2 Unix SMB/CIFS implementation.
4 CLDAP server - netlogon handling
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/ldb/include/ldb.h"
25 #include "lib/ldb/include/ldb_errors.h"
26 #include "lib/events/events.h"
27 #include "lib/socket/socket.h"
28 #include "smbd/service_task.h"
29 #include "cldap_server/cldap_server.h"
30 #include "librpc/gen_ndr/ndr_misc.h"
31 #include "libcli/ldap/ldap_ndr.h"
32 #include "libcli/security/security.h"
33 #include "dsdb/samdb/samdb.h"
34 #include "auth/auth.h"
36 #include "system/network.h"
37 #include "lib/socket/netif.h"
38 #include "param/param.h"
40 fill in the cldap netlogon union for a given version
42 NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
45 const char *netbios_domain,
46 struct dom_sid *domain_sid,
47 const char *domain_guid,
49 uint32_t acct_control,
50 const char *src_address,
52 struct loadparm_context *lp_ctx,
53 struct netlogon_samlogon_response *netlogon)
55 const char *ref_attrs[] = {"nETBIOSName", "dnsRoot", "ncName", NULL};
56 const char *dom_attrs[] = {"objectGUID", NULL};
57 const char *none_attrs[] = {NULL};
58 struct ldb_result *ref_res = NULL, *dom_res = NULL, *user_res = NULL;
60 const char **services = lp_server_services(lp_ctx);
63 struct GUID domain_uuid;
65 const char *dns_domain;
66 const char *pdc_dns_name;
68 const char *server_site;
69 const char *client_site;
71 struct ldb_dn *partitions_basedn;
72 struct interface *ifaces;
75 partitions_basedn = samdb_partitions_dn(sam_ctx, mem_ctx);
77 /* the domain has an optional trailing . */
78 if (domain && domain[strlen(domain)-1] == '.') {
79 domain = talloc_strndup(mem_ctx, domain, strlen(domain)-1);
83 struct ldb_dn *dom_dn;
84 /* try and find the domain */
86 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &ref_res,
87 partitions_basedn, LDB_SCOPE_ONELEVEL,
89 "(&(&(objectClass=crossRef)(dnsRoot=%s))(nETBIOSName=*))",
92 if (ret != LDB_SUCCESS) {
93 DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
95 ldb_errstring(sam_ctx)));
96 return NT_STATUS_NO_SUCH_DOMAIN;
97 } else if (ref_res->count == 1) {
98 talloc_steal(mem_ctx, dom_res);
99 dom_dn = ldb_msg_find_attr_as_dn(sam_ctx, mem_ctx, ref_res->msgs[0], "ncName");
101 return NT_STATUS_NO_SUCH_DOMAIN;
103 ret = ldb_search(sam_ctx, dom_dn,
104 LDB_SCOPE_BASE, "objectClass=domain",
105 dom_attrs, &dom_res);
106 if (ret != LDB_SUCCESS) {
107 DEBUG(2,("Error finding domain '%s'/'%s' in sam: %s\n", domain, ldb_dn_get_linearized(dom_dn), ldb_errstring(sam_ctx)));
108 return NT_STATUS_NO_SUCH_DOMAIN;
110 talloc_steal(mem_ctx, dom_res);
111 if (dom_res->count != 1) {
112 DEBUG(2,("Error finding domain '%s'/'%s' in sam\n", domain, ldb_dn_get_linearized(dom_dn)));
113 return NT_STATUS_NO_SUCH_DOMAIN;
115 } else if (ref_res->count > 1) {
116 talloc_free(ref_res);
117 return NT_STATUS_NO_SUCH_DOMAIN;
121 if (netbios_domain) {
122 struct ldb_dn *dom_dn;
123 /* try and find the domain */
125 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &ref_res,
126 partitions_basedn, LDB_SCOPE_ONELEVEL,
128 "(&(objectClass=crossRef)(ncName=*)(nETBIOSName=%s))",
131 if (ret != LDB_SUCCESS) {
132 DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
134 ldb_errstring(sam_ctx)));
135 return NT_STATUS_NO_SUCH_DOMAIN;
136 } else if (ref_res->count == 1) {
137 talloc_steal(mem_ctx, dom_res);
138 dom_dn = ldb_msg_find_attr_as_dn(sam_ctx, mem_ctx, ref_res->msgs[0], "ncName");
