endpoint server for the netlogon pipe
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
+ Copyright (C) Stefan Metzmacher <metze@samba.org> 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
*/
#include "includes.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "rpc_server/dcerpc_server.h"
#include "rpc_server/common/common.h"
+#include "librpc/gen_ndr/ndr_dcom.h"
+#include "auth/auth.h"
+#include "lib/ldb/include/ldb.h"
struct server_pipe_state {
- TALLOC_CTX *mem_ctx;
struct netr_Credential client_challenge;
struct netr_Credential server_challenge;
- BOOL authenticated;
- char *account_name;
- char *computer_name; /* for logging only */
- uint32_t acct_flags;
- uint16_t sec_chan_type;
struct creds_CredentialState *creds;
};
{
struct server_pipe_state *state;
NTSTATUS status;
- TALLOC_CTX *mem_ctx;
- mem_ctx = talloc_init("netlogon_bind");
- if (!mem_ctx) {
- return NT_STATUS_NO_MEMORY;
- }
- state = talloc_p(mem_ctx, struct server_pipe_state);
+ state = talloc(dce_call->conn, struct server_pipe_state);
if (state == NULL) {
- talloc_destroy(mem_ctx);
- }
- ZERO_STRUCTP(state);
- state->mem_ctx = mem_ctx;
- state->authenticated = True;
-
- state->creds = talloc_p(mem_ctx, struct creds_CredentialState);
- if (state->creds == NULL) {
- talloc_destroy(mem_ctx);
return NT_STATUS_NO_MEMORY;
}
- ZERO_STRUCTP(state->creds);
+ ZERO_STRUCTP(state);
if (dce_call->conn->auth_state.session_info == NULL) {
- talloc_destroy(mem_ctx);
+ talloc_free(state);
+ smb_panic("No session info provided by schannel level setup!");
return NT_STATUS_NO_USER_SESSION_KEY;
}
- status = schannel_fetch_session_key(mem_ctx,
- dce_call->conn->auth_state.session_info->workstation,
- state->creds);
+ status = dcerpc_schannel_creds(dce_call->conn->auth_state.gensec_security,
+ state,
+ &state->creds);
+
if (!NT_STATUS_IS_OK(status)) {
- talloc_destroy(mem_ctx);
+ DEBUG(3, ("getting schannel credentials failed with %s\n", nt_errstr(status)));
+ talloc_free(state);
return status;
}
- dce_call->conn->private = state;
+ dce_call->context->private = state;
return NT_STATUS_OK;
}
*/
static NTSTATUS netlogon_bind(struct dcesrv_call_state *dce_call, const struct dcesrv_interface *di)
{
- dce_call->conn->private = NULL;
+ dce_call->context->private = NULL;
/* if this is a schannel bind then we need to reconstruct the pipe state */
if (dce_call->conn->auth_state.auth_info &&
dce_call->conn->auth_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
NTSTATUS status;
+ DEBUG(5, ("schannel bind on netlogon\n"));
+
status = netlogon_schannel_setup(dce_call);
if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(3, ("schannel bind on netlogon failed with %s\n", nt_errstr(status)));
return status;
}
}
return NT_STATUS_OK;
}
-/* this function is called when the client disconnects the endpoint */
-static void netlogon_unbind(struct dcesrv_connection *conn, const struct dcesrv_interface *di)
-{
- struct server_pipe_state *pipe_state = conn->private;
-
- if (pipe_state) {
- talloc_destroy(pipe_state->mem_ctx);
- }
-
- conn->private = NULL;
-}
-
#define DCESRV_INTERFACE_NETLOGON_BIND netlogon_bind
-#define DCESRV_INTERFACE_NETLOGON_UNBIND netlogon_unbind
static NTSTATUS netr_ServerReqChallenge(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
struct netr_ServerReqChallenge *r)
{
- struct server_pipe_state *pipe_state = dce_call->conn->private;
- TALLOC_CTX *pipe_mem_ctx;
+ struct server_pipe_state *pipe_state = dce_call->context->private;
ZERO_STRUCTP(r->out.credentials);
/* destroyed on pipe shutdown */
if (pipe_state) {
- talloc_destroy(pipe_state->mem_ctx);
- dce_call->conn->private = NULL;
+ talloc_free(pipe_state);
+ dce_call->context->private = NULL;
}
- pipe_mem_ctx = talloc_init("internal netlogon pipe state for %s",
- r->in.computer_name);
-
- if (!pipe_mem_ctx) {
- return NT_STATUS_NO_MEMORY;
- }
-
- pipe_state = talloc_p(pipe_mem_ctx, struct server_pipe_state);
