2 Unix SMB/Netbios implementation.
4 NT Domain Authentication SMB / MSRPC client
5 Copyright (C) Andrew Tridgell 1992-2000
6 Copyright (C) Luke Kenneth Casson Leighton 1996-2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Paul Ashton 1997.
9 Copyright (C) Jeremy Allison 1998.
10 Copyright (C) Andrew Bartlett 2001.
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 2 of the License, or
15 (at your option) any later version.
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program; if not, write to the Free Software
24 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 /* Opens a SMB connection to the netlogon pipe */
31 struct cli_state *cli_netlogon_initialise(struct cli_state *cli,
33 struct ntuser_creds *creds)
35 return cli_pipe_initialise(cli, system_name, PIPE_NETLOGON, creds);
38 /* LSA Request Challenge. Sends our challenge to server, then gets
39 server response. These are used to generate the credentials. */
41 NTSTATUS new_cli_net_req_chal(struct cli_state *cli, DOM_CHAL *clnt_chal,
44 prs_struct qbuf, rbuf;
47 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
48 extern pstring global_myname;
50 prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
51 prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
53 /* create and send a MSRPC command with api NET_REQCHAL */
55 DEBUG(4,("cli_net_req_chal: LSA Request Challenge from %s to %s: %s\n",
56 cli->desthost, global_myname, credstr(clnt_chal->data)));
58 /* store the parameters */
59 init_q_req_chal(&q, cli->srv_name_slash, global_myname, clnt_chal);
61 /* Marshall data and send request */
63 if (!net_io_q_req_chal("", &q, &qbuf, 0) ||
64 !rpc_api_pipe_req(cli, NET_REQCHAL, &qbuf, &rbuf)) {
68 /* Unmarhall response */
70 if (!net_io_r_req_chal("", &r, &rbuf, 0)) {
78 if (NT_STATUS_IS_OK(result)) {
79 memcpy(srv_chal, r.srv_chal.data, sizeof(srv_chal->data));
89 /****************************************************************************
92 Send the client credential, receive back a server credential.
93 Ensure that the server credential returned matches the session key
94 encrypt of the server challenge originally received. JRA.
95 ****************************************************************************/
97 NTSTATUS new_cli_net_auth2(struct cli_state *cli, uint16 sec_chan,
98 uint32 neg_flags, DOM_CHAL *srv_chal)
100 prs_struct qbuf, rbuf;
103 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
104 extern pstring global_myname;
106 prs_init(&qbuf, MAX_PDU_FRAG_LEN, cli->mem_ctx, MARSHALL);
107 prs_init(&rbuf, 0, cli->mem_ctx, UNMARSHALL);
109 /* create and send a MSRPC command with api NET_AUTH2 */
111 DEBUG(4,("cli_net_auth2: srv:%s acct:%s sc:%x mc: %s chal %s neg: %x\n",
112 cli->srv_name_slash, cli->mach_acct, sec_chan, global_myname,
113 credstr(cli->clnt_cred.challenge.data), neg_flags));
115 /* store the parameters */
116 init_q_auth_2(&q, cli->srv_name_slash, cli->mach_acct,
117 sec_chan, global_myname, &cli->clnt_cred.challenge,
120 /* turn parameters into data stream */
122 if (!net_io_q_auth_2("", &q, &qbuf, 0) ||
123 !rpc_api_pipe_req(cli, NET_AUTH2, &qbuf, &rbuf)) {
127 /* Unmarshall response */
129 if (!net_io_r_auth_2("", &r, &rbuf, 0)) {
135 if (NT_STATUS_IS_OK(result)) {
139 * Check the returned value using the initial
140 * server received challenge.
144 if (cred_assert( &r.srv_chal, cli->sess_key, srv_chal,
148 * Server replied with bad credential. Fail.
150 DEBUG(0,("cli_net_auth2: server %s replied with bad credential (bad machine \
151 password ?).\n", cli->desthost ));
152 result = NT_STATUS_ACCESS_DENIED;
164 /* Initialize domain session credentials */
166 NTSTATUS new_cli_nt_setup_creds(struct cli_state *cli,
167 unsigned char mach_pwd[16])
174 /******************* Request Challenge ********************/
176 generate_random_buffer(clnt_chal.data, 8, False);
178 /* send a client challenge; receive a server challenge */
179 result = new_cli_net_req_chal(cli, &clnt_chal, &srv_chal);
181 if (!NT_STATUS_IS_OK(result)) {
182 DEBUG(0,("cli_nt_setup_creds: request challenge failed\n"));
186 /**************** Long-term Session key **************/
188 /* calculate the session key */
189 cred_session_key(&clnt_chal, &srv_chal, (char *)mach_pwd,
191 memset((char *)cli->sess_key+8, '\0', 8);
193 /******************* Authenticate 2 ********************/
195 /* calculate auth-2 credentials */
197 cred_create(cli->sess_key, &clnt_chal, zerotime,
198 &cli->clnt_cred.challenge);
201 * Send client auth-2 challenge.
