summaryrefslogtreecommitdiff
path: root/source4/rpc_server/netlogon
diff options
context:
space:
mode:
Diffstat (limited to 'source4/rpc_server/netlogon')
-rw-r--r--source4/rpc_server/netlogon/dcerpc_netlogon.c172
-rw-r--r--source4/rpc_server/netlogon/schannel_state.c26
2 files changed, 189 insertions, 9 deletions
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 301f2ed041..8d7b97802f 100644
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -35,10 +35,72 @@ struct server_pipe_state {
struct creds_CredentialState *creds;
};
+
+/*
+ a client has connected to the netlogon server using schannel, so we need
+ to re-establish the credentials state
+*/
+static NTSTATUS netlogon_schannel_setup(struct dcesrv_call_state *dce_call)
+{
+ struct server_pipe_state *state;
+ NTSTATUS status;
+ TALLOC_CTX *mem_ctx;
+
+ mem_ctx = talloc_init("netlogon_bind");
+ if (!mem_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ state = talloc_p(mem_ctx, struct server_pipe_state);
+ if (state == NULL) {
+ talloc_destroy(mem_ctx);
+ }
+ ZERO_STRUCTP(state);
+ state->mem_ctx = mem_ctx;
+ state->authenticated = True;
+
+ state->creds = talloc_p(mem_ctx, struct creds_CredentialState);
+ if (state->creds == NULL) {
+ talloc_destroy(mem_ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+ ZERO_STRUCTP(state->creds);
+
+ if (dce_call->conn->auth_state.session_info == NULL) {
+ talloc_destroy(mem_ctx);
+ return NT_STATUS_NO_USER_SESSION_KEY;
+ }
+
+ status = schannel_fetch_session_key(mem_ctx,
+ dce_call->conn->auth_state.session_info->workstation,
+ state->creds);
+ if (!NT_STATUS_IS_OK(status)) {
+ talloc_destroy(mem_ctx);
+ return status;
+ }
+
+ dce_call->conn->private = state;
+
+ return NT_STATUS_OK;
+}
+
+/*
+ a hook for bind on the netlogon pipe
+*/
static NTSTATUS netlogon_bind(struct dcesrv_call_state *dce_call, const struct dcesrv_interface *di)
{
dce_call->conn->private = NULL;
+ /* if this is a schannel bind then we need to reconstruct the pipe state */
+ if (dce_call->conn->auth_state.auth_info &&
+ dce_call->conn->auth_state.auth_info->auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
+ NTSTATUS status;
+
+ status = netlogon_schannel_setup(dce_call);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ }
+
return NT_STATUS_OK;
}
@@ -861,13 +923,115 @@ static WERROR netr_DSRGETSITENAME(struct dcesrv_call_state *dce_call, TALLOC_CTX
}
+/*
+ fill in a netr_DomainTrustInfo from a ldb search result
+*/
+static NTSTATUS fill_domain_trust_info(TALLOC_CTX *mem_ctx, struct ldb_message *res,
+ struct netr_DomainTrustInfo *info)
+{
+ ZERO_STRUCTP(info);
+
+ info->domainname.string = samdb_result_string(res, "flatName", NULL);
+ if (info->domainname.string == NULL) {
+ info->domainname.string = samdb_result_string(res, "name", NULL);
+ info->fulldomainname.string = samdb_result_string(res, "dnsDomain", NULL);
+ } else {
+ info->fulldomainname.string = samdb_result_string(res, "name", NULL);
+ }
+
+ /* TODO: we need proper forest support */
+ info->forest.string = info->fulldomainname.string;
+
+ info->guid = samdb_result_guid(res, "objectGUID");
+ info->sid = samdb_result_dom_sid(mem_ctx, res, "objectSid");
+
+ return NT_STATUS_OK;
+}
+
/*
- netr_NETRLOGONGETDOMAININFO
+ netr_LogonGetDomainInfo
+ this is called as part of the ADS domain logon procedure.
