source3/rpc_server/srv_netlog_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997.
   7  *  Copyright (C) Jeremy Allison               1998-2001.
   8  *  Copyright (C) Andrew Bartlett                   2001.
   9  *  Copyright (C) Guenther Deschner                 2008-2009.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 3 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  23  */
  24
  25 /* This is the implementation of the netlogon pipe. */
  26
  27 #include "includes.h"
  28 #include "../libcli/auth/schannel.h"
  29 #include "../librpc/gen_ndr/srv_netlogon.h"
  30 #include "librpc/gen_ndr/messaging.h"
  31 #include "../lib/crypto/md4.h"
  32
  33 extern userdom_struct current_user_info;
  34
  35 #undef DBGC_CLASS
  36 #define DBGC_CLASS DBGC_RPC_SRV
  37
  38 struct netlogon_server_pipe_state {
  39         struct netr_Credential client_challenge;
  40         struct netr_Credential server_challenge;
  41 };
  42
  43 /*************************************************************************
  44  _netr_LogonControl
  45  *************************************************************************/
  46
  47 WERROR _netr_LogonControl(pipes_struct *p,
  48                           struct netr_LogonControl *r)
  49 {
  50         struct netr_LogonControl2Ex l;
  51
  52         switch (r->in.level) {
  53         case 1:
  54                 break;
  55         case 2:
  56                 return WERR_NOT_SUPPORTED;
  57         default:
  58                 return WERR_UNKNOWN_LEVEL;
  59         }
  60
  61         l.in.logon_server       = r->in.logon_server;
  62         l.in.function_code      = r->in.function_code;
  63         l.in.level              = r->in.level;
  64         l.in.data               = NULL;
  65         l.out.query             = r->out.query;
  66
  67         return _netr_LogonControl2Ex(p, &l);
  68 }
  69
  70 /****************************************************************************
  71 Send a message to smbd to do a sam synchronisation
  72 **************************************************************************/
  73
  74 static void send_sync_message(void)
  75 {
  76         DEBUG(3, ("sending sam synchronisation message\n"));
  77         message_send_all(smbd_messaging_context(), MSG_SMB_SAM_SYNC, NULL, 0,
  78                          NULL);
  79 }
  80
  81 /*************************************************************************
  82  _netr_LogonControl2
  83  *************************************************************************/
  84
  85 WERROR _netr_LogonControl2(pipes_struct *p,
  86                            struct netr_LogonControl2 *r)
  87 {
  88         struct netr_LogonControl2Ex l;
  89
  90         l.in.logon_server       = r->in.logon_server;
  91         l.in.function_code      = r->in.function_code;
  92         l.in.level              = r->in.level;
  93         l.in.data               = r->in.data;
  94         l.out.query             = r->out.query;
  95
  96         return _netr_LogonControl2Ex(p, &l);
  97 }
  98
  99 /*************************************************************************
 100  *************************************************************************/
 101
 102 static bool wb_change_trust_creds(const char *domain, WERROR *tc_status)
 103 {
 104         wbcErr result;
 105         struct wbcAuthErrorInfo *error = NULL;
 106
 107         result = wbcChangeTrustCredentials(domain, &error);
 108         switch (result) {
 109         case WBC_ERR_WINBIND_NOT_AVAILABLE:
 110                 return false;
 111         case WBC_ERR_DOMAIN_NOT_FOUND:
 112                 *tc_status = WERR_NO_SUCH_DOMAIN;
 113                 return true;
 114         case WBC_ERR_SUCCESS:
 115                 *tc_status = WERR_OK;
 116                 return true;
 117         default:
 118                 break;
 119         }
 120
 121         if (error && error->nt_status != 0) {
 122                 *tc_status = ntstatus_to_werror(NT_STATUS(error->nt_status));
 123         } else {
 124                 *tc_status = WERR_TRUST_FAILURE;
 125         }
 126         wbcFreeMemory(error);
 127         return true;
 128 }
 129
 130 /*************************************************************************
 131  *************************************************************************/
 132
 133 static bool wb_check_trust_creds(const char *domain, WERROR *tc_status)
 134 {
 135         wbcErr result;
 136         struct wbcAuthErrorInfo *error = NULL;
 137
 138         result = wbcCheckTrustCredentials(domain, &error);
 139         switch (result) {
 140         case WBC_ERR_WINBIND_NOT_AVAILABLE:
 141                 return false;
 142         case WBC_ERR_DOMAIN_NOT_FOUND:
 143                 *tc_status = WERR_NO_SUCH_DOMAIN;
 144                 return true;
 145         case WBC_ERR_SUCCESS:
 146                 *tc_status = WERR_OK;
 147                 return true;
 148         default:
 149                 break;
 150         }
 151
 152         if (error && error->nt_status != 0) {
 153                 *tc_status = ntstatus_to_werror(NT_STATUS(error->nt_status));
 154         } else {
 155                 *tc_status = WERR_TRUST_FAILURE;
 156         }
 157         wbcFreeMemory(error);
 158         return true;
 159 }
 160
 161 /****************************************************************
 162  _netr_LogonControl2Ex
 163 ****************************************************************/
 164
 165 WERROR _netr_LogonControl2Ex(pipes_struct *p,
 166                              struct netr_LogonControl2Ex *r)
 167 {
 168         uint32_t flags = 0x0;
 169         WERROR pdc_connection_status = WERR_OK;
 170         uint32_t logon_attempts = 0x0;
 171         WERROR tc_status;
 172         fstring dc_name2;
 173         const char *dc_name = NULL;
 174         struct sockaddr_storage dc_ss;
 175         const char *domain = NULL;
 176         struct netr_NETLOGON_INFO_1 *info1;
 177         struct netr_NETLOGON_INFO_2 *info2;
 178         struct netr_NETLOGON_INFO_3 *info3;
 179         struct netr_NETLOGON_INFO_4 *info4;
 180         const char *fn;
 181         uint32_t acct_ctrl;
 182
 183         switch (p->hdr_req.opnum) {
 184         case NDR_NETR_LOGONCONTROL:
 185                 fn = "_netr_LogonControl";
 186                 break;
 187         case NDR_NETR_LOGONCONTROL2:
 188                 fn = "_netr_LogonControl2";
 189                 break;
 190         case NDR_NETR_LOGONCONTROL2EX:
 191                 fn = "_netr_LogonControl2Ex";
 192                 break;
 193         default:
 194                 return WERR_INVALID_PARAM;
 195         }
 196
 197         acct_ctrl = p->server_info->info3->base.acct_flags;
 198
 199         switch (r->in.function_code) {
 200         case NETLOGON_CONTROL_TC_VERIFY:
 201         case NETLOGON_CONTROL_CHANGE_PASSWORD:
 202         case NETLOGON_CONTROL_REDISCOVER:
 203                 if ((geteuid() != sec_initial_uid()) &&
 204                     !nt_token_check_domain_rid(p->server_info->ptok, DOMAIN_RID_ADMINS) &&
 205                     !nt_token_check_sid(&global_sid_Builtin_Administrators, p->server_info->ptok) &&
 206                     !(acct_ctrl & (ACB_WSTRUST | ACB_SVRTRUST))) {
 207                         return WERR_ACCESS_DENIED;
 208                 }
 209                 break;
 210         default:
 211                 break;
 212         }
 213
 214         tc_status = WERR_NO_SUCH_DOMAIN;
 215
 216         switch (r->in.function_code) {
 217         case NETLOGON_CONTROL_QUERY:
 218                 tc_status = WERR_OK;
 219                 break;
 220         case NETLOGON_CONTROL_REPLICATE:
 221         case NETLOGON_CONTROL_SYNCHRONIZE:
 222         case NETLOGON_CONTROL_PDC_REPLICATE:
 223         case NETLOGON_CONTROL_BACKUP_CHANGE_LOG:
 224         case NETLOGON_CONTROL_BREAKPOINT:
 225                 if (acct_ctrl & ACB_NORMAL) {
 226                         return WERR_NOT_SUPPORTED;
 227                 } else if (acct_ctrl & (ACB_WSTRUST | ACB_SVRTRUST)) {
 228                         return WERR_ACCESS_DENIED;
 229                 } else {
 230                         return WERR_ACCESS_DENIED;
 231                 }
 232         case NETLOGON_CONTROL_TRUNCATE_LOG:
 233                 if (acct_ctrl & ACB_NORMAL) {
 234                         break;
 235                 } else if (acct_ctrl & (ACB_WSTRUST | ACB_SVRTRUST)) {
