2 Unix SMB/CIFS implementation.
4 CLDAP server - netlogon handling
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/ldb/include/ldb.h"
25 #include "lib/ldb/include/ldb_errors.h"
26 #include "lib/events/events.h"
27 #include "lib/socket/socket.h"
28 #include "smbd/service_task.h"
29 #include "cldap_server/cldap_server.h"
30 #include "librpc/gen_ndr/ndr_misc.h"
31 #include "libcli/ldap/ldap_ndr.h"
32 #include "libcli/security/security.h"
33 #include "dsdb/samdb/samdb.h"
34 #include "auth/auth.h"
36 #include "system/network.h"
37 #include "lib/socket/netif.h"
38 #include "param/param.h"
40 fill in the cldap netlogon union for a given version
42 NTSTATUS fill_netlogon_samlogon_response(struct ldb_context *sam_ctx,
45 const char *netbios_domain,
46 struct dom_sid *domain_sid,
47 const char *domain_guid,
49 const char *src_address,
51 struct loadparm_context *lp_ctx,
52 struct netlogon_samlogon_response *netlogon)
54 const char *ref_attrs[] = {"nETBIOSName", "dnsRoot", "ncName", NULL};
55 const char *dom_attrs[] = {"objectGUID", NULL};
56 struct ldb_result *ref_res = NULL, *dom_res = NULL;
58 const char **services = lp_server_services(lp_ctx);
61 struct GUID domain_uuid;
63 const char *dns_domain;
64 const char *pdc_dns_name;
66 const char *server_site;
67 const char *client_site;
69 struct ldb_dn *partitions_basedn;
70 struct interface *ifaces;
72 partitions_basedn = samdb_partitions_dn(sam_ctx, mem_ctx);
74 /* the domain has an optional trailing . */
75 if (domain && domain[strlen(domain)-1] == '.') {
76 domain = talloc_strndup(mem_ctx, domain, strlen(domain)-1);
80 struct ldb_dn *dom_dn;
81 /* try and find the domain */
83 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &ref_res,
84 partitions_basedn, LDB_SCOPE_ONELEVEL,
86 "(&(&(objectClass=crossRef)(dnsRoot=%s))(nETBIOSName=*))",
89 if (ret != LDB_SUCCESS) {
90 DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
92 ldb_errstring(sam_ctx)));
93 return NT_STATUS_NO_SUCH_DOMAIN;
94 } else if (ref_res->count == 1) {
95 talloc_steal(mem_ctx, dom_res);
96 dom_dn = ldb_msg_find_attr_as_dn(sam_ctx, mem_ctx, ref_res->msgs[0], "ncName");
98 return NT_STATUS_NO_SUCH_DOMAIN;
100 ret = ldb_search(sam_ctx, dom_dn,
101 LDB_SCOPE_BASE, "objectClass=domain",
102 dom_attrs, &dom_res);
103 if (ret != LDB_SUCCESS) {
104 DEBUG(2,("Error finding domain '%s'/'%s' in sam: %s\n", domain, ldb_dn_get_linearized(dom_dn), ldb_errstring(sam_ctx)));
105 return NT_STATUS_NO_SUCH_DOMAIN;
107 talloc_steal(mem_ctx, dom_res);
108 if (dom_res->count != 1) {
109 DEBUG(2,("Error finding domain '%s'/'%s' in sam\n", domain, ldb_dn_get_linearized(dom_dn)));
110 return NT_STATUS_NO_SUCH_DOMAIN;
112 } else if (ref_res->count > 1) {
113 talloc_free(ref_res);
114 return NT_STATUS_NO_SUCH_DOMAIN;
118 if (netbios_domain) {
119 struct ldb_dn *dom_dn;
120 /* try and find the domain */
122 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &ref_res,
123 partitions_basedn, LDB_SCOPE_ONELEVEL,
125 "(&(objectClass=crossRef)(ncName=*)(nETBIOSName=%s))",
128 if (ret != LDB_SUCCESS) {
