Changeset 745 for trunk/server/source3/auth/auth_netlogond.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/auth/auth_netlogond.c (modified) (11 diffs)

trunk/server/source3/auth/auth_netlogond.c

@@ -19 +19 @@
 
 #include "includes.h"
+#include "auth.h"
 #include "../libcli/auth/libcli_auth.h"
+#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/gen_ndr/ndr_schannel.h"
+#include "rpc_client/cli_pipe.h"
+#include "rpc_client/cli_netlogon.h"
+#include "secrets.h"
+#include "tldap.h"
+#include "tldap_util.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
+
+static bool secrets_store_local_schannel_creds(
+        const struct netlogon_creds_CredentialState *creds)
+{
+        DATA_BLOB blob;
+        enum ndr_err_code ndr_err;
+        bool ret;
+
+        ndr_err = ndr_push_struct_blob(
+                &blob, talloc_tos(), creds,
+                (ndr_push_flags_fn_t)ndr_push_netlogon_creds_CredentialState);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                DEBUG(10, ("ndr_push_netlogon_creds_CredentialState failed: "
+                           "%s\n", ndr_errstr(ndr_err)));
+                return false;
+        }
+        ret = secrets_store(SECRETS_LOCAL_SCHANNEL_KEY,
+                            blob.data, blob.length);
+        data_blob_free(&blob);
+        return ret;
+}
+
+static struct netlogon_creds_CredentialState *
+secrets_fetch_local_schannel_creds(TALLOC_CTX *mem_ctx)
+{
+        struct netlogon_creds_CredentialState *creds;
+        enum ndr_err_code ndr_err;
+        DATA_BLOB blob;
+
+        blob.data = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY,
+                                             &blob.length);
+        if (blob.data == NULL) {
+                DEBUG(10, ("secrets_fetch failed\n"));
+                return NULL;
+        }
+
+        creds = talloc(mem_ctx, struct netlogon_creds_CredentialState);
+        if (creds == NULL) {
+                DEBUG(10, ("talloc failed\n"));
+                SAFE_FREE(blob.data);
+                return NULL;
+        }
+        ndr_err = ndr_pull_struct_blob(
+                &blob, creds, creds,
+                (ndr_pull_flags_fn_t)ndr_pull_netlogon_creds_CredentialState);
+        SAFE_FREE(blob.data);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                DEBUG(10, ("ndr_pull_netlogon_creds_CredentialState failed: "
+                           "%s\n", ndr_errstr(ndr_err)));
+                TALLOC_FREE(creds);
+                return NULL;
+        }
+
+        return creds;
+}
 
 static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
                                    const struct auth_context *auth_context,
                                    const char *ncalrpc_sockname,
-                                   uint8_t schannel_key[16],
-                                   const auth_usersupplied_info *user_info,
+                                   struct netlogon_creds_CredentialState *creds,
+                                   const struct auth_usersupplied_info *user_info,
                                    struct netr_SamInfo3 **pinfo3,
                                    NTSTATUS *schannel_bind_result)
 {
         struct rpc_pipe_client *p = NULL;
-        struct cli_pipe_auth_data *auth = NULL;
+        struct pipe_auth_data *auth = NULL;
         struct netr_SamInfo3 *info3 = NULL;
         NTSTATUS status;
@@ -47 +110 @@
         }
 
-        /*
-         * We have to fake a struct dcinfo, so that
-         * rpccli_netlogon_sam_network_logon_ex can decrypt the session keys.
-         */
-
-        p->dc = netlogon_creds_client_init_session_key(p, schannel_key);
-        if (p->dc == NULL) {
-                DEBUG(0, ("talloc failed\n"));
-                TALLOC_FREE(p);
-                return NT_STATUS_NO_MEMORY;
-        }
+        p->dc = creds;
 
         status = rpccli_schannel_bind_data(p, lp_workgroup(),
@@ -79 +132 @@
         status = rpccli_netlogon_sam_network_logon_ex(
                 p, p,
-                user_info->logon_parameters,/* flags such as 'allow
-                                             * workstation logon' */
-                global_myname(),            /* server name */
-                user_info->smb_name,        /* user name logging on. */
-                user_info->client_domain,   /* domain name */
-                user_info->wksta_name,      /* workstation name */
+                user_info->logon_parameters,           /* flags such as 'allow
+                                                        * workstation logon' */
+                global_myname(),                       /* server name */
+                user_info->client.account_name,        /* user name logging on. */
+                user_info->client.domain_name,         /* domain name */
+                user_info->workstation_name,           /* workstation name */
                 (uchar *)auth_context->challenge.data, /* 8 byte challenge. */
-                3,                          /* validation level */
-                user_info->lm_resp,         /* lanman 24 byte response */
-                user_info->nt_resp,         /* nt 24 byte response */
-                &info3);                    /* info3 out */
+                3,                                     /* validation level */
+                user_info->password.response.lanman,   /* lanman 24 byte response */
+                user_info->password.response.nt,       /* nt 24 byte response */
+                &info3);                               /* info3 out */
 
