Given Jeremy's positive response, and a lack of one from tpot, I'll commit
[kai/samba.git] / source3 / libsmb / cli_netlogon.c
1 /* 
2    Unix SMB/CIFS implementation.
3    NT Domain Authentication SMB / MSRPC client
4    Copyright (C) Andrew Tridgell 1992-2000
5    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
6    Copyright (C) Tim Potter 2001
7    Copyright (C) Paul Ashton                       1997.
8    Copyright (C) Jeremy Allison                    1998.
9    Copyright (C) Andrew Bartlett                   2001.
10    
11    This program is free software; you can redistribute it and/or modify
12    it under the terms of the GNU General Public License as published by
13    the Free Software Foundation; either version 2 of the License, or
14    (at your option) any later version.
15    
16    This program is distributed in the hope that it will be useful,
17    but WITHOUT ANY WARRANTY; without even the implied warranty of
18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19    GNU General Public License for more details.
20    
21    You should have received a copy of the GNU General Public License
22    along with this program; if not, write to the Free Software
23    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 */
25
26 #include "includes.h"
27
28 /* LSA Request Challenge. Sends our challenge to server, then gets
29    server response. These are used to generate the credentials. */
30
31 NTSTATUS new_cli_net_req_chal(struct cli_state *cli, DOM_CHAL *clnt_chal, 
32                               DOM_CHAL *srv_chal)
33 {
34         prs_struct qbuf, rbuf;
35         NET_Q_REQ_CHAL q;
36         NET_R_REQ_CHAL r;
37         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
38         extern pstring global_myname;
39
40         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
41         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
42         
43         /* create and send a MSRPC command with api NET_REQCHAL */
44
45         DEBUG(4,("new_cli_net_req_chal: LSA Request Challenge from %s to %s: %s\n",
46                  cli->desthost, global_myname, credstr(clnt_chal->data)));
47         
48         /* store the parameters */
49         init_q_req_chal(&q, cli->srv_name_slash, global_myname, clnt_chal);
50         
51         /* Marshall data and send request */
52
53         if (!net_io_q_req_chal("", &q,  &qbuf, 0) ||
54             !rpc_api_pipe_req(cli, NET_REQCHAL, &qbuf, &rbuf)) {
55                 goto done;
56         }
57
58         /* Unmarhall response */
59
60         if (!net_io_r_req_chal("", &r, &rbuf, 0)) {
61                 goto done;
62         }
63
64         result = r.status;
65
66         /* Return result */
67
68         if (NT_STATUS_IS_OK(result)) {
69                 memcpy(srv_chal, r.srv_chal.data, sizeof(srv_chal->data));
70         }
71         
72  done:
73         prs_mem_free(&qbuf);
74         prs_mem_free(&rbuf);
75         
76         return result;
77 }
78
79 /****************************************************************************
80 LSA Authenticate 2
81
82 Send the client credential, receive back a server credential.
83 Ensure that the server credential returned matches the session key 
84 encrypt of the server challenge originally received. JRA.
85 ****************************************************************************/
86
87 NTSTATUS new_cli_net_auth2(struct cli_state *cli, 
88                            uint16 sec_chan, 
89                            uint32 neg_flags, DOM_CHAL *srv_chal)
90 {
91         prs_struct qbuf, rbuf;
92         NET_Q_AUTH_2 q;
93         NET_R_AUTH_2 r;
94         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
95         extern pstring global_myname;
96
97         prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
98         prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
99
100         /* create and send a MSRPC command with api NET_AUTH2 */
101
102         DEBUG(4,("new_cli_net_auth2: srv:%s acct:%s sc:%x mc: %s chal %s neg: %x\n",
103                  cli->srv_name_slash, cli->mach_acct, sec_chan, global_myname,
104                  credstr(cli->clnt_cred.challenge.data), neg_flags));
105
106         /* store the parameters */
107         init_q_auth_2(&q, cli->srv_name_slash, cli->mach_acct, 
108                       sec_chan, global_myname, &cli->clnt_cred.challenge, 
109                       neg_flags);
110
111         /* turn parameters into data stream */
112
113         if (!net_io_q_auth_2("", &q,  &qbuf, 0) ||
114             !rpc_api_pipe_req(cli, NET_AUTH2, &qbuf, &rbuf)) {
115                 goto done;
116         }
117         
118         /* Unmarshall response */
119         
120         if (!net_io_r_auth_2("", &r, &rbuf, 0)) {
121                 goto done;
122         }
123
124         result = r.status;
125
126         if (NT_STATUS_IS_OK(result)) {
127                 UTIME zerotime;
128                 
129                 /*
130                  * Check the returned value using the initial
131                  * server received challenge.
