1/* 2 Unix SMB/Netbios implementation. 3 Version 1.9. 4 NBT netbios routines and daemon - version 2 5 Copyright (C) Andrew Tridgell 1994-1998 6 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 7 Copyright (C) Jeremy Allison 1994-1998 8 9 This program is free software; you can redistribute it and/or modify 10 it under the terms of the GNU General Public License as published by 11 the Free Software Foundation; either version 2 of the License, or 12 (at your option) any later version. 13 14 This program is distributed in the hope that it will be useful, 15 but WITHOUT ANY WARRANTY; without even the implied warranty of 16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 GNU General Public License for more details. 18 19 You should have received a copy of the GNU General Public License 20 along with this program; if not, write to the Free Software 21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 22 23 Revision History: 24 25*/ 26 27#include "includes.h" 28 29extern int DEBUGLEVEL; 30 31extern pstring global_myname; 32extern fstring global_myworkgroup; 33 34/**************************************************************************** 35Process a domain logon packet 36**************************************************************************/ 37 38void process_logon_packet(struct packet_struct *p,char *buf,int len, 39 char *mailslot) 40{ 41 struct dgram_packet *dgram = &p->packet.dgram; 42 pstring my_name; 43 fstring reply_name; 44 pstring outbuf; 45 int code; 46 uint16 token = 0; 47 uint32 ntversion = 0; 48 uint16 lmnttoken = 0; 49 uint16 lm20token = 0; 50 uint32 domainsidsize; 51 BOOL short_request = False; 52 char *getdc; 53 char *uniuser; /* Unicode user name. */ 54 pstring ascuser; 55 char *unicomp; /* Unicode computer name. */ 56 57 memset(outbuf, 0, sizeof(outbuf)); 58 59 if (!lp_domain_logons()) 60 { 61 DEBUG(3,("process_logon_packet: Logon packet received from IP %s and domain \ 62logons are not enabled.\n", inet_ntoa(p->ip) )); 63 return; 64 } 65 66 pstrcpy(my_name, global_myname); 67 strupper(my_name); 68 69 code = SVAL(buf,0); 70 DEBUG(1,("process_logon_packet: Logon from %s: code = 0x%x\n", inet_ntoa(p->ip), code)); 71 72 switch (code) 73 { 74 case 0: 75 { 76 char *q = buf + 2; 77 char *machine = q; 78 char *user = skip_string(machine,1); 79 80 getdc = skip_string(user,1); 81 q = skip_string(getdc,1); 82 token = SVAL(q,3); 83 84 fstrcpy(reply_name,my_name); 85 86 DEBUG(3,("process_logon_packet: Domain login request from %s at IP %s user=%s token=%x\n", 87 machine,inet_ntoa(p->ip),user,token)); 88 89 q = outbuf; 90 SSVAL(q, 0, 6); 91 q += 2; 92 93 fstrcpy(reply_name, "\\\\"); 94 fstrcat(reply_name, my_name); 95 fstrcpy(q, reply_name); q = skip_string(q, 1); /* PDC name */ 96 97 SSVAL(q, 0, token); 98 q += 2; 99 100 dump_data(4, outbuf, PTR_DIFF(q, outbuf)); 101 102 send_mailslot(True, getdc, 103 outbuf,PTR_DIFF(q,outbuf), 104 global_myname, 0x0, 105 dgram->source_name.name, 106 dgram->source_name.name_type, 107 p->ip, *iface_ip(p->ip), p->port); 108 break; 109 } 110 111 case QUERYFORPDC: 112 { 113 char *q = buf + 2; 114 char *machine = q; 115 116 getdc = skip_string(machine,1); 117 q = skip_string(getdc,1); 118 q = ALIGN2(q, buf); 119 120 /* at this point we can work out if this is a W9X or NT style 121 request. Experiments show that the difference is wether the 122 packet ends here. For a W9X request we now end with a pair of 123 bytes (usually 0xFE 0xFF) whereas with NT we have two further 124 strings - the following is a simple way of detecting this */ 125 if (len - PTR_DIFF(q, buf) <= 3) { 126 short_request = True; 127 } else { 128 unicomp = q; 129 130 /* A full length (NT style) request */ 131 q = skip_unibuf(unicomp, PTR_DIFF(buf + len, unicomp)); 132 133 if (len - PTR_DIFF(q, buf) > 8) { 134 /* with NT5 clients we can sometimes 135 get additional data - a length specificed string 136 containing the domain name, then 16 bytes of 137 data (no idea what it is) */ 138 int dom_len = CVAL(q, 0); 139 q++; 140 if (dom_len != 0) { 141 q += dom_len + 1; 142 } 143 q += 16; 144 } 145 ntversion = IVAL(q, 0); 146 lmnttoken = SVAL(q, 4); 147 lm20token = SVAL(q, 6); 148 } 149 150 /* Construct reply. */ 151 q = outbuf; 152 SSVAL(q, 0, QUERYFORPDC_R); 153 q += 2; 154 155 fstrcpy(reply_name,my_name); 156 fstrcpy(q, reply_name); 157 q = skip_string(q, 1); /* PDC name */ 158 159 /* PDC and domain name */ 160 if (!short_request) /* Make a full reply */ 161 { 162 q = ALIGN2(q, buf); 163 164 q += dos_PutUniCode(q, my_name, sizeof(pstring), True); /* PDC name */ 165 q += dos_PutUniCode(q, global_myworkgroup,sizeof(pstring), True); /* Domain name*/ 166 167 SIVAL(q, 0, 1); /* our nt version */ 168 SSVAL(q, 4, 0xffff); /* our lmnttoken */ 169 SSVAL(q, 6, 0xffff); /* our lm20token */ 170 q += 8; 171 } 172 173 /* RJS, 21-Feb-2000, we send a short reply if the request was short */ 174 175 DEBUG(3,("process_logon_packet: GETDC request from %s at IP %s, \ 176reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", 177 machine,inet_ntoa(p->ip), reply_name, global_myworkgroup, 178 QUERYFORPDC_R, (uint32)ntversion, (uint32)lmnttoken, 179 (uint32)lm20token )); 180 181 dump_data(4, outbuf, PTR_DIFF(q, outbuf)); 182 183 send_mailslot(True, getdc, 184 outbuf,PTR_DIFF(q,outbuf), 185 global_myname, 0x0, 186 dgram->source_name.name, 187 dgram->source_name.name_type, 188 p->ip, *iface_ip(p->ip), p->port); 189 return; 190 } 191 192 case SAMLOGON: 193 { 194 char *q = buf + 2; 195 196 q += 2; 197 unicomp = q; 198 uniuser = skip_unibuf(unicomp, PTR_DIFF(buf+len, unicomp)); 199 getdc = skip_unibuf(uniuser,PTR_DIFF(buf+len, uniuser)); 200 q = skip_string(getdc,1); 201 q += 4; /* Account Control Bits - indicating username type */ 202 domainsidsize = IVAL(q, 0); 203 q += 4; 204 205 DEBUG(3,("process_logon_packet: SAMLOGON sidsize %d, len = %d\n", domainsidsize, len)); 206 207 if (domainsidsize < (len - PTR_DIFF(q, buf)) && (domainsidsize != 0)) { 208 q += domainsidsize; 209 q = ALIGN4(q, buf); 210 } 211 212 DEBUG(3,("process_logon_packet: len = %d PTR_DIFF(q, buf) = %d\n", len, PTR_DIFF(q, buf) )); 213 214 if (len - PTR_DIFF(q, buf) > 8) { 215 /* with NT5 clients we can sometimes 216 get additional data - a length specificed string 217 containing the domain name, then 16 bytes of 218 data (no idea what it is) */ 219 int dom_len = CVAL(q, 0); 220 q++; 221 if (dom_len < (len - PTR_DIFF(q, buf)) && (dom_len != 0)) { 222 q += dom_len + 1; 223 } 224 q += 16; 225 } 226 227 ntversion = IVAL(q, 0); 228 lmnttoken = SVAL(q, 4); 229 lm20token = SVAL(q, 6); 230 q += 8; 231 232 DEBUG(3,("process_logon_packet: SAMLOGON sidsize %d ntv %d\n", domainsidsize, ntversion)); 233 234 /* 235 * we respond regadless of whether the machine is in our password 236 * database. If it isn't then we let smbd send an appropriate error. 237 * Let's ignore the SID. 238 */ 239 240 pstrcpy(ascuser, dos_unistr(uniuser)); 241 DEBUG(3,("process_logon_packet: SAMLOGON user %s\n", ascuser)); 242 243 fstrcpy(reply_name,"\\\\"); /* Here it wants \\LOGONSERVER. */ 244 fstrcpy(reply_name+2,my_name); 245 246 DEBUG(3,("process_logon_packet: SAMLOGON request from %s(%s) for %s, returning logon svr %s domain %s code %x token=%x\n", 247 dos_unistr(unicomp),inet_ntoa(p->ip), ascuser, reply_name, global_myworkgroup, 248 SAMLOGON_R ,lmnttoken)); 249 250 /* Construct reply. */ 251 252 q = outbuf; 253 if (SVAL(uniuser, 0) == 0) { 254 SSVAL(q, 0, SAMLOGON_UNK_R); /* user unknown */ 255 } else { 256 SSVAL(q, 0, SAMLOGON_R); 257 } 258 q += 2; 259 260 q += dos_PutUniCode(q, reply_name,sizeof(pstring), True); 261 q += dos_PutUniCode(q, ascuser, sizeof(pstring), True); 262 q += dos_PutUniCode(q, global_myworkgroup,sizeof(pstring), True); 263 264 /* tell the client what version we are */ 265 SIVAL(q, 0, 1); /* our ntversion */ 266 SSVAL(q, 4, 0xffff); /* our lmnttoken */ 267 SSVAL(q, 6, 0xffff); /* our lm20token */ 268 q += 8; 269 270 dump_data(4, outbuf, PTR_DIFF(q, outbuf)); 271 272 send_mailslot(True, getdc, 273 outbuf,PTR_DIFF(q,outbuf), 274 global_myname, 0x0, 275 dgram->source_name.name, 276 dgram->source_name.name_type, 277 p->ip, *iface_ip(p->ip), p->port); 278 break; 279 } 280 281 default: 282 { 283 DEBUG(3,("process_logon_packet: Unknown domain request %d\n",code)); 284 return; 285 } 286 } 287} 288