source/rpc_client/cli_netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    NT Domain Authentication SMB / MSRPC client
   4    Copyright (C) Andrew Tridgell 1992-2000
   5    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
   6    Copyright (C) Tim Potter 2001
   7    Copyright (C) Paul Ashton                       1997.
   8    Copyright (C) Jeremy Allison                    1998.
   9    Copyright (C) Andrew Bartlett                   2001.
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 2 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program; if not, write to the Free Software
  23    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24 */
  25
  26 #include "includes.h"
  27
  28 /* LSA Request Challenge. Sends our challenge to server, then gets
  29    server response. These are used to generate the credentials. */
  30
  31 NTSTATUS cli_net_req_chal(struct cli_state *cli, DOM_CHAL *clnt_chal,
  32                           DOM_CHAL *srv_chal)
  33 {
  34         prs_struct qbuf, rbuf;
  35         NET_Q_REQ_CHAL q;
  36         NET_R_REQ_CHAL r;
  37         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  38
  39         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
  40         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
  41
  42         /* create and send a MSRPC command with api NET_REQCHAL */
  43
  44         DEBUG(4,("cli_net_req_chal: LSA Request Challenge from %s to %s: %s\n",
  45                  global_myname(), cli->desthost, credstr(clnt_chal->data)));
  46
  47         /* store the parameters */
  48         init_q_req_chal(&q, cli->srv_name_slash, global_myname(), clnt_chal);
  49
  50         /* Marshall data and send request */
  51
  52         if (!net_io_q_req_chal("", &q,  &qbuf, 0) ||
  53             !rpc_api_pipe_req(cli, NET_REQCHAL, &qbuf, &rbuf)) {
  54                 goto done;
  55         }
  56
  57         /* Unmarhall response */
  58
  59         if (!net_io_r_req_chal("", &r, &rbuf, 0)) {
  60                 goto done;
  61         }
  62
  63         result = r.status;
  64
  65         /* Return result */
  66
  67         if (NT_STATUS_IS_OK(result)) {
  68                 memcpy(srv_chal, r.srv_chal.data, sizeof(srv_chal->data));
  69         }
  70
  71  done:
  72         prs_mem_free(&qbuf);
  73         prs_mem_free(&rbuf);
  74
  75         return result;
  76 }
  77
  78 /****************************************************************************
  79 LSA Authenticate 2
  80
  81 Send the client credential, receive back a server credential.
  82 Ensure that the server credential returned matches the session key
  83 encrypt of the server challenge originally received. JRA.
  84 ****************************************************************************/
  85
  86 NTSTATUS cli_net_auth2(struct cli_state *cli,
  87                        uint16 sec_chan,
  88                        uint32 *neg_flags, DOM_CHAL *srv_chal)
  89 {
  90         prs_struct qbuf, rbuf;
  91         NET_Q_AUTH_2 q;
  92         NET_R_AUTH_2 r;
  93         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  94         fstring machine_acct;
  95
  96         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
  97         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
  98
  99         if ( sec_chan == SEC_CHAN_DOMAIN )
 100                 fstr_sprintf( machine_acct, "%s$", lp_workgroup() );
 101         else
 102                 fstrcpy( machine_acct, cli->mach_acct );
 103
 104         /* create and send a MSRPC command with api NET_AUTH2 */
 105
 106         DEBUG(4,("cli_net_auth2: srv:%s acct:%s sc:%x mc: %s chal %s neg: %x\n",
 107                  cli->srv_name_slash, machine_acct, sec_chan, global_myname(),
 108                  credstr(cli->clnt_cred.challenge.data), *neg_flags));
 109
 110         /* store the parameters */
 111
 112         init_q_auth_2(&q, cli->srv_name_slash, machine_acct,
 113                       sec_chan, global_myname(), &cli->clnt_cred.challenge,
 114                       *neg_flags);
 115
 116         /* turn parameters into data stream */
 117
 118         if (!net_io_q_auth_2("", &q,  &qbuf, 0) ||
 119             !rpc_api_pipe_req(cli, NET_AUTH2, &qbuf, &rbuf)) {
 120                 goto done;
 121         }
 122
 123         /* Unmarshall response */
 124
 125         if (!net_io_r_auth_2("", &r, &rbuf, 0)) {
 126                 goto done;
 127         }
 128
 129         result = r.status;
 130
 131         if (NT_STATUS_IS_OK(result)) {
 132                 UTIME zerotime;
 133
 134                 /*
 135                  * Check the returned value using the initial
 136                  * server received challenge.
