source: vendor/3.5.0/source3/auth/auth_netlogond.c

Last change on this file was 414, checked in by Herwig Bauernfeind, 15 years ago

Samba 3.5.0: Initial import
File size: 8.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Authenticate against a netlogon pipe listening on a unix domain socket
4 Copyright (C) Volker Lendecke 2008
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18*/
19
20#include "includes.h"
21#include "../libcli/auth/libcli_auth.h"
22
23#undef DBGC_CLASS
24#define DBGC_CLASS DBGC_AUTH
25
26static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
27 const struct auth_context *auth_context,
28 const char *ncalrpc_sockname,
29 uint8_t schannel_key[16],
30 const auth_usersupplied_info *user_info,
31 struct netr_SamInfo3 **pinfo3,
32 NTSTATUS *schannel_bind_result)
33{
34 struct rpc_pipe_client *p = NULL;
35 struct cli_pipe_auth_data *auth = NULL;
36 struct netr_SamInfo3 *info3 = NULL;
37 NTSTATUS status;
38
39 *schannel_bind_result = NT_STATUS_OK;
40
41 status = rpc_pipe_open_ncalrpc(talloc_tos(), ncalrpc_sockname,
42 &ndr_table_netlogon.syntax_id, &p);
43 if (!NT_STATUS_IS_OK(status)) {
44 DEBUG(10, ("rpc_pipe_open_ncalrpc failed: %s\n",
45 nt_errstr(status)));
46 return status;
47 }
48
49 /*
50 * We have to fake a struct dcinfo, so that
51 * rpccli_netlogon_sam_network_logon_ex can decrypt the session keys.
52 */
53
54 p->dc = netlogon_creds_client_init_session_key(p, schannel_key);
55 if (p->dc == NULL) {
56 DEBUG(0, ("talloc failed\n"));
57 TALLOC_FREE(p);
58 return NT_STATUS_NO_MEMORY;
59 }
60
61 status = rpccli_schannel_bind_data(p, lp_workgroup(),
62 DCERPC_AUTH_LEVEL_PRIVACY,
63 p->dc, &auth);
64 if (!NT_STATUS_IS_OK(status)) {
65 DEBUG(10, ("rpccli_schannel_bind_data failed: %s\n",
66 nt_errstr(status)));
67 TALLOC_FREE(p);
68 return status;
69 }
70
71 status = rpc_pipe_bind(p, auth);
72 if (!NT_STATUS_IS_OK(status)) {
73 DEBUG(10, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
74 TALLOC_FREE(p);
75 *schannel_bind_result = status;
76 return status;
77 }
78
79 status = rpccli_netlogon_sam_network_logon_ex(
80 p, p,
81 user_info->logon_parameters,/* flags such as 'allow
82 * workstation logon' */
83 global_myname(), /* server name */
84 user_info->smb_name, /* user name logging on. */
85 user_info->client_domain, /* domain name */
86 user_info->wksta_name, /* workstation name */
87 (uchar *)auth_context->challenge.data, /* 8 byte challenge. */
88 user_info->lm_resp, /* lanman 24 byte response */
89 user_info->nt_resp, /* nt 24 byte response */
90 &info3); /* info3 out */
91
92 DEBUG(10, ("rpccli_netlogon_sam_network_logon_ex returned %s\n",
93 nt_errstr(status)));
94
95 if (!NT_STATUS_IS_OK(status)) {
96 TALLOC_FREE(p);
97 return status;
98 }
99
100 *pinfo3 = talloc_move(mem_ctx, &info3);
101
102 TALLOC_FREE(p);
103 return NT_STATUS_OK;
104}
105
106static char *mymachinepw(TALLOC_CTX *mem_ctx)
107{
108 fstring pwd;
109 const char *script;
110 char *to_free = NULL;
111 ssize_t nread;
112 int ret, fd;
113
114 script = lp_parm_const_string(
115 GLOBAL_SECTION_SNUM, "auth_netlogond", "machinepwscript",
116 NULL);
117
118 if (script == NULL) {
119 to_free = talloc_asprintf(talloc_tos(), "%s/%s",
120 get_dyn_SBINDIR(), "mymachinepw");
121 script = to_free;
122 }
123 if (script == NULL) {
124 return NULL;
125 }
126
127 ret = smbrun(script, &fd);
128 DEBUG(ret ? 0 : 3, ("mymachinepw: Running the command `%s' gave %d\n",
129 script, ret));
130 TALLOC_FREE(to_free);
131
132 if (ret != 0) {
133 return NULL;
134 }
135
136 nread = read(fd, pwd, sizeof(pwd)-1);
137 close(fd);
138
139 if (nread <= 0) {
140 DEBUG(3, ("mymachinepwd: Could not read password\n"));
141 return NULL;
142 }
143
144 pwd[nread] = '\0';
145
146 if (pwd[nread-1] == '\n') {
147 pwd[nread-1] = '\0';
148 }
149
150 return talloc_strdup(mem_ctx, pwd);
151}
152
153static NTSTATUS check_netlogond_security(const struct auth_context *auth_context,
154 void *my_private_data,
155 TALLOC_CTX *mem_ctx,
156 const auth_usersupplied_info *user_info,
157 auth_serversupplied_info **server_info)
158{
159 TALLOC_CTX *frame = talloc_stackframe();
160 struct netr_SamInfo3 *info3 = NULL;
