librpc idl: netlogon netr_identity_info logon_id to 64 bit

Fold the two 32 bit values logon_id_high and logon_id_low into a single
64 bit logon_id in netr_identity_info.  This will be used to tie
together winbind and SamLogon requests in audit logging.

Summary of the of the Query and Response from Microsoft on it's usage.

[REG:119013019612095] [MS-NRPC]: NETLOGON_LOGON_IDENTITY_INFO: Does
the Reserved field have LogonId meaning?

Questions:
  In NetrLogonSamLogonEx does the Reserved field
  (of NETLOGON_LOGON_IDENTITY_INFO) have LogonId meaning?

  What is a valid LogonID, and does have any audit usage?

  Samba is sending a constant "deadbeef" in hex and would like to
  understand any usage of this field.

Response:
  The NRPC spec is accurate in defining the field as Reserved, and without
  protocol significance. In the header file in our source code, it is
  defined as LogonId and commented as such, but it’s effectively not used.
  This is probably why the API structure has that field name. It may have
  been intended as such but it’s not used.

Samba will send a random value in this field.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl
index 22f86b9207668a5e505ba8ee13bddb410a5f0116..b4474f7ec496dd1d5b221e79a00ba6bd54de7802 100644 (file)
--- a/librpc/idl/netlogon.idl
+++ b/librpc/idl/netlogon.idl
@@ -133,11 +133,35 @@ interface netlogon
                MSV1_0_SUBAUTHENTICATION_DLL_EX         = 0x00100000
        } netr_LogonParameterControl;
 
+       /* Summary of the of the Query and Response from Microsoft on
+        * the usage of logon_id in netr_IdendityInfo
+        *
+        * [REG:119013019612095] [MS-NRPC]: NETLOGON_LOGON_IDENTITY_INFO: Does
+        * the Reserved field have LogonId meaning?
+        *
+        * Questions:
+        *   In NetrLogonSamLogonEx does the Reserved field
+        *   (of NETLOGON_LOGON_IDENTITY_INFO) have LogonId meaning?
+        *
+        *   What is a valid LogonID, and does have any audit usage?
+        *
+        *   Samba is sending a constant "deadbeef" in hex and would like to
+        *   understand any usage of this field.
+        *
+        * Response:
+        *   The NRPC spec is accurate in defining the field as Reserved, and
+        *   without protocol significance. In the header file in our source
+        *   code, it is defined as LogonId and commented as such, but it’s
+        *   effectively not used. This is probably why the API structure has
+        *   that field name. It may have been intended as such but it’s not
+        *    used.
+        *
+        * Samba now sends a random value in this field.
+        */
        typedef struct {
                lsa_String  domain_name;
                netr_LogonParameterControl parameter_control; /* see MSV1_0_* */
-               uint32      logon_id_low;
-               uint32      logon_id_high;
+               udlong logon_id;
                lsa_String  account_name;
                lsa_String  workstation;
        } netr_IdentityInfo;

diff --git a/source3/rpc_client/cli_netlogon.c b/source3/rpc_client/cli_netlogon.c
index 2aa0f5e7b1c2bc125e1d6b62a6626488921c206a..c7cc183dd16ba76e0a098c288b302285c9aa1436 100644 (file)
--- a/source3/rpc_client/cli_netlogon.c
+++ b/source3/rpc_client/cli_netlogon.c
@@ -508,8 +508,7 @@ NTSTATUS rpccli_netlogon_password_logon(
 
                password_info->identity_info.domain_name.string         = domain;
                password_info->identity_info.parameter_control          = logon_parameters;
-               password_info->identity_info.logon_id_low               = 0xdead;
-               password_info->identity_info.logon_id_high              = 0xbeef;
+               password_info->identity_info.logon_id                   = 0xbeef0000dead;
                password_info->identity_info.account_name.string        = username;
                password_info->identity_info.workstation.string         = workstation_slash;
 
@@ -551,8 +550,7 @@ NTSTATUS rpccli_netlogon_password_logon(
 
                network_info->identity_info.domain_name.string          = domain;
                network_info->identity_info.parameter_control           = logon_parameters;
-               network_info->identity_info.logon_id_low                = 0xdead;
-               network_info->identity_info.logon_id_high               = 0xbeef;
+               network_info->identity_info.logon_id                    = 0xbeef0000dead;
                network_info->identity_info.account_name.string         = username;
                network_info->identity_info.workstation.string          = workstation_slash;
 