129 DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
131 ldb_errstring(sam_ctx)));
132 return NT_STATUS_NO_SUCH_DOMAIN;
133 } else if (ref_res->count == 1) {
134 talloc_steal(mem_ctx, dom_res);
135 dom_dn = ldb_msg_find_attr_as_dn(sam_ctx, mem_ctx, ref_res->msgs[0], "ncName");
137 return NT_STATUS_NO_SUCH_DOMAIN;
139 ret = ldb_search(sam_ctx, dom_dn,
140 LDB_SCOPE_BASE, "objectClass=domain",
141 dom_attrs, &dom_res);
142 if (ret != LDB_SUCCESS) {
143 DEBUG(2,("Error finding domain '%s'/'%s' in sam: %s\n", domain, ldb_dn_get_linearized(dom_dn), ldb_errstring(sam_ctx)));
144 return NT_STATUS_NO_SUCH_DOMAIN;
146 talloc_steal(mem_ctx, dom_res);
147 if (dom_res->count != 1) {
148 DEBUG(2,("Error finding domain '%s'/'%s' in sam\n", domain, ldb_dn_get_linearized(dom_dn)));
149 return NT_STATUS_NO_SUCH_DOMAIN;
151 } else if (ref_res->count > 1) {
152 talloc_free(ref_res);
153 return NT_STATUS_NO_SUCH_DOMAIN;
157 if ((dom_res == NULL || dom_res->count == 0) && (domain_guid || domain_sid)) {
161 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &dom_res,
162 NULL, LDB_SCOPE_SUBTREE,
164 "(&(objectClass=domainDNS)(objectGUID=%s))",
166 } else { /* domain_sid case */
167 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &dom_res,
168 NULL, LDB_SCOPE_SUBTREE,
170 "(&(objectClass=domainDNS)(objectSID=%s))",
171 dom_sid_string(mem_ctx, domain_sid));
174 if (ret != LDB_SUCCESS) {
175 DEBUG(2,("Unable to find referece to GUID '%s' or SID %s in sam: %s\n",
176 domain_guid, dom_sid_string(mem_ctx, domain_sid),
177 ldb_errstring(sam_ctx)));
178 return NT_STATUS_NO_SUCH_DOMAIN;
179 } else if (dom_res->count == 1) {
180 /* try and find the domain */
181 ret = ldb_search_exp_fmt(sam_ctx, mem_ctx, &ref_res,
182 partitions_basedn, LDB_SCOPE_ONELEVEL,
184 "(&(objectClass=crossRef)(ncName=%s))",
185 ldb_dn_get_linearized(dom_res->msgs[0]->dn));
187 if (ret != LDB_SUCCESS) {
188 DEBUG(2,("Unable to find referece to '%s' in sam: %s\n",
189 ldb_dn_get_linearized(dom_res->msgs[0]->dn),
190 ldb_errstring(sam_ctx)));
191 return NT_STATUS_NO_SUCH_DOMAIN;
193 } else if (ref_res->count != 1) {
194 DEBUG(2,("Unable to find referece to '%s' in sam\n",
195 ldb_dn_get_linearized(dom_res->msgs[0]->dn)));
196 return NT_STATUS_NO_SUCH_DOMAIN;
198 } else if (dom_res->count > 1) {
199 talloc_free(ref_res);
200 return NT_STATUS_NO_SUCH_DOMAIN;
204 if ((ref_res == NULL || ref_res->count == 0)) {
205 DEBUG(2,("Unable to find domain reference with name %s or GUID {%s}\n", domain, domain_guid));
206 return NT_STATUS_NO_SUCH_DOMAIN;
209 if ((dom_res == NULL || dom_res->count == 0)) {
210 DEBUG(2,("Unable to find domain with name %s or GUID {%s}\n", domain, domain_guid));
211 return NT_STATUS_NO_SUCH_DOMAIN;
215 NBT_SERVER_DS | NBT_SERVER_TIMESERV |
216 NBT_SERVER_CLOSEST | NBT_SERVER_WRITABLE |
217 NBT_SERVER_GOOD_TIMESERV;
219 if (samdb_is_pdc(sam_ctx)) {
220 server_type |= NBT_SERVER_PDC;
223 if (samdb_is_gc(sam_ctx)) {
224 server_type |= NBT_SERVER_GC;
227 if (str_list_check(services, "ldap")) {
228 server_type |= NBT_SERVER_LDAP;
231 if (str_list_check(services, "kdc")) {