*/
-static WERROR netr_NETRLOGONGETDOMAININFO(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
- struct netr_NETRLOGONGETDOMAININFO *r)
+static NTSTATUS netr_LogonGetDomainInfo(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+ struct netr_LogonGetDomainInfo *r)
{
- DCESRV_FAULT(DCERPC_FAULT_OP_RNG_ERROR);
+ struct server_pipe_state *pipe_state = dce_call->conn->private;
+ const char * const attrs[] = { "name", "dnsDomain", "objectSid",
+ "objectGUID", "flatName", NULL };
+ void *sam_ctx;
+ struct ldb_message **res1, **res2;
+ struct netr_DomainInfo1 *info1;
+ int ret1, ret2, i;
+ NTSTATUS status;
+
+ if (!pipe_state) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ if (!netr_creds_server_step_check(pipe_state,
+ r->in.credential, r->out.credential)) {
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ sam_ctx = samdb_connect();
+ if (sam_ctx == NULL) {
+ return NT_STATUS_INVALID_SYSTEM_SERVICE;
+ }
+
+ /* we need to do two searches. The first will pull our primary
+ domain and the second will pull any trusted domains. Our
+ primary domain is also a "trusted" domain, so we need to
+ put the primary domain into the lists of returned trusts as
+ well */
+ ret1 = samdb_search(sam_ctx, mem_ctx, NULL, &res1, attrs, "(objectClass=domainDNS)");
+ if (ret1 != 1) {
+ samdb_close(sam_ctx);
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+
+ ret2 = samdb_search(sam_ctx, mem_ctx, NULL, &res2, attrs, "(objectClass=trustedDomain)");
+ if (ret2 == -1) {
+ samdb_close(sam_ctx);
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+
+ /* we don't need the db link any more */
+ samdb_close(sam_ctx);
+
+ info1 = talloc_p(mem_ctx, struct netr_DomainInfo1);
+ if (info1 == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ ZERO_STRUCTP(info1);
+
+ info1->num_trusts = ret2 + 1;
+ info1->trusts = talloc_array_p(mem_ctx, struct netr_DomainTrustInfo,
+ info1->num_trusts);
+ if (info1->trusts == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ status = fill_domain_trust_info(mem_ctx, res1[0], &info1->domaininfo);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = fill_domain_trust_info(mem_ctx, res1[0], &info1->trusts[0]);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ for (i=0;i<ret2;i++) {
+ status = fill_domain_trust_info(mem_ctx, res2[i], &info1->trusts[i+1]);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ }
+
+ r->out.info.info1 = info1;
+
+ return NT_STATUS_OK;
}
diff --git a/source4/rpc_server/netlogon/schannel_state.c b/source4/rpc_server/netlogon/schannel_state.c
index eaa5013572..43134fd437 100644
--- a/source4/rpc_server/netlogon/schannel_state.c
+++ b/source4/rpc_server/netlogon/schannel_state.c
@@ -53,11 +53,12 @@ static struct ldb_context *schannel_db_connect(TALLOC_CTX *mem_ctx)
use a simple ldb structure
*/
NTSTATUS schannel_store_session_key(TALLOC_CTX *mem_ctx,
- const char *computer_name, struct creds_CredentialState *creds)
+ const char *computer_name,
+ struct creds_CredentialState *creds)
{
struct ldb_context *ldb;
struct ldb_message msg;
- struct ldb_val val;
+ struct ldb_val val, seed;
char *s = NULL;
time_t expiry = time(NULL) + SCHANNEL_CREDENTIALS_EXPIRY;
int ret;
@@ -85,7 +86,11 @@ NTSTATUS schannel_store_session_key(TALLOC_CTX *mem_ctx,
val.data = creds->session_key;
val.length = sizeof(creds->session_key);
+ seed.data = creds->seed.data;
+ seed.length = sizeof(creds->seed.data);
+
ldb_msg_add_value(ldb, &msg, "sessionKey", &val);
+ ldb_msg_add_value(ldb, &msg, "seed", &seed);
ldb_msg_add_string(ldb, &msg, "expiry", s);
ldb_delete(ldb, msg.dn);
@@ -104,10 +109,11 @@ NTSTATUS schannel_store_session_key(TALLOC_CTX *mem_ctx,
/*
- read back a session key for a computer
+ read back a credentials back for a computer
*/
NTSTATUS schannel_fetch_session_key(TALLOC_CTX *mem_ctx,
- const char *computer_name, uint8_t session_key[16])
+ const char *computer_name,
+ struct creds_CredentialState *creds)
{
struct ldb_context *ldb;
time_t expiry;
@@ -116,6 +122,8 @@ NTSTATUS schannel_fetch_session_key(TALLOC_CTX *mem_ctx,
const struct ldb_val *val;
char *expr=NULL;
+ ZERO_STRUCTP(creds);
+
ldb = schannel_db_connect(mem_ctx);
if (ldb == NULL) {
return NT_STATUS_NO_MEMORY;
@@ -146,7 +154,15 @@ NTSTATUS schannel_fetch_session_key(TALLOC_CTX *mem_ctx,
return NT_STATUS_INVALID_HANDLE;
}
- memcpy(session_key, val->data, 16);
+ memcpy(creds->session_key, val->data, 16);
+
+ val = ldb_msg_find_ldb_val(res[0], "seed");
+ if (val == NULL || val->length != 8) {
+ ldb_close(ldb);
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ memcpy(creds->seed.data, val->data, 8);
ldb_close(ldb);