Convert all uses of uint8/16/32 to _t in nmbd and the include file.
[samba.git] / source3 / nmbd / nmbd_processlogon.c
1 /*
2    Unix SMB/CIFS implementation.
3    NBT netbios routines and daemon - version 2
4    Copyright (C) Andrew Tridgell 1994-1998
5    Copyright (C) Luke Kenneth Casson Leighton 1994-1998
6    Copyright (C) Jeremy Allison 1994-2003
7    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
8
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21
22    Revision History:
23
24 */
25
26 #include "includes.h"
27 #include "../libcli/netlogon/netlogon.h"
28 #include "../libcli/cldap/cldap.h"
29 #include "../lib/tsocket/tsocket.h"
30 #include "../libcli/security/security.h"
31 #include "secrets.h"
32 #include "nmbd/nmbd.h"
33
34 struct sam_database_info {
35         uint32_t index;
36         uint32_t serial_lo, serial_hi;
37         uint32_t date_lo, date_hi;
38 };
39
40 /**
41  * check whether the client belongs to the hosts
42  * for which initial logon should be delayed...
43  */
44 static bool delay_logon(const char *peer_name, const char *peer_addr)
45 {
46         const char **delay_list = lp_init_logon_delayed_hosts();
47         const char *peer[2];
48
49         if (delay_list == NULL) {
50                 return False;
51         }
52
53         peer[0] = peer_name;
54         peer[1] = peer_addr;
55
56         return list_match(delay_list, (const char *)peer, client_match);
57 }
58
59 static void delayed_init_logon_handler(struct tevent_context *event_ctx,
60                                        struct tevent_timer *te,
61                                        struct timeval now,
62                                        void *private_data)
63 {
64         struct packet_struct *p = (struct packet_struct *)private_data;
65
66         DEBUG(10, ("delayed_init_logon_handler (%lx): re-queuing packet.\n",
67                    (unsigned long)te));
68
69         queue_packet(p);
70
71         TALLOC_FREE(te);
72 }
73
74 struct nmbd_proxy_logon_context {
75         struct cldap_socket *cldap_sock;
76 };
77
78 static struct nmbd_proxy_logon_context *global_nmbd_proxy_logon;
79
80 bool initialize_nmbd_proxy_logon(void)
81 {
82         const char *cldap_server = lp_parm_const_string(-1, "nmbd_proxy_logon",
83                                                         "cldap_server", NULL);
84         struct nmbd_proxy_logon_context *ctx;
85         NTSTATUS status;
86         struct in_addr addr;
87         char addrstr[INET_ADDRSTRLEN];
88         const char *server_str;
89         int ret;
90         struct tsocket_address *server_addr;
91
92         if (!cldap_server) {
93                 return true;
94         }
95
96         addr = interpret_addr2(cldap_server);
97         server_str = inet_ntop(AF_INET, &addr,
98                              addrstr, sizeof(addrstr));
99         if (!server_str || strcmp("0.0.0.0", server_str) == 0) {
100                 DEBUG(0,("Failed to resolve[%s] for nmbd_proxy_logon\n",
101                          cldap_server));
102                 return false;
103         }
104
105         ctx = talloc_zero(nmbd_event_context(),
106                           struct nmbd_proxy_logon_context);
107         if (!ctx) {
108                 return false;
109         }
110
111         ret = tsocket_address_inet_from_strings(ctx, "ipv4",
112                                                 server_str, LDAP_PORT,
113                                                 &server_addr);
114         if (ret != 0) {
115                 TALLOC_FREE(ctx);
116                 status = map_nt_error_from_unix(errno);
117                 DEBUG(0,("Failed to create cldap tsocket_address for %s - %s\n",
118                          server_str, nt_errstr(status)));
119                 return false;
120         }
121
122         /* we create a connected udp socket */
123         status = cldap_socket_init(ctx, NULL, server_addr, &ctx->cldap_sock);
124         TALLOC_FREE(server_addr);
125         if (!NT_STATUS_IS_OK(status)) {
126                 TALLOC_FREE(ctx);
127                 DEBUG(0,("failed to create cldap socket for %s: %s\n",
128                         server_str, nt_errstr(status)));
129                 return false;
130         }
131
132         global_nmbd_proxy_logon = ctx;
133         return true;
134 }
135
136 struct nmbd_proxy_logon_state {
137         struct in_addr local_ip;
138         struct packet_struct *p;
139         const char *remote_name;
140         uint8_t remote_name_type;
141         const char *remote_mailslot;
142         struct nbt_netlogon_packet req;
143         struct nbt_netlogon_response resp;