232 server_type |= NBT_SERVER_KDC;
235 pdc_name = talloc_asprintf(mem_ctx, "\\\\%s", lp_netbios_name(lp_ctx));
236 domain_uuid = samdb_result_guid(dom_res->msgs[0], "objectGUID");
237 realm = samdb_result_string(ref_res->msgs[0], "dnsRoot", lp_realm(lp_ctx));
238 dns_domain = samdb_result_string(ref_res->msgs[0], "dnsRoot", lp_realm(lp_ctx));
239 pdc_dns_name = talloc_asprintf(mem_ctx, "%s.%s",
240 strlower_talloc(mem_ctx,
241 lp_netbios_name(lp_ctx)),
244 flatname = samdb_result_string(ref_res->msgs[0], "nETBIOSName",
245 lp_workgroup(lp_ctx));
246 server_site = "Default-First-Site-Name";
247 client_site = "Default-First-Site-Name";
248 load_interfaces(mem_ctx, lp_interfaces(lp_ctx), &ifaces);
249 pdc_ip = iface_best_ip(ifaces, src_address);
251 ZERO_STRUCTP(netlogon);
253 if (version & NETLOGON_NT_VERSION_5EX) {
254 uint32_t extra_flags = 0;
255 netlogon->ntver = NETLOGON_NT_VERSION_5EX;
257 /* could check if the user exists */
260 netlogon->nt5_ex.command = LOGON_SAM_LOGON_RESPONSE_EX;
262 netlogon->nt5_ex.command = LOGON_SAM_LOGON_USER_UNKNOWN_EX;
264 netlogon->nt5_ex.server_type = server_type;
265 netlogon->nt5_ex.domain_uuid = domain_uuid;
266 netlogon->nt5_ex.forest = realm;
267 netlogon->nt5_ex.dns_domain = dns_domain;
268 netlogon->nt5_ex.pdc_dns_name = pdc_dns_name;
269 netlogon->nt5_ex.domain = flatname;
270 netlogon->nt5_ex.pdc_name = lp_netbios_name(lp_ctx);
271 netlogon->nt5_ex.user_name = user;
272 netlogon->nt5_ex.server_site = server_site;
273 netlogon->nt5_ex.client_site = client_site;
275 if (version & NETLOGON_NT_VERSION_5EX_WITH_IP) {
276 /* Clearly this needs to be fixed up for IPv6 */
277 extra_flags = NETLOGON_NT_VERSION_5EX_WITH_IP;
278 netlogon->nt5_ex.sockaddr.sa_family = 2;
279 netlogon->nt5_ex.sockaddr.pdc_ip = pdc_ip;
280 netlogon->nt5_ex.sockaddr.remaining = data_blob(NULL, 4);
282 netlogon->nt5_ex.nt_version = NETLOGON_NT_VERSION_1|NETLOGON_NT_VERSION_5EX|extra_flags;
283 netlogon->nt5_ex.lmnt_token = 0xFFFF;
284 netlogon->nt5_ex.lm20_token = 0xFFFF;
286 } else if (version & NETLOGON_NT_VERSION_5) {
287 netlogon->ntver = NETLOGON_NT_VERSION_5;
289 /* could check if the user exists */
292 netlogon->nt5.command = LOGON_SAM_LOGON_RESPONSE;
294 netlogon->nt5.command = LOGON_SAM_LOGON_USER_UNKNOWN;
296 netlogon->nt5.pdc_name = pdc_name;
297 netlogon->nt5.user_name = user;
298 netlogon->nt5.domain_name = flatname;
299 netlogon->nt5.domain_uuid = domain_uuid;
300 netlogon->nt5.forest = realm;
301 netlogon->nt5.dns_domain = dns_domain;
302 netlogon->nt5.pdc_dns_name = pdc_dns_name;
303 netlogon->nt5.pdc_ip = pdc_ip;
304 netlogon->nt5.server_type = server_type;
305 netlogon->nt5.nt_version = NETLOGON_NT_VERSION_1|NETLOGON_NT_VERSION_5;
306 netlogon->nt5.lmnt_token = 0xFFFF;
307 netlogon->nt5.lm20_token = 0xFFFF;
309 } else /* (version & NETLOGON_NT_VERSION_1) and all other cases */ {
310 netlogon->ntver = NETLOGON_NT_VERSION_1;
311 /* could check if the user exists */
314 netlogon->nt4.command = LOGON_SAM_LOGON_RESPONSE;
316 netlogon->nt4.command = LOGON_SAM_LOGON_USER_UNKNOWN;