 137                  */
 138
 139                 zerotime.time = 0;
 140                 if (cred_assert( &r.srv_chal, cli->sess_key, srv_chal,
 141                                  zerotime) == 0) {
 142
 143                         /*
 144                          * Server replied with bad credential. Fail.
 145                          */
 146                         DEBUG(0,("cli_net_auth2: server %s replied with bad credential (bad machine \
 147 password ?).\n", cli->desthost ));
 148                         result = NT_STATUS_ACCESS_DENIED;
 149                         goto done;
 150                 }
 151                 *neg_flags = r.srv_flgs.neg_flags;
 152         }
 153
 154  done:
 155         prs_mem_free(&qbuf);
 156         prs_mem_free(&rbuf);
 157
 158         return result;
 159 }
 160
 161 /****************************************************************************
 162 LSA Authenticate 3
 163
 164 Send the client credential, receive back a server credential.
 165 Ensure that the server credential returned matches the session key
 166 encrypt of the server challenge originally received. JRA.
 167 ****************************************************************************/
 168
 169 NTSTATUS cli_net_auth3(struct cli_state *cli,
 170                        uint16 sec_chan,
 171                        uint32 *neg_flags, DOM_CHAL *srv_chal)
 172 {
 173         prs_struct qbuf, rbuf;
 174         NET_Q_AUTH_3 q;
 175         NET_R_AUTH_3 r;
 176         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 177
 178         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
 179         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
 180
 181         /* create and send a MSRPC command with api NET_AUTH2 */
 182
 183         DEBUG(4,("cli_net_auth3: srv:%s acct:%s sc:%x mc: %s chal %s neg: %x\n",
 184                  cli->srv_name_slash, cli->mach_acct, sec_chan, global_myname(),
 185                  credstr(cli->clnt_cred.challenge.data), *neg_flags));
 186
 187         /* store the parameters */
 188         init_q_auth_3(&q, cli->srv_name_slash, cli->mach_acct,
 189                       sec_chan, global_myname(), &cli->clnt_cred.challenge,
 190                       *neg_flags);
 191
 192         /* turn parameters into data stream */
 193
 194         if (!net_io_q_auth_3("", &q,  &qbuf, 0) ||
 195             !rpc_api_pipe_req(cli, NET_AUTH3, &qbuf, &rbuf)) {
 196                 goto done;
 197         }
 198
 199         /* Unmarshall response */
 200
 201         if (!net_io_r_auth_3("", &r, &rbuf, 0)) {
 202                 goto done;
 203         }
 204
 205         result = r.status;
 206
 207         if (NT_STATUS_IS_OK(result)) {
 208                 UTIME zerotime;
 209
 210                 /*
 211                  * Check the returned value using the initial
 212                  * server received challenge.
 213                  */
 214
 215                 zerotime.time = 0;
 216                 if (cred_assert( &r.srv_chal, cli->sess_key, srv_chal,
 217                                  zerotime) == 0) {
 218
 219                         /*
 220                          * Server replied with bad credential. Fail.
