source4/librpc/rpc/dcerpc_schannel.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    dcerpc schannel operations
   5
   6    Copyright (C) Andrew Tridgell 2004
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth/auth.h"
  26
  27 /*
  28   get a schannel key using a netlogon challenge on a secondary pipe
  29 */
  30 static NTSTATUS dcerpc_schannel_key(TALLOC_CTX *tmp_ctx,
  31                                     struct dcerpc_pipe *p,
  32                                     struct cli_credentials *credentials)
  33 {
  34         NTSTATUS status;
  35         struct dcerpc_binding *b;
  36         struct dcerpc_pipe *p2;
  37         struct netr_ServerReqChallenge r;
  38         struct netr_ServerAuthenticate2 a;
  39         struct netr_Credential credentials1, credentials2, credentials3;
  40         const struct samr_Password *mach_pwd;
  41         uint32_t negotiate_flags;
  42         struct creds_CredentialState *creds;
  43         creds = talloc(tmp_ctx, struct creds_CredentialState);
  44         if (!creds) {
  45                 return NT_STATUS_NO_MEMORY;
  46         }
  47
  48         if (p->conn->flags & DCERPC_SCHANNEL_128) {
  49                 negotiate_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
  50         } else {
  51                 negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
  52         }
  53
  54         /*
  55           step 1 - establish a netlogon connection, with no authentication
  56         */
  57
  58         b = talloc(tmp_ctx, struct dcerpc_binding);
  59         if (!b) {
  60                 return NT_STATUS_NO_MEMORY;
  61         }
  62         *b = *p->binding;
  63
  64         /* Make binding string for netlogon, not the other pipe */
  65         status = dcerpc_epm_map_binding(tmp_ctx, b,
  66                                         &dcerpc_table_netlogon,
  67                                         p->conn->event_ctx);
  68         if (!NT_STATUS_IS_OK(status)) {
  69                 DEBUG(0,("Failed to map DCERPC/TCP NCACN_NP pipe for '%s' - %s\n",
  70                          DCERPC_NETLOGON_UUID, nt_errstr(status)));
  71                 return status;
  72         }
  73
  74         status = dcerpc_secondary_connection(p, &p2, b);
  75         if (!NT_STATUS_IS_OK(status)) {
  76                 return status;
  77         }
  78
  79         status = dcerpc_bind_auth_none(p2, &dcerpc_table_netlogon);
  80         if (!NT_STATUS_IS_OK(status)) {
  81                 talloc_free(p2);
  82                 return status;
  83         }
  84
  85         /*
  86           step 2 - request a netlogon challenge
  87         */
  88         r.in.server_name = talloc_asprintf(tmp_ctx, "\\\\%s", dcerpc_server_name(p));
  89         r.in.computer_name = cli_credentials_get_workstation(credentials);
  90         r.in.credentials = &credentials1;
  91         r.out.credentials = &credentials2;
  92
  93         generate_random_buffer(credentials1.data, sizeof(credentials1.data));
  94
  95         status = dcerpc_netr_ServerReqChallenge(p2, tmp_ctx, &r);
  96         if (!NT_STATUS_IS_OK(status)) {
  97                 return status;
  98         }
  99
 100         /*
 101           step 3 - authenticate on the netlogon pipe
 102         */
 103         mach_pwd = cli_credentials_get_nt_hash(credentials, tmp_ctx);
 104
 105         creds_client_init(creds, &credentials1, &credentials2,
 106                           mach_pwd, &credentials3,
 107                           negotiate_flags);
 108
 109         a.in.server_name = r.in.server_name;
 110         a.in.account_name = cli_credentials_get_username(credentials);
 111         a.in.secure_channel_type =
 112                 cli_credentials_get_secure_channel_type(credentials);
 113         a.in.computer_name = cli_credentials_get_workstation(credentials);
 114         a.in.negotiate_flags = &negotiate_flags;
 115         a.out.negotiate_flags = &negotiate_flags;
 116         a.in.credentials = &credentials3;
 117         a.out.credentials = &credentials3;
 118
 119         status = dcerpc_netr_ServerAuthenticate2(p2, tmp_ctx, &a);
 120         if (!NT_STATUS_IS_OK(status)) {
 121                 return status;
 122         }
 123
 124         if (!creds_client_check(creds, a.out.credentials)) {
 125                 return NT_STATUS_UNSUCCESSFUL;
 126         }
 127
 128         cli_credentials_set_netlogon_creds(credentials, creds);
 129
 130         /*
 131           the schannel session key is now in creds.session_key
 132
 133           we no longer need the netlogon pipe open
 134         */
 135         talloc_free(p2);
 136
 137         return NT_STATUS_OK;
 138 }
 139
 140 NTSTATUS dcerpc_bind_auth_schannel(TALLOC_CTX *tmp_ctx,
 141                                    struct dcerpc_pipe *p,
 142                                    const struct dcerpc_interface_table *table,
 143                                    struct cli_credentials *credentials,
 144                                    uint8_t auth_level)
 145 {
 146         NTSTATUS status;
 147
 148         /* Fills in NETLOGON credentials */
 149         status = dcerpc_schannel_key(tmp_ctx,
 150                                      p, credentials);
 151
 152         if (!NT_STATUS_IS_OK(status)) {
 153                 DEBUG(1, ("Failed to setup credentials for account %s: %s\n",
 154                           cli_credentials_get_username(credentials),
 155                           nt_errstr(status)));
 156                 return status;
 157         }
 158
 159         return dcerpc_bind_auth(p, table, credentials,
 160                                 DCERPC_AUTH_TYPE_SCHANNEL, auth_level,
 161                                 NULL);
 162 }
 163