Makefile: Added nterr.c into the mix.

clientgen.c: Added nt_error as an entry in the struct client_state.
password.c: Open the netlogon pipe.
smb.h: Added nt_error as an entry in the struct client_state.
lib/rpc/parse/parse_net.c: Added comments on net logon.
lib/rpc/server/srv_netlog.c: Added comments on net logon.
Jeremy.
(This used to be commit 899a9f0dce50c73e03c8da2ebe920957491c8ad7)

diff --git a/source3/include/proto.h b/source3/include/proto.h
index adf753ccf5dc55ef6b2b210e3b23423814d18e80..70f61781eac1fb580628b0cc101022f3c3e55e18 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1492,6 +1492,10 @@ BOOL nmb_name_equal(struct nmb_name *n1, struct nmb_name *n2);
 BOOL send_packet(struct packet_struct *p);
 struct packet_struct *receive_packet(int fd,enum packet_type type,int t);
 
+/*The following definitions come from  nterr.c  */
+
+char *get_nt_error_msg(uint32 nt_code);
+
 /*The following definitions come from  params.c  */
 
 BOOL pm_process( char *FileName,

diff --git a/source3/include/smb.h b/source3/include/smb.h
index 4438024dbd961676f26c155895a5f68319df25ae..8d5cc205827c5d3c3d4e5aa25126f4302ec03ed1 100644 (file)
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -298,7 +298,8 @@ struct cli_state {
        int uid;
        int protocol;
        int sec_mode;
-       int error;
+       int rap_error;
+        uint32 nt_error;
        int privilages;
        fstring eff_name;
        fstring desthost;

diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c
index 9de6afcceef7f76440d33bae44bd658b2f8ede4c..f23c846cf947d908634905e2c29b0ccfedbbefd5 100644 (file)
--- a/source3/libsmb/clientgen.c
+++ b/source3/libsmb/clientgen.c
@@ -71,19 +71,39 @@ char *cli_errstr(struct cli_state *cli)
   int i;      
       
   /*  
-   * Errors are of two kinds - smb errors,
-   * dealt with by cli_smb_errstr, and rap
-   * errors, whose error code is in cli.error.
+   * Errors are of three kinds - smb errors,
+   * dealt with by cli_smb_errstr, NT errors,
+   * whose code is in cli.nt_error, and rap
+   * errors, whose error code is in cli.rap_error.
    */ 
 
   cli_error(cli, &errclass, &errnum);
   if(errclass != 0)
     return cli_smb_errstr(cli);
-    
-  sprintf(error_message, "code %d", cli->error);
+
+  /*
+   * Was it an NT error ?
+   */
+
+  if(cli->nt_error) {
+    char *nt_msg = get_nt_error_msg(cli->nt_error);
+
+    if(nt_msg == NULL)
+      sprintf(error_message, "NT code %d", cli->nt_error);
+    else
+      fstrcpy(error_message, nt_msg);
+
+    return error_message;
+  }
+
+  /*
+   * Must have been a rap error.
+   */
+
+  sprintf(error_message, "code %d", cli->rap_error);
     
   for(i = 0; rap_errmap[i].message != NULL; i++) {
-    if (rap_errmap[i].err == cli->error) {
+    if (rap_errmap[i].err == cli->rap_error) {
       fstrcpy( error_message, rap_errmap[i].message);
       break;
     }
@@ -97,6 +117,8 @@ setup basics in a outgoing packet
 ****************************************************************************/
 static void cli_setup_packet(struct cli_state *cli)
 {
+        cli->rap_error = 0;
+        cli->nt_error = 0;
        SSVAL(cli->outbuf,smb_pid,cli->pid);
        SSVAL(cli->outbuf,smb_uid,cli->uid);
        SSVAL(cli->outbuf,smb_mid,cli->mid);
@@ -382,29 +404,27 @@ BOOL cli_NetWkstaUserLogon(struct cli_state *cli,char *user, char *workstation)
        SSVAL(p, 0, BUFFER_SIZE);
        p += 2;
        
-       cli->error = -1;
-       
        if (cli_api(cli, 
                     param, PTR_DIFF(p,param),1024,  /* param, length, max */
                     NULL, 0, BUFFER_SIZE,           /* data, length, max */
                     &rparam, &rprcnt,               /* return params, return size */
                     &rdata, &rdrcnt                 /* return data, return size */
                    )) {
-               cli->error = SVAL(rparam,0);
+               cli->rap_error = SVAL(rparam,0);
                p = rdata;
                
-               if (cli->error == 0) {
+               if (cli->rap_error == 0) {
                        DEBUG(4,("NetWkstaUserLogon success\n"));
                        cli->privilages = SVAL(p, 24);
                        fstrcpy(cli->eff_name,p+2);
                } else {
-                       DEBUG(1,("NetwkstaUserLogon gave error %d\n", cli->error));
+                       DEBUG(1,("NetwkstaUserLogon gave error %d\n", cli->rap_error));
                }
        }
        
        if (rparam) free(rparam);
        if (rdata) free(rdata);
-       return cli->error == 0;
+       return (cli->rap_error == 0);
 }
 
 
@@ -1357,8 +1377,6 @@ BOOL cli_oem_change_password(struct cli_state *cli, char *user, char *new_passwo
   char *rdata = NULL;
   int rprcnt, rdrcnt;
 