132                  */
133
134                 zerotime.time = 0;
135                 if (cred_assert( &r.srv_chal, cli->sess_key, srv_chal, 
136                                  zerotime) == 0) {
137
138                         /*
139                          * Server replied with bad credential. Fail.
140                          */
141                         DEBUG(0,("new_cli_net_auth2: server %s replied with bad credential (bad machine \
142 password ?).\n", cli->desthost ));
143                         result = NT_STATUS_ACCESS_DENIED;
144                         goto done;
145                 }
146         }
147
148  done:
149         prs_mem_free(&qbuf);
150         prs_mem_free(&rbuf);
151         
152         return result;
153 }
154
155 /* Initialize domain session credentials */
156
157 NTSTATUS new_cli_nt_setup_creds(struct cli_state *cli, 
158                                 uint16 sec_chan,
159                                 const unsigned char mach_pwd[16])
160 {
161         DOM_CHAL clnt_chal;
162         DOM_CHAL srv_chal;
163         UTIME zerotime;
164         NTSTATUS result;
165
166         /******************* Request Challenge ********************/
167
168         generate_random_buffer(clnt_chal.data, 8, False);
169         
170         /* send a client challenge; receive a server challenge */
171         result = new_cli_net_req_chal(cli, &clnt_chal, &srv_chal);
172
173         if (!NT_STATUS_IS_OK(result)) {
174                 DEBUG(0,("new_cli_nt_setup_creds: request challenge failed\n"));
175                 return result;
176         }
177         
178         /**************** Long-term Session key **************/
179
180         /* calculate the session key */
181         cred_session_key(&clnt_chal, &srv_chal, mach_pwd, 
182                          cli->sess_key);
183         memset((char *)cli->sess_key+8, '\0', 8);
184
185         /******************* Authenticate 2 ********************/
186
187         /* calculate auth-2 credentials */
188         zerotime.time = 0;
189         cred_create(cli->sess_key, &clnt_chal, zerotime, 
190                     &cli->clnt_cred.challenge);
191
192         /*  
193          * Send client auth-2 challenge.
194          * Receive an auth-2 challenge response and check it.
195          */
196         
197         result = new_cli_net_auth2(cli, sec_chan, 0x000001ff, 
198                                    &srv_chal);
199         if (!NT_STATUS_IS_OK(result)) {
200                 DEBUG(0,("cli_nt_setup_creds: auth2 challenge failed %s\n",
201                          nt_errstr(result)));
202         }
203
204         return result;
205 }
206
207 /* Logon Control 2 */
208
209 NTSTATUS cli_netlogon_logon_ctrl2(struct cli_state *cli, TALLOC_CTX *mem_ctx,
210                                   uint32 query_level)
211 {
212         prs_struct qbuf, rbuf;
213         NET_Q_LOGON_CTRL2 q;
214         NET_R_LOGON_CTRL2 r;
215         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
216
217         ZERO_STRUCT(q);
218         ZERO_STRUCT(r);
219
220         /* Initialise parse structures */
221
222         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
223         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
224
225         /* Initialise input parameters */
226
227         init_net_q_logon_ctrl2(&q, cli->srv_name_slash, query_level);
228
229         /* Marshall data and send request */
230
231         if (!net_io_q_logon_ctrl2("", &q, &qbuf, 0) ||
232             !rpc_api_pipe_req(cli, NET_LOGON_CTRL2, &qbuf, &rbuf)) {
233                 result = NT_STATUS_UNSUCCESSFUL;
234                 goto done;
235         }
236
237         /* Unmarshall response */
238
239         if (!net_io_r_logon_ctrl2("", &r, &rbuf, 0)) {
240                 result = NT_STATUS_UNSUCCESSFUL;
241                 goto done;
242         }
243
244         result = r.status;
245
246  done:
247         prs_mem_free(&qbuf);
248         prs_mem_free(&rbuf);
249
250         return result;
251 }
252
253 /****************************************************************************
254 Generate the next creds to use.  Yuck - this is a cut&paste from another
255 file.  They should be combined at some stage.  )-:
256 ****************************************************************************/
257
258 static void gen_next_creds( struct cli_state *cli, DOM_CRED *new_clnt_cred)
259 {
260   /*
261    * Create the new client credentials.
