2008-02-13 14:24:56 +03:00
/*
2002-01-30 09:08:46 +03:00
* Unix SMB / CIFS implementation .
2001-02-27 03:32:11 +03:00
* RPC Pipe client / server routines
* Copyright ( C ) Andrew Tridgell 1992 - 1997 ,
* Copyright ( C ) Luke Kenneth Casson Leighton 1996 - 1997 ,
* Copyright ( C ) Paul Ashton 1997.
* Copyright ( C ) Jeremy Allison 1998 - 2001.
2003-07-23 10:11:38 +04:00
* Copyright ( C ) Andrew Bartlett 2001.
2009-09-30 15:40:17 +04:00
* Copyright ( C ) Guenther Deschner 2008 - 2009.
2001-02-27 03:32:11 +03:00
*
* This program is free software ; you can redistribute it and / or modify
* it under the terms of the GNU General Public License as published by
2007-07-09 23:25:36 +04:00
* the Free Software Foundation ; either version 3 of the License , or
2001-02-27 03:32:11 +03:00
* ( at your option ) any later version .
2008-02-13 14:24:56 +03:00
*
2001-02-27 03:32:11 +03:00
* This program is distributed in the hope that it will be useful ,
* but WITHOUT ANY WARRANTY ; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
* GNU General Public License for more details .
2008-02-13 14:24:56 +03:00
*
2001-02-27 03:32:11 +03:00
* You should have received a copy of the GNU General Public License
2007-07-10 09:23:25 +04:00
* along with this program ; if not , see < http : //www.gnu.org/licenses/>.
2001-02-27 03:32:11 +03:00
*/
/* This is the implementation of the netlogon pipe. */
# include "includes.h"
2009-09-16 02:26:17 +04:00
# include "../libcli/auth/schannel.h"
2009-11-26 20:21:28 +03:00
# include "../librpc/gen_ndr/srv_netlogon.h"
2001-02-27 03:32:11 +03:00
2005-04-06 20:28:04 +04:00
extern userdom_struct current_user_info ;
2002-07-15 14:35:28 +04:00
# undef DBGC_CLASS
# define DBGC_CLASS DBGC_RPC_SRV
2009-08-26 00:38:55 +04:00
struct netlogon_server_pipe_state {
struct netr_Credential client_challenge ;
struct netr_Credential server_challenge ;
} ;
2001-05-24 12:05:12 +04:00
/*************************************************************************
2008-02-13 13:56:24 +03:00
_netr_LogonControl
2001-05-24 12:05:12 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-02-13 13:56:24 +03:00
WERROR _netr_LogonControl ( pipes_struct * p ,
struct netr_LogonControl * r )
2001-05-24 12:05:12 +04:00
{
2008-12-13 02:55:04 +03:00
struct netr_LogonControl2Ex l ;
2001-05-24 12:05:12 +04:00
2008-02-13 13:56:24 +03:00
switch ( r - > in . level ) {
2008-12-13 02:55:04 +03:00
case 1 :
break ;
case 2 :
return WERR_NOT_SUPPORTED ;
default :
return WERR_UNKNOWN_LEVEL ;
2008-02-13 13:56:24 +03:00
}
2008-12-13 02:55:04 +03:00
l . in . logon_server = r - > in . logon_server ;
l . in . function_code = r - > in . function_code ;
l . in . level = r - > in . level ;
l . in . data = NULL ;
2009-06-18 09:00:28 +04:00
l . out . query = r - > out . query ;
2008-12-13 02:55:04 +03:00
return _netr_LogonControl2Ex ( p , & l ) ;
2001-05-24 12:05:12 +04:00
}
2001-08-28 10:34:08 +04:00
/****************************************************************************
Send a message to smbd to do a sam synchronisation
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2005-09-30 21:13:37 +04:00
2001-09-06 09:24:37 +04:00
static void send_sync_message ( void )
2001-08-28 10:34:08 +04:00
{
DEBUG ( 3 , ( " sending sam synchronisation message \n " ) ) ;
2007-05-15 19:49:55 +04:00
message_send_all ( smbd_messaging_context ( ) , MSG_SMB_SAM_SYNC , NULL , 0 ,
2007-05-22 02:17:13 +04:00
NULL ) ;
2001-08-28 10:34:08 +04:00
}
2001-02-27 03:32:11 +03:00
/*************************************************************************
2008-02-14 01:06:09 +03:00
_netr_LogonControl2
2001-02-27 03:32:11 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-02-14 01:06:09 +03:00
WERROR _netr_LogonControl2 ( pipes_struct * p ,
struct netr_LogonControl2 * r )
2008-12-13 02:55:04 +03:00
{
struct netr_LogonControl2Ex l ;
l . in . logon_server = r - > in . logon_server ;
l . in . function_code = r - > in . function_code ;
l . in . level = r - > in . level ;
l . in . data = r - > in . data ;
l . out . query = r - > out . query ;
return _netr_LogonControl2Ex ( p , & l ) ;
}
2009-10-08 02:38:53 +04:00
/*************************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static bool wb_change_trust_creds ( const char * domain , WERROR * tc_status )
{
wbcErr result ;
struct wbcAuthErrorInfo * error = NULL ;
result = wbcChangeTrustCredentials ( domain , & error ) ;
switch ( result ) {
case WBC_ERR_WINBIND_NOT_AVAILABLE :
return false ;
case WBC_ERR_DOMAIN_NOT_FOUND :
* tc_status = WERR_NO_SUCH_DOMAIN ;
return true ;
case WBC_ERR_SUCCESS :
* tc_status = WERR_OK ;
return true ;
default :
break ;
}
if ( error & & error - > nt_status ! = 0 ) {
* tc_status = ntstatus_to_werror ( NT_STATUS ( error - > nt_status ) ) ;
} else {
* tc_status = WERR_TRUST_FAILURE ;
}
wbcFreeMemory ( error ) ;
return true ;
}
2009-10-19 13:28:00 +04:00
/*************************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static bool wb_check_trust_creds ( const char * domain , WERROR * tc_status )
{
wbcErr result ;
struct wbcAuthErrorInfo * error = NULL ;
result = wbcCheckTrustCredentials ( domain , & error ) ;
switch ( result ) {
case WBC_ERR_WINBIND_NOT_AVAILABLE :
return false ;
case WBC_ERR_DOMAIN_NOT_FOUND :
* tc_status = WERR_NO_SUCH_DOMAIN ;
return true ;
case WBC_ERR_SUCCESS :
* tc_status = WERR_OK ;
return true ;
default :
break ;
}
if ( error & & error - > nt_status ! = 0 ) {
* tc_status = ntstatus_to_werror ( NT_STATUS ( error - > nt_status ) ) ;
} else {
* tc_status = WERR_TRUST_FAILURE ;
}
wbcFreeMemory ( error ) ;
return true ;
}
2008-12-13 02:55:04 +03:00
/****************************************************************
_netr_LogonControl2Ex
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_LogonControl2Ex ( pipes_struct * p ,
struct netr_LogonControl2Ex * r )
2001-02-27 03:32:11 +03:00
{
2009-09-02 17:29:44 +04:00
uint32_t flags = 0x0 ;
WERROR pdc_connection_status = WERR_OK ;
uint32_t logon_attempts = 0x0 ;
WERROR tc_status ;
2008-03-26 21:18:08 +03:00
fstring dc_name2 ;
const char * dc_name = NULL ;
2007-10-25 01:16:54 +04:00
struct sockaddr_storage dc_ss ;
2008-02-14 01:06:09 +03:00
const char * domain = NULL ;
struct netr_NETLOGON_INFO_1 * info1 ;
struct netr_NETLOGON_INFO_2 * info2 ;
struct netr_NETLOGON_INFO_3 * info3 ;
2009-10-08 02:58:02 +04:00
struct netr_NETLOGON_INFO_4 * info4 ;
2009-02-13 18:56:52 +03:00
const char * fn ;
2009-11-09 19:34:47 +03:00
uint32_t acct_ctrl ;
2009-02-13 18:56:52 +03:00
switch ( p - > hdr_req . opnum ) {
2009-10-06 19:50:15 +04:00
case NDR_NETR_LOGONCONTROL :
fn = " _netr_LogonControl " ;
break ;
case NDR_NETR_LOGONCONTROL2 :
fn = " _netr_LogonControl2 " ;
break ;
case NDR_NETR_LOGONCONTROL2EX :
fn = " _netr_LogonControl2Ex " ;
break ;
default :
return WERR_INVALID_PARAM ;
2009-02-13 18:56:52 +03:00
}
2008-02-13 14:24:56 +03:00
2009-11-09 19:34:47 +03:00
acct_ctrl = pdb_get_acct_ctrl ( p - > server_info - > sam_account ) ;
2009-11-04 02:34:29 +03:00
switch ( r - > in . function_code ) {
case NETLOGON_CONTROL_TC_VERIFY :
case NETLOGON_CONTROL_CHANGE_PASSWORD :
case NETLOGON_CONTROL_REDISCOVER :
2009-11-09 19:34:47 +03:00
if ( ( geteuid ( ) ! = sec_initial_uid ( ) ) & &
! nt_token_check_domain_rid ( p - > server_info - > ptok , DOMAIN_RID_ADMINS ) & &
! nt_token_check_sid ( & global_sid_Builtin_Administrators , p - > server_info - > ptok ) & &
! ( acct_ctrl & ( ACB_WSTRUST | ACB_SVRTRUST ) ) ) {
2009-11-04 02:34:29 +03:00
return WERR_ACCESS_DENIED ;
}
break ;
default :
break ;
}
2009-09-02 17:29:44 +04:00
tc_status = WERR_NO_SUCH_DOMAIN ;
2008-02-13 14:24:56 +03:00
2008-02-14 01:06:09 +03:00
switch ( r - > in . function_code ) {
2009-10-19 13:28:00 +04:00
case NETLOGON_CONTROL_QUERY :
tc_status = WERR_OK ;
break ;
