1/* 2 * Unix SMB/CIFS implementation. 3 * RPC Pipe client / server routines 4 * Copyright (C) Andrew Tridgell 1992-1997, 5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997, 6 * Copyright (C) Paul Ashton 1997. 7 * Copyright (C) Jeremy Allison 1998-2001. 8 * Copyright (C) Andrew Bartlett 2001. 9 * 10 * This program is free software; you can redistribute it and/or modify 11 * it under the terms of the GNU General Public License as published by 12 * the Free Software Foundation; either version 2 of the License, or 13 * (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, 16 * but WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18 * GNU General Public License for more details. 19 * 20 * You should have received a copy of the GNU General Public License 21 * along with this program; if not, write to the Free Software 22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 23 */ 24 25/* This is the implementation of the netlogon pipe. */ 26 27#include "includes.h" 28 29#undef DBGC_CLASS 30#define DBGC_CLASS DBGC_RPC_SRV 31 32/************************************************************************* 33 init_net_r_req_chal: 34 *************************************************************************/ 35 36static void init_net_r_req_chal(NET_R_REQ_CHAL *r_c, 37 DOM_CHAL *srv_chal, NTSTATUS status) 38{ 39 DEBUG(6,("init_net_r_req_chal: %d\n", __LINE__)); 40 memcpy(r_c->srv_chal.data, srv_chal->data, sizeof(srv_chal->data)); 41 r_c->status = status; 42} 43 44/************************************************************************* 45 error messages cropping up when using nltest.exe... 46 *************************************************************************/ 47 48#define ERROR_NO_SUCH_DOMAIN 0x54b 49#define ERROR_NO_LOGON_SERVERS 0x51f 50#define NO_ERROR 0x0 51 52/************************************************************************* 53 net_reply_logon_ctrl: 54 *************************************************************************/ 55 56/* Some flag values reverse engineered from NLTEST.EXE */ 57 58#define LOGON_CTRL_IN_SYNC 0x00 59#define LOGON_CTRL_REPL_NEEDED 0x01 60#define LOGON_CTRL_REPL_IN_PROGRESS 0x02 61 62NTSTATUS _net_logon_ctrl(pipes_struct *p, NET_Q_LOGON_CTRL *q_u, 63 NET_R_LOGON_CTRL *r_u) 64{ 65 uint32 flags = 0x0; 66 uint32 pdc_connection_status = 0x00; /* Maybe a win32 error code? */ 67 68 /* Setup the Logon Control response */ 69 70 init_net_r_logon_ctrl(r_u, q_u->query_level, flags, 71 pdc_connection_status); 72 73 return r_u->status; 74} 75 76/**************************************************************************** 77Send a message to smbd to do a sam synchronisation 78**************************************************************************/ 79static void send_sync_message(void) 80{ 81 TDB_CONTEXT *tdb; 82 83 tdb = tdb_open_log(lock_path("connections.tdb"), 0, 84 TDB_DEFAULT, O_RDONLY, 0); 85 86 if (!tdb) { 87 DEBUG(3, ("send_sync_message(): failed to open connections " 88 "database\n")); 89 return; 90 } 91 92 DEBUG(3, ("sending sam synchronisation message\n")); 93 94 message_send_all(tdb, MSG_SMB_SAM_SYNC, NULL, 0, False, NULL); 95 96 tdb_close(tdb); 97} 98 99/************************************************************************* 100 net_reply_logon_ctrl2: 101 *************************************************************************/ 102 103NTSTATUS _net_logon_ctrl2(pipes_struct *p, NET_Q_LOGON_CTRL2 *q_u, NET_R_LOGON_CTRL2 *r_u) 