140 return NT_STATUS_NO_SUCH_DOMAIN;
142 ret = ldb_search(sam_ctx, dom_dn,
143 LDB_SCOPE_BASE, "objectClass=domain",
144 dom_attrs, &dom_res);
145 if (ret != LDB_SUCCESS) {
146 DEBUG(2,("Error finding domain '%s'/'%s' in sam: %s\n", domain, ldb_dn_get_linearized(dom_dn), ldb_errstring(sam_ctx)));
147 return NT_STATUS_NO_SUCH_DOMAIN;
149 talloc_steal(mem_ctx, dom_res);
150 if (dom_res->count != 1) {
151 DEBUG(2,("Error finding domain '%s'/'%s' in sam\n", domain, ldb_dn_get_linearized(dom_dn)));
152 return NT_STATUS_NO_SUCH_DOMAIN;
154 } else if (ref_res->count > 1) {
155 talloc_free(ref_res);
156 return NT_STATUS_NO_SUCH_DOMAIN;
160 if ((dom_res == NULL || dom_res->count == 0) && (domain_guid || domain_sid)) {
164 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &dom_res,
165 NULL, LDB_SCOPE_SUBTREE,
167 "(&(objectClass=domainDNS)(objectGUID=%s))",
169 } else { /* domain_sid case */
170 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &dom_res,
171 NULL, LDB_SCOPE_SUBTREE,
173 "(&(objectClass=domainDNS)(objectSID=%s))",
174 dom_sid_string(mem_ctx, domain_sid));
177 if (ret != LDB_SUCCESS) {
178 DEBUG(2,("Unable to find referece to GUID '%s' or SID %s in sam: %s\n",
179 domain_guid, dom_sid_string(mem_ctx, domain_sid),
180 ldb_errstring(sam_ctx)));
181 return NT_STATUS_NO_SUCH_DOMAIN;
182 } else if (dom_res->count == 1) {
183 /* try and find the domain */
184 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &ref_res,
185 partitions_basedn, LDB_SCOPE_ONELEVEL,
187 "(&(objectClass=crossRef)(ncName=%s))",
188 ldb_dn_get_linearized(dom_res->msgs[0]->dn));
190 if (ret != LDB_SUCCESS) {
191 DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
192 ldb_dn_get_linearized(dom_res->msgs[0]->dn),
193 ldb_errstring(sam_ctx)));
194 return NT_STATUS_NO_SUCH_DOMAIN;
196 } else if (ref_res->count != 1) {
197 DEBUG(2,("Unable to find referece to '%s' in sam\n",
198 ldb_dn_get_linearized(dom_res->msgs[0]->dn)));
199 return NT_STATUS_NO_SUCH_DOMAIN;
201 } else if (dom_res->count > 1) {
202 talloc_free(ref_res);
203 return NT_STATUS_NO_SUCH_DOMAIN;
208 if ((ref_res == NULL || ref_res->count == 0)) {
209 DEBUG(2,("Unable to find domain reference with name %s or GUID {%s}\n", domain, domain_guid));
210 return NT_STATUS_NO_SUCH_DOMAIN;
213 if ((dom_res == NULL || dom_res->count == 0)) {
214 DEBUG(2,("Unable to find domain with name %s or GUID {%s}\n", domain, domain_guid));
215 return NT_STATUS_NO_SUCH_DOMAIN;
218 /* work around different inputs for not-specified users */
223 /* Enquire about any valid username with just a CLDAP packet -
224 * if kerberos didn't also do this, the security folks would
227 /* Only allow some bits to be enquired: [MS-ATDS] 7.3.3.2 */
228 if (acct_control == (uint32_t)-1) {
231 acct_control = acct_control & (ACB_TEMPDUP | ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST);
233 /* We must exclude disabled accounts, but otherwise do the bitwise match the client asked for */
234 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &user_res,
235 dom_res->msgs[0]->dn, LDB_SCOPE_SUBTREE,
237 "(&(objectClass=user)(samAccountName=%s)"
238 "(!(userAccountControl:" LDB_OID_COMPARATOR_AND ":=%u))"
239 "(userAccountControl:" LDB_OID_COMPARATOR_OR ":=%u))",
240 user, UF_ACCOUNTDISABLE, samdb_acb2uf(acct_control));
241 if (ret != LDB_SUCCESS) {
242 DEBUG(2,("Unable to find referece to user '%s' with ACB 0x%8x under %s: %s\n",