144         struct cldap_netlogon io;
145 };
146
147 static int nmbd_proxy_logon_state_destructor(struct nmbd_proxy_logon_state *s)
148 {
149         s->p->locked = false;
150         free_packet(s->p);
151         return 0;
152 }
153
154 static void nmbd_proxy_logon_done(struct tevent_req *subreq);
155
156 static void nmbd_proxy_logon(struct nmbd_proxy_logon_context *ctx,
157                              struct in_addr local_ip,
158                              struct packet_struct *p,
159                              const uint8_t *buf,
160                              uint32_t len)
161 {
162         struct nmbd_proxy_logon_state *state;
163         enum ndr_err_code ndr_err;
164         DATA_BLOB blob = data_blob_const(buf, len);
165         const char *computer_name = NULL;
166         const char *mailslot_name = NULL;
167         const char *user_name = NULL;
168         const char *domain_sid = NULL;
169         uint32_t acct_control = 0;
170         uint32_t nt_version = 0;
171         struct tevent_req *subreq;
172         fstring source_name;
173         struct dgram_packet *dgram = &p->packet.dgram;
174
175         state = talloc_zero(ctx, struct nmbd_proxy_logon_state);
176         if (!state) {
177                 DEBUG(0,("failed to allocate nmbd_proxy_logon_state\n"));
178                 return;
179         }
180
181         pull_ascii_nstring(source_name, sizeof(source_name), dgram->source_name.name);
182         state->remote_name = talloc_strdup(state, source_name);
183         state->remote_name_type = dgram->source_name.name_type,
184         state->local_ip = local_ip;
185         state->p = p;
186
187         ndr_err = ndr_pull_struct_blob(
188                 &blob, state, &state->req,
189                 (ndr_pull_flags_fn_t)ndr_pull_nbt_netlogon_packet);
190         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
191                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
192                 DEBUG(0,("failed parse nbt_netlogon_packet: %s\n",
193                         nt_errstr(status)));
194                 TALLOC_FREE(state);
195                 return;
196         }
197
198         if (DEBUGLEVEL >= 10) {
199                 DEBUG(10, ("nmbd_proxy_logon:\n"));
200                 NDR_PRINT_DEBUG(nbt_netlogon_packet, &state->req);
201         }
202
203         switch (state->req.command) {
204         case LOGON_SAM_LOGON_REQUEST:
205                 computer_name   = state->req.req.logon.computer_name;
206                 user_name       = state->req.req.logon.user_name;
207                 mailslot_name   = state->req.req.logon.mailslot_name;
208                 acct_control    = state->req.req.logon.acct_control;
209                 if (state->req.req.logon.sid_size > 0) {
210                         domain_sid = dom_sid_string(state,
211                                                     &state->req.req.logon.sid);
212                         if (!domain_sid) {
213                                 DEBUG(0,("failed to get a string for sid\n"));
214                                 TALLOC_FREE(state);
215                                 return;
216                         }
217                 }
218                 nt_version      = state->req.req.logon.nt_version;
219                 break;
220
221         default:
222                 /* this can't happen as the caller already checks the command */
223                 break;
224         }
225
226         state->remote_mailslot = mailslot_name;
227
228         if (user_name && strlen(user_name) == 0) {
229                 user_name = NULL;
230         }
231
232         if (computer_name && strlen(computer_name) == 0) {
233                 computer_name = NULL;
234         }
235
236         /*
237          * as the socket is connected,
238          * we don't need to specify the destination
239          */
240         state->io.in.dest_address       = NULL;
241         state->io.in.dest_port          = 0;
242         state->io.in.realm              = NULL;
243         state->io.in.host               = computer_name;
244         state->io.in.user               = user_name;
245         state->io.in.domain_guid        = NULL;
246         state->io.in.domain_sid         = domain_sid;
247         state->io.in.acct_control       = acct_control;
248         state->io.in.version            = nt_version;
249         state->io.in.map_response       = false;
250
251         subreq = cldap_netlogon_send(state, nmbd_event_context(),
252                                      ctx->cldap_sock,
253                                      &state->io);