104{ 105 uint32 flags = 0x0; 106 uint32 pdc_connection_status = 0x0; 107 uint32 logon_attempts = 0x0; 108 uint32 tc_status; 109 fstring servername, domain, dc_name, dc_name2; 110 struct in_addr dc_ip; 111 112 /* this should be \\global_myname() */ 113 unistr2_to_ascii(servername, &q_u->uni_server_name, sizeof(servername)); 114 115 r_u->status = NT_STATUS_OK; 116 117 tc_status = ERROR_NO_SUCH_DOMAIN; 118 fstrcpy( dc_name, "" ); 119 120 switch ( q_u->function_code ) { 121 case NETLOGON_CONTROL_TC_QUERY: 122 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain)); 123 124 if ( !is_trusted_domain( domain ) ) 125 break; 126 127 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ip ) ) { 128 tc_status = ERROR_NO_LOGON_SERVERS; 129 break; 130 } 131 132 fstr_sprintf( dc_name, "\\\\%s", dc_name2 ); 133 134 tc_status = NO_ERROR; 135 136 break; 137 138 case NETLOGON_CONTROL_REDISCOVER: 139 unistr2_to_ascii(domain, &q_u->info.info6.domain, sizeof(domain)); 140 141 if ( !is_trusted_domain( domain ) ) 142 break; 143 144 if ( !get_dc_name( domain, NULL, dc_name2, &dc_ip ) ) { 145 tc_status = ERROR_NO_LOGON_SERVERS; 146 break; 147 } 148 149 fstr_sprintf( dc_name, "\\\\%s", dc_name2 ); 150 151 tc_status = NO_ERROR; 152 153 break; 154 155 default: 156 /* no idea what this should be */ 157 DEBUG(0,("_net_logon_ctrl2: unimplemented function level [%d]\n", 158 q_u->function_code)); 159 } 160 161 /* prepare the response */ 162 163 init_net_r_logon_ctrl2( r_u, q_u->query_level, flags, 164 pdc_connection_status, logon_attempts, tc_status, dc_name ); 165 166 if (lp_server_role() == ROLE_DOMAIN_BDC) 167 send_sync_message(); 168 169 return r_u->status; 170} 171 172/************************************************************************* 173 net_reply_trust_dom_list: 174 *************************************************************************/ 175 176NTSTATUS _net_trust_dom_list(pipes_struct *p, NET_Q_TRUST_DOM_LIST *q_u, NET_R_TRUST_DOM_LIST *r_u) 177{ 178 const char *trusted_domain = "test_domain"; 179 uint32 num_trust_domains = 1; 180 181 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__)); 182 183 /* set up the Trusted Domain List response */ 184 init_r_trust_dom(r_u, num_trust_domains, trusted_domain); 185 186 DEBUG(6,("_net_trust_dom_list: %d\n", __LINE__)); 187 188 return r_u->status; 189} 190 191/*********************************************************************************** 192 init_net_r_srv_pwset: 193 ***********************************************************************************/ 194 195static void init_net_r_srv_pwset(NET_R_SRV_PWSET *r_s, 196 DOM_CRED *srv_cred, NTSTATUS status) 197{ 198 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__)); 199 200 memcpy(&r_s->srv_cred, srv_cred, sizeof(r_s->srv_cred)); 201 r_s->status = status; 202 203 DEBUG(5,("init_net_r_srv_pwset: %d\n", __LINE__)); 204} 205 206/****************************************************************** 207 gets a machine password entry. checks access rights of the host. 208 ******************************************************************/ 209 210static BOOL get_md4pw(char *md4pw, char *mach_acct) 211{ 212 SAM_ACCOUNT *sampass = NULL; 213 const uint8 *pass; 214 BOOL ret; 215 uint32 acct_ctrl; 216 217#if 0 218 /* 219 * Currently this code is redundent as we already have a filter 220 * by hostname list. What this code really needs to do is to 221 * get a hosts allowed/hosts denied list from the SAM database 222 * on a per user basis, and make the access decision there. 