winbind: Generate and pass logon ID

Generate a random logon_id and pass it in the SamLogon calls.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source3/rpc_client/cli_netlogon.c b/source3/rpc_client/cli_netlogon.c
index c7cc183dd16ba76e0a098c288b302285c9aa1436..3ed496862061d8c0032186483e6018db0ffe547e 100644 (file)
--- a/source3/rpc_client/cli_netlogon.c
+++ b/source3/rpc_client/cli_netlogon.c
@@ -458,6 +458,7 @@ NTSTATUS rpccli_netlogon_password_logon(
        const char *username,
        const char *password,
        const char *workstation,
+       const uint64_t logon_id,
        enum netr_LogonInfoClass logon_type,
        uint8_t *authoritative,
        uint32_t *flags,
@@ -508,7 +509,7 @@ NTSTATUS rpccli_netlogon_password_logon(
 
                password_info->identity_info.domain_name.string         = domain;
                password_info->identity_info.parameter_control          = logon_parameters;
-               password_info->identity_info.logon_id                   = 0xbeef0000dead;
+               password_info->identity_info.logon_id                   = logon_id;
                password_info->identity_info.account_name.string        = username;
                password_info->identity_info.workstation.string         = workstation_slash;
 
@@ -550,7 +551,7 @@ NTSTATUS rpccli_netlogon_password_logon(
 
                network_info->identity_info.domain_name.string          = domain;
                network_info->identity_info.parameter_control           = logon_parameters;
-               network_info->identity_info.logon_id                    = 0xbeef0000dead;
+               network_info->identity_info.logon_id                    = logon_id;
                network_info->identity_info.account_name.string         = username;
                network_info->identity_info.workstation.string          = workstation_slash;
 
@@ -605,6 +606,7 @@ NTSTATUS rpccli_netlogon_network_logon(
        const char *username,
        const char *domain,
        const char *workstation,
+       const uint64_t logon_id,
        const uint8_t chal[8],
        DATA_BLOB lm_response,
        DATA_BLOB nt_response,
@@ -668,7 +670,7 @@ NTSTATUS rpccli_netlogon_network_logon(
 
        network_info->identity_info.domain_name.string          = domain;
        network_info->identity_info.parameter_control           = logon_parameters;
-       network_info->identity_info.logon_id                    = 0xbeef0000dead;
+       network_info->identity_info.logon_id                    = logon_id;
        network_info->identity_info.account_name.string         = username;
        network_info->identity_info.workstation.string          = workstation_name_slash;
 
@@ -707,6 +709,7 @@ NTSTATUS rpccli_netlogon_interactive_logon(
        const char *username,
        const char *domain,
        const char *workstation,
+       const uint64_t logon_id,
        DATA_BLOB lm_hash,
        DATA_BLOB nt_hash,
        enum netr_LogonInfoClass logon_type,
@@ -768,7 +771,7 @@ NTSTATUS rpccli_netlogon_interactive_logon(
 
        password_info->identity_info.domain_name.string         = domain;
        password_info->identity_info.parameter_control          = logon_parameters;
-       password_info->identity_info.logon_id                   = 0xbeef0000dead;
+       password_info->identity_info.logon_id                   = logon_id;
        password_info->identity_info.account_name.string        = username;
        password_info->identity_info.workstation.string         = workstation_name_slash;
 

diff --git a/source3/rpc_client/cli_netlogon.h b/source3/rpc_client/cli_netlogon.h
index d0232b51d98d20a16f5fadbae5310987a2edd5d3..362321f312f2be6e65f922795200526d61c452e4 100644 (file)
--- a/source3/rpc_client/cli_netlogon.h
+++ b/source3/rpc_client/cli_netlogon.h
@@ -68,6 +68,7 @@ NTSTATUS rpccli_netlogon_password_logon(
        const char *username,
        const char *password,
        const char *workstation,
+       const uint64_t logon_id,
        enum netr_LogonInfoClass logon_type,
        uint8_t *authoritative,
        uint32_t *flags,
@@ -81,6 +82,7 @@ NTSTATUS rpccli_netlogon_network_logon(
        const char *username,
        const char *domain,
        const char *workstation,
+       const uint64_t logon_id,
        const uint8_t chal[8],
        DATA_BLOB lm_response,
        DATA_BLOB nt_response,
@@ -97,6 +99,7 @@ NTSTATUS rpccli_netlogon_interactive_logon(
        const char *username,
        const char *domain,
        const char *workstation,
+       const uint64_t logon_id,
        DATA_BLOB lm_hash,
        DATA_BLOB nt_hash,
        enum netr_LogonInfoClass logon_type,