+ pipe_state = talloc(dce_call->context, struct server_pipe_state);
if (!pipe_state) {
- talloc_destroy(pipe_mem_ctx);
return NT_STATUS_NO_MEMORY;
}
- pipe_state->mem_ctx = pipe_mem_ctx;
- pipe_state->authenticated = False;
pipe_state->creds = NULL;
- pipe_state->account_name = NULL;
- pipe_state->computer_name = NULL;
pipe_state->client_challenge = *r->in.credentials;
generate_random_buffer(pipe_state->server_challenge.data,
- sizeof(pipe_state->server_challenge.data),
- False);
+ sizeof(pipe_state->server_challenge.data));
*r->out.credentials = pipe_state->server_challenge;
- dce_call->conn->private = pipe_state;
+ dce_call->context->private = pipe_state;
return NT_STATUS_OK;
}
static NTSTATUS netr_ServerAuthenticate3(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
struct netr_ServerAuthenticate3 *r)
{
- struct server_pipe_state *pipe_state = dce_call->conn->private;
+ struct server_pipe_state *pipe_state = dce_call->context->private;
void *sam_ctx;
struct samr_Password *mach_pwd;
uint16_t acct_flags;
return NT_STATUS_ACCESS_DENIED;
}
- sam_ctx = samdb_connect();
+ sam_ctx = samdb_connect(mem_ctx);
if (sam_ctx == NULL) {
return NT_STATUS_INVALID_SYSTEM_SERVICE;
}
if (num_records == 0) {
DEBUG(3,("Couldn't find user [%s] in samdb.\n",
r->in.account_name));
- samdb_close(sam_ctx);
return NT_STATUS_NO_SUCH_USER;
}
if (num_records > 1) {
- DEBUG(1,("Found %d records matching user [%s]\n", num_records, r->in.account_name));
- samdb_close(sam_ctx);
+ DEBUG(0,("Found %d records matching user [%s]\n", num_records, r->in.account_name));
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
return NT_STATUS_ACCESS_DENIED;
}
- pipe_state->acct_flags = acct_flags;
- pipe_state->sec_chan_type = r->in.secure_channel_type;
*r->out.rid = samdb_result_rid_from_sid(mem_ctx, msgs[0], "objectSid", 0);
nt_status = samdb_result_passwords(mem_ctx, msgs[0], NULL, &mach_pwd);
if (!NT_STATUS_IS_OK(nt_status) || mach_pwd == NULL) {
- samdb_close(sam_ctx);
return NT_STATUS_ACCESS_DENIED;
}
- samdb_close(sam_ctx);
-
+ if (pipe_state->creds) {
+ talloc_free(pipe_state->creds);
+ }
+ pipe_state->creds = talloc(pipe_state, struct creds_CredentialState);
if (!pipe_state->creds) {
- pipe_state->creds = talloc_p(pipe_state->mem_ctx, struct creds_CredentialState);
- if (!pipe_state->creds) {
- return NT_STATUS_NO_MEMORY;
- }
+ return NT_STATUS_NO_MEMORY;
}
creds_server_init(pipe_state->creds, &pipe_state->client_challenge,
*r->in.negotiate_flags);
if (!creds_server_check(pipe_state->creds, r->in.credentials)) {
+ talloc_free(pipe_state->creds);
+ pipe_state->creds = NULL;
return NT_STATUS_ACCESS_DENIED;
}
- pipe_state->authenticated = True;
-
- if (pipe_state->account_name) {
- /* We don't want a memory leak on this long-lived talloc context */
- talloc_free(pipe_state->mem_ctx, pipe_state->account_name);
- }
-
- pipe_state->account_name = talloc_strdup(pipe_state->mem_ctx, r->in.account_name);
+ pipe_state->creds->account_name = talloc_reference(pipe_state->creds, r->in.account_name);
- if (pipe_state->computer_name) {
- /* We don't want a memory leak on this long-lived talloc context */
- talloc_free(pipe_state->mem_ctx, pipe_state->account_name);
- }
+ pipe_state->creds->computer_name = talloc_reference(pipe_state->creds, r->in.computer_name);
- pipe_state->computer_name = talloc_strdup(pipe_state->mem_ctx, r->in.computer_name);
+ pipe_state->creds->secure_channel_type = r->in.secure_channel_type;
/* remember this session key state */
- nt_status = schannel_store_session_key(mem_ctx, pipe_state->computer_name, pipe_state->creds);
+ nt_status = schannel_store_session_key(mem_ctx, pipe_state->creds);
return nt_status;
}
struct netr_ServerAuthenticate *r)
{
struct netr_ServerAuthenticate3 r3;
- uint32 negotiate_flags, rid;
+ uint32_t rid = 0;
+ /* TODO:
+ * negotiate_flags is used as an [in] parameter
+ * so it need to be initialised.