223 * I will leave this code here for now as a reminder to implement 224 * this at a later date. JRA. 225 */ 226 227 if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(), 228 client_name(), client_addr())) 229 { 230 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct)); 231 return False; 232 } 233#endif /* 0 */ 234 235 if(!NT_STATUS_IS_OK(pdb_init_sam(&sampass))) 236 return False; 237 238 /* JRA. This is ok as it is only used for generating the challenge. */ 239 become_root(); 240 ret=pdb_getsampwnam(sampass, mach_acct); 241 unbecome_root(); 242 243 if (ret==False) { 244 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct)); 245 pdb_free_sam(&sampass); 246 return False; 247 } 248 249 acct_ctrl = pdb_get_acct_ctrl(sampass); 250 if (!(acct_ctrl & ACB_DISABLED) && 251 ((acct_ctrl & ACB_DOMTRUST) || 252 (acct_ctrl & ACB_WSTRUST) || 253 (acct_ctrl & ACB_SVRTRUST)) && 254 ((pass=pdb_get_nt_passwd(sampass)) != NULL)) { 255 memcpy(md4pw, pass, 16); 256 dump_data(5, md4pw, 16); 257 pdb_free_sam(&sampass); 258 return True; 259 } 260 261 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct)); 262 pdb_free_sam(&sampass); 263 return False; 264 265} 266 267/************************************************************************* 268 _net_req_chal 269 *************************************************************************/ 270 271NTSTATUS _net_req_chal(pipes_struct *p, NET_Q_REQ_CHAL *q_u, NET_R_REQ_CHAL *r_u) 272{ 273 NTSTATUS status = NT_STATUS_OK; 274 275 rpcstr_pull(p->dc.remote_machine,q_u->uni_logon_clnt.buffer,sizeof(fstring),q_u->uni_logon_clnt.uni_str_len*2,0); 276 277 /* create a server challenge for the client */ 278 /* Set these to random values. */ 279 generate_random_buffer(p->dc.srv_chal.data, 8); 280 281 memcpy(p->dc.srv_cred.challenge.data, p->dc.srv_chal.data, 8); 282 283 memcpy(p->dc.clnt_chal.data , q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data)); 284 memcpy(p->dc.clnt_cred.challenge.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data)); 285 286 memset((char *)p->dc.sess_key, '\0', sizeof(p->dc.sess_key)); 287 288 p->dc.challenge_sent = True; 289 /* set up the LSA REQUEST CHALLENGE response */ 290 init_net_r_req_chal(r_u, &p->dc.srv_chal, status); 291 292 return status; 293} 294 295/************************************************************************* 296 init_net_r_auth: 297 *************************************************************************/ 298 299static void init_net_r_auth(NET_R_AUTH *r_a, DOM_CHAL *resp_cred, NTSTATUS status) 300{ 301 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data)); 302 r_a->status = status; 303} 304 305/************************************************************************* 306 _net_auth 307 *************************************************************************/ 308 309NTSTATUS _net_auth(pipes_struct *p, NET_Q_AUTH *q_u, NET_R_AUTH *r_u) 310{ 311 NTSTATUS status = NT_STATUS_OK; 312 DOM_CHAL srv_cred; 313 UTIME srv_time; 314 fstring mach_acct; 315 316 srv_time.time = 0; 317 318 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),q_u->clnt_id.uni_acct_name.uni_str_len*2,0); 319 320 if (p->dc.challenge_sent && get_md4pw((char *)p->dc.md4pw, mach_acct)) { 321 322 /* from client / server challenges and md4 password, generate sess key */ 323 cred_session_key(&p->dc.clnt_chal, &p->dc.srv_chal, 324 p->dc.md4pw, p->dc.sess_key); 325 326 /* check that the client credentials are valid */ 327 if (cred_assert(&q_u->clnt_chal, p->dc.sess_key, &p->dc.clnt_cred.challenge, srv_time)) { 328 329 /* create server challenge for inclusion in the reply */ 330 cred_create(p->dc.sess_key, &p->dc.srv_cred.challenge, srv_time, &srv_cred); 331 332 /* copy the received client credentials for use next time */ 333 memcpy(p->dc.clnt_cred.challenge.