source3/nmbd/nmbd_processlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    NBT netbios routines and daemon - version 2
   4    Copyright (C) Andrew Tridgell 1994-1998
   5    Copyright (C) Luke Kenneth Casson Leighton 1994-1998
   6    Copyright (C) Jeremy Allison 1994-2003
   7    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21
  22    Revision History:
  23
  24 */
  25
  26 #include "includes.h"
  27 #include "../libcli/netlogon.h"
  28 #include "../libcli/cldap/cldap.h"
  29 #include "../lib/tsocket/tsocket.h"
  30 #include "../libcli/security/dom_sid.h"
  31 #include "secrets.h"
  32 #include "nmbd/nmbd.h"
  33
  34 struct sam_database_info {
  35         uint32 index;
  36         uint32 serial_lo, serial_hi;
  37         uint32 date_lo, date_hi;
  38 };
  39
  40 /**
  41  * check whether the client belongs to the hosts
  42  * for which initial logon should be delayed...
  43  */
  44 static bool delay_logon(const char *peer_name, const char *peer_addr)
  45 {
  46         const char **delay_list = lp_init_logon_delayed_hosts();
  47         const char *peer[2];
  48
  49         if (delay_list == NULL) {
  50                 return False;
  51         }
  52
  53         peer[0] = peer_name;
  54         peer[1] = peer_addr;
  55
  56         return list_match(delay_list, (const char *)peer, client_match);
  57 }
  58
  59 static void delayed_init_logon_handler(struct event_context *event_ctx,
  60                                        struct timed_event *te,
  61                                        struct timeval now,
  62                                        void *private_data)
  63 {
  64         struct packet_struct *p = (struct packet_struct *)private_data;
  65
  66         DEBUG(10, ("delayed_init_logon_handler (%lx): re-queuing packet.\n",
  67                    (unsigned long)te));
  68
  69         queue_packet(p);
  70
  71         TALLOC_FREE(te);
  72 }
  73
  74 struct nmbd_proxy_logon_context {
  75         struct cldap_socket *cldap_sock;
  76 };
  77
  78 static struct nmbd_proxy_logon_context *global_nmbd_proxy_logon;
  79
  80 bool initialize_nmbd_proxy_logon(void)
  81 {
  82         const char *cldap_server = lp_parm_const_string(-1, "nmbd_proxy_logon",
  83                                                         "cldap_server", NULL);
  84         struct nmbd_proxy_logon_context *ctx;
  85         NTSTATUS status;
  86         struct in_addr addr;
  87         char addrstr[INET_ADDRSTRLEN];
  88         const char *server_str;
  89         int ret;
  90         struct tsocket_address *server_addr;
  91
  92         if (!cldap_server) {
  93                 return true;
  94         }
  95
  96         addr = interpret_addr2(cldap_server);
  97         server_str = inet_ntop(AF_INET, &addr,
  98                              addrstr, sizeof(addrstr));
  99         if (!server_str || strcmp("0.0.0.0", server_str) == 0) {
 100                 DEBUG(0,("Failed to resolve[%s] for nmbd_proxy_logon\n",
 101                          cldap_server));
 102                 return false;
 103         }
 104
 105         ctx = talloc_zero(nmbd_event_context(),
 106                           struct nmbd_proxy_logon_context);
 107         if (!ctx) {
 108                 return false;
 109         }
 110
 111         ret = tsocket_address_inet_from_strings(ctx, "ipv4",
 112                                                 server_str, LDAP_PORT,
 113                                                 &server_addr);
 114         if (ret != 0) {
 115                 TALLOC_FREE(ctx);
 116                 status = map_nt_error_from_unix(errno);
 117                 DEBUG(0,("Failed to create cldap tsocket_address for %s - %s\n",
 118                          server_str, nt_errstr(status)));
 119                 return false;
 120         }
 121
 122         /* we create a connected udp socket */
 123         status = cldap_socket_init(ctx, nmbd_event_context(), NULL,
 124                                    server_addr, &ctx->cldap_sock);
 125         TALLOC_FREE(server_addr);
 126         if (!NT_STATUS_IS_OK(status)) {
 127                 TALLOC_FREE(ctx);
 128                 DEBUG(0,("failed to create cldap socket for %s: %s\n",
 129                         server_str, nt_errstr(status)));
 130                 return false;
 131         }
 132
 133         global_nmbd_proxy_logon = ctx;
 134         return true;
 135 }
 136