254         if (!subreq) {
255                 DEBUG(0,("failed to send cldap netlogon call\n"));
256                 TALLOC_FREE(state);
257                 return;
258         }
259         tevent_req_set_callback(subreq, nmbd_proxy_logon_done, state);
260
261         /* we reply async */
262         state->p->locked = true;
263         talloc_set_destructor(state, nmbd_proxy_logon_state_destructor);
264 }
265
266 static void nmbd_proxy_logon_done(struct tevent_req *subreq)
267 {
268         struct nmbd_proxy_logon_state *state =
269                 tevent_req_callback_data(subreq,
270                 struct nmbd_proxy_logon_state);
271         NTSTATUS status;
272         DATA_BLOB response = data_blob_null;
273
274         status = cldap_netlogon_recv(subreq, state, &state->io);
275         if (!NT_STATUS_IS_OK(status)) {
276                 DEBUG(0,("failed to recv cldap netlogon call: %s\n",
277                         nt_errstr(status)));
278                 TALLOC_FREE(state);
279                 return;
280         }
281
282         status = push_netlogon_samlogon_response(&response, state,
283                                                  &state->io.out.netlogon);
284         if (!NT_STATUS_IS_OK(status)) {
285                 DEBUG(0,("failed to push netlogon_samlogon_response: %s\n",
286                         nt_errstr(status)));
287                 TALLOC_FREE(state);
288                 return;
289         }
290
291         send_mailslot(true, state->remote_mailslot,
292                       (char *)response.data, response.length,
293                       lp_netbios_name(), 0x0,
294                       state->remote_name,
295                       state->remote_name_type,
296                       state->p->ip,
297                       state->local_ip,
298                       state->p->port);
299         TALLOC_FREE(state);
300 }
301
302 /****************************************************************************
303 Process a domain logon packet
304 **************************************************************************/
305
306 void process_logon_packet(struct packet_struct *p, const char *buf,int len,
307                           const char *mailslot)
308 {
309         fstring source_name;
310         struct dgram_packet *dgram = &p->packet.dgram;
311         struct sockaddr_storage ss;
312         const struct sockaddr_storage *pss;
313         struct in_addr ip;
314
315         DATA_BLOB blob_in, blob_out;
316         enum ndr_err_code ndr_err;
317         struct nbt_netlogon_packet request;
318         struct nbt_netlogon_response response;
319         NTSTATUS status;
320         const char *pdc_name;
321
322         in_addr_to_sockaddr_storage(&ss, p->ip);
323         pss = iface_ip((struct sockaddr *)&ss);
324         if (!pss) {
325                 DEBUG(5,("process_logon_packet:can't find outgoing interface "
326                         "for packet from IP %s\n",
327                         inet_ntoa(p->ip) ));
328                 return;
329         }
330         ip = ((const struct sockaddr_in *)pss)->sin_addr;
331
332         if (!IS_DC) {
333                 DEBUG(5,("process_logon_packet: Logon packet received from IP %s and domain \
334 logons are not enabled.\n", inet_ntoa(p->ip) ));
335                 return;
336         }
337
338         pull_ascii_nstring(source_name, sizeof(source_name), dgram->source_name.name);
339
340         pdc_name = talloc_asprintf(talloc_tos(), "\\\\%s", lp_netbios_name());
341         if (!pdc_name) {
342                 return;
343         }
344
345         ZERO_STRUCT(request);
346
347         blob_in = data_blob_const(buf, len);
348
349         ndr_err = ndr_pull_struct_blob(&blob_in, talloc_tos(), &request,
350                 (ndr_pull_flags_fn_t)ndr_pull_nbt_netlogon_packet);
351         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
352                 DEBUG(1,("process_logon_packet: Failed to pull logon packet\n"));
353                 return;
354         }
355
356         if (DEBUGLEVEL >= 10) {
357                 NDR_PRINT_DEBUG(nbt_netlogon_packet, &request);
358         }
359
360         DEBUG(4,("process_logon_packet: Logon from %s: code = 0x%x\n",
361                 inet_ntoa(p->ip), request.command));
362
363         switch (request.command) {
364         case LOGON_REQUEST: {
365
366                 struct nbt_netlogon_response2 response2;
367
368                 DEBUG(5,("process_logon_packet: Domain login request from %s at IP %s user=%s token=%x\n",
369                         request.req.logon0.computer_name, inet_ntoa(p->ip),