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data)); 334 memcpy(p->dc.srv_cred .challenge.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data)); 335 336 /* Save the machine account name. */ 337 fstrcpy(p->dc.mach_acct, mach_acct); 338 339 p->dc.authenticated = True; 340 341 } else { 342 status = NT_STATUS_ACCESS_DENIED; 343 } 344 } else { 345 status = NT_STATUS_ACCESS_DENIED; 346 } 347 348 /* set up the LSA AUTH response */ 349 init_net_r_auth(r_u, &srv_cred, status); 350 351 return r_u->status; 352} 353 354/************************************************************************* 355 init_net_r_auth_2: 356 *************************************************************************/ 357 358static void init_net_r_auth_2(NET_R_AUTH_2 *r_a, 359 DOM_CHAL *resp_cred, NEG_FLAGS *flgs, NTSTATUS status) 360{ 361 memcpy(r_a->srv_chal.data, resp_cred->data, sizeof(resp_cred->data)); 362 memcpy(&r_a->srv_flgs, flgs, sizeof(r_a->srv_flgs)); 363 r_a->status = status; 364} 365 366/************************************************************************* 367 _net_auth_2 368 *************************************************************************/ 369 370NTSTATUS _net_auth_2(pipes_struct *p, NET_Q_AUTH_2 *q_u, NET_R_AUTH_2 *r_u) 371{ 372 NTSTATUS status = NT_STATUS_OK; 373 DOM_CHAL srv_cred; 374 UTIME srv_time; 375 NEG_FLAGS srv_flgs; 376 fstring mach_acct; 377 378 srv_time.time = 0; 379 380 if ( (lp_server_schannel() == True) && 381 ((q_u->clnt_flgs.neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) { 382 383 /* schannel must be used, but client did not offer it. */ 384 status = NT_STATUS_ACCESS_DENIED; 385 } 386 387 rpcstr_pull(mach_acct, q_u->clnt_id.uni_acct_name.buffer,sizeof(fstring),q_u->clnt_id.uni_acct_name.uni_str_len*2,0); 388 389 if (p->dc.challenge_sent && get_md4pw((char *)p->dc.md4pw, mach_acct)) { 390 391 /* from client / server challenges and md4 password, generate sess key */ 392 cred_session_key(&p->dc.clnt_chal, &p->dc.srv_chal, 393 p->dc.md4pw, p->dc.sess_key); 394 395 /* check that the client credentials are valid */ 396 if (cred_assert(&q_u->clnt_chal, p->dc.sess_key, &p->dc.clnt_cred.challenge, srv_time)) { 397 398 /* create server challenge for inclusion in the reply */ 399 cred_create(p->dc.sess_key, &p->dc.srv_cred.challenge, srv_time, &srv_cred); 400 401 /* copy the received client credentials for use next time */ 402 memcpy(p->dc.clnt_cred.challenge.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data)); 403 memcpy(p->dc.srv_cred .challenge.data, q_u->clnt_chal.data, sizeof(q_u->clnt_chal.data)); 404 405 /* Save the machine account name. */ 406 fstrcpy(p->dc.mach_acct, mach_acct); 407 408 p->dc.authenticated = True; 409 410 } else { 411 status = NT_STATUS_ACCESS_DENIED; 412 } 413 } else { 414 status = NT_STATUS_ACCESS_DENIED; 415 } 416 417 srv_flgs.neg_flags = 0x000001ff; 418 419 if (lp_server_schannel() != False) { 420 srv_flgs.neg_flags |= NETLOGON_NEG_SCHANNEL; 421 } 422 423 /* set up the LSA AUTH 2 response */ 424 