 137 struct nmbd_proxy_logon_state {
 138         struct in_addr local_ip;
 139         struct packet_struct *p;
 140         const char *remote_name;
 141         uint8_t remote_name_type;
 142         const char *remote_mailslot;
 143         struct nbt_netlogon_packet req;
 144         struct nbt_netlogon_response resp;
 145         struct cldap_netlogon io;
 146 };
 147
 148 static int nmbd_proxy_logon_state_destructor(struct nmbd_proxy_logon_state *s)
 149 {
 150         s->p->locked = false;
 151         free_packet(s->p);
 152         return 0;
 153 }
 154
 155 static void nmbd_proxy_logon_done(struct tevent_req *subreq);
 156
 157 static void nmbd_proxy_logon(struct nmbd_proxy_logon_context *ctx,
 158                              struct in_addr local_ip,
 159                              struct packet_struct *p,
 160                              uint8_t *buf,
 161                              uint32_t len)
 162 {
 163         struct nmbd_proxy_logon_state *state;
 164         enum ndr_err_code ndr_err;
 165         DATA_BLOB blob = data_blob_const(buf, len);
 166         const char *computer_name = NULL;
 167         const char *mailslot_name = NULL;
 168         const char *user_name = NULL;
 169         const char *domain_sid = NULL;
 170         uint32_t acct_control = 0;
 171         uint32_t nt_version = 0;
 172         struct tevent_req *subreq;
 173         fstring source_name;
 174         struct dgram_packet *dgram = &p->packet.dgram;
 175
 176         state = TALLOC_ZERO_P(ctx, struct nmbd_proxy_logon_state);
 177         if (!state) {
 178                 DEBUG(0,("failed to allocate nmbd_proxy_logon_state\n"));
 179                 return;
 180         }
 181
 182         pull_ascii_nstring(source_name, sizeof(source_name), dgram->source_name.name);
 183         state->remote_name = talloc_strdup(state, source_name);
 184         state->remote_name_type = dgram->source_name.name_type,
 185         state->local_ip = local_ip;
 186         state->p = p;
 187
 188         ndr_err = ndr_pull_struct_blob(
 189                 &blob, state, &state->req,
 190                 (ndr_pull_flags_fn_t)ndr_pull_nbt_netlogon_packet);
 191         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 192                 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
 193                 DEBUG(0,("failed parse nbt_netlogon_packet: %s\n",
 194                         nt_errstr(status)));
 195                 TALLOC_FREE(state);
 196                 return;
 197         }
 198
 199         if (DEBUGLEVEL >= 10) {
 200                 DEBUG(10, ("nmbd_proxy_logon:\n"));
 201                 NDR_PRINT_DEBUG(nbt_netlogon_packet, &state->req);
 202         }
 203
 204         switch (state->req.command) {
 205         case LOGON_SAM_LOGON_REQUEST:
 206                 computer_name   = state->req.req.logon.computer_name;
 207                 user_name       = state->req.req.logon.user_name;
 208                 mailslot_name   = state->req.req.logon.mailslot_name;
 209                 acct_control    = state->req.req.logon.acct_control;
 210                 if (state->req.req.logon.sid_size > 0) {
 211                         domain_sid = dom_sid_string(state,
 212                                                     &state->req.req.logon.sid);
 213                         if (!domain_sid) {
 214                                 DEBUG(0,("failed to get a string for sid\n"));
 215                                 TALLOC_FREE(state);
 216                                 return;
 217                         }
 218                 }
 219                 nt_version      = state->req.req.logon.nt_version;
 220                 break;
 221
 222         default:
 223                 /* this can't happen as the caller already checks the command */
 224                 break;
 225         }
 226
 227         state->remote_mailslot = mailslot_name;
 228
 229         if (user_name && strlen(user_name) == 0) {
 230                 user_name = NULL;
 231         }
 232
 233         if (computer_name && strlen(computer_name) == 0) {
 234                 computer_name = NULL;
 235         }
 236
 237         /*
 238          * as the socket is connected,
 239          * we don't need to specify the destination
 240          */
 241         state->io.in.dest_address       = NULL;
 242         state->io.in.dest_port          = 0;
 243         state->io.in.realm              = NULL;