case NETLOGON_CONTROL_REPLICATE :
case NETLOGON_CONTROL_SYNCHRONIZE :
case NETLOGON_CONTROL_PDC_REPLICATE :
case NETLOGON_CONTROL_BACKUP_CHANGE_LOG :
case NETLOGON_CONTROL_BREAKPOINT :
2009-11-09 19:34:47 +03:00
if ( acct_ctrl & ACB_NORMAL ) {
return WERR_NOT_SUPPORTED ;
} else if ( acct_ctrl & ( ACB_WSTRUST | ACB_SVRTRUST ) ) {
return WERR_ACCESS_DENIED ;
} else {
return WERR_ACCESS_DENIED ;
}
case NETLOGON_CONTROL_TRUNCATE_LOG :
if ( acct_ctrl & ACB_NORMAL ) {
break ;
} else if ( acct_ctrl & ( ACB_WSTRUST | ACB_SVRTRUST ) ) {
return WERR_ACCESS_DENIED ;
} else {
return WERR_ACCESS_DENIED ;
}
2009-10-19 13:28:00 +04:00
case NETLOGON_CONTROL_TRANSPORT_NOTIFY :
case NETLOGON_CONTROL_FORCE_DNS_REG :
case NETLOGON_CONTROL_QUERY_DNS_REG :
return WERR_NOT_SUPPORTED ;
case NETLOGON_CONTROL_FIND_USER :
if ( ! r - > in . data | | ! r - > in . data - > user ) {
return WERR_NOT_SUPPORTED ;
}
break ;
case NETLOGON_CONTROL_SET_DBFLAG :
if ( ! r - > in . data ) {
return WERR_NOT_SUPPORTED ;
}
break ;
case NETLOGON_CONTROL_TC_VERIFY :
if ( ! r - > in . data | | ! r - > in . data - > domain ) {
return WERR_NOT_SUPPORTED ;
}
if ( ! wb_check_trust_creds ( r - > in . data - > domain , & tc_status ) ) {
return WERR_NOT_SUPPORTED ;
}
break ;
2009-10-06 19:50:15 +04:00
case NETLOGON_CONTROL_TC_QUERY :
2009-10-19 13:28:00 +04:00
if ( ! r - > in . data | | ! r - > in . data - > domain ) {
return WERR_NOT_SUPPORTED ;
}
2009-10-06 19:50:15 +04:00
domain = r - > in . data - > domain ;
2008-02-13 14:24:56 +03:00
2009-10-06 19:50:15 +04:00
if ( ! is_trusted_domain ( domain ) ) {
break ;
}
2008-02-13 14:24:56 +03:00
2009-10-06 19:50:15 +04:00
if ( ! get_dc_name ( domain , NULL , dc_name2 , & dc_ss ) ) {
tc_status = WERR_NO_LOGON_SERVERS ;
break ;
}
2004-06-03 22:00:22 +04:00
2009-10-06 19:50:15 +04:00
dc_name = talloc_asprintf ( p - > mem_ctx , " \\ \\ %s " , dc_name2 ) ;
if ( ! dc_name ) {
return WERR_NOMEM ;
}
2008-02-13 14:24:56 +03:00
2009-10-06 19:50:15 +04:00
tc_status = WERR_OK ;
2008-02-13 14:24:56 +03:00
2009-10-06 19:50:15 +04:00
break ;
2008-02-13 14:24:56 +03:00
2009-10-06 19:50:15 +04:00
case NETLOGON_CONTROL_REDISCOVER :
2009-10-19 13:28:00 +04:00
if ( ! r - > in . data | | ! r - > in . data - > domain ) {
return WERR_NOT_SUPPORTED ;
}
2009-10-06 19:50:15 +04:00
domain = r - > in . data - > domain ;
2008-02-13 14:24:56 +03:00
2009-10-06 19:50:15 +04:00
if ( ! is_trusted_domain ( domain ) ) {
break ;
}
2008-02-13 14:24:56 +03:00
2009-10-06 19:50:15 +04:00
if ( ! get_dc_name ( domain , NULL , dc_name2 , & dc_ss ) ) {
tc_status = WERR_NO_LOGON_SERVERS ;
break ;
}
2004-06-03 22:00:22 +04:00
2009-10-06 19:50:15 +04:00
dc_name = talloc_asprintf ( p - > mem_ctx , " \\ \\ %s " , dc_name2 ) ;
if ( ! dc_name ) {
return WERR_NOMEM ;
}
2008-02-13 14:24:56 +03:00
2009-10-06 19:50:15 +04:00
tc_status = WERR_OK ;
2008-02-13 14:24:56 +03:00
2009-10-06 19:50:15 +04:00
break ;
2008-02-13 14:24:56 +03:00
2009-10-08 02:38:53 +04:00
case NETLOGON_CONTROL_CHANGE_PASSWORD :
if ( ! r - > in . data | | ! r - > in . data - > domain ) {
return WERR_NOT_SUPPORTED ;
}
if ( ! wb_change_trust_creds ( r - > in . data - > domain , & tc_status ) ) {
return WERR_NOT_SUPPORTED ;
}
break ;
2009-10-06 19:50:15 +04:00
default :
/* no idea what this should be */
DEBUG ( 0 , ( " %s: unimplemented function level [%d] \n " ,
fn , r - > in . function_code ) ) ;
return WERR_UNKNOWN_LEVEL ;
2004-06-03 22:00:22 +04:00
}
2008-02-13 14:24:56 +03:00
2004-06-03 22:00:22 +04:00
/* prepare the response */
2008-02-13 14:24:56 +03:00
2008-02-14 01:06:09 +03:00
switch ( r - > in . level ) {
2009-10-06 19:50:15 +04:00
case 1 :
info1 = TALLOC_ZERO_P ( p - > mem_ctx , struct netr_NETLOGON_INFO_1 ) ;
W_ERROR_HAVE_NO_MEMORY ( info1 ) ;
2001-02-27 03:32:11 +03:00
2009-10-06 19:50:15 +04:00
info1 - > flags = flags ;
info1 - > pdc_connection_status = pdc_connection_status ;
2009-09-02 17:29:44 +04:00
2009-10-06 19:50:15 +04:00
r - > out . query - > info1 = info1 ;
break ;
case 2 :
info2 = TALLOC_ZERO_P ( p - > mem_ctx , struct netr_NETLOGON_INFO_2 ) ;
W_ERROR_HAVE_NO_MEMORY ( info2 ) ;
2008-02-14 01:06:09 +03:00
2009-10-06 19:50:15 +04:00
info2 - > flags = flags ;
info2 - > pdc_connection_status = pdc_connection_status ;
info2 - > trusted_dc_name = dc_name ;
info2 - > tc_connection_status = tc_status ;
2009-09-02 17:29:44 +04:00
2009-10-06 19:50:15 +04:00
r - > out . query - > info2 = info2 ;
break ;
case 3 :
info3 = TALLOC_ZERO_P ( p - > mem_ctx , struct netr_NETLOGON_INFO_3 ) ;
W_ERROR_HAVE_NO_MEMORY ( info3 ) ;
2008-02-14 01:06:09 +03:00
2009-10-06 19:50:15 +04:00
info3 - > flags = flags ;
info3 - > logon_attempts = logon_attempts ;
2009-09-02 17:29:44 +04:00
2009-10-06 19:50:15 +04:00
r - > out . query - > info3 = info3 ;
break ;
2009-10-08 02:58:02 +04:00
case 4 :
info4 = TALLOC_ZERO_P ( p - > mem_ctx , struct netr_NETLOGON_INFO_4 ) ;
W_ERROR_HAVE_NO_MEMORY ( info4 ) ;
info4 - > trusted_dc_name = dc_name ;
info4 - > trusted_domain_name = r - > in . data - > domain ;
r - > out . query - > info4 = info4 ;
break ;
2009-10-06 19:50:15 +04:00
default :
return WERR_UNKNOWN_LEVEL ;
2008-02-14 01:06:09 +03:00
}
if ( lp_server_role ( ) = = ROLE_DOMAIN_BDC ) {
2001-08-28 10:34:08 +04:00
send_sync_message ( ) ;
2008-02-14 01:06:09 +03:00
}
2001-08-28 10:34:08 +04:00
2008-02-14 01:06:09 +03:00
return WERR_OK ;
2001-02-27 03:32:11 +03:00
}
/*************************************************************************
2008-02-13 12:23:45 +03:00
_netr_NetrEnumerateTrustedDomains
2001-02-27 03:32:11 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-02-13 12:23:45 +03:00
WERROR _netr_NetrEnumerateTrustedDomains ( pipes_struct * p ,
struct netr_NetrEnumerateTrustedDomains * r )
2001-02-27 03:32:11 +03:00
{
2009-09-24 20:53:40 +04:00
NTSTATUS status ;
2008-02-13 12:23:45 +03:00
DATA_BLOB blob ;
2009-09-24 20:53:40 +04:00
struct trustdom_info * * domains ;
uint32_t num_domains ;
const char * * trusted_domains ;
int i ;
2001-02-27 03:32:11 +03:00
2008-02-13 12:23:45 +03:00
DEBUG ( 6 , ( " _netr_NetrEnumerateTrustedDomains: %d \n " , __LINE__ ) ) ;
2001-02-27 03:32:11 +03:00
/* set up the Trusted Domain List response */
2009-09-24 20:53:40 +04:00
become_root ( ) ;
status = pdb_enum_trusteddoms ( p - > mem_ctx , & num_domains , & domains ) ;
unbecome_root ( ) ;
2001-02-27 03:32:11 +03:00
2009-09-24 20:53:40 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
return ntstatus_to_werror ( status ) ;
}
trusted_domains = talloc_zero_array ( p - > mem_ctx , const char * , num_domains + 1 ) ;
if ( ! trusted_domains ) {
return WERR_NOMEM ;
}
for ( i = 0 ; i < num_domains ; i + + ) {
trusted_domains [ i ] = talloc_strdup ( trusted_domains , domains [ i ] - > name ) ;
if ( ! trusted_domains [ i ] ) {
TALLOC_FREE ( trusted_domains ) ;
return WERR_NOMEM ;
}
}
if ( ! push_reg_multi_sz ( trusted_domains , & blob , trusted_domains ) ) {
TALLOC_FREE ( trusted_domains ) ;
return WERR_NOMEM ;
}
2008-02-13 12:23:45 +03:00
2009-09-24 20:53:40 +04:00
r - > out . trusted_domains_blob - > data = blob . data ;
r - > out . trusted_domains_blob - > length = blob . length ;
DEBUG ( 6 , ( " _netr_NetrEnumerateTrustedDomains: %d \n " , __LINE__ ) ) ;
2008-02-13 12:23:45 +03:00
return WERR_OK ;
2001-02-27 03:32:11 +03:00
}
/******************************************************************
gets a machine password entry . checks access rights of the host .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-08-25 20:44:24 +04:00
static NTSTATUS get_md4pw ( struct samr_Password * md4pw , const char * mach_acct ,
2009-10-13 12:15:34 +04:00
enum netr_SchannelType sec_chan_type , struct dom_sid * sid )
2001-02-27 03:32:11 +03:00
{
2006-02-20 23:09:36 +03:00
struct samu * sampass = NULL ;
This commit is number 4 of 4.