370                         request.req.logon0.user_name,
371                         request.req.logon0.lm20_token));
372
373                 response2.command       = LOGON_RESPONSE2;
374                 response2.pdc_name      = pdc_name;
375                 response2.lm20_token    = 0xffff;
376
377                 response.response_type = NETLOGON_RESPONSE2;
378                 response.data.response2 = response2;
379
380                 status = push_nbt_netlogon_response(&blob_out, talloc_tos(), &response);
381                 if (!NT_STATUS_IS_OK(status)) {
382                         DEBUG(0,("process_logon_packet: failed to push packet\n"));
383                         return;
384                 }
385
386                 if (DEBUGLEVEL >= 10) {
387                         NDR_PRINT_DEBUG(nbt_netlogon_response2, &response.data.response2);
388                 }
389
390                 send_mailslot(True, request.req.logon0.mailslot_name,
391                                 (char *)blob_out.data,
392                                 blob_out.length,
393                                 lp_netbios_name(), 0x0,
394                                 source_name,
395                                 dgram->source_name.name_type,
396                                 p->ip, ip, p->port);
397                 break;
398         }
399
400         case LOGON_PRIMARY_QUERY: {
401
402                 struct nbt_netlogon_response_from_pdc get_pdc;
403
404                 if (!lp_domain_master()) {
405                         /* We're not Primary Domain Controller -- ignore this */
406                         return;
407                 }
408
409                 DEBUG(5,("process_logon_packet: GETDC request from %s at IP %s, "
410                         "reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
411                         request.req.pdc.computer_name,
412                         inet_ntoa(p->ip),
413                         lp_netbios_name(),
414                         lp_workgroup(),
415                         NETLOGON_RESPONSE_FROM_PDC,
416                         request.req.pdc.nt_version,
417                         request.req.pdc.lmnt_token,
418                         request.req.pdc.lm20_token));
419
420                 get_pdc.command                 = NETLOGON_RESPONSE_FROM_PDC;
421                 get_pdc.pdc_name                = lp_netbios_name();
422                 get_pdc._pad                    = data_blob_null;
423                 get_pdc.unicode_pdc_name        = lp_netbios_name();
424                 get_pdc.domain_name             = lp_workgroup();
425                 get_pdc.nt_version              = NETLOGON_NT_VERSION_1;
426                 get_pdc.lmnt_token              = 0xffff;
427                 get_pdc.lm20_token              = 0xffff;
428
429                 response.response_type = NETLOGON_GET_PDC;
430                 response.data.get_pdc = get_pdc;
431
432                 status = push_nbt_netlogon_response(&blob_out, talloc_tos(), &response);
433                 if (!NT_STATUS_IS_OK(status)) {
434                         DEBUG(0,("process_logon_packet: failed to push packet\n"));
435                         return;
436                 }
437
438                 if (DEBUGLEVEL >= 10) {
439                         NDR_PRINT_DEBUG(nbt_netlogon_response_from_pdc, &response.data.get_pdc);
440                 }
441
442                 send_mailslot(True, request.req.pdc.mailslot_name,
443                         (char *)blob_out.data,
444                         blob_out.length,
445                         lp_netbios_name(), 0x0,
446                         source_name,
447                         dgram->source_name.name_type,
448                         p->ip, ip, p->port);
449
450                 return;
451         }
452
453         case LOGON_SAM_LOGON_REQUEST: {
454                 char *source_addr;
455                 bool user_unknown = false;
456
457                 struct netlogon_samlogon_response samlogon;
458                 struct NETLOGON_SAM_LOGON_RESPONSE_NT40 nt4;
459
460                 if (global_nmbd_proxy_logon) {
461                         nmbd_proxy_logon(global_nmbd_proxy_logon,
462                                          ip, p, (const uint8_t *)buf, len);
463                         return;
464                 }
465
466                 source_addr = SMB_STRDUP(inet_ntoa(dgram->header.source_ip));
467                 if (source_addr == NULL) {
468                         DEBUG(3, ("out of memory copying client"
469                                   " address string\n"));
