2 Unix SMB/CIFS implementation.
4 CLDAP server - netlogon handling
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/ldb/include/ldb.h"
25 #include "lib/ldb/include/ldb_errors.h"
26 #include "lib/events/events.h"
27 #include "lib/socket/socket.h"
28 #include "smbd/service_task.h"
29 #include "cldap_server/cldap_server.h"
30 #include "librpc/gen_ndr/ndr_misc.h"
31 #include "libcli/ldap/ldap_ndr.h"
32 #include "libcli/security/security.h"
33 #include "dsdb/samdb/samdb.h"
34 #include "auth/auth.h"
36 #include "system/network.h"
37 #include "lib/socket/netif.h"
38 #include "param/param.h"
40 fill in the cldap netlogon union for a given version
42 NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
45 const char *netbios_domain,
46 struct dom_sid *domain_sid,
47 const char *domain_guid,
49 uint32_t acct_control,
50 const char *src_address,
52 struct loadparm_context *lp_ctx,
53 struct netlogon_samlogon_response *netlogon)
55 const char *ref_attrs[] = {"nETBIOSName", "dnsRoot", "ncName", NULL};
56 const char *dom_attrs[] = {"objectGUID", NULL};
57 const char *none_attrs[] = {NULL};
58 struct ldb_result *ref_res = NULL, *dom_res = NULL, *user_res = NULL;
60 const char **services = lp_server_services(lp_ctx);
63 struct GUID domain_uuid;
65 const char *dns_domain;
66 const char *pdc_dns_name;
68 const char *server_site;
69 const char *client_site;
71 struct ldb_dn *partitions_basedn;
72 struct interface *ifaces;
76 partitions_basedn = samdb_partitions_dn(sam_ctx, mem_ctx);
78 /* the domain has an optional trailing . */
79 if (domain && domain[strlen(domain)-1] == '.') {
80 domain = talloc_strndup(mem_ctx, domain, strlen(domain)-1);
84 struct ldb_dn *dom_dn;
85 /* try and find the domain */
87 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &ref_res,
88 partitions_basedn, LDB_SCOPE_ONELEVEL,
90 "(&(&(objectClass=crossRef)(dnsRoot=%s))(nETBIOSName=*))",
91 ldb_binary_encode_string(mem_ctx, domain));
93 if (ret != LDB_SUCCESS) {
94 DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
96 ldb_errstring(sam_ctx)));
97 return NT_STATUS_NO_SUCH_DOMAIN;
98 } else if (ref_res->count == 1) {
99 talloc_steal(mem_ctx, dom_res);
100 dom_dn = ldb_msg_find_attr_as_dn(sam_ctx, mem_ctx, ref_res->msgs[0], "ncName");
102 return NT_STATUS_NO_SUCH_DOMAIN;
104 ret = ldb_search(sam_ctx, dom_dn,
105 LDB_SCOPE_BASE, "objectClass=domain",
106 dom_attrs, &dom_res);
107 if (ret != LDB_SUCCESS) {
108 DEBUG(2,("Error finding domain '%s'/'%s' in sam: %s\n", domain, ldb_dn_get_linearized(dom_dn), ldb_errstring(sam_ctx)));
109 return NT_STATUS_NO_SUCH_DOMAIN;
111 talloc_steal(mem_ctx, dom_res);
112 if (dom_res->count != 1) {
113 DEBUG(2,("Error finding domain '%s'/'%s' in sam\n", domain, ldb_dn_get_linearized(dom_dn)));
114 return NT_STATUS_NO_SUCH_DOMAIN;
116 } else if (ref_res->count > 1) {
117 talloc_free(ref_res);
118 return NT_STATUS_NO_SUCH_DOMAIN;
122 if (netbios_domain) {
123 struct ldb_dn *dom_dn;
124 /* try and find the domain */
