s3-netlogon: enable RPC-NETLOGON-ADMIN test against s3.
[ira/wip.git] / source3 / rpc_server / srv_netlog_nt.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  RPC Pipe client / server routines
4  *  Copyright (C) Andrew Tridgell              1992-1997,
5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6  *  Copyright (C) Paul Ashton                       1997.
7  *  Copyright (C) Jeremy Allison               1998-2001.
8  *  Copyright (C) Andrew Bartlett                   2001.
9  *  Copyright (C) Guenther Deschner                 2008-2009.
10  *
11  *  This program is free software; you can redistribute it and/or modify
12  *  it under the terms of the GNU General Public License as published by
13  *  the Free Software Foundation; either version 3 of the License, or
14  *  (at your option) any later version.
15  *
16  *  This program is distributed in the hope that it will be useful,
17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19  *  GNU General Public License for more details.
20  *
21  *  You should have received a copy of the GNU General Public License
22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
23  */
24
25 /* This is the implementation of the netlogon pipe. */
26
27 #include "includes.h"
28 #include "../libcli/auth/libcli_auth.h"
29 #include "../libcli/auth/schannel_state.h"
30 #include "../libcli/auth/schannel.h"
31
32 extern userdom_struct current_user_info;
33
34 #undef DBGC_CLASS
35 #define DBGC_CLASS DBGC_RPC_SRV
36
37 struct netlogon_server_pipe_state {
38         struct netr_Credential client_challenge;
39         struct netr_Credential server_challenge;
40 };
41
42 /*************************************************************************
43  _netr_LogonControl
44  *************************************************************************/
45
46 WERROR _netr_LogonControl(pipes_struct *p,
47                           struct netr_LogonControl *r)
48 {
49         struct netr_LogonControl2Ex l;
50
51         switch (r->in.level) {
52         case 1:
53                 break;
54         case 2:
55                 return WERR_NOT_SUPPORTED;
56         default:
57                 return WERR_UNKNOWN_LEVEL;
58         }
59
60         l.in.logon_server       = r->in.logon_server;
61         l.in.function_code      = r->in.function_code;
62         l.in.level              = r->in.level;
63         l.in.data               = NULL;
64         l.out.query             = r->out.query;
65
66         return _netr_LogonControl2Ex(p, &l);
67 }
68
69 /****************************************************************************
70 Send a message to smbd to do a sam synchronisation
71 **************************************************************************/
72
73 static void send_sync_message(void)
74 {
75         DEBUG(3, ("sending sam synchronisation message\n"));
76         message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
77                          NULL);
78 }
79
80 /*************************************************************************
81  _netr_LogonControl2
82  *************************************************************************/
83
84 WERROR _netr_LogonControl2(pipes_struct *p,
85                            struct netr_LogonControl2 *r)
86 {
87         struct netr_LogonControl2Ex l;
88
89         l.in.logon_server       = r->in.logon_server;
90         l.in.function_code      = r->in.function_code;
91         l.in.level              = r->in.level;
92         l.in.data               = r->in.data;
93         l.out.query             = r->out.query;
94
95         return _netr_LogonControl2Ex(p, &l);
96 }
97
98 /*************************************************************************
99  *************************************************************************/
100
101 static bool wb_change_trust_creds(const char *domain, WERROR *tc_status)
102 {
103         wbcErr result;
104         struct wbcAuthErrorInfo *error = NULL;
105
106         result = wbcChangeTrustCredentials(domain, &error);
107         switch (result) {
108         case WBC_ERR_WINBIND_NOT_AVAILABLE:
109                 return false;
110         case WBC_ERR_DOMAIN_NOT_FOUND:
111                 *tc_status = WERR_NO_SUCH_DOMAIN;
112                 return true;
113         case WBC_ERR_SUCCESS:
114                 *tc_status = WERR_OK;
115                 return true;
116         default:
117                 break;
118         }
119
120         if (error && error->nt_status != 0) {
121                 *tc_status = ntstatus_to_werror(NT_STATUS(error->nt_status));
122         } else {
123                 *tc_status = WERR_TRUST_FAILURE;
124         }
125         wbcFreeMemory(error);
126         return true;
127 }
128
129 /*************************************************************************
130  *************************************************************************/
131
132 static bool wb_check_trust_creds(const char *domain, WERROR *tc_status)
133 {
134         wbcErr result;
135         struct wbcAuthErrorInfo *error = NULL;
136
137         result = wbcCheckTrustCredentials(domain, &error);
138         switch (result) {
139         case WBC_ERR_WINBIND_NOT_AVAILABLE:
140                 return false;
141         case WBC_ERR_DOMAIN_NOT_FOUND:
142                 *tc_status = WERR_NO_SUCH_DOMAIN;
143                 return true;
144         case WBC_ERR_SUCCESS:
145                 *tc_status = WERR_OK;
146                 return true;
147         default:
148                 break;
149         }
150
151         if (error && error->nt_status != 0) {
152                 *tc_status = ntstatus_to_werror(NT_STATUS(error->nt_status));
153         } else {
154                 *tc_status = WERR_TRUST_FAILURE;
155         }
156         wbcFreeMemory(error);
157         return true;
158 }
159
160 /****************************************************************
161  _netr_LogonControl2Ex
162 ****************************************************************/
163
164 WERROR _netr_LogonControl2Ex(pipes_struct *p,
165                              struct netr_LogonControl2Ex *r)
166 {
167         uint32_t flags = 0x0;
168         WERROR pdc_connection_status = WERR_OK;
169         uint32_t logon_attempts = 0x0;
170         WERROR tc_status;
171         fstring dc_name2;
172         const char *dc_name = NULL;
173         struct sockaddr_storage dc_ss;
174         const char *domain = NULL;
175         struct netr_NETLOGON_INFO_1 *info1;
176         struct netr_NETLOGON_INFO_2 *info2;
177         struct netr_NETLOGON_INFO_3 *info3;
178         struct netr_NETLOGON_INFO_4 *info4;
179         const char *fn;
180         uint32_t acct_ctrl;
181
182         switch (p->hdr_req.opnum) {
183         case NDR_NETR_LOGONCONTROL:
184                 fn = "_netr_LogonControl";
185                 break;
186         case NDR_NETR_LOGONCONTROL2:
187                 fn = "_netr_LogonControl2";
188                 break;
189         case NDR_NETR_LOGONCONTROL2EX:
190                 fn = "_netr_LogonControl2Ex";
191                 break;
192         default:
193                 return WERR_INVALID_PARAM;
194         }
195
196         acct_ctrl = pdb_get_acct_ctrl(p->server_info->sam_account);
197
198         switch (r->in.function_code) {
199         case NETLOGON_CONTROL_TC_VERIFY:
200         case NETLOGON_CONTROL_CHANGE_PASSWORD:
201         case NETLOGON_CONTROL_REDISCOVER:
202                 if ((geteuid() != sec_initial_uid()) &&
203                     !nt_token_check_domain_rid(p->server_info->ptok, DOMAIN_RID_ADMINS) &&
204                     !nt_token_check_sid(&global_sid_Builtin_Administrators, p->server_info->ptok) &&
205                     !(acct_ctrl & (ACB_WSTRUST | ACB_SVRTRUST))) {
206                         return WERR_ACCESS_DENIED;
207                 }
208                 break;
209         default:
210                 break;
211         }
212
213         tc_status = WERR_NO_SUCH_DOMAIN;
214
215         switch (r->in.function_code) {
216         case NETLOGON_CONTROL_QUERY:
217                 tc_status = WERR_OK;
218                 break;
219         case NETLOGON_CONTROL_REPLICATE:
220         case NETLOGON_CONTROL_SYNCHRONIZE:
221         case NETLOGON_CONTROL_PDC_REPLICATE:
222         case NETLOGON_CONTROL_BACKUP_CHANGE_LOG:
223         case NETLOGON_CONTROL_BREAKPOINT:
224                 if (acct_ctrl & ACB_NORMAL) {
225                         return WERR_NOT_SUPPORTED;
226                 } else if (acct_ctrl & (ACB_WSTRUST | ACB_SVRTRUST)) {