         DEBUG(10, ("rpccli_netlogon_sam_network_logon_ex returned %s\n",
@@ -105 +158 @@
 }
 
-static char *mymachinepw(TALLOC_CTX *mem_ctx)
-{
-        fstring pwd;
-        const char *script;
-        char *to_free = NULL;
-        ssize_t nread;
-        int ret, fd;
-
-        script = lp_parm_const_string(
-                GLOBAL_SECTION_SNUM, "auth_netlogond", "machinepwscript",
-                NULL);
-
-        if (script == NULL) {
-                to_free = talloc_asprintf(talloc_tos(), "%s/%s",
-                                          get_dyn_SBINDIR(), "mymachinepw");
-                script = to_free;
-        }
-        if (script == NULL) {
-                return NULL;
-        }
-
-        ret = smbrun(script, &fd);
-        DEBUG(ret ? 0 : 3, ("mymachinepw: Running the command `%s' gave %d\n",
-                            script, ret));
-        TALLOC_FREE(to_free);
-
-        if (ret != 0) {
-                return NULL;
-        }
-
-        nread = read(fd, pwd, sizeof(pwd)-1);
-        close(fd);
-
-        if (nread <= 0) {
-                DEBUG(3, ("mymachinepwd: Could not read password\n"));
-                return NULL;
-        }
-
-        pwd[nread] = '\0';
-
-        if (pwd[nread-1] == '\n') {
-                pwd[nread-1] = '\0';
-        }
-
-        return talloc_strdup(mem_ctx, pwd);
+static NTSTATUS get_ldapi_ctx(TALLOC_CTX *mem_ctx, struct tldap_context **pld)
+{
+        struct tldap_context *ld;
+        struct sockaddr_un addr;
+        char *sockaddr;
+        int fd;
+        NTSTATUS status;
+        int res;
+
+        sockaddr = talloc_asprintf(talloc_tos(), "/%s/ldap_priv/ldapi",
+                                   lp_private_dir());
+        if (sockaddr == NULL) {
+                DEBUG(10, ("talloc failed\n"));
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ZERO_STRUCT(addr);
+        addr.sun_family = AF_UNIX;
+        strncpy(addr.sun_path, sockaddr, sizeof(addr.sun_path));
+        TALLOC_FREE(sockaddr);
+
+        status = open_socket_out((struct sockaddr_storage *)(void *)&addr,
+                                 0, 0, &fd);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("Could not connect to %s: %s\n", addr.sun_path,
+                           nt_errstr(status)));
+                return status;
+        }
+        set_blocking(fd, false);
+
+        ld = tldap_context_create(mem_ctx, fd);
+        if (ld == NULL) {
+                close(fd);
+                return NT_STATUS_NO_MEMORY;
+        }
+        res = tldap_fetch_rootdse(ld);
+        if (res != TLDAP_SUCCESS) {
+                DEBUG(10, ("tldap_fetch_rootdse failed: %s\n",
+                           tldap_errstr(talloc_tos(), ld, res)));
+                TALLOC_FREE(ld);
+                return NT_STATUS_LDAP(res);
+        }
+        *pld = ld;
+        return NT_STATUS_OK;;
+}
+
+static NTSTATUS mymachinepw(uint8_t pwd[16])
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct tldap_context *ld = NULL;
+        struct tldap_message *rootdse, **msg;
+        const char *attrs[1] = { "unicodePwd" };
+        char *default_nc, *myname;
+        int rc, num_msg;
+        DATA_BLOB pwdblob;
+        NTSTATUS status;
+
+        status = get_ldapi_ctx(talloc_tos(), &ld);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto fail;
+        }
+        rootdse = tldap_rootdse(ld);
+        if (rootdse == NULL) {
+                DEBUG(10, ("Could not get rootdse\n"));
+                status = NT_STATUS_INTERNAL_ERROR;
+                goto fail;
+        }
+        default_nc = tldap_talloc_single_attribute(
+                rootdse, "defaultNamingContext", talloc_tos());
+        if (default_nc == NULL) {
+                DEBUG(10, ("Could not get defaultNamingContext\n"));
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+        DEBUG(10, ("default_nc = %s\n", default_nc));
+
+        myname = talloc_asprintf_strupper_m(talloc_tos(), "%s$",
+                                            global_myname());
+        if (myname == NULL) {
+                DEBUG(10, ("talloc failed\n"));
+                status = NT_STATUS_NO_MEMORY;
+                goto fail;
+        }
+
+        rc = tldap_search_fmt(
+                ld, default_nc, TLDAP_SCOPE_SUB, attrs, ARRAY_SIZE(attrs), 0,
+                talloc_tos(), &msg,
+                "(&(sAMAccountName=%s)(objectClass=computer))", myname);
+        if (rc != TLDAP_SUCCESS) {
+                DEBUG(10, ("Could not retrieve our account: %s\n",
+                           tldap_errstr(talloc_tos(), ld, rc)));
+                status = NT_STATUS_LDAP(rc);
+                goto fail;
+        }
+        num_msg = talloc_array_length(msg);
+        if (num_msg != 1) {
+                DEBUG(10, ("Got %d accounts, expected one\n", num_msg));
+                status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                goto fail;
+        }
+        if (!tldap_get_single_valueblob(msg[0], "unicodePwd", &pwdblob)) {
+                char *dn = NULL;
+                tldap_entry_dn(msg[0], &dn);
+                DEBUG(10, ("No unicodePwd attribute in %s\n",
+                           dn ? dn : "<unknown DN>"));
+                status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                goto fail;
+        }
+        if (pwdblob.length != 16) {
+                DEBUG(10, ("Password hash hash has length %d, expected 16\n",
+                           (int)pwdblob.length));
+                status = NT_STATUS_INTERNAL_DB_CORRUPTION;
+                goto fail;
+        }
+        memcpy(pwd, pwdblob.data, 16);
+
+fail:
+        TALLOC_FREE(frame);
+        return status;
 }
 