126 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &ref_res,
127 partitions_basedn, LDB_SCOPE_ONELEVEL,
129 "(&(objectClass=crossRef)(ncName=*)(nETBIOSName=%s))",
130 ldb_binary_encode_string(mem_ctx, netbios_domain));
132 if (ret != LDB_SUCCESS) {
133 DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
135 ldb_errstring(sam_ctx)));
136 return NT_STATUS_NO_SUCH_DOMAIN;
137 } else if (ref_res->count == 1) {
138 talloc_steal(mem_ctx, dom_res);
139 dom_dn = ldb_msg_find_attr_as_dn(sam_ctx, mem_ctx, ref_res->msgs[0], "ncName");
141 return NT_STATUS_NO_SUCH_DOMAIN;
143 ret = ldb_search(sam_ctx, dom_dn,
144 LDB_SCOPE_BASE, "objectClass=domain",
145 dom_attrs, &dom_res);
146 if (ret != LDB_SUCCESS) {
147 DEBUG(2,("Error finding domain '%s'/'%s' in sam: %s\n", domain, ldb_dn_get_linearized(dom_dn), ldb_errstring(sam_ctx)));
148 return NT_STATUS_NO_SUCH_DOMAIN;
150 talloc_steal(mem_ctx, dom_res);
151 if (dom_res->count != 1) {
152 DEBUG(2,("Error finding domain '%s'/'%s' in sam\n", domain, ldb_dn_get_linearized(dom_dn)));
153 return NT_STATUS_NO_SUCH_DOMAIN;
155 } else if (ref_res->count > 1) {
156 talloc_free(ref_res);
157 return NT_STATUS_NO_SUCH_DOMAIN;
161 if ((dom_res == NULL || dom_res->count == 0) && (domain_guid || domain_sid)) {
165 struct GUID binary_guid;
166 struct ldb_val guid_val;
167 enum ndr_err_code ndr_err;
169 /* By this means, we ensure we don't have funny stuff in the GUID */
171 status = GUID_from_string(domain_guid, &binary_guid);
172 if (!NT_STATUS_IS_OK(status)) {
176 /* And this gets the result into the binary format we want anyway */
177 ndr_err = ndr_push_struct_blob(&guid_val, mem_ctx, NULL, &binary_guid,
178 (ndr_push_flags_fn_t)ndr_push_GUID);
179 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
180 return NT_STATUS_INVALID_PARAMETER;
182 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &dom_res,
183 NULL, LDB_SCOPE_SUBTREE,
185 "(&(objectCategory=Domain-DNS)(objectGUID=%s))",
186 ldb_binary_encode(mem_ctx, guid_val));
187 } else { /* domain_sid case */
189 struct ldb_val sid_val;
190 enum ndr_err_code ndr_err;
192 /* Rather than go via the string, just push into the NDR form */
193 ndr_err = ndr_push_struct_blob(&sid_val, mem_ctx, NULL, &sid,
194 (ndr_push_flags_fn_t)ndr_push_dom_sid);
195 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
196 return NT_STATUS_INVALID_PARAMETER;
199 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &dom_res,
200 NULL, LDB_SCOPE_SUBTREE,
202 "(&(objectCategory=Domain-DNS)(objectSID=%s))",
203 ldb_binary_encode(mem_ctx, sid_val));
206 if (ret != LDB_SUCCESS) {
207 DEBUG(2,("Unable to find referece to GUID '%s' or SID %s in sam: %s\n",
208 domain_guid, dom_sid_string(mem_ctx, domain_sid),
209 ldb_errstring(sam_ctx)));
210 return NT_STATUS_NO_SUCH_DOMAIN;
211 } else if (dom_res->count == 1) {
212 /* try and find the domain */
213 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &ref_res,
214 partitions_basedn, LDB_SCOPE_ONELEVEL,
216 "(&(objectClass=crossRef)(ncName=%s))",