318 netlogon->nt4.server = pdc_name;
319 netlogon->nt4.user_name = user;
320 netlogon->nt4.domain = flatname;
321 netlogon->nt4.nt_version = NETLOGON_NT_VERSION_1;
322 netlogon->nt4.lmnt_token = 0xFFFF;
323 netlogon->nt4.lm20_token = 0xFFFF;
331 handle incoming cldap requests
333 void cldapd_netlogon_request(struct cldap_socket *cldap,
335 struct ldb_parse_tree *tree,
336 struct socket_address *src)
338 struct cldapd_server *cldapd = talloc_get_type(cldap->incoming.private, struct cldapd_server);
340 const char *domain = NULL;
341 const char *host = NULL;
342 const char *user = NULL;
343 const char *domain_guid = NULL;
344 const char *domain_sid = NULL;
345 int acct_control = -1;
347 struct netlogon_samlogon_response netlogon;
348 NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
350 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
352 if (tree->operation != LDB_OP_AND) goto failed;
354 /* extract the query elements */
355 for (i=0;i<tree->u.list.num_elements;i++) {
356 struct ldb_parse_tree *t = tree->u.list.elements[i];
357 if (t->operation != LDB_OP_EQUALITY) goto failed;
358 if (strcasecmp(t->u.equality.attr, "DnsDomain") == 0) {
359 domain = talloc_strndup(tmp_ctx,
360 (const char *)t->u.equality.value.data,
361 t->u.equality.value.length);
363 if (strcasecmp(t->u.equality.attr, "Host") == 0) {
364 host = talloc_strndup(tmp_ctx,
365 (const char *)t->u.equality.value.data,
366 t->u.equality.value.length);
368 if (strcasecmp(t->u.equality.attr, "DomainGuid") == 0) {
371 enc_status = ldap_decode_ndr_GUID(tmp_ctx,
372 t->u.equality.value, &guid);
373 if (NT_STATUS_IS_OK(enc_status)) {
374 domain_guid = GUID_string(tmp_ctx, &guid);
377 if (strcasecmp(t->u.equality.attr, "DomainSid") == 0) {
378 domain_sid = talloc_strndup(tmp_ctx,
379 (const char *)t->u.equality.value.data,
380 t->u.equality.value.length);
382 if (strcasecmp(t->u.equality.attr, "User") == 0) {
383 user = talloc_strndup(tmp_ctx,
384 (const char *)t->u.equality.value.data,
385 t->u.equality.value.length);
387 if (strcasecmp(t->u.equality.attr, "NtVer") == 0 &&
388 t->u.equality.value.length == 4) {
389 version = IVAL(t->u.equality.value.data, 0);
391 if (strcasecmp(t->u.equality.attr, "AAC") == 0 &&
392 t->u.equality.value.length == 4) {
393 acct_control = IVAL(t->u.equality.value.data, 0);
397 if (domain_guid == NULL && domain == NULL) {
398 domain = lp_realm(cldapd->task->lp_ctx);
405 DEBUG(5,("cldap netlogon query domain=%s host=%s user=%s version=%d guid=%s\n",
406 domain, host, user, version, domain_guid));
408 status = fill_netlogon_samlogon_response(cldapd->samctx, tmp_ctx, domain, NULL, NULL, domain_guid,
410 version, cldapd->task->lp_ctx, &netlogon);
411 if (!NT_STATUS_IS_OK(status)) {
415 status = cldap_netlogon_reply(cldap, message_id, src, version,
417 if (!NT_STATUS_IS_OK(status)) {
421 talloc_free(tmp_ctx);
425 DEBUG(2,("cldap netlogon query failed domain=%s host=%s version=%d - %s\n",
426 domain, host, version, nt_errstr(status)));
427 talloc_free(tmp_ctx);
428 cldap_empty_reply(cldap, message_id, src);