s3:rpc_server: add support for AES bases netlogon schannel

[metze/samba/wip.git] / source3 / rpc_server / srv_netlog_nt.c

diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c
index 1982da4f2d0f9a06b2baa1180ea47e39ca1e7d6b..c84f3121a402182c84a573e11a22e94b44352231 100644 (file)
--- a/source3/rpc_server/srv_netlog_nt.c
+++ b/source3/rpc_server/srv_netlog_nt.c
@@ -460,6 +460,10 @@ NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
                srv_flgs |= NETLOGON_NEG_STRONG_KEYS;
        }
 
+       if (in_neg_flags & NETLOGON_NEG_SUPPORTS_AES) {
+               srv_flgs |= NETLOGON_NEG_SUPPORTS_AES;
+       }
+
        if (lp_server_schannel() != false) {
                srv_flgs |= NETLOGON_NEG_SCHANNEL;
        }
@@ -523,7 +527,7 @@ NTSTATUS _netr_ServerAuthenticate3(pipes_struct *p,
                                           &mach_pwd,
                                           r->in.credentials,
                                           r->out.return_credentials,
-                                          *r->in.negotiate_flags);
+                                          srv_flgs);
        if (!creds) {
                DEBUG(0,("%s: netlogon_creds_server_check failed. Rejecting auth "
                        "request from client %s machine account %s\n",
@@ -910,6 +914,12 @@ static NTSTATUS _netr_LogonSamLogon_base(pipes_struct *p,
                        return NT_STATUS_NO_MEMORY;
                }
                break;
+       case 6:
+               r->out.validation->sam6 = TALLOC_ZERO_P(p->mem_ctx, struct netr_SamInfo6);
+               if (!r->out.validation->sam6) {
+                       return NT_STATUS_NO_MEMORY;
+               }
+               break;
        default:
                DEBUG(0,("%s: bad validation_level value %d.\n",
                        fn, (int)r->in.validation_level));
@@ -1075,6 +1085,10 @@ static NTSTATUS _netr_LogonSamLogon_base(pipes_struct *p,
                status = serverinfo_to_SamInfo3(server_info, pipe_session_key, 16,
                                                r->out.validation->sam3);
                break;
+       case 6:
+               status = serverinfo_to_SamInfo6(server_info, pipe_session_key, 16,
+                                               r->out.validation->sam6);
+               break;
        }
 
        TALLOC_FREE(server_info);
@@ -1318,7 +1332,27 @@ WERROR _netr_DsRGetDCName(pipes_struct *p,
 NTSTATUS _netr_LogonGetCapabilities(pipes_struct *p,
                                    struct netr_LogonGetCapabilities *r)
 {
-       return NT_STATUS_NOT_IMPLEMENTED;
+       struct netlogon_creds_CredentialState *creds;
+       NTSTATUS status;
+
+       become_root();
+       status = netr_creds_server_step_check(p, p->mem_ctx,
+                                             r->in.computer_name,
+                                             r->in.credential,
+                                             r->out.return_authenticator,
+                                             &creds);
+       unbecome_root();
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
+       if (r->in.query_level != 1) {
+               return NT_STATUS_NOT_SUPPORTED;
+       }
+
+       r->out.capabilities->server_capabilities = creds->negotiate_flags;
+
+       return NT_STATUS_OK;
 }
 
 /****************************************************************