Rework the CLDAP and NBT netlogon requests and responses.

This now matches section 7.3.3 of the MS-ATDS specification, and all
our current tests pass against windows.  There is still more testing
to do, and the server implementation to complete.

Andrew Bartlett
(This used to be commit 431d0c03965cbee85691cd0dc1e2a509c1a2b717)

6 files changed, 39 insertions, 187 deletions

diff --git a/source4/libcli/cldap/cldap.c b/source4/libcli/cldap/cldap.c
index 614bd51d2a..3867f3d3fd 100644
--- a/source4/libcli/cldap/cldap.c
+++ b/source4/libcli/cldap/cldap.c
@@ -595,7 +595,6 @@ NTSTATUS cldap_netlogon_recv(struct cldap_request *req,
 			     struct cldap_netlogon *io)
 {
 	NTSTATUS status;
-	enum ndr_err_code ndr_err;
 	struct cldap_search search;
 	struct cldap_socket *cldap;
 	DATA_BLOB *data;
@@ -618,18 +617,15 @@ NTSTATUS cldap_netlogon_recv(struct cldap_request *req,
 	}
 	data = search.out.response->attributes[0].values;
 
-	ndr_err = ndr_pull_union_blob_all(data, mem_ctx, 
-					  cldap->iconv_convenience,
-					  &io->out.netlogon,
-					  io->in.version & 0xF,
-					  (ndr_pull_flags_fn_t)ndr_pull_nbt_cldap_netlogon);
-	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-		DEBUG(2,("cldap failed to parse netlogon response of type 0x%02x\n",
-			 SVAL(data->data, 0)));
-		dump_data(10, data->data, data->length);
-		return ndr_map_error2ntstatus(ndr_err);
+	status = pull_netlogon_samlogon_response(data, mem_ctx, req->cldap->iconv_convenience,
+						 &io->out.netlogon);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+	
+	if (io->in.map_response) {
+		map_netlogon_samlogon_response(&io->out.netlogon);
 	}
-
 	return NT_STATUS_OK;
 }
 
@@ -704,25 +700,20 @@ NTSTATUS cldap_netlogon_reply(struct cldap_socket *cldap,
 			      uint32_t message_id,
 			      struct socket_address *src,
 			      uint32_t version,
-			      union nbt_cldap_netlogon *netlogon)
+			      struct netlogon_samlogon_response *netlogon)
 {
 	NTSTATUS status;
-	enum ndr_err_code ndr_err;
 	struct cldap_reply reply;
 	struct ldap_SearchResEntry response;
 	struct ldap_Result result;
 	TALLOC_CTX *tmp_ctx = talloc_new(cldap);
 	DATA_BLOB blob;
 
-	ndr_err = ndr_push_union_blob(&blob, tmp_ctx, 
-				      cldap->iconv_convenience,
-				      netlogon, version & 0xF,
-				     (ndr_push_flags_fn_t)ndr_push_nbt_cldap_netlogon);
-	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-		talloc_free(tmp_ctx);
-		return ndr_map_error2ntstatus(ndr_err);
-	}
+	status = push_netlogon_samlogon_response(&blob, tmp_ctx, cldap->iconv_convenience,
+						 netlogon);
+	if (!NT_STATUS_IS_OK(status)) {
 
+	}
 	reply.messageid    = message_id;
 	reply.dest         = src;
 	reply.response     = &response;
diff --git a/source4/libcli/cldap/cldap.h b/source4/libcli/cldap/cldap.h
index eb0191d0f4..7c2daf0ca2 100644
--- a/source4/libcli/cldap/cldap.h
+++ b/source4/libcli/cldap/cldap.h
@@ -20,7 +20,7 @@
 */
 
 #include "lib/util/asn1.h"
-#include "librpc/gen_ndr/nbt.h"
+#include "libcli/netlogon.h"
 
 struct ldap_message;
 
@@ -161,9 +161,10 @@ struct cldap_netlogon {
 		const char *domain_sid;
 		int acct_control;
 		uint32_t version;
+		bool map_response;
 	} in;
 	struct {
-		union nbt_cldap_netlogon netlogon;
+		struct netlogon_samlogon_response netlogon;
 	} out;
 };
 