In particular this commit focuses on:
Actually adding the 'const' to the passdb interface, and the flow-on changes.
Also kill off the 'disp_info' stuff, as its no longer used.
While these changes have been mildly tested, and are pretty small, any
assistance in this is appreciated.
----
These changes introduces a large dose of 'const' to the Samba tree.
There are a number of good reasons to do this:
- I want to allow the SAM_ACCOUNT structure to move from wasteful
pstrings and fstrings to allocated strings. We can't do that if
people are modifying these outputs, as they may well make
assumptions about getting pstrings and fstrings
- I want --with-pam_smbpass to compile with a slightly sane
volume of warnings, currently its pretty bad, even in 2.2
where is compiles at all.
- Tridge assures me that he no longer opposes 'const religion'
based on the ability to #define const the problem away.
- Changed Get_Pwnam(x,y) into two variants (so that the const
parameter can work correctly): - Get_Pwnam(const x) and
Get_Pwnam_Modify(x).
- Reworked smbd/chgpasswd.c to work with these mods, passing
around a 'struct passwd' rather than the modified username
---
This finishes this line of commits off, your tree should now compile again :-)
Andrew Bartlett
(This used to be commit c95f5aeb9327347674589ae313b75bee3bf8e317)
2001-10-29 10:35:11 +03:00
const uint8 * pass ;
2007-10-19 04:40:25 +04:00
bool ret ;
2002-03-02 01:45:23 +03:00
uint32 acct_ctrl ;
2008-02-13 14:24:56 +03:00
2001-02-27 03:32:11 +03:00
#if 0
2007-11-04 04:15:45 +03:00
char addr [ INET6_ADDRSTRLEN ] ;
2001-02-27 03:32:11 +03:00
/*
* Currently this code is redundent as we already have a filter
2008-02-13 14:24:56 +03:00
* by hostname list . What this code really needs to do is to
2001-02-27 03:32:11 +03:00
* get a hosts allowed / hosts denied list from the SAM database
* on a per user basis , and make the access decision there .
* I will leave this code here for now as a reminder to implement
* this at a later date . JRA .
*/
if ( ! allow_access ( lp_domain_hostsdeny ( ) , lp_domain_hostsallow ( ) ,
2007-11-04 09:20:10 +03:00
client_name ( get_client_fd ( ) ) ,
client_addr ( get_client_fd ( ) , addr , sizeof ( addr ) ) ) ) {
2001-02-27 03:32:11 +03:00
DEBUG ( 0 , ( " get_md4pw: Workstation %s denied access to domain \n " , mach_acct ) ) ;
return False ;
}
# endif /* 0 */
2006-02-21 17:34:11 +03:00
if ( ! ( sampass = samu_new ( NULL ) ) ) {
2006-03-15 15:23:09 +03:00
return NT_STATUS_NO_MEMORY ;
2006-02-21 17:34:11 +03:00
}
2001-03-12 01:26:28 +03:00
2001-05-04 19:44:27 +04:00
/* JRA. This is ok as it is only used for generating the challenge. */
2001-02-27 03:32:11 +03:00
become_root ( ) ;
2006-03-15 15:23:09 +03:00
ret = pdb_getsampwnam ( sampass , mach_acct ) ;
2001-02-27 03:32:11 +03:00
unbecome_root ( ) ;
2008-02-13 14:24:56 +03:00
2006-06-15 05:54:09 +04:00
if ( ! ret ) {
2001-05-04 19:44:27 +04:00
DEBUG ( 0 , ( " get_md4pw: Workstation %s: no account in domain \n " , mach_acct ) ) ;
2006-02-20 23:09:36 +03:00
TALLOC_FREE ( sampass ) ;
2006-03-15 15:23:09 +03:00
return NT_STATUS_ACCESS_DENIED ;
2001-05-04 19:44:27 +04:00
}
2002-03-02 01:45:23 +03:00
acct_ctrl = pdb_get_acct_ctrl ( sampass ) ;
2006-03-15 15:23:09 +03:00
if ( acct_ctrl & ACB_DISABLED ) {
DEBUG ( 0 , ( " get_md4pw: Workstation %s: account is disabled \n " , mach_acct ) ) ;
TALLOC_FREE ( sampass ) ;
return NT_STATUS_ACCOUNT_DISABLED ;
2001-02-27 03:32:11 +03:00
}
2006-03-15 15:23:09 +03:00
2006-03-15 17:58:39 +03:00
if ( ! ( acct_ctrl & ACB_SVRTRUST ) & &
! ( acct_ctrl & ACB_WSTRUST ) & &
2008-02-13 14:24:56 +03:00
! ( acct_ctrl & ACB_DOMTRUST ) )
2006-03-15 17:58:39 +03:00
{
2006-03-15 15:23:09 +03:00
DEBUG ( 0 , ( " get_md4pw: Workstation %s: account is not a trust account \n " , mach_acct ) ) ;
TALLOC_FREE ( sampass ) ;
return NT_STATUS_NO_TRUST_SAM_ACCOUNT ;
}
switch ( sec_chan_type ) {
case SEC_CHAN_BDC :
if ( ! ( acct_ctrl & ACB_SVRTRUST ) ) {
DEBUG ( 0 , ( " get_md4pw: Workstation %s: BDC secure channel requested "
" but not a server trust account \n " , mach_acct ) ) ;
TALLOC_FREE ( sampass ) ;
return NT_STATUS_NO_TRUST_SAM_ACCOUNT ;
}
2006-03-15 18:38:15 +03:00
break ;
2006-03-15 15:23:09 +03:00
case SEC_CHAN_WKSTA :
if ( ! ( acct_ctrl & ACB_WSTRUST ) ) {
DEBUG ( 0 , ( " get_md4pw: Workstation %s: WORKSTATION secure channel requested "
" but not a workstation trust account \n " , mach_acct ) ) ;
TALLOC_FREE ( sampass ) ;
return NT_STATUS_NO_TRUST_SAM_ACCOUNT ;
}
2006-03-15 18:38:15 +03:00
break ;
2006-03-15 15:23:09 +03:00
case SEC_CHAN_DOMAIN :
if ( ! ( acct_ctrl & ACB_DOMTRUST ) ) {
DEBUG ( 0 , ( " get_md4pw: Workstation %s: DOMAIN secure channel requested "
" but not a interdomain trust account \n " , mach_acct ) ) ;
TALLOC_FREE ( sampass ) ;
return NT_STATUS_NO_TRUST_SAM_ACCOUNT ;
}
2006-03-15 18:38:15 +03:00
break ;
2006-03-15 15:23:09 +03:00
default :
break ;
}
if ( ( pass = pdb_get_nt_passwd ( sampass ) ) = = NULL ) {
DEBUG ( 0 , ( " get_md4pw: Workstation %s: account does not have a password \n " , mach_acct ) ) ;
TALLOC_FREE ( sampass ) ;
return NT_STATUS_LOGON_FAILURE ;
}
2009-08-25 20:44:24 +04:00
memcpy ( md4pw - > hash , pass , 16 ) ;
dump_data ( 5 , md4pw - > hash , 16 ) ;
2006-03-15 15:23:09 +03:00
2009-08-26 13:35:40 +04:00
sid_copy ( sid , pdb_get_user_sid ( sampass ) ) ;
2009-02-13 03:35:35 +03:00
2006-02-20 23:09:36 +03:00
TALLOC_FREE ( sampass ) ;
2008-02-13 14:24:56 +03:00
2006-03-15 15:23:09 +03:00
return NT_STATUS_OK ;
2008-02-13 14:24:56 +03:00
2001-05-04 19:44:27 +04:00
2001-02-27 03:32:11 +03:00
}
/*************************************************************************
2008-02-13 16:08:59 +03:00
_netr_ServerReqChallenge
2001-02-27 03:32:11 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-02-13 16:08:59 +03:00
NTSTATUS _netr_ServerReqChallenge ( pipes_struct * p ,
struct netr_ServerReqChallenge * r )
2001-02-27 03:32:11 +03:00
{
2009-08-26 00:38:55 +04:00
struct netlogon_server_pipe_state * pipe_state =
talloc_get_type ( p - > private_data , struct netlogon_server_pipe_state ) ;
if ( pipe_state ) {
2008-02-13 16:08:59 +03:00
DEBUG ( 10 , ( " _netr_ServerReqChallenge: new challenge requested. Clearing old state. \n " ) ) ;
2009-08-26 00:38:55 +04:00
talloc_free ( pipe_state ) ;
p - > private_data = NULL ;
2005-09-30 21:13:37 +04:00
}
2001-02-27 03:32:11 +03:00
2009-08-26 00:38:55 +04:00
pipe_state = talloc ( p , struct netlogon_server_pipe_state ) ;
NT_STATUS_HAVE_NO_MEMORY ( pipe_state ) ;
2001-02-27 03:32:11 +03:00
2009-08-26 00:38:55 +04:00
pipe_state - > client_challenge = * r - > in . credentials ;
2001-02-27 03:32:11 +03:00
2009-08-26 00:38:55 +04:00
generate_random_buffer ( pipe_state - > server_challenge . data ,
sizeof ( pipe_state - > server_challenge . data ) ) ;
2008-02-13 14:24:56 +03:00
2009-08-26 00:38:55 +04:00
* r - > out . return_credentials = pipe_state - > server_challenge ;
2008-02-13 14:24:56 +03:00
2009-08-26 00:38:55 +04:00
p - > private_data = pipe_state ;
2005-09-30 21:13:37 +04:00
return NT_STATUS_OK ;
2001-02-27 03:32:11 +03:00
}
2001-04-24 03:31:09 +04:00
/*************************************************************************
2008-02-15 23:24:39 +03:00
_netr_ServerAuthenticate
Create the initial credentials .