202 * Receive an auth-2 challenge response and check it.
205 result = new_cli_net_auth2(cli, (lp_server_role() == ROLE_DOMAIN_MEMBER) ?
206 SEC_CHAN_WKSTA : SEC_CHAN_BDC, 0x000001ff,
208 if (!NT_STATUS_IS_OK(result)) {
209 DEBUG(0,("cli_nt_setup_creds: auth2 challenge failed %s\n",
210 get_nt_error_msg(result)));
216 /* Logon Control 2 */
218 NTSTATUS cli_netlogon_logon_ctrl2(struct cli_state *cli, TALLOC_CTX *mem_ctx,
221 prs_struct qbuf, rbuf;
224 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
229 /* Initialise parse structures */
231 prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
232 prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
234 /* Initialise input parameters */
236 init_net_q_logon_ctrl2(&q, cli->srv_name_slash, query_level);
238 /* Marshall data and send request */
240 if (!net_io_q_logon_ctrl2("", &q, &qbuf, 0) ||
241 !rpc_api_pipe_req(cli, NET_LOGON_CTRL2, &qbuf, &rbuf)) {
242 result = NT_STATUS_UNSUCCESSFUL;
246 /* Unmarshall response */
248 if (!net_io_r_logon_ctrl2("", &r, &rbuf, 0)) {
249 result = NT_STATUS_UNSUCCESSFUL;
262 /****************************************************************************
263 Generate the next creds to use. Yuck - this is a cut&paste from another
264 file. They should be combined at some stage. )-:
265 ****************************************************************************/
267 static void gen_next_creds( struct cli_state *cli, DOM_CRED *new_clnt_cred)
270 * Create the new client credentials.
273 cli->clnt_cred.timestamp.time = time(NULL);
275 memcpy(new_clnt_cred, &cli->clnt_cred, sizeof(*new_clnt_cred));
277 /* Calculate the new credentials. */
278 cred_create(cli->sess_key, &(cli->clnt_cred.challenge),
279 new_clnt_cred->timestamp, &(new_clnt_cred->challenge));
283 /* Sam synchronisation */
285 NTSTATUS cli_netlogon_sam_sync(struct cli_state *cli, TALLOC_CTX *mem_ctx,
286 uint32 database_id, uint32 *num_deltas,
287 SAM_DELTA_HDR **hdr_deltas,
288 SAM_DELTA_CTR **deltas)
290 prs_struct qbuf, rbuf;
293 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
299 /* Initialise parse structures */
301 prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
302 prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
304 /* Initialise input parameters */
306 gen_next_creds(cli, &clnt_creds);
308 init_net_q_sam_sync(&q, cli->srv_name_slash, cli->clnt_name_slash + 2,
309 &clnt_creds, database_id);
311 /* Marshall data and send request */
313 if (!net_io_q_sam_sync("", &q, &qbuf, 0) ||
314 !rpc_api_pipe_req(cli, NET_SAM_SYNC, &qbuf, &rbuf)) {
315 result = NT_STATUS_UNSUCCESSFUL;
319 /* Unmarshall response */
321 if (!net_io_r_sam_sync("", cli->sess_key, &r, &rbuf, 0)) {
322 result = NT_STATUS_UNSUCCESSFUL;
329 *num_deltas = r.num_deltas2;
330 *hdr_deltas = r.hdr_deltas;
340 /* Sam synchronisation */
342 NTSTATUS cli_netlogon_sam_deltas(struct cli_state *cli, TALLOC_CTX *mem_ctx,
343 uint32 database_id, UINT64_S seqnum,
345 SAM_DELTA_HDR **hdr_deltas,
346 SAM_DELTA_CTR **deltas)
348 prs_struct qbuf, rbuf;
351 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
357 /* Initialise parse structures */
359 prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
360 prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
362 /* Initialise input parameters */
364 gen_next_creds(cli, &clnt_creds);
366 init_net_q_sam_deltas(&q, cli->srv_name_slash,
367 cli->clnt_name_slash + 2, &clnt_creds,
368 database_id, seqnum);
370 /* Marshall data and send request */
372 if (!net_io_q_sam_deltas("", &q, &qbuf, 0) ||
373 !rpc_api_pipe_req(cli, NET_SAM_DELTAS, &qbuf, &rbuf)) {
374 result = NT_STATUS_UNSUCCESSFUL;
378 /* Unmarshall response */
380 if (!net_io_r_sam_deltas("", cli->sess_key, &r, &rbuf, 0)) {
381 result = NT_STATUS_UNSUCCESSFUL;
388 *num_deltas = r.num_deltas2;
389 *hdr_deltas = r.hdr_deltas;
399 /* Logon domain user */