 221                          */
 222                         DEBUG(0,("cli_net_auth3: server %s replied with bad credential (bad machine \
 223 password ?).\n", cli->desthost ));
 224                         result = NT_STATUS_ACCESS_DENIED;
 225                         goto done;
 226                 }
 227                 *neg_flags = r.srv_flgs.neg_flags;
 228         }
 229
 230  done:
 231         prs_mem_free(&qbuf);
 232         prs_mem_free(&rbuf);
 233
 234         return result;
 235 }
 236
 237 /* Initialize domain session credentials */
 238
 239 NTSTATUS cli_nt_setup_creds(struct cli_state *cli,
 240                             uint16 sec_chan,
 241                             const unsigned char mach_pwd[16], uint32 *neg_flags, int level)
 242 {
 243         DOM_CHAL clnt_chal;
 244         DOM_CHAL srv_chal;
 245         UTIME zerotime;
 246         NTSTATUS result;
 247
 248         /******************* Request Challenge ********************/
 249
 250         generate_random_buffer(clnt_chal.data, 8);
 251
 252         /* send a client challenge; receive a server challenge */
 253         result = cli_net_req_chal(cli, &clnt_chal, &srv_chal);
 254
 255         if (!NT_STATUS_IS_OK(result)) {
 256                 DEBUG(0,("cli_nt_setup_creds: request challenge failed\n"));
 257                 return result;
 258         }
 259
 260         /**************** Long-term Session key **************/
 261
 262         /* calculate the session key */
 263         cred_session_key(&clnt_chal, &srv_chal, mach_pwd,
 264                          cli->sess_key);
 265         memset((char *)cli->sess_key+8, '\0', 8);
 266
 267         /******************* Authenticate 2/3 ********************/
 268
 269         /* calculate auth-2/3 credentials */
 270         zerotime.time = 0;
 271         cred_create(cli->sess_key, &clnt_chal, zerotime, &cli->clnt_cred.challenge);
 272
 273         /*
 274          * Send client auth-2/3 challenge.
 275          * Receive an auth-2/3 challenge response and check it.
 276          */
 277         switch (level) {
 278                 case 2:
 279                         result = cli_net_auth2(cli, sec_chan, neg_flags, &srv_chal);
 280                         break;
 281                 case 3:
 282                         result = cli_net_auth3(cli, sec_chan, neg_flags, &srv_chal);
 283                         break;
 284                 default:
 285                         DEBUG(1,("cli_nt_setup_creds: unsupported auth level: %d\n", level));
 286                         break;
 287         }
 288
 289         if (!NT_STATUS_IS_OK(result))
 290                 DEBUG(3,("cli_nt_setup_creds: auth%d challenge failed %s\n", level, nt_errstr(result)));
 291
 292         return result;
 293 }
 294
 295 /* Logon Control 2 */
 296
 297 NTSTATUS cli_netlogon_logon_ctrl2(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 298                                   uint32 query_level)
 299 {
 300         prs_struct qbuf, rbuf;
 301         NET_Q_LOGON_CTRL2 q;
 302         NET_R_LOGON_CTRL2 r;
 303         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 304
 305         ZERO_STRUCT(q);
 306         ZERO_STRUCT(r);
 307
 308         /* Initialise parse structures */
 309
 310         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 311         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 312
 313         /* Initialise input parameters */
 314
 315         init_net_q_logon_ctrl2(&q, cli->srv_name_slash, query_level);
 316
 317         /* Marshall data and send request */
 318
 319         if (!net_io_q_logon_ctrl2("", &q, &qbuf, 0) ||
 320             !rpc_api_pipe_req(cli, NET_LOGON_CTRL2, &qbuf, &rbuf)) {
 321                 result = NT_STATUS_UNSUCCESSFUL;
 322                 goto done;
 323         }
 324
 325         /* Unmarshall response */
 326
 327         if (!net_io_r_logon_ctrl2("", &r, &rbuf, 0)) {
 328                 result = NT_STATUS_UNSUCCESSFUL;
 329                 goto done;
 330         }
 331
 332         result = r.status;
 333
 334  done:
 335         prs_mem_free(&qbuf);
 336         prs_mem_free(&rbuf);
 337
 338         return result;
 339 }
 340
 341 /* GetDCName */
 342
 343 NTSTATUS cli_netlogon_getdcname(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 344                                 const char *domainname, fstring dcname)
 345 {
 346         prs_struct qbuf, rbuf;
 347         NET_Q_GETDCNAME q;
 348         NET_R_GETDCNAME r;
 349         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 350
 351         ZERO_STRUCT(q);
 352         ZERO_STRUCT(r);
 353
 354         /* Initialise parse structures */
 355
 356         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 357         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 358
 359         /* Initialise input parameters */
 360
 361         init_net_q_getdcname(&q, cli->srv_name_slash, domainname);
 362
 363         /* Marshall data and send request */
 364
 365         if (!net_io_q_getdcname("", &q, &qbuf, 0) ||
 366             !rpc_api_pipe_req(cli, NET_GETDCNAME, &qbuf, &rbuf)) {
 367                 result = NT_STATUS_UNSUCCESSFUL;
 368                 goto done;
 369         }
 370
 371         /* Unmarshall response */
 372
 373         if (!net_io_r_getdcname("", &r, &rbuf, 0)) {
 374                 result = NT_STATUS_UNSUCCESSFUL;
 375                 goto done;
 376         }
 377
 378         result = r.status;
 379
 380         if (NT_STATUS_IS_OK(result))
 381                 rpcstr_pull_unistr2_fstring(dcname, &r.uni_dcname);
 382
 383  done:
 384         prs_mem_free(&qbuf);
 385         prs_mem_free(&rbuf);
 386
 387         return result;
 388 }
 389
 390 /****************************************************************************