227                         return WERR_ACCESS_DENIED;
228                 } else {
229                         return WERR_ACCESS_DENIED;
230                 }
231         case NETLOGON_CONTROL_TRUNCATE_LOG:
232                 if (acct_ctrl & ACB_NORMAL) {
233                         break;
234                 } else if (acct_ctrl & (ACB_WSTRUST | ACB_SVRTRUST)) {
235                         return WERR_ACCESS_DENIED;
236                 } else {
237                         return WERR_ACCESS_DENIED;
238                 }
239
240         case NETLOGON_CONTROL_TRANSPORT_NOTIFY:
241         case NETLOGON_CONTROL_FORCE_DNS_REG:
242         case NETLOGON_CONTROL_QUERY_DNS_REG:
243                 return WERR_NOT_SUPPORTED;
244         case NETLOGON_CONTROL_FIND_USER:
245                 if (!r->in.data || !r->in.data->user) {
246                         return WERR_NOT_SUPPORTED;
247                 }
248                 break;
249         case NETLOGON_CONTROL_SET_DBFLAG:
250                 if (!r->in.data) {
251                         return WERR_NOT_SUPPORTED;
252                 }
253                 break;
254         case NETLOGON_CONTROL_TC_VERIFY:
255                 if (!r->in.data || !r->in.data->domain) {
256                         return WERR_NOT_SUPPORTED;
257                 }
258
259                 if (!wb_check_trust_creds(r->in.data->domain, &tc_status)) {
260                         return WERR_NOT_SUPPORTED;
261                 }
262                 break;
263         case NETLOGON_CONTROL_TC_QUERY:
264                 if (!r->in.data || !r->in.data->domain) {
265                         return WERR_NOT_SUPPORTED;
266                 }
267
268                 domain = r->in.data->domain;
269
270                 if (!is_trusted_domain(domain)) {
271                         break;
272                 }
273
274                 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
275                         tc_status = WERR_NO_LOGON_SERVERS;
276                         break;
277                 }
278
279                 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
280                 if (!dc_name) {
281                         return WERR_NOMEM;
282                 }
283
284                 tc_status = WERR_OK;
285
286                 break;
287
288         case NETLOGON_CONTROL_REDISCOVER:
289                 if (!r->in.data || !r->in.data->domain) {
290                         return WERR_NOT_SUPPORTED;
291                 }
292
293                 domain = r->in.data->domain;
294
295                 if (!is_trusted_domain(domain)) {
296                         break;
297                 }
298
299                 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
300                         tc_status = WERR_NO_LOGON_SERVERS;
301                         break;
302                 }
303
304                 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
305                 if (!dc_name) {
306                         return WERR_NOMEM;
307                 }
308
309                 tc_status = WERR_OK;
310
311                 break;
312
313         case NETLOGON_CONTROL_CHANGE_PASSWORD:
314                 if (!r->in.data || !r->in.data->domain) {
315                         return WERR_NOT_SUPPORTED;
316                 }
317
318                 if (!wb_change_trust_creds(r->in.data->domain, &tc_status)) {
319                         return WERR_NOT_SUPPORTED;
320                 }
321                 break;
322
323         default:
324                 /* no idea what this should be */
325                 DEBUG(0,("%s: unimplemented function level [%d]\n",
326                         fn, r->in.function_code));
327                 return WERR_UNKNOWN_LEVEL;
328         }
329
330         /* prepare the response */
331
332         switch (r->in.level) {
333         case 1:
334                 info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
335                 W_ERROR_HAVE_NO_MEMORY(info1);
336
337                 info1->flags                    = flags;
338                 info1->pdc_connection_status    = pdc_connection_status;
339
340                 r->out.query->info1 = info1;
341                 break;
342         case 2:
343                 info2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_2);
344                 W_ERROR_HAVE_NO_MEMORY(info2);
345
346                 info2->flags                    = flags;
347                 info2->pdc_connection_status    = pdc_connection_status;
348                 info2->trusted_dc_name          = dc_name;
349                 info2->tc_connection_status     = tc_status;
350
351                 r->out.query->info2 = info2;
352                 break;
353         case 3:
354                 info3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_3);
355                 W_ERROR_HAVE_NO_MEMORY(info3);
356
357                 info3->flags                    = flags;
358                 info3->logon_attempts           = logon_attempts;
359
360                 r->out.query->info3 = info3;
361                 break;
362         case 4:
363                 info4 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_4);
364                 W_ERROR_HAVE_NO_MEMORY(info4);
365
366                 info4->trusted_dc_name          = dc_name;
367                 info4->trusted_domain_name      = r->in.data->domain;
368
369                 r->out.query->info4 = info4;
370                 break;
371         default:
372                 return WERR_UNKNOWN_LEVEL;
373         }
374
375         if (lp_server_role() == ROLE_DOMAIN_BDC) {
376                 send_sync_message();
377         }
378
379         return WERR_OK;
380 }
381
382 /*************************************************************************
383  _netr_NetrEnumerateTrustedDomains
384  *************************************************************************/
385
386 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
387                                          struct netr_NetrEnumerateTrustedDomains *r)
388 {
389         NTSTATUS status;
390         DATA_BLOB blob;
391         struct trustdom_info **domains;
392         uint32_t num_domains;
393         const char **trusted_domains;
394         int i;
395
396         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
397
398         /* set up the Trusted Domain List response */
399
400         become_root();
401         status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
402         unbecome_root();
403
404         if (!NT_STATUS_IS_OK(status)) {
405                 return ntstatus_to_werror(status);
406         }
407
408         trusted_domains = talloc_zero_array(p->mem_ctx, const char *, num_domains + 1);
409         if (!trusted_domains) {
410                 return WERR_NOMEM;
411         }
412
413         for (i = 0; i < num_domains; i++) {
414                 trusted_domains[i] = talloc_strdup(trusted_domains, domains[i]->name);
415                 if (!trusted_domains[i]) {
416                         TALLOC_FREE(trusted_domains);
417                         return WERR_NOMEM;
418                 }
419         }
420
421         if (!push_reg_multi_sz(trusted_domains, &blob, trusted_domains)) {
422                 TALLOC_FREE(trusted_domains);
423                 return WERR_NOMEM;
424         }
425
426         r->out.trusted_domains_blob->data = blob.data;
427         r->out.trusted_domains_blob->length = blob.length;
428
429         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
430
431         return WERR_OK;
432 }
433
434 /******************************************************************
435  gets a machine password entry.  checks access rights of the host.
436  ******************************************************************/
437
438 static NTSTATUS get_md4pw(struct samr_Password *md4pw, const char *mach_acct,
439                           enum netr_SchannelType sec_chan_type, struct dom_sid *sid)
440 {
441         struct samu *sampass = NULL;
442         const uint8 *pass;
443         bool ret;
444         uint32 acct_ctrl;
445
446 #if 0
447         char addr[INET6_ADDRSTRLEN];
448
449     /*
450      * Currently this code is redundent as we already have a filter
451      * by hostname list. What this code really needs to do is to
452      * get a hosts allowed/hosts denied list from the SAM database
453      * on a per user basis, and make the access decision there.
