?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Remove unused rpc_ds marshalling code that is unused now.
[Samba/gebeck_regimport.git] / source / rpc_server / srv_netlog_nt.c
blob5003af8ce78d6044beb460bdc908602b1128474c
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997.
7 * Copyright (C) Jeremy Allison 1998-2001.
8 * Copyright (C) Andrew Bartlett 2001.
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /* This is the implementation of the netlogon pipe. */
25
26 #include "includes.h"
27
28 extern userdom_struct current_user_info;
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_RPC_SRV
32
33 /*************************************************************************
34 init_net_r_req_chal:
35 *************************************************************************/
36
37 static void init_net_r_req_chal(NET_R_REQ_CHAL *r_c,
38 DOM_CHAL *srv_chal, NTSTATUS status)
39 {
40 DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__));
41 memcpy(r_c->srv_chal.data, srv_chal->data, sizeof(srv_chal->data));
42 r_c->status = status;
43 }
44
45 /*************************************************************************
46 error messages cropping up when using nltest.exe...
47 *************************************************************************/
48
49 #define ERROR_NO_SUCH_DOMAIN 0x54b
50 #define ERROR_NO_LOGON_SERVERS 0x51f
51 #define NO_ERROR 0x0
52
53 /*************************************************************************
54 net_reply_logon_ctrl:
55 *************************************************************************/
56
57 NTSTATUS _net_logon_ctrl(pipes_struct *p, NET_Q_LOGON_CTRL *q_u,
58 NET_R_LOGON_CTRL *r_u)
59 {
60 uint32 flags = 0x0;
61 uint32 pdc_connection_status = 0x00; /* Maybe a win32 error code? */
62
63 /* Setup the Logon Control response */
64
65 init_net_r_logon_ctrl(r_u, q_u->query_level, flags,
66 pdc_connection_status);
67
68 return r_u->status;
69 }
70
71 /****************************************************************************
72 Send a message to smbd to do a sam synchronisation
73 **************************************************************************/
74
75 static void send_sync_message(void)
76 {
77 DEBUG(3, ("sending sam synchronisation message\n"));
78 message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
79 NULL);
80 }
81
82 /*************************************************************************
83 net_reply_logon_ctrl2:
84 *************************************************************************/
85
86 NTSTATUS _net_logon_ctrl2(pipes_struct *p, NET_Q_LOGON_CTRL2 *q_u, NET_R_LOGON_CTRL2 *r_u)
87 {
88 uint32 flags = 0x0;
89 uint32 pdc_connection_status = 0x0;
90 uint32 logon_attempts = 0x0;
91 uint32 tc_status;
92 fstring servername, domain, dc_name, dc_name2;
93 struct sockaddr_storage dc_ss;
94
95 /* this should be \\global_myname() */
96 unistr2_to_ascii(servername, &q_u->uni_server_name, sizeof(servername));
97
98 r_u->status = NT_STATUS_OK;
99
100 tc_status = ERROR_NO_SUCH_DOMAIN;
101 fstrcpy( dc_name, "" );
102
103 switch ( q_u->function_code ) {
104 case NETLOGON_CONTROL_TC_QUERY:
105 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
106
107 if ( !is_trusted_domain( domain ) )
108 break;
109
110 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
111 tc_status = ERROR_NO_LOGON_SERVERS;
112 break;
113 }
114
115 fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
116
117 tc_status = NO_ERROR;
118
119 break;
120
121 case NETLOGON_CONTROL_REDISCOVER:
122 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain));
123
124 if ( !is_trusted_domain( domain ) )
125 break;
126
127 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ss ) ) {
128 tc_status = ERROR_NO_LOGON_SERVERS;
129 break;
130 }
131
132 fstr_sprintf( dc_name, "\\\\%s", dc_name2 );
133
134 tc_status = NO_ERROR;
135
136 break;
137
138 default:
139 /* no idea what this should be */
140 DEBUG(0,("_net_logon_ctrl2: unimplemented function level [%d]\n",
141 q_u->function_code));
142 }
143
144 /* prepare the response */
145
146 init_net_r_logon_ctrl2( r_u, q_u->query_level, flags,
147 pdc_connection_status, logon_attempts, tc_status, dc_name );
148
149 if (lp_server_role() == ROLE_DOMAIN_BDC)
150 send_sync_message();
151
152 return r_u->status;
153 }
154
155 /*************************************************************************
156 net_reply_trust_dom_list:
157 *************************************************************************/
158
159 NTSTATUS _net_trust_dom_list(pipes_struct *p, NET_Q_TRUST_DOM_LIST *q_u, NET_R_TRUST_DOM_LIST *r_u)
160 {
161 const char *trusted_domain = "test_domain";
162 uint32 num_trust_domains = 1;
163
164 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
165
166 /* set up the Trusted Domain List response */
167 init_r_trust_dom(r_u, num_trust_domains, trusted_domain);
168
169 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__));
170
171 return r_u->status;
172 }
173
174 /***********************************************************************************
175 init_net_r_srv_pwset:
176 ***********************************************************************************/
177
178 static void init_net_r_srv_pwset(NET_R_SRV_PWSET *r_s,
179 DOM_CRED *srv_cred, NTSTATUS status)
180 {
181 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
182
183 memcpy(&r_s->srv_cred, srv_cred, sizeof(r_s->srv_cred));
184 r_s->status = status;
185
186 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__));
187 }
188
189 /******************************************************************
190 gets a machine password entry. checks access rights of the host.