243 user, acct_control, ldb_dn_get_linearized(dom_res->msgs[0]->dn),
244 ldb_errstring(sam_ctx)));
245 return NT_STATUS_NO_SUCH_USER;
246 } else if (user_res->count == 1) {
257 NBT_SERVER_DS | NBT_SERVER_TIMESERV |
258 NBT_SERVER_CLOSEST | NBT_SERVER_WRITABLE |
259 NBT_SERVER_GOOD_TIMESERV;
261 if (samdb_is_pdc(sam_ctx)) {
262 server_type |= NBT_SERVER_PDC;
265 if (samdb_is_gc(sam_ctx)) {
266 server_type |= NBT_SERVER_GC;
269 if (str_list_check(services, "ldap")) {
270 server_type |= NBT_SERVER_LDAP;
273 if (str_list_check(services, "kdc")) {
274 server_type |= NBT_SERVER_KDC;
277 pdc_name = talloc_asprintf(mem_ctx, "\\\\%s", lp_netbios_name(lp_ctx));
278 domain_uuid = samdb_result_guid(dom_res->msgs[0], "objectGUID");
279 realm = samdb_result_string(ref_res->msgs[0], "dnsRoot", lp_realm(lp_ctx));
280 dns_domain = samdb_result_string(ref_res->msgs[0], "dnsRoot", lp_realm(lp_ctx));
281 pdc_dns_name = talloc_asprintf(mem_ctx, "%s.%s",
282 strlower_talloc(mem_ctx,
283 lp_netbios_name(lp_ctx)),
286 flatname = samdb_result_string(ref_res->msgs[0], "nETBIOSName",
287 lp_workgroup(lp_ctx));
288 server_site = "Default-First-Site-Name";
289 client_site = "Default-First-Site-Name";
290 load_interfaces(mem_ctx, lp_interfaces(lp_ctx), &ifaces);
291 pdc_ip = iface_best_ip(ifaces, src_address);
293 ZERO_STRUCTP(netlogon);
295 /* check if either of these bits is present */
296 if (version & (NETLOGON_NT_VERSION_5EX|NETLOGON_NT_VERSION_5EX_WITH_IP)) {
297 uint32_t extra_flags = 0;
298 netlogon->ntver = NETLOGON_NT_VERSION_5EX;
300 /* could check if the user exists */
302 netlogon->nt5_ex.command = LOGON_SAM_LOGON_RESPONSE_EX;
304 netlogon->nt5_ex.command = LOGON_SAM_LOGON_USER_UNKNOWN_EX;
306 netlogon->nt5_ex.server_type = server_type;
307 netlogon->nt5_ex.domain_uuid = domain_uuid;
308 netlogon->nt5_ex.forest = realm;
309 netlogon->nt5_ex.dns_domain = dns_domain;
310 netlogon->nt5_ex.pdc_dns_name = pdc_dns_name;
311 netlogon->nt5_ex.domain = flatname;
312 netlogon->nt5_ex.pdc_name = lp_netbios_name(lp_ctx);
313 netlogon->nt5_ex.user_name = user;
314 netlogon->nt5_ex.server_site = server_site;
315 netlogon->nt5_ex.client_site = client_site;
317 if (version & NETLOGON_NT_VERSION_5EX_WITH_IP) {
318 /* Clearly this needs to be fixed up for IPv6 */
319 extra_flags = NETLOGON_NT_VERSION_5EX_WITH_IP;
320 netlogon->nt5_ex.sockaddr.sa_family = 2;
321 netlogon->nt5_ex.sockaddr.pdc_ip = pdc_ip;
322 netlogon->nt5_ex.sockaddr.remaining = data_blob_talloc_zero(mem_ctx, 8);
324 netlogon->nt5_ex.nt_version = NETLOGON_NT_VERSION_1|NETLOGON_NT_VERSION_5EX|extra_flags;
325 netlogon->nt5_ex.lmnt_token = 0xFFFF;
326 netlogon->nt5_ex.lm20_token = 0xFFFF;
328 } else if (version & NETLOGON_NT_VERSION_5) {
329 netlogon->ntver = NETLOGON_NT_VERSION_5;
331 /* could check if the user exists */
333 netlogon->nt5.command = LOGON_SAM_LOGON_RESPONSE;
335 netlogon->nt5.command = LOGON_SAM_LOGON_USER_UNKNOWN;
337 netlogon->nt5.pdc_name = pdc_name;
338 netlogon->nt5.user_name = user;
339 netlogon->nt5.domain_name = flatname;
340 netlogon->nt5.domain_uuid = domain_uuid;
341 netlogon->nt5.forest = realm;
342 netlogon->nt5.dns_domain = dns_domain;
343 netlogon->nt5.pdc_dns_name = pdc_dns_name;
344 netlogon->nt5.pdc_ip = pdc_ip;
345 netlogon->nt5.server_type = server_type;
346 netlogon->nt5.nt_version = NETLOGON_NT_VERSION_1|NETLOGON_NT_VERSION_5;
347 netlogon->nt5.lmnt_token = 0xFFFF;
