s3: Fix auth_netlogond to cope with netlogon_creds_CredentialState

Autobuild-User: Volker Lendecke <vlendec@samba.org>
Autobuild-Date: Sun Feb  6 17:30:48 CET 2011 on sn-devel-104

diff --git a/source3/auth/auth_netlogond.c b/source3/auth/auth_netlogond.c
index cff36a535d1df33650a35127fea8e202c16ce626..854060b75d41501d330b23fad0481d78c3ae65eb 100644 (file)
--- a/source3/auth/auth_netlogond.c
+++ b/source3/auth/auth_netlogond.c
@@ -20,6 +20,7 @@
 #include "includes.h"
 #include "../libcli/auth/libcli_auth.h"
 #include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/gen_ndr/ndr_schannel.h"
 #include "rpc_client/cli_netlogon.h"
 #include "secrets.h"
 #include "tldap.h"
@@ -28,10 +29,65 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
 
+static bool secrets_store_local_schannel_creds(
+       const struct netlogon_creds_CredentialState *creds)
+{
+       DATA_BLOB blob;
+       enum ndr_err_code ndr_err;
+       bool ret;
+
+       ndr_err = ndr_push_struct_blob(
+               &blob, talloc_tos(), creds,
+               (ndr_push_flags_fn_t)ndr_push_netlogon_creds_CredentialState);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               DEBUG(10, ("ndr_push_netlogon_creds_CredentialState failed: "
+                          "%s\n", ndr_errstr(ndr_err)));
+               return false;
+       }
+       ret = secrets_store(SECRETS_LOCAL_SCHANNEL_KEY,
+                           blob.data, blob.length);
+       data_blob_free(&blob);
+       return ret;
+}
+
+static struct netlogon_creds_CredentialState *
+secrets_fetch_local_schannel_creds(TALLOC_CTX *mem_ctx)
+{
+       struct netlogon_creds_CredentialState *creds;
+       enum ndr_err_code ndr_err;
+       DATA_BLOB blob;
+
+       blob.data = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY,
+                                            &blob.length);
+       if (blob.data == NULL) {
+               DEBUG(10, ("secrets_fetch failed\n"));
+               return NULL;
+       }
+
+       creds = talloc(mem_ctx, struct netlogon_creds_CredentialState);
+       if (creds == NULL) {
+               DEBUG(10, ("talloc failed\n"));
+               SAFE_FREE(blob.data);
+               return NULL;
+       }
+       ndr_err = ndr_pull_struct_blob(
+               &blob, creds, creds,
+               (ndr_pull_flags_fn_t)ndr_pull_netlogon_creds_CredentialState);
+       SAFE_FREE(blob.data);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               DEBUG(10, ("ndr_pull_netlogon_creds_CredentialState failed: "
+                          "%s\n", ndr_errstr(ndr_err)));
+               TALLOC_FREE(creds);
+               return NULL;
+       }
+
+       return creds;
+}
+
 static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
                                   const struct auth_context *auth_context,
                                   const char *ncalrpc_sockname,
-                                  uint8_t schannel_key[16],
+                                  struct netlogon_creds_CredentialState *creds,
                                   const struct auth_usersupplied_info *user_info,
                                   struct netr_SamInfo3 **pinfo3,
                                   NTSTATUS *schannel_bind_result)
@@ -51,17 +107,7 @@ static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
                return status;
        }
 
-       /*
-        * We have to fake a struct dcinfo, so that
-        * rpccli_netlogon_sam_network_logon_ex can decrypt the session keys.
-        */
-
-       p->dc = netlogon_creds_client_init_session_key(p, schannel_key);
-       if (p->dc == NULL) {
-               DEBUG(0, ("talloc failed\n"));
-               TALLOC_FREE(p);
-               return NT_STATUS_NO_MEMORY;
-       }
+       p->dc = creds;
 
        status = rpccli_schannel_bind_data(p, lp_workgroup(),
                                           DCERPC_AUTH_LEVEL_PRIVACY,
@@ -242,7 +288,7 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
        struct pipe_auth_data *auth = NULL;
        uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
        uint8_t machine_password[16];
-       uint8_t schannel_key[16];
+       struct netlogon_creds_CredentialState *creds;
        NTSTATUS schannel_bind_result, status;
        struct named_mutex *mutex = NULL;
        const char *ncalrpcsock;
@@ -262,12 +308,13 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
                goto done;
        }
 