191 ******************************************************************/
192
193 static NTSTATUS get_md4pw(char *md4pw, char *mach_acct, uint16 sec_chan_type)
194 {
195 struct samu *sampass = NULL;
196 const uint8 *pass;
197 bool ret;
198 uint32 acct_ctrl;
199
200 #if 0
201 char addr[INET6_ADDRSTRLEN];
202
203 /*
204 * Currently this code is redundent as we already have a filter
205 * by hostname list. What this code really needs to do is to
206 * get a hosts allowed/hosts denied list from the SAM database
207 * on a per user basis, and make the access decision there.
208 * I will leave this code here for now as a reminder to implement
209 * this at a later date. JRA.
210 */
211
212 if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
213 client_name(get_client_fd()),
214 client_addr(get_client_fd(),addr,sizeof(addr)))) {
215 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
216 return False;
217 }
218 #endif /* 0 */
219
220 if ( !(sampass = samu_new( NULL )) ) {
221 return NT_STATUS_NO_MEMORY;
222 }
223
224 /* JRA. This is ok as it is only used for generating the challenge. */
225 become_root();
226 ret = pdb_getsampwnam(sampass, mach_acct);
227 unbecome_root();
228
229 if (!ret) {
230 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
231 TALLOC_FREE(sampass);
232 return NT_STATUS_ACCESS_DENIED;
233 }
234
235 acct_ctrl = pdb_get_acct_ctrl(sampass);
236 if (acct_ctrl & ACB_DISABLED) {
237 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
238 TALLOC_FREE(sampass);
239 return NT_STATUS_ACCOUNT_DISABLED;
240 }
241
242 if (!(acct_ctrl & ACB_SVRTRUST) &&
243 !(acct_ctrl & ACB_WSTRUST) &&
244 !(acct_ctrl & ACB_DOMTRUST))
245 {
246 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
247 TALLOC_FREE(sampass);
248 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
249 }
250
251 switch (sec_chan_type) {
252 case SEC_CHAN_BDC:
253 if (!(acct_ctrl & ACB_SVRTRUST)) {
254 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
255 "but not a server trust account\n", mach_acct));
256 TALLOC_FREE(sampass);
257 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
258 }
259 break;
260 case SEC_CHAN_WKSTA:
261 if (!(acct_ctrl & ACB_WSTRUST)) {
262 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
263 "but not a workstation trust account\n", mach_acct));
264 TALLOC_FREE(sampass);
265 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
266 }
267 break;
268 case SEC_CHAN_DOMAIN:
269 if (!(acct_ctrl & ACB_DOMTRUST)) {
270 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
271 "but not a interdomain trust account\n", mach_acct));
272 TALLOC_FREE(sampass);
273 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
274 }
275 break;
276 default:
277 break;
278 }
279
280 if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
281 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
282 TALLOC_FREE(sampass);
283 return NT_STATUS_LOGON_FAILURE;
284 }
285
286 memcpy(md4pw, pass, 16);
287 dump_data(5, (uint8 *)md4pw, 16);
288
289 TALLOC_FREE(sampass);
290
291 return NT_STATUS_OK;
292
293
294 }
295
296 /*************************************************************************
297 _net_req_chal
298 *************************************************************************/
299
300 NTSTATUS _net_req_chal(pipes_struct *p, NET_Q_REQ_CHAL *q_u, NET_R_REQ_CHAL *r_u)
301 {
302 if (!p->dc) {
303 p->dc = TALLOC_ZERO_P(p->pipe_state_mem_ctx, struct dcinfo);
304 if (!p->dc) {
305 return NT_STATUS_NO_MEMORY;
306 }
307 } else {
308 DEBUG(10,("_net_req_chal: new challenge requested. Clearing old state.\n"));
309 ZERO_STRUCTP(p->dc);
310 }
311
312 rpcstr_pull(p->dc->remote_machine,
313 q_u->uni_logon_clnt.buffer,
314 sizeof(fstring),q_u->uni_logon_clnt.uni_str_len*2,0);
315
316 /* Save the client challenge to the server. */
317 memcpy(p->dc->clnt_chal.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data));
318
319 /* Create a server challenge for the client */
320 /* Set this to a random value. */
321 generate_random_buffer(p->dc->srv_chal.data, 8);
322
323 /* set up the LSA REQUEST CHALLENGE response */
324 init_net_r_req_chal(r_u, &p->dc->srv_chal, NT_STATUS_OK);
325
326 p->dc->challenge_sent = True;
327
328 return NT_STATUS_OK;
329 }
330
331 /*************************************************************************
332 init_net_r_auth:
333 *************************************************************************/
334
335 static void init_net_r_auth(NET_R_AUTH *r_a, DOM_CHAL *resp_cred, NTSTATUS status)
336 {
337 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
338 r_a->status = status;
339 }
340
341 /*************************************************************************
342 _net_auth. Create the initial credentials.