-  cli->error = -1;
-
   if(strlen(user) >= sizeof(fstring)-1) {
     DEBUG(0,("cli_oem_change_password: user name %s is too long.\n", user));
     return False;
@@ -1432,7 +1450,7 @@ BOOL cli_oem_change_password(struct cli_state *cli, char *user, char *new_passwo
                        &rparam, &rprcnt,
                        &rdata, &rdrcnt)) {
     if(rparam)
-      cli->error = SVAL(rparam,0);
+      cli->rap_error = SVAL(rparam,0);
   }
 
   if (rparam)
@@ -1440,7 +1458,7 @@ BOOL cli_oem_change_password(struct cli_state *cli, char *user, char *new_passwo
   if (rdata)
     free(rdata);
 
-  return (cli->error == 0);
+  return (cli->rap_error == 0);
 }
 
 /****************************************************************************
@@ -1561,7 +1579,8 @@ BOOL cli_session_request(struct cli_state *cli, char *host, int name_type,
                return False;
 
        if (CVAL(cli->inbuf,0) != 0x82) {
-               cli->error = CVAL(cli->inbuf,0);
+                /* This is the wrong place to put the error... JRA. */
+               cli->rap_error = CVAL(cli->inbuf,0);
                return False;
        }
        return(True);

diff --git a/source3/rpc_parse/parse_net.c b/source3/rpc_parse/parse_net.c
index 529cd37105702221b84de161eba40f448768df0b..c5dd23a00eda0c6a826f755fa4a04d16561f58ac 100644 (file)
--- a/source3/rpc_parse/parse_net.c
+++ b/source3/rpc_parse/parse_net.c
@@ -569,7 +569,17 @@ static int make_dom_sid2s(char *sids_str, DOM_SID2 *sids, int max_sids)
 
 /*******************************************************************
 makes a NET_ID_INFO_1 structure.
+
+This is an interactive logon packet. The log_id parameters
+are what an NT server would generate for LUID once the
+user is logged on. I don't think we care about them.
+
+Note that this passes the actual NT and LM hashed passwords
+over the secure channel. This is not the preferred logon 
+method from a Samba domain client as it exposes the password
+hashes to anyone who has compromised the secure channel. JRA.
 ********************************************************************/
+
 void make_id_info1(NET_ID_INFO_1 *id, char *domain_name,
                                uint32 param_ctrl, uint32 log_id_low, uint32 log_id_high,
                                char *user_name, char *wksta_name,
@@ -671,7 +681,19 @@ void net_io_id_info1(char *desc,  NET_ID_INFO_1 *id, prs_struct *ps, int depth)
 
 /*******************************************************************
 makes a NET_ID_INFO_2 structure.
+
+This is a network logon packet. The log_id parameters
+are what an NT server would generate for LUID once the
+user is logged on. I don't think we care about them.
+
+Note that this has no access to the NT and LM hashed passwords,
+so it forwards the challenge, and the NT and LM responses (24
+bytes each) over the secure channel to the Domain controller
+for it to say yea or nay. This is the preferred method of 
+checking for a logon as it doesn't export the password
+hashes to anyone who has compromised the secure channel. JRA.
 ********************************************************************/
+
 void make_id_info2(NET_ID_INFO_2 *id, char *domain_name,
                                uint32 param_ctrl, uint32 log_id_low, uint32 log_id_high,
                                char *user_name, char *wksta_name,

diff --git a/source3/rpc_server/srv_netlog.c b/source3/rpc_server/srv_netlog.c
index 83e590a14b10c9164c93033b3c1ff5eb4b6fff11..eb4dfb4a264314d43ee714cdc222ae80a698e895 100644 (file)
--- a/source3/rpc_server/srv_netlog.c
+++ b/source3/rpc_server/srv_netlog.c
@@ -647,7 +647,7 @@ static void api_net_sam_logon( int uid,
                {
                        case 1:
                        {
-                               /* interactive login.  passwords arcfour'd with session key */
+                               /* interactive login. */
                                status = net_login_interactive(&q_l.sam_id.ctr->auth.id1,
                                                               smb_pass, vuser);
                                break;

diff --git a/source3/smbd/password.c b/source3/smbd/password.c
index d627edf1cd1e1b987e473518f9257756dac1d798..11ffe4afd103be48f03ba80b8db0c1fcef40308b 100644 (file)
--- a/source3/smbd/password.c
+++ b/source3/smbd/password.c
@@ -1886,6 +1886,7 @@ BOOL domain_client_validate( char *user, char *domain,
   struct in_addr dest_ip;
   struct cli_state cli;
   BOOL connected_ok = False;
+  int fnum;
 
   /* 
    * Check that the requested domain is not our own machine name.
@@ -2037,6 +2038,18 @@ Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
    * Now start the NT Domain stuff :-).
    */
 
+  /*
+   * First, open the pipe to \PIPE\NETLOGON.
+   */
+
+  if((fnum = cli_open(&cli, PIPE_NETLOGON, O_CREAT, DENY_NONE)) == -1) {
+    DEBUG(0,("domain_client_validate: cli_open on %s on machine %s failed. Error was :%s.\n",
+           PIPE_NETLOGON, remote_machine, cli_errstr(&cli)));
+    cli_ulogoff(&cli);
+    cli_shutdown(&cli);
+    return False;
+  }
+
   return False;
 }
 #endif /* DOMAIN_CLIENT */