@@ -178,4 +179,4 @@ NTSTATUS cldap_netlogon_reply(struct cldap_socket *cldap,
 			      uint32_t message_id,
 			      struct socket_address *src,
 			      uint32_t version,
-			      union nbt_cldap_netlogon *netlogon);
+			      struct netlogon_samlogon_response *netlogon);
diff --git a/source4/libcli/config.mk b/source4/libcli/config.mk
index 95b45003be..08c08043a6 100644
--- a/source4/libcli/config.mk
+++ b/source4/libcli/config.mk
@@ -53,6 +53,14 @@ LIBCLI_NBT_OBJ_FILES = $(addprefix libcli/nbt/, \
 	namerefresh.o \
 	namerelease.o)
 
+[SUBSYSTEM::LIBCLI_NETLOGON]
+PRIVATE_PROTO_HEADER = netlogon_proto.h
+PUBLIC_DEPENDENCIES = LIBNDR NDR_NBT  \
+	NDR_SECURITY LIBSAMBA-UTIL
+
+LIBCLI_NETLOGON_OBJ_FILES = $(addprefix libcli/, \
+	netlogon.o)
+
 [PYTHON::python_libcli_nbt]
 SWIG_FILE = swig/libcli_nbt.i
 PUBLIC_DEPENDENCIES = LIBCLI_NBT DYNCONFIG LIBSAMBA-HOSTCONFIG
@@ -66,18 +74,17 @@ PUBLIC_DEPENDENCIES = LIBCLI_SMB DYNCONFIG LIBSAMBA-HOSTCONFIG
 python_libcli_smb_OBJ_FILES = libcli/swig/libcli_smb_wrap.o
 
 [SUBSYSTEM::LIBCLI_DGRAM]
-PUBLIC_DEPENDENCIES = LIBCLI_NBT LIBNDR LIBCLI_RESOLVE
+PUBLIC_DEPENDENCIES = LIBCLI_NBT LIBNDR LIBCLI_RESOLVE LIBCLI_NETLOGON
 
 LIBCLI_DGRAM_OBJ_FILES = $(addprefix libcli/dgram/, \
 	dgramsocket.o \
 	mailslot.o \
 	netlogon.o \
-	ntlogon.o \
 	browse.o)
 
 [SUBSYSTEM::LIBCLI_CLDAP]
 PUBLIC_DEPENDENCIES = LIBCLI_LDAP
-PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBLDB
+PRIVATE_DEPENDENCIES = LIBSAMBA-UTIL LIBLDB LIBCLI_NETLOGON
 
 LIBCLI_CLDAP_OBJ_FILES = libcli/cldap/cldap.o
 # PUBLIC_HEADERS += libcli/cldap/cldap.h
diff --git a/source4/libcli/dgram/libdgram.h b/source4/libcli/dgram/libdgram.h
index 707cca8cc5..3eac78f5e8 100644
--- a/source4/libcli/dgram/libdgram.h
+++ b/source4/libcli/dgram/libdgram.h
@@ -19,7 +19,7 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#include "librpc/gen_ndr/nbt.h"
+#include "libcli/netlogon.h"
 