343 *************************************************************************/
344
345 NTSTATUS _net_auth(pipes_struct *p, NET_Q_AUTH *q_u, NET_R_AUTH *r_u)
346 {
347 NTSTATUS status;
348 fstring mach_acct;
349 fstring remote_machine;
350 DOM_CHAL srv_chal_out;
351
352 if (!p->dc || !p->dc->challenge_sent) {
353 return NT_STATUS_ACCESS_DENIED;
354 }
355
356 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
357 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
358 rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
359 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
360
361 status = get_md4pw((char *)p->dc->mach_pw, mach_acct, q_u->clnt_id.sec_chan);
362 if (!NT_STATUS_IS_OK(status)) {
363 DEBUG(0,("_net_auth: creds_server_check failed. Failed to "
364 "get password for machine account %s "
365 "from client %s: %s\n",
366 mach_acct, remote_machine, nt_errstr(status) ));
367 /* always return NT_STATUS_ACCESS_DENIED */
368 return NT_STATUS_ACCESS_DENIED;
369 }
370
371 /* From the client / server challenges and md4 password, generate sess key */
372 creds_server_init(0, /* No neg flags. */
373 p->dc,
374 &p->dc->clnt_chal, /* Stored client chal. */
375 &p->dc->srv_chal, /* Stored server chal. */
376 p->dc->mach_pw,
377 &srv_chal_out);
378
379 /* Check client credentials are valid. */
380 if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
381 DEBUG(0,("_net_auth: creds_server_check failed. Rejecting auth "
382 "request from client %s machine account %s\n",
383 remote_machine, mach_acct ));
384 return NT_STATUS_ACCESS_DENIED;
385 }
386
387 fstrcpy(p->dc->mach_acct, mach_acct);
388 fstrcpy(p->dc->remote_machine, remote_machine);
389 p->dc->authenticated = True;
390
391 /* set up the LSA AUTH response */
392 /* Return the server credentials. */
393 init_net_r_auth(r_u, &srv_chal_out, NT_STATUS_OK);
394
395 return r_u->status;
396 }
397
398 /*************************************************************************
399 init_net_r_auth_2:
400 *************************************************************************/
401
402 static void init_net_r_auth_2(NET_R_AUTH_2 *r_a,
403 DOM_CHAL *resp_cred, NEG_FLAGS *flgs, NTSTATUS status)
404 {
405 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data));
406 memcpy(&r_a->srv_flgs, flgs, sizeof(r_a->srv_flgs));
407 r_a->status = status;
408 }
409
410 /*************************************************************************
411 _net_auth_2
412 *************************************************************************/
413
414 NTSTATUS _net_auth_2(pipes_struct *p, NET_Q_AUTH_2 *q_u, NET_R_AUTH_2 *r_u)
415 {
416 NTSTATUS status;
417 NEG_FLAGS srv_flgs;
418 fstring mach_acct;
419 fstring remote_machine;
420 DOM_CHAL srv_chal_out;
421
422 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),
423 q_u->clnt_id.uni_acct_name.uni_str_len*2,0);
424
425 /* We use this as the key to store the creds. */
426 rpcstr_pull(remote_machine, q_u->clnt_id.uni_comp_name.buffer,sizeof(fstring),
427 q_u->clnt_id.uni_comp_name.uni_str_len*2,0);
428
429 if (!p->dc || !p->dc->challenge_sent) {
430 DEBUG(0,("_net_auth2: no challenge sent to client %s\n",
431 remote_machine ));
432 return NT_STATUS_ACCESS_DENIED;
433 }
434
435 if ( (lp_server_schannel() == True) &&
436 ((q_u->clnt_flgs.neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
437
438 /* schannel must be used, but client did not offer it. */
439 DEBUG(0,("_net_auth2: schannel required but client failed "
440 "to offer it. Client was %s\n",
441 mach_acct ));
442 return NT_STATUS_ACCESS_DENIED;
443 }
444
445 status = get_md4pw((char *)p->dc->mach_pw, mach_acct, q_u->clnt_id.sec_chan);
446 if (!NT_STATUS_IS_OK(status)) {
447 DEBUG(0,("_net_auth2: failed to get machine password for "
448 "account %s: %s\n",
449 mach_acct, nt_errstr(status) ));
450 /* always return NT_STATUS_ACCESS_DENIED */
451 return NT_STATUS_ACCESS_DENIED;
452 }
453
454 /* From the client / server challenges and md4 password, generate sess key */
455 creds_server_init(q_u->clnt_flgs.neg_flags,
456 p->dc,
457 &p->dc->clnt_chal, /* Stored client chal. */
458 &p->dc->srv_chal, /* Stored server chal. */
459 p->dc->mach_pw,
460 &srv_chal_out);
461
462 /* Check client credentials are valid. */
463 if (!creds_server_check(p->dc, &q_u->clnt_chal)) {
464 DEBUG(0,("_net_auth2: creds_server_check failed. Rejecting auth "
465 "request from client %s machine account %s\n",
466 remote_machine, mach_acct ));
467 return NT_STATUS_ACCESS_DENIED;
468 }
469
470 srv_flgs.neg_flags = 0x000001ff;
471
472 if (lp_server_schannel() != False) {
473 srv_flgs.neg_flags |= NETLOGON_NEG_SCHANNEL;
474 }
475
476 /* set up the LSA AUTH 2 response */
477 init_net_r_auth_2(r_u, &srv_chal_out, &srv_flgs, NT_STATUS_OK);
478
479 fstrcpy(p->dc->mach_acct, mach_acct);