 236                         return WERR_ACCESS_DENIED;
 237                 } else {
 238                         return WERR_ACCESS_DENIED;
 239                 }
 240
 241         case NETLOGON_CONTROL_TRANSPORT_NOTIFY:
 242         case NETLOGON_CONTROL_FORCE_DNS_REG:
 243         case NETLOGON_CONTROL_QUERY_DNS_REG:
 244                 return WERR_NOT_SUPPORTED;
 245         case NETLOGON_CONTROL_FIND_USER:
 246                 if (!r->in.data || !r->in.data->user) {
 247                         return WERR_NOT_SUPPORTED;
 248                 }
 249                 break;
 250         case NETLOGON_CONTROL_SET_DBFLAG:
 251                 if (!r->in.data) {
 252                         return WERR_NOT_SUPPORTED;
 253                 }
 254                 break;
 255         case NETLOGON_CONTROL_TC_VERIFY:
 256                 if (!r->in.data || !r->in.data->domain) {
 257                         return WERR_NOT_SUPPORTED;
 258                 }
 259
 260                 if (!wb_check_trust_creds(r->in.data->domain, &tc_status)) {
 261                         return WERR_NOT_SUPPORTED;
 262                 }
 263                 break;
 264         case NETLOGON_CONTROL_TC_QUERY:
 265                 if (!r->in.data || !r->in.data->domain) {
 266                         return WERR_NOT_SUPPORTED;
 267                 }
 268
 269                 domain = r->in.data->domain;
 270
 271                 if (!is_trusted_domain(domain)) {
 272                         break;
 273                 }
 274
 275                 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
 276                         tc_status = WERR_NO_LOGON_SERVERS;
 277                         break;
 278                 }
 279
 280                 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
 281                 if (!dc_name) {
 282                         return WERR_NOMEM;
 283                 }
 284
 285                 tc_status = WERR_OK;
 286
 287                 break;
 288
 289         case NETLOGON_CONTROL_REDISCOVER:
 290                 if (!r->in.data || !r->in.data->domain) {
 291                         return WERR_NOT_SUPPORTED;
 292                 }
 293
 294                 domain = r->in.data->domain;
 295
 296                 if (!is_trusted_domain(domain)) {
 297                         break;
 298                 }
 299
 300                 if (!get_dc_name(domain, NULL, dc_name2, &dc_ss)) {
 301                         tc_status = WERR_NO_LOGON_SERVERS;
 302                         break;
 303                 }
 304
 305                 dc_name = talloc_asprintf(p->mem_ctx, "\\\\%s", dc_name2);
 306                 if (!dc_name) {
 307                         return WERR_NOMEM;
 308                 }
 309
 310                 tc_status = WERR_OK;
 311
 312                 break;
 313
 314         case NETLOGON_CONTROL_CHANGE_PASSWORD:
 315                 if (!r->in.data || !r->in.data->domain) {
 316                         return WERR_NOT_SUPPORTED;
 317                 }
 318
 319                 if (!wb_change_trust_creds(r->in.data->domain, &tc_status)) {
 320                         return WERR_NOT_SUPPORTED;
 321                 }
 322                 break;
 323
 324         default:
 325                 /* no idea what this should be */
 326                 DEBUG(0,("%s: unimplemented function level [%d]\n",
 327                         fn, r->in.function_code));
 328                 return WERR_UNKNOWN_LEVEL;
 329         }
 330
 331         /* prepare the response */
 332
 333         switch (r->in.level) {
 334         case 1:
 335                 info1 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_1);
 336                 W_ERROR_HAVE_NO_MEMORY(info1);
 337
 338                 info1->flags                    = flags;
 339                 info1->pdc_connection_status    = pdc_connection_status;
 340
 341                 r->out.query->info1 = info1;
 342                 break;
 343         case 2:
 344                 info2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_2);
 345                 W_ERROR_HAVE_NO_MEMORY(info2);
 346
 347                 info2->flags                    = flags;
 348                 info2->pdc_connection_status    = pdc_connection_status;
 349                 info2->trusted_dc_name          = dc_name;
 350                 info2->tc_connection_status     = tc_status;
 351
 352                 r->out.query->info2 = info2;
 353                 break;
 354         case 3:
 355                 info3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_3);
 356                 W_ERROR_HAVE_NO_MEMORY(info3);
 357
 358                 info3->flags                    = flags;
 359                 info3->logon_attempts           = logon_attempts;
 360
 361                 r->out.query->info3 = info3;
 362                 break;
 363         case 4:
 364                 info4 = TALLOC_ZERO_P(p->mem_ctx, struct netr_NETLOGON_INFO_4);
 365                 W_ERROR_HAVE_NO_MEMORY(info4);
 366
 367                 info4->trusted_dc_name          = dc_name;
 368                 info4->trusted_domain_name      = r->in.data->domain;
 369
 370                 r->out.query->info4 = info4;
 371                 break;
 372         default:
 373                 return WERR_UNKNOWN_LEVEL;
 374         }
 375
 376         if (lp_server_role() == ROLE_DOMAIN_BDC) {
 377                 send_sync_message();
 378         }
 379
 380         return WERR_OK;
 381 }
 382
 383 /*************************************************************************
 384  _netr_NetrEnumerateTrustedDomains
 385  *************************************************************************/
 386
 387 WERROR _netr_NetrEnumerateTrustedDomains(pipes_struct *p,
 388                                          struct netr_NetrEnumerateTrustedDomains *r)
 389 {
 390         NTSTATUS status;
 391         DATA_BLOB blob;
 392         struct trustdom_info **domains;
 393         uint32_t num_domains;
 394         const char **trusted_domains;
 395         int i;
 396
 397         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 398
 399         /* set up the Trusted Domain List response */
 400
 401         become_root();
 402         status = pdb_enum_trusteddoms(p->mem_ctx, &num_domains, &domains);
 403         unbecome_root();
 404
 405         if (!NT_STATUS_IS_OK(status)) {
 406                 return ntstatus_to_werror(status);
 407         }
 408
 409         trusted_domains = talloc_zero_array(p->mem_ctx, const char *, num_domains + 1);
 410         if (!trusted_domains) {
 411                 return WERR_NOMEM;
 412         }
 413
 414         for (i = 0; i < num_domains; i++) {
 415                 trusted_domains[i] = talloc_strdup(trusted_domains, domains[i]->name);
 416                 if (!trusted_domains[i]) {
 417                         TALLOC_FREE(trusted_domains);
 418                         return WERR_NOMEM;
 419                 }
 420         }
 421
 422         if (!push_reg_multi_sz(trusted_domains, &blob, trusted_domains)) {
 423                 TALLOC_FREE(trusted_domains);
 424                 return WERR_NOMEM;
 425         }
 426
 427         r->out.trusted_domains_blob->data = blob.data;
 428         r->out.trusted_domains_blob->length = blob.length;
 429
 430         DEBUG(6,("_netr_NetrEnumerateTrustedDomains: %d\n", __LINE__));
 431
 432         return WERR_OK;
 433 }
 434
 435 /******************************************************************
 436  gets a machine password entry.  checks access rights of the host.
 437  ******************************************************************/
 438
 439 static NTSTATUS get_md4pw(struct samr_Password *md4pw, const char *mach_acct,
 440                           enum netr_SchannelType sec_chan_type, struct dom_sid *sid)
 441 {
 442         struct samu *sampass = NULL;
 443         const uint8 *pass;
 444         bool ret;
 445         uint32 acct_ctrl;
 446
 447 #if 0
 448         char addr[INET6_ADDRSTRLEN];
 449
 450     /*
 451      * Currently this code is redundent as we already have a filter
 452      * by hostname list. What this code really needs to do is to
 453      * get a hosts allowed/hosts denied list from the SAM database
 454      * on a per user basis, and make the access decision there.
 455      * I will leave this code here for now as a reminder to implement
 456      * this at a later date. JRA.