 244         state->io.in.host               = computer_name;
 245         state->io.in.user               = user_name;
 246         state->io.in.domain_guid        = NULL;
 247         state->io.in.domain_sid         = domain_sid;
 248         state->io.in.acct_control       = acct_control;
 249         state->io.in.version            = nt_version;
 250         state->io.in.map_response       = false;
 251
 252         subreq = cldap_netlogon_send(state,
 253                                      ctx->cldap_sock,
 254                                      &state->io);
 255         if (!subreq) {
 256                 DEBUG(0,("failed to send cldap netlogon call\n"));
 257                 TALLOC_FREE(state);
 258                 return;
 259         }
 260         tevent_req_set_callback(subreq, nmbd_proxy_logon_done, state);
 261
 262         /* we reply async */
 263         state->p->locked = true;
 264         talloc_set_destructor(state, nmbd_proxy_logon_state_destructor);
 265 }
 266
 267 static void nmbd_proxy_logon_done(struct tevent_req *subreq)
 268 {
 269         struct nmbd_proxy_logon_state *state =
 270                 tevent_req_callback_data(subreq,
 271                 struct nmbd_proxy_logon_state);
 272         NTSTATUS status;
 273         DATA_BLOB response = data_blob_null;
 274
 275         status = cldap_netlogon_recv(subreq, state, &state->io);
 276         if (!NT_STATUS_IS_OK(status)) {
 277                 DEBUG(0,("failed to recv cldap netlogon call: %s\n",
 278                         nt_errstr(status)));
 279                 TALLOC_FREE(state);
 280                 return;
 281         }
 282
 283         status = push_netlogon_samlogon_response(&response, state,
 284                                                  &state->io.out.netlogon);
 285         if (!NT_STATUS_IS_OK(status)) {
 286                 DEBUG(0,("failed to push netlogon_samlogon_response: %s\n",
 287                         nt_errstr(status)));
 288                 TALLOC_FREE(state);
 289                 return;
 290         }
 291
 292         send_mailslot(true, state->remote_mailslot,
 293                       (char *)response.data, response.length,
 294                       global_myname(), 0x0,
 295                       state->remote_name,
 296                       state->remote_name_type,
 297                       state->p->ip,
 298                       state->local_ip,
 299                       state->p->port);
 300         TALLOC_FREE(state);
 301 }
 302
 303 /****************************************************************************
 304 Process a domain logon packet
 305 **************************************************************************/
 306
 307 void process_logon_packet(struct packet_struct *p, char *buf,int len,
 308                           const char *mailslot)
 309 {
 310         fstring source_name;
 311         struct dgram_packet *dgram = &p->packet.dgram;
 312         fstring my_name;
 313         fstring reply_name;
 314         char outbuf[1024];
 315         uint32 ntversion = 0;
 316         uint16 lmnttoken = 0;
 317         uint16 lm20token = 0;
 318         uint32 domainsidsize;
 319         char *getdc;
 320         char *uniuser; /* Unicode user name. */
 321         fstring ascuser;
 322         char *unicomp; /* Unicode computer name. */
 323         size_t size;
 324         struct sockaddr_storage ss;
 325         const struct sockaddr_storage *pss;
 326         struct in_addr ip;
 327
 328         DATA_BLOB blob_in, blob_out;
 329         enum ndr_err_code ndr_err;
 330         struct nbt_netlogon_packet request;
 331         struct nbt_netlogon_response response;
 332         NTSTATUS status;
 333         const char *pdc_name;
 334
 335         in_addr_to_sockaddr_storage(&ss, p->ip);
 336         pss = iface_ip((struct sockaddr *)&ss);
 337         if (!pss) {
 338                 DEBUG(5,("process_logon_packet:can't find outgoing interface "
 339                         "for packet from IP %s\n",
 340                         inet_ntoa(p->ip) ));
 341                 return;
 342         }
 343         ip = ((struct sockaddr_in *)pss)->sin_addr;
 344
 345         memset(outbuf, 0, sizeof(outbuf));
 346
 347         if (!lp_domain_logons()) {
 348                 DEBUG(5,("process_logon_packet: Logon packet received from IP %s and domain \
 349 logons are not enabled.\n", inet_ntoa(p->ip) ));
 350                 return;