217 ldb_dn_get_linearized(dom_res->msgs[0]->dn));
219 if (ret != LDB_SUCCESS) {
220 DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
221 ldb_dn_get_linearized(dom_res->msgs[0]->dn),
222 ldb_errstring(sam_ctx)));
223 return NT_STATUS_NO_SUCH_DOMAIN;
225 } else if (ref_res->count != 1) {
226 DEBUG(2,("Unable to find referece to '%s' in sam\n",
227 ldb_dn_get_linearized(dom_res->msgs[0]->dn)));
228 return NT_STATUS_NO_SUCH_DOMAIN;
230 } else if (dom_res->count > 1) {
231 talloc_free(ref_res);
232 return NT_STATUS_NO_SUCH_DOMAIN;
237 if ((ref_res == NULL || ref_res->count == 0)) {
238 DEBUG(2,("Unable to find domain reference with name %s or GUID {%s}\n", domain, domain_guid));
239 return NT_STATUS_NO_SUCH_DOMAIN;
242 if ((dom_res == NULL || dom_res->count == 0)) {
243 DEBUG(2,("Unable to find domain with name %s or GUID {%s}\n", domain, domain_guid));
244 return NT_STATUS_NO_SUCH_DOMAIN;
247 /* work around different inputs for not-specified users */
252 /* Enquire about any valid username with just a CLDAP packet -
253 * if kerberos didn't also do this, the security folks would
256 /* Only allow some bits to be enquired: [MS-ATDS] 7.3.3.2 */
257 if (acct_control == (uint32_t)-1) {
260 acct_control = acct_control & (ACB_TEMPDUP | ACB_NORMAL | ACB_DOMTRUST | ACB_WSTRUST | ACB_SVRTRUST);
262 /* We must exclude disabled accounts, but otherwise do the bitwise match the client asked for */
263 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &user_res,
264 dom_res->msgs[0]->dn, LDB_SCOPE_SUBTREE,
266 "(&(objectClass=user)(samAccountName=%s)"
267 "(!(userAccountControl:" LDB_OID_COMPARATOR_AND ":=%u))"
268 "(userAccountControl:" LDB_OID_COMPARATOR_OR ":=%u))",
269 ldb_binary_encode_string(mem_ctx, user),
270 UF_ACCOUNTDISABLE, samdb_acb2uf(acct_control));
271 if (ret != LDB_SUCCESS) {
272 DEBUG(2,("Unable to find referece to user '%s' with ACB 0x%8x under %s: %s\n",
273 user, acct_control, ldb_dn_get_linearized(dom_res->msgs[0]->dn),
274 ldb_errstring(sam_ctx)));
275 return NT_STATUS_NO_SUCH_USER;
276 } else if (user_res->count == 1) {
287 NBT_SERVER_DS | NBT_SERVER_TIMESERV |
288 NBT_SERVER_CLOSEST | NBT_SERVER_WRITABLE |
289 NBT_SERVER_GOOD_TIMESERV | NBT_SERVER_DS_DNS_CONTR |
290 NBT_SERVER_DS_DNS_DOMAIN;
292 if (samdb_is_pdc(sam_ctx)) {
293 server_type |= NBT_SERVER_PDC;
296 if (samdb_is_gc(sam_ctx)) {
297 server_type |= NBT_SERVER_GC;
300 if (str_list_check(services, "ldap")) {
301 server_type |= NBT_SERVER_LDAP;
304 if (str_list_check(services, "kdc")) {
305 server_type |= NBT_SERVER_KDC;
308 if (!ldb_dn_compare_base(ldb_get_root_basedn(sam_ctx), ldb_get_default_basedn(sam_ctx))) {
309 server_type |= NBT_SERVER_DS_DNS_FOREST;
312 pdc_name = talloc_asprintf(mem_ctx, "\\\\%s", lp_netbios_name(lp_ctx));
313 domain_uuid = samdb_result_guid(dom_res->msgs[0], "objectGUID");
314 realm = samdb_result_string(ref_res->msgs[0], "dnsRoot", lp_realm(lp_ctx));
315 dns_domain = samdb_result_string(ref_res->msgs[0], "dnsRoot", lp_realm(lp_ctx));