2001-04-24 03:31:09 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-02-15 23:24:39 +03:00
NTSTATUS _netr_ServerAuthenticate ( pipes_struct * p ,
struct netr_ServerAuthenticate * r )
2001-04-24 03:31:09 +04:00
{
2009-08-25 20:36:28 +04:00
struct netr_ServerAuthenticate3 a ;
uint32_t negotiate_flags = 0 ;
uint32_t rid ;
2005-09-30 21:13:37 +04:00
2009-08-25 20:36:28 +04:00
a . in . server_name = r - > in . server_name ;
a . in . account_name = r - > in . account_name ;
a . in . secure_channel_type = r - > in . secure_channel_type ;
a . in . computer_name = r - > in . computer_name ;
a . in . credentials = r - > in . credentials ;
a . in . negotiate_flags = & negotiate_flags ;
2005-09-30 21:13:37 +04:00
2009-08-25 20:36:28 +04:00
a . out . return_credentials = r - > out . return_credentials ;
a . out . rid = & rid ;
a . out . negotiate_flags = & negotiate_flags ;
2001-04-24 03:31:09 +04:00
2009-08-25 20:36:28 +04:00
return _netr_ServerAuthenticate3 ( p , & a ) ;
2008-02-15 23:24:39 +03:00
2001-04-24 03:31:09 +04:00
}
/*************************************************************************
2009-02-13 03:35:35 +03:00
_netr_ServerAuthenticate3
2001-04-24 03:31:09 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-02-13 03:35:35 +03:00
NTSTATUS _netr_ServerAuthenticate3 ( pipes_struct * p ,
struct netr_ServerAuthenticate3 * r )
2001-02-27 03:32:11 +03:00
{
2006-03-15 15:23:09 +03:00
NTSTATUS status ;
2008-02-15 23:41:16 +03:00
uint32_t srv_flgs ;
2009-05-07 03:10:20 +04:00
/* r->in.negotiate_flags is an aliased pointer to r->out.negotiate_flags,
* so use a copy to avoid destroying the client values . */
uint32_t in_neg_flags = * r - > in . negotiate_flags ;
2009-02-13 03:35:35 +03:00
const char * fn ;
2009-08-26 13:35:40 +04:00
struct dom_sid sid ;
2009-08-25 20:44:24 +04:00
struct samr_Password mach_pwd ;
2009-08-26 00:38:55 +04:00
struct netlogon_creds_CredentialState * creds ;
struct netlogon_server_pipe_state * pipe_state =
talloc_get_type ( p - > private_data , struct netlogon_server_pipe_state ) ;
2009-02-13 03:35:35 +03:00
2009-02-16 05:12:20 +03:00
/* According to Microsoft (see bugid #6099)
* Windows 7 looks at the negotiate_flags
* returned in this structure * even if the
2009-05-07 03:10:20 +04:00
* call fails with access denied * ! So in order
2009-02-16 05:12:20 +03:00
* to allow Win7 to connect to a Samba NT style
* PDC we set the flags before we know if it ' s
* an error or not .
*/
/* 0x000001ff */
srv_flgs = NETLOGON_NEG_ACCOUNT_LOCKOUT |
NETLOGON_NEG_PERSISTENT_SAMREPL |
NETLOGON_NEG_ARCFOUR |
NETLOGON_NEG_PROMOTION_COUNT |
NETLOGON_NEG_CHANGELOG_BDC |
NETLOGON_NEG_FULL_SYNC_REPL |
NETLOGON_NEG_MULTIPLE_SIDS |
NETLOGON_NEG_REDO |
2009-08-28 01:30:50 +04:00
NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL |
NETLOGON_NEG_PASSWORD_SET2 ;
2009-02-16 05:12:20 +03:00
2009-05-07 03:10:20 +04:00
/* Ensure we support strong (128-bit) keys. */
if ( in_neg_flags & NETLOGON_NEG_STRONG_KEYS ) {
srv_flgs | = NETLOGON_NEG_STRONG_KEYS ;
}
2009-02-16 05:12:20 +03:00
if ( lp_server_schannel ( ) ! = false ) {
srv_flgs | = NETLOGON_NEG_SCHANNEL ;
}
2009-02-13 03:35:35 +03:00
switch ( p - > hdr_req . opnum ) {
2009-08-25 20:36:28 +04:00
case NDR_NETR_SERVERAUTHENTICATE :
fn = " _netr_ServerAuthenticate " ;
break ;
2009-02-13 03:35:35 +03:00
case NDR_NETR_SERVERAUTHENTICATE2 :
fn = " _netr_ServerAuthenticate2 " ;
break ;
case NDR_NETR_SERVERAUTHENTICATE3 :
fn = " _netr_ServerAuthenticate3 " ;
break ;
default :
return NT_STATUS_INTERNAL_ERROR ;
}
2005-09-30 21:13:37 +04:00
2008-02-15 23:41:16 +03:00
/* We use this as the key to store the creds: */
/* r->in.computer_name */
2001-02-27 03:32:11 +03:00
2009-08-26 00:38:55 +04:00
if ( ! pipe_state ) {
2009-02-13 03:35:35 +03:00
DEBUG ( 0 , ( " %s: no challenge sent to client %s \n " , fn ,
2008-02-15 23:41:16 +03:00
r - > in . computer_name ) ) ;
2009-05-07 03:10:20 +04:00
status = NT_STATUS_ACCESS_DENIED ;
goto out ;
2005-09-30 21:13:37 +04:00
}
2001-02-27 03:32:11 +03:00
2008-02-15 23:41:16 +03:00
if ( ( lp_server_schannel ( ) = = true ) & &
2009-05-07 03:10:20 +04:00
( ( in_neg_flags & NETLOGON_NEG_SCHANNEL ) = = 0 ) ) {
2003-04-06 11:04:09 +04:00
/* schannel must be used, but client did not offer it. */
2009-02-13 03:35:35 +03:00
DEBUG ( 0 , ( " %s: schannel required but client failed "
2005-09-30 21:13:37 +04:00
" to offer it. Client was %s \n " ,
2009-02-13 03:35:35 +03:00
fn , r - > in . account_name ) ) ;
2009-05-07 03:10:20 +04:00
status = NT_STATUS_ACCESS_DENIED ;
goto out ;
2003-04-06 11:04:09 +04:00
}
2009-08-25 20:44:24 +04:00
status = get_md4pw ( & mach_pwd ,
2008-02-15 23:41:16 +03:00
r - > in . account_name ,
2009-02-13 03:35:35 +03:00
r - > in . secure_channel_type ,
2009-08-26 13:35:40 +04:00
& sid ) ;
2006-03-15 15:23:09 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2009-02-13 03:35:35 +03:00
DEBUG ( 0 , ( " %s: failed to get machine password for "
2006-03-15 15:23:09 +03:00
" account %s: %s \n " ,
2009-02-13 03:35:35 +03:00
fn , r - > in . account_name , nt_errstr ( status ) ) ) ;
2006-03-15 15:23:09 +03:00
/* always return NT_STATUS_ACCESS_DENIED */
2009-05-07 03:10:20 +04:00
status = NT_STATUS_ACCESS_DENIED ;
goto out ;
2005-09-30 21:13:37 +04:00
}
2002-03-03 06:56:53 +03:00
2005-09-30 21:13:37 +04:00
/* From the client / server challenges and md4 password, generate sess key */
/* Check client credentials are valid. */
2009-08-26 00:38:55 +04:00
creds = netlogon_creds_server_init ( p - > mem_ctx ,
r - > in . account_name ,
r - > in . computer_name ,
r - > in . secure_channel_type ,
& pipe_state - > client_challenge ,
& pipe_state - > server_challenge ,
& mach_pwd ,
r - > in . credentials ,
r - > out . return_credentials ,
* r - > in . negotiate_flags ) ;
if ( ! creds ) {
2009-02-13 03:35:35 +03:00
DEBUG ( 0 , ( " %s: netlogon_creds_server_check failed. Rejecting auth "
2005-09-30 21:13:37 +04:00
" request from client %s machine account %s \n " ,
2009-02-13 03:35:35 +03:00
fn , r - > in . computer_name ,
2008-02-15 23:41:16 +03:00
r - > in . account_name ) ) ;
2009-05-07 03:10:20 +04:00
status = NT_STATUS_ACCESS_DENIED ;
goto out ;
2001-02-27 03:32:11 +03:00
}
2005-10-05 05:47:52 +04:00
2009-08-26 00:38:55 +04:00
creds - > sid = sid_dup_talloc ( creds , & sid ) ;
if ( ! creds - > sid ) {
status = NT_STATUS_NO_MEMORY ;
goto out ;
}
2005-10-07 05:46:19 +04:00
/* Store off the state so we can continue after client disconnect. */
become_root ( ) ;
2010-02-19 00:17:06 +03:00
status = schannel_save_creds_state ( p - > mem_ctx ,
NULL , lp_private_dir ( ) , creds ) ;
2005-10-07 05:46:19 +04:00
unbecome_root ( ) ;
2009-08-25 01:00:47 +04:00
2009-08-26 00:38:55 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