262    */
263
264   cli->clnt_cred.timestamp.time = time(NULL);
265
266   memcpy(new_clnt_cred, &cli->clnt_cred, sizeof(*new_clnt_cred));
267
268   /* Calculate the new credentials. */
269   cred_create(cli->sess_key, &(cli->clnt_cred.challenge),
270               new_clnt_cred->timestamp, &(new_clnt_cred->challenge));
271
272 }
273
274 /* Sam synchronisation */
275
276 NTSTATUS cli_netlogon_sam_sync(struct cli_state *cli, TALLOC_CTX *mem_ctx, DOM_CRED *ret_creds,
277                                uint32 database_id, uint32 *num_deltas,
278                                SAM_DELTA_HDR **hdr_deltas, 
279                                SAM_DELTA_CTR **deltas)
280 {
281         prs_struct qbuf, rbuf;
282         NET_Q_SAM_SYNC q;
283         NET_R_SAM_SYNC r;
284         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
285         DOM_CRED clnt_creds;
286
287         ZERO_STRUCT(q);
288         ZERO_STRUCT(r);
289
290         /* Initialise parse structures */
291
292         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
293         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
294
295         /* Initialise input parameters */
296
297         gen_next_creds(cli, &clnt_creds);
298
299         init_net_q_sam_sync(&q, cli->srv_name_slash, cli->clnt_name_slash + 2,
300                             &clnt_creds, ret_creds, database_id);
301
302         /* Marshall data and send request */
303
304         if (!net_io_q_sam_sync("", &q, &qbuf, 0) ||
305             !rpc_api_pipe_req(cli, NET_SAM_SYNC, &qbuf, &rbuf)) {
306                 result = NT_STATUS_UNSUCCESSFUL;
307                 goto done;
308         }
309
310         /* Unmarshall response */
311
312         if (!net_io_r_sam_sync("", cli->sess_key, &r, &rbuf, 0)) {
313                 result = NT_STATUS_UNSUCCESSFUL;
314                 goto done;
315         }
316
317         /* Return results */
318
319         result = r.status;
320         *num_deltas = r.num_deltas2;
321         *hdr_deltas = r.hdr_deltas;
322         *deltas = r.deltas;
323
324         memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds));
325
326  done:
327         prs_mem_free(&qbuf);
328         prs_mem_free(&rbuf);
329
330         return result;
331 }
332
333 /* Sam synchronisation */
334
335 NTSTATUS cli_netlogon_sam_deltas(struct cli_state *cli, TALLOC_CTX *mem_ctx,
336                                  uint32 database_id, UINT64_S seqnum,
337                                  uint32 *num_deltas, 
338                                  SAM_DELTA_HDR **hdr_deltas, 
339                                  SAM_DELTA_CTR **deltas)
340 {
341         prs_struct qbuf, rbuf;
342         NET_Q_SAM_DELTAS q;
343         NET_R_SAM_DELTAS r;
344         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
345         DOM_CRED clnt_creds;
346
347         ZERO_STRUCT(q);
348         ZERO_STRUCT(r);
349
350         /* Initialise parse structures */
351
352         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
353         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
354
355         /* Initialise input parameters */
356
357         gen_next_creds(cli, &clnt_creds);
358
359         init_net_q_sam_deltas(&q, cli->srv_name_slash, 
360                               cli->clnt_name_slash + 2, &clnt_creds, 
361                               database_id, seqnum);
362
363         /* Marshall data and send request */
364
365         if (!net_io_q_sam_deltas("", &q, &qbuf, 0) ||
366             !rpc_api_pipe_req(cli, NET_SAM_DELTAS, &qbuf, &rbuf)) {
367                 result = NT_STATUS_UNSUCCESSFUL;
368                 goto done;
369         }
370
371         /* Unmarshall response */
372
373         if (!net_io_r_sam_deltas("", cli->sess_key, &r, &rbuf, 0)) {
374                 result = NT_STATUS_UNSUCCESSFUL;
375                 goto done;
376         }
377
378         /* Return results */
379
380         result = r.status;
381         *num_deltas = r.num_deltas2;
382         *hdr_deltas = r.hdr_deltas;
383         *deltas = r.deltas;
384
385  done:
386         prs_mem_free(&qbuf);
387         prs_mem_free(&rbuf);
388
389         return result;
390 }
391
392 /* Logon domain user */
393
394 NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
395                                 char *username, char *password,
396                                 int logon_type)
397 {
398         prs_struct qbuf, rbuf;
399         NET_Q_SAM_LOGON q;
400         NET_R_SAM_LOGON r;
401         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
402         DOM_CRED clnt_creds, dummy_rtn_creds;
403         extern pstring global_myname;
404         NET_ID_INFO_CTR ctr;
405         NET_USER_INFO_3 user;
406         int validation_level = 3;
407
408         ZERO_STRUCT(q);
409         ZERO_STRUCT(r);
410
411         /* Initialise parse structures */
412
413         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
414         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
415
416         /* Initialise input parameters */
417
418         gen_next_creds(cli, &clnt_creds);
419
420         q.validation_level = validation_level;
421
422         memset(&dummy_rtn_creds, '\0', sizeof(dummy_rtn_creds));
423         dummy_rtn_creds.timestamp.time = time(NULL);
424
425         ctr.switch_value = logon_type;