454      * I will leave this code here for now as a reminder to implement
455      * this at a later date. JRA.
456      */
457
458         if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
459                         client_name(get_client_fd()),
460                         client_addr(get_client_fd(),addr,sizeof(addr)))) {
461                 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
462                 return False;
463         }
464 #endif /* 0 */
465
466         if ( !(sampass = samu_new( NULL )) ) {
467                 return NT_STATUS_NO_MEMORY;
468         }
469
470         /* JRA. This is ok as it is only used for generating the challenge. */
471         become_root();
472         ret = pdb_getsampwnam(sampass, mach_acct);
473         unbecome_root();
474
475         if (!ret) {
476                 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
477                 TALLOC_FREE(sampass);
478                 return NT_STATUS_ACCESS_DENIED;
479         }
480
481         acct_ctrl = pdb_get_acct_ctrl(sampass);
482         if (acct_ctrl & ACB_DISABLED) {
483                 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
484                 TALLOC_FREE(sampass);
485                 return NT_STATUS_ACCOUNT_DISABLED;
486         }
487
488         if (!(acct_ctrl & ACB_SVRTRUST) &&
489             !(acct_ctrl & ACB_WSTRUST) &&
490             !(acct_ctrl & ACB_DOMTRUST))
491         {
492                 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
493                 TALLOC_FREE(sampass);
494                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
495         }
496
497         switch (sec_chan_type) {
498                 case SEC_CHAN_BDC:
499                         if (!(acct_ctrl & ACB_SVRTRUST)) {
500                                 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
501                                          "but not a server trust account\n", mach_acct));
502                                 TALLOC_FREE(sampass);
503                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
504                         }
505                         break;
506                 case SEC_CHAN_WKSTA:
507                         if (!(acct_ctrl & ACB_WSTRUST)) {
508                                 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
509                                          "but not a workstation trust account\n", mach_acct));
510                                 TALLOC_FREE(sampass);
511                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
512                         }
513                         break;
514                 case SEC_CHAN_DOMAIN:
515                         if (!(acct_ctrl & ACB_DOMTRUST)) {
516                                 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
517                                          "but not a interdomain trust account\n", mach_acct));
518                                 TALLOC_FREE(sampass);
519                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
520                         }
521                         break;
522                 default:
523                         break;
524         }
525
526         if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
527                 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
528                 TALLOC_FREE(sampass);
529                 return NT_STATUS_LOGON_FAILURE;
530         }
531
532         memcpy(md4pw->hash, pass, 16);
533         dump_data(5, md4pw->hash, 16);
534
535         sid_copy(sid, pdb_get_user_sid(sampass));
536
537         TALLOC_FREE(sampass);
538
539         return NT_STATUS_OK;
540
541
542 }
543
544 /*************************************************************************
545  _netr_ServerReqChallenge
546  *************************************************************************/
547
548 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
549                                   struct netr_ServerReqChallenge *r)
550 {
551         struct netlogon_server_pipe_state *pipe_state =
552                 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
553
554         if (pipe_state) {
555                 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
556                 talloc_free(pipe_state);
557                 p->private_data = NULL;
558         }
559
560         pipe_state = talloc(p, struct netlogon_server_pipe_state);
561         NT_STATUS_HAVE_NO_MEMORY(pipe_state);
562
563         pipe_state->client_challenge = *r->in.credentials;
564
565         generate_random_buffer(pipe_state->server_challenge.data,
566                                sizeof(pipe_state->server_challenge.data));
567
568         *r->out.return_credentials = pipe_state->server_challenge;
569
570         p->private_data = pipe_state;
571
572         return NT_STATUS_OK;
573 }
574
575 /*************************************************************************
576  _netr_ServerAuthenticate
577  Create the initial credentials.
578  *************************************************************************/
579
580 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
581                                   struct netr_ServerAuthenticate *r)
582 {
583         struct netr_ServerAuthenticate3 a;
584         uint32_t negotiate_flags = 0;
585         uint32_t rid;
586
587         a.in.server_name                = r->in.server_name;
588         a.in.account_name               = r->in.account_name;
589         a.in.secure_channel_type        = r->in.secure_channel_type;
590         a.in.computer_name              = r->in.computer_name;
591         a.in.credentials                = r->in.credentials;
592         a.in.negotiate_flags            = &negotiate_flags;
593
594         a.out.return_credentials        = r->out.return_credentials;
595         a.out.rid                       = &rid;
596         a.out.negotiate_flags           = &negotiate_flags;
597
598         return _netr_ServerAuthenticate3(p, &a);
599
600 }
601
602 /*************************************************************************
603  _netr_ServerAuthenticate3
604  *************************************************************************/
605
606 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
607                                    struct netr_ServerAuthenticate3 *r)
608 {
609         NTSTATUS status;
610         uint32_t srv_flgs;
611         /* r->in.negotiate_flags is an aliased pointer to r->out.negotiate_flags,
612          * so use a copy to avoid destroying the client values. */
613         uint32_t in_neg_flags = *r->in.negotiate_flags;
614         const char *fn;
615         struct dom_sid sid;
616         struct samr_Password mach_pwd;
617         struct netlogon_creds_CredentialState *creds;
618         struct netlogon_server_pipe_state *pipe_state =
619                 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
620
621         /* According to Microsoft (see bugid #6099)
622          * Windows 7 looks at the negotiate_flags
623          * returned in this structure *even if the
624          * call fails with access denied* ! So in order
625          * to allow Win7 to connect to a Samba NT style
626          * PDC we set the flags before we know if it's
627          * an error or not.