goto out ;
}
2009-08-26 13:35:40 +04:00
sid_peek_rid ( & sid , r - > out . rid ) ;
2009-08-25 01:00:47 +04:00
2009-05-07 03:10:20 +04:00
status = NT_STATUS_OK ;
2003-04-06 11:04:09 +04:00
2009-05-07 03:10:20 +04:00
out :
2009-05-06 21:29:01 +04:00
2009-05-07 03:10:20 +04:00
* r - > out . negotiate_flags = srv_flgs ;
return status ;
2001-02-27 03:32:11 +03:00
}
2009-02-13 03:35:35 +03:00
/*************************************************************************
_netr_ServerAuthenticate2
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_ServerAuthenticate2 ( pipes_struct * p ,
struct netr_ServerAuthenticate2 * r )
{
struct netr_ServerAuthenticate3 a ;
uint32_t rid ;
a . in . server_name = r - > in . server_name ;
a . in . account_name = r - > in . account_name ;
a . in . secure_channel_type = r - > in . secure_channel_type ;
a . in . computer_name = r - > in . computer_name ;
a . in . credentials = r - > in . credentials ;
a . in . negotiate_flags = r - > in . negotiate_flags ;
a . out . return_credentials = r - > out . return_credentials ;
a . out . rid = & rid ;
a . out . negotiate_flags = r - > out . negotiate_flags ;
return _netr_ServerAuthenticate3 ( p , & a ) ;
}
2010-02-18 18:19:09 +03:00
/*************************************************************************
* If schannel is required for this call test that it actually is available .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static NTSTATUS schannel_check_required ( struct pipe_auth_data * auth_info ,
const char * computer_name ,
bool integrity , bool privacy )
{
if ( auth_info & & auth_info - > auth_type = = PIPE_AUTH_TYPE_SCHANNEL ) {
if ( ! privacy & & ! integrity ) {
return NT_STATUS_OK ;
}
if ( ( ! privacy & & integrity ) & &
auth_info - > auth_level = = DCERPC_AUTH_LEVEL_INTEGRITY ) {
return NT_STATUS_OK ;
}
if ( ( privacy | | integrity ) & &
auth_info - > auth_level = = DCERPC_AUTH_LEVEL_PRIVACY ) {
return NT_STATUS_OK ;
}
}
/* test didn't pass */
DEBUG ( 0 , ( " schannel_check_required: [%s] is not using schannel \n " ,
computer_name ) ) ;
return NT_STATUS_ACCESS_DENIED ;
}
2009-08-26 00:26:34 +04:00
/*************************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static NTSTATUS netr_creds_server_step_check ( pipes_struct * p ,
TALLOC_CTX * mem_ctx ,
const char * computer_name ,
struct netr_Authenticator * received_authenticator ,
struct netr_Authenticator * return_authenticator ,
struct netlogon_creds_CredentialState * * creds_out )
{
NTSTATUS status ;
bool schannel_global_required = ( lp_server_schannel ( ) = = true ) ? true : false ;
2010-02-18 18:19:09 +03:00
if ( schannel_global_required ) {
status = schannel_check_required ( & p - > auth ,
computer_name ,
false , false ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return status ;
}
}
2009-08-26 00:26:34 +04:00
2010-02-19 00:17:06 +03:00
status = schannel_check_creds_state ( mem_ctx , NULL ,
lp_private_dir ( ) ,
2010-02-18 22:44:09 +03:00
computer_name ,
received_authenticator ,
return_authenticator ,
creds_out ) ;
2009-08-26 00:26:34 +04:00
return status ;
}
2001-02-27 03:32:11 +03:00
/*************************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-08-28 01:30:14 +04:00
static NTSTATUS netr_find_machine_account ( TALLOC_CTX * mem_ctx ,
const char * account_name ,
struct samu * * sampassp )
2001-02-27 03:32:11 +03:00
{
2009-08-28 01:30:14 +04:00
struct samu * sampass ;
bool ret = false ;
uint32_t acct_ctrl ;
2008-02-13 14:24:56 +03:00
2009-08-28 01:30:14 +04:00
sampass = samu_new ( mem_ctx ) ;
2006-06-15 05:54:09 +04:00
if ( ! sampass ) {
return NT_STATUS_NO_MEMORY ;
}
2001-02-27 03:32:11 +03:00
become_root ( ) ;
2009-08-28 01:30:14 +04:00
ret = pdb_getsampwnam ( sampass , account_name ) ;
2001-02-27 03:32:11 +03:00
unbecome_root ( ) ;
2006-06-15 05:54:09 +04:00
if ( ! ret ) {
TALLOC_FREE ( sampass ) ;
return NT_STATUS_ACCESS_DENIED ;
}
2006-02-21 17:34:11 +03:00
2001-03-12 01:26:28 +03:00
/* Ensure the account exists and is a machine account. */
2008-02-13 14:24:56 +03:00
2002-03-03 06:56:53 +03:00
acct_ctrl = pdb_get_acct_ctrl ( sampass ) ;
2001-03-12 01:26:28 +03:00
2006-06-15 05:54:09 +04:00
if ( ! ( acct_ctrl & ACB_WSTRUST | |
2009-08-28 01:30:14 +04:00
acct_ctrl & ACB_SVRTRUST | |
acct_ctrl & ACB_DOMTRUST ) ) {
2006-02-20 23:09:36 +03:00
TALLOC_FREE ( sampass ) ;
2001-02-27 03:32:11 +03:00
return NT_STATUS_NO_SUCH_USER ;
2001-05-04 19:44:27 +04:00
}
2008-02-13 14:24:56 +03:00
2009-08-28 01:30:14 +04:00
if ( acct_ctrl & ACB_DISABLED ) {
2006-02-20 23:09:36 +03:00
TALLOC_FREE ( sampass ) ;
This is another *BIG* change...
Samba now features a pluggable passdb interface, along the same lines as the
one in use in the auth subsystem. In this case, only one backend may be active
at a time by the 'normal' interface, and only one backend per passdb_context is
permitted outside that.
This pluggable interface is designed to allow any number of passdb backends to
be compiled in, with the selection at runtime. The 'passdb backend' paramater
has been created (and documented!) to support this.
As such, configure has been modfied to allow (for example) --with-ldap and the
old smbpasswd to be selected at the same time.
This patch also introduces two new backends: smbpasswd_nua and tdbsam_nua.
These two backends accept 'non unix accounts', where the user does *not* exist
in /etc/passwd. These accounts' don't have UIDs in the unix sense, but to
avoid conflicts in the algroitmic mapping of RIDs, they use the values
specified in the 'non unix account range' paramter - in the same way as the
winbind ranges are specifed.
While I was at it, I cleaned up some of the code in pdb_tdb (code copied
directly from smbpasswd and not really considered properly). Most of this was
to do with % macro expansion on stored data. It isn't easy to get the macros
into the tdb, and the first password change will 'expand' them. tdbsam needs
to use a similar system to pdb_ldap in this regard.
This patch only makes minor adjustments to pdb_nisplus and pdb_ldap, becouse I
don't have the test facilities for these. I plan to incoroprate at least
pdb_ldap into this scheme after consultation with Jerry.
Each (converted) passdb module now no longer has any 'static' variables, and
only exports 1 init function outside its .c file.
The non-unix-account support in this patch has been proven! It is now possible
to join a win2k machine to a Samba PDC without an account in /etc/passwd!
Other changes:
Minor interface adjustments:
pdb_delete_sam_account() now takes a SAM_ACCOUNT, not a char*.
pdb_update_sam_account() no longer takes the 'override' argument that was being
ignored so often (every other passdb backend). Extra checks have been added in
some places.