 391 Generate the next creds to use.
 392 ****************************************************************************/
 393
 394 static void gen_next_creds( struct cli_state *cli, DOM_CRED *new_clnt_cred)
 395 {
 396         /*
 397          * Create the new client credentials.
 398          */
 399
 400         cli->clnt_cred.timestamp.time = time(NULL);
 401
 402         memcpy(new_clnt_cred, &cli->clnt_cred, sizeof(*new_clnt_cred));
 403
 404         /* Calculate the new credentials. */
 405         cred_create(cli->sess_key, &(cli->clnt_cred.challenge),
 406                     new_clnt_cred->timestamp, &(new_clnt_cred->challenge));
 407 }
 408
 409 /* Sam synchronisation */
 410
 411 NTSTATUS cli_netlogon_sam_sync(struct cli_state *cli, TALLOC_CTX *mem_ctx, DOM_CRED *ret_creds,
 412                                uint32 database_id, uint32 next_rid, uint32 *num_deltas,
 413                                SAM_DELTA_HDR **hdr_deltas,
 414                                SAM_DELTA_CTR **deltas)
 415 {
 416         prs_struct qbuf, rbuf;
 417         NET_Q_SAM_SYNC q;
 418         NET_R_SAM_SYNC r;
 419         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 420         DOM_CRED clnt_creds;
 421
 422         ZERO_STRUCT(q);
 423         ZERO_STRUCT(r);
 424
 425         /* Initialise parse structures */
 426
 427         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 428         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 429
 430         /* Initialise input parameters */
 431
 432         gen_next_creds(cli, &clnt_creds);
 433
 434         init_net_q_sam_sync(&q, cli->srv_name_slash, cli->clnt_name_slash + 2,
 435                             &clnt_creds, ret_creds, database_id, next_rid);
 436
 437         /* Marshall data and send request */
 438
 439         if (!net_io_q_sam_sync("", &q, &qbuf, 0) ||
 440             !rpc_api_pipe_req(cli, NET_SAM_SYNC, &qbuf, &rbuf)) {
 441                 result = NT_STATUS_UNSUCCESSFUL;
 442                 goto done;
 443         }
 444
 445         /* Unmarshall response */
 446
 447         if (!net_io_r_sam_sync("", cli->sess_key, &r, &rbuf, 0)) {
 448                 result = NT_STATUS_UNSUCCESSFUL;
 449                 goto done;
 450         }
 451
 452         /* Return results */
 453
 454         result = r.status;
 455         *num_deltas = r.num_deltas2;
 456         *hdr_deltas = r.hdr_deltas;
 457         *deltas = r.deltas;
 458
 459         memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
 460
 461  done:
 462         prs_mem_free(&qbuf);
 463         prs_mem_free(&rbuf);
 464
 465         return result;
 466 }
 467
 468 /* Sam synchronisation */
 469
 470 NTSTATUS cli_netlogon_sam_deltas(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 471                                  uint32 database_id, UINT64_S seqnum,
 472                                  uint32 *num_deltas,
 473                                  SAM_DELTA_HDR **hdr_deltas,
 474                                  SAM_DELTA_CTR **deltas)
 475 {
 476         prs_struct qbuf, rbuf;
 477         NET_Q_SAM_DELTAS q;
 478         NET_R_SAM_DELTAS r;
 479         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 480         DOM_CRED clnt_creds;
 481
 482         ZERO_STRUCT(q);
 483         ZERO_STRUCT(r);
 484
 485         /* Initialise parse structures */
 486
 487         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 488         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 489
 490         /* Initialise input parameters */
 491
 492         gen_next_creds(cli, &clnt_creds);
 493
 494         init_net_q_sam_deltas(&q, cli->srv_name_slash,
 495                               cli->clnt_name_slash + 2, &clnt_creds,
 496                               database_id, seqnum);
 497
 498         /* Marshall data and send request */
 499
 500         if (!net_io_q_sam_deltas("", &q, &qbuf, 0) ||
 501             !rpc_api_pipe_req(cli, NET_SAM_DELTAS, &qbuf, &rbuf)) {
 502                 result = NT_STATUS_UNSUCCESSFUL;