@@ -670,8 +668,7 @@ NTSTATUS rpccli_netlogon_network_logon(
 
        network_info->identity_info.domain_name.string          = domain;
        network_info->identity_info.parameter_control           = logon_parameters;
-       network_info->identity_info.logon_id_low                = 0xdead;
-       network_info->identity_info.logon_id_high               = 0xbeef;
+       network_info->identity_info.logon_id                    = 0xbeef0000dead;
        network_info->identity_info.account_name.string         = username;
        network_info->identity_info.workstation.string          = workstation_name_slash;
 
@@ -771,8 +768,7 @@ NTSTATUS rpccli_netlogon_interactive_logon(
 
        password_info->identity_info.domain_name.string         = domain;
        password_info->identity_info.parameter_control          = logon_parameters;
-       password_info->identity_info.logon_id_low               = 0xdead;
-       password_info->identity_info.logon_id_high              = 0xbeef;
+       password_info->identity_info.logon_id                   = 0xbeef0000dead;
        password_info->identity_info.account_name.string        = username;
        password_info->identity_info.workstation.string         = workstation_name_slash;
 

diff --git a/source4/auth/ntlm/auth_winbind.c b/source4/auth/ntlm/auth_winbind.c
index 318675fa59b5dad2747f643aaf6b5da479368823..d7c26e7a1a7210f1a4e3d2f4c7af03052fc10264 100644 (file)
--- a/source4/auth/ntlm/auth_winbind.c
+++ b/source4/auth/ntlm/auth_winbind.c
@@ -174,8 +174,7 @@ static struct tevent_req *winbind_check_password_send(TALLOC_CTX *mem_ctx,
 
        identity_info->domain_name.string       = user_info->client.domain_name;
        identity_info->parameter_control        = user_info->logon_parameters; /* see MSV1_0_* */
-       identity_info->logon_id_low             = 0;
-       identity_info->logon_id_high            = 0;
+       identity_info->logon_id                 = 0;
        identity_info->account_name.string      = user_info->client.account_name;
        identity_info->workstation.string       = user_info->workstation_name;
 

diff --git a/source4/kdc/hdb-samba4.c b/source4/kdc/hdb-samba4.c
index cff472574d414b776b26cffc0721e00bc654b4c5..638179e880605b6c672b6efefb5092c7eb975407 100644 (file)
--- a/source4/kdc/hdb-samba4.c
+++ b/source4/kdc/hdb-samba4.c
@@ -361,8 +361,7 @@ static void send_bad_password_netlogon(TALLOC_CTX *mem_ctx,
 
        identity_info->domain_name.string = user_info->mapped.domain_name;
        identity_info->parameter_control = user_info->logon_parameters; /* TODO */
-       identity_info->logon_id_low = 0;
-       identity_info->logon_id_high = 0;
+       identity_info->logon_id = 0;
        identity_info->account_name.string = user_info->mapped.account_name;
        identity_info->workstation.string
                = talloc_asprintf(identity_info, "krb5-bad-pw on RODC from %s",

diff --git a/source4/torture/ndr/netlogon.c b/source4/torture/ndr/netlogon.c
index 2e20ff748b9483405ea61be8cccbbc64bf05cd6f..05a68eb79d291df82f35f58dc11e0b253f2ad6f1 100644 (file)
--- a/source4/torture/ndr/netlogon.c
+++ b/source4/torture/ndr/netlogon.c
@@ -154,8 +154,7 @@ static bool netrlogonsamlogon_w2k_in_check(struct torture_context *tctx,
        torture_assert_int_equal(tctx, r->in.logon->password->identity_info.domain_name.size, 12, "domain_name.size");
        torture_assert_str_equal(tctx, r->in.logon->password->identity_info.domain_name.string, "W2KDOM", "domain_name.string");
        torture_assert_int_equal(tctx, r->in.logon->password->identity_info.parameter_control, 0, "parameter_control");
-       torture_assert_int_equal(tctx, r->in.logon->password->identity_info.logon_id_low, 0xdead, "logon_id_low");
-       torture_assert_int_equal(tctx, r->in.logon->password->identity_info.logon_id_high, 0xbeef, "logon_id_high");
+       torture_assert_u64_equal(tctx, r->in.logon->password->identity_info.logon_id, 0xbeef0000dead, "logon_id");
        torture_assert_int_equal(tctx, r->in.logon->password->identity_info.account_name.length, 26, "account_name.length");
        torture_assert_int_equal(tctx, r->in.logon->password->identity_info.account_name.size, 26, "account_name.size");
        torture_assert_str_equal(tctx, r->in.logon->password->identity_info.account_name.string, "administrator", "account_name.string");

diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c
index 026d86d50e4720fbbf49e436a6e1a819649674a9..52c443e39f3c744369edf83dcd56f04a9c8d6081 100644 (file)
--- a/source4/torture/rpc/netlogon.c
+++ b/source4/torture/rpc/netlogon.c
@@ -988,8 +988,7 @@ static bool test_netlogon_ops_args(struct dcerpc_pipe *p, struct torture_context
        ninfo.nt.length = nt_resp.length;
 
        ninfo.identity_info.parameter_control = 0;
-       ninfo.identity_info.logon_id_low = 0;
-       ninfo.identity_info.logon_id_high = 0;
+       ninfo.identity_info.logon_id = 0;
        ninfo.identity_info.workstation.string = cli_credentials_get_workstation(credentials);
 
        logon.network = &ninfo;

diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
index ab10013356bc0b654a92e97332c23f5c50f7232e..d915427f1b4afc97803baa3f38d0f69fc6b6e25d 100644 (file)
--- a/source4/torture/rpc/remote_pac.c
+++ b/source4/torture/rpc/remote_pac.c
@@ -362,8 +362,7 @@ static bool test_PACVerify(struct torture_context *tctx,
        /* Validate it over the netlogon pipe */
 
        generic.identity_info.parameter_control = 0;
-       generic.identity_info.logon_id_high = 0;
-       generic.identity_info.logon_id_low = 0;
+       generic.identity_info.logon_id = 0;
        generic.identity_info.domain_name.string = session_info->info->domain_name;
        generic.identity_info.account_name.string = session_info->info->account_name;
        generic.identity_info.workstation.string = test_machine_name;
@@ -836,8 +835,7 @@ static bool test_S2U4Self(struct torture_context *tctx,
        ninfo.nt.length = nt_resp.length;
 
        ninfo.identity_info.parameter_control = 0;
-       ninfo.identity_info.logon_id_low = 0;
-       ninfo.identity_info.logon_id_high = 0;
+       ninfo.identity_info.logon_id = 0;
        ninfo.identity_info.workstation.string = cli_credentials_get_workstation(server_creds);
 
        logon.network = &ninfo;

diff --git a/source4/torture/rpc/samba3rpc.c b/source4/torture/rpc/samba3rpc.c
index 9cd479c9baf310c3ff5d63d022dba648c642ef03..9fee3ef68cd63689f9070bd0db1ec618f3682aa4 100644 (file)
--- a/source4/torture/rpc/samba3rpc.c
+++ b/source4/torture/rpc/samba3rpc.c
@@ -1212,8 +1212,7 @@ static bool schan(struct torture_context *tctx,
                ninfo.identity_info.domain_name.string =
                        cli_credentials_get_domain(user_creds);
                ninfo.identity_info.parameter_control = 0;
-               ninfo.identity_info.logon_id_low = 0;
-               ninfo.identity_info.logon_id_high = 0;
+               ninfo.identity_info.logon_id = 0;
                ninfo.identity_info.workstation.string =
                        cli_credentials_get_workstation(user_creds);
                memcpy(ninfo.challenge, chal.data, sizeof(ninfo.challenge));

diff --git a/source4/torture/rpc/samlogon.c b/source4/torture/rpc/samlogon.c
index d5ef47ec1ee750b91f9e119eb0608fb72b42b6b2..7053fc11fa59704e51369bd279ddb2364d3c781a 100644 (file)
--- a/source4/torture/rpc/samlogon.c
+++ b/source4/torture/rpc/samlogon.c
@@ -96,8 +96,7 @@ static NTSTATUS check_samlogon(struct samlogon_state *samlogon_state,
 