480 fstrcpy(p->dc->remote_machine, remote_machine);
481 fstrcpy(p->dc->domain, lp_workgroup() );
482
483 p->dc->authenticated = True;
484
485 /* Store off the state so we can continue after client disconnect. */
486 become_root();
487 secrets_store_schannel_session_info(p->mem_ctx,
488 remote_machine,
489 p->dc);
490 unbecome_root();
491
492 return r_u->status;
493 }
494
495 /*************************************************************************
496 _net_srv_pwset
497 *************************************************************************/
498
499 NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *r_u)
500 {
501 fstring remote_machine;
502 struct samu *sampass=NULL;
503 bool ret = False;
504 unsigned char pwd[16];
505 int i;
506 uint32 acct_ctrl;
507 DOM_CRED cred_out;
508 const uchar *old_pw;
509
510 DEBUG(5,("_net_srv_pwset: %d\n", __LINE__));
511
512 /* We need the remote machine name for the creds lookup. */
513 rpcstr_pull(remote_machine,q_u->clnt_id.login.uni_comp_name.buffer,
514 sizeof(remote_machine),q_u->clnt_id.login.uni_comp_name.uni_str_len*2,0);
515
516 if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
517 /* 'server schannel = yes' should enforce use of
518 schannel, the client did offer it in auth2, but
519 obviously did not use it. */
520 DEBUG(0,("_net_srv_pwset: client %s not using schannel for netlogon\n",
521 remote_machine ));
522 return NT_STATUS_ACCESS_DENIED;
523 }
524
525 if (!p->dc) {
526 /* Restore the saved state of the netlogon creds. */
527 become_root();
528 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
529 remote_machine,
530 &p->dc);
531 unbecome_root();
532 if (!ret) {
533 return NT_STATUS_INVALID_HANDLE;
534 }
535 }
536
537 if (!p->dc || !p->dc->authenticated) {
538 return NT_STATUS_INVALID_HANDLE;
539 }
540
541 DEBUG(3,("_net_srv_pwset: Server Password Set by remote machine:[%s] on account [%s]\n",
542 remote_machine, p->dc->mach_acct));
543
544 /* Step the creds chain forward. */
545 if (!creds_server_step(p->dc, &q_u->clnt_id.cred, &cred_out)) {
546 DEBUG(2,("_net_srv_pwset: creds_server_step failed. Rejecting auth "
547 "request from client %s machine account %s\n",
548 remote_machine, p->dc->mach_acct ));
549 return NT_STATUS_INVALID_PARAMETER;
550 }
551
552 /* We must store the creds state after an update. */
553 sampass = samu_new( NULL );
554 if (!sampass) {
555 return NT_STATUS_NO_MEMORY;
556 }
557
558 become_root();
559 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
560 remote_machine,
561 p->dc);
562 ret = pdb_getsampwnam(sampass, p->dc->mach_acct);
563 unbecome_root();
564
565 if (!ret) {
566 TALLOC_FREE(sampass);
567 return NT_STATUS_ACCESS_DENIED;
568 }
569
570 /* Ensure the account exists and is a machine account. */
571
572 acct_ctrl = pdb_get_acct_ctrl(sampass);
573
574 if (!(acct_ctrl & ACB_WSTRUST ||
575 acct_ctrl & ACB_SVRTRUST ||
576 acct_ctrl & ACB_DOMTRUST)) {
577 TALLOC_FREE(sampass);
578 return NT_STATUS_NO_SUCH_USER;
579 }
580
581 if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
582 TALLOC_FREE(sampass);
583 return NT_STATUS_ACCOUNT_DISABLED;
584 }
585
586 /* Woah - what does this to to the credential chain ? JRA */
587 cred_hash3( pwd, q_u->pwd, p->dc->sess_key, 0);
588
589 DEBUG(100,("Server password set : new given value was :\n"));
590 for(i = 0; i < sizeof(pwd); i++)
591 DEBUG(100,("%02X ", pwd[i]));
592 DEBUG(100,("\n"));
593
594 old_pw = pdb_get_nt_passwd(sampass);
595
596 if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
597 /* Avoid backend modificiations and other fun if the
598 client changed the password to the *same thing* */
599
600 ret = True;
601 } else {
602
603 /* LM password should be NULL for machines */
604 if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
605 TALLOC_FREE(sampass);
606 return NT_STATUS_NO_MEMORY;
607 }
608
609 if (!pdb_set_nt_passwd(sampass, pwd, PDB_CHANGED)) {
610 TALLOC_FREE(sampass);
611 return NT_STATUS_NO_MEMORY;
612 }
613
614 if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
615 TALLOC_FREE(sampass);
616 /* Not quite sure what this one qualifies as, but this will do */
617 return NT_STATUS_UNSUCCESSFUL;
618 }
619
620 become_root();
621 r_u->status = pdb_update_sam_account(sampass);
622 unbecome_root();
623 }
624
625 /* set up the LSA Server Password Set response */
626 init_net_r_srv_pwset(r_u, &cred_out, r_u->status);
627
628 TALLOC_FREE(sampass);
629 return r_u->status;
630 }
631
632 /*************************************************************************
633 _net_sam_logoff:
634 *************************************************************************/
635
636 NTSTATUS _net_sam_logoff(pipes_struct *p, NET_Q_SAM_LOGOFF *q_u, NET_R_SAM_LOGOFF *r_u)
637 {
638 fstring remote_machine;
639
640 if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