628          */
629
630         /* 0x000001ff */
631         srv_flgs = NETLOGON_NEG_ACCOUNT_LOCKOUT |
632                    NETLOGON_NEG_PERSISTENT_SAMREPL |
633                    NETLOGON_NEG_ARCFOUR |
634                    NETLOGON_NEG_PROMOTION_COUNT |
635                    NETLOGON_NEG_CHANGELOG_BDC |
636                    NETLOGON_NEG_FULL_SYNC_REPL |
637                    NETLOGON_NEG_MULTIPLE_SIDS |
638                    NETLOGON_NEG_REDO |
639                    NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL |
640                    NETLOGON_NEG_PASSWORD_SET2;
641
642         /* Ensure we support strong (128-bit) keys. */
643         if (in_neg_flags & NETLOGON_NEG_STRONG_KEYS) {
644                 srv_flgs |= NETLOGON_NEG_STRONG_KEYS;
645         }
646
647         if (lp_server_schannel() != false) {
648                 srv_flgs |= NETLOGON_NEG_SCHANNEL;
649         }
650
651         switch (p->hdr_req.opnum) {
652                 case NDR_NETR_SERVERAUTHENTICATE:
653                         fn = "_netr_ServerAuthenticate";
654                         break;
655                 case NDR_NETR_SERVERAUTHENTICATE2:
656                         fn = "_netr_ServerAuthenticate2";
657                         break;
658                 case NDR_NETR_SERVERAUTHENTICATE3:
659                         fn = "_netr_ServerAuthenticate3";
660                         break;
661                 default:
662                         return NT_STATUS_INTERNAL_ERROR;
663         }
664
665         /* We use this as the key to store the creds: */
666         /* r->in.computer_name */
667
668         if (!pipe_state) {
669                 DEBUG(0,("%s: no challenge sent to client %s\n", fn,
670                         r->in.computer_name));
671                 status = NT_STATUS_ACCESS_DENIED;
672                 goto out;
673         }
674
675         if ( (lp_server_schannel() == true) &&
676              ((in_neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
677
678                 /* schannel must be used, but client did not offer it. */
679                 DEBUG(0,("%s: schannel required but client failed "
680                         "to offer it. Client was %s\n",
681                         fn, r->in.account_name));
682                 status = NT_STATUS_ACCESS_DENIED;
683                 goto out;
684         }
685
686         status = get_md4pw(&mach_pwd,
687                            r->in.account_name,
688                            r->in.secure_channel_type,
689                            &sid);
690         if (!NT_STATUS_IS_OK(status)) {
691                 DEBUG(0,("%s: failed to get machine password for "
692                         "account %s: %s\n",
693                         fn, r->in.account_name, nt_errstr(status) ));
694                 /* always return NT_STATUS_ACCESS_DENIED */
695                 status = NT_STATUS_ACCESS_DENIED;
696                 goto out;
697         }
698
699         /* From the client / server challenges and md4 password, generate sess key */
700         /* Check client credentials are valid. */
701         creds = netlogon_creds_server_init(p->mem_ctx,
702                                            r->in.account_name,
703                                            r->in.computer_name,
704                                            r->in.secure_channel_type,
705                                            &pipe_state->client_challenge,
706                                            &pipe_state->server_challenge,
707                                            &mach_pwd,
708                                            r->in.credentials,
709                                            r->out.return_credentials,
710                                            *r->in.negotiate_flags);
711         if (!creds) {
712                 DEBUG(0,("%s: netlogon_creds_server_check failed. Rejecting auth "
713                         "request from client %s machine account %s\n",
714                         fn, r->in.computer_name,
715                         r->in.account_name));
716                 status = NT_STATUS_ACCESS_DENIED;
717                 goto out;
718         }
719
720         creds->sid = sid_dup_talloc(creds, &sid);
721         if (!creds->sid) {
722                 status = NT_STATUS_NO_MEMORY;
723                 goto out;
724         }
725
726         /* Store off the state so we can continue after client disconnect. */
727         become_root();
728         status = schannel_store_session_key(p->mem_ctx, creds);
729         unbecome_root();
730
731         if (!NT_STATUS_IS_OK(status)) {
732                 goto out;
733         }
734
735         sid_peek_rid(&sid, r->out.rid);
736
737         status = NT_STATUS_OK;
738
739   out:
740
741         *r->out.negotiate_flags = srv_flgs;
742         return status;
743 }
744
745 /*************************************************************************
746  _netr_ServerAuthenticate2
747  *************************************************************************/
748
749 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
750                                    struct netr_ServerAuthenticate2 *r)
751 {
752         struct netr_ServerAuthenticate3 a;
753         uint32_t rid;
754
755         a.in.server_name                = r->in.server_name;
756         a.in.account_name               = r->in.account_name;
757         a.in.secure_channel_type        = r->in.secure_channel_type;
758         a.in.computer_name              = r->in.computer_name;
759         a.in.credentials                = r->in.credentials;
760         a.in.negotiate_flags            = r->in.negotiate_flags;
761
762         a.out.return_credentials        = r->out.return_credentials;
763         a.out.rid                       = &rid;
764         a.out.negotiate_flags           = r->out.negotiate_flags;
765
766         return _netr_ServerAuthenticate3(p, &a);
767 }
768
769 /*************************************************************************
770  *************************************************************************/
771
772 static NTSTATUS netr_creds_server_step_check(pipes_struct *p,
773                                              TALLOC_CTX *mem_ctx,
774                                              const char *computer_name,
775                                              struct netr_Authenticator *received_authenticator,
776                                              struct netr_Authenticator *return_authenticator,
777                                              struct netlogon_creds_CredentialState **creds_out)
778 {
779         NTSTATUS status;
780         struct tdb_context *tdb;
781         bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
782         bool schannel_in_use = (p->auth.auth_type == PIPE_AUTH_TYPE_SCHANNEL) ? true:false; /* &&
783                 (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY ||
784                  p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY); */
785
786         tdb = open_schannel_session_store(mem_ctx);
787         if (!tdb) {
788                 return NT_STATUS_ACCESS_DENIED;
789         }
790
791         status = schannel_creds_server_step_check_tdb(tdb, mem_ctx,
792                                                       computer_name,
793                                                       schannel_global_required,
794                                                       schannel_in_use,
795                                                       received_authenticator,
796                                                       return_authenticator,
797                                                       creds_out);
798         tdb_close(tdb);
799
800         return status;
801 }
802
803 /*************************************************************************
804  *************************************************************************/
805
806 static NTSTATUS netr_find_machine_account(TALLOC_CTX *mem_ctx,
807                                           const char *account_name,
808                                           struct samu **sampassp)
809 {
810         struct samu *sampass;
811         bool ret = false;
812         uint32_t acct_ctrl;
813
814         sampass = samu_new(mem_ctx);
815         if (!sampass) {
816                 return NT_STATUS_NO_MEMORY;
817         }
818
819         become_root();
820         ret = pdb_getsampwnam(sampass, account_name);
821         unbecome_root();
822
823         if (!ret) {
824                 TALLOC_FREE(sampass);
825                 return NT_STATUS_ACCESS_DENIED;
826         }
827
828         /* Ensure the account exists and is a machine account. */
829
830         acct_ctrl = pdb_get_acct_ctrl(sampass);
831
832         if (!(acct_ctrl & ACB_WSTRUST ||
833               acct_ctrl & ACB_SVRTRUST ||
834               acct_ctrl & ACB_DOMTRUST)) {
835                 TALLOC_FREE(sampass);
836                 return NT_STATUS_NO_SUCH_USER;
837         }
838
839         if (acct_ctrl & ACB_DISABLED) {
840                 TALLOC_FREE(sampass);
841                 return NT_STATUS_ACCOUNT_DISABLED;
842         }
843
844         *sampassp = sampass;
845
846         return NT_STATUS_OK;
847 }
848
849 /*************************************************************************
850  *************************************************************************/
851
852 static NTSTATUS netr_set_machine_account_password(TALLOC_CTX *mem_ctx,
853                                                   struct samu *sampass,
854                                                   DATA_BLOB *plaintext_blob,
855                                                   struct samr_Password *nt_hash,
856                                                   struct samr_Password *lm_hash)
857 {
858         NTSTATUS status;
859         const uchar *old_pw;
860         const char *plaintext = NULL;
861         size_t plaintext_len;
862         struct samr_Password nt_hash_local;
863
864         if (!sampass) {
865                 return NT_STATUS_INVALID_PARAMETER;
866         }
867
868         if (plaintext_blob) {
869                 if (!convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
870                                            plaintext_blob->data, plaintext_blob->length,
871                                            &plaintext, &plaintext_len, false))
872                 {
873                         plaintext = NULL;
874                         mdfour(nt_hash_local.hash, plaintext_blob->data, plaintext_blob->length);
875                         nt_hash = &nt_hash_local;
876                 }
877         }
878
879         if (plaintext) {
880                 if (!pdb_set_plaintext_passwd(sampass, plaintext)) {