348 netlogon->nt5.lm20_token = 0xFFFF;
350 } else /* (version & NETLOGON_NT_VERSION_1) and all other cases */ {
351 netlogon->ntver = NETLOGON_NT_VERSION_1;
352 /* could check if the user exists */
354 netlogon->nt4.command = LOGON_SAM_LOGON_RESPONSE;
356 netlogon->nt4.command = LOGON_SAM_LOGON_USER_UNKNOWN;
358 netlogon->nt4.server = pdc_name;
359 netlogon->nt4.user_name = user;
360 netlogon->nt4.domain = flatname;
361 netlogon->nt4.nt_version = NETLOGON_NT_VERSION_1;
362 netlogon->nt4.lmnt_token = 0xFFFF;
363 netlogon->nt4.lm20_token = 0xFFFF;
371 handle incoming cldap requests
373 void cldapd_netlogon_request(struct cldap_socket *cldap,
375 struct ldb_parse_tree *tree,
376 struct socket_address *src)
378 struct cldapd_server *cldapd = talloc_get_type(cldap->incoming.private, struct cldapd_server);
380 const char *domain = NULL;
381 const char *host = NULL;
382 const char *user = NULL;
383 const char *domain_guid = NULL;
384 const char *domain_sid = NULL;
385 int acct_control = -1;
387 struct netlogon_samlogon_response netlogon;
388 NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
390 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
392 if (tree->operation != LDB_OP_AND) goto failed;
394 /* extract the query elements */
395 for (i=0;i<tree->u.list.num_elements;i++) {
396 struct ldb_parse_tree *t = tree->u.list.elements[i];
397 if (t->operation != LDB_OP_EQUALITY) goto failed;
398 if (strcasecmp(t->u.equality.attr, "DnsDomain") == 0) {
399 domain = talloc_strndup(tmp_ctx,
400 (const char *)t->u.equality.value.data,
401 t->u.equality.value.length);
403 if (strcasecmp(t->u.equality.attr, "Host") == 0) {
404 host = talloc_strndup(tmp_ctx,
405 (const char *)t->u.equality.value.data,
406 t->u.equality.value.length);
408 if (strcasecmp(t->u.equality.attr, "DomainGuid") == 0) {
411 enc_status = ldap_decode_ndr_GUID(tmp_ctx,
412 t->u.equality.value, &guid);
413 if (NT_STATUS_IS_OK(enc_status)) {
414 domain_guid = GUID_string(tmp_ctx, &guid);
417 if (strcasecmp(t->u.equality.attr, "DomainSid") == 0) {
418 domain_sid = talloc_strndup(tmp_ctx,
419 (const char *)t->u.equality.value.data,
420 t->u.equality.value.length);
422 if (strcasecmp(t->u.equality.attr, "User") == 0) {
423 user = talloc_strndup(tmp_ctx,
424 (const char *)t->u.equality.value.data,
425 t->u.equality.value.length);
427 if (strcasecmp(t->u.equality.attr, "NtVer") == 0 &&
428 t->u.equality.value.length == 4) {
429 version = IVAL(t->u.equality.value.data, 0);
431 if (strcasecmp(t->u.equality.attr, "AAC") == 0 &&
432 t->u.equality.value.length == 4) {
433 acct_control = IVAL(t->u.equality.value.data, 0);
437 if (domain_guid == NULL && domain == NULL) {
438 domain = lp_realm(cldapd->task->lp_ctx);
445 DEBUG(5,("cldap netlogon query domain=%s host=%s user=%s version=%d guid=%s\n",
446 domain, host, user, version, domain_guid));
448 status = fill_netlogon_samlogon_response(cldapd->samctx, tmp_ctx, domain, NULL, NULL, domain_guid,
449 user, acct_control, src->addr,
450 version, cldapd->task->lp_ctx, &netlogon);
451 if (!NT_STATUS_IS_OK(status)) {
455 status = cldap_netlogon_reply(cldap, message_id, src, version,
457 if (!NT_STATUS_IS_OK(status)) {
461 talloc_free(tmp_ctx);
465 DEBUG(2,("cldap netlogon query failed domain=%s host=%s version=%d - %s\n",
466 domain, host, version, nt_errstr(status)));
467 talloc_free(tmp_ctx);
468 cldap_empty_reply(cldap, message_id, src);