diff --git a/source3/rpcclient/cmd_netlogon.c b/source3/rpcclient/cmd_netlogon.c
index 39bee441b73616e7dfb94e4cefa552b6e0f0c59d..4db23793c63909ed8872bfba320991e96351c166 100644 (file)
--- a/source3/rpcclient/cmd_netlogon.c
+++ b/source3/rpcclient/cmd_netlogon.c
@@ -500,6 +500,7 @@ static NTSTATUS cmd_netlogon_sam_logon(struct rpc_pipe_client *cli,
        uint32_t flags = 0;
        uint16_t validation_level;
        union netr_Validation *validation = NULL;
+       uint64_t logon_id = 0;
 
        /* Check arguments */
 
@@ -525,6 +526,7 @@ static NTSTATUS cmd_netlogon_sam_logon(struct rpc_pipe_client *cli,
                result = NT_STATUS_UNSUCCESSFUL;
                goto done;
        }
+       logon_id = generate_random_u64();
 
        /* Perform the sam logon */
 
@@ -536,6 +538,7 @@ static NTSTATUS cmd_netlogon_sam_logon(struct rpc_pipe_client *cli,
                                                username,
                                                password,
                                                workstation,
+                                               logon_id,
                                                logon_type,
                                                &authoritative,
                                                &flags,

diff --git a/source3/winbindd/winbindd_dual_srv.c b/source3/winbindd/winbindd_dual_srv.c
index ab14f5d51a048a88311b122497990138525eb754..a34fce4bbe58731d2df16c4b6280eb2368db52b9 100644 (file)
--- a/source3/winbindd/winbindd_dual_srv.c
+++ b/source3/winbindd/winbindd_dual_srv.c
@@ -1001,6 +1001,7 @@ NTSTATUS _winbind_SamLogon(struct pipes_struct *p,
                                       identity_info->account_name.string,
                                       identity_info->domain_name.string,
                                       identity_info->workstation.string,
+                                      identity_info->logon_id,
                                       challenge,
                                       lm_response, nt_response,
                                       &r->out.authoritative,

diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
index b81f2722c420917a30310aa5a336bc9f2f41c1a2..4405205a5f2bbc78b501967e22dbe3e376941ef8 100644 (file)
--- a/source3/winbindd/winbindd_pam.c
+++ b/source3/winbindd/winbindd_pam.c
@@ -1337,7 +1337,9 @@ done:
 
 static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
                                          uint32_t logon_parameters,
-                                         const char *domain, const char *user,
+                                         const char *domain,
+                                         const char *user,
+                                         const uint64_t logon_id,
                                          const DATA_BLOB *challenge,
                                          const DATA_BLOB *lm_resp,
                                          const DATA_BLOB *nt_resp,
@@ -1387,6 +1389,7 @@ static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
        }
 
        user_info->logon_parameters = logon_parameters;
+       user_info->logon_id = logon_id;
 
        /* We don't want any more mapping of the username */
        user_info->mapped_state = True;
@@ -1452,6 +1455,7 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
                                            const char *password,
                                            const char *domainname,
                                            const char *workstation,
+                                           const uint64_t logon_id,
                                            bool plaintext_given,
                                            const uint8_t chal[8],
                                            DATA_BLOB lm_response,
@@ -1564,6 +1568,7 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
                                username,
                                password,
                                workstation,
+                               logon_id,
                                logon_type_i,
                                authoritative,
                                flags,
@@ -1578,6 +1583,7 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
                                username,
                                domainname,
                                workstation,
+                               logon_id,
                                lm_response,
                                nt_response,
                                logon_type_i,
@@ -1594,6 +1600,7 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
                                username,
                                domainname,
                                workstation,
+                               logon_id,
                                chal,
                                lm_response,
                                nt_response,
@@ -1683,6 +1690,7 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon(
        struct winbindd_domain *domain,
        const char *user,
        const char *pass,
+       uint64_t logon_id,
        uint32_t request_flags,
        uint16_t *_validation_level,
        union netr_Validation **_validation)
@@ -1760,6 +1768,7 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon(
 
                result = winbindd_dual_auth_passdb(
                        talloc_tos(), 0, name_domain, name_user,
+                       logon_id,
                        &chal_blob, &lm_resp, &nt_resp,
                        true, /* interactive */
                        &authoritative,
@@ -1795,6 +1804,7 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon(
                                             pass,
                                             name_domain,
                                             lp_netbios_name(),
+                                            logon_id,
                                             true, /* plaintext_given */
                                             NULL,
                                             data_blob_null, data_blob_null,
@@ -1910,6 +1920,7 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
        union netr_Validation *validation = NULL;
        NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
        bool ok;
+       uint64_t logon_id = 0;
 