881                         return NT_STATUS_ACCESS_DENIED;
882                 }
883
884                 goto done;
885         }
886
887         if (nt_hash) {
888                 old_pw = pdb_get_nt_passwd(sampass);
889
890                 if (old_pw && memcmp(nt_hash->hash, old_pw, 16) == 0) {
891                         /* Avoid backend modificiations and other fun if the
892                            client changed the password to the *same thing* */
893                 } else {
894                         /* LM password should be NULL for machines */
895                         if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
896                                 return NT_STATUS_NO_MEMORY;
897                         }
898                         if (!pdb_set_nt_passwd(sampass, nt_hash->hash, PDB_CHANGED)) {
899                                 return NT_STATUS_NO_MEMORY;
900                         }
901
902                         if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
903                                 /* Not quite sure what this one qualifies as, but this will do */
904                                 return NT_STATUS_UNSUCCESSFUL;
905                         }
906                 }
907         }
908
909  done:
910         become_root();
911         status = pdb_update_sam_account(sampass);
912         unbecome_root();
913
914         return status;
915 }
916
917 /*************************************************************************
918  _netr_ServerPasswordSet
919  *************************************************************************/
920
921 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
922                                  struct netr_ServerPasswordSet *r)
923 {
924         NTSTATUS status = NT_STATUS_OK;
925         struct samu *sampass=NULL;
926         int i;
927         struct netlogon_creds_CredentialState *creds;
928
929         DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
930
931         become_root();
932         status = netr_creds_server_step_check(p, p->mem_ctx,
933                                               r->in.computer_name,
934                                               r->in.credential,
935                                               r->out.return_authenticator,
936                                               &creds);
937         unbecome_root();
938
939         if (!NT_STATUS_IS_OK(status)) {
940                 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
941                         "request from client %s machine account %s\n",
942                         r->in.computer_name, creds->computer_name));
943                 TALLOC_FREE(creds);
944                 return status;
945         }
946
947         DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
948                         r->in.computer_name, creds->computer_name));
949
950         netlogon_creds_des_decrypt(creds, r->in.new_password);
951
952         DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
953         for(i = 0; i < sizeof(r->in.new_password->hash); i++)
954                 DEBUG(100,("%02X ", r->in.new_password->hash[i]));
955         DEBUG(100,("\n"));
956
957         status = netr_find_machine_account(p->mem_ctx,
958                                            creds->account_name,
959                                            &sampass);
960         if (!NT_STATUS_IS_OK(status)) {
961                 return status;
962         }
963
964         status = netr_set_machine_account_password(sampass,
965                                                    sampass,
966                                                    NULL,
967                                                    r->in.new_password,
968                                                    NULL);
969         TALLOC_FREE(sampass);
970         return status;
971 }
972
973 /****************************************************************
974  _netr_ServerPasswordSet2
975 ****************************************************************/
976
977 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
978                                   struct netr_ServerPasswordSet2 *r)
979 {
980         NTSTATUS status;
981         struct netlogon_creds_CredentialState *creds;
982         struct samu *sampass;
983         DATA_BLOB plaintext;
984         struct samr_CryptPassword password_buf;
985         struct samr_Password nt_hash;
986
987         become_root();
988         status = netr_creds_server_step_check(p, p->mem_ctx,
989                                               r->in.computer_name,
990                                               r->in.credential,
991                                               r->out.return_authenticator,
992                                               &creds);
993         unbecome_root();
994
995         if (!NT_STATUS_IS_OK(status)) {
996                 DEBUG(2,("_netr_ServerPasswordSet2: netlogon_creds_server_step "
997                         "failed. Rejecting auth request from client %s machine account %s\n",
998                         r->in.computer_name, creds->computer_name));
999                 TALLOC_FREE(creds);
1000                 return status;
1001         }
1002
1003         memcpy(password_buf.data, r->in.new_password->data, 512);
1004         SIVAL(password_buf.data, 512, r->in.new_password->length);
1005         netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
1006
1007         if (!extract_pw_from_buffer(p->mem_ctx, password_buf.data, &plaintext)) {
1008                 return NT_STATUS_WRONG_PASSWORD;
1009         }
1010
1011         mdfour(nt_hash.hash, plaintext.data, plaintext.length);
1012
1013         status = netr_find_machine_account(p->mem_ctx,
1014                                            creds->account_name,
1015                                            &sampass);
1016         if (!NT_STATUS_IS_OK(status)) {
1017                 return status;
1018         }
1019
1020         status = netr_set_machine_account_password(sampass,
1021                                                    sampass,
1022                                                    NULL,
1023                                                    &nt_hash,
1024                                                    NULL);
1025         TALLOC_FREE(sampass);
1026         return status;
1027 }
1028
1029 /*************************************************************************
1030  _netr_LogonSamLogoff
1031  *************************************************************************/
1032
1033 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
1034                               struct netr_LogonSamLogoff *r)
1035 {
1036         NTSTATUS status;
1037         struct netlogon_creds_CredentialState *creds;
1038
1039         become_root();
1040         status = netr_creds_server_step_check(p, p->mem_ctx,
1041                                               r->in.computer_name,
1042                                               r->in.credential,
1043                                               r->out.return_authenticator,
1044                                               &creds);
1045         unbecome_root();
1046
1047         return status;
1048 }
1049
1050 /*************************************************************************
1051  _netr_LogonSamLogon_base
1052  *************************************************************************/
1053
1054 static NTSTATUS _netr_LogonSamLogon_base(pipes_struct *p,
1055                                          struct netr_LogonSamLogonEx *r,
1056                                          struct netlogon_creds_CredentialState *creds)
1057 {
1058         NTSTATUS status = NT_STATUS_OK;
1059         union netr_LogonLevel *logon = r->in.logon;
1060         const char *nt_username, *nt_domain, *nt_workstation;
1061         auth_usersupplied_info *user_info = NULL;
1062         auth_serversupplied_info *server_info = NULL;
1063         struct auth_context *auth_context = NULL;
1064         uint8_t pipe_session_key[16];
1065         bool process_creds = true;
1066         const char *fn;
1067
1068         switch (p->hdr_req.opnum) {
1069                 case NDR_NETR_LOGONSAMLOGON:
1070                         process_creds = true;
1071                         fn = "_netr_LogonSamLogon";
1072                         break;
1073                 case NDR_NETR_LOGONSAMLOGONWITHFLAGS:
1074                         process_creds = true;
1075                         fn = "_netr_LogonSamLogonWithFlags";
1076                         break;
1077                 case NDR_NETR_LOGONSAMLOGONEX:
1078                         process_creds = false;
1079                         fn = "_netr_LogonSamLogonEx";
1080                         break;
1081                 default:
1082                         return NT_STATUS_INTERNAL_ERROR;
1083         }
1084
1085         *r->out.authoritative = true; /* authoritative response */
1086
1087         switch (r->in.validation_level) {
1088         case 2:
1089                 r->out.validation->sam2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo2);
1090                 if (!r->out.validation->sam2) {
1091                         return NT_STATUS_NO_MEMORY;
1092                 }
1093                 break;
1094         case 3:
1095                 r->out.validation->sam3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo3);
1096                 if (!r->out.validation->sam3) {
1097                         return NT_STATUS_NO_MEMORY;
1098                 }
1099                 break;
1100         case 6:
1101                 r->out.validation->sam6 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo6);
1102                 if (!r->out.validation->sam6) {
1103                         return NT_STATUS_NO_MEMORY;
1104                 }
1105                 break;
1106         default:
1107                 DEBUG(0,("%s: bad validation_level value %d.\n",
1108                         fn, (int)r->in.validation_level));
1109                 return NT_STATUS_INVALID_INFO_CLASS;
1110         }
1111
1112         switch (r->in.logon_level) {
1113         case NetlogonInteractiveInformation:
1114         case NetlogonServiceInformation:
1115         case NetlogonInteractiveTransitiveInformation:
1116         case NetlogonServiceTransitiveInformation:
1117                 nt_username     = logon->password->identity_info.account_name.string;
1118                 nt_domain       = logon->password->identity_info.domain_name.string;
1119                 nt_workstation  = logon->password->identity_info.workstation.string;
1120
1121                 DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
1122                 break;
1123         case NetlogonNetworkInformation:
1124         case NetlogonNetworkTransitiveInformation:
