_get_logon_script(sampw
),
800 pdb_get_profile_path(sampw
),
801 pdb_get_logon_time(sampw
),
804 pdb_get_pass_last_set_time(sampw
),
805 pdb_get_pass_can_change_time(sampw
),
806 pdb_get_pass_must_change_time(sampw
),
809 0, /* bad_pw_count */
810 num_gids
, /* uint32 num_groups */
811 gids
, /* DOM_GID *gids */
812 0x20 , /* uint32 user_flgs (?) */
813 server_info
->user_session_key
.length
? user_session_key
: NULL
,
814 server_info
->lm_session_key
.length
? lm_session_key
: NULL
,
815 my_name
, /* char *logon_srv */
816 pdb_get_domain(sampw
),
817 &domain_sid
, /* DOM_SID *dom_sid */
818 /* Should be users domain sid, not servers - for trusted domains */
820 NULL
); /* char *other_sids */
821 ZERO_STRUCT(user_session_key
);
822 ZERO_STRUCT(lm_session_key
);
824 free_server_info(&server_info
);
828 /*************************************************************************
830 *************************************************************************/
831 #if 0 /* JERRY -- not correct */
832 NTSTATUS
_ds_enum_dom_trusts(pipes_struct
*p
, DS_Q_ENUM_DOM_TRUSTS
*q_u
,
833 DS_R_ENUM_DOM_TRUSTS
*r_u
)
835 NTSTATUS status
= NT_STATUS_OK
;
837 /* TODO: According to MSDN, the can only be executed against a
838 DC or domain member running Windows 2000 or later. Need
839 to test against a standalone 2k server and see what it
840 does. A windows 2000 DC includes its own domain in the