@@ -155 +282 @@
                                          void *my_private_data,
                                          TALLOC_CTX *mem_ctx,
-                                         const auth_usersupplied_info *user_info,
-                                         auth_serversupplied_info **server_info)
+                                         const struct auth_usersupplied_info *user_info,
+                                         struct auth_serversupplied_info **server_info)
 {
         TALLOC_CTX *frame = talloc_stackframe();
         struct netr_SamInfo3 *info3 = NULL;
         struct rpc_pipe_client *p = NULL;
-        struct cli_pipe_auth_data *auth = NULL;
+        struct pipe_auth_data *auth = NULL;
         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
-        char *plaintext_machinepw = NULL;
         uint8_t machine_password[16];
-        uint8_t schannel_key[16];
+        struct netlogon_creds_CredentialState *creds;
         NTSTATUS schannel_bind_result, status;
         struct named_mutex *mutex = NULL;
         const char *ncalrpcsock;
 
+        DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
+
         ncalrpcsock = lp_parm_const_string(
                 GLOBAL_SECTION_SNUM, "auth_netlogond", "socket", NULL);
@@ -183 +311 @@
         }
 
-        if (!secrets_fetch_local_schannel_key(schannel_key)) {
+        creds = secrets_fetch_local_schannel_creds(talloc_tos());
+        if (creds == NULL) {
                 goto new_key;
         }
 
         status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
-                                    schannel_key, user_info, &info3,
+                                    creds, user_info, &info3,
                                     &schannel_bind_result);
 
@@ -237 +366 @@
         }
 
-        plaintext_machinepw = mymachinepw(talloc_tos());
-        if (plaintext_machinepw == NULL) {
-                status = NT_STATUS_NO_MEMORY;
-                goto done;
-        }
-
-        E_md4hash(plaintext_machinepw, machine_password);
-
-        TALLOC_FREE(plaintext_machinepw);
+        status = mymachinepw(machine_password);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("mymachinepw failed: %s\n", nt_errstr(status)));
+                goto done;
+        }
+
+        DEBUG(10, ("machinepw "));
+        dump_data(10, machine_password, 16);
 
         status = rpccli_netlogon_setup_creds(
@@ -257 +385 @@
         }
 
-        memcpy(schannel_key, p->dc->session_key, 16);
-        secrets_store_local_schannel_key(schannel_key);
-
-        TALLOC_FREE(p);
+        secrets_store_local_schannel_creds(p->dc);
 
         /*
@@ -268 +393 @@
 
         status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
-                                    schannel_key, user_info, &info3,
+                                    p->dc, user_info, &info3,
                                     &schannel_bind_result);
 
+        TALLOC_FREE(p);
+
         DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));
 
@@ -279 +406 @@
  okay:
 
-        status = make_server_info_info3(mem_ctx, user_info->smb_name,
-                                        user_info->domain, server_info,
+        status = make_server_info_info3(mem_ctx, user_info->client.account_name,
+                                        user_info->mapped.domain_name, server_info,
                                         info3);
         if (!NT_STATUS_IS_OK(status)) {
@@ -301 +428 @@
                                     auth_methods **auth_method)
 {
-        if (!make_auth_methods(auth_context, auth_method)) {
+        struct auth_methods *result;
+
+        result = TALLOC_ZERO_P(auth_context, struct auth_methods);
+        if (result == NULL) {
                 return NT_STATUS_NO_MEMORY;
         }
-
-        (*auth_method)->name = "netlogond";
-        (*auth_method)->auth = check_netlogond_security;
+        result->name = "netlogond";
+        result->auth = check_netlogond_security;
+
+        *auth_method = result;
         return NT_STATUS_OK;
 }