 351         }
 352
 353         fstrcpy(my_name, global_myname());
 354
 355         pull_ascii_nstring(source_name, sizeof(source_name), dgram->source_name.name);
 356
 357         pdc_name = talloc_asprintf(talloc_tos(), "\\\\%s", global_myname());
 358         if (!pdc_name) {
 359                 return;
 360         }
 361
 362         ZERO_STRUCT(request);
 363
 364         blob_in = data_blob_const(buf, len);
 365
 366         ndr_err = ndr_pull_struct_blob(&blob_in, talloc_tos(), &request,
 367                 (ndr_pull_flags_fn_t)ndr_pull_nbt_netlogon_packet);
 368         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 369                 DEBUG(1,("process_logon_packet: Failed to pull logon packet\n"));
 370                 return;
 371         }
 372
 373         if (DEBUGLEVEL >= 10) {
 374                 NDR_PRINT_DEBUG(nbt_netlogon_packet, &request);
 375         }
 376
 377         DEBUG(4,("process_logon_packet: Logon from %s: code = 0x%x\n",
 378                 inet_ntoa(p->ip), request.command));
 379
 380         switch (request.command) {
 381         case LOGON_REQUEST: {
 382
 383                 struct nbt_netlogon_response2 response2;
 384
 385                 DEBUG(5,("process_logon_packet: Domain login request from %s at IP %s user=%s token=%x\n",
 386                         request.req.logon0.computer_name, inet_ntoa(p->ip),
 387                         request.req.logon0.user_name,
 388                         request.req.logon0.lm20_token));
 389
 390                 response2.command       = LOGON_RESPONSE2;
 391                 response2.pdc_name      = pdc_name;
 392                 response2.lm20_token    = 0xffff;
 393
 394                 response.response_type = NETLOGON_RESPONSE2;
 395                 response.data.response2 = response2;
 396
 397                 status = push_nbt_netlogon_response(&blob_out, talloc_tos(), &response);
 398                 if (!NT_STATUS_IS_OK(status)) {
 399                         DEBUG(0,("process_logon_packet: failed to push packet\n"));
 400                         return;
 401                 }
 402
 403                 if (DEBUGLEVEL >= 10) {
 404                         NDR_PRINT_DEBUG(nbt_netlogon_response2, &response.data.response2);
 405                 }
 406
 407                 send_mailslot(True, request.req.logon0.mailslot_name,
 408                                 (char *)blob_out.data,
 409                                 blob_out.length,
 410                                 global_myname(), 0x0,
 411                                 source_name,
 412                                 dgram->source_name.name_type,
 413                                 p->ip, ip, p->port);
 414                 break;
 415         }
 416
 417         case LOGON_PRIMARY_QUERY: {
 418
 419                 struct nbt_netlogon_response_from_pdc get_pdc;
 420
 421                 if (!lp_domain_master()) {
 422                         /* We're not Primary Domain Controller -- ignore this */
 423                         return;
 424                 }
 425
 426                 DEBUG(5,("process_logon_packet: GETDC request from %s at IP %s, "
 427                         "reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n",
 428                         request.req.pdc.computer_name,
 429                         inet_ntoa(p->ip),
 430                         global_myname(),
 431                         lp_workgroup(),
 432                         NETLOGON_RESPONSE_FROM_PDC,
 433                         request.req.pdc.nt_version,
 434                         request.req.pdc.lmnt_token,
 435                         request.req.pdc.lm20_token));
 436
 437                 get_pdc.command                 = NETLOGON_RESPONSE_FROM_PDC;
 438                 get_pdc.pdc_name                = global_myname();
 439                 get_pdc._pad                    = data_blob_null;
 440                 get_pdc.unicode_pdc_name        = global_myname();
 441                 get_pdc.domain_name             = lp_workgroup();
 442                 get_pdc.nt_version              = 1;
 443                 get_pdc.lmnt_token              = 0xffff;
 444                 get_pdc.lm20_token              = 0xffff;
 445
 446                 response.response_type = NETLOGON_GET_PDC;
 447                 response.data.get_pdc = get_pdc;
 448
 449                 status = push_nbt_netlogon_response(&blob_out, talloc_tos(), &response);