 503                 goto done;
 504         }
 505
 506         /* Unmarshall response */
 507
 508         if (!net_io_r_sam_deltas("", cli->sess_key, &r, &rbuf, 0)) {
 509                 result = NT_STATUS_UNSUCCESSFUL;
 510                 goto done;
 511         }
 512
 513         /* Return results */
 514
 515         result = r.status;
 516         *num_deltas = r.num_deltas2;
 517         *hdr_deltas = r.hdr_deltas;
 518         *deltas = r.deltas;
 519
 520  done:
 521         prs_mem_free(&qbuf);
 522         prs_mem_free(&rbuf);
 523
 524         return result;
 525 }
 526
 527 /* Logon domain user */
 528
 529 NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 530                                 DOM_CRED *ret_creds,
 531                                 const char *username, const char *password,
 532                                 int logon_type)
 533 {
 534         prs_struct qbuf, rbuf;
 535         NET_Q_SAM_LOGON q;
 536         NET_R_SAM_LOGON r;
 537         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 538         DOM_CRED clnt_creds, dummy_rtn_creds;
 539         NET_ID_INFO_CTR ctr;
 540         NET_USER_INFO_3 user;
 541         int validation_level = 3;
 542
 543         ZERO_STRUCT(q);
 544         ZERO_STRUCT(r);
 545         ZERO_STRUCT(dummy_rtn_creds);
 546
 547         /* Initialise parse structures */
 548
 549         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 550         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 551
 552         /* Initialise input parameters */
 553
 554         gen_next_creds(cli, &clnt_creds);
 555
 556         q.validation_level = validation_level;
 557
 558         if (ret_creds == NULL)
 559                 ret_creds = &dummy_rtn_creds;
 560
 561         ctr.switch_value = logon_type;
 562
 563         switch (logon_type) {
 564         case INTERACTIVE_LOGON_TYPE: {
 565                 unsigned char lm_owf_user_pwd[16], nt_owf_user_pwd[16];
 566
 567                 nt_lm_owf_gen(password, nt_owf_user_pwd, lm_owf_user_pwd);
 568
 569                 init_id_info1(&ctr.auth.id1, lp_workgroup(),
 570                               0, /* param_ctrl */
 571                               0xdead, 0xbeef, /* LUID? */
 572                               username, cli->clnt_name_slash,
 573                               (const char *)cli->sess_key, lm_owf_user_pwd,
 574                               nt_owf_user_pwd);
 575
 576                 break;
 577         }
 578         case NET_LOGON_TYPE: {
 579                 uint8 chal[8];
 580                 unsigned char local_lm_response[24];
 581                 unsigned char local_nt_response[24];
 582
 583                 generate_random_buffer(chal, 8);
 584
 585                 SMBencrypt(password, chal, local_lm_response);
 586                 SMBNTencrypt(password, chal, local_nt_response);
 587
 588                 init_id_info2(&ctr.auth.id2, lp_workgroup(),
 589                               0, /* param_ctrl */
 590                               0xdead, 0xbeef, /* LUID? */
 591                               username, cli->clnt_name_slash, chal,
 592                               local_lm_response, 24, local_nt_response, 24);
 593                 break;
 594         }
 595         default:
 596                 DEBUG(0, ("switch value %d not supported\n",
 597                           ctr.switch_value));
 598                 goto done;
 599         }
 600
 601         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname(),
 602                       &clnt_creds, ret_creds, logon_type,
 603                       &ctr);
 604
 605         /* Marshall data and send request */
 606
 607         if (!net_io_q_sam_logon("", &q, &qbuf, 0) ||
 608             !rpc_api_pipe_req(cli, NET_SAMLOGON, &qbuf, &rbuf)) {
 609                 goto done;
 610         }
 611
 612         /* Unmarshall response */
 613
 614         r.user = &user;
 615
 616         if (!net_io_r_sam_logon("", &r, &rbuf, 0)) {
 617                 goto done;