316 pdc_dns_name = talloc_asprintf(mem_ctx, "%s.%s",
317 strlower_talloc(mem_ctx,
318 lp_netbios_name(lp_ctx)),
321 flatname = samdb_result_string(ref_res->msgs[0], "nETBIOSName",
322 lp_workgroup(lp_ctx));
323 /* FIXME: Hardcoded site names */
324 server_site = "Default-First-Site-Name";
325 client_site = "Default-First-Site-Name";
326 load_interfaces(mem_ctx, lp_interfaces(lp_ctx), &ifaces);
327 pdc_ip = iface_best_ip(ifaces, src_address);
329 ZERO_STRUCTP(netlogon);
331 /* check if either of these bits is present */
332 if (version & (NETLOGON_NT_VERSION_5EX|NETLOGON_NT_VERSION_5EX_WITH_IP)) {
333 uint32_t extra_flags = 0;
334 netlogon->ntver = NETLOGON_NT_VERSION_5EX;
336 /* could check if the user exists */
338 netlogon->nt5_ex.command = LOGON_SAM_LOGON_RESPONSE_EX;
340 netlogon->nt5_ex.command = LOGON_SAM_LOGON_USER_UNKNOWN_EX;
342 netlogon->nt5_ex.server_type = server_type;
343 netlogon->nt5_ex.domain_uuid = domain_uuid;
344 netlogon->nt5_ex.forest = realm;
345 netlogon->nt5_ex.dns_domain = dns_domain;
346 netlogon->nt5_ex.pdc_dns_name = pdc_dns_name;
347 netlogon->nt5_ex.domain = flatname;
348 netlogon->nt5_ex.pdc_name = lp_netbios_name(lp_ctx);
349 netlogon->nt5_ex.user_name = user;
350 netlogon->nt5_ex.server_site = server_site;
351 netlogon->nt5_ex.client_site = client_site;
353 if (version & NETLOGON_NT_VERSION_5EX_WITH_IP) {
354 /* Clearly this needs to be fixed up for IPv6 */
355 extra_flags = NETLOGON_NT_VERSION_5EX_WITH_IP;
356 netlogon->nt5_ex.sockaddr.sa_family = 2;
357 netlogon->nt5_ex.sockaddr.pdc_ip = pdc_ip;
358 netlogon->nt5_ex.sockaddr.remaining = data_blob_talloc_zero(mem_ctx, 8);
360 netlogon->nt5_ex.nt_version = NETLOGON_NT_VERSION_1|NETLOGON_NT_VERSION_5EX|extra_flags;
361 netlogon->nt5_ex.lmnt_token = 0xFFFF;
362 netlogon->nt5_ex.lm20_token = 0xFFFF;
364 } else if (version & NETLOGON_NT_VERSION_5) {
365 netlogon->ntver = NETLOGON_NT_VERSION_5;
367 /* could check if the user exists */
369 netlogon->nt5.command = LOGON_SAM_LOGON_RESPONSE;
371 netlogon->nt5.command = LOGON_SAM_LOGON_USER_UNKNOWN;
373 netlogon->nt5.pdc_name = pdc_name;
374 netlogon->nt5.user_name = user;
375 netlogon->nt5.domain_name = flatname;
376 netlogon->nt5.domain_uuid = domain_uuid;
377 netlogon->nt5.forest = realm;
378 netlogon->nt5.dns_domain = dns_domain;
379 netlogon->nt5.pdc_dns_name = pdc_dns_name;
380 netlogon->nt5.pdc_ip = pdc_ip;
381 netlogon->nt5.server_type = server_type;
382 netlogon->nt5.nt_version = NETLOGON_NT_VERSION_1|NETLOGON_NT_VERSION_5;
383 netlogon->nt5.lmnt_token = 0xFFFF;
384 netlogon->nt5.lm20_token = 0xFFFF;
386 } else /* (version & NETLOGON_NT_VERSION_1) and all other cases */ {
387 netlogon->ntver = NETLOGON_NT_VERSION_1;
388 /* could check if the user exists */
390 netlogon->nt4.command = LOGON_SAM_LOGON_RESPONSE;
392 netlogon->nt4.command = LOGON_SAM_LOGON_USER_UNKNOWN;
394 netlogon->nt4.server = pdc_name;
395 netlogon->nt4.user_name = user;
396 netlogon->nt4.domain = flatname;