 457      */
 458
 459         if (!allow_access(lp_domain_hostsdeny(), lp_domain_hostsallow(),
 460                         client_name(get_client_fd()),
 461                         client_addr(get_client_fd(),addr,sizeof(addr)))) {
 462                 DEBUG(0,("get_md4pw: Workstation %s denied access to domain\n", mach_acct));
 463                 return False;
 464         }
 465 #endif /* 0 */
 466
 467         if ( !(sampass = samu_new( NULL )) ) {
 468                 return NT_STATUS_NO_MEMORY;
 469         }
 470
 471         /* JRA. This is ok as it is only used for generating the challenge. */
 472         become_root();
 473         ret = pdb_getsampwnam(sampass, mach_acct);
 474         unbecome_root();
 475
 476         if (!ret) {
 477                 DEBUG(0,("get_md4pw: Workstation %s: no account in domain\n", mach_acct));
 478                 TALLOC_FREE(sampass);
 479                 return NT_STATUS_ACCESS_DENIED;
 480         }
 481
 482         acct_ctrl = pdb_get_acct_ctrl(sampass);
 483         if (acct_ctrl & ACB_DISABLED) {
 484                 DEBUG(0,("get_md4pw: Workstation %s: account is disabled\n", mach_acct));
 485                 TALLOC_FREE(sampass);
 486                 return NT_STATUS_ACCOUNT_DISABLED;
 487         }
 488
 489         if (!(acct_ctrl & ACB_SVRTRUST) &&
 490             !(acct_ctrl & ACB_WSTRUST) &&
 491             !(acct_ctrl & ACB_DOMTRUST))
 492         {
 493                 DEBUG(0,("get_md4pw: Workstation %s: account is not a trust account\n", mach_acct));
 494                 TALLOC_FREE(sampass);
 495                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 496         }
 497
 498         switch (sec_chan_type) {
 499                 case SEC_CHAN_BDC:
 500                         if (!(acct_ctrl & ACB_SVRTRUST)) {
 501                                 DEBUG(0,("get_md4pw: Workstation %s: BDC secure channel requested "
 502                                          "but not a server trust account\n", mach_acct));
 503                                 TALLOC_FREE(sampass);
 504                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 505                         }
 506                         break;
 507                 case SEC_CHAN_WKSTA:
 508                         if (!(acct_ctrl & ACB_WSTRUST)) {
 509                                 DEBUG(0,("get_md4pw: Workstation %s: WORKSTATION secure channel requested "
 510                                          "but not a workstation trust account\n", mach_acct));
 511                                 TALLOC_FREE(sampass);
 512                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 513                         }
 514                         break;
 515                 case SEC_CHAN_DOMAIN:
 516                         if (!(acct_ctrl & ACB_DOMTRUST)) {
 517                                 DEBUG(0,("get_md4pw: Workstation %s: DOMAIN secure channel requested "
 518                                          "but not a interdomain trust account\n", mach_acct));
 519                                 TALLOC_FREE(sampass);
 520                                 return NT_STATUS_NO_TRUST_SAM_ACCOUNT;
 521                         }
 522                         break;
 523                 default:
 524                         break;
 525         }
 526
 527         if ((pass = pdb_get_nt_passwd(sampass)) == NULL) {
 528                 DEBUG(0,("get_md4pw: Workstation %s: account does not have a password\n", mach_acct));
 529                 TALLOC_FREE(sampass);
 530                 return NT_STATUS_LOGON_FAILURE;
 531         }
 532
 533         memcpy(md4pw->hash, pass, 16);
 534         dump_data(5, md4pw->hash, 16);
 535
 536         sid_copy(sid, pdb_get_user_sid(sampass));
 537
 538         TALLOC_FREE(sampass);
 539
 540         return NT_STATUS_OK;
 541
 542
 543 }
 544
 545 /*************************************************************************
 546  _netr_ServerReqChallenge
 547  *************************************************************************/
 548
 549 NTSTATUS _netr_ServerReqChallenge(pipes_struct *p,
 550                                   struct netr_ServerReqChallenge *r)
 551 {
 552         struct netlogon_server_pipe_state *pipe_state =
 553                 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
 554
 555         if (pipe_state) {
 556                 DEBUG(10,("_netr_ServerReqChallenge: new challenge requested. Clearing old state.\n"));
 557                 talloc_free(pipe_state);
 558                 p->private_data = NULL;
 559         }
 560
 561         pipe_state = talloc(p, struct netlogon_server_pipe_state);
 562         NT_STATUS_HAVE_NO_MEMORY(pipe_state);
 563
 564         pipe_state->client_challenge = *r->in.credentials;
 565
 566         generate_random_buffer(pipe_state->server_challenge.data,
 567                                sizeof(pipe_state->server_challenge.data));
 568
 569         *r->out.return_credentials = pipe_state->server_challenge;
 570
 571         p->private_data = pipe_state;
 572
 573         return NT_STATUS_OK;
 574 }
 575
 576 /*************************************************************************
 577  _netr_ServerAuthenticate
 578  Create the initial credentials.
 579  *************************************************************************/
 580
 581 NTSTATUS _netr_ServerAuthenticate(pipes_struct *p,
 582                                   struct netr_ServerAuthenticate *r)
 583 {
 584         struct netr_ServerAuthenticate3 a;
 585         uint32_t negotiate_flags = 0;
 586         uint32_t rid;
 587
 588         a.in.server_name                = r->in.server_name;
 589         a.in.account_name               = r->in.account_name;
 590         a.in.secure_channel_type        = r->in.secure_channel_type;
 591         a.in.computer_name              = r->in.computer_name;
 592         a.in.credentials                = r->in.credentials;
 593         a.in.negotiate_flags            = &negotiate_flags;
 594
 595         a.out.return_credentials        = r->out.return_credentials;
 596         a.out.rid                       = &rid;
 597         a.out.negotiate_flags           = &negotiate_flags;
 598
 599         return _netr_ServerAuthenticate3(p, &a);
 600
 601 }
 602
 603 /*************************************************************************
 604  _netr_ServerAuthenticate3
 605  *************************************************************************/
 606
 607 NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
 608                                    struct netr_ServerAuthenticate3 *r)
 609 {
 610         NTSTATUS status;
 611         uint32_t srv_flgs;
 612         /* r->in.negotiate_flags is an aliased pointer to r->out.negotiate_flags,
 613          * so use a copy to avoid destroying the client values. */
 614         uint32_t in_neg_flags = *r->in.negotiate_flags;
 615         const char *fn;
 616         struct dom_sid sid;
 617         struct samr_Password mach_pwd;
 618         struct netlogon_creds_CredentialState *creds;
 619         struct netlogon_server_pipe_state *pipe_state =
 620                 talloc_get_type(p->private_data, struct netlogon_server_pipe_state);
 621
 622         /* According to Microsoft (see bugid #6099)
 623          * Windows 7 looks at the negotiate_flags
 624          * returned in this structure *even if the
 625          * call fails with access denied* ! So in order
 626          * to allow Win7 to connect to a Samba NT style
 627          * PDC we set the flags before we know if it's
 628          * an error or not.