426
427         switch (logon_type) {
428         case INTERACTIVE_LOGON_TYPE: {
429                 unsigned char lm_owf_user_pwd[16], nt_owf_user_pwd[16];
430
431                 nt_lm_owf_gen(password, nt_owf_user_pwd, lm_owf_user_pwd);
432
433                 init_id_info1(&ctr.auth.id1, lp_workgroup(), 
434                               0, /* param_ctrl */
435                               0xdead, 0xbeef, /* LUID? */
436                               username, cli->clnt_name_slash,
437                               cli->sess_key, lm_owf_user_pwd,
438                               nt_owf_user_pwd);
439
440                 break;
441         }
442         case NET_LOGON_TYPE: {
443                 uint8 chal[8];
444                 unsigned char local_lm_response[24];
445                 unsigned char local_nt_response[24];
446
447                 generate_random_buffer(chal, 8, False);
448
449                 SMBencrypt(password, chal, local_lm_response);
450                 SMBNTencrypt(password, chal, local_nt_response);
451
452                 init_id_info2(&ctr.auth.id2, lp_workgroup(), 
453                               0, /* param_ctrl */
454                               0xdead, 0xbeef, /* LUID? */
455                               username, cli->clnt_name_slash, chal,
456                               local_lm_response, 24, local_nt_response, 24);
457                 break;
458         }
459         default:
460                 DEBUG(0, ("switch value %d not supported\n", 
461                           ctr.switch_value));
462                 goto done;
463         }
464
465         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname,
466                       &clnt_creds, &dummy_rtn_creds, logon_type,
467                       &ctr);
468
469         /* Marshall data and send request */
470
471         if (!net_io_q_sam_logon("", &q, &qbuf, 0) ||
472             !rpc_api_pipe_req(cli, NET_SAMLOGON, &qbuf, &rbuf)) {
473                 goto done;
474         }
475
476         /* Unmarshall response */
477
478         r.user = &user;
479
480         if (!net_io_r_sam_logon("", &r, &rbuf, 0)) {
481                 goto done;
482         }
483
484         /* Return results */
485
486         result = r.status;
487
488  done:
489         prs_mem_free(&qbuf);
490         prs_mem_free(&rbuf);
491
492         return result;
493 }
494
495
496 /** 
497  * Logon domain user with an 'network' SAM logon 
498  *
499  * @param info3 Pointer to a NET_USER_INFO_3 already allocated by the caller.
500  **/
501
502 NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
503                                         const char *username, const char *domain, const char *workstation, 
504                                         const uint8 chal[8],
505                                         DATA_BLOB lm_response, DATA_BLOB nt_response,
506                                         NET_USER_INFO_3 *info3)
507
508 {
509         prs_struct qbuf, rbuf;
510         NET_Q_SAM_LOGON q;
511         NET_R_SAM_LOGON r;
512         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
513         DOM_CRED clnt_creds, dummy_rtn_creds;
514         NET_ID_INFO_CTR ctr;
515         extern pstring global_myname;
516         int validation_level = 3;
517         char *workstation_name_slash;
518         
519         ZERO_STRUCT(q);
520         ZERO_STRUCT(r);
521
522         workstation_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", workstation);
523         
524         if (!workstation_name_slash) {
525                 DEBUG(0, ("talloc_asprintf failed!\n"));
526                 return NT_STATUS_NO_MEMORY;
527         }
528
529         /* Initialise parse structures */
530
531         prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
532         prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
533
534         /* Initialise input parameters */
535
536         gen_next_creds(cli, &clnt_creds);
537
538         q.validation_level = validation_level;
539
540         memset(&dummy_rtn_creds, '\0', sizeof(dummy_rtn_creds));
541         dummy_rtn_creds.timestamp.time = time(NULL);
542
543         ctr.switch_value = NET_LOGON_TYPE;
544
545         init_id_info2(&ctr.auth.id2, domain,
546                       0, /* param_ctrl */
547                       0xdead, 0xbeef, /* LUID? */
548                       username, workstation_name_slash, (const uchar*)chal,
549                       lm_response.data, lm_response.length, nt_response.data, nt_response.length);
550  
551         init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname,
552                       &clnt_creds, &dummy_rtn_creds, NET_LOGON_TYPE,
553                       &ctr);
554
555         /* Marshall data and send request */
556
557         if (!net_io_q_sam_logon("", &q, &qbuf, 0) ||
558             !rpc_api_pipe_req(cli, NET_SAMLOGON, &qbuf, &rbuf)) {
559                 goto done;
560         }
561
562         /* Unmarshall response */
563
564         r.user = info3;
565
566         if (!net_io_r_sam_logon("", &r, &rbuf, 0)) {
567                 goto done;
568         }
569
570         /* Return results */
571
572         result = r.status;
573
574  done:
575         prs_mem_free(&qbuf);
576         prs_mem_free(&rbuf);
577
578         return result;