Minor code changes:
smbpasswd no longer attempts to initialise the passdb at startup, this is
now done on first use.
pdbedit has lost some of its 'machine account' logic, as this behaviour is now
controlled by the passdb subsystem directly.
The samr subsystem no longer calls 'local password change', but does the pdb
interactions directly. This allow the ACB_ flags specifed to be transferred
direct to the backend, without interference.
Doco:
I've updated the doco to reflect some of the changes, and removed some paramters
no longer applicable to HEAD.
(This used to be commit ff354c99c585068af6dc1ff35a1f109a806b326b)
2002-01-20 17:30:58 +03:00
return NT_STATUS_ACCOUNT_DISABLED ;
}
2009-08-28 01:30:14 +04:00
* sampassp = sampass ;
2004-08-31 23:56:16 +04:00
2009-08-28 01:30:14 +04:00
return NT_STATUS_OK ;
}
2001-02-27 03:32:11 +03:00
2009-08-28 01:30:14 +04:00
/*************************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2001-02-27 03:32:11 +03:00
2009-08-28 01:30:14 +04:00
static NTSTATUS netr_set_machine_account_password ( TALLOC_CTX * mem_ctx ,
struct samu * sampass ,
DATA_BLOB * plaintext_blob ,
struct samr_Password * nt_hash ,
struct samr_Password * lm_hash )
{
NTSTATUS status ;
const uchar * old_pw ;
const char * plaintext = NULL ;
size_t plaintext_len ;
struct samr_Password nt_hash_local ;
2001-09-29 17:08:26 +04:00
2009-08-28 01:30:14 +04:00
if ( ! sampass ) {
return NT_STATUS_INVALID_PARAMETER ;
}
2001-09-29 17:08:26 +04:00
2009-08-28 01:30:14 +04:00
if ( plaintext_blob ) {
if ( ! convert_string_talloc ( mem_ctx , CH_UTF16 , CH_UNIX ,
plaintext_blob - > data , plaintext_blob - > length ,
& plaintext , & plaintext_len , false ) )
{
plaintext = NULL ;
mdfour ( nt_hash_local . hash , plaintext_blob - > data , plaintext_blob - > length ) ;
nt_hash = & nt_hash_local ;
2004-08-31 23:56:16 +04:00
}
2009-08-28 01:30:14 +04:00
}
2008-02-13 14:24:56 +03:00
2009-08-28 01:30:14 +04:00
if ( plaintext ) {
if ( ! pdb_set_plaintext_passwd ( sampass , plaintext ) ) {
return NT_STATUS_ACCESS_DENIED ;
2004-08-31 23:56:16 +04:00
}
2008-02-13 14:24:56 +03:00
2009-08-28 01:30:14 +04:00
goto done ;
}
if ( nt_hash ) {
old_pw = pdb_get_nt_passwd ( sampass ) ;
if ( old_pw & & memcmp ( nt_hash - > hash , old_pw , 16 ) = = 0 ) {
/* Avoid backend modificiations and other fun if the
client changed the password to the * same thing * */
} else {
/* LM password should be NULL for machines */
if ( ! pdb_set_lanman_passwd ( sampass , NULL , PDB_CHANGED ) ) {
return NT_STATUS_NO_MEMORY ;
}
if ( ! pdb_set_nt_passwd ( sampass , nt_hash - > hash , PDB_CHANGED ) ) {
return NT_STATUS_NO_MEMORY ;
}
if ( ! pdb_set_pass_last_set_time ( sampass , time ( NULL ) , PDB_CHANGED ) ) {
/* Not quite sure what this one qualifies as, but this will do */
return NT_STATUS_UNSUCCESSFUL ;
}
2004-08-31 23:56:16 +04:00
}
2009-08-28 01:30:14 +04:00
}
done :
become_root ( ) ;
status = pdb_update_sam_account ( sampass ) ;
unbecome_root ( ) ;
return status ;
}
/*************************************************************************
_netr_ServerPasswordSet
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-02-13 14:24:56 +03:00
2009-08-28 01:30:14 +04:00
NTSTATUS _netr_ServerPasswordSet ( pipes_struct * p ,
struct netr_ServerPasswordSet * r )
{
NTSTATUS status = NT_STATUS_OK ;
struct samu * sampass = NULL ;
int i ;
struct netlogon_creds_CredentialState * creds ;
DEBUG ( 5 , ( " _netr_ServerPasswordSet: %d \n " , __LINE__ ) ) ;
become_root ( ) ;
status = netr_creds_server_step_check ( p , p - > mem_ctx ,
r - > in . computer_name ,
r - > in . credential ,
r - > out . return_authenticator ,
& creds ) ;
unbecome_root ( ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 2 , ( " _netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
" request from client %s machine account %s \n " ,
r - > in . computer_name , creds - > computer_name ) ) ;
TALLOC_FREE ( creds ) ;
return status ;
}
DEBUG ( 3 , ( " _netr_ServerPasswordSet: Server Password Set by remote machine:[%s] on account [%s] \n " ,
r - > in . computer_name , creds - > computer_name ) ) ;
netlogon_creds_des_decrypt ( creds , r - > in . new_password ) ;
DEBUG ( 100 , ( " _netr_ServerPasswordSet: new given value was : \n " ) ) ;
for ( i = 0 ; i < sizeof ( r - > in . new_password - > hash ) ; i + + )
DEBUG ( 100 , ( " %02X " , r - > in . new_password - > hash [ i ] ) ) ;
DEBUG ( 100 , ( " \n " ) ) ;
status = netr_find_machine_account ( p - > mem_ctx ,
creds - > account_name ,
& sampass ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return status ;
2001-10-29 10:15:51 +03:00
}
2001-02-27 03:32:11 +03:00
2009-08-28 01:30:14 +04:00
status = netr_set_machine_account_password ( sampass ,
sampass ,
NULL ,
r - > in . new_password ,
NULL ) ;
2006-02-20 23:09:36 +03:00
TALLOC_FREE ( sampass ) ;
2008-02-15 23:13:50 +03:00
return status ;
2001-02-27 03:32:11 +03:00
}
2009-08-28 01:30:50 +04:00
/****************************************************************
_netr_ServerPasswordSet2
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_ServerPasswordSet2 ( pipes_struct * p ,
struct netr_ServerPasswordSet2 * r )
{
NTSTATUS status ;
struct netlogon_creds_CredentialState * creds ;
struct samu * sampass ;
DATA_BLOB plaintext ;
struct samr_CryptPassword password_buf ;
2009-10-16 14:09:55 +04:00
struct samr_Password nt_hash ;
2009-08-28 01:30:50 +04:00
become_root ( ) ;
status = netr_creds_server_step_check ( p , p - > mem_ctx ,
r - > in . computer_name ,
r - > in . credential ,
r - > out . return_authenticator ,
& creds ) ;
unbecome_root ( ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 2 , ( " _netr_ServerPasswordSet2: netlogon_creds_server_step "
" failed. Rejecting auth request from client %s machine account %s \n " ,
r - > in . computer_name , creds - > computer_name ) ) ;
TALLOC_FREE ( creds ) ;
return status ;
}
memcpy ( password_buf . data , r - > in . new_password - > data , 512 ) ;
SIVAL ( password_buf . data , 512 , r - > in . new_password - > length ) ;
netlogon_creds_arcfour_crypt ( creds , password_buf . data , 516 ) ;
if ( ! extract_pw_from_buffer ( p - > mem_ctx , password_buf . data , & plaintext ) ) {
return NT_STATUS_WRONG_PASSWORD ;
}
2009-10-16 14:09:55 +04:00
mdfour ( nt_hash . hash , plaintext . data , plaintext . length ) ;
2009-08-28 01:30:50 +04:00
status = netr_find_machine_account ( p - > mem_ctx ,
creds - > account_name ,
& sampass ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return status ;
}
status = netr_set_machine_account_password ( sampass ,
sampass ,
NULL ,
2009-10-16 14:09:55 +04:00
& nt_hash ,
2009-08-28 01:30:50 +04:00
NULL ) ;
TALLOC_FREE ( sampass ) ;
return status ;
}
2001-02-27 03:32:11 +03:00
/*************************************************************************
2008-02-15 23:46:42 +03:00
_netr_LogonSamLogoff
2001-02-27 03:32:11 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-02-15 23:46:42 +03:00
NTSTATUS _netr_LogonSamLogoff ( pipes_struct * p ,
struct netr_LogonSamLogoff * r )
2001-02-27 03:32:11 +03:00
{
2009-08-26 00:38:55 +04:00
NTSTATUS status ;
struct netlogon_creds_CredentialState * creds ;
2001-02-27 03:32:11 +03:00
2006-02-16 02:15:55 +03:00
become_root ( ) ;
2009-08-26 00:38:55 +04:00
status = netr_creds_server_step_check ( p , p - > mem_ctx ,
r - > in . computer_name ,
r - > in . credential ,
r - > out . return_authenticator ,
& creds ) ;
2006-02-16 02:15:55 +03:00
unbecome_root ( ) ;
2009-08-26 00:38:55 +04:00
return status ;
2001-02-27 03:32:11 +03:00
}
/*************************************************************************
2009-08-26 00:38:55 +04:00
_netr_LogonSamLogon_base