 618         }
 619
 620         /* Return results */
 621
 622         result = r.status;
 623         memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
 624
 625  done:
 626         prs_mem_free(&qbuf);
 627         prs_mem_free(&rbuf);
 628
 629         return result;
 630 }
 631
 632
 633 /**
 634  * Logon domain user with an 'network' SAM logon
 635  *
 636  * @param info3 Pointer to a NET_USER_INFO_3 already allocated by the caller.
 637  **/
 638
 639 NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 640                                         DOM_CRED *ret_creds,
 641                                         const char *username, const char *domain, const char *workstation,
 642                                         const uint8 chal[8],
 643                                         DATA_BLOB lm_response, DATA_BLOB nt_response,
 644                                         NET_USER_INFO_3 *info3)
 645
 646 {
 647         prs_struct qbuf, rbuf;
 648         NET_Q_SAM_LOGON q;
 649         NET_R_SAM_LOGON r;
 650         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 651         DOM_CRED clnt_creds, dummy_rtn_creds;
 652         NET_ID_INFO_CTR ctr;
 653         int validation_level = 3;
 654         char *workstation_name_slash;
 655         uint8 netlogon_sess_key[16];
 656         static uint8 zeros[16];
 657
 658         ZERO_STRUCT(q);
 659         ZERO_STRUCT(r);
 660         ZERO_STRUCT(dummy_rtn_creds);
 661
 662         workstation_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", workstation);
 663
 664         if (!workstation_name_slash) {
 665                 DEBUG(0, ("talloc_asprintf failed!\n"));
 666                 return NT_STATUS_NO_MEMORY;
 667         }
 668
 669         /* Initialise parse structures */
 670
 671         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
 672         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
 673
 674         /* Initialise input parameters */
 675
 676         gen_next_creds(cli, &clnt_creds);
 677
 678         q.validation_level = validation_level;
 679
 680         if (ret_creds == NULL)
 681                 ret_creds = &dummy_rtn_creds;
 682
 683         ctr.switch_value = NET_LOGON_TYPE;
 684
 685         init_id_info2(&ctr.auth.id2, domain,
 686                       0, /* param_ctrl */
 687                       0xdead, 0xbeef, /* LUID? */
 688                       username, workstation_name_slash, (const uchar*)chal,
 689                       lm_response.data, lm_response.length, nt_response.data, nt_response.length);
 690
 691         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname(),
 692                       &clnt_creds, ret_creds, NET_LOGON_TYPE,
 693                       &ctr);
 694
 695         /* Marshall data and send request */
 696
 697         if (!net_io_q_sam_logon("", &q, &qbuf, 0) ||
 698             !rpc_api_pipe_req(cli, NET_SAMLOGON, &qbuf, &rbuf)) {
 699                 goto done;
 700         }
 701
 702         /* Unmarshall response */
 703
 704         r.user = info3;
 705
 706         if (!net_io_r_sam_logon("", &r, &rbuf, 0)) {
 707                 goto done;
 708         }
 709
 710         ZERO_STRUCT(netlogon_sess_key);
 711         memcpy(netlogon_sess_key, cli->sess_key, 8);
 712
 713         if (memcmp(zeros, info3->user_sess_key, 16) != 0) {
 714                 SamOEMhash(info3->user_sess_key, netlogon_sess_key, 16);
 715         } else {
 716                 memset(info3->user_sess_key, '\0', 16);
 717         }
 718
 719         if (memcmp(zeros, info3->padding, 16) != 0) {
 720                 SamOEMhash(info3->padding, netlogon_sess_key, 16);
 721         } else {
 722                 memset(info3->padding, '\0', 16);
 723         }
 724
 725         /* Return results */
 726
 727         result = r.status;
 728         memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
 729
 730  done:
 731         prs_mem_free(&qbuf);
 732         prs_mem_free(&rbuf);
 733
 734         return result;