 629          */
 630
 631         /* 0x000001ff */
 632         srv_flgs = NETLOGON_NEG_ACCOUNT_LOCKOUT |
 633                    NETLOGON_NEG_PERSISTENT_SAMREPL |
 634                    NETLOGON_NEG_ARCFOUR |
 635                    NETLOGON_NEG_PROMOTION_COUNT |
 636                    NETLOGON_NEG_CHANGELOG_BDC |
 637                    NETLOGON_NEG_FULL_SYNC_REPL |
 638                    NETLOGON_NEG_MULTIPLE_SIDS |
 639                    NETLOGON_NEG_REDO |
 640                    NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL |
 641                    NETLOGON_NEG_PASSWORD_SET2;
 642
 643         /* Ensure we support strong (128-bit) keys. */
 644         if (in_neg_flags & NETLOGON_NEG_STRONG_KEYS) {
 645                 srv_flgs |= NETLOGON_NEG_STRONG_KEYS;
 646         }
 647
 648         if (lp_server_schannel() != false) {
 649                 srv_flgs |= NETLOGON_NEG_SCHANNEL;
 650         }
 651
 652         switch (p->hdr_req.opnum) {
 653                 case NDR_NETR_SERVERAUTHENTICATE:
 654                         fn = "_netr_ServerAuthenticate";
 655                         break;
 656                 case NDR_NETR_SERVERAUTHENTICATE2:
 657                         fn = "_netr_ServerAuthenticate2";
 658                         break;
 659                 case NDR_NETR_SERVERAUTHENTICATE3:
 660                         fn = "_netr_ServerAuthenticate3";
 661                         break;
 662                 default:
 663                         return NT_STATUS_INTERNAL_ERROR;
 664         }
 665
 666         /* We use this as the key to store the creds: */
 667         /* r->in.computer_name */
 668
 669         if (!pipe_state) {
 670                 DEBUG(0,("%s: no challenge sent to client %s\n", fn,
 671                         r->in.computer_name));
 672                 status = NT_STATUS_ACCESS_DENIED;
 673                 goto out;
 674         }
 675
 676         if ( (lp_server_schannel() == true) &&
 677              ((in_neg_flags & NETLOGON_NEG_SCHANNEL) == 0) ) {
 678
 679                 /* schannel must be used, but client did not offer it. */
 680                 DEBUG(0,("%s: schannel required but client failed "
 681                         "to offer it. Client was %s\n",
 682                         fn, r->in.account_name));
 683                 status = NT_STATUS_ACCESS_DENIED;
 684                 goto out;
 685         }
 686
 687         status = get_md4pw(&mach_pwd,
 688                            r->in.account_name,
 689                            r->in.secure_channel_type,
 690                            &sid);
 691         if (!NT_STATUS_IS_OK(status)) {
 692                 DEBUG(0,("%s: failed to get machine password for "
 693                         "account %s: %s\n",
 694                         fn, r->in.account_name, nt_errstr(status) ));
 695                 /* always return NT_STATUS_ACCESS_DENIED */
 696                 status = NT_STATUS_ACCESS_DENIED;
 697                 goto out;
 698         }
 699
 700         /* From the client / server challenges and md4 password, generate sess key */
 701         /* Check client credentials are valid. */
 702         creds = netlogon_creds_server_init(p->mem_ctx,
 703                                            r->in.account_name,
 704                                            r->in.computer_name,
 705                                            r->in.secure_channel_type,
 706                                            &pipe_state->client_challenge,
 707                                            &pipe_state->server_challenge,
 708                                            &mach_pwd,
 709                                            r->in.credentials,
 710                                            r->out.return_credentials,
 711                                            *r->in.negotiate_flags);
 712         if (!creds) {
 713                 DEBUG(0,("%s: netlogon_creds_server_check failed. Rejecting auth "
 714                         "request from client %s machine account %s\n",
 715                         fn, r->in.computer_name,
 716                         r->in.account_name));
 717                 status = NT_STATUS_ACCESS_DENIED;
 718                 goto out;
 719         }
 720
 721         creds->sid = sid_dup_talloc(creds, &sid);
 722         if (!creds->sid) {
 723                 status = NT_STATUS_NO_MEMORY;
 724                 goto out;
 725         }
 726
 727         /* Store off the state so we can continue after client disconnect. */
 728         become_root();
 729         status = schannel_save_creds_state(p->mem_ctx, lp_private_dir(), creds);
 730         unbecome_root();
 731
 732         if (!NT_STATUS_IS_OK(status)) {
 733                 goto out;
 734         }
 735
 736         sid_peek_rid(&sid, r->out.rid);
 737
 738         status = NT_STATUS_OK;
 739
 740   out:
 741
 742         *r->out.negotiate_flags = srv_flgs;
 743         return status;
 744 }
 745
 746 /*************************************************************************
 747  _netr_ServerAuthenticate2
 748  *************************************************************************/
 749
 750 NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
 751                                    struct netr_ServerAuthenticate2 *r)
 752 {
 753         struct netr_ServerAuthenticate3 a;
 754         uint32_t rid;
 755
 756         a.in.server_name                = r->in.server_name;
 757         a.in.account_name               = r->in.account_name;
 758         a.in.secure_channel_type        = r->in.secure_channel_type;
 759         a.in.computer_name              = r->in.computer_name;
 760         a.in.credentials                = r->in.credentials;
 761         a.in.negotiate_flags            = r->in.negotiate_flags;
 762
 763         a.out.return_credentials        = r->out.return_credentials;
 764         a.out.rid                       = &rid;
 765         a.out.negotiate_flags           = r->out.negotiate_flags;
 766
 767         return _netr_ServerAuthenticate3(p, &a);
 768 }
 769
 770 /*************************************************************************
 771  * If schannel is required for this call test that it actually is available.
 772  *************************************************************************/
 773 static NTSTATUS schannel_check_required(struct pipe_auth_data *auth_info,
 774                                         const char *computer_name,
 775                                         bool integrity, bool privacy)
 776 {
 777         if (auth_info && auth_info->auth_type == PIPE_AUTH_TYPE_SCHANNEL) {
 778                 if (!privacy && !integrity) {
 779                         return NT_STATUS_OK;
 780                 }
 781
 782                 if ((!privacy && integrity) &&
 783                     auth_info->auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 784                         return NT_STATUS_OK;
 785                 }
 786
 787                 if ((privacy || integrity) &&
 788                     auth_info->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 789                         return NT_STATUS_OK;
 790                 }
 791         }
 792
 793         /* test didn't pass */
 794         DEBUG(0, ("schannel_check_required: [%s] is not using schannel\n",
 795                   computer_name));
 796
 797         return NT_STATUS_ACCESS_DENIED;
 798 }
 799
 800 /*************************************************************************
 801  *************************************************************************/
 802
 803 static NTSTATUS netr_creds_server_step_check(pipes_struct *p,
 804                                              TALLOC_CTX *mem_ctx,
 805                                              const char *computer_name,
 806                                              struct netr_Authenticator *received_authenticator,
 807                                              struct netr_Authenticator *return_authenticator,
 808                                              struct netlogon_creds_CredentialState **creds_out)
 809 {
 810         NTSTATUS status;
 811         bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
 812
 813         if (schannel_global_required) {
 814                 status = schannel_check_required(&p->auth,
 815                                                  computer_name,
 816                                                  false, false);
 817                 if (!NT_STATUS_IS_OK(status)) {
 818                         return status;
 819                 }
 820         }
 821
 822         status = schannel_check_creds_state(mem_ctx, lp_private_dir(),
 823                                             computer_name, received_authenticator,
 824                                             return_authenticator, creds_out);
 825
 826         return status;
 827 }
 828
 829 /*************************************************************************
 830  *************************************************************************/
 831
 832 static NTSTATUS netr_find_machine_account(TALLOC_CTX *mem_ctx,
 833                                           const char *account_name,
 834                                           struct samu **sampassp)
 835 {
 836         struct samu *sampass;
 837         bool ret = false;
 838         uint32_t acct_ctrl;
 839
 840         sampass = samu_new(mem_ctx);
 841         if (!sampass) {
 842                 return NT_STATUS_NO_MEMORY;
 843         }
 844
 845         become_root();
 846         ret = pdb_getsampwnam(sampass, account_name);
 847         unbecome_root();
 848
 849         if (!ret) {
 850                 TALLOC_FREE(sampass);
 851                 return NT_STATUS_ACCESS_DENIED;
 852         }
 853
 854         /* Ensure the account exists and is a machine account. */
 855
 856         acct_ctrl = pdb_get_acct_ctrl(sampass);
 857
 858         if (!(acct_ctrl & ACB_WSTRUST ||
 859               acct_ctrl & ACB_SVRTRUST ||
 860               acct_ctrl & ACB_DOMTRUST)) {
 861                 TALLOC_FREE(sampass);
 862                 return NT_STATUS_NO_SUCH_USER;
 863         }
 864
 865         if (acct_ctrl & ACB_DISABLED) {
 866                 TALLOC_FREE(sampass);
 867                 return NT_STATUS_ACCOUNT_DISABLED;
 868         }
 869
 870         *sampassp = sampass;
 871
 872         return NT_STATUS_OK;
 873 }
 874
 875 /*************************************************************************
 876  *************************************************************************/
 877
 878 static NTSTATUS netr_set_machine_account_password(TALLOC_CTX *mem_ctx,
 879                                                   struct samu *sampass,
 880                                                   DATA_BLOB *plaintext_blob,
 881                                                   struct samr_Password *nt_hash,
 882                                                   struct samr_Password *lm_hash)
 883 {
 884         NTSTATUS status;
 885         const uchar *old_pw;
 886         const char *plaintext = NULL;
 887         size_t plaintext_len;
 888         struct samr_Password nt_hash_local;
 889
 890         if (!sampass) {
 891                 return NT_STATUS_INVALID_PARAMETER;
 892         }
 893
 894         if (plaintext_blob) {