641 /* 'server schannel = yes' should enforce use of
642 schannel, the client did offer it in auth2, but
643 obviously did not use it. */
644 DEBUG(0,("_net_sam_logoff: client %s not using schannel for netlogon\n",
645 get_remote_machine_name() ));
646 return NT_STATUS_ACCESS_DENIED;
647 }
648
649
650 if (!get_valid_user_struct(p->vuid))
651 return NT_STATUS_NO_SUCH_USER;
652
653 /* Get the remote machine name for the creds store. */
654 rpcstr_pull(remote_machine,q_u->sam_id.client.login.uni_comp_name.buffer,
655 sizeof(remote_machine),q_u->sam_id.client.login.uni_comp_name.uni_str_len*2,0);
656
657 if (!p->dc) {
658 /* Restore the saved state of the netlogon creds. */
659 bool ret;
660
661 become_root();
662 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
663 remote_machine,
664 &p->dc);
665 unbecome_root();
666 if (!ret) {
667 return NT_STATUS_INVALID_HANDLE;
668 }
669 }
670
671 if (!p->dc || !p->dc->authenticated) {
672 return NT_STATUS_INVALID_HANDLE;
673 }
674
675 r_u->buffer_creds = 1; /* yes, we have valid server credentials */
676
677 /* checks and updates credentials. creates reply credentials */
678 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
679 DEBUG(2,("_net_sam_logoff: creds_server_step failed. Rejecting auth "
680 "request from client %s machine account %s\n",
681 remote_machine, p->dc->mach_acct ));
682 return NT_STATUS_INVALID_PARAMETER;
683 }
684
685 /* We must store the creds state after an update. */
686 become_root();
687 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
688 remote_machine,
689 p->dc);
690 unbecome_root();
691
692 r_u->status = NT_STATUS_OK;
693 return r_u->status;
694 }
695
696 /*******************************************************************
697 gets a domain user's groups from their already-calculated NT_USER_TOKEN
698 ********************************************************************/
699
700 static NTSTATUS nt_token_to_group_list(TALLOC_CTX *mem_ctx,
701 const DOM_SID *domain_sid,
702 size_t num_sids,
703 const DOM_SID *sids,
704 int *numgroups, DOM_GID **pgids)
705 {
706 int i;
707
708 *numgroups=0;
709 *pgids = NULL;
710
711 for (i=0; i<num_sids; i++) {
712 DOM_GID gid;
713 if (!sid_peek_check_rid(domain_sid, &sids[i], &gid.g_rid)) {
714 continue;
715 }
716 gid.attr = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
717 SE_GROUP_ENABLED);
718 ADD_TO_ARRAY(mem_ctx, DOM_GID, gid, pgids, numgroups);
719 if (*pgids == NULL) {
720 return NT_STATUS_NO_MEMORY;
721 }
722 }
723 return NT_STATUS_OK;
724 }
725
726 /*************************************************************************
727 _net_sam_logon
728 *************************************************************************/
729
730 static NTSTATUS _net_sam_logon_internal(pipes_struct *p,
731 NET_Q_SAM_LOGON *q_u,
732 NET_R_SAM_LOGON *r_u,
733 bool process_creds)
734 {
735 NTSTATUS status = NT_STATUS_OK;
736 NET_USER_INFO_3 *usr_info = NULL;
737 NET_ID_INFO_CTR *ctr = q_u->sam_id.ctr;
738 UNISTR2 *uni_samlogon_user = NULL;
739 UNISTR2 *uni_samlogon_domain = NULL;
740 UNISTR2 *uni_samlogon_workstation = NULL;
741 fstring nt_username, nt_domain, nt_workstation;
742 auth_usersupplied_info *user_info = NULL;
743 auth_serversupplied_info *server_info = NULL;
744 struct samu *sampw;
745 struct auth_context *auth_context = NULL;
746
747 if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) {
748 /* 'server schannel = yes' should enforce use of
749 schannel, the client did offer it in auth2, but
750 obviously did not use it. */
751 DEBUG(0,("_net_sam_logon_internal: client %s not using schannel for netlogon\n",
752 get_remote_machine_name() ));
753 return NT_STATUS_ACCESS_DENIED;
754 }
755
756 usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3);
757 if (!usr_info) {
758 return NT_STATUS_NO_MEMORY;
759 }
760
761 ZERO_STRUCTP(usr_info);
762
763 /* store the user information, if there is any. */
764 r_u->user = usr_info;
765 r_u->auth_resp = 1; /* authoritative response */
766 if (q_u->validation_level != 2 && q_u->validation_level != 3) {
767 DEBUG(0,("_net_sam_logon: bad validation_level value %d.\n", (int)q_u->validation_level ));
768 return NT_STATUS_ACCESS_DENIED;
769 }
770 /* We handle the return of USER_INFO_2 instead of 3 in the parse return. Sucks, I know... */
771 r_u->switch_value = q_u->validation_level; /* indicates type of validation user info */
772 r_u->buffer_creds = 1; /* Ensure we always return server creds. */
773
774 if (!get_valid_user_struct(p->vuid))
775 return NT_STATUS_NO_SUCH_USER;
776
777 if (process_creds) {
778 fstring remote_machine;
779
780 /* Get the remote machine name for the creds store. */
781 /* Note this is the remote machine this request is coming from (member server),
782 not neccessarily the workstation name the user is logging onto.