 450                 if (!NT_STATUS_IS_OK(status)) {
 451                         DEBUG(0,("process_logon_packet: failed to push packet\n"));
 452                         return;
 453                 }
 454
 455                 if (DEBUGLEVEL >= 10) {
 456                         NDR_PRINT_DEBUG(nbt_netlogon_response_from_pdc, &response.data.get_pdc);
 457                 }
 458
 459                 send_mailslot(True, request.req.pdc.mailslot_name,
 460                         (char *)blob_out.data,
 461                         blob_out.length,
 462                         global_myname(), 0x0,
 463                         source_name,
 464                         dgram->source_name.name_type,
 465                         p->ip, ip, p->port);
 466
 467                 return;
 468         }
 469
 470         case LOGON_SAM_LOGON_REQUEST: {
 471                 fstring getdc_str;
 472                 char *source_addr;
 473                 char *q = buf + 2;
 474                 fstring asccomp;
 475
 476                 if (global_nmbd_proxy_logon) {
 477                         nmbd_proxy_logon(global_nmbd_proxy_logon,
 478                                          ip, p, (uint8_t *)buf, len);
 479                         return;
 480                 }
 481
 482                 q += 2;
 483
 484                 if (PTR_DIFF(q, buf) >= len) {
 485                         DEBUG(0,("process_logon_packet: bad packet\n"));
 486                         return;
 487                 }
 488
 489                 unicomp = q;
 490                 uniuser = skip_unibuf(unicomp, PTR_DIFF(buf+len, unicomp));
 491
 492                 if (PTR_DIFF(uniuser, buf) >= len) {
 493                         DEBUG(0,("process_logon_packet: bad packet\n"));
 494                         return;
 495                 }
 496
 497                 getdc = skip_unibuf(uniuser,PTR_DIFF(buf+len, uniuser));
 498
 499                 if (PTR_DIFF(getdc, buf) >= len) {
 500                         DEBUG(0,("process_logon_packet: bad packet\n"));
 501                         return;
 502                 }
 503
 504                 q = skip_string(buf,len,getdc);
 505
 506                 if (!q || PTR_DIFF(q + 8, buf) >= len) {
 507                         DEBUG(0,("process_logon_packet: bad packet\n"));
 508                         return;
 509                 }
 510
 511                 q += 4; /* Account Control Bits - indicating username type */
 512                 domainsidsize = IVAL(q, 0);
 513                 q += 4;
 514
 515                 DEBUG(5,("process_logon_packet: LOGON_SAM_LOGON_REQUEST sidsize %d, len = %d\n", domainsidsize, len));
 516
 517                 if (domainsidsize < (len - PTR_DIFF(q, buf)) && (domainsidsize != 0)) {
 518                         q += domainsidsize;
 519                         q = ALIGN4(q, buf);
 520                 }
 521
 522                 DEBUG(5,("process_logon_packet: len = %d PTR_DIFF(q, buf) = %ld\n", len, (unsigned long)PTR_DIFF(q, buf) ));
 523
 524                 if (len - PTR_DIFF(q, buf) > 8) {
 525                         /* with NT5 clients we can sometimes
 526                                 get additional data - a length specificed string
 527                                 containing the domain name, then 16 bytes of
 528                                 data (no idea what it is) */
 529                         int dom_len = CVAL(q, 0);
 530                         q++;
 531                         if (dom_len < (len - PTR_DIFF(q, buf)) && (dom_len != 0)) {
 532                                 q += dom_len + 1;
 533                         }
 534                         q += 16;
 535                 }
 536
 537                 if (PTR_DIFF(q + 8, buf) > len) {
 538                         DEBUG(0,("process_logon_packet: bad packet\n"));
 539                         return;
 540                 }
 541
 542                 ntversion = IVAL(q, 0);
 543                 lmnttoken = SVAL(q, 4);
 544                 lm20token = SVAL(q, 6);
 545                 q += 8;
 546
 547                 DEBUG(3,("process_logon_packet: LOGON_SAM_LOGON_REQUEST sidsize %d ntv %d\n", domainsidsize, ntversion));
 548
 549                 /*
 550                  * we respond regadless of whether the machine is in our password
 551                  * database. If it isn't then we let smbd send an appropriate error.