 895                 if (!convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
 896                                            plaintext_blob->data, plaintext_blob->length,
 897                                            &plaintext, &plaintext_len, false))
 898                 {
 899                         plaintext = NULL;
 900                         mdfour(nt_hash_local.hash, plaintext_blob->data, plaintext_blob->length);
 901                         nt_hash = &nt_hash_local;
 902                 }
 903         }
 904
 905         if (plaintext) {
 906                 if (!pdb_set_plaintext_passwd(sampass, plaintext)) {
 907                         return NT_STATUS_ACCESS_DENIED;
 908                 }
 909
 910                 goto done;
 911         }
 912
 913         if (nt_hash) {
 914                 old_pw = pdb_get_nt_passwd(sampass);
 915
 916                 if (old_pw && memcmp(nt_hash->hash, old_pw, 16) == 0) {
 917                         /* Avoid backend modificiations and other fun if the
 918                            client changed the password to the *same thing* */
 919                 } else {
 920                         /* LM password should be NULL for machines */
 921                         if (!pdb_set_lanman_passwd(sampass, NULL, PDB_CHANGED)) {
 922                                 return NT_STATUS_NO_MEMORY;
 923                         }
 924                         if (!pdb_set_nt_passwd(sampass, nt_hash->hash, PDB_CHANGED)) {
 925                                 return NT_STATUS_NO_MEMORY;
 926                         }
 927
 928                         if (!pdb_set_pass_last_set_time(sampass, time(NULL), PDB_CHANGED)) {
 929                                 /* Not quite sure what this one qualifies as, but this will do */
 930                                 return NT_STATUS_UNSUCCESSFUL;
 931                         }
 932                 }
 933         }
 934
 935  done:
 936         become_root();
 937         status = pdb_update_sam_account(sampass);
 938         unbecome_root();
 939
 940         return status;
 941 }
 942
 943 /*************************************************************************
 944  _netr_ServerPasswordSet
 945  *************************************************************************/
 946
 947 NTSTATUS _netr_ServerPasswordSet(pipes_struct *p,
 948                                  struct netr_ServerPasswordSet *r)
 949 {
 950         NTSTATUS status = NT_STATUS_OK;
 951         struct samu *sampass=NULL;
 952         int i;
 953         struct netlogon_creds_CredentialState *creds;
 954
 955         DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
 956
 957         become_root();
 958         status = netr_creds_server_step_check(p, p->mem_ctx,
 959                                               r->in.computer_name,
 960                                               r->in.credential,
 961                                               r->out.return_authenticator,
 962                                               &creds);
 963         unbecome_root();
 964
 965         if (!NT_STATUS_IS_OK(status)) {
 966                 DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
 967                         "request from client %s machine account %s\n",
 968                         r->in.computer_name, creds->computer_name));
 969                 TALLOC_FREE(creds);
 970                 return status;
 971         }
 972
 973         DEBUG(3,("_netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s]\n",
 974                         r->in.computer_name, creds->computer_name));
 975
 976         netlogon_creds_des_decrypt(creds, r->in.new_password);
 977
 978         DEBUG(100,("_netr_ServerPasswordSet: new given value was :\n"));
 979         for(i = 0; i < sizeof(r->in.new_password->hash); i++)
 980                 DEBUG(100,("%02X ", r->in.new_password->hash[i]));
 981         DEBUG(100,("\n"));
 982
 983         status = netr_find_machine_account(p->mem_ctx,
 984                                            creds->account_name,
 985                                            &sampass);
 986         if (!NT_STATUS_IS_OK(status)) {
 987                 return status;
 988         }
 989
 990         status = netr_set_machine_account_password(sampass,
 991                                                    sampass,
 992                                                    NULL,
 993                                                    r->in.new_password,
 994                                                    NULL);
 995         TALLOC_FREE(sampass);
 996         return status;
 997 }
 998
 999 /****************************************************************
1000  _netr_ServerPasswordSet2
1001 ****************************************************************/
1002
1003 NTSTATUS _netr_ServerPasswordSet2(pipes_struct *p,
1004                                   struct netr_ServerPasswordSet2 *r)
1005 {
1006         NTSTATUS status;
1007         struct netlogon_creds_CredentialState *creds;
1008         struct samu *sampass;
1009         DATA_BLOB plaintext;
1010         struct samr_CryptPassword password_buf;
1011         struct samr_Password nt_hash;
1012
1013         become_root();
1014         status = netr_creds_server_step_check(p, p->mem_ctx,
1015                                               r->in.computer_name,
1016                                               r->in.credential,
1017                                               r->out.return_authenticator,
1018                                               &creds);
1019         unbecome_root();
1020
1021         if (!NT_STATUS_IS_OK(status)) {
1022                 DEBUG(2,("_netr_ServerPasswordSet2: netlogon_creds_server_step "
1023                         "failed. Rejecting auth request from client %s machine account %s\n",
1024                         r->in.computer_name, creds->computer_name));
1025                 TALLOC_FREE(creds);
1026                 return status;
1027         }
1028
1029         memcpy(password_buf.data, r->in.new_password->data, 512);
1030         SIVAL(password_buf.data, 512, r->in.new_password->length);
1031         netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
1032
1033         if (!extract_pw_from_buffer(p->mem_ctx, password_buf.data, &plaintext)) {
1034                 return NT_STATUS_WRONG_PASSWORD;
1035         }
1036
1037         mdfour(nt_hash.hash, plaintext.data, plaintext.length);
1038
1039         status = netr_find_machine_account(p->mem_ctx,
1040                                            creds->account_name,
1041                                            &sampass);
1042         if (!NT_STATUS_IS_OK(status)) {
1043                 return status;
1044         }
1045
1046         status = netr_set_machine_account_password(sampass,
1047                                                    sampass,
1048                                                    NULL,
1049                                                    &nt_hash,
1050                                                    NULL);
1051         TALLOC_FREE(sampass);
1052         return status;
1053 }
1054
1055 /*************************************************************************
1056  _netr_LogonSamLogoff
1057  *************************************************************************/
1058
1059 NTSTATUS _netr_LogonSamLogoff(pipes_struct *p,
1060                               struct netr_LogonSamLogoff *r)
1061 {
1062         NTSTATUS status;
1063         struct netlogon_creds_CredentialState *creds;
1064
1065         become_root();
1066         status = netr_creds_server_step_check(p, p->mem_ctx,
1067                                               r->in.computer_name,
1068                                               r->in.credential,
1069                                               r->out.return_authenticator,
1070                                               &creds);
1071         unbecome_root();
1072
1073         return status;
1074 }
1075
1076 /*************************************************************************
1077  _netr_LogonSamLogon_base
1078  *************************************************************************/
1079
1080 static NTSTATUS _netr_LogonSamLogon_base(pipes_struct *p,
1081                                          struct netr_LogonSamLogonEx *r,
1082                                          struct netlogon_creds_CredentialState *creds)
1083 {
1084         NTSTATUS status = NT_STATUS_OK;
1085         union netr_LogonLevel *logon = r->in.logon;
1086         const char *nt_username, *nt_domain, *nt_workstation;
1087         struct auth_usersupplied_info *user_info = NULL;
1088         struct auth_serversupplied_info *server_info = NULL;
1089         struct auth_context *auth_context = NULL;
1090         uint8_t pipe_session_key[16];
1091         bool process_creds = true;
1092         const char *fn;
1093
1094         switch (p->hdr_req.opnum) {
1095                 case NDR_NETR_LOGONSAMLOGON:
1096                         process_creds = true;
1097                         fn = "_netr_LogonSamLogon";
1098                         break;
1099                 case NDR_NETR_LOGONSAMLOGONWITHFLAGS:
1100                         process_creds = true;
1101                         fn = "_netr_LogonSamLogonWithFlags";
1102                         break;
1103                 case NDR_NETR_LOGONSAMLOGONEX:
1104                         process_creds = false;
1105                         fn = "_netr_LogonSamLogonEx";
1106                         break;
1107                 default:
1108                         return NT_STATUS_INTERNAL_ERROR;
1109         }
1110
1111         *r->out.authoritative = true; /* authoritative response */
1112
1113         switch (r->in.validation_level) {
1114         case 2:
1115                 r->out.validation->sam2 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo2);
1116                 if (!r->out.validation->sam2) {
1117                         return NT_STATUS_NO_MEMORY;
1118                 }
1119                 break;
1120         case 3:
1121                 r->out.validation->sam3 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo3);
1122                 if (!r->out.validation->sam3) {
1123                         return NT_STATUS_NO_MEMORY;
1124                 }
1125                 break;
1126         case 6:
1127                 r->out.validation->sam6 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo6);
1128                 if (!r->out.validation->sam6) {
1129                         return NT_STATUS_NO_MEMORY;
1130                 }
1131                 break;
1132         default:
1133                 DEBUG(0,("%s: bad validation_level value %d.\n",
1134                         fn, (int)r->in.validation_level));
1135                 return NT_STATUS_INVALID_INFO_CLASS;
1136         }
1137
1138         switch (r->in.logon_level) {
1139         case NetlogonInteractiveInformation:
1140         case NetlogonServiceInformation:
1141         case NetlogonInteractiveTransitiveInformation:
1142         case NetlogonServiceTransitiveInformation:
1143                 nt_username     = logon->password->identity_info.account_name.string ?
1144                                   logon->password->identity_info.account_name.string : "";
1145                 nt_domain       = logon->password->identity_info.domain_name.string ?