-       if (!secrets_fetch_local_schannel_key(schannel_key)) {
+       creds = secrets_fetch_local_schannel_creds(talloc_tos());
+       if (creds == NULL) {
                goto new_key;
        }
 
        status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
-                                   schannel_key, user_info, &info3,
+                                   creds, user_info, &info3,
                                    &schannel_bind_result);
 
        DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
@@ -322,6 +369,9 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
                goto done;
        }
 
+       DEBUG(10, ("machinepw "));
+       dump_data(10, machine_password, 16);
+
        status = rpccli_netlogon_setup_creds(
                p, global_myname(), lp_workgroup(), global_myname(),
                global_myname(), machine_password, SEC_CHAN_BDC, &neg_flags);
@@ -332,10 +382,7 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
                goto done;
        }
 
-       memcpy(schannel_key, p->dc->session_key, 16);
-       secrets_store_local_schannel_key(schannel_key);
-
-       TALLOC_FREE(p);
+       secrets_store_local_schannel_creds(p->dc);
 
        /*
         * Retry the authentication with the mutex held. This way nobody else
@@ -343,9 +390,11 @@ static NTSTATUS check_netlogond_security(const struct auth_context *auth_context
         */
 
        status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
-                                   schannel_key, user_info, &info3,
+                                   creds, user_info, &info3,
                                    &schannel_bind_result);
 
+       TALLOC_FREE(p);
+
        DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
 
        if (!NT_STATUS_IS_OK(status)) {

diff --git a/source3/include/secrets.h b/source3/include/secrets.h
index 095ab6ee78b96eac4b0cb9804a40be899bd1fce8..712065512663b0428ecfea5404be3bfb37bc624d 100644 (file)
--- a/source3/include/secrets.h
+++ b/source3/include/secrets.h
@@ -123,7 +123,5 @@ void secrets_fetch_ipc_userpass(char **username, char **domain, char **password)
 bool secrets_store_generic(const char *owner, const char *key, const char *secret);
 char *secrets_fetch_generic(const char *owner, const char *key);
 bool secrets_delete_generic(const char *owner, const char *key);
-bool secrets_store_local_schannel_key(uint8_t schannel_key[16]);
-bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16]);
 
 #endif /* _SECRETS_H */

diff --git a/source3/passdb/secrets.c b/source3/passdb/secrets.c
index 6571e6ef6ba572655f7c8aa871ebb73415891651..45f8e152be80a43aa3097e95dda18d81c60ef291 100644 (file)
--- a/source3/passdb/secrets.c
+++ b/source3/passdb/secrets.c
@@ -169,31 +169,6 @@ bool secrets_delete(const char *key)
        return NT_STATUS_IS_OK(status);
 }
 
-bool secrets_store_local_schannel_key(uint8_t schannel_key[16])
-{
-       return secrets_store(SECRETS_LOCAL_SCHANNEL_KEY, schannel_key, 16);
-}
-
-bool secrets_fetch_local_schannel_key(uint8_t schannel_key[16])
-{
-       size_t size = 0;
-       uint8_t *key;
-
-       key = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY, &size);
-       if (key == NULL) {
-               return false;
-       }
-
-       if (size != 16) {
-               SAFE_FREE(key);
-               return false;
-       }
-
-       memcpy(schannel_key, key, 16);
-       SAFE_FREE(key);
-       return true;
-}
-
 /**
  * Form a key for fetching a trusted domain password
  *