+ *
+ * (I think ... = 0; seems wrong here --metze)
+ */
+ uint32_t negotiate_flags = 0;
r3.in.server_name = r->in.server_name;
r3.in.account_name = r->in.account_name;
struct netr_ServerAuthenticate2 *r)
{
struct netr_ServerAuthenticate3 r3;
- uint32 rid;
+ uint32_t rid = 0;
r3.in.server_name = r->in.server_name;
r3.in.account_name = r->in.account_name;
}
-static BOOL netr_creds_server_step_check(struct server_pipe_state *pipe_state,
- struct netr_Authenticator *received_authenticator,
- struct netr_Authenticator *return_authenticator)
+static NTSTATUS netr_creds_server_step_check(struct server_pipe_state *pipe_state,
+ struct netr_Authenticator *received_authenticator,
+ struct netr_Authenticator *return_authenticator)
{
- if (!pipe_state->authenticated) {
- return False;
+ if (!pipe_state) {
+ DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+ return NT_STATUS_ACCESS_DENIED;
}
+
return creds_server_step_check(pipe_state->creds,
received_authenticator,
return_authenticator);
static NTSTATUS netr_ServerPasswordSet(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
struct netr_ServerPasswordSet *r)
{
- struct server_pipe_state *pipe_state = dce_call->conn->private;
+ struct server_pipe_state *pipe_state = dce_call->context->private;
void *sam_ctx;
int num_records;
struct ldb_message **msgs;
struct ldb_message **msgs_domain;
NTSTATUS nt_status;
- struct ldb_message mod, *msg_set_pw = &mod;
- const char *domain_dn;
+ struct ldb_message *mod;
const char *domain_sid;
const char *attrs[] = {"objectSid", NULL };
const char **domain_attrs = attrs;
- ZERO_STRUCT(mod);
- if (!pipe_state) {
- DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
- return NT_STATUS_ACCESS_DENIED;
- }
-
- if (!netr_creds_server_step_check(pipe_state, &r->in.credential, &r->out.return_authenticator)) {
- return NT_STATUS_ACCESS_DENIED;
- }
+ nt_status = netr_creds_server_step_check(pipe_state, &r->in.credential, &r->out.return_authenticator);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
- sam_ctx = samdb_connect();
+ sam_ctx = samdb_connect(mem_ctx);
if (sam_ctx == NULL) {
return NT_STATUS_INVALID_SYSTEM_SERVICE;
}
/* pull the user attributes */
num_records = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
"(&(sAMAccountName=%s)(objectclass=user))",
- pipe_state->account_name);
+ pipe_state->creds->account_name);
+ if (num_records == -1) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
if (num_records == 0) {
DEBUG(3,("Couldn't find user [%s] in samdb.\n",
- pipe_state->account_name));
- samdb_close(sam_ctx);
+ pipe_state->creds->account_name));
return NT_STATUS_NO_SUCH_USER;
}
if (num_records > 1) {
- DEBUG(1,("Found %d records matching user [%s]\n", num_records,
- pipe_state->account_name));
- samdb_close(sam_ctx);
+ DEBUG(0,("Found %d records matching user [%s]\n", num_records,
+ pipe_state->creds->account_name));
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
if (!domain_sid) {
- samdb_close(sam_ctx);
- DEBUG(1,("no objectSid in user record\n"));
+ DEBUG(0,("no objectSid in user record\n"));
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
&msgs_domain, domain_attrs,
"(&(objectSid=%s)(objectclass=domain))",
domain_sid);
+ if (num_records_domain == -1) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
if (num_records_domain == 0) {
- DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n",
+ DEBUG(3,("Couldn't find domain [%s] in samdb.\n",
domain_sid));
- samdb_close(sam_ctx);
return NT_STATUS_NO_SUCH_USER;
}
if (num_records_domain > 1) {
- DEBUG(1,("Found %d records matching domain [%s]\n",
+ DEBUG(0,("Found %d records matching domain [%s]\n",
num_records_domain, domain_sid));
- samdb_close(sam_ctx);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
- domain_dn = msgs_domain[0]->dn;
-
- mod.dn = talloc_strdup(mem_ctx, msgs[0]->dn);
- if (!mod.dn) {
- samdb_close(sam_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
+ mod = talloc_zero(mem_ctx, struct ldb_message);
+ NT_STATUS_HAVE_NO_MEMORY(mod);
+ mod->dn = talloc_reference(mod, msgs[0]->dn);
+
creds_des_decrypt(pipe_state->creds, &r->in.new_password);
/* set the password - samdb needs to know both the domain and user DNs,
so the domain password policy can be used */
- nt_status = samdb_set_password(sam_ctx, mem_ctx,
- msgs[0]->dn, domain_dn,
- msg_set_pw,
+ nt_status = samdb_set_password(sam_ctx, mod,
+ msgs[0]->dn,
+ msgs_domain[0]->dn,
+ mod,
NULL, /* Don't have plaintext */
NULL, &r->in.new_password,
- False /* This is not considered a password change */,
+ False, /* This is not considered a password change */
+ False, /* don't restrict this password change (match w2k3) */
NULL);
-
- if (!NT_STATUS_IS_OK(nt_status)) {