161 struct rpc_pipe_client *p = NULL;
162 struct cli_pipe_auth_data *auth = NULL;
163 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
164 char *plaintext_machinepw = NULL;
165 uint8_t machine_password[16];
166 uint8_t schannel_key[16];
167 NTSTATUS schannel_bind_result, status;
168 struct named_mutex *mutex = NULL;
169 const char *ncalrpcsock;
170
171 ncalrpcsock = lp_parm_const_string(
172 GLOBAL_SECTION_SNUM, "auth_netlogond", "socket", NULL);
173
174 if (ncalrpcsock == NULL) {
175 ncalrpcsock = talloc_asprintf(talloc_tos(), "%s/%s",
176 get_dyn_NCALRPCDIR(), "DEFAULT");
177 }
178
179 if (ncalrpcsock == NULL) {
180 status = NT_STATUS_NO_MEMORY;
181 goto done;
182 }
183
184 if (!secrets_fetch_local_schannel_key(schannel_key)) {
185 goto new_key;
186 }
187
188 status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
189 schannel_key, user_info, &info3,
190 &schannel_bind_result);
191
192 DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
193
194 if (NT_STATUS_IS_OK(status)) {
195 goto okay;
196 }
197
198 if (NT_STATUS_IS_OK(schannel_bind_result)) {
199 /*
200 * This is a real failure from the DC
201 */
202 goto done;
203 }
204
205 new_key:
206
207 mutex = grab_named_mutex(talloc_tos(), "LOCAL_SCHANNEL_KEY", 60);
208 if (mutex == NULL) {
209 DEBUG(10, ("Could not get mutex LOCAL_SCHANNEL_KEY\n"));
210 status = NT_STATUS_ACCESS_DENIED;
211 goto done;
212 }
213
214 DEBUG(10, ("schannel bind failed, setting up new key\n"));
215
216 status = rpc_pipe_open_ncalrpc(talloc_tos(), ncalrpcsock,
217 &ndr_table_netlogon.syntax_id, &p);
218
219 if (!NT_STATUS_IS_OK(status)) {
220 DEBUG(10, ("rpc_pipe_open_ncalrpc failed: %s\n",
221 nt_errstr(status)));
222 goto done;
223 }
224
225 status = rpccli_anon_bind_data(p, &auth);
226 if (!NT_STATUS_IS_OK(status)) {
227 DEBUG(10, ("rpccli_anon_bind_data failed: %s\n",
228 nt_errstr(status)));
229 goto done;
230 }
231
232 status = rpc_pipe_bind(p, auth);
233 if (!NT_STATUS_IS_OK(status)) {
234 DEBUG(10, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
235 goto done;
236 }
237
238 plaintext_machinepw = mymachinepw(talloc_tos());
239 if (plaintext_machinepw == NULL) {
240 status = NT_STATUS_NO_MEMORY;
241 goto done;
242 }
243
244 E_md4hash(plaintext_machinepw, machine_password);
245
246 TALLOC_FREE(plaintext_machinepw);
247
248 status = rpccli_netlogon_setup_creds(
249 p, global_myname(), lp_workgroup(), global_myname(),
250 global_myname(), machine_password, SEC_CHAN_BDC, &neg_flags);
251
252 if (!NT_STATUS_IS_OK(status)) {
253 DEBUG(10, ("rpccli_netlogon_setup_creds failed: %s\n",
254 nt_errstr(status)));
255 goto done;
256 }
257
258 memcpy(schannel_key, p->dc->session_key, 16);
259 secrets_store_local_schannel_key(schannel_key);
260
261 TALLOC_FREE(p);
262
263 /*
264 * Retry the authentication with the mutex held. This way nobody else
265 * can step on our toes.
266 */
267
268 status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
269 schannel_key, user_info, &info3,
270 &schannel_bind_result);
271
272 DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
273
274 if (!NT_STATUS_IS_OK(status)) {
275 goto done;
276 }
277
278 okay:
279
280 status = make_server_info_info3(mem_ctx, user_info->smb_name,
281 user_info->domain, server_info,
282 info3);
283 if (!NT_STATUS_IS_OK(status)) {
284 DEBUG(10, ("make_server_info_info3 failed: %s\n",
285 nt_errstr(status)));
286 TALLOC_FREE(frame);
287 return status;
288 }
289
290 status = NT_STATUS_OK;
291
292 done:
293 TALLOC_FREE(frame);
294 return status;
295}
296
297/* module initialisation */
298static NTSTATUS auth_init_netlogond(struct auth_context *auth_context,
299 const char *param,
300 auth_methods **auth_method)
301{
302 if (!make_auth_methods(auth_context, auth_method)) {
303 return NT_STATUS_NO_MEMORY;
304 }
305
306 (*auth_method)->name = "netlogond";
307 (*auth_method)->auth = check_netlogond_security;
308 return NT_STATUS_OK;
309}
310
311NTSTATUS auth_netlogond_init(void)
312{
313 smb_register_auth(AUTH_INTERFACE_VERSION, "netlogond",
314 auth_init_netlogond);
315 return NT_STATUS_OK;
316}
Note: See TracBrowser for help on using the repository browser.