2001-02-27 03:32:11 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-08-26 00:38:55 +04:00
static NTSTATUS _netr_LogonSamLogon_base ( pipes_struct * p ,
struct netr_LogonSamLogonEx * r ,
struct netlogon_creds_CredentialState * creds )
2001-02-27 03:32:11 +03:00
{
2001-08-27 23:46:22 +04:00
NTSTATUS status = NT_STATUS_OK ;
2008-10-15 18:14:15 +04:00
union netr_LogonLevel * logon = r - > in . logon ;
2009-06-30 19:18:47 +04:00
const char * nt_username , * nt_domain , * nt_workstation ;
2010-01-10 16:16:04 +03:00
struct auth_usersupplied_info * user_info = NULL ;
2010-01-10 16:24:22 +03:00
struct auth_serversupplied_info * server_info = NULL ;
2003-07-01 00:45:14 +04:00
struct auth_context * auth_context = NULL ;
2008-05-18 00:44:35 +04:00
uint8_t pipe_session_key [ 16 ] ;
2008-02-16 15:28:03 +03:00
bool process_creds = true ;
2009-02-13 18:56:52 +03:00
const char * fn ;
2008-02-16 15:28:03 +03:00
switch ( p - > hdr_req . opnum ) {
case NDR_NETR_LOGONSAMLOGON :
process_creds = true ;
2009-02-13 18:56:52 +03:00
fn = " _netr_LogonSamLogon " ;
2008-02-16 15:28:03 +03:00
break ;
2009-08-31 19:13:05 +04:00
case NDR_NETR_LOGONSAMLOGONWITHFLAGS :
process_creds = true ;
fn = " _netr_LogonSamLogonWithFlags " ;
break ;
2008-02-16 15:28:03 +03:00
case NDR_NETR_LOGONSAMLOGONEX :
2009-08-26 03:03:47 +04:00
process_creds = false ;
2009-02-13 18:56:52 +03:00
fn = " _netr_LogonSamLogonEx " ;
2009-08-26 03:03:47 +04:00
break ;
2008-02-16 15:28:03 +03:00
default :
2009-08-26 03:03:47 +04:00
return NT_STATUS_INTERNAL_ERROR ;
2008-02-16 15:28:03 +03:00
}
2008-02-13 14:24:56 +03:00
2009-05-29 15:15:27 +04:00
* r - > out . authoritative = true ; /* authoritative response */
2009-06-25 14:00:20 +04:00
switch ( r - > in . validation_level ) {
case 2 :
r - > out . validation - > sam2 = TALLOC_ZERO_P ( p - > mem_ctx , struct netr_SamInfo2 ) ;
if ( ! r - > out . validation - > sam2 ) {
return NT_STATUS_NO_MEMORY ;
}
break ;
case 3 :
r - > out . validation - > sam3 = TALLOC_ZERO_P ( p - > mem_ctx , struct netr_SamInfo3 ) ;
if ( ! r - > out . validation - > sam3 ) {
return NT_STATUS_NO_MEMORY ;
}
break ;
2009-08-31 22:21:40 +04:00
case 6 :
r - > out . validation - > sam6 = TALLOC_ZERO_P ( p - > mem_ctx , struct netr_SamInfo6 ) ;
if ( ! r - > out . validation - > sam6 ) {
return NT_STATUS_NO_MEMORY ;
}
break ;
2009-06-25 14:00:20 +04:00
default :
2009-05-29 15:15:27 +04:00
DEBUG ( 0 , ( " %s: bad validation_level value %d. \n " ,
fn , ( int ) r - > in . validation_level ) ) ;
return NT_STATUS_INVALID_INFO_CLASS ;
}
2008-02-16 15:28:03 +03:00
switch ( r - > in . logon_level ) {
2008-10-15 18:14:15 +04:00
case NetlogonInteractiveInformation :
2009-08-31 22:20:52 +04:00
case NetlogonServiceInformation :
case NetlogonInteractiveTransitiveInformation :
case NetlogonServiceTransitiveInformation :
2009-06-30 19:18:47 +04:00
nt_username = logon - > password - > identity_info . account_name . string ;
nt_domain = logon - > password - > identity_info . domain_name . string ;
nt_workstation = logon - > password - > identity_info . workstation . string ;
2008-02-13 14:24:56 +03:00
2006-02-18 00:32:31 +03:00
DEBUG ( 3 , ( " SAM Logon (Interactive). Domain:[%s]. " , lp_workgroup ( ) ) ) ;
break ;
2008-10-15 18:14:15 +04:00
case NetlogonNetworkInformation :
2009-08-31 22:20:52 +04:00
case NetlogonNetworkTransitiveInformation :
2009-06-30 19:18:47 +04:00
nt_username = logon - > network - > identity_info . account_name . string ;
nt_domain = logon - > network - > identity_info . domain_name . string ;
nt_workstation = logon - > network - > identity_info . workstation . string ;
2008-02-13 14:24:56 +03:00
2006-02-18 00:32:31 +03:00
DEBUG ( 3 , ( " SAM Logon (Network). Domain:[%s]. " , lp_workgroup ( ) ) ) ;
break ;
default :
DEBUG ( 2 , ( " SAM Logon: unsupported switch value \n " ) ) ;
return NT_STATUS_INVALID_INFO_CLASS ;
} /* end switch */
DEBUG ( 3 , ( " User:[%s@%s] Requested Domain:[%s] \n " , nt_username , nt_workstation , nt_domain ) ) ;
2003-01-04 09:15:24 +03:00
fstrcpy ( current_user_info . smb_name , nt_username ) ;
2002-11-20 03:53:24 +03:00
sub_set_smb_name ( nt_username ) ;
2008-02-13 14:24:56 +03:00
2008-02-16 15:28:03 +03:00
DEBUG ( 5 , ( " Attempting validation level %d for unmapped username %s. \n " ,
r - > in . validation_level , nt_username ) ) ;
2001-02-27 03:32:11 +03:00
2003-07-01 00:45:14 +04:00
status = NT_STATUS_OK ;
2008-02-13 14:24:56 +03:00
2008-02-16 15:28:03 +03:00
switch ( r - > in . logon_level ) {
2008-10-15 18:14:15 +04:00
case NetlogonNetworkInformation :
2009-08-31 22:20:52 +04:00
case NetlogonNetworkTransitiveInformation :
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
{
2004-03-18 10:36:36 +03:00
const char * wksname = nt_workstation ;
2008-02-13 14:24:56 +03:00
2008-02-16 15:28:03 +03:00
status = make_auth_context_fixed ( & auth_context ,
logon - > network - > challenge ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
2002-01-05 07:55:41 +03:00
return status ;
}
2004-03-18 10:36:36 +03:00
/* For a network logon, the workstation name comes in with two
* backslashes in the front . Strip them if they are there . */
if ( * wksname = = ' \\ ' ) wksname + + ;
if ( * wksname = = ' \\ ' ) wksname + + ;
2001-11-26 07:05:28 +03:00
/* Standard challenge/response authenticaion */
2008-02-13 14:24:56 +03:00
if ( ! make_user_info_netlogon_network ( & user_info ,
nt_username , nt_domain ,
2004-03-18 10:36:36 +03:00
wksname ,
2008-02-16 15:28:03 +03:00
logon - > network - > identity_info . parameter_control ,
logon - > network - > lm . data ,
logon - > network - > lm . length ,
logon - > network - > nt . data ,
logon - > network - > nt . length ) ) {
2002-01-05 07:55:41 +03:00
status = NT_STATUS_NO_MEMORY ;
2008-02-13 14:24:56 +03:00
}
2001-10-31 13:46:25 +03:00
break ;
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
}
2008-10-15 18:14:15 +04:00
case NetlogonInteractiveInformation :
2009-08-31 22:20:52 +04:00
case NetlogonServiceInformation :
case NetlogonInteractiveTransitiveInformation :
case NetlogonServiceTransitiveInformation :
2006-02-04 01:19:41 +03:00
/* 'Interactive' authentication, supplies the password in its
MD4 form , encrypted with the session key . We will convert
this to challenge / response for the auth subsystem to chew
on */
2001-10-31 13:46:25 +03:00
{
2009-02-20 01:41:48 +03:00
uint8_t chal [ 8 ] ;
2008-02-13 14:24:56 +03:00
2002-01-05 07:55:41 +03:00
if ( ! NT_STATUS_IS_OK ( status = make_auth_context_subsystem ( & auth_context ) ) ) {
return status ;
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
}
2008-02-13 14:24:56 +03:00
2009-02-20 01:41:48 +03:00
auth_context - > get_ntlm_challenge ( auth_context , chal ) ;
2002-01-05 07:55:41 +03:00
2008-02-13 14:24:56 +03:00
if ( ! make_user_info_netlogon_interactive ( & user_info ,
nt_username , nt_domain ,
nt_workstation ,
2008-02-16 15:28:03 +03:00
logon - > password - > identity_info . parameter_control ,
2005-11-08 09:19:34 +03:00
chal ,
2008-02-16 15:28:03 +03:00
logon - > password - > lmpassword . hash ,
logon - > password - > ntpassword . hash ,
2009-08-26 00:38:55 +04:00
creds - > session_key ) ) {
2002-01-05 07:55:41 +03:00
status = NT_STATUS_NO_MEMORY ;
}
2001-10-31 13:46:25 +03:00
break ;
}
default :
DEBUG ( 2 , ( " SAM Logon: unsupported switch value \n " ) ) ;
return NT_STATUS_INVALID_INFO_CLASS ;
} /* end switch */
2008-02-13 14:24:56 +03:00
2003-07-01 00:45:14 +04:00
if ( NT_STATUS_IS_OK ( status ) ) {
2008-02-13 14:24:56 +03:00
status = auth_context - > check_ntlm_password ( auth_context ,
2003-07-01 00:45:14 +04:00
user_info , & server_info ) ;
}
