source4/librpc/rpc/dcerpc_schannel.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    dcerpc schannel operations
   5
   6    Copyright (C) Andrew Tridgell 2004
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth/auth.h"
  26
  27 /*
  28   get a schannel key using a netlogon challenge on a secondary pipe
  29 */
  30 static NTSTATUS dcerpc_schannel_key(TALLOC_CTX *tmp_ctx,
  31                                     struct dcerpc_pipe *p,
  32                                     struct cli_credentials *credentials)
  33 {
  34         NTSTATUS status;
  35         struct dcerpc_binding *b;
  36         struct dcerpc_pipe *p2;
  37         struct netr_ServerReqChallenge r;
  38         struct netr_ServerAuthenticate2 a;
  39         struct netr_Credential credentials1, credentials2, credentials3;
  40         const struct samr_Password *mach_pwd;
  41         uint32_t negotiate_flags;
  42         struct creds_CredentialState *creds;
  43         creds = talloc(tmp_ctx, struct creds_CredentialState);
  44         if (!creds) {
  45                 return NT_STATUS_NO_MEMORY;
  46         }
  47
  48         if (p->conn->flags & DCERPC_SCHANNEL_128) {
  49                 negotiate_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
  50         } else {
  51                 negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
  52         }
  53
  54         /*
  55           step 1 - establish a netlogon connection, with no authentication
  56         */
  57
  58         /* Find the original binding string */
  59         status = dcerpc_parse_binding(tmp_ctx, p->conn->binding_string, &b);
  60         if (!NT_STATUS_IS_OK(status)) {
  61                 DEBUG(0,("Failed to parse dcerpc binding '%s'\n", p->conn->binding_string));
  62                 return status;
  63         }
  64
  65         /* Make binding string for netlogon, not the other pipe */
  66         status = dcerpc_epm_map_binding(tmp_ctx, b,
  67                                                                         &dcerpc_table_netlogon,
  68                                         p->conn->event_ctx);
  69         if (!NT_STATUS_IS_OK(status)) {
  70                 DEBUG(0,("Failed to map DCERPC/TCP NCACN_NP pipe for '%s' - %s\n",
  71                          DCERPC_NETLOGON_UUID, nt_errstr(status)));
  72                 return status;
  73         }
  74
  75         status = dcerpc_secondary_connection(p, &p2, b);
  76         if (!NT_STATUS_IS_OK(status)) {
  77                 return status;
  78         }
  79
  80         status = dcerpc_bind_auth_none(p2, &dcerpc_table_netlogon);
  81         if (!NT_STATUS_IS_OK(status)) {
  82                 talloc_free(p2);
  83                 return status;
  84         }
  85
  86         /*
  87           step 2 - request a netlogon challenge
  88         */
  89         r.in.server_name = talloc_asprintf(tmp_ctx, "\\\\%s", dcerpc_server_name(p));
  90         r.in.computer_name = cli_credentials_get_workstation(credentials);
  91         r.in.credentials = &credentials1;
  92         r.out.credentials = &credentials2;
  93
  94         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
  95
  96         status = dcerpc_netr_ServerReqChallenge(p2, tmp_ctx, &r);
  97         if (!NT_STATUS_IS_OK(status)) {
  98                 return status;
  99         }
 100
 101         /*
 102           step 3 - authenticate on the netlogon pipe
 103         */
 104         mach_pwd = cli_credentials_get_nt_hash(credentials, tmp_ctx);
 105
 106         creds_client_init(creds, &credentials1, &credentials2,
 107                           mach_pwd, &credentials3,
 108                           negotiate_flags);
 109
 110         a.in.server_name = r.in.server_name;
 111         a.in.account_name = cli_credentials_get_username(credentials);
 112         a.in.secure_channel_type =
 113                 cli_credentials_get_secure_channel_type(credentials);
 114         a.in.computer_name = cli_credentials_get_workstation(credentials);
 115         a.in.negotiate_flags = &negotiate_flags;
 116         a.out.negotiate_flags = &negotiate_flags;
 117         a.in.credentials = &credentials3;
 118         a.out.credentials = &credentials3;
 119
 120         status = dcerpc_netr_ServerAuthenticate2(p2, tmp_ctx, &a);
 121         if (!NT_STATUS_IS_OK(status)) {
 122                 return status;
 123         }
 124
 125         if (!creds_client_check(creds, a.out.credentials)) {
 126                 return NT_STATUS_UNSUCCESSFUL;
 127         }
 128
 129         cli_credentials_set_netlogon_creds(credentials, creds);
 130
 131         /*
 132           the schannel session key is now in creds.session_key
 133
 134           we no longer need the netlogon pipe open
 135         */
 136         talloc_free(p2);
 137
 138         return NT_STATUS_OK;
 139 }
 140
 141 NTSTATUS dcerpc_bind_auth_schannel(TALLOC_CTX *tmp_ctx,
 142                                    struct dcerpc_pipe *p,
 143                                    const struct dcerpc_interface_table *table,
 144                                    struct cli_credentials *credentials)
 145 {
 146         NTSTATUS status;
 147
 148         /* Fills in NETLOGON credentials */
 149         status = dcerpc_schannel_key(tmp_ctx,
 150                                      p, credentials);
 151
 152         if (!NT_STATUS_IS_OK(status)) {
 153                 DEBUG(1, ("Failed to setup credentials for account %s: %s\n",
 154                           cli_credentials_get_username(credentials),
 155                           nt_errstr(status)));
 156                 return status;
 157         }
 158
 159         return dcerpc_bind_auth(p, table, credentials, DCERPC_AUTH_TYPE_SCHANNEL,
 160                                 NULL);
 161 }
 162