 /*
   a datagram name request
@@ -121,6 +121,7 @@ NTSTATUS dgram_mailslot_send(struct nbt_dgram_socket *dgmsock,
 NTSTATUS dgram_mailslot_netlogon_send(struct nbt_dgram_socket *dgmsock,
 				      struct nbt_name *dest_name,
 				      struct socket_address *dest,
+				      const char *mailslot_name,
 				      struct nbt_name *src_name,
 				      struct nbt_netlogon_packet *request);
 NTSTATUS dgram_mailslot_netlogon_reply(struct nbt_dgram_socket *dgmsock,
@@ -131,23 +132,7 @@ NTSTATUS dgram_mailslot_netlogon_reply(struct nbt_dgram_socket *dgmsock,
 NTSTATUS dgram_mailslot_netlogon_parse(struct dgram_mailslot_handler *dgmslot,
 				       TALLOC_CTX *mem_ctx,
 				       struct nbt_dgram_packet *dgram,
-				       struct nbt_netlogon_packet *netlogon);
-
-NTSTATUS dgram_mailslot_ntlogon_send(struct nbt_dgram_socket *dgmsock,
-				     enum dgram_msg_type msg_type,
-				     struct nbt_name *dest_name,
-				     struct socket_address *dest,
-				     struct nbt_name *src_name,
-				     struct nbt_ntlogon_packet *request);
-NTSTATUS dgram_mailslot_ntlogon_reply(struct nbt_dgram_socket *dgmsock,
-				       struct nbt_dgram_packet *request,
-				       const char *my_netbios_name,
-				       const char *mailslot_name,
-				       struct nbt_ntlogon_packet *reply);
-NTSTATUS dgram_mailslot_ntlogon_parse(struct dgram_mailslot_handler *dgmslot,
-				       TALLOC_CTX *mem_ctx,
-				       struct nbt_dgram_packet *dgram,
-				       struct nbt_ntlogon_packet *ntlogon);
+				       struct nbt_netlogon_response *netlogon);
 
 NTSTATUS dgram_mailslot_browse_send(struct nbt_dgram_socket *dgmsock,
 				    struct nbt_name *dest_name,
diff --git a/source4/libcli/dgram/netlogon.c b/source4/libcli/dgram/netlogon.c
index 5c7dedc7bb..c097127083 100644
--- a/source4/libcli/dgram/netlogon.c
+++ b/source4/libcli/dgram/netlogon.c
@@ -32,6 +32,7 @@
 NTSTATUS dgram_mailslot_netlogon_send(struct nbt_dgram_socket *dgmsock,
 				      struct nbt_name *dest_name,
 				      struct socket_address *dest,
+				      const char *mailslot,
 				      struct nbt_name *src_name,
 				      struct nbt_netlogon_packet *request)
 {
@@ -51,7 +52,7 @@ NTSTATUS dgram_mailslot_netlogon_send(struct nbt_dgram_socket *dgmsock,
 