- samdb_close(sam_ctx);
- return nt_status;
- }
+ NT_STATUS_NOT_OK_RETURN(nt_status);
- ret = samdb_replace(sam_ctx, mem_ctx, msg_set_pw);
+ ret = samdb_replace(sam_ctx, mem_ctx, mod);
if (ret != 0) {
/* we really need samdb.c to return NTSTATUS */
-
- samdb_close(sam_ctx);
return NT_STATUS_UNSUCCESSFUL;
}
- samdb_close(sam_ctx);
return NT_STATUS_OK;
}
/*
- netr_LogonSamLogon
-
-
+ netr_LogonSamLogonWithFlags
+ This version of the function allows other wrappers to say 'do not check the credentials'
*/
-
-static NTSTATUS netr_LogonSamLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
- struct netr_LogonSamLogon *r)
+static NTSTATUS netr_LogonSamLogonEx(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+ struct netr_LogonSamLogonEx *r)
{
- struct server_pipe_state *pipe_state = dce_call->conn->private;
+ struct server_pipe_state *pipe_state = dce_call->context->private;
struct auth_context *auth_context;
struct auth_usersupplied_info *user_info;
NTSTATUS nt_status;
const uint8_t *chal;
static const char zeros[16];
+ struct netr_SamBaseInfo *sam;
struct netr_SamInfo2 *sam2;
- struct netr_SamInfo3 *sam;
+ struct netr_SamInfo3 *sam3;
+ struct netr_SamInfo6 *sam6;
- if (!pipe_state) {
- DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
- return NT_STATUS_ACCESS_DENIED;
- }
-
- r->out.return_authenticator = talloc_p(mem_ctx, struct netr_Authenticator);
- if (!r->out.return_authenticator) {
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!netr_creds_server_step_check(pipe_state, r->in.credential, r->out.return_authenticator)) {
- return NT_STATUS_ACCESS_DENIED;
- }
-
switch (r->in.logon_level) {
case 1:
case 3:
- creds_arcfour_crypt(pipe_state->creds,
- r->in.logon.password->lmpassword.hash,
- sizeof(r->in.logon.password->lmpassword.hash));
- creds_arcfour_crypt(pipe_state->creds,
- r->in.logon.password->ntpassword.hash,
- sizeof(r->in.logon.password->ntpassword.hash));
-
- nt_status = make_auth_context_subsystem(&auth_context);
- if (!NT_STATUS_IS_OK(nt_status)) {
- return nt_status;
+ case 5:
+ if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
+ creds_arcfour_crypt(pipe_state->creds,
+ r->in.logon.password->lmpassword.hash,
+ sizeof(r->in.logon.password->lmpassword.hash));
+ creds_arcfour_crypt(pipe_state->creds,
+ r->in.logon.password->ntpassword.hash,
+ sizeof(r->in.logon.password->ntpassword.hash));
+ } else {
+ creds_des_decrypt(pipe_state->creds, &r->in.logon.password->lmpassword);
+ creds_des_decrypt(pipe_state->creds, &r->in.logon.password->ntpassword);
}
- chal = auth_context->get_ntlm_challenge(auth_context);
- nt_status = make_user_info_netlogon_interactive(&user_info,
+ /* TODO: we need to deny anonymous access here */
+ nt_status = auth_context_create(mem_ctx, lp_auth_methods(), &auth_context);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+
+ nt_status = auth_get_challenge(auth_context, &chal);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+
+ nt_status = make_user_info_netlogon_interactive(mem_ctx,
r->in.logon.password->identity_info.account_name.string,
r->in.logon.password->identity_info.domain_name.string,
r->in.logon.password->identity_info.workstation.string,
chal,
&r->in.logon.password->lmpassword,
- &r->in.logon.password->ntpassword);
- break;
-
+ &r->in.logon.password->ntpassword,
+ &user_info);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+ break;
case 2:
case 6:
- nt_status = make_auth_context_fixed(&auth_context, r->in.logon.network->challenge);
- if (!NT_STATUS_IS_OK(nt_status)) {
- return nt_status;
- }
+ /* TODO: we need to deny anonymous access here */
+ nt_status = auth_context_create(mem_ctx, lp_auth_methods(), &auth_context);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
- nt_status = make_user_info_netlogon_network(&user_info,
+ nt_status = auth_context_set_challenge(auth_context, r->in.logon.network->challenge, "netr_LogonSamLogonWithFlags");
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+
+ nt_status = make_user_info_netlogon_network(auth_context,
r->in.logon.network->identity_info.account_name.string,
r->in.logon.network->identity_info.domain_name.string,
r->in.logon.network->identity_info.workstation.string,
r->in.logon.network->lm.data, r->in.logon.network->lm.length,
- r->in.logon.network->nt.data, r->in.logon.network->nt.length);
+ r->in.logon.network->nt.data, r->in.logon.network->nt.length,
+ &user_info);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
break;
default:
- free_auth_context(&auth_context);
return NT_STATUS_INVALID_PARAMETER;
}
- if (!NT_STATUS_IS_OK(nt_status)) {
- return nt_status;
- }
+ nt_status = auth_check_password(auth_context, mem_ctx, user_info, &server_info);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
