1/* 2 Unix SMB/CIFS implementation. 3 4 NBT datagram netlogon server 5 6 Copyright (C) Andrew Tridgell 2005 7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008 8 9 This program is free software; you can redistribute it and/or modify 10 it under the terms of the GNU General Public License as published by 11 the Free Software Foundation; either version 3 of the License, or 12 (at your option) any later version. 13 14 This program is distributed in the hope that it will be useful, 15 but WITHOUT ANY WARRANTY; without even the implied warranty of 16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 GNU General Public License for more details. 18 19 You should have received a copy of the GNU General Public License 20 along with this program. If not, see <http://www.gnu.org/licenses/>. 21*/ 22 23#include "includes.h" 24#include "nbt_server/nbt_server.h" 25#include "lib/socket/socket.h" 26#include "lib/ldb/include/ldb.h" 27#include "dsdb/samdb/samdb.h" 28#include "auth/auth.h" 29#include "../lib/util/util_ldb.h" 30#include "param/param.h" 31#include "smbd/service_task.h" 32#include "cldap_server/cldap_server.h" 33#include "libcli/security/security.h" 34#include "nbt_server/dgram/proto.h" 35 36/* 37 reply to a GETDC request 38 */ 39static void nbtd_netlogon_getdc(struct dgram_mailslot_handler *dgmslot, 40 struct nbtd_interface *iface, 41 struct nbt_dgram_packet *packet, 42 const struct socket_address *src, 43 struct nbt_netlogon_packet *netlogon) 44{ 45 struct nbt_name *name = &packet->data.msg.dest_name; 46 struct nbtd_interface *reply_iface = nbtd_find_reply_iface(iface, src->addr, false); 47 struct nbt_netlogon_response_from_pdc *pdc; 48 struct ldb_context *samctx; 49 struct nbt_netlogon_response netlogon_response; 50 51 /* only answer getdc requests on the PDC or LOGON names */ 52 if (name->type != NBT_NAME_PDC && name->type != NBT_NAME_LOGON) { 53 return; 54 } 55 56 samctx = iface->nbtsrv->sam_ctx; 57 58 if (lp_server_role(iface->nbtsrv->task->lp_ctx) != ROLE_DOMAIN_CONTROLLER 59 || !samdb_is_pdc(samctx)) { 60 DEBUG(2, ("Not a PDC, so not processing LOGON_PRIMARY_QUERY\n")); 61 return; 62 } 63 64 if (strcasecmp_m(name->name, lp_workgroup(iface->nbtsrv->task->lp_ctx)) != 0) { 65 DEBUG(5,("GetDC requested for a domian %s that we don't host\n", name->name)); 66 return; 67 } 68 69 /* setup a GETDC reply */ 70 ZERO_STRUCT(netlogon_response); 71 netlogon_response.response_type = NETLOGON_GET_PDC; 72 pdc = &netlogon_response.data.get_pdc; 73 74 pdc->command = NETLOGON_RESPONSE_FROM_PDC; 75 pdc->pdc_name = lp_netbios_name(iface->nbtsrv->task->lp_ctx); 76 pdc->unicode_pdc_name = pdc->pdc_name; 77 pdc->domain_name = lp_workgroup(iface->nbtsrv->task->lp_ctx); 78 pdc->nt_version = 1; 79 pdc->lmnt_token = 0xFFFF; 80 pdc->lm20_token = 0xFFFF; 81 82 dgram_mailslot_netlogon_reply(reply_iface->dgmsock, 83 packet, 84 lp_netbios_name(iface->nbtsrv->task->lp_ctx), 85 netlogon->req.pdc.mailslot_name, 86 &netlogon_response); 87} 88 89 90/* 91 reply to a ADS style GETDC request 92 */ 93static void nbtd_netlogon_samlogon(struct dgram_mailslot_handler *dgmslot, 94 struct nbtd_interface *iface, 95 struct nbt_dgram_packet *packet, 96 const struct socket_address *src, 97 struct nbt_netlogon_packet *netlogon) 98{ 99 struct nbt_name *name = &packet->data.msg.dest_name; 100 struct nbtd_interface *reply_iface = nbtd_find_reply_iface(iface, src->addr, false); 101 struct ldb_context *samctx; 102 const char *my_ip = reply_iface->ip_address; 103 struct dom_sid *sid; 104 struct nbt_netlogon_response netlogon_response; 105 NTSTATUS status; 106 107 if (!my_ip) { 108 DEBUG(0, ("Could not obtain own IP address for datagram socket\n")); 109 return; 110 } 111 112 /* only answer getdc requests on the PDC or LOGON names */ 113 if (name->type != NBT_NAME_PDC && name->type != NBT_NAME_LOGON) { 114 return; 115 } 116 117 samctx = iface->nbtsrv->sam_ctx; 118 119 if (netlogon->req.logon.sid_size) { 120 sid = &netlogon->req.logon.sid; 121 } else { 122 sid = NULL; 123 } 124 125 status = fill_netlogon_samlogon_response(samctx, packet, NULL, name->name, sid, NULL, 126 netlogon->req.logon.user_name, netlogon->req.logon.acct_control, src->addr, 127 netlogon->req.logon.nt_version, iface->nbtsrv->task->lp_ctx, &netlogon_response.data.samlogon); 128 if (!NT_STATUS_IS_OK(status)) { 129 DEBUG(2,("NBT netlogon query failed domain=%s sid=%s version=%d - %s\n", 130 name->name, dom_sid_string(packet, sid), netlogon->req.logon.nt_version, nt_errstr(status))); 131 return; 132 } 133 134 netlogon_response.response_type = NETLOGON_SAMLOGON; 135 136 packet->data.msg.dest_name.type = 0; 137 138 dgram_mailslot_netlogon_reply(reply_iface->dgmsock, 139 packet, 140 lp_netbios_name(iface->nbtsrv->task->lp_ctx), 141 netlogon->req.logon.mailslot_name, 142 &netlogon_response); 143} 144 145 146/* 147 handle incoming netlogon mailslot requests 148*/ 149void nbtd_mailslot_netlogon_handler(struct dgram_mailslot_handler *dgmslot, 150 struct nbt_dgram_packet *packet, 151 struct socket_address *src) 152{ 153 NTSTATUS status = NT_STATUS_NO_MEMORY; 154 struct nbtd_interface *iface = 155 talloc_get_type(dgmslot->private_data, struct nbtd_interface); 156 struct nbt_netlogon_packet *netlogon = 157 talloc(dgmslot, struct nbt_netlogon_packet); 158 struct nbtd_iface_name *iname; 159 struct nbt_name *name = &packet->data.msg.dest_name; 160 161 if (netlogon == NULL) goto failed; 162 163 /* 164 see if the we are listening on the destination netbios name 165 */ 166 iname = nbtd_find_iname(iface, name, 0); 167 if (iname == NULL) { 168 status = NT_STATUS_BAD_NETWORK_NAME; 169 goto failed; 170 } 171 172 DEBUG(2,("netlogon request to %s from %s:%d\n", 173 nbt_name_string(netlogon, name), src->addr, src->port)); 174 status = dgram_mailslot_netlogon_parse_request(dgmslot, netlogon, packet, netlogon); 175 if (!NT_STATUS_IS_OK(status)) goto failed; 176 177 switch (netlogon->command) { 178 case LOGON_PRIMARY_QUERY: 179 nbtd_netlogon_getdc(dgmslot, iface, packet, 180 src, netlogon); 181 break; 182 case LOGON_SAM_LOGON_REQUEST: 183 nbtd_netlogon_samlogon(dgmslot, iface, packet, 184 src, netlogon); 185 break; 186 default: 187 DEBUG(2,("unknown netlogon op %d from %s:%d\n", 188 netlogon->command, src->addr, src->port)); 189 NDR_PRINT_DEBUG(nbt_netlogon_packet, netlogon); 190 break; 191 } 192 193 talloc_free(netlogon); 194 return; 195 196failed: 197 DEBUG(2,("nbtd netlogon handler failed from %s:%d to %s - %s\n", 198 src->addr, src->port, nbt_name_string(netlogon, name), 199 nt_errstr(status))); 200 talloc_free(netlogon); 201} 202