        /* Ensure null termination */
        state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0';
@@ -1917,6 +1928,10 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
        /* Ensure null termination */
        state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0';
 
+       /*
+        * Generate a logon_id for this session.
+        */
+       logon_id = generate_random_u64();
        DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
                  state->request->data.auth.user));
 
@@ -2037,6 +2052,7 @@ sam_logon:
                        state->mem_ctx, domain,
                        state->request->data.auth.user,
                        state->request->data.auth.pass,
+                       logon_id,
                        state->request->flags,
                        &validation_level,
                        &validation);
@@ -2246,6 +2262,7 @@ NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain,
                               const char *name_user,
                               const char *name_domain,
                               const char *workstation,
+                              const uint64_t logon_id,
                               const uint8_t chal[8],
                               DATA_BLOB lm_response,
                               DATA_BLOB nt_response,
@@ -2277,6 +2294,7 @@ NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain,
                        talloc_tos(),
                        logon_parameters,
                        name_domain, name_user,
+                       logon_id,
                        &chal_blob, &lm_response, &nt_response,
                        interactive,
                        authoritative,
@@ -2310,6 +2328,7 @@ NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain,
                                             name_domain,
                                             /* Bug #3248 - found by Stefan Burkei. */
                                             workstation, /* We carefully set this above so use it... */
+                                            logon_id,
                                             false, /* plaintext_given */
                                             chal,
                                             lm_response,
@@ -2411,6 +2430,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
        const char *name_user = NULL;
        const char *name_domain = NULL;
        const char *workstation;
+       uint64_t logon_id = 0;
        uint8_t authoritative = 0;
        uint32_t flags = 0;
        uint16_t validation_level;
@@ -2427,6 +2447,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
        name_user = state->request->data.auth_crap.user;
        name_domain = state->request->data.auth_crap.domain;
        workstation = state->request->data.auth_crap.workstation;
+       logon_id = generate_random_u64();
 
        DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
                  name_domain, name_user));
@@ -2464,6 +2485,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                                       name_domain,
                                       /* Bug #3248 - found by Stefan Burkei. */
                                       workstation, /* We carefully set this above so use it... */
+                                      logon_id,
                                       state->request->data.auth_crap.chal,
                                       lm_resp,
                                       nt_resp,

diff --git a/source3/winbindd/winbindd_proto.h b/source3/winbindd/winbindd_proto.h
index be3626dc477ba88d72816be2d477035eb7dd6aa0..85a490a4feb0f43fd30dd43db419b203dad7e088 100644 (file)
--- a/source3/winbindd/winbindd_proto.h
+++ b/source3/winbindd/winbindd_proto.h
@@ -439,6 +439,7 @@ NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain,
                               const char *name_user,
                               const char *name_domain,
                               const char *workstation,
+                              const uint64_t logon_id,
                               const uint8_t chal[8],
                               DATA_BLOB lm_response,
                               DATA_BLOB nt_response,

diff --git a/source4/auth/ntlm/auth_winbind.c b/source4/auth/ntlm/auth_winbind.c
index d7c26e7a1a7210f1a4e3d2f4c7af03052fc10264..d78799666035a203063d2c334fe0dcef4c3c26fd 100644 (file)
--- a/source4/auth/ntlm/auth_winbind.c
+++ b/source4/auth/ntlm/auth_winbind.c
@@ -174,7 +174,7 @@ static struct tevent_req *winbind_check_password_send(TALLOC_CTX *mem_ctx,
 
        identity_info->domain_name.string       = user_info->client.domain_name;
        identity_info->parameter_control        = user_info->logon_parameters; /* see MSV1_0_* */
-       identity_info->logon_id                 = 0;
+       identity_info->logon_id                 = user_info->logon_id;
        identity_info->account_name.string      = user_info->client.account_name;
        identity_info->workstation.string       = user_info->workstation_name;