source3/libnet/libnet_samsync.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Extract the user/system database from a remote SamSync server
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7    Copyright (C) Guenther Deschner <gd@samba.org> 2008
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23
  24 #include "includes.h"
  25 #include "libnet/libnet_samsync.h"
  26
  27 /**
  28  * Decrypt and extract the user's passwords.
  29  *
  30  * The writes decrypted (no longer 'RID encrypted' or arcfour encrypted)
  31  * passwords back into the structure
  32  */
  33
  34 static NTSTATUS fix_user(TALLOC_CTX *mem_ctx,
  35                          DATA_BLOB *session_key,
  36                          bool rid_crypt,
  37                          enum netr_SamDatabaseID database_id,
  38                          struct netr_DELTA_ENUM *delta)
  39 {
  40
  41         uint32_t rid = delta->delta_id_union.rid;
  42         struct netr_DELTA_USER *user = delta->delta_union.user;
  43         struct samr_Password lm_hash;
  44         struct samr_Password nt_hash;
  45
  46         if (rid_crypt) {
  47                 if (user->lm_password_present) {
  48                         sam_pwd_hash(rid, user->lmpassword.hash, lm_hash.hash, 0);
  49                         user->lmpassword = lm_hash;
  50                 }
  51
  52                 if (user->nt_password_present) {
  53                         sam_pwd_hash(rid, user->ntpassword.hash, nt_hash.hash, 0);
  54                         user->ntpassword = nt_hash;
  55                 }
  56         }
  57
  58         if (user->user_private_info.SensitiveData) {
  59                 DATA_BLOB data;
  60                 struct netr_USER_KEYS keys;
  61                 enum ndr_err_code ndr_err;
  62                 data.data = user->user_private_info.SensitiveData;
  63                 data.length = user->user_private_info.DataLength;
  64                 SamOEMhashBlob(data.data, data.length, session_key);
  65                 user->user_private_info.SensitiveData = data.data;
  66                 user->user_private_info.DataLength = data.length;
  67
  68                 ndr_err = ndr_pull_struct_blob(&data, mem_ctx, &keys,
  69                         (ndr_pull_flags_fn_t)ndr_pull_netr_USER_KEYS);
  70                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  71                         dump_data(10, data.data, data.length);
  72                         return ndr_map_error2ntstatus(ndr_err);
  73                 }
  74
  75                 if (keys.keys.keys2.lmpassword.length == 16) {
  76                         if (rid_crypt) {
  77                                 sam_pwd_hash(rid,
  78                                              keys.keys.keys2.lmpassword.pwd.hash,
  79                                              lm_hash.hash, 0);
  80                                 user->lmpassword = lm_hash;
  81                         } else {
  82                                 user->lmpassword = keys.keys.keys2.lmpassword.pwd;
  83                         }
  84                         user->lm_password_present = true;
  85                 }
  86                 if (keys.keys.keys2.ntpassword.length == 16) {
  87                         if (rid_crypt) {
  88                                 sam_pwd_hash(rid,
  89                                              keys.keys.keys2.ntpassword.pwd.hash,
  90                                              nt_hash.hash, 0);
  91                                 user->ntpassword = nt_hash;
  92                         } else {
  93                                 user->ntpassword = keys.keys.keys2.ntpassword.pwd;
  94                         }
  95                         user->nt_password_present = true;
  96                 }
  97                 /* TODO: rid decrypt history fields */
  98         }
  99         return NT_STATUS_OK;
 100 }
 101
 102 /**
 103  * Decrypt and extract the secrets
 104  *
 105  * The writes decrypted secrets back into the structure
 106  */
 107 static NTSTATUS fix_secret(TALLOC_CTX *mem_ctx,
 108                            DATA_BLOB *session_key,
 109                            enum netr_SamDatabaseID database_id,
 110                            struct netr_DELTA_ENUM *delta)
 111 {
 112         struct netr_DELTA_SECRET *secret = delta->delta_union.secret;
 113
 114         SamOEMhashBlob(secret->current_cipher.cipher_data,
 115                        secret->current_cipher.maxlen,
 116                        session_key);
 117
 118         SamOEMhashBlob(secret->old_cipher.cipher_data,
 119                        secret->old_cipher.maxlen,
 120                        session_key);
 121
 122         return NT_STATUS_OK;
 123 }
 124
 125 /**
 126  * Fix up the delta, dealing with encryption issues so that the final
 127  * callback need only do the printing or application logic
 128  */
 129
 130 static NTSTATUS samsync_fix_delta(TALLOC_CTX *mem_ctx,
 131                                   DATA_BLOB *session_key,
 132                                   bool rid_crypt,
 133                                   enum netr_SamDatabaseID database_id,
 134                                   struct netr_DELTA_ENUM *delta)