init_net_r_auth_2(r_u, &srv_cred, &srv_flgs, status); 425 426 if (NT_STATUS_IS_OK(status)) { 427 extern struct dcinfo last_dcinfo; 428 last_dcinfo = p->dc; 429 } 430 431 return r_u->status; 432} 433 434/************************************************************************* 435 _net_srv_pwset 436 *************************************************************************/ 437 438NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *r_u) 439{ 440 NTSTATUS status = NT_STATUS_ACCESS_DENIED; 441 DOM_CRED srv_cred; 442 pstring workstation; 443 SAM_ACCOUNT *sampass=NULL; 444 BOOL ret = False; 445 unsigned char pwd[16]; 446 int i; 447 uint32 acct_ctrl; 448 const uchar *old_pw; 449 450 /* checks and updates credentials. creates reply credentials */ 451 if (!(p->dc.authenticated && deal_with_creds(p->dc.sess_key, &p->dc.clnt_cred, &q_u->clnt_id.cred, &srv_cred))) 452 return NT_STATUS_INVALID_HANDLE; 453 454 memcpy(&p->dc.srv_cred, &p->dc.clnt_cred, sizeof(p->dc.clnt_cred)); 455 456 DEBUG(5,("_net_srv_pwset: %d\n", __LINE__)); 457 458 rpcstr_pull(workstation,q_u->clnt_id.login.uni_comp_name.buffer, 459 sizeof(workstation),q_u->clnt_id.login.uni_comp_name.uni_str_len*2,0); 460 461 DEBUG(3,("Server Password Set by Wksta:[%s] on account [%s]\n", workstation, p->dc.mach_acct)); 462 463 pdb_init_sam(&sampass); 464 465 become_root(); 466 ret=pdb_getsampwnam(sampass, p->dc.mach_acct); 467 unbecome_root(); 468 469 /* Ensure the account exists and is a machine account. */ 470 471 acct_ctrl = pdb_get_acct_ctrl(sampass); 472 473 if (!(ret 474 && (acct_ctrl & ACB_WSTRUST || 475 acct_ctrl & ACB_SVRTRUST || 476 acct_ctrl & ACB_DOMTRUST))) { 477 pdb_free_sam(&sampass); 478 return NT_STATUS_NO_SUCH_USER; 479 } 480 481 if (pdb_get_acct_ctrl(sampass) & ACB_DISABLED) { 482 pdb_free_sam(&sampass); 483 return NT_STATUS_ACCOUNT_DISABLED; 484 } 485 486 cred_hash3( pwd, q_u->pwd, p->dc.sess_key, 0); 487 488 DEBUG(100,("Server password set : new given value was :\n")); 489 for(i = 0; i < sizeof(pwd); i++) 490 DEBUG(100,("%02X ", pwd[i])); 491 DEBUG(100,("\n")); 492 493 old_pw = pdb_get_nt_passwd(sampass); 494 495 if (old_pw && memcmp(pwd, old_pw, 16) == 0) { 496 /* Avoid backend modificiations and other fun if the 497 client changed the password to the *same thing* */ 498 499 ret = True; 500 } else { 501 502 /* LM password should be NULL for machines */ 503 if (!pdb_set_lanman_passwd (sampass, NULL, PDB_CHANGED)) { 504 pdb_free_sam(&sampass); 505 return NT_STATUS_NO_MEMORY; 506 } 507 508 if (!pdb_set_nt_passwd (sampass, pwd, PDB_CHANGED)) { 509 pdb_free_sam(&sampass); 510 return NT_STATUS_NO_MEMORY; 511 } 512 513 if (!pdb_set_pass_changed_now (sampass)) { 514 pdb_free_sam(&sampass); 515 /* Not quite sure what this one qualifies as, but this will do */ 516 return NT_STATUS_UNSUCCESSFUL; 517 } 518 519 become_root(); 520 ret = pdb_update_sam_account (sampass); 521 unbecome_root(); 522 } 523 if (ret) 524 status = NT_STATUS_OK; 525 526 /* set up the LSA Server Password Set response */ 527 init_net_r_srv_pwset(r_u, &srv_cred, status); 528 529 pdb_free_sam(&sampass); 530 return r_u->status; 531} 532 533 534/************************************************************************* 535 _net_sam_logoff: 536 *************************************************************************/ 537 538NTSTATUS _net_sam_logoff(pipes_struct *p, NET_Q_SAM_LOGOFF *q_u, NET_R_SAM_LOGOFF *r_u) 539{ 540 DOM_CRED srv_cred; 541 542 if (!get_valid_user_struct(p->vuid)) 543 return NT_STATUS_NO_SUCH_USER; 544 545 /* checks and updates credentials. creates reply credentials */ 546 if (!