s3: Fetch the machinepw via ldapi in pdb_ads

diff --git a/source3/auth/auth_netlogond.c b/source3/auth/auth_netlogond.c
index 1e3ccb1189d2120f59d34bfe852040293229ea34..cff36a535d1df33650a35127fea8e202c16ce626 100644 (file)
--- a/source3/auth/auth_netlogond.c
+++ b/source3/auth/auth_netlogond.c
@@ -22,6 +22,8 @@
 #include "../librpc/gen_ndr/ndr_netlogon.h"
 #include "rpc_client/cli_netlogon.h"
 #include "secrets.h"
+#include "tldap.h"
+#include "tldap_util.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
@@ -107,51 +109,125 @@ static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
        return NT_STATUS_OK;
 }
 
-static char *mymachinepw(TALLOC_CTX *mem_ctx)
+static NTSTATUS get_ldapi_ctx(TALLOC_CTX *mem_ctx, struct tldap_context **pld)
 {
-       fstring pwd;
-       const char *script;
-       char *to_free = NULL;
-       ssize_t nread;
-       int ret, fd;
-
-       script = lp_parm_const_string(
-               GLOBAL_SECTION_SNUM, "auth_netlogond", "machinepwscript",
-               NULL);
-
-       if (script == NULL) {
-               to_free = talloc_asprintf(talloc_tos(), "%s/%s",
-                                         get_dyn_SBINDIR(), "mymachinepw");
-               script = to_free;
-       }
-       if (script == NULL) {
-               return NULL;
+       struct tldap_context *ld;
+       struct sockaddr_un addr;
+       char *sockaddr;
+       int fd;
+       NTSTATUS status;
+       int res;
+
+       sockaddr = talloc_asprintf(talloc_tos(), "/%s/ldap_priv/ldapi",
+                                  lp_private_dir());
+       if (sockaddr == NULL) {
+               DEBUG(10, ("talloc failed\n"));
+               return NT_STATUS_NO_MEMORY;
        }
 
-       ret = smbrun(script, &fd);
-       DEBUG(ret ? 0 : 3, ("mymachinepw: Running the command `%s' gave %d\n",
-                           script, ret));
-       TALLOC_FREE(to_free);
+       ZERO_STRUCT(addr);
+       addr.sun_family = AF_UNIX;
+       strncpy(addr.sun_path, sockaddr, sizeof(addr.sun_path));
+       TALLOC_FREE(sockaddr);
 
-       if (ret != 0) {
-               return NULL;
+       status = open_socket_out((struct sockaddr_storage *)(void *)&addr,
+                                0, 0, &fd);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(10, ("Could not connect to %s: %s\n", addr.sun_path,
+                          nt_errstr(status)));
+               return status;
        }
+       set_blocking(fd, false);
 
-       nread = read(fd, pwd, sizeof(pwd)-1);
-       close(fd);
+       ld = tldap_context_create(mem_ctx, fd);
+       if (ld == NULL) {
+               close(fd);
+               return NT_STATUS_NO_MEMORY;
+       }
+       res = tldap_fetch_rootdse(ld);
+       if (res != TLDAP_SUCCESS) {
+               DEBUG(10, ("tldap_fetch_rootdse failed: %s\n",
+                          tldap_errstr(talloc_tos(), ld, res)));
+               TALLOC_FREE(ld);
+               return NT_STATUS_LDAP(res);
+       }
+       *pld = ld;
+       return NT_STATUS_OK;;
+}
+
+static NTSTATUS mymachinepw(uint8_t pwd[16])
+{
+       TALLOC_CTX *frame = talloc_stackframe();
+       struct tldap_context *ld;
+       struct tldap_message *rootdse, **msg;
+       const char *attrs[1] = { "unicodePwd" };
+       char *default_nc, *myname;
+       int rc, num_msg;
+       DATA_BLOB pwdblob;
+       NTSTATUS status;
 