 135 {
 136         NTSTATUS status = NT_STATUS_OK;
 137
 138         switch (delta->delta_type) {
 139                 case NETR_DELTA_USER:
 140
 141                         status = fix_user(mem_ctx,
 142                                           session_key,
 143                                           rid_crypt,
 144                                           database_id,
 145                                           delta);
 146                         break;
 147                 case NETR_DELTA_SECRET:
 148
 149                         status = fix_secret(mem_ctx,
 150                                             session_key,
 151                                             database_id,
 152                                             delta);
 153                         break;
 154                 default:
 155                         break;
 156         }
 157
 158         return status;
 159 }
 160
 161 /**
 162  * Fix up the delta, dealing with encryption issues so that the final
 163  * callback need only do the printing or application logic
 164  */
 165
 166 NTSTATUS samsync_fix_delta_array(TALLOC_CTX *mem_ctx,
 167                                  DATA_BLOB *session_key,
 168                                  bool rid_crypt,
 169                                  enum netr_SamDatabaseID database_id,
 170                                  struct netr_DELTA_ENUM_ARRAY *r)
 171 {
 172         NTSTATUS status;
 173         int i;
 174
 175         for (i = 0; i < r->num_deltas; i++) {
 176
 177                 status = samsync_fix_delta(mem_ctx,
 178                                            session_key,
 179                                            rid_crypt,
 180                                            database_id,
 181                                            &r->delta_enum[i]);
 182                 if (!NT_STATUS_IS_OK(status)) {
 183                         return status;
 184                 }
 185         }
 186
 187         return NT_STATUS_OK;
 188 }
 189
 190 /**
 191  * samsync_init_context
 192  */
 193
 194 NTSTATUS samsync_init_context(TALLOC_CTX *mem_ctx,
 195                               const struct dom_sid *domain_sid,
 196                               const char *domain_name,
 197                               enum net_samsync_mode mode,
 198                               struct samsync_context **ctx_p)
 199 {
 200         struct samsync_context *ctx;
 201
 202         *ctx_p = NULL;
 203
 204         ctx = TALLOC_ZERO_P(mem_ctx, struct samsync_context);
 205         NT_STATUS_HAVE_NO_MEMORY(ctx);
 206
 207         ctx->mode = mode;
 208
 209         ctx->domain_name = talloc_strdup(mem_ctx, domain_name);
 210         NT_STATUS_HAVE_NO_MEMORY(ctx->domain_name);
 211
 212         if (domain_sid) {
 213                 ctx->domain_sid = sid_dup_talloc(mem_ctx, domain_sid);
 214                 NT_STATUS_HAVE_NO_MEMORY(ctx->domain_sid);
 215
 216                 ctx->domain_sid_str = sid_string_talloc(mem_ctx, ctx->domain_sid);
 217                 NT_STATUS_HAVE_NO_MEMORY(ctx->domain_sid_str);
 218         }
 219
 220         *ctx_p = ctx;
 221
 222         return NT_STATUS_OK;
 223 }
 224
 225 /**
 226  * samsync_database_str
 227  */
 228
 229 static const char *samsync_database_str(enum netr_SamDatabaseID database_id)
 230 {
 231
 232         switch (database_id) {
 233                 case SAM_DATABASE_DOMAIN:
 234                         return "DOMAIN";
 235                 case SAM_DATABASE_BUILTIN:
 236                         return "BUILTIN";
 237                 case SAM_DATABASE_PRIVS:
 238                         return "PRIVS";
 239                 default:
 240                         return "unknown";
 241         }
 242 }
 243
 244 /**
 245  * samsync_debug_str
 246  */
 247
 248 static const char *samsync_debug_str(TALLOC_CTX *mem_ctx,
 249                                      enum net_samsync_mode mode,
 250                                      enum netr_SamDatabaseID database_id)
 251 {
 252         const char *action = NULL;
 253
 254         switch (mode) {
 255                 case NET_SAMSYNC_MODE_DUMP:
 256                         action = "Dumping (to stdout)";
 257                         break;
 258                 case NET_SAMSYNC_MODE_FETCH_PASSDB:
 259                         action = "Fetching (to passdb)";
 260                         break;
 261                 case NET_SAMSYNC_MODE_FETCH_LDIF:
 262                         action = "Fetching (to ldif)";
 263                         break;
 264                 default:
 265                         action = "Unknown";
 266                         break;
 267         }
 268
 269         return talloc_asprintf(mem_ctx, "%s %s database",
 270                                 action, samsync_database_str(database_id));
 271 }
 272
 273 /**
 274  * samsync_process_database
 275  */
 276
 277 NTSTATUS samsync_process_database(struct rpc_pipe_client *pipe_hnd,
 278                                   enum netr_SamDatabaseID database_id,
 279                                   samsync_fn_t callback_fn,
 280                                   struct samsync_context *ctx)
 281 {
 282         NTSTATUS result;
 283         TALLOC_CTX *mem_ctx;