1146                                   logon->password->identity_info.domain_name.string : "";
1147                 nt_workstation  = logon->password->identity_info.workstation.string ?
1148                                   logon->password->identity_info.workstation.string : "";
1149
1150                 DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
1151                 break;
1152         case NetlogonNetworkInformation:
1153         case NetlogonNetworkTransitiveInformation:
1154                 nt_username     = logon->network->identity_info.account_name.string ?
1155                                   logon->network->identity_info.account_name.string : "";
1156                 nt_domain       = logon->network->identity_info.domain_name.string ?
1157                                   logon->network->identity_info.domain_name.string : "";
1158                 nt_workstation  = logon->network->identity_info.workstation.string ?
1159                                   logon->network->identity_info.workstation.string : "";
1160
1161                 DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
1162                 break;
1163         default:
1164                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1165                 return NT_STATUS_INVALID_INFO_CLASS;
1166         } /* end switch */
1167
1168         DEBUG(3,("User:[%s@%s] Requested Domain:[%s]\n", nt_username, nt_workstation, nt_domain));
1169         fstrcpy(current_user_info.smb_name, nt_username);
1170         sub_set_smb_name(nt_username);
1171
1172         DEBUG(5,("Attempting validation level %d for unmapped username %s.\n",
1173                 r->in.validation_level, nt_username));
1174
1175         status = NT_STATUS_OK;
1176
1177         switch (r->in.logon_level) {
1178         case NetlogonNetworkInformation:
1179         case NetlogonNetworkTransitiveInformation:
1180         {
1181                 const char *wksname = nt_workstation;
1182
1183                 status = make_auth_context_fixed(&auth_context,
1184                                                  logon->network->challenge);
1185                 if (!NT_STATUS_IS_OK(status)) {
1186                         return status;
1187                 }
1188
1189                 /* For a network logon, the workstation name comes in with two
1190                  * backslashes in the front. Strip them if they are there. */
1191
1192                 if (*wksname == '\\') wksname++;
1193                 if (*wksname == '\\') wksname++;
1194
1195                 /* Standard challenge/response authenticaion */
1196                 if (!make_user_info_netlogon_network(&user_info,
1197                                                      nt_username, nt_domain,
1198                                                      wksname,
1199                                                      logon->network->identity_info.parameter_control,
1200                                                      logon->network->lm.data,
1201                                                      logon->network->lm.length,
1202                                                      logon->network->nt.data,
1203                                                      logon->network->nt.length)) {
1204                         status = NT_STATUS_NO_MEMORY;
1205                 }
1206                 break;
1207         }
1208         case NetlogonInteractiveInformation:
1209         case NetlogonServiceInformation:
1210         case NetlogonInteractiveTransitiveInformation:
1211         case NetlogonServiceTransitiveInformation:
1212
1213                 /* 'Interactive' authentication, supplies the password in its
1214                    MD4 form, encrypted with the session key.  We will convert
1215                    this to challenge/response for the auth subsystem to chew
1216                    on */
1217         {
1218                 uint8_t chal[8];
1219
1220                 if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) {
1221                         return status;
1222                 }
1223
1224                 auth_context->get_ntlm_challenge(auth_context, chal);
1225
1226                 if (!make_user_info_netlogon_interactive(&user_info,
1227                                                          nt_username, nt_domain,
1228                                                          nt_workstation,
1229                                                          logon->password->identity_info.parameter_control,
1230                                                          chal,
1231                                                          logon->password->lmpassword.hash,
1232                                                          logon->password->ntpassword.hash,
1233                                                          creds->session_key)) {
1234                         status = NT_STATUS_NO_MEMORY;
1235                 }
1236                 break;
1237         }
1238         default:
1239                 DEBUG(2,("SAM Logon: unsupported switch value\n"));
1240                 return NT_STATUS_INVALID_INFO_CLASS;
1241         } /* end switch */
1242
1243         if ( NT_STATUS_IS_OK(status) ) {
1244                 status = auth_context->check_ntlm_password(auth_context,
1245                         user_info, &server_info);
1246         }
1247
1248         (auth_context->free)(&auth_context);
1249         free_user_info(&user_info);
1250
1251         DEBUG(5,("%s: check_password returned status %s\n",
1252                   fn, nt_errstr(status)));
1253
1254         /* Check account and password */
1255
1256         if (!NT_STATUS_IS_OK(status)) {
1257                 /* If we don't know what this domain is, we need to
1258                    indicate that we are not authoritative.  This
1259                    allows the client to decide if it needs to try
1260                    a local user.  Fix by jpjanosi@us.ibm.com, #2976 */
1261                 if ( NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
1262                      && !strequal(nt_domain, get_global_sam_name())
1263                      && !is_trusted_domain(nt_domain) )
1264                         *r->out.authoritative = false; /* We are not authoritative */
1265
1266                 TALLOC_FREE(server_info);
1267                 return status;
1268         }
1269
1270         if (server_info->guest) {
1271                 /* We don't like guest domain logons... */
1272                 DEBUG(5,("%s: Attempted domain logon as GUEST "
1273                          "denied.\n", fn));
1274                 TALLOC_FREE(server_info);
1275                 return NT_STATUS_LOGON_FAILURE;
1276         }
1277
1278         /* This is the point at which, if the login was successful, that
1279            the SAM Local Security Authority should record that the user is
1280            logged in to the domain.  */
1281
1282         if (process_creds) {
1283                 /* Get the pipe session key from the creds. */
1284                 memcpy(pipe_session_key, creds->session_key, 16);
1285         } else {
1286                 /* Get the pipe session key from the schannel. */
1287                 if ((p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL)
1288                     || (p->auth.a_u.schannel_auth == NULL)) {
1289                         return NT_STATUS_INVALID_HANDLE;
1290                 }
1291                 memcpy(pipe_session_key, p->auth.a_u.schannel_auth->creds->session_key, 16);
1292         }
1293
1294         switch (r->in.validation_level) {
1295         case 2:
1296                 status = serverinfo_to_SamInfo2(server_info, pipe_session_key, 16,
1297                                                 r->out.validation->sam2);
1298                 break;
1299         case 3:
1300                 status = serverinfo_to_SamInfo3(server_info, pipe_session_key, 16,
1301                                                 r->out.validation->sam3);
1302                 break;
1303         case 6:
1304                 status = serverinfo_to_SamInfo6(server_info, pipe_session_key, 16,
1305                                                 r->out.validation->sam6);
1306                 break;
1307         }
1308
1309         TALLOC_FREE(server_info);
1310
1311         return status;
1312 }
1313
1314 /****************************************************************
1315  _netr_LogonSamLogonWithFlags
1316 ****************************************************************/
1317
1318 NTSTATUS _netr_LogonSamLogonWithFlags(pipes_struct *p,
1319                                       struct netr_LogonSamLogonWithFlags *r)
1320 {
1321         NTSTATUS status;
1322         struct netlogon_creds_CredentialState *creds;
1323         struct netr_LogonSamLogonEx r2;
1324         struct netr_Authenticator return_authenticator;
1325
1326         become_root();
1327         status = netr_creds_server_step_check(p, p->mem_ctx,
1328                                               r->in.computer_name,
1329                                               r->in.credential,
1330                                               &return_authenticator,
1331                                               &creds);
1332         unbecome_root();
1333         if (!NT_STATUS_IS_OK(status)) {
1334                 return status;
1335         }
1336
1337         r2.in.server_name       = r->in.server_name;
1338         r2.in.computer_name     = r->in.computer_name;
1339         r2.in.logon_level       = r->in.logon_level;
1340         r2.in.logon             = r->in.logon;
1341         r2.in.validation_level  = r->in.validation_level;
1342         r2.in.flags             = r->in.flags;
1343         r2.out.validation       = r->out.validation;
1344         r2.out.authoritative    = r->out.authoritative;
1345         r2.out.flags            = r->out.flags;
1346
1347         status = _netr_LogonSamLogon_base(p, &r2, creds);
1348
1349         *r->out.return_authenticator = return_authenticator;
1350
1351         return status;
1352 }
1353
1354 /*************************************************************************
1355  _netr_LogonSamLogon
1356  *************************************************************************/
1357
1358 NTSTATUS _netr_LogonSamLogon(pipes_struct *p,
1359                              struct netr_LogonSamLogon *r)
1360 {
1361         NTSTATUS status;
1362         struct netr_LogonSamLogonWithFlags r2;
1363         uint32_t flags = 0;
1364
1365         r2.in.server_name               = r->in.server_name;
1366         r2.in.computer_name             = r->in.computer_name;
1367         r2.in.credential                = r->in.credential;
1368         r2.in.logon_level               = r->in.logon_level;
1369         r2.in.logon                     = r->in.logon;
1370         r2.in.validation_level          = r->in.validation_level;
1371         r2.in.return_authenticator      = r->in.return_authenticator;
1372         r2.in.flags                     = &flags;
1373         r2.out.validation               = r->out.validation;
1374         r2.out.authoritative            = r->out.authoritative;
1375         r2.out.flags                    = &flags;
1376         r2.out.return_authenticator     = r->out.return_authenticator;
1377
1378         status = _netr_LogonSamLogonWithFlags(p, &r2);
1379
1380         return status;
1381 }
1382
1383 /*************************************************************************
1384  _netr_LogonSamLogonEx
1385  - no credential chaining. Map into net sam logon.