783 */
784 rpcstr_pull(remote_machine,q_u->sam_id.client.login.uni_comp_name.buffer,
785 sizeof(remote_machine),q_u->sam_id.client.login.uni_comp_name.uni_str_len*2,0);
786
787 if (!p->dc) {
788 /* Restore the saved state of the netlogon creds. */
789 bool ret;
790
791 become_root();
792 ret = secrets_restore_schannel_session_info(p->pipe_state_mem_ctx,
793 remote_machine,
794 &p->dc);
795 unbecome_root();
796 if (!ret) {
797 return NT_STATUS_INVALID_HANDLE;
798 }
799 }
800
801 if (!p->dc || !p->dc->authenticated) {
802 return NT_STATUS_INVALID_HANDLE;
803 }
804
805 /* checks and updates credentials. creates reply credentials */
806 if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) {
807 DEBUG(2,("_net_sam_logon: creds_server_step failed. Rejecting auth "
808 "request from client %s machine account %s\n",
809 remote_machine, p->dc->mach_acct ));
810 return NT_STATUS_INVALID_PARAMETER;
811 }
812
813 /* We must store the creds state after an update. */
814 become_root();
815 secrets_store_schannel_session_info(p->pipe_state_mem_ctx,
816 remote_machine,
817 p->dc);
818 unbecome_root();
819 }
820
821 switch (q_u->sam_id.logon_level) {
822 case INTERACTIVE_LOGON_TYPE:
823 uni_samlogon_user = &ctr->auth.id1.uni_user_name;
824 uni_samlogon_domain = &ctr->auth.id1.uni_domain_name;
825
826 uni_samlogon_workstation = &ctr->auth.id1.uni_wksta_name;
827
828 DEBUG(3,("SAM Logon (Interactive). Domain:[%s]. ", lp_workgroup()));
829 break;
830 case NET_LOGON_TYPE:
831 uni_samlogon_user = &ctr->auth.id2.uni_user_name;
832 uni_samlogon_domain = &ctr->auth.id2.uni_domain_name;
833 uni_samlogon_workstation = &ctr->auth.id2.uni_wksta_name;
834
835 DEBUG(3,("SAM Logon (Network). Domain:[%s]. ", lp_workgroup()));
836 break;
837 default:
838 DEBUG(2,("SAM Logon: unsupported switch value\n"));
839 return NT_STATUS_INVALID_INFO_CLASS;
840 } /* end switch */
841
842 rpcstr_pull(nt_username,uni_samlogon_user->buffer,sizeof(nt_username),uni_samlogon_user->uni_str_len*2,0);
843 rpcstr_pull(nt_domain,uni_samlogon_domain->buffer,sizeof(nt_domain),uni_samlogon_domain->uni_str_len*2,0);
844 rpcstr_pull(nt_workstation,uni_samlogon_workstation->buffer,sizeof(nt_workstation),uni_samlogon_workstation->uni_str_len*2,0);
845
846 DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
847 fstrcpy(current_user_info.smb_name, nt_username);
848 sub_set_smb_name(nt_username);
849
850 DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u->sam_id.ctr->switch_value, nt_username));
851
852 status = NT_STATUS_OK;
853
854 switch (ctr->switch_value) {
855 case NET_LOGON_TYPE:
856 {
857 const char *wksname = nt_workstation;
858
859 if (!NT_STATUS_IS_OK(status = make_auth_context_fixed(&auth_context, ctr->auth.id2.lm_chal))) {
860 return status;
861 }
862
863 /* For a network logon, the workstation name comes in with two
864 * backslashes in the front. Strip them if they are there. */
865
866 if (*wksname == '\\') wksname++;
867 if (*wksname == '\\') wksname++;
868
869 /* Standard challenge/response authenticaion */
870 if (!make_user_info_netlogon_network(&user_info,
871 nt_username, nt_domain,
872 wksname,
873 ctr->auth.id2.param_ctrl,
874 ctr->auth.id2.lm_chal_resp.buffer,
875 ctr->auth.id2.lm_chal_resp.str_str_len,
876 ctr->auth.id2.nt_chal_resp.buffer,
877 ctr->auth.id2.nt_chal_resp.str_str_len)) {
878 status = NT_STATUS_NO_MEMORY;
879 }
880 break;
881 }
882 case INTERACTIVE_LOGON_TYPE:
883 /* 'Interactive' authentication, supplies the password in its
884 MD4 form, encrypted with the session key. We will convert
885 this to challenge/response for the auth subsystem to chew
886 on */
887 {
888 const uint8 *chal;
889
890 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
891 return status;
892 }
893
894 chal = auth_context->get_ntlm_challenge(auth_context);
895
896 if (!make_user_info_netlogon_interactive(&user_info,
897 nt_username, nt_domain,
898 nt_workstation,
899 ctr->auth.id1.param_ctrl,
900 chal,
901 ctr->auth.id1.lm_owf.data,
902 ctr->auth.id1.nt_owf.data,