        ninfo.identity_info.domain_name.string = samlogon_state->account_domain;
        ninfo.identity_info.parameter_control = parameter_control;
-       ninfo.identity_info.logon_id_low = 0;
-       ninfo.identity_info.logon_id_high = 0;
+       ninfo.identity_info.logon_id = 0;
        ninfo.identity_info.account_name.string = samlogon_state->account_name;
        ninfo.identity_info.workstation.string = TEST_MACHINE_NAME;
 
@@ -1526,8 +1525,7 @@ bool test_InteractiveLogon(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 
        pinfo.identity_info.domain_name.string = account_domain;
        pinfo.identity_info.parameter_control = parameter_control;
-       pinfo.identity_info.logon_id_low = 0;
-       pinfo.identity_info.logon_id_high = 0;
+       pinfo.identity_info.logon_id = 0;
        pinfo.identity_info.account_name.string = account_name;
        pinfo.identity_info.workstation.string = workstation_name;
 

diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
index 92861f4c8aaaba4f17fa4e060619fe25a75db7c9..cb4778ecd79870f74a6a52a6544de25351aa1bd0 100644 (file)
--- a/source4/torture/rpc/samr.c
+++ b/source4/torture/rpc/samr.c
@@ -3058,8 +3058,7 @@ static bool test_SamLogon(struct torture_context *tctx,
        identity.parameter_control =
                MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
                MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
-       identity.logon_id_low = 0;
-       identity.logon_id_high = 0;
+       identity.logon_id = 0;
        identity.workstation.string = cli_credentials_get_workstation(test_credentials);
 
        if (interactive) {

diff --git a/source4/torture/rpc/samsync.c b/source4/torture/rpc/samsync.c
index e71faf899a557e74848d19da470678f8caa17ca8..869d3ba96b64a14d8500a080e296d1a7e46a153a 100644 (file)
--- a/source4/torture/rpc/samsync.c
+++ b/source4/torture/rpc/samsync.c
@@ -64,8 +64,7 @@ static NTSTATUS test_SamLogon(struct torture_context *tctx,
 
        ninfo.identity_info.domain_name.string = domain;
        ninfo.identity_info.parameter_control = 0;
-       ninfo.identity_info.logon_id_low = 0;
-       ninfo.identity_info.logon_id_high = 0;
+       ninfo.identity_info.logon_id = 0;
        ninfo.identity_info.account_name.string = account_name;
        ninfo.identity_info.workstation.string = workstation;
        generate_random_buffer(ninfo.challenge,

diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c
index de3a36eaa4f1ca52074f37578eb060e539fe74b6..5b40af216a549210c576a189728509b66460486e 100644 (file)
--- a/source4/torture/rpc/schannel.c
+++ b/source4/torture/rpc/schannel.c
@@ -105,8 +105,7 @@ bool test_netlogon_ex_ops(struct dcerpc_pipe *p, struct torture_context *tctx,
        ninfo.nt.length = nt_resp.length;
 
        ninfo.identity_info.parameter_control = 0;
-       ninfo.identity_info.logon_id_low = 0;
-       ninfo.identity_info.logon_id_high = 0;
+       ninfo.identity_info.logon_id = 0;
        ninfo.identity_info.workstation.string = cli_credentials_get_workstation(credentials);
 
        logon.network = &ninfo;
@@ -872,8 +871,7 @@ static bool torture_schannel_bench_start(struct torture_schannel_bench_conn *con
        conn->ninfo.nt.length = nt_resp.length;
 
        conn->ninfo.identity_info.parameter_control = 0;
-       conn->ninfo.identity_info.logon_id_low = 0;
-       conn->ninfo.identity_info.logon_id_high = 0;
+       conn->ninfo.identity_info.logon_id = 0;
        conn->ninfo.identity_info.workstation.string = cli_credentials_get_workstation(conn->wks_creds);
 
        conn->r.in.server_name = talloc_asprintf(conn->tmp, "\\\\%s", dcerpc_server_name(conn->pipe));