401 NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx,
402 char *username, char *password,
405 prs_struct qbuf, rbuf;
408 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
409 DOM_CRED clnt_creds, dummy_rtn_creds;
410 extern pstring global_myname;
412 NET_USER_INFO_3 user;
413 int validation_level = 3;
418 /* Initialise parse structures */
420 prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL);
421 prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
423 /* Initialise input parameters */
425 gen_next_creds(cli, &clnt_creds);
427 q.validation_level = validation_level;
429 memset(&dummy_rtn_creds, '\0', sizeof(dummy_rtn_creds));
430 dummy_rtn_creds.timestamp.time = time(NULL);
432 ctr.switch_value = logon_type;
434 switch (logon_type) {
435 case INTERACTIVE_LOGON_TYPE: {
436 unsigned char lm_owf_user_pwd[16], nt_owf_user_pwd[16];
438 nt_lm_owf_gen(password, nt_owf_user_pwd, lm_owf_user_pwd);
440 init_id_info1(&ctr.auth.id1, lp_workgroup(),
442 0xdead, 0xbeef, /* LUID? */
443 username, cli->clnt_name_slash,
444 cli->sess_key, lm_owf_user_pwd,
449 case NET_LOGON_TYPE: {
451 unsigned char local_lm_response[24];
452 unsigned char local_nt_response[24];
454 generate_random_buffer(chal, 8, False);
456 SMBencrypt(password, chal, local_lm_response);
457 SMBNTencrypt(password, chal, local_nt_response);
459 init_id_info2(&ctr.auth.id2, lp_workgroup(),
461 0xdead, 0xbeef, /* LUID? */
462 username, cli->clnt_name_slash, chal,
463 local_lm_response, 24, local_nt_response, 24);
467 DEBUG(0, ("switch value %d not supported\n",
472 init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname,
473 &clnt_creds, &dummy_rtn_creds, logon_type,
476 /* Marshall data and send request */
478 if (!net_io_q_sam_logon("", &q, &qbuf, 0) ||
479 !rpc_api_pipe_req(cli, NET_SAMLOGON, &qbuf, &rbuf)) {
483 /* Unmarshall response */
487 if (!net_io_r_sam_logon("", &r, &rbuf, 0)) {
499 /***************************************************************************
500 LSA Server Password Set.
501 ****************************************************************************/
503 NTSTATUS cli_net_srv_pwset(struct cli_state *cli, TALLOC_CTX *mem_ctx,
504 char* machine_name, uint8 hashed_mach_pwd[16])
508 DOM_CRED new_clnt_cred;
510 uint16 sec_chan_type = 2;
514 gen_next_creds( cli, &new_clnt_cred);
516 prs_init(&buf , 1024, mem_ctx, MARSHALL);
517 prs_init(&rbuf, 0, mem_ctx, UNMARSHALL);
519 /* create and send a MSRPC command with api NET_SRV_PWSET */
521 mach_acct = talloc_asprintf(mem_ctx, "%s$", machine_name);
524 DEBUG(0,("talloc_asprintf failed!\n"));
525 return NT_STATUS_NO_MEMORY;
528 DEBUG(4,("cli_net_srv_pwset: srv:%s acct:%s sc: %d mc: %s clnt %s %x\n",
529 cli->srv_name_slash, mach_acct, sec_chan_type, machine_name,
530 credstr(new_clnt_cred.challenge.data), new_clnt_cred.timestamp.time));
532 /* store the parameters */
533 init_q_srv_pwset(&q_s, cli->srv_name_slash, cli->sess_key,
534 mach_acct, sec_chan_type, machine_name,
535 &new_clnt_cred, (char *)hashed_mach_pwd);
537 /* turn parameters into data stream */
538 if(!net_io_q_srv_pwset("", &q_s, &buf, 0)) {
539 DEBUG(0,("cli_net_srv_pwset: Error : failed to marshall NET_Q_SRV_PWSET struct.\n"));
540 return NT_STATUS_UNSUCCESSFUL;
543 /* send the data on \PIPE\ */
544 if (rpc_api_pipe_req(cli, NET_SRVPWSET, &buf, &rbuf))
548 if (!net_io_r_srv_pwset("", &r_s, &rbuf, 0)) {
549 return NT_STATUS_UNSUCCESSFUL;
552 nt_status = r_s.status;
554 if (!NT_STATUS_IS_OK(r_s.status))
556 /* report error code */
557 DEBUG(0,("cli_net_srv_pwset: %s\n", get_nt_error_msg(nt_status)));
561 /* Update the credentials. */
562 if (!clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &(r_s.srv_cred)))
565 * Server replied with bad credential. Fail.
567 DEBUG(0,("cli_net_srv_pwset: server %s replied with bad credential (bad machine \
568 password ?).\n", cli->desthost ));
569 nt_status = NT_STATUS_UNSUCCESSFUL;