579 }
580
581 /***************************************************************************
582 LSA Server Password Set.
583 ****************************************************************************/
584
585 NTSTATUS cli_net_srv_pwset(struct cli_state *cli, TALLOC_CTX *mem_ctx, 
586                            char* machine_name, uint8 hashed_mach_pwd[16])
587 {
588         prs_struct rbuf;
589         prs_struct qbuf; 
590         DOM_CRED new_clnt_cred;
591         NET_Q_SRV_PWSET q_s;
592         uint16 sec_chan_type = 2;
593         NTSTATUS nt_status;
594         char *mach_acct;
595
596         gen_next_creds( cli, &new_clnt_cred);
597         
598         prs_init(&qbuf , 1024, mem_ctx, MARSHALL);
599         prs_init(&rbuf, 0,    mem_ctx, UNMARSHALL);
600         
601         /* create and send a MSRPC command with api NET_SRV_PWSET */
602         
603         mach_acct = talloc_asprintf(mem_ctx, "%s$", machine_name);
604         
605         if (!mach_acct) {
606                 DEBUG(0,("talloc_asprintf failed!\n"));
607                 nt_status = NT_STATUS_NO_MEMORY;
608                 goto done;
609         }
610
611         DEBUG(4,("cli_net_srv_pwset: srv:%s acct:%s sc: %d mc: %s clnt %s %x\n",
612                  cli->srv_name_slash, mach_acct, sec_chan_type, machine_name,
613                  credstr(new_clnt_cred.challenge.data), new_clnt_cred.timestamp.time));
614         
615         /* store the parameters */
616         init_q_srv_pwset(&q_s, cli->srv_name_slash, cli->sess_key,
617                          mach_acct, sec_chan_type, machine_name, 
618                          &new_clnt_cred, (char *)hashed_mach_pwd);
619         
620         /* turn parameters into data stream */
621         if(!net_io_q_srv_pwset("", &q_s,  &qbuf, 0)) {
622                 DEBUG(0,("cli_net_srv_pwset: Error : failed to marshall NET_Q_SRV_PWSET struct.\n"));
623                 nt_status = NT_STATUS_UNSUCCESSFUL;
624                 goto done;
625         }
626         
627         /* send the data on \PIPE\ */
628         if (rpc_api_pipe_req(cli, NET_SRVPWSET, &qbuf, &rbuf))
629         {
630                 NET_R_SRV_PWSET r_s;
631                 
632                 if (!net_io_r_srv_pwset("", &r_s, &rbuf, 0)) {
633                         nt_status =  NT_STATUS_UNSUCCESSFUL;
634                         goto done;
635                 }
636                 
637                 nt_status = r_s.status;
638
639                 if (!NT_STATUS_IS_OK(r_s.status))
640                 {
641                         /* report error code */
642                         DEBUG(0,("cli_net_srv_pwset: %s\n", nt_errstr(nt_status)));
643                         goto done;
644                 }
645
646                 /* Update the credentials. */
647                 if (!clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &(r_s.srv_cred)))
648                 {
649                         /*
650                          * Server replied with bad credential. Fail.
651                          */
652                         DEBUG(0,("cli_net_srv_pwset: server %s replied with bad credential (bad machine \
653 password ?).\n", cli->desthost ));
654                         nt_status = NT_STATUS_UNSUCCESSFUL;
655                 }
656         }
657
658  done:
659         prs_mem_free(&qbuf);
660         prs_mem_free(&rbuf);
661         
662         return nt_status;
663 }
664