(p->dc.authenticated && deal_with_creds(p->dc.sess_key, &p->dc.clnt_cred, 547 &q_u->sam_id.client.cred, &srv_cred))) 548 return NT_STATUS_INVALID_HANDLE; 549 550 memcpy(&p->dc.srv_cred, &p->dc.clnt_cred, sizeof(p->dc.clnt_cred)); 551 552 /* XXXX maybe we want to say 'no', reject the client's credentials */ 553 r_u->buffer_creds = 1; /* yes, we have valid server credentials */ 554 memcpy(&r_u->srv_creds, &srv_cred, sizeof(r_u->srv_creds)); 555 556 r_u->status = NT_STATUS_OK; 557 558 return r_u->status; 559} 560 561 562/************************************************************************* 563 _net_sam_logon 564 *************************************************************************/ 565 566NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON *r_u) 567{ 568 NTSTATUS status = NT_STATUS_OK; 569 NET_USER_INFO_3 *usr_info = NULL; 570 NET_ID_INFO_CTR *ctr = q_u->sam_id.ctr; 571 DOM_CRED srv_cred; 572 UNISTR2 *uni_samlogon_user = NULL; 573 UNISTR2 *uni_samlogon_domain = NULL; 574 UNISTR2 *uni_samlogon_workstation = NULL; 575 fstring nt_username, nt_domain, nt_workstation; 576 auth_usersupplied_info *user_info = NULL; 577 auth_serversupplied_info *server_info = NULL; 578 extern userdom_struct current_user_info; 579 SAM_ACCOUNT *sampw; 580 struct auth_context *auth_context = NULL; 581 582 usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3); 583 if (!usr_info) 584 return NT_STATUS_NO_MEMORY; 585 586 ZERO_STRUCTP(usr_info); 587 588 /* store the user information, if there is any. */ 589 r_u->user = usr_info; 590 r_u->switch_value = 0; /* indicates no info */ 591 r_u->auth_resp = 1; /* authoritative response */ 592 r_u->switch_value = 3; /* indicates type of validation user info */ 593 594 if (!get_valid_user_struct(p->vuid)) 595 return NT_STATUS_NO_SUCH_USER; 596 597 598 if ( (lp_server_schannel() == True) && (!p->netsec_auth_validated) ) { 599 /* 'server schannel = yes' should enforce use of 600 schannel, the client did offer it in auth2, but 601 obviously did not use it. */ 602 return NT_STATUS_ACCESS_DENIED; 603 } 604 605 /* checks and updates credentials. creates reply credentials */ 606 if (!(p->dc.authenticated && deal_with_creds(p->dc.sess_key, &p->dc.clnt_cred, &q_u->sam_id.client.cred, &srv_cred))) 607 return NT_STATUS_INVALID_HANDLE; 608 609 memcpy(&p->dc.srv_cred, &p->dc.clnt_cred, sizeof(p->dc.clnt_cred)); 610 611 r_u->buffer_creds = 1; /* yes, we have valid server credentials */ 612 memcpy(&r_u->srv_creds, &srv_cred, sizeof(r_u->srv_creds)); 613 614 /* find the username */ 615 616 switch (q_u->sam_id.logon_level) { 617 case INTERACTIVE_LOGON_TYPE: 618 uni_samlogon_user = &ctr->auth.id1.uni_user_name; 619 uni_samlogon_domain = &ctr->auth.id1.uni_domain_name; 620 621 uni_samlogon_workstation = &ctr->auth.id1.uni_wksta_name; 622 623 DEBUG(3,("SAM Logon (Interactive). Domain:[%s]. ", lp_workgroup())); 624 break; 625 case NET_LOGON_TYPE: 626 uni_samlogon_user = &ctr->auth.id2.uni_user_name; 627 uni_samlogon_domain = &ctr->auth.id2.uni_domain_name; 628 uni_samlogon_workstation = &ctr->auth.id2.uni_wksta_name; 629 630 DEBUG(3,("SAM Logon (Network). Domain:[%s]. ", lp_workgroup())); 631 break; 632 default: 633 DEBUG(2,("SAM Logon: unsupported switch value\n")); 634 return NT_STATUS_INVALID_INFO_CLASS; 635 } /* end switch */ 636 