 735 }
 736
 737 /***************************************************************************
 738 LSA Server Password Set.
 739 ****************************************************************************/
 740
 741 NTSTATUS cli_net_srv_pwset(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 742                            const char *machine_name, uint8 hashed_mach_pwd[16])
 743 {
 744         prs_struct rbuf;
 745         prs_struct qbuf;
 746         DOM_CRED new_clnt_cred;
 747         NET_Q_SRV_PWSET q_s;
 748         uint16 sec_chan_type = 2;
 749         NTSTATUS nt_status;
 750
 751         gen_next_creds( cli, &new_clnt_cred);
 752
 753         prs_init(&qbuf , 1024, mem_ctx, MARSHALL);
 754         prs_init(&rbuf, 0,    mem_ctx, UNMARSHALL);
 755
 756         DEBUG(4,("cli_net_srv_pwset: srv:%s acct:%s sc: %d mc: %s clnt %s %x\n",
 757                  cli->srv_name_slash, cli->mach_acct, sec_chan_type, machine_name,
 758                  credstr(new_clnt_cred.challenge.data), new_clnt_cred.timestamp.time));
 759
 760         /* store the parameters */
 761         init_q_srv_pwset(&q_s, cli->srv_name_slash, (const char *)cli->sess_key,
 762                          cli->mach_acct, sec_chan_type, machine_name,
 763                          &new_clnt_cred, hashed_mach_pwd);
 764
 765         /* turn parameters into data stream */
 766         if(!net_io_q_srv_pwset("", &q_s,  &qbuf, 0)) {
 767                 DEBUG(0,("cli_net_srv_pwset: Error : failed to marshall NET_Q_SRV_PWSET struct.\n"));
 768                 nt_status = NT_STATUS_UNSUCCESSFUL;
 769                 goto done;
 770         }
 771
 772         /* send the data on \PIPE\ */
 773         if (rpc_api_pipe_req(cli, NET_SRVPWSET, &qbuf, &rbuf))
 774         {
 775                 NET_R_SRV_PWSET r_s;
 776
 777                 if (!net_io_r_srv_pwset("", &r_s, &rbuf, 0)) {
 778                         nt_status =  NT_STATUS_UNSUCCESSFUL;
 779                         goto done;
 780                 }
 781
 782                 nt_status = r_s.status;
 783
 784                 if (!NT_STATUS_IS_OK(r_s.status))
 785                 {
 786                         /* report error code */
 787                         DEBUG(0,("cli_net_srv_pwset: %s\n", nt_errstr(nt_status)));
 788                         goto done;
 789                 }
 790
 791                 /* Update the credentials. */
 792                 if (!clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &(r_s.srv_cred)))
 793                 {
 794                         /*
 795                          * Server replied with bad credential. Fail.
 796                          */
 797                         DEBUG(0,("cli_net_srv_pwset: server %s replied with bad credential (bad machine \
 798 password ?).\n", cli->desthost ));
 799                         nt_status = NT_STATUS_UNSUCCESSFUL;
 800                 }
 801         }
 802
 803  done:
 804         prs_mem_free(&qbuf);
 805         prs_mem_free(&rbuf);
 806
 807         return nt_status;
 808 }
 809