 284         const char *logon_server = pipe_hnd->desthost;
 285         const char *computername = global_myname();
 286         struct netr_Authenticator credential;
 287         struct netr_Authenticator return_authenticator;
 288         uint16_t restart_state = 0;
 289         uint32_t sync_context = 0;
 290         const char *debug_str;
 291         DATA_BLOB session_key;
 292
 293         ZERO_STRUCT(return_authenticator);
 294
 295         if (!(mem_ctx = talloc_init("samsync_process_database"))) {
 296                 return NT_STATUS_NO_MEMORY;
 297         }
 298
 299         debug_str = samsync_debug_str(mem_ctx, ctx->mode, database_id);
 300         if (debug_str) {
 301                 d_fprintf(stderr, "%s\n", debug_str);
 302         }
 303
 304         do {
 305                 struct netr_DELTA_ENUM_ARRAY *delta_enum_array = NULL;
 306                 NTSTATUS callback_status;
 307
 308                 netlogon_creds_client_step(pipe_hnd->dc, &credential);
 309
 310                 result = rpccli_netr_DatabaseSync2(pipe_hnd, mem_ctx,
 311                                                    logon_server,
 312                                                    computername,
 313                                                    &credential,
 314                                                    &return_authenticator,
 315                                                    database_id,
 316                                                    restart_state,
 317                                                    &sync_context,
 318                                                    &delta_enum_array,
 319                                                    0xffff);
 320                 if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) {
 321                         return result;
 322                 }
 323
 324                 /* Check returned credentials. */
 325                 if (!netlogon_creds_client_check(pipe_hnd->dc,
 326                                                  &return_authenticator.cred)) {
 327                         DEBUG(0,("credentials chain check failed\n"));
 328                         return NT_STATUS_ACCESS_DENIED;
 329                 }
 330
 331                 if (NT_STATUS_IS_ERR(result)) {
 332                         break;
 333                 }
 334
 335                 session_key = data_blob_const(pipe_hnd->dc->sess_key, 16);
 336
 337                 samsync_fix_delta_array(mem_ctx,
 338                                         &session_key,
 339                                         false,
 340                                         database_id,
 341                                         delta_enum_array);
 342
 343                 /* Process results */
 344                 callback_status = callback_fn(mem_ctx, database_id, delta_enum_array, result, ctx);
 345                 if (!NT_STATUS_IS_OK(callback_status)) {
 346                         result = callback_status;
 347                         goto out;
 348                 }
 349
 350                 TALLOC_FREE(delta_enum_array);
 351
 352                 /* Increment sync_context */
 353                 sync_context += 1;
 354
 355         } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
 356
 357  out:
 358         if (NT_STATUS_IS_ERR(result) && !ctx->error_message) {
 359
 360                 ctx->error_message = talloc_asprintf(ctx,
 361                         "Failed to fetch %s database: %s",
 362                         samsync_database_str(database_id),
 363                         nt_errstr(result));
 364
 365                 if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) {
 366
 367                         ctx->error_message =
 368                                 talloc_asprintf_append(ctx->error_message,
 369                                         "\nPerhaps %s is a Windows native mode domain?",
 370                                         ctx->domain_name);
 371                 }
 372         }
 373
 374         talloc_destroy(mem_ctx);
 375
 376         return result;
 377 }
 378
 379 /**
 380  * pull_netr_AcctLockStr
 381  */
 382
 383 NTSTATUS pull_netr_AcctLockStr(TALLOC_CTX *mem_ctx,
 384                                struct lsa_BinaryString *r,
 385                                struct netr_AcctLockStr **str_p)
 386 {
 387         struct netr_AcctLockStr *str;
 388         enum ndr_err_code ndr_err;
 389         DATA_BLOB blob;
 390
 391         if (!mem_ctx || !r || !str_p) {
 392                 return NT_STATUS_INVALID_PARAMETER;
 393         }
 394
 395         *str_p = NULL;
 396
 397         str = TALLOC_ZERO_P(mem_ctx, struct netr_AcctLockStr);
 398         if (!str) {
 399                 return NT_STATUS_NO_MEMORY;
 400         }
 401
 402         blob = data_blob_const(r->array, r->length);
 403
 404         ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, str,
 405                        (ndr_pull_flags_fn_t)ndr_pull_netr_AcctLockStr);
 406
 407         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 408                 return ndr_map_error2ntstatus(ndr_err);
 409         }
 410
 411         *str_p = str;
 412
 413         return NT_STATUS_OK;
 414 }
 415