 552                  * Let's ignore the SID.
 553                  */
 554                 pull_ucs2_fstring(ascuser, uniuser);
 555                 pull_ucs2_fstring(asccomp, unicomp);
 556                 DEBUG(5,("process_logon_packet: LOGON_SAM_LOGON_REQUEST user %s\n", ascuser));
 557
 558                 fstrcpy(reply_name, "\\\\"); /* Here it wants \\LOGONSERVER. */
 559                 fstrcat(reply_name, my_name);
 560
 561                 DEBUG(5,("process_logon_packet: LOGON_SAM_LOGON_REQUEST request from %s(%s) for %s, returning logon svr %s domain %s code %x token=%x\n",
 562                         asccomp,inet_ntoa(p->ip), ascuser, reply_name, lp_workgroup(),
 563                 LOGON_SAM_LOGON_RESPONSE ,lmnttoken));
 564
 565                 /* Construct reply. */
 566
 567                 q = outbuf;
 568                 /* we want the simple version unless we are an ADS PDC..which means  */
 569                 /* never, at least for now */
 570                 if ((ntversion < 11) || (SEC_ADS != lp_security()) || (ROLE_DOMAIN_PDC != lp_server_role())) {
 571                         if (SVAL(uniuser, 0) == 0) {
 572                                 SSVAL(q, 0, LOGON_SAM_LOGON_USER_UNKNOWN);      /* user unknown */
 573                         } else {
 574                                 SSVAL(q, 0, LOGON_SAM_LOGON_RESPONSE);
 575                         }
 576
 577                         q += 2;
 578
 579                         q += dos_PutUniCode(q, reply_name,
 580                                 sizeof(outbuf) - PTR_DIFF(q, outbuf),
 581                                 True);
 582                         q += dos_PutUniCode(q, ascuser,
 583                                 sizeof(outbuf) - PTR_DIFF(q, outbuf),
 584                                 True);
 585                         q += dos_PutUniCode(q, lp_workgroup(),
 586                                 sizeof(outbuf) - PTR_DIFF(q, outbuf),
 587                                 True);
 588                 }
 589 #ifdef HAVE_ADS
 590                 else {
 591                         struct GUID domain_guid;
 592                         UUID_FLAT flat_guid;
 593                         char *domain;
 594                         char *hostname;
 595                         char *component, *dc, *q1;
 596                         char *q_orig = q;
 597                         int str_offset;
 598                         char *saveptr = NULL;
 599
 600                         domain = get_mydnsdomname(talloc_tos());
 601                         if (!domain) {
 602                                 DEBUG(2,
 603                                 ("get_mydnsdomname failed.\n"));
 604                                 return;
 605                         }
 606                         hostname = get_myname(talloc_tos());
 607                         if (!hostname) {
 608                                 DEBUG(2,
 609                                 ("get_myname failed.\n"));
 610                                 return;
 611                         }
 612
 613                         if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 8) {
 614                                 return;
 615                         }
 616                         if (SVAL(uniuser, 0) == 0) {
 617                                 SIVAL(q, 0, LOGON_SAM_LOGON_USER_UNKNOWN_EX);   /* user unknown */
 618                         } else {
 619                                 SIVAL(q, 0, LOGON_SAM_LOGON_RESPONSE_EX);
 620                         }
 621                         q += 4;
 622
 623                         SIVAL(q, 0, NBT_SERVER_PDC|NBT_SERVER_GC|NBT_SERVER_LDAP|NBT_SERVER_DS|
 624                                 NBT_SERVER_KDC|NBT_SERVER_TIMESERV|NBT_SERVER_CLOSEST|NBT_SERVER_WRITABLE);
 625                         q += 4;
 626
 627                         /* Push Domain GUID */
 628                         if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < UUID_FLAT_SIZE) {
 629                                 return;
 630                         }
 631                         if (False == secrets_fetch_domain_guid(domain, &domain_guid)) {
 632                                 DEBUG(2, ("Could not fetch DomainGUID for %s\n", domain));
 633                                 return;
 634                         }
 635
 636                         smb_uuid_pack(domain_guid, &flat_guid);
 637                         memcpy(q, &flat_guid.info, UUID_FLAT_SIZE);
 638                         q += UUID_FLAT_SIZE;
 639
 640                         /* Forest */
 641                         str_offset = q - q_orig;
 642                         dc = domain;
 643                         q1 = q;
 644                         while ((component = strtok_r(dc, ".", &saveptr)) != NULL) {
 645                                 dc = NULL;