 
 	status = dgram_mailslot_send(dgmsock, DGRAM_DIRECT_UNIQUE, 
-				     NBT_MAILSLOT_NETLOGON,
+				     mailslot,
 				     dest_name, dest, 
 				     src_name, &blob);
 	talloc_free(tmp_ctx);
@@ -109,21 +110,16 @@ NTSTATUS dgram_mailslot_netlogon_reply(struct nbt_dgram_socket *dgmsock,
 NTSTATUS dgram_mailslot_netlogon_parse(struct dgram_mailslot_handler *dgmslot,
 				       TALLOC_CTX *mem_ctx,
 				       struct nbt_dgram_packet *dgram,
-				       struct nbt_netlogon_packet *netlogon)
+				       struct nbt_netlogon_response *netlogon)
 {
+	NTSTATUS status;
 	DATA_BLOB data = dgram_mailslot_data(dgram);
-	enum ndr_err_code ndr_err;
-
-	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, dgmslot->dgmsock->iconv_convenience, netlogon,
-				      (ndr_pull_flags_fn_t)ndr_pull_nbt_netlogon_packet);
-	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
-		DEBUG(0,("Failed to parse netlogon packet of length %d: %s\n",
-			 (int)data.length, nt_errstr(status)));
-		if (DEBUGLVL(10)) {
-			file_save("netlogon.dat", data.data, data.length);
-		}
+	
+	status = pull_nbt_netlogon_response(&data, mem_ctx, dgmslot->dgmsock->iconv_convenience, netlogon);
+	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
+	
 	return NT_STATUS_OK;
 }
+
diff --git a/source4/libcli/dgram/ntlogon.c b/source4/libcli/dgram/ntlogon.c
deleted file mode 100644
index 7b26ed7c00..0000000000
--- a/source4/libcli/dgram/ntlogon.c
+++ /dev/null
@@ -1,128 +0,0 @@
-/* 
-   Unix SMB/CIFS implementation.
-
-   handling for ntlogon dgram requests
-
-   Copyright (C) Andrew Tridgell 2005
-   
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 3 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-#include "includes.h"
-#include "libcli/dgram/libdgram.h"
-#include "lib/socket/socket.h"
-#include "libcli/resolve/resolve.h"
-#include "librpc/gen_ndr/ndr_nbt.h"
-#include "param/param.h"
-
-/* 
-   send a ntlogon mailslot request 
-*/
-NTSTATUS dgram_mailslot_ntlogon_send(struct nbt_dgram_socket *dgmsock,
-				     enum dgram_msg_type msg_type,
-				     struct nbt_name *dest_name,
-				     struct socket_address *dest,
-				     struct nbt_name *src_name,
-				     struct nbt_ntlogon_packet *request)
-{
-	NTSTATUS status;
-	enum ndr_err_code ndr_err;
-	DATA_BLOB blob;
-	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
-
-	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, dgmsock->iconv_convenience, 
-				       request,
-				      (ndr_push_flags_fn_t)ndr_push_nbt_ntlogon_packet);
-	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-		talloc_free(tmp_ctx);
-		return ndr_map_error2ntstatus(ndr_err);
-	}
-
-
-	status = dgram_mailslot_send(dgmsock, msg_type,
-				     NBT_MAILSLOT_NTLOGON,
-				     dest_name, dest, 
-				     src_name, &blob);
-	talloc_free(tmp_ctx);
-	return status;
-}
-
-
-/* 
-   send a ntlogon mailslot reply
-*/
-NTSTATUS dgram_mailslot_ntlogon_reply(struct nbt_dgram_socket *dgmsock,
-				      struct nbt_dgram_packet *request,
-				      const char *my_netbios_name,
-				      const char *mailslot_name,
-				      struct nbt_ntlogon_packet *reply)
-{
-	NTSTATUS status;
-	enum ndr_err_code ndr_err;
-	DATA_BLOB blob;
-	TALLOC_CTX *tmp_ctx = talloc_new(dgmsock);
-	struct nbt_name myname;
-	struct socket_address *dest;
-
-	ndr_err = ndr_push_struct_blob(&blob, tmp_ctx, dgmsock->iconv_convenience, reply,
-				      (ndr_push_flags_fn_t)ndr_push_nbt_ntlogon_packet);
-	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-		talloc_free(tmp_ctx);
-		return ndr_map_error2ntstatus(ndr_err);
-	}
-
-	make_nbt_name_client(&myname, my_netbios_name);
-
-	dest = socket_address_from_strings(tmp_ctx, 
-					   dgmsock->sock->backend_name, 
-					   request->src_addr, request->src_port);
-	if (!dest) {
-		talloc_free(tmp_ctx);
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	status = dgram_mailslot_send(dgmsock, DGRAM_DIRECT_UNIQUE, 
-				     mailslot_name,
-				     &request->data.msg.source_name,
-				     dest,
-				     &myname, &blob);
-	talloc_free(tmp_ctx);
-	return status;
-}
-
-
-/*
-  parse a ntlogon response. The packet must be a valid mailslot packet
-*/
-NTSTATUS dgram_mailslot_ntlogon_parse(struct dgram_mailslot_handler *dgmslot,
-				      TALLOC_CTX *mem_ctx,
-				      struct nbt_dgram_packet *dgram,
-				      struct nbt_ntlogon_packet *ntlogon)
-{
-	DATA_BLOB data = dgram_mailslot_data(dgram);
-	enum ndr_err_code ndr_err;
-
-	ndr_err = ndr_pull_struct_blob(&data, mem_ctx, dgmslot->dgmsock->iconv_convenience, ntlogon,
-				      (ndr_pull_flags_fn_t)ndr_pull_nbt_ntlogon_packet);
-	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-		NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
-		DEBUG(0,("Failed to parse ntlogon packet of length %d: %s\n",
-			 (int)data.length, nt_errstr(status)));
-		if (DEBUGLVL(10)) {
-			file_save("ntlogon.dat", data.data, data.length);
-		}
-		return status;
-	}
-	return NT_STATUS_OK;
-}