903 p->dc->sess_key)) {
904 status = NT_STATUS_NO_MEMORY;
905 }
906 break;
907 }
908 default:
909 DEBUG(2,("SAM Logon: unsupported switch value\n"));
910 return NT_STATUS_INVALID_INFO_CLASS;
911 } /* end switch */
912
913 if ( NT_STATUS_IS_OK(status) ) {
914 status = auth_context->check_ntlm_password(auth_context,
915 user_info, &server_info);
916 }
917
918 (auth_context->free)(&auth_context);
919 free_user_info(&user_info);
920
921 DEBUG(5, ("_net_sam_logon: check_password returned status %s\n",
922 nt_errstr(status)));
923
924 /* Check account and password */
925
926 if (!NT_STATUS_IS_OK(status)) {
927 /* If we don't know what this domain is, we need to
928 indicate that we are not authoritative. This
929 allows the client to decide if it needs to try
930 a local user. Fix by jpjanosi@us.ibm.com, #2976 */
931 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
932 && !strequal(nt_domain, get_global_sam_name())
933 && !is_trusted_domain(nt_domain) )
934 r_u->auth_resp = 0; /* We are not authoritative */
935
936 TALLOC_FREE(server_info);
937 return status;
938 }
939
940 if (server_info->guest) {
941 /* We don't like guest domain logons... */
942 DEBUG(5,("_net_sam_logon: Attempted domain logon as GUEST "
943 "denied.\n"));
944 TALLOC_FREE(server_info);
945 return NT_STATUS_LOGON_FAILURE;
946 }
947
948 /* This is the point at which, if the login was successful, that
949 the SAM Local Security Authority should record that the user is
950 logged in to the domain. */
951
952 {
953 DOM_GID *gids = NULL;
954 const DOM_SID *user_sid = NULL;
955 const DOM_SID *group_sid = NULL;
956 DOM_SID domain_sid;
957 uint32 user_rid, group_rid;
958
959 int num_gids = 0;
960 const char *my_name;
961 unsigned char user_session_key[16];
962 unsigned char lm_session_key[16];
963 unsigned char pipe_session_key[16];
964
965 sampw = server_info->sam_account;
966
967 /* set up pointer indicating user/password failed to be
968 * found */
969 usr_info->ptr_user_info = 0;
970
971 user_sid = pdb_get_user_sid(sampw);
972 group_sid = pdb_get_group_sid(sampw);
973
974 if ((user_sid == NULL) || (group_sid == NULL)) {
975 DEBUG(1, ("_net_sam_logon: User without group or user SID\n"));
976 return NT_STATUS_UNSUCCESSFUL;
977 }
978
979 sid_copy(&domain_sid, user_sid);
980 sid_split_rid(&domain_sid, &user_rid);
981
982 if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
983 DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid "
984 "%s\n but group sid %s.\n"
985 "The conflicting domain portions are not "
986 "supported for NETLOGON calls\n",
987 pdb_get_domain(sampw),
988 pdb_get_username(sampw),
989 sid_string_dbg(user_sid),
990 sid_string_dbg(group_sid)));
991 return NT_STATUS_UNSUCCESSFUL;
992 }
993
994 if(server_info->login_server) {
995 my_name = server_info->login_server;
996 } else {
997 my_name = global_myname();
998 }
999
1000 status = nt_token_to_group_list(p->mem_ctx, &domain_sid,
1001 server_info->num_sids,
1002 server_info->sids,
1003 &num_gids, &gids);
1004
1005 if (!NT_STATUS_IS_OK(status)) {
1006 return status;
1007 }
1008
1009 if (server_info->user_session_key.length) {
1010 memcpy(user_session_key,
1011 server_info->user_session_key.data,
1012 MIN(sizeof(user_session_key),
1013 server_info->user_session_key.length));
1014 if (process_creds) {
1015 /* Get the pipe session key from the creds. */
1016 memcpy(pipe_session_key, p->dc->sess_key, 16);
1017 } else {
1018 /* Get the pipe session key from the schannel. */
1019 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1020 return NT_STATUS_INVALID_HANDLE;
1021 }
1022 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1023 }
1024 SamOEMhash(user_session_key, pipe_session_key, 16);
1025 memset(pipe_session_key, '\0', 16);
1026 }
1027 if (server_info->lm_session_key.length) {
1028 memcpy(lm_session_key,
1029 server_info->lm_session_key.data,
1030 MIN(sizeof(lm_session_key),
1031 server_info->lm_session_key.length));
1032 if (process_creds) {
1033 /* Get the pipe session key from the creds. */