- nt_status = auth_context->check_ntlm_password(auth_context,
- user_info,
- &server_info);
-
- if (!NT_STATUS_IS_OK(nt_status)) {
- free_auth_context(&auth_context);
- return nt_status;
- }
- free_auth_context(&auth_context);
+ sam = talloc_zero(mem_ctx, struct netr_SamBaseInfo);
+ NT_STATUS_HAVE_NO_MEMORY(sam);
- sam = talloc_p(mem_ctx, struct netr_SamInfo3);
-
sam->last_logon = server_info->last_logon;
sam->last_logoff = server_info->last_logoff;
sam->acct_expiry = server_info->acct_expiry;
sam->last_password_change = server_info->last_password_change;
sam->allow_password_change = server_info->allow_password_change;
sam->force_password_change = server_info->force_password_change;
-
- sam->account_name.string = talloc_strdup(mem_ctx, server_info->account_name);
- sam->full_name.string = talloc_strdup(mem_ctx, server_info->full_name);
- sam->logon_script.string = talloc_strdup(mem_ctx, server_info->account_name);
- sam->profile_path.string = talloc_strdup(mem_ctx, server_info->profile_path);
- sam->home_directory.string = talloc_strdup(mem_ctx, server_info->home_directory);
- sam->home_drive.string = talloc_strdup(mem_ctx, server_info->home_drive);
-
+
+ sam->account_name.string = server_info->account_name;
+ sam->full_name.string = server_info->full_name;
+ sam->logon_script.string = server_info->logon_script;
+ sam->profile_path.string = server_info->profile_path;
+ sam->home_directory.string = server_info->home_directory;
+ sam->home_drive.string = server_info->home_drive;
+
sam->logon_count = server_info->logon_count;
sam->bad_password_count = sam->bad_password_count;
- sam->rid = server_info->user_sid->sub_auths[server_info->user_sid->num_auths-1];
+ sam->rid = server_info->account_sid->sub_auths[server_info->account_sid->num_auths-1];
sam->primary_gid = server_info->primary_group_sid->sub_auths[server_info->primary_group_sid->num_auths-1];
sam->group_count = 0;
sam->groupids = NULL;
-
+ sam->user_flags = 0; /* TODO: w2k3 uses 0x120 - what is this? */
sam->acct_flags = server_info->acct_flags;
-
sam->logon_server.string = lp_netbios_name();
-
- sam->domain.string = talloc_strdup(mem_ctx, server_info->domain);
-
- sam->domain_sid = dom_sid_dup(mem_ctx, server_info->user_sid);
- sam->domain_sid->num_auths--;
+ sam->domain.string = server_info->domain_name;
- sam->AccountControl = 0;
+ sam->domain_sid = dom_sid_dup(mem_ctx, server_info->account_sid);
+ NT_STATUS_HAVE_NO_MEMORY(sam->domain_sid);
+ sam->domain_sid->num_auths--;
- sam->unknown1 = 0;
- sam->unknown2 = 0;
- sam->unknown3 = 0;
- sam->unknown4 = 0;
- sam->unknown5 = 0;
- sam->unknown6 = 0;
- sam->unknown7 = 0;
+ ZERO_ARRAY(sam->unknown);
- sam->sidcount = 0;
- sam->sids = NULL;
-
+ ZERO_STRUCT(sam->key);
if (server_info->user_session_key.length == sizeof(sam->key.key)) {
memcpy(sam->key.key, server_info->user_session_key.data, sizeof(sam->key.key));
- } else {
- ZERO_STRUCT(sam->key.key);
}
-
+
/* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
- if (memcmp(sam->key.key, zeros,
- sizeof(sam->key.key)) != 0) {
- creds_arcfour_crypt(pipe_state->creds,
- sam->key.key,
- sizeof(sam->key.key));
+ /* It appears that level 6 is not individually encrypted */
+ if ((r->in.validation_level != 6)
+ && memcmp(sam->key.key, zeros,
+ sizeof(sam->key.key)) != 0) {
+
+ /* This key is sent unencrypted without the ARCFOUR flag set */
+ if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
+ creds_arcfour_crypt(pipe_state->creds,
+ sam->key.key,
+ sizeof(sam->key.key));
+ }
}
-
+
+ ZERO_STRUCT(sam->LMSessKey);
if (server_info->lm_session_key.length == sizeof(sam->LMSessKey.key)) {
memcpy(sam->LMSessKey.key, server_info->lm_session_key.data,
sizeof(sam->LMSessKey.key));
- } else {
- ZERO_STRUCT(sam->LMSessKey.key);
}
/* Don't crypt an all-zero key, it would give away the NETLOGON pipe session key */
- if (memcmp(sam->LMSessKey.key, zeros,
- sizeof(sam->LMSessKey.key)) != 0) {
- creds_arcfour_crypt(pipe_state->creds,
- sam->LMSessKey.key,
- sizeof(sam->LMSessKey.key));
+ /* It appears that level 6 is not individually encrypted */
+ if ((r->in.validation_level != 6)
+ && memcmp(sam->LMSessKey.key, zeros,
+ sizeof(sam->LMSessKey.key)) != 0) {
+ if (pipe_state->creds->negotiate_flags & NETLOGON_NEG_ARCFOUR) {
+ creds_arcfour_crypt(pipe_state->creds,
+ sam->LMSessKey.key,
+ sizeof(sam->LMSessKey.key));
+ } else {
+ creds_des_encrypt_LMKey(pipe_state->creds,
+ &sam->LMSessKey);
+ }
}
switch (r->in.validation_level) {
case 2:
- {
- sam2 = talloc_p(mem_ctx, struct netr_SamInfo2);
+ sam2 = talloc_zero(mem_ctx, struct netr_SamInfo2);
+ NT_STATUS_HAVE_NO_MEMORY(sam2);
+ sam2->base = *sam;