1125                 nt_username     = logon->network->identity_info.account_name.string;
1126                 nt_domain       = logon->network->identity_info.domain_name.string;
1127                 nt_workstation  = logon->network->identity_info.workstation.string;
1128
1129                 DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
1130                 break;
1131         default:
1132                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1133                 return NT_STATUS_INVALID_INFO_CLASS;
1134         } /* end switch */
1135
1136         DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
1137         fstrcpy(current_user_info.smb_name, nt_username);
1138         sub_set_smb_name(nt_username);
1139
1140         DEBUG(5,("Attempting validation level %d for unmapped username %s.\n",
1141                 r->in.validation_level, nt_username));
1142
1143         status = NT_STATUS_OK;
1144
1145         switch (r->in.logon_level) {
1146         case NetlogonNetworkInformation:
1147         case NetlogonNetworkTransitiveInformation:
1148         {
1149                 const char *wksname = nt_workstation;
1150
1151                 status = make_auth_context_fixed(&auth_context,
1152                                                  logon->network->challenge);
1153                 if (!NT_STATUS_IS_OK(status)) {
1154                         return status;
1155                 }
1156
1157                 /* For a network logon, the workstation name comes in with two
1158                  * backslashes in the front. Strip them if they are there. */
1159
1160                 if (*wksname == '\\') wksname++;
1161                 if (*wksname == '\\') wksname++;
1162
1163                 /* Standard challenge/response authenticaion */
1164                 if (!make_user_info_netlogon_network(&user_info,
1165                                                      nt_username, nt_domain,
1166                                                      wksname,
1167                                                      logon->network->identity_info.parameter_control,
1168                                                      logon->network->lm.data,
1169                                                      logon->network->lm.length,
1170                                                      logon->network->nt.data,
1171                                                      logon->network->nt.length)) {
1172                         status = NT_STATUS_NO_MEMORY;
1173                 }
1174                 break;
1175         }
1176         case NetlogonInteractiveInformation:
1177         case NetlogonServiceInformation:
1178         case NetlogonInteractiveTransitiveInformation:
1179         case NetlogonServiceTransitiveInformation:
1180
1181                 /* 'Interactive' authentication, supplies the password in its
1182                    MD4 form, encrypted with the session key.  We will convert
1183                    this to challenge/response for the auth subsystem to chew
1184                    on */
1185         {
1186                 uint8_t chal[8];
1187
1188                 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
1189                         return status;
1190                 }
1191
1192                 auth_context->get_ntlm_challenge(auth_context, chal);
1193
1194                 if (!make_user_info_netlogon_interactive(&user_info,
1195                                                          nt_username, nt_domain,
1196                                                          nt_workstation,
1197                                                          logon->password->identity_info.parameter_control,
1198                                                          chal,
1199                                                          logon->password->lmpassword.hash,
1200                                                          logon->password->ntpassword.hash,
1201                                                          creds->session_key)) {
1202                         status = NT_STATUS_NO_MEMORY;
1203                 }
1204                 break;
1205         }
1206         default:
1207                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1208                 return NT_STATUS_INVALID_INFO_CLASS;
1209         } /* end switch */
1210
1211         if ( NT_STATUS_IS_OK(status) ) {
1212                 status = auth_context->check_ntlm_password(auth_context,
1213                         user_info, &server_info);
1214         }
1215
1216         (auth_context->free)(&auth_context);
1217         free_user_info(&user_info);
1218
1219         DEBUG(5,("%s: check_password returned status %s\n",
1220                   fn, nt_errstr(status)));
1221
1222         /* Check account and password */
1223
1224         if (!NT_STATUS_IS_OK(status)) {
1225                 /* If we don't know what this domain is, we need to
1226                    indicate that we are not authoritative.  This
1227                    allows the client to decide if it needs to try
1228                    a local user.  Fix by jpjanosi@us.ibm.com, #2976 */
1229                 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
1230                      && !strequal(nt_domain, get_global_sam_name())
1231                      && !is_trusted_domain(nt_domain) )
1232                         *r->out.authoritative = false; /* We are not authoritative */
1233
1234                 TALLOC_FREE(server_info);
1235                 return status;
1236         }
1237
1238         if (server_info->guest) {
1239                 /* We don't like guest domain logons... */
1240                 DEBUG(5,("%s: Attempted domain logon as GUEST "
1241                          "denied.\n", fn));
1242                 TALLOC_FREE(server_info);
1243                 return NT_STATUS_LOGON_FAILURE;
1244         }
1245
1246         /* This is the point at which, if the login was successful, that
1247            the SAM Local Security Authority should record that the user is
1248            logged in to the domain.  */
1249
1250         if (process_creds) {
1251                 /* Get the pipe session key from the creds. */
1252                 memcpy(pipe_session_key, creds->session_key, 16);
1253         } else {
1254                 /* Get the pipe session key from the schannel. */
1255                 if ((p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL)
1256                     || (p->auth.a_u.schannel_auth == NULL)) {
1257                         return NT_STATUS_INVALID_HANDLE;
1258                 }
1259                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->creds->session_key, 16);
1260         }
1261
1262         switch (r->in.validation_level) {
1263         case 2:
1264                 status = serverinfo_to_SamInfo2(server_info, pipe_session_key, 16,
1265                                                 r->out.validation->sam2);
1266                 break;
1267         case 3:
1268                 status = serverinfo_to_SamInfo3(server_info, pipe_session_key, 16,
1269                                                 r->out.validation->sam3);
1270                 break;
1271         case 6:
1272                 status = serverinfo_to_SamInfo6(server_info, pipe_session_key, 16,
1273                                                 r->out.validation->sam6);
1274                 break;
1275         }
1276
1277         TALLOC_FREE(server_info);
1278
1279         return status;
1280 }
1281
1282 /****************************************************************
1283  _netr_LogonSamLogonWithFlags
1284 ****************************************************************/
1285
1286 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1287                                       struct netr_LogonSamLogonWithFlags *r)
1288 {
1289         NTSTATUS status;
1290         struct netlogon_creds_CredentialState *creds;
1291         struct netr_LogonSamLogonEx r2;
1292         struct netr_Authenticator return_authenticator;
1293
1294         become_root();
1295         status = netr_creds_server_step_check(p, p->mem_ctx,
1296                                               r->in.computer_name,
1297                                               r->in.credential,
1298                                               &return_authenticator,
1299                                               &creds);
1300         unbecome_root();
1301         if (!NT_STATUS_IS_OK(status)) {
1302                 return status;
1303         }
1304
1305         r2.in.server_name       = r->in.server_name;
1306         r2.in.computer_name     = r->in.computer_name;
1307         r2.in.logon_level       = r->in.logon_level;
1308         r2.in.logon             = r->in.logon;
1309         r2.in.validation_level  = r->in.validation_level;
1310         r2.in.flags             = r->in.flags;
1311         r2.out.validation       = r->out.validation;
1312         r2.out.authoritative    = r->out.authoritative;
1313         r2.out.flags            = r->out.flags;
1314
1315         status = _netr_LogonSamLogon_base(p, &r2, creds);
1316
1317         *r->out.return_authenticator = return_authenticator;
1318
1319         return status;
1320 }
1321
1322 /*************************************************************************
1323  _netr_LogonSamLogon
1324  *************************************************************************/
1325
1326 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
1327                              struct netr_LogonSamLogon *r)
1328 {
1329         NTSTATUS status;
1330         struct netr_LogonSamLogonWithFlags r2;
1331         uint32_t flags = 0;
1332
1333         r2.in.server_name               = r->in.server_name;
1334         r2.in.computer_name             = r->in.computer_name;
1335         r2.in.credential                = r->in.credential;
1336         r2.in.logon_level               = r->in.logon_level;
1337         r2.in.logon                     = r->in.logon;
1338         r2.in.validation_level          = r->in.validation_level;
1339         r2.in.return_authenticator      = r->in.return_authenticator;
1340         r2.in.flags                     = &flags;
1341         r2.out.validation               = r->out.validation;
1342         r2.out.authoritative            = r->out.authoritative;
1343         r2.out.flags                    = &flags;
1344         r2.out.return_authenticator     = r->out.return_authenticator;
1345
1346         status = _netr_LogonSamLogonWithFlags(p, &r2);
1347
1348         return status;
1349 }
1350
1351 /*************************************************************************
1352  _netr_LogonSamLogonEx
1353  - no credential chaining. Map into net sam logon.