470                         return;
471                 }
472
473                 DEBUG(5,("process_logon_packet: LOGON_SAM_LOGON_REQUEST request from %s(%s) for %s, returning logon svr %s domain %s code %x token=%x\n",
474                         request.req.logon.computer_name,
475                         inet_ntoa(p->ip),
476                         request.req.logon.user_name,
477                         pdc_name,
478                         lp_workgroup(),
479                         LOGON_SAM_LOGON_RESPONSE,
480                         request.req.logon.lmnt_token));
481
482                 if (!request.req.logon.user_name) {
483                         user_unknown = true;
484                 }
485
486                 nt4.command             = user_unknown ? LOGON_SAM_LOGON_USER_UNKNOWN :
487                         LOGON_SAM_LOGON_RESPONSE;
488                 nt4.pdc_name            = pdc_name;
489                 nt4.user_name           = request.req.logon.user_name;
490                 nt4.domain_name         = lp_workgroup();
491                 nt4.nt_version          = NETLOGON_NT_VERSION_1;
492                 nt4.lmnt_token          = 0xffff;
493                 nt4.lm20_token          = 0xffff;
494                 
495                 samlogon.ntver = NETLOGON_NT_VERSION_1;
496                 samlogon.data.nt4 = nt4;
497                 
498                 if (DEBUGLEVEL >= 10) {
499                         NDR_PRINT_DEBUG(NETLOGON_SAM_LOGON_RESPONSE_NT40, &nt4);
500                 }
501
502                 response.response_type = NETLOGON_SAMLOGON;
503                 response.data.samlogon = samlogon;
504
505                 status = push_nbt_netlogon_response(&blob_out, talloc_tos(), &response);
506                 if (!NT_STATUS_IS_OK(status)) {
507                         DEBUG(0,("process_logon_packet: failed to push packet\n"));
508                         SAFE_FREE(source_addr);
509                         return;
510                 }
511
512                 /*
513                  * handle delay.
514                  * packets requeued after delay are marked as
515                  * locked.
516                  */
517                 if ((p->locked == False) &&
518                     (strlen(request.req.logon.user_name) == 0) &&
519                     delay_logon(source_name, source_addr))
520                 {
521                         struct timeval when;
522
523                         DEBUG(3, ("process_logon_packet: "
524                                   "delaying initial logon "
525                                   "reply for client %s(%s) for "
526                                   "%u milliseconds\n",
527                                   source_name, source_addr,
528                                   lp_init_logon_delay()));
529
530                         when = timeval_current_ofs_msec(lp_init_logon_delay());
531                         p->locked = true;
532                         tevent_add_timer(nmbd_event_context(),
533                                         NULL,
534                                         when,
535                                         delayed_init_logon_handler,
536                                         p);
537                 } else {
538                         DEBUG(3, ("process_logon_packet: "
539                                   "processing delayed initial "
540                                   "logon reply for client "
541                                   "%s(%s)\n",
542                                   source_name, source_addr));
543                         p->locked = false;
544                         send_mailslot(true, request.req.logon.mailslot_name,
545                                 (char *)blob_out.data,
546                                 blob_out.length,
547                                 lp_netbios_name(), 0x0,
548                                 source_name,
549                                 dgram->source_name.name_type,
550                                 p->ip, ip, p->port);
551                 }
552
553                 SAFE_FREE(source_addr);
554
555                 break;
556         }
557
558         /* Announce change to UAS or SAM.  Send by the domain controller when a
559         replication event is required. */
560
561         case NETLOGON_ANNOUNCE_UAS:
562                 DEBUG(5, ("Got NETLOGON_ANNOUNCE_UAS\n"));
563                 break;
564
565         default:
566                 DEBUG(3,("process_logon_packet: Unknown domain request %d\n",
567                         request.command));
568                 return;
569         }
570 }