r->out.validation.sam2 = sam2;
- sam2->last_logon = sam->last_logon;
- sam2->last_logoff = sam->last_logoff;
- sam2->acct_expiry = sam->acct_expiry;
-
- sam2->last_password_change = sam->last_password_change;
- sam2->allow_password_change = sam->allow_password_change;
- sam2->force_password_change = sam->force_password_change;
-
- sam2->account_name = sam->account_name;
- sam2->full_name = sam->full_name;
- sam2->logon_script = sam->logon_script;
- sam2->profile_path = sam->profile_path;
- sam2->home_directory = sam->home_directory;
- sam2->home_drive = sam->home_drive;
-
- sam2->logon_count = sam->logon_count;
- sam2->bad_password_count = sam->bad_password_count;
- sam2->rid = sam->rid;
- sam2->primary_gid = sam->primary_gid;
- sam2->group_count = sam->group_count;
- sam2->groupids = sam->groupids;
-
- sam2->acct_flags = sam->acct_flags;
-
- sam2->key = sam->key;
-
- sam2->logon_server = sam->logon_server;
-
- sam2->domain = sam->domain;
-
- sam2->domain_sid = sam->domain_sid;
-
- sam2->LMSessKey = sam->LMSessKey;
-
- sam2->AccountControl = sam->AccountControl;
-
- sam2->unknown1 = sam->unknown1;
- sam2->unknown2 = sam->unknown2;
- sam2->unknown3 = sam->unknown3;
- sam2->unknown4 = sam->unknown4;
- sam2->unknown5 = sam->unknown5;
- sam2->unknown6 = sam->unknown6;
- sam2->unknown7 = sam->unknown7;
-
break;
- }
+
case 3:
- {
- r->out.validation.sam3 = sam;
+ sam3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
+ NT_STATUS_HAVE_NO_MEMORY(sam3);
+ sam3->base = *sam;
+ r->out.validation.sam3 = sam3;
break;
- }
+
+ case 6:
+ sam6 = talloc_zero(mem_ctx, struct netr_SamInfo6);
+ NT_STATUS_HAVE_NO_MEMORY(sam6);
+ sam6->base = *sam;
+ sam6->forest.string = lp_realm();
+ sam6->principle.string = talloc_asprintf(mem_ctx, "%s@%s",
+ sam->account_name.string, sam6->forest.string);
+ NT_STATUS_HAVE_NO_MEMORY(sam6->principle.string);
+ r->out.validation.sam6 = sam6;
+ break;
+
default:
break;
}
r->out.authoritative = 1;
+ /* TODO: Describe and deal with these flags */
+ r->out.flags = 0;
+
return NT_STATUS_OK;
}
+/*
+ netr_LogonSamLogonWithFlags
+
+*/
+static NTSTATUS netr_LogonSamLogonWithFlags(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+ struct netr_LogonSamLogonWithFlags *r)
+{
+ struct server_pipe_state *pipe_state = dce_call->context->private;
+ NTSTATUS nt_status;
+ struct netr_LogonSamLogonEx r2;
+
+ struct netr_Authenticator *return_authenticator;
+
+ return_authenticator = talloc(mem_ctx, struct netr_Authenticator);
+ NT_STATUS_HAVE_NO_MEMORY(return_authenticator);
+
+ nt_status = netr_creds_server_step_check(pipe_state, r->in.credential, return_authenticator);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+
+ ZERO_STRUCT(r2);
+
+ r2.in.server_name = r->in.server_name;
+ r2.in.workstation = r->in.workstation;
+ r2.in.logon_level = r->in.logon_level;
+ r2.in.logon = r->in.logon;
+ r2.in.validation_level = r->in.validation_level;
+ r2.in.flags = r->in.flags;
+
+ nt_status = netr_LogonSamLogonEx(dce_call, mem_ctx, &r2);
+
+ r->out.return_authenticator = return_authenticator;
+ r->out.validation = r2.out.validation;
+ r->out.authoritative = r2.out.authoritative;
+ r->out.flags = r2.out.flags;
+
+ return nt_status;
+}
+
+/*
+ netr_LogonSamLogon
+*/
+static NTSTATUS netr_LogonSamLogon(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+ struct netr_LogonSamLogon *r)
+{
+ struct netr_LogonSamLogonWithFlags r2;
+ NTSTATUS status;
+
+ ZERO_STRUCT(r2);
+
+ r2.in.server_name = r->in.server_name;
+ r2.in.workstation = r->in.workstation;
+ r2.in.credential = r->in.credential;
+ r2.in.return_authenticator = r->in.return_authenticator;
+ r2.in.logon_level = r->in.logon_level;
+ r2.in.logon = r->in.logon;
+ r2.in.validation_level = r->in.validation_level;
+ r2.in.flags = 0;
+
+ status = netr_LogonSamLogonWithFlags(dce_call, mem_ctx, &r2);
+
+ r->out.return_authenticator = r2.out.return_authenticator;
+ r->out.validation = r2.out.validation;
+ r->out.authoritative = r2.out.authoritative;
+
+ return status;
+}
+
+
/*
netr_LogonSamLogoff
*/
fill in a netr_DomainTrustInfo from a ldb search result
*/
static NTSTATUS fill_domain_trust_info(TALLOC_CTX *mem_ctx, struct ldb_message *res,
- struct netr_DomainTrustInfo *info)
+ struct netr_DomainTrustInfo *info, BOOL is_local)
{
ZERO_STRUCTP(info);
-
- info->domainname.string = samdb_result_string(res, "flatName", NULL);
- if (info->domainname.string == NULL) {
+
+ if (is_local) {
info->domainname.string = samdb_result_string(res, "name", NULL);
info->fulldomainname.string = samdb_result_string(res, "dnsDomain", NULL);
+ info->guid = samdb_result_guid(res, "objectGUID");
+ info->sid = samdb_result_dom_sid(mem_ctx, res, "objectSid");
} else {