 646                                 if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 1) {
 647                                         return;
 648                                 }
 649                                 size = push_ascii(&q[1], component,
 650                                         sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
 651                                         0);
 652                                 if (size == (size_t)-1 || size > 0xff) {
 653                                         return;
 654                                 }
 655                                 SCVAL(q, 0, size);
 656                                 q += (size + 1);
 657                         }
 658
 659                         /* Unk0 */
 660                         if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 4) {
 661                                 return;
 662                         }
 663                         SCVAL(q, 0, 0);
 664                         q++;
 665
 666                         /* Domain */
 667                         SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F));
 668                         SCVAL(q, 1, str_offset & 0xFF);
 669                         q += 2;
 670
 671                         /* Hostname */
 672                         size = push_ascii(&q[1], hostname,
 673                                         sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
 674                                         0);
 675                         if (size == (size_t)-1 || size > 0xff) {
 676                                 return;
 677                         }
 678                         SCVAL(q, 0, size);
 679                         q += (size + 1);
 680
 681                         if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 3) {
 682                                 return;
 683                         }
 684
 685                         SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F));
 686                         SCVAL(q, 1, str_offset & 0xFF);
 687                         q += 2;
 688
 689                         /* NETBIOS of domain */
 690                         size = push_ascii(&q[1], lp_workgroup(),
 691                                         sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
 692                                         STR_UPPER);
 693                         if (size == (size_t)-1 || size > 0xff) {
 694                                 return;
 695                         }
 696                         SCVAL(q, 0, size);
 697                         q += (size + 1);
 698
 699                         /* Unk1 */
 700                         if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 2) {
 701                                 return;
 702                         }
 703
 704                         SCVAL(q, 0, 0);
 705                         q++;
 706
 707                         /* NETBIOS of hostname */
 708                         size = push_ascii(&q[1], my_name,
 709                                         sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
 710                                         0);
 711                         if (size == (size_t)-1 || size > 0xff) {
 712                                 return;
 713                         }
 714                         SCVAL(q, 0, size);
 715                         q += (size + 1);
 716
 717                         /* Unk2 */
 718                         if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 4) {
 719                                 return;
 720                         }
 721
 722                         SCVAL(q, 0, 0);
 723                         q++;
 724
 725                         /* User name */
 726                         if (SVAL(uniuser, 0) != 0) {
 727                                 size = push_ascii(&q[1], ascuser,
 728                                         sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
 729                                         0);
 730                                 if (size == (size_t)-1 || size > 0xff) {
 731                                         return;
 732                                 }
 733                                 SCVAL(q, 0, size);
 734                                 q += (size + 1);
 735                         }
 736
 737                         q_orig = q;
 738                         /* Site name */
 739                         if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 1) {
 740                                 return;
 741                         }
 742                         size = push_ascii(&q[1], "Default-First-Site-Name",
 743                                         sizeof(outbuf) - PTR_DIFF(q+1, outbuf),
 744                                         0);
