From 5539d3d5a8d270a86c749d4ec5a5ceefa228b339 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Sat, 18 Feb 2006 00:39:31 +0000 Subject: r13556: Ensure that any potential creds operation are protected by schannel if "server schannel = true" was set. Jeremy. (This used to be commit fd84d9703ed01feb010df4ebb7e9ceb0d063780b) --- source3/rpc_server/srv_netlog_nt.c | 45 ++++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 14 deletions(-) (limited to 'source3/rpc_server') diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c index 1813fd6c1e..2b0d870812 100644 --- a/source3/rpc_server/srv_netlog_nt.c +++ b/source3/rpc_server/srv_netlog_nt.c @@ -474,6 +474,15 @@ NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET * rpcstr_pull(workstation,q_u->clnt_id.login.uni_comp_name.buffer, sizeof(workstation),q_u->clnt_id.login.uni_comp_name.uni_str_len*2,0); + if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) { + /* 'server schannel = yes' should enforce use of + schannel, the client did offer it in auth2, but + obviously did not use it. */ + DEBUG(0,("_net_srv_pwset: client %s not using schannel for netlogon\n", + get_remote_machine_name() )); + return NT_STATUS_ACCESS_DENIED; + } + if (!p->dc) { /* Restore the saved state of the netlogon creds. */ become_root(); @@ -579,6 +588,16 @@ NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET * NTSTATUS _net_sam_logoff(pipes_struct *p, NET_Q_SAM_LOGOFF *q_u, NET_R_SAM_LOGOFF *r_u) { + if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) { + /* 'server schannel = yes' should enforce use of + schannel, the client did offer it in auth2, but + obviously did not use it. */ + DEBUG(0,("_net_sam_logoff: client %s not using schannel for netlogon\n", + get_remote_machine_name() )); + return NT_STATUS_ACCESS_DENIED; + } + + if (!get_valid_user_struct(p->vuid)) return NT_STATUS_NO_SUCH_USER; @@ -671,10 +690,20 @@ static NTSTATUS _net_sam_logon_internal(pipes_struct *p, auth_serversupplied_info *server_info = NULL; SAM_ACCOUNT *sampw; struct auth_context *auth_context = NULL; - + + if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) { + /* 'server schannel = yes' should enforce use of + schannel, the client did offer it in auth2, but + obviously did not use it. */ + DEBUG(0,("_net_sam_logon_internal: client %s not using schannel for netlogon\n", + get_remote_machine_name() )); + return NT_STATUS_ACCESS_DENIED; + } + usr_info = TALLOC_P(p->mem_ctx, NET_USER_INFO_3); - if (!usr_info) + if (!usr_info) { return NT_STATUS_NO_MEMORY; + } ZERO_STRUCTP(usr_info); @@ -710,18 +739,7 @@ static NTSTATUS _net_sam_logon_internal(pipes_struct *p, if (!p->dc || !p->dc->authenticated) { return NT_STATUS_INVALID_HANDLE; } - } - - if ( (lp_server_schannel() == True) && (p->auth.auth_type != PIPE_AUTH_TYPE_SCHANNEL) ) { - /* 'server schannel = yes' should enforce use of - schannel, the client did offer it in auth2, but - obviously did not use it. */ - DEBUG(0,("_net_sam_logon: client %s not using schannel for netlogon\n", - get_remote_machine_name() )); - return NT_STATUS_ACCESS_DENIED; - } - if (process_creds) { /* checks and updates credentials. creates reply credentials */ if (!creds_server_step(p->dc, &q_u->sam_id.client.cred, &r_u->srv_creds)) { DEBUG(2,("_net_sam_logon: creds_server_step failed. Rejecting auth " @@ -738,7 +756,6 @@ static NTSTATUS _net_sam_logon_internal(pipes_struct *p, unbecome_root(); } - switch (q_u->sam_id.logon_level) { case INTERACTIVE_LOGON_TYPE: uni_samlogon_user = &ctr->auth.id1.uni_user_name; -- cgit