+ info->domainname.string = samdb_result_string(res, "flatName", NULL);
info->fulldomainname.string = samdb_result_string(res, "name", NULL);
+ info->guid = samdb_result_guid(res, "objectGUID");
+ info->sid = samdb_result_dom_sid(mem_ctx, res, "securityIdentifier");
}
/* TODO: we need proper forest support */
info->forest.string = info->fulldomainname.string;
- info->guid = samdb_result_guid(res, "objectGUID");
- info->sid = samdb_result_dom_sid(mem_ctx, res, "objectSid");
-
return NT_STATUS_OK;
}
static NTSTATUS netr_LogonGetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
struct netr_LogonGetDomainInfo *r)
{
- struct server_pipe_state *pipe_state = dce_call->conn->private;
+ struct server_pipe_state *pipe_state = dce_call->context->private;
const char * const attrs[] = { "name", "dnsDomain", "objectSid",
- "objectGUID", "flatName", NULL };
+ "objectGUID", "flatName", "securityIdentifier",
+ NULL };
void *sam_ctx;
struct ldb_message **res1, **res2;
struct netr_DomainInfo1 *info1;
int ret1, ret2, i;
NTSTATUS status;
- if (!pipe_state) {
- return NT_STATUS_ACCESS_DENIED;
- }
-
- if (!netr_creds_server_step_check(pipe_state,
- r->in.credential, r->out.credential)) {
- return NT_STATUS_ACCESS_DENIED;
+ status = netr_creds_server_step_check(pipe_state,
+ r->in.credential, r->out.return_authenticator);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
}
- sam_ctx = samdb_connect();
+ sam_ctx = samdb_connect(mem_ctx);
if (sam_ctx == NULL) {
return NT_STATUS_INVALID_SYSTEM_SERVICE;
}
well */
ret1 = samdb_search(sam_ctx, mem_ctx, NULL, &res1, attrs, "(objectClass=domainDNS)");
if (ret1 != 1) {
- samdb_close(sam_ctx);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
ret2 = samdb_search(sam_ctx, mem_ctx, NULL, &res2, attrs, "(objectClass=trustedDomain)");
if (ret2 == -1) {
- samdb_close(sam_ctx);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
- /* we don't need the db link any more */
- samdb_close(sam_ctx);
-
- info1 = talloc_p(mem_ctx, struct netr_DomainInfo1);
+ info1 = talloc(mem_ctx, struct netr_DomainInfo1);
if (info1 == NULL) {
return NT_STATUS_NO_MEMORY;
}
ZERO_STRUCTP(info1);
info1->num_trusts = ret2 + 1;
- info1->trusts = talloc_array_p(mem_ctx, struct netr_DomainTrustInfo,
+ info1->trusts = talloc_array(mem_ctx, struct netr_DomainTrustInfo,
info1->num_trusts);
if (info1->trusts == NULL) {
return NT_STATUS_NO_MEMORY;
}
- status = fill_domain_trust_info(mem_ctx, res1[0], &info1->domaininfo);
+ status = fill_domain_trust_info(mem_ctx, res1[0], &info1->domaininfo, True);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- status = fill_domain_trust_info(mem_ctx, res1[0], &info1->trusts[0]);
+ status = fill_domain_trust_info(mem_ctx, res1[0], &info1->trusts[0], True);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
for (i=0;i<ret2;i++) {
- status = fill_domain_trust_info(mem_ctx, res2[i], &info1->trusts[i+1]);
+ status = fill_domain_trust_info(mem_ctx, res2[i], &info1->trusts[i+1], False);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
/*
- netr_NETRSERVERPASSWORDSET2
+ netr_ServerPasswordSet2
*/
-static WERROR netr_NETRSERVERPASSWORDSET2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
- struct netr_NETRSERVERPASSWORDSET2 *r)
+static NTSTATUS netr_ServerPasswordSet2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+ struct netr_ServerPasswordSet2 *r)
{
- DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+ struct server_pipe_state *pipe_state = dce_call->context->private;
+
+ void *sam_ctx;
+ int num_records;
+ int num_records_domain;
+ int ret;
+ struct ldb_message **msgs;
+ struct ldb_message **msgs_domain;
+ NTSTATUS nt_status;
+ struct ldb_message *mod;
+ const char *domain_sid;
+ char new_pass[512];
+ uint32_t new_pass_len;
+
+ const char *attrs[] = {"objectSid", NULL };
+
+ const char **domain_attrs = attrs;
+
+ nt_status = netr_creds_server_step_check(pipe_state, &r->in.credential, &r->out.return_authenticator);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+
+ sam_ctx = samdb_connect(mem_ctx);
+ if (sam_ctx == NULL) {
+ return NT_STATUS_INVALID_SYSTEM_SERVICE;
+ }
+ /* pull the user attributes */
+ num_records = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
+ "(&(sAMAccountName=%s)(objectclass=user))",
+ pipe_state->creds->account_name);
+ if (num_records == -1) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+
+ if (num_records == 0) {
+ DEBUG(3,("Couldn't find user [%s] in samdb.\n",
+ pipe_state->creds->account_name));
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ if (num_records > 1) {
+ DEBUG(0,("Found %d records matching user [%s]\n", num_records,
+ pipe_state->creds->account_name));
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+
+ domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
+ if (!domain_sid) {
+ DEBUG(0,("no objectSid in user record\n"));
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+
+ /* find the domain's DN */
+ num_records_domain = samdb_search(sam_ctx, mem_ctx, NULL,
+ &msgs_domain, domain_attrs,
+ "(&(objectSid=%s)(objectclass=domain))",
+ domain_sid);
+ if (num_records_domain == -1) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+
+ if (num_records_domain == 0) {
+ DEBUG(3,("Couldn't find domain [%s] in samdb.\n",
+ domain_sid));
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ if (num_records_domain > 1) {
+ DEBUG(0,("Found %d records matching domain [%s]\n",
+ num_records_domain, domain_sid));
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+
+ mod = talloc_zero(mem_ctx, struct ldb_message);
+ NT_STATUS_HAVE_NO_MEMORY(mod);
+ mod->dn = talloc_reference(mod, msgs[0]->dn);
+
+ creds_arcfour_crypt(pipe_state->creds, r->in.new_password.data, 516);
+
+ ret = decode_pw_buffer(r->in.new_password.data, new_pass, sizeof(new_pass),
+ &new_pass_len, STR_UNICODE);
+ if (!ret) {
+ DEBUG(3,("netr_ServerPasswordSet2: failed to decode password buffer\n"));
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ /* set the password - samdb needs to know both the domain and user DNs,
+ so the domain password policy can be used */
+ nt_status = samdb_set_password(sam_ctx, mod,
+ msgs[0]->dn,
+ msgs_domain[0]->dn,
+ mod, new_pass, /* we have plaintext */
+ NULL, NULL,
+ False, /* This is not considered a password change */
+ False, /* don't restrict this password change (match w2k3) */
+ NULL);
+ ZERO_ARRAY(new_pass);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+
+ ret = samdb_replace(sam_ctx, mem_ctx, mod);
+ if (ret != 0) {
+ /* we really need samdb.c to return NTSTATUS */
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ return NT_STATUS_OK;
}
/*
- netr_DSRGETDCNAMEEX2
+ netr_DrsGetDCNameEx2
*/
-static WERROR netr_DSRGETDCNAMEEX2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
- struct netr_DSRGETDCNAMEEX2 *r)
+static WERROR netr_DrsGetDCNameEx2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+ struct netr_DrsGetDCNameEx2 *r)
{
- DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+ const char * const attrs[] = { "dnsDomain", "objectGUID", NULL };
+ void *sam_ctx;
+ struct ldb_message **res;
+ int ret;
+
+ ZERO_STRUCT(r->out);
+
+ sam_ctx = samdb_connect(mem_ctx);
+ if (sam_ctx == NULL) {
+ return WERR_DS_SERVICE_UNAVAILABLE;
+ }
+
+ ret = samdb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
+ "(&(objectClass=domainDNS)(dnsDomain=%s))",
+ r->in.domain_name);
+ if (ret != 1) {
+ return WERR_NO_SUCH_DOMAIN;
+ }
+
+ r->out.info = talloc(mem_ctx, struct netr_DrsGetDCNameEx2Info);
+ if (!r->out.info) {
+ return WERR_NOMEM;
+ }
+
+ /* TODO: - return real IP address
+ * - check all r->in.* parameters (server_unc is ignored by w2k3!)
+ */
+ r->out.info->dc_unc = talloc_asprintf(mem_ctx, "\\\\%s.%s", lp_netbios_name(),lp_realm());
+ r->out.info->dc_address = talloc_strdup(mem_ctx, "\\\\0.0.0.0");
+ r->out.info->dc_address_type = 1;
+ r->out.info->domain_guid = samdb_result_guid(res[0], "objectGUID");
+ r->out.info->domain_name = samdb_result_string(res[0], "dnsDomain", NULL);
+ r->out.info->forest_name = samdb_result_string(res[0], "dnsDomain", NULL);
+ r->out.info->dc_flags = 0xE00001FD;
+ r->out.info->dc_site_name = talloc_strdup(mem_ctx, "Default-First-Site-Name");
+ r->out.info->client_site_name = talloc_strdup(mem_ctx, "Default-First-Site-Name");
+
+ return WERR_OK;
}
}
-/*
- netr_NETRLOGONSAMLOGONEX
-*/
-static WERROR netr_NETRLOGONSAMLOGONEX(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
- struct netr_NETRLOGONSAMLOGONEX *r)
-{
- DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
/*
netr_DsrEnumerateDomainTrusts
*/
ZERO_STRUCT(r->out);
- sam_ctx = samdb_connect();
+ sam_ctx = samdb_connect(mem_ctx);
if (sam_ctx == NULL) {
return WERR_GENERAL_FAILURE;
}
ret = samdb_search(sam_ctx, mem_ctx, NULL, &res, attrs, "(objectClass=domainDNS)");
if (ret == -1) {
- samdb_close(sam_ctx);
return WERR_GENERAL_FAILURE;
}
return WERR_OK;
}
- trusts = talloc_array_p(mem_ctx, struct netr_DomainTrust, ret);
+ trusts = talloc_array(mem_ctx, struct netr_DomainTrust, ret);
if (trusts == NULL) {
return WERR_NOMEM;
}
}
-/*
- netr_NETRLOGONSAMLOGONWITHFLAGS
-*/
-static WERROR netr_NETRLOGONSAMLOGONWITHFLAGS(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
- struct netr_NETRLOGONSAMLOGONWITHFLAGS *r)
-{
- DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
-}
-
-
/*
netr_NETRSERVERGETTRUSTINFO
*/
git.samba.org / nivanova / samba-autobuild / .git / blobdiff