1386  *************************************************************************/
1387
1388 NTSTATUS _netr_LogonSamLogonEx(pipes_struct *p,
1389                                struct netr_LogonSamLogonEx *r)
1390 {
1391         NTSTATUS status;
1392         struct netlogon_creds_CredentialState *creds = NULL;
1393
1394         become_root();
1395         status = schannel_get_creds_state(p->mem_ctx, lp_private_dir(),
1396                                           r->in.computer_name, &creds);
1397         unbecome_root();
1398         if (!NT_STATUS_IS_OK(status)) {
1399                 return status;
1400         }
1401
1402         /* Only allow this if the pipe is protected. */
1403         if (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) {
1404                 DEBUG(0,("_netr_LogonSamLogonEx: client %s not using schannel for netlogon\n",
1405                         get_remote_machine_name() ));
1406                 return NT_STATUS_INVALID_PARAMETER;
1407         }
1408
1409         status = _netr_LogonSamLogon_base(p, r, creds);
1410         TALLOC_FREE(creds);
1411
1412         return status;
1413 }
1414
1415 /*************************************************************************
1416  _ds_enum_dom_trusts
1417  *************************************************************************/
1418 #if 0   /* JERRY -- not correct */
1419  NTSTATUS _ds_enum_dom_trusts(pipes_struct *p, DS_Q_ENUM_DOM_TRUSTS *q_u,
1420                              DS_R_ENUM_DOM_TRUSTS *r_u)
1421 {
1422         NTSTATUS status = NT_STATUS_OK;
1423
1424         /* TODO: According to MSDN, the can only be executed against a
1425            DC or domain member running Windows 2000 or later.  Need
1426            to test against a standalone 2k server and see what it
1427            does.  A windows 2000 DC includes its own domain in the
1428            list.  --jerry */
1429
1430         return status;
1431 }
1432 #endif  /* JERRY */
1433
1434
1435 /****************************************************************
1436 ****************************************************************/
1437
1438 WERROR _netr_LogonUasLogon(pipes_struct *p,
1439                            struct netr_LogonUasLogon *r)
1440 {
1441         p->rng_fault_state = true;
1442         return WERR_NOT_SUPPORTED;
1443 }
1444
1445 /****************************************************************
1446 ****************************************************************/
1447
1448 WERROR _netr_LogonUasLogoff(pipes_struct *p,
1449                             struct netr_LogonUasLogoff *r)
1450 {
1451         p->rng_fault_state = true;
1452         return WERR_NOT_SUPPORTED;
1453 }
1454
1455 /****************************************************************
1456 ****************************************************************/
1457
1458 NTSTATUS _netr_DatabaseDeltas(pipes_struct *p,
1459                               struct netr_DatabaseDeltas *r)
1460 {
1461         p->rng_fault_state = true;
1462         return NT_STATUS_NOT_IMPLEMENTED;
1463 }
1464
1465 /****************************************************************
1466 ****************************************************************/
1467
1468 NTSTATUS _netr_DatabaseSync(pipes_struct *p,
1469                             struct netr_DatabaseSync *r)
1470 {
1471         p->rng_fault_state = true;
1472         return NT_STATUS_NOT_IMPLEMENTED;
1473 }
1474
1475 /****************************************************************
1476 ****************************************************************/
1477
1478 NTSTATUS _netr_AccountDeltas(pipes_struct *p,
1479                              struct netr_AccountDeltas *r)
1480 {
1481         p->rng_fault_state = true;
1482         return NT_STATUS_NOT_IMPLEMENTED;
1483 }
1484
1485 /****************************************************************
1486 ****************************************************************/
1487
1488 NTSTATUS _netr_AccountSync(pipes_struct *p,
1489                            struct netr_AccountSync *r)
1490 {
1491         p->rng_fault_state = true;
1492         return NT_STATUS_NOT_IMPLEMENTED;
1493 }
1494
1495 /****************************************************************
1496 ****************************************************************/
1497
1498 static bool wb_getdcname(TALLOC_CTX *mem_ctx,
1499                          const char *domain,
1500                          const char **dcname,
1501                          uint32_t flags,
1502                          WERROR *werr)
1503 {
1504         wbcErr result;
1505         struct wbcDomainControllerInfo *dc_info = NULL;
1506
1507         result = wbcLookupDomainController(domain,
1508                                            flags,
1509                                            &dc_info);
1510         switch (result) {
1511         case WBC_ERR_SUCCESS:
1512                 break;
1513         case WBC_ERR_WINBIND_NOT_AVAILABLE:
1514                 return false;
1515         case WBC_ERR_DOMAIN_NOT_FOUND:
1516                 *werr = WERR_NO_SUCH_DOMAIN;
1517                 return true;
1518         default:
1519                 *werr = WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1520                 return true;
1521         }
1522
1523         *dcname = talloc_strdup(mem_ctx, dc_info->dc_name);
1524         wbcFreeMemory(dc_info);
1525         if (!*dcname) {
1526                 *werr = WERR_NOMEM;
1527                 return false;
1528         }
1529
1530         *werr = WERR_OK;
1531
1532         return true;
1533 }
1534
1535 /****************************************************************
1536  _netr_GetDcName
1537 ****************************************************************/
1538
1539 WERROR _netr_GetDcName(pipes_struct *p,
1540                        struct netr_GetDcName *r)
1541 {
1542         NTSTATUS status;
1543         WERROR werr;
1544         uint32_t flags;
1545         struct netr_DsRGetDCNameInfo *info;
1546         bool ret;
1547
1548         ret = wb_getdcname(p->mem_ctx,
1549                            r->in.domainname,
1550                            r->out.dcname,
1551                            WBC_LOOKUP_DC_IS_FLAT_NAME |
1552                            WBC_LOOKUP_DC_RETURN_FLAT_NAME |
1553                            WBC_LOOKUP_DC_PDC_REQUIRED,
1554                            &werr);
1555         if (ret == true) {
1556                 return werr;
1557         }
1558
1559         flags = DS_PDC_REQUIRED | DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME;
1560
1561         status = dsgetdcname(p->mem_ctx,
1562                              smbd_messaging_context(),
1563                              r->in.domainname,
1564                              NULL,
1565                              NULL,
1566                              flags,
1567                              &info);
1568         if (!NT_STATUS_IS_OK(status)) {
1569                 return ntstatus_to_werror(status);
1570         }
1571
1572         *r->out.dcname = talloc_strdup(p->mem_ctx, info->dc_unc);
1573         talloc_free(info);
1574         if (!*r->out.dcname) {
1575                 return WERR_NOMEM;
1576         }
1577
1578         return WERR_OK;
1579 }
1580
1581 /****************************************************************
1582  _netr_GetAnyDCName
1583 ****************************************************************/
1584
1585 WERROR _netr_GetAnyDCName(pipes_struct *p,
1586                           struct netr_GetAnyDCName *r)
1587 {
1588         NTSTATUS status;
1589         WERROR werr;
1590         uint32_t flags;
1591         struct netr_DsRGetDCNameInfo *info;
1592         bool ret;
1593
1594         ret = wb_getdcname(p->mem_ctx,
1595                            r->in.domainname,
1596                            r->out.dcname,
1597                            WBC_LOOKUP_DC_IS_FLAT_NAME |
1598                            WBC_LOOKUP_DC_RETURN_FLAT_NAME,
1599                            &werr);
1600         if (ret == true) {
1601                 return werr;
1602         }
1603
1604         flags = DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME;
1605
1606         status = dsgetdcname(p->mem_ctx,
1607                              smbd_messaging_context(),
1608                              r->in.domainname,
1609                              NULL,
1610                              NULL,
1611                              flags,
1612                              &info);
1613         if (!NT_STATUS_IS_OK(status)) {
1614                 return ntstatus_to_werror(status);
1615         }
1616
1617         *r->out.dcname = talloc_strdup(p->mem_ctx, info->dc_unc);
1618         talloc_free(info);
1619         if (!*r->out.dcname) {
1620                 return WERR_NOMEM;
1621         }
1622
1623         return WERR_OK;
1624 }
1625
1626 /****************************************************************
1627 ****************************************************************/
1628
1629 NTSTATUS _netr_DatabaseSync2(pipes_struct *p,
1630                              struct netr_DatabaseSync2 *r)
1631 {
1632         p->rng_fault_state = true;
1633         return NT_STATUS_NOT_IMPLEMENTED;
1634 }
1635