1034 memcpy(pipe_session_key, p->dc->sess_key, 16);
1035 } else {
1036 /* Get the pipe session key from the schannel. */
1037 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL || p->auth.a_u.schannel_auth == NULL) {
1038 return NT_STATUS_INVALID_HANDLE;
1039 }
1040 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->sess_key, 16);
1041 }
1042 SamOEMhash(lm_session_key, pipe_session_key, 16);
1043 memset(pipe_session_key, '\0', 16);
1044 }
1045
1046 init_net_user_info3(p->mem_ctx, usr_info,
1047 user_rid,
1048 group_rid,
1049 pdb_get_username(sampw),
1050 pdb_get_fullname(sampw),
1051 pdb_get_homedir(sampw),
1052 pdb_get_dir_drive(sampw),
1053 pdb_get_logon_script(sampw),
1054 pdb_get_profile_path(sampw),
1055 pdb_get_logon_time(sampw),
1056 get_time_t_max(),
1057 get_time_t_max(),
1058 pdb_get_pass_last_set_time(sampw),
1059 pdb_get_pass_can_change_time(sampw),
1060 pdb_get_pass_must_change_time(sampw),
1061 0, /* logon_count */
1062 0, /* bad_pw_count */
1063 num_gids, /* uint32 num_groups */
1064 gids , /* DOM_GID *gids */
1065 NETLOGON_EXTRA_SIDS, /* uint32 user_flgs (?) */
1066 pdb_get_acct_ctrl(sampw),
1067 server_info->user_session_key.length ? user_session_key : NULL,
1068 server_info->lm_session_key.length ? lm_session_key : NULL,
1069 my_name , /* char *logon_srv */
1070 pdb_get_domain(sampw),
1071 &domain_sid); /* DOM_SID *dom_sid */
1072 ZERO_STRUCT(user_session_key);
1073 ZERO_STRUCT(lm_session_key);
1074 }
1075 TALLOC_FREE(server_info);
1076 return status;
1077 }
1078
1079 /*************************************************************************
1080 _net_sam_logon
1081 *************************************************************************/
1082
1083 NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *r_u)
1084 {
1085 return _net_sam_logon_internal(p, q_u, r_u, True);
1086 }
1087
1088 /*************************************************************************
1089 _net_sam_logon_ex - no credential chaining. Map into net sam logon.
1090 *************************************************************************/
1091
1092 NTSTATUS _net_sam_logon_ex(pipes_struct *p, NET_Q_SAM_LOGON_EX *q_u, NET_R_SAM_LOGON_EX *r_u)
1093 {
1094 NET_Q_SAM_LOGON q;
1095 NET_R_SAM_LOGON r;
1096
1097 ZERO_STRUCT(q);
1098 ZERO_STRUCT(r);
1099
1100 /* Only allow this if the pipe is protected. */
1101 if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1102 DEBUG(0,("_net_sam_logon_ex: client %s not using schannel for netlogon\n",
1103 get_remote_machine_name() ));
1104 return NT_STATUS_INVALID_PARAMETER;
1105 }
1106
1107 /* Map a NET_Q_SAM_LOGON_EX to NET_Q_SAM_LOGON. */
1108 q.validation_level = q_u->validation_level;
1109
1110 /* Map a DOM_SAM_INFO_EX into a DOM_SAM_INFO with no creds. */
1111 q.sam_id.client.login = q_u->sam_id.client;
1112 q.sam_id.logon_level = q_u->sam_id.logon_level;
1113 q.sam_id.ctr = q_u->sam_id.ctr;
1114
1115 r_u->status = _net_sam_logon_internal(p, &q, &r, False);
1116
1117 if (!NT_STATUS_IS_OK(r_u->status)) {
1118 return r_u->status;
1119 }
1120
1121 /* Map the NET_R_SAM_LOGON to NET_R_SAM_LOGON_EX. */
1122 r_u->switch_value = r.switch_value;
1123 r_u->user = r.user;
1124 r_u->auth_resp = r.auth_resp;
1125 r_u->flags = 0; /* FIXME ! */
1126 return r_u->status;
1127 }
1128
1129 /*************************************************************************
1130 _ds_enum_dom_trusts
1131 *************************************************************************/
1132 #if 0 /* JERRY -- not correct */
1133 NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1134 DS_R_ENUM_DOM_TRUSTS *r_u)
1135 {
1136 NTSTATUS status = NT_STATUS_OK;
1137
1138 /* TODO: According to MSDN, the can only be executed against a
1139 DC or domain member running Windows 2000 or later. Need
1140 to test against a standalone 2k server and see what it
1141 does. A windows 2000 DC includes its own domain in the
1142 list. --jerry */
1143
1144 return status;
1145 }
1146 #endif /* JERRY */
reg import