1354  *************************************************************************/
1355
1356 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1357                                struct netr_LogonSamLogonEx *r)
1358 {
1359         NTSTATUS status;
1360         struct netlogon_creds_CredentialState *creds = NULL;
1361
1362         become_root();
1363         status = schannel_fetch_session_key(p->mem_ctx, r->in.computer_name, &creds);
1364         unbecome_root();
1365         if (!NT_STATUS_IS_OK(status)) {
1366                 return status;
1367         }
1368
1369         /* Only allow this if the pipe is protected. */
1370         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1371                 DEBUG(0,("_netr_LogonSamLogonEx: client %s not using schannel for netlogon\n",
1372                         get_remote_machine_name() ));
1373                 return NT_STATUS_INVALID_PARAMETER;
1374         }
1375
1376         status = _netr_LogonSamLogon_base(p, r, creds);
1377         TALLOC_FREE(creds);
1378
1379         return status;
1380 }
1381
1382 /*************************************************************************
1383  _ds_enum_dom_trusts
1384  *************************************************************************/
1385 #if 0   /* JERRY -- not correct */
1386  NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1387                              DS_R_ENUM_DOM_TRUSTS *r_u)
1388 {
1389         NTSTATUS status = NT_STATUS_OK;
1390
1391         /* TODO: According to MSDN, the can only be executed against a
1392            DC or domain member running Windows 2000 or later.  Need
1393            to test against a standalone 2k server and see what it
1394            does.  A windows 2000 DC includes its own domain in the
1395            list.  --jerry */
1396
1397         return status;
1398 }
1399 #endif  /* JERRY */
1400
1401
1402 /****************************************************************
1403 ****************************************************************/
1404
1405 WERROR _netr_LogonUasLogon(pipes_struct *p,
1406                            struct netr_LogonUasLogon *r)
1407 {
1408         p->rng_fault_state = true;
1409         return WERR_NOT_SUPPORTED;
1410 }
1411
1412 /****************************************************************
1413 ****************************************************************/
1414
1415 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1416                             struct netr_LogonUasLogoff *r)
1417 {
1418         p->rng_fault_state = true;
1419         return WERR_NOT_SUPPORTED;
1420 }
1421
1422 /****************************************************************
1423 ****************************************************************/
1424
1425 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1426                               struct netr_DatabaseDeltas *r)
1427 {
1428         p->rng_fault_state = true;
1429         return NT_STATUS_NOT_IMPLEMENTED;
1430 }
1431
1432 /****************************************************************
1433 ****************************************************************/
1434
1435 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1436                             struct netr_DatabaseSync *r)
1437 {
1438         p->rng_fault_state = true;
1439         return NT_STATUS_NOT_IMPLEMENTED;
1440 }
1441
1442 /****************************************************************
1443 ****************************************************************/
1444
1445 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1446                              struct netr_AccountDeltas *r)
1447 {
1448         p->rng_fault_state = true;
1449         return NT_STATUS_NOT_IMPLEMENTED;
1450 }
1451
1452 /****************************************************************
1453 ****************************************************************/
1454
1455 NTSTATUS _netr_AccountSync(pipes_struct *p,
1456                            struct netr_AccountSync *r)
1457 {
1458         p->rng_fault_state = true;
1459         return NT_STATUS_NOT_IMPLEMENTED;
1460 }
1461
1462 /****************************************************************
1463 ****************************************************************/
1464
1465 static bool wb_getdcname(TALLOC_CTX *mem_ctx,
1466                          const char *domain,
1467                          const char **dcname,
1468                          uint32_t flags,
1469                          WERROR *werr)
1470 {
1471         wbcErr result;
1472         struct wbcDomainControllerInfo *dc_info = NULL;
1473
1474         result = wbcLookupDomainController(domain,
1475                                            flags,
1476                                            &dc_info);
1477         switch (result) {
1478         case WBC_ERR_SUCCESS:
1479                 break;
1480         case WBC_ERR_WINBIND_NOT_AVAILABLE:
1481                 return false;
1482         case WBC_ERR_DOMAIN_NOT_FOUND:
1483                 *werr = WERR_NO_SUCH_DOMAIN;
1484                 return true;
1485         default:
1486                 *werr = WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1487                 return true;
1488         }
1489
1490         *dcname = talloc_strdup(mem_ctx, dc_info->dc_name);
1491         wbcFreeMemory(dc_info);
1492         if (!*dcname) {
1493                 *werr = WERR_NOMEM;
1494                 return false;
1495         }
1496
1497         *werr = WERR_OK;
1498
1499         return true;
1500 }
1501
1502 /****************************************************************
1503  _netr_GetDcName
1504 ****************************************************************/
1505
1506 WERROR _netr_GetDcName(pipes_struct *p,
1507                        struct netr_GetDcName *r)
1508 {
1509         NTSTATUS status;
1510         WERROR werr;
1511         uint32_t flags;
1512         struct netr_DsRGetDCNameInfo *info;
1513         bool ret;
1514
1515         ret = wb_getdcname(p->mem_ctx,
1516                            r->in.domainname,
1517                            r->out.dcname,
1518                            WBC_LOOKUP_DC_IS_FLAT_NAME |
1519                            WBC_LOOKUP_DC_RETURN_FLAT_NAME |
1520                            WBC_LOOKUP_DC_PDC_REQUIRED,
1521                            &werr);
1522         if (ret == true) {
1523                 return werr;
1524         }
1525
1526         flags = DS_PDC_REQUIRED | DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME;
1527
1528         status = dsgetdcname(p->mem_ctx,
1529                              smbd_messaging_context(),
1530                              r->in.domainname,
1531                              NULL,
1532                              NULL,
1533                              flags,
1534                              &info);
1535         if (!NT_STATUS_IS_OK(status)) {
1536                 return ntstatus_to_werror(status);
1537         }
1538
1539         *r->out.dcname = talloc_strdup(p->mem_ctx, info->dc_unc);
1540         talloc_free(info);
1541         if (!*r->out.dcname) {
1542                 return WERR_NOMEM;
1543         }
1544
1545         return WERR_OK;
1546 }
1547
1548 /****************************************************************
1549  _netr_GetAnyDCName
1550 ****************************************************************/
1551
1552 WERROR _netr_GetAnyDCName(pipes_struct *p,
1553                           struct netr_GetAnyDCName *r)
1554 {
1555         NTSTATUS status;
1556         WERROR werr;
1557         uint32_t flags;
1558         struct netr_DsRGetDCNameInfo *info;
1559         bool ret;
1560
1561         ret = wb_getdcname(p->mem_ctx,
1562                            r->in.domainname,
1563                            r->out.dcname,
1564                            WBC_LOOKUP_DC_IS_FLAT_NAME |
1565                            WBC_LOOKUP_DC_RETURN_FLAT_NAME,
1566                            &werr);
1567         if (ret == true) {
1568                 return werr;
1569         }
1570
1571         flags = DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME;
1572
1573         status = dsgetdcname(p->mem_ctx,
1574                              smbd_messaging_context(),
1575                              r->in.domainname,
1576                              NULL,
1577                              NULL,
1578                              flags,
1579                              &info);
1580         if (!NT_STATUS_IS_OK(status)) {
1581                 return ntstatus_to_werror(status);
1582         }
1583
1584         *r->out.dcname = talloc_strdup(p->mem_ctx, info->dc_unc);
1585         talloc_free(info);
1586         if (!*r->out.dcname) {
1587                 return WERR_NOMEM;
1588         }
1589
1590         return WERR_OK;
1591 }
1592
1593 /****************************************************************
1594 ****************************************************************/
1595
1596 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1597                              struct netr_DatabaseSync2 *r)
1598 {
1599         p->rng_fault_state = true;
1600         return NT_STATUS_NOT_IMPLEMENTED;
1601 }
1602