1636 /****************************************************************
1637 ****************************************************************/
1638
1639 NTSTATUS _netr_DatabaseRedo(pipes_struct *p,
1640                             struct netr_DatabaseRedo *r)
1641 {
1642         p->rng_fault_state = true;
1643         return NT_STATUS_NOT_IMPLEMENTED;
1644 }
1645
1646 /****************************************************************
1647 ****************************************************************/
1648
1649 WERROR _netr_DsRGetDCName(pipes_struct *p,
1650                           struct netr_DsRGetDCName *r)
1651 {
1652         p->rng_fault_state = true;
1653         return WERR_NOT_SUPPORTED;
1654 }
1655
1656 /****************************************************************
1657 ****************************************************************/
1658
1659 NTSTATUS _netr_LogonGetCapabilities(pipes_struct *p,
1660                                     struct netr_LogonGetCapabilities *r)
1661 {
1662         return NT_STATUS_NOT_IMPLEMENTED;
1663 }
1664
1665 /****************************************************************
1666 ****************************************************************/
1667
1668 WERROR _netr_NETRLOGONSETSERVICEBITS(pipes_struct *p,
1669                                      struct netr_NETRLOGONSETSERVICEBITS *r)
1670 {
1671         p->rng_fault_state = true;
1672         return WERR_NOT_SUPPORTED;
1673 }
1674
1675 /****************************************************************
1676 ****************************************************************/
1677
1678 WERROR _netr_LogonGetTrustRid(pipes_struct *p,
1679                               struct netr_LogonGetTrustRid *r)
1680 {
1681         p->rng_fault_state = true;
1682         return WERR_NOT_SUPPORTED;
1683 }
1684
1685 /****************************************************************
1686 ****************************************************************/
1687
1688 WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST(pipes_struct *p,
1689                                           struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
1690 {
1691         p->rng_fault_state = true;
1692         return WERR_NOT_SUPPORTED;
1693 }
1694
1695 /****************************************************************
1696 ****************************************************************/
1697
1698 WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST(pipes_struct *p,
1699                                           struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
1700 {
1701         p->rng_fault_state = true;
1702         return WERR_NOT_SUPPORTED;
1703 }
1704
1705 /****************************************************************
1706 ****************************************************************/
1707
1708 WERROR _netr_DsRGetDCNameEx(pipes_struct *p,
1709                             struct netr_DsRGetDCNameEx *r)
1710 {
1711         p->rng_fault_state = true;
1712         return WERR_NOT_SUPPORTED;
1713 }
1714
1715 /****************************************************************
1716 ****************************************************************/
1717
1718 WERROR _netr_DsRGetSiteName(pipes_struct *p,
1719                             struct netr_DsRGetSiteName *r)
1720 {
1721         p->rng_fault_state = true;
1722         return WERR_NOT_SUPPORTED;
1723 }
1724
1725 /****************************************************************
1726 ****************************************************************/
1727
1728 NTSTATUS _netr_LogonGetDomainInfo(pipes_struct *p,
1729                                   struct netr_LogonGetDomainInfo *r)
1730 {
1731         p->rng_fault_state = true;
1732         return NT_STATUS_NOT_IMPLEMENTED;
1733 }
1734
1735 /****************************************************************
1736 ****************************************************************/
1737
1738 WERROR _netr_ServerPasswordGet(pipes_struct *p,
1739                                struct netr_ServerPasswordGet *r)
1740 {
1741         p->rng_fault_state = true;
1742         return WERR_NOT_SUPPORTED;
1743 }
1744
1745 /****************************************************************
1746 ****************************************************************/
1747
1748 WERROR _netr_NETRLOGONSENDTOSAM(pipes_struct *p,
1749                                 struct netr_NETRLOGONSENDTOSAM *r)
1750 {
1751         p->rng_fault_state = true;
1752         return WERR_NOT_SUPPORTED;
1753 }
1754
1755 /****************************************************************
1756 ****************************************************************/
1757
1758 WERROR _netr_DsRAddressToSitenamesW(pipes_struct *p,
1759                                     struct netr_DsRAddressToSitenamesW *r)
1760 {
1761         p->rng_fault_state = true;
1762         return WERR_NOT_SUPPORTED;
1763 }
1764
1765 /****************************************************************
1766 ****************************************************************/
1767
1768 WERROR _netr_DsRGetDCNameEx2(pipes_struct *p,
1769                              struct netr_DsRGetDCNameEx2 *r)
1770 {
1771         p->rng_fault_state = true;
1772         return WERR_NOT_SUPPORTED;
1773 }
1774
1775 /****************************************************************
1776 ****************************************************************/
1777
1778 WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN(pipes_struct *p,
1779                                                  struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
1780 {
1781         p->rng_fault_state = true;
1782         return WERR_NOT_SUPPORTED;
1783 }
1784
1785 /****************************************************************
1786 ****************************************************************/
1787
1788 WERROR _netr_NetrEnumerateTrustedDomainsEx(pipes_struct *p,
1789                                            struct netr_NetrEnumerateTrustedDomainsEx *r)
1790 {
1791         p->rng_fault_state = true;
1792         return WERR_NOT_SUPPORTED;
1793 }
1794
1795 /****************************************************************
1796 ****************************************************************/
1797
1798 WERROR _netr_DsRAddressToSitenamesExW(pipes_struct *p,
1799                                       struct netr_DsRAddressToSitenamesExW *r)
1800 {
1801         p->rng_fault_state = true;
1802         return WERR_NOT_SUPPORTED;
1803 }
1804
1805 /****************************************************************
1806 ****************************************************************/
1807
1808 WERROR _netr_DsrGetDcSiteCoverageW(pipes_struct *p,
1809                                    struct netr_DsrGetDcSiteCoverageW *r)
1810 {
1811         p->rng_fault_state = true;
1812         return WERR_NOT_SUPPORTED;
1813 }
1814
1815 /****************************************************************
1816 ****************************************************************/
1817
1818 WERROR _netr_DsrEnumerateDomainTrusts(pipes_struct *p,
1819                                       struct netr_DsrEnumerateDomainTrusts *r)
1820 {
1821         p->rng_fault_state = true;
1822         return WERR_NOT_SUPPORTED;
1823 }
1824
1825 /****************************************************************
1826 ****************************************************************/
1827
1828 WERROR _netr_DsrDeregisterDNSHostRecords(pipes_struct *p,
1829                                          struct netr_DsrDeregisterDNSHostRecords *r)
1830 {
1831         p->rng_fault_state = true;
1832         return WERR_NOT_SUPPORTED;
1833 }
1834
1835 /****************************************************************
1836 ****************************************************************/
1837
1838 NTSTATUS _netr_ServerTrustPasswordsGet(pipes_struct *p,
1839                                        struct netr_ServerTrustPasswordsGet *r)
1840 {
1841         p->rng_fault_state = true;
1842         return NT_STATUS_NOT_IMPLEMENTED;
1843 }
1844
1845 /****************************************************************
1846 ****************************************************************/
1847
1848 WERROR _netr_DsRGetForestTrustInformation(pipes_struct *p,
1849                                           struct netr_DsRGetForestTrustInformation *r)
1850 {
1851         p->rng_fault_state = true;
1852         return WERR_NOT_SUPPORTED;
1853 }
1854
1855 /****************************************************************
1856 ****************************************************************/
1857
1858 NTSTATUS _netr_GetForestTrustInformation(pipes_struct *p,
1859                                          struct netr_GetForestTrustInformation *r)
1860 {
1861         p->rng_fault_state = true;
1862         return NT_STATUS_NOT_IMPLEMENTED;
1863 }
1864
1865 /****************************************************************
1866 ****************************************************************/
1867
1868 NTSTATUS _netr_ServerGetTrustInfo(pipes_struct *p,
1869                                   struct netr_ServerGetTrustInfo *r)
1870 {
1871         p->rng_fault_state = true;
1872         return NT_STATUS_NOT_IMPLEMENTED;
1873 }
1874