637 rpcstr_pull(nt_username,uni_samlogon_user->buffer,sizeof(nt_username),uni_samlogon_user->uni_str_len*2,0); 638 rpcstr_pull(nt_domain,uni_samlogon_domain->buffer,sizeof(nt_domain),uni_samlogon_domain->uni_str_len*2,0); 639 rpcstr_pull(nt_workstation,uni_samlogon_workstation->buffer,sizeof(nt_workstation),uni_samlogon_workstation->uni_str_len*2,0); 640 641 DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, 642 nt_workstation, nt_domain)); 643 644 fstrcpy(current_user_info.smb_name, nt_username); 645 sub_set_smb_name(nt_username); 646 647 DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u->sam_id.ctr->switch_value, nt_username)); 648 649 status = NT_STATUS_OK; 650 651 switch (ctr->switch_value) { 652 case NET_LOGON_TYPE: 653 { 654 const char *wksname = nt_workstation; 655 656 if (!NT_STATUS_IS_OK(status = make_auth_context_fixed(&auth_context, ctr->auth.id2.lm_chal))) { 657 return status; 658 } 659 660 /* For a network logon, the workstation name comes in with two 661 * backslashes in the front. Strip them if they are there. */ 662 663 if (*wksname == '\\') wksname++; 664 if (*wksname == '\\') wksname++; 665 666 /* Standard challenge/response authenticaion */ 667 if (!make_user_info_netlogon_network(&user_info, 668 nt_username, nt_domain, 669 wksname, 670 ctr->auth.id2.lm_chal_resp.buffer, 671 ctr->auth.id2.lm_chal_resp.str_str_len, 672 ctr->auth.id2.nt_chal_resp.buffer, 673 ctr->auth.id2.nt_chal_resp.str_str_len)) { 674 status = NT_STATUS_NO_MEMORY; 675 } 676 break; 677 } 678 case INTERACTIVE_LOGON_TYPE: 679 /* 'Interactive' autheticaion, supplies the password in its 680 MD4 form, encrypted with the session key. We will 681 convert this to chellange/responce for the auth 682 subsystem to chew on */ 683 { 684 const uint8 *chal; 685 686 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) { 687 return status; 688 } 689 690 chal = auth_context->get_ntlm_challenge(auth_context); 691 692 if (!make_user_info_netlogon_interactive(&user_info, 693 nt_username, nt_domain, 694 nt_workstation, chal, 695 ctr->auth.id1.lm_owf.data, 696 ctr->auth.id1.nt_owf.data, 697 p->dc.sess_key)) { 698 status = NT_STATUS_NO_MEMORY; 699 } 700 break; 701 } 702 default: 703 DEBUG(2,("SAM Logon: unsupported switch value\n")); 704 return NT_STATUS_INVALID_INFO_CLASS; 705 } /* end switch */ 706 707 if ( NT_STATUS_IS_OK(status) ) { 708 status = auth_context->check_ntlm_password(auth_context, 709 user_info, &server_info); 710 } 711 712 (auth_context->free)(&auth_context); 713 free_user_info(&user_info); 714 715 DEBUG(5, ("_net_sam_logon: check_password returned status %s\n", 716 nt_errstr(status))); 717 718 /* Check account and password */ 719 720 if (!NT_STATUS_IS_OK(status)) { 721 free_server_info(&server_info); 722 return status; 723 } 724 725 if (server_info->guest) { 726 /* We don't like guest domain logons... */ 727 DEBUG(5,("_net_sam_logon: Attempted domain logon as GUEST denied.\n")); 728 free_server_info(&server_info); 729 return NT_STATUS_LOGON_FAILURE; 730 } 731 732 /* This is the point at which, if the login was successful, that 733 the SAM Local Security Authority should record that the user is 734 logged in to the domain. */ 735 736 { 737 DOM_GID *gids = NULL; 738 const DOM_SID *user_sid = NULL; 739 const DOM_SID *group_sid = NULL; 740 DOM_SID domain_sid; 741 uint32 user_rid, group_rid; 742 743 int num_gids = 0; 744 pstring my_name; 745 fstring user_sid_string; 746 fstring