397 netlogon->nt4.nt_version = NETLOGON_NT_VERSION_1;
398 netlogon->nt4.lmnt_token = 0xFFFF;
399 netlogon->nt4.lm20_token = 0xFFFF;
407 handle incoming cldap requests
409 void cldapd_netlogon_request(struct cldap_socket *cldap,
411 struct ldb_parse_tree *tree,
412 struct socket_address *src)
414 struct cldapd_server *cldapd = talloc_get_type(cldap->incoming.private, struct cldapd_server);
416 const char *domain = NULL;
417 const char *host = NULL;
418 const char *user = NULL;
419 const char *domain_guid = NULL;
420 const char *domain_sid = NULL;
421 int acct_control = -1;
423 struct netlogon_samlogon_response netlogon;
424 NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
426 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
428 if (tree->operation != LDB_OP_AND) goto failed;
430 /* extract the query elements */
431 for (i=0;i<tree->u.list.num_elements;i++) {
432 struct ldb_parse_tree *t = tree->u.list.elements[i];
433 if (t->operation != LDB_OP_EQUALITY) goto failed;
434 if (strcasecmp(t->u.equality.attr, "DnsDomain") == 0) {
435 domain = talloc_strndup(tmp_ctx,
436 (const char *)t->u.equality.value.data,
437 t->u.equality.value.length);
439 if (strcasecmp(t->u.equality.attr, "Host") == 0) {
440 host = talloc_strndup(tmp_ctx,
441 (const char *)t->u.equality.value.data,
442 t->u.equality.value.length);
444 if (strcasecmp(t->u.equality.attr, "DomainGuid") == 0) {
447 enc_status = ldap_decode_ndr_GUID(tmp_ctx,
448 t->u.equality.value, &guid);
449 if (NT_STATUS_IS_OK(enc_status)) {
450 domain_guid = GUID_string(tmp_ctx, &guid);
453 if (strcasecmp(t->u.equality.attr, "DomainSid") == 0) {
454 domain_sid = talloc_strndup(tmp_ctx,
455 (const char *)t->u.equality.value.data,
456 t->u.equality.value.length);
458 if (strcasecmp(t->u.equality.attr, "User") == 0) {
459 user = talloc_strndup(tmp_ctx,
460 (const char *)t->u.equality.value.data,
461 t->u.equality.value.length);
463 if (strcasecmp(t->u.equality.attr, "NtVer") == 0 &&
464 t->u.equality.value.length == 4) {
465 version = IVAL(t->u.equality.value.data, 0);
467 if (strcasecmp(t->u.equality.attr, "AAC") == 0 &&
468 t->u.equality.value.length == 4) {
469 acct_control = IVAL(t->u.equality.value.data, 0);
473 if (domain_guid == NULL && domain == NULL) {
474 domain = lp_realm(cldapd->task->lp_ctx);
481 DEBUG(5,("cldap netlogon query domain=%s host=%s user=%s version=%d guid=%s\n",
482 domain, host, user, version, domain_guid));
484 status = fill_netlogon_samlogon_response(cldapd->samctx, tmp_ctx, domain, NULL, NULL, domain_guid,
485 user, acct_control, src->addr,
486 version, cldapd->task->lp_ctx, &netlogon);
487 if (!NT_STATUS_IS_OK(status)) {
491 status = cldap_netlogon_reply(cldap, message_id, src, version,
493 if (!NT_STATUS_IS_OK(status)) {
497 talloc_free(tmp_ctx);
501 DEBUG(2,("cldap netlogon query failed domain=%s host=%s version=%d - %s\n",
502 domain, host, version, nt_errstr(status)));
503 talloc_free(tmp_ctx);
504 cldap_empty_reply(cldap, message_id, src);