-       if (nread <= 0) {
-               DEBUG(3, ("mymachinepwd: Could not read password\n"));
-               return NULL;
+       status = get_ldapi_ctx(talloc_tos(), &ld);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto fail;
+       }
+       rootdse = tldap_rootdse(ld);
+       if (rootdse == NULL) {
+               DEBUG(10, ("Could not get rootdse\n"));
+               status = NT_STATUS_INTERNAL_ERROR;
+               goto fail;
+       }
+       default_nc = tldap_talloc_single_attribute(
+               rootdse, "defaultNamingContext", talloc_tos());
+       if (default_nc == NULL) {
+               DEBUG(10, ("Could not get defaultNamingContext\n"));
+               status = NT_STATUS_NO_MEMORY;
+               goto fail;
        }
+       DEBUG(10, ("default_nc = %s\n", default_nc));
 
-       pwd[nread] = '\0';
+       myname = talloc_asprintf_strupper_m(talloc_tos(), "%s$",
+                                           global_myname());
+       if (myname == NULL) {
+               DEBUG(10, ("talloc failed\n"));
+               status = NT_STATUS_NO_MEMORY;
+               goto fail;
+       }
 
-       if (pwd[nread-1] == '\n') {
-               pwd[nread-1] = '\0';
+       rc = tldap_search_fmt(
+               ld, default_nc, TLDAP_SCOPE_SUB, attrs, ARRAY_SIZE(attrs), 0,
+               talloc_tos(), &msg,
+               "(&(sAMAccountName=%s)(objectClass=computer))", myname);
+       if (rc != TLDAP_SUCCESS) {
+               DEBUG(10, ("Could not retrieve our account: %s\n",
+                          tldap_errstr(talloc_tos(), ld, rc)));
+               status = NT_STATUS_LDAP(rc);
+               goto fail;
+       }
+       num_msg = talloc_array_length(msg);
+       if (num_msg != 1) {
+               DEBUG(10, ("Got %d accounts, expected one\n", num_msg));
+               status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+               goto fail;
+       }
+       if (!tldap_get_single_valueblob(msg[0], "unicodePwd", &pwdblob)) {
+               char *dn = NULL;
+               tldap_entry_dn(msg[0], &dn);
+               DEBUG(10, ("No unicodePwd attribute in %s\n",
+                          dn ? dn : "<unknown DN>"));
+               status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+               goto fail;
        }
+       if (pwdblob.length != 16) {
+               DEBUG(10, ("Password hash hash has length %d, expected 16\n",
+                          (int)pwdblob.length));
+               status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+               goto fail;
+       }
+       memcpy(pwd, pwdblob.data, 16);
 
-       return talloc_strdup(mem_ctx, pwd);
+fail:
+       TALLOC_FREE(frame);
+       return status;
 }
 
 static NTSTATUS check_netlogond_security(const struct auth_context *auth_context,
@@ -165,7 +241,6 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
        struct rpc_pipe_client *p = NULL;
        struct pipe_auth_data *auth = NULL;
        uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
-       char *plaintext_machinepw = NULL;
        uint8_t machine_password[16];
        uint8_t schannel_key[16];
        NTSTATUS schannel_bind_result, status;
@@ -241,16 +316,12 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
                goto done;
        }
 
-       plaintext_machinepw = mymachinepw(talloc_tos());
-       if (plaintext_machinepw == NULL) {
-               status = NT_STATUS_NO_MEMORY;
+       status = mymachinepw(machine_password);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(10, ("mymachinepw failed: %s\n", nt_errstr(status)));
                goto done;
        }
 
-       E_md4hash(plaintext_machinepw, machine_password);
-
-       TALLOC_FREE(plaintext_machinepw);
-
        status = rpccli_netlogon_setup_creds(
                p, global_myname(), lp_workgroup(), global_myname(),
                global_myname(), machine_password, SEC_CHAN_BDC, &neg_flags);