group_sid_string; 747 uchar user_session_key[16]; 748 uchar lm_session_key[16]; 749 uchar netlogon_sess_key[16]; 750 751 sampw = server_info->sam_account; 752 753 /* set up pointer indicating user/password failed to be found */ 754 usr_info->ptr_user_info = 0; 755 756 user_sid = pdb_get_user_sid(sampw); 757 group_sid = pdb_get_group_sid(sampw); 758 759 sid_copy(&domain_sid, user_sid); 760 sid_split_rid(&domain_sid, &user_rid); 761 762 if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) { 763 DEBUG(1, ("_net_sam_logon: user %s\\%s has user sid %s\n but group sid %s.\nThe conflicting domain portions are not supported for NETLOGON calls\n", 764 pdb_get_domain(sampw), pdb_get_username(sampw), 765 sid_to_string(user_sid_string, user_sid), 766 sid_to_string(group_sid_string, group_sid))); 767 return NT_STATUS_UNSUCCESSFUL; 768 } 769 770 pstrcpy(my_name, global_myname()); 771 772 if (!NT_STATUS_IS_OK(status 773 = nt_token_to_group_list(p->mem_ctx, 774 &domain_sid, 775 server_info->ptok, 776 &num_gids, 777 &gids))) { 778 return status; 779 } 780 781 ZERO_STRUCT(netlogon_sess_key); 782 memcpy(netlogon_sess_key, p->dc.sess_key, 8); 783 if (server_info->user_session_key.length) { 784 memcpy(user_session_key, server_info->user_session_key.data, 785 MIN(sizeof(user_session_key), server_info->user_session_key.length)); 786 SamOEMhash(user_session_key, netlogon_sess_key, 16); 787 } 788 if (server_info->lm_session_key.length) { 789 memcpy(lm_session_key, server_info->lm_session_key.data, 790 MIN(sizeof(lm_session_key), server_info->lm_session_key.length)); 791 SamOEMhash(lm_session_key, netlogon_sess_key, 16); 792 } 793 ZERO_STRUCT(netlogon_sess_key); 794 795 init_net_user_info3(p->mem_ctx, usr_info, 796 user_rid, 797 group_rid, 798 pdb_get_username(sampw), 799 pdb_get_fullname(sampw), 800 pdb_get_homedir(sampw), 801 pdb_get_dir_drive(sampw), 802 pdb_get_logon_script(sampw), 803 pdb_get_profile_path(sampw), 804 pdb_get_logon_time(sampw), 805 get_time_t_max(), 806 get_time_t_max(), 807 pdb_get_pass_last_set_time(sampw), 808 pdb_get_pass_can_change_time(sampw), 809 pdb_get_pass_must_change_time(sampw), 810 811 0, /* logon_count */ 812 0, /* bad_pw_count */ 813 num_gids, /* uint32 num_groups */ 814 gids , /* DOM_GID *gids */ 815 0x20 , /* uint32 user_flgs (?) */ 816 server_info->user_session_key.length ? user_session_key : NULL, 817 server_info->lm_session_key.length ? lm_session_key : NULL, 818 my_name , /* char *logon_srv */ 819 pdb_get_domain(sampw), 820 &domain_sid, /* DOM_SID *dom_sid */ 821 /* Should be users domain sid, not servers - for trusted domains */ 822 823 NULL); /* char *other_sids */ 824 ZERO_STRUCT(user_session_key); 825 ZERO_STRUCT(lm_session_key); 826 } 827 free_server_info(&server_info); 828 return status; 829} 830 831/************************************************************************* 832 _ds_enum_dom_trusts 833 *************************************************************************/ 834#if 0 /* JERRY -- not correct */ 835NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u, 836 DS_R_ENUM_DOM_TRUSTS *r_u) 837{ 838 NTSTATUS status = NT_STATUS_OK; 839 840 /* TODO: According to MSDN, the can only be executed against a 841 DC or domain member running Windows 2000 or later. Need 842 to test against a standalone 2k server and see what it 843 does. A windows 2000 DC includes its own domain in the 844 list. --jerry */ 845 846 return status; 847} 848#endif /* JERRY */ 849