 745                         if (size == (size_t)-1 || size > 0xff) {
 746                                 return;
 747                         }
 748                         SCVAL(q, 0, size);
 749                         q += (size + 1);
 750
 751                         if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 18) {
 752                                 return;
 753                         }
 754
 755                         /* Site name (2) */
 756                         str_offset = q - q_orig;
 757                         SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F));
 758                         SCVAL(q, 1, str_offset & 0xFF);
 759                         q += 2;
 760
 761                         SCVAL(q, 0, PTR_DIFF(q,q1));
 762                         SCVAL(q, 1, 0x10); /* unknown */
 763
 764                         SIVAL(q, 0, 0x00000002);
 765                         q += 4; /* unknown */
 766                         SIVAL(q, 0, ntohl(ip.s_addr));
 767                         q += 4;
 768                         SIVAL(q, 0, 0x00000000);
 769                         q += 4; /* unknown */
 770                         SIVAL(q, 0, 0x00000000);
 771                         q += 4; /* unknown */
 772                 }
 773 #endif
 774
 775                 if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 8) {
 776                         return;
 777                 }
 778
 779                 /* tell the client what version we are */
 780                 SIVAL(q, 0, ((ntversion < 11) || (SEC_ADS != lp_security())) ? 1 : 13);
 781                 /* our ntversion */
 782                 SSVAL(q, 4, 0xffff); /* our lmnttoken */
 783                 SSVAL(q, 6, 0xffff); /* our lm20token */
 784                 q += 8;
 785
 786                 dump_data(4, (uint8 *)outbuf, PTR_DIFF(q, outbuf));
 787
 788                 pull_ascii_fstring(getdc_str, getdc);
 789                 source_addr = SMB_STRDUP(inet_ntoa(dgram->header.source_ip));
 790                 if (source_addr == NULL) {
 791                         DEBUG(3, ("out of memory copying client"
 792                                   " address string\n"));
 793                         return;
 794                 }
 795
 796                 /*
 797                  * handle delay.
 798                  * packets requeued after delay are marked as
 799                  * locked.
 800                  */
 801                 if ((p->locked == False) &&
 802                     (strlen(ascuser) == 0) &&
 803                     delay_logon(source_name, source_addr))
 804                 {
 805                         struct timeval when;
 806
 807                         DEBUG(3, ("process_logon_packet: "
 808                                   "delaying initial logon "
 809                                   "reply for client %s(%s) for "
 810                                   "%u milliseconds\n",
 811                                   source_name, source_addr,
 812                                   lp_init_logon_delay()));
 813
 814                         when = timeval_current_ofs(0,
 815                                 lp_init_logon_delay() * 1000);
 816                         p->locked = true;
 817                         event_add_timed(nmbd_event_context(),
 818                                         NULL,
 819                                         when,
 820                                         delayed_init_logon_handler,
 821                                         p);
 822                 } else {
 823                         DEBUG(3, ("process_logon_packet: "
 824                                   "processing delayed initial "
 825                                   "logon reply for client "
 826                                   "%s(%s)\n",
 827                                   source_name, source_addr));
 828
 829                         p->locked = false;
 830                         send_mailslot(true, getdc,
 831                                 outbuf,PTR_DIFF(q,outbuf),
 832                                 global_myname(), 0x0,
 833                                 source_name,
 834                                 dgram->source_name.name_type,
 835                                 p->ip, ip, p->port);
 836                 }
 837
 838                 SAFE_FREE(source_addr);
 839
 840                 break;
 841         }
 842
 843         /* Announce change to UAS or SAM.  Send by the domain controller when a
 844         replication event is required. */
 845
 846         case NETLOGON_ANNOUNCE_UAS:
 847                 DEBUG(5, ("Got NETLOGON_ANNOUNCE_UAS\n"));
 848                 break;
 849
 850         default:
 851                 DEBUG(3,("process_logon_packet: Unknown domain request %d\n",
 852                         request.command));
 853                 return;
 854         }
 855 }