1603 /****************************************************************
1604 ****************************************************************/
1605
1606 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1607                             struct netr_DatabaseRedo *r)
1608 {
1609         p->rng_fault_state = true;
1610         return NT_STATUS_NOT_IMPLEMENTED;
1611 }
1612
1613 /****************************************************************
1614 ****************************************************************/
1615
1616 WERROR _netr_DsRGetDCName(pipes_struct *p,
1617                           struct netr_DsRGetDCName *r)
1618 {
1619         p->rng_fault_state = true;
1620         return WERR_NOT_SUPPORTED;
1621 }
1622
1623 /****************************************************************
1624 ****************************************************************/
1625
1626 NTSTATUS _netr_LogonGetCapabilities(pipes_struct *p,
1627                                     struct netr_LogonGetCapabilities *r)
1628 {
1629         return NT_STATUS_NOT_IMPLEMENTED;
1630 }
1631
1632 /****************************************************************
1633 ****************************************************************/
1634
1635 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1636                                      struct netr_NETRLOGONSETSERVICEBITS *r)
1637 {
1638         p->rng_fault_state = true;
1639         return WERR_NOT_SUPPORTED;
1640 }
1641
1642 /****************************************************************
1643 ****************************************************************/
1644
1645 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1646                               struct netr_LogonGetTrustRid *r)
1647 {
1648         p->rng_fault_state = true;
1649         return WERR_NOT_SUPPORTED;
1650 }
1651
1652 /****************************************************************
1653 ****************************************************************/
1654
1655 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1656                                           struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1657 {
1658         p->rng_fault_state = true;
1659         return WERR_NOT_SUPPORTED;
1660 }
1661
1662 /****************************************************************
1663 ****************************************************************/
1664
1665 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1666                                           struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1667 {
1668         p->rng_fault_state = true;
1669         return WERR_NOT_SUPPORTED;
1670 }
1671
1672 /****************************************************************
1673 ****************************************************************/
1674
1675 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1676                             struct netr_DsRGetDCNameEx *r)
1677 {
1678         p->rng_fault_state = true;
1679         return WERR_NOT_SUPPORTED;
1680 }
1681
1682 /****************************************************************
1683 ****************************************************************/
1684
1685 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1686                             struct netr_DsRGetSiteName *r)
1687 {
1688         p->rng_fault_state = true;
1689         return WERR_NOT_SUPPORTED;
1690 }
1691
1692 /****************************************************************
1693 ****************************************************************/
1694
1695 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1696                                   struct netr_LogonGetDomainInfo *r)
1697 {
1698         p->rng_fault_state = true;
1699         return NT_STATUS_NOT_IMPLEMENTED;
1700 }
1701
1702 /****************************************************************
1703 ****************************************************************/
1704
1705 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1706                                struct netr_ServerPasswordGet *r)
1707 {
1708         p->rng_fault_state = true;
1709         return WERR_NOT_SUPPORTED;
1710 }
1711
1712 /****************************************************************
1713 ****************************************************************/
1714
1715 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1716                                 struct netr_NETRLOGONSENDTOSAM *r)
1717 {
1718         p->rng_fault_state = true;
1719         return WERR_NOT_SUPPORTED;
1720 }
1721
1722 /****************************************************************
1723 ****************************************************************/
1724
1725 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1726                                     struct netr_DsRAddressToSitenamesW *r)
1727 {
1728         p->rng_fault_state = true;
1729         return WERR_NOT_SUPPORTED;
1730 }
1731
1732 /****************************************************************
1733 ****************************************************************/
1734
1735 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1736                              struct netr_DsRGetDCNameEx2 *r)
1737 {
1738         p->rng_fault_state = true;
1739         return WERR_NOT_SUPPORTED;
1740 }
1741
1742 /****************************************************************
1743 ****************************************************************/
1744
1745 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1746                                                  struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1747 {
1748         p->rng_fault_state = true;
1749         return WERR_NOT_SUPPORTED;
1750 }
1751
1752 /****************************************************************
1753 ****************************************************************/
1754
1755 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1756                                            struct netr_NetrEnumerateTrustedDomainsEx *r)
1757 {
1758         p->rng_fault_state = true;
1759         return WERR_NOT_SUPPORTED;
1760 }
1761
1762 /****************************************************************
1763 ****************************************************************/
1764
1765 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1766                                       struct netr_DsRAddressToSitenamesExW *r)
1767 {
1768         p->rng_fault_state = true;
1769         return WERR_NOT_SUPPORTED;
1770 }
1771
1772 /****************************************************************
1773 ****************************************************************/
1774
1775 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1776                                    struct netr_DsrGetDcSiteCoverageW *r)
1777 {
1778         p->rng_fault_state = true;
1779         return WERR_NOT_SUPPORTED;
1780 }
1781
1782 /****************************************************************
1783 ****************************************************************/
1784
1785 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1786                                       struct netr_DsrEnumerateDomainTrusts *r)
1787 {
1788         p->rng_fault_state = true;
1789         return WERR_NOT_SUPPORTED;
1790 }
1791
1792 /****************************************************************
1793 ****************************************************************/
1794
1795 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1796                                          struct netr_DsrDeregisterDNSHostRecords *r)
1797 {
1798         p->rng_fault_state = true;
1799         return WERR_NOT_SUPPORTED;
1800 }
1801
1802 /****************************************************************
1803 ****************************************************************/
1804
1805 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1806                                        struct netr_ServerTrustPasswordsGet *r)
1807 {
1808         p->rng_fault_state = true;
1809         return NT_STATUS_NOT_IMPLEMENTED;
1810 }
1811
1812 /****************************************************************
1813 ****************************************************************/
1814
1815 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1816                                           struct netr_DsRGetForestTrustInformation *r)
1817 {
1818         p->rng_fault_state = true;
1819         return WERR_NOT_SUPPORTED;
1820 }
1821
1822 /****************************************************************
1823 ****************************************************************/
1824
1825 WERROR _netr_GetForestTrustInformation(pipes_struct *p,
1826                                        struct netr_GetForestTrustInformation *r)
1827 {
1828         p->rng_fault_state = true;
1829         return WERR_NOT_SUPPORTED;
1830 }
1831
1832 /****************************************************************
1833 ****************************************************************/
1834
1835 NTSTATUS _netr_ServerGetTrustInfo(pipes_struct *p,
1836                                   struct netr_ServerGetTrustInfo *r)
1837 {
1838         p->rng_fault_state = true;
1839         return NT_STATUS_NOT_IMPLEMENTED;
1840 }
1841