2008-02-13 14:24:56 +03:00
( auth_context - > free ) ( & auth_context ) ;
2001-10-31 13:46:25 +03:00
free_user_info ( & user_info ) ;
2008-02-13 14:24:56 +03:00
2009-02-13 18:56:52 +03:00
DEBUG ( 5 , ( " %s: check_password returned status %s \n " ,
fn , nt_errstr ( status ) ) ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
/* Check account and password */
2008-02-13 14:24:56 +03:00
2001-11-25 05:30:30 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2008-02-13 14:24:56 +03:00
/* If we don't know what this domain is, we need to
indicate that we are not authoritative . This
allows the client to decide if it needs to try
2005-08-12 19:28:19 +04:00
a local user . Fix by jpjanosi @ us . ibm . com , # 2976 */
2008-02-13 14:24:56 +03:00
if ( NT_STATUS_EQUAL ( status , NT_STATUS_NO_SUCH_USER )
2005-08-12 19:28:19 +04:00
& & ! strequal ( nt_domain , get_global_sam_name ( ) )
& & ! is_trusted_domain ( nt_domain ) )
2008-02-16 15:28:03 +03:00
* r - > out . authoritative = false ; /* We are not authoritative */
2005-08-12 19:28:19 +04:00
2006-02-20 20:59:58 +03:00
TALLOC_FREE ( server_info ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
return status ;
2001-05-04 19:44:27 +04:00
}
2001-10-31 13:46:25 +03:00
2001-11-09 01:19:01 +03:00
if ( server_info - > guest ) {
/* We don't like guest domain logons... */
2009-02-13 18:56:52 +03:00
DEBUG ( 5 , ( " %s: Attempted domain logon as GUEST "
" denied. \n " , fn ) ) ;
2006-02-20 20:59:58 +03:00
TALLOC_FREE ( server_info ) ;
2001-11-09 01:19:01 +03:00
return NT_STATUS_LOGON_FAILURE ;
}
2001-09-06 09:24:37 +04:00
/* This is the point at which, if the login was successful, that
the SAM Local Security Authority should record that the user is
logged in to the domain . */
2007-11-27 22:22:58 +03:00
2008-05-18 00:44:35 +04:00
if ( process_creds ) {
/* Get the pipe session key from the creds. */
2009-08-26 00:38:55 +04:00
memcpy ( pipe_session_key , creds - > session_key , 16 ) ;
2008-05-18 00:44:35 +04:00
} else {
/* Get the pipe session key from the schannel. */
if ( ( p - > auth . auth_type ! = PIPE_AUTH_TYPE_SCHANNEL )
| | ( p - > auth . a_u . schannel_auth = = NULL ) ) {
return NT_STATUS_INVALID_HANDLE ;
2008-02-16 15:28:03 +03:00
}
2009-09-16 02:26:17 +04:00
memcpy ( pipe_session_key , p - > auth . a_u . schannel_auth - > creds - > session_key , 16 ) ;
2001-05-04 19:44:27 +04:00
}
2008-05-18 00:44:35 +04:00
2009-06-25 14:00:20 +04:00
switch ( r - > in . validation_level ) {
case 2 :
status = serverinfo_to_SamInfo2 ( server_info , pipe_session_key , 16 ,
r - > out . validation - > sam2 ) ;
break ;
case 3 :
status = serverinfo_to_SamInfo3 ( server_info , pipe_session_key , 16 ,
r - > out . validation - > sam3 ) ;
break ;
2009-08-31 22:21:40 +04:00
case 6 :
status = serverinfo_to_SamInfo6 ( server_info , pipe_session_key , 16 ,
r - > out . validation - > sam6 ) ;
break ;
2009-06-25 14:00:20 +04:00
}
2006-02-20 20:59:58 +03:00
TALLOC_FREE ( server_info ) ;
2009-06-25 14:00:20 +04:00
2001-05-04 19:44:27 +04:00
return status ;
2001-02-27 03:32:11 +03:00
}
2001-10-31 13:46:25 +03:00
2009-08-31 19:13:05 +04:00
/****************************************************************
_netr_LogonSamLogonWithFlags
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-08-26 00:38:55 +04:00
2009-08-31 19:13:05 +04:00
NTSTATUS _netr_LogonSamLogonWithFlags ( pipes_struct * p ,
struct netr_LogonSamLogonWithFlags * r )
2009-08-26 00:38:55 +04:00
{
NTSTATUS status ;
struct netlogon_creds_CredentialState * creds ;
struct netr_LogonSamLogonEx r2 ;
struct netr_Authenticator return_authenticator ;
become_root ( ) ;
status = netr_creds_server_step_check ( p , p - > mem_ctx ,
r - > in . computer_name ,
r - > in . credential ,
& return_authenticator ,
& creds ) ;
unbecome_root ( ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return status ;
}
r2 . in . server_name = r - > in . server_name ;
r2 . in . computer_name = r - > in . computer_name ;
r2 . in . logon_level = r - > in . logon_level ;
r2 . in . logon = r - > in . logon ;
r2 . in . validation_level = r - > in . validation_level ;
2009-08-31 19:13:05 +04:00
r2 . in . flags = r - > in . flags ;
2009-08-26 00:38:55 +04:00
r2 . out . validation = r - > out . validation ;
r2 . out . authoritative = r - > out . authoritative ;
2009-08-31 19:13:05 +04:00
r2 . out . flags = r - > out . flags ;
2009-08-26 00:38:55 +04:00
status = _netr_LogonSamLogon_base ( p , & r2 , creds ) ;
* r - > out . return_authenticator = return_authenticator ;
return status ;
}
2009-08-31 19:13:05 +04:00
/*************************************************************************
_netr_LogonSamLogon
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_LogonSamLogon ( pipes_struct * p ,
struct netr_LogonSamLogon * r )
{
NTSTATUS status ;
struct netr_LogonSamLogonWithFlags r2 ;
uint32_t flags = 0 ;
r2 . in . server_name = r - > in . server_name ;
r2 . in . computer_name = r - > in . computer_name ;
r2 . in . credential = r - > in . credential ;
r2 . in . logon_level = r - > in . logon_level ;
r2 . in . logon = r - > in . logon ;
r2 . in . validation_level = r - > in . validation_level ;
r2 . in . return_authenticator = r - > in . return_authenticator ;
r2 . in . flags = & flags ;
r2 . out . validation = r - > out . validation ;
r2 . out . authoritative = r - > out . authoritative ;
r2 . out . flags = & flags ;
r2 . out . return_authenticator = r - > out . return_authenticator ;
status = _netr_LogonSamLogonWithFlags ( p , & r2 ) ;
return status ;
}
2006-02-10 21:05:55 +03:00
/*************************************************************************
2008-02-16 15:28:03 +03:00
_netr_LogonSamLogonEx
- no credential chaining . Map into net sam logon .
2006-02-10 21:51:18 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-02-16 15:28:03 +03:00
NTSTATUS _netr_LogonSamLogonEx ( pipes_struct * p ,
struct netr_LogonSamLogonEx * r )
2006-02-10 21:05:55 +03:00
{
2009-08-26 00:38:55 +04:00
NTSTATUS status ;
2009-09-13 23:28:23 +04:00
struct netlogon_creds_CredentialState * creds = NULL ;
2009-08-26 00:38:55 +04:00
become_root ( ) ;
2010-02-18 22:44:09 +03:00
status = schannel_get_creds_state ( p - > mem_ctx ,
2010-02-19 00:17:06 +03:00
NULL , lp_private_dir ( ) ,
2010-02-18 22:44:09 +03:00
r - > in . computer_name , & creds ) ;
2009-08-26 00:38:55 +04:00
unbecome_root ( ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return status ;
}
2006-02-10 21:51:18 +03:00
/* Only allow this if the pipe is protected. */
2006-02-11 02:52:53 +03:00
if ( p - > auth . auth_type ! = PIPE_AUTH_TYPE_SCHANNEL ) {
2009-02-13 18:56:52 +03:00
DEBUG ( 0 , ( " _netr_LogonSamLogonEx: client %s not using schannel for netlogon \n " ,
2006-02-11 03:04:39 +03:00
get_remote_machine_name ( ) ) ) ;
2006-02-11 02:52:53 +03:00
return NT_STATUS_INVALID_PARAMETER ;
}
2006-02-10 21:51:18 +03:00
2009-08-26 00:38:55 +04:00
status = _netr_LogonSamLogon_base ( p , r , creds ) ;
TALLOC_FREE ( creds ) ;
2006-02-10 21:51:18 +03:00
2009-08-26 00:38:55 +04:00
return status ;
2006-02-10 21:05:55 +03:00
}
2004-04-13 18:39:48 +04:00
/*************************************************************************
_ds_enum_dom_trusts
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
#if 0 /* JERRY -- not correct */
2008-01-29 17:51:19 +03:00
NTSTATUS _ds_enum_dom_trusts ( pipes_struct * p , DS_Q_ENUM_DOM_TRUSTS * q_u ,
2004-04-13 18:39:48 +04:00
DS_R_ENUM_DOM_TRUSTS * r_u )
{
NTSTATUS status = NT_STATUS_OK ;
2001-10-31 13:46:25 +03:00
2008-02-13 14:24:56 +03:00
/* TODO: According to MSDN, the can only be executed against a
2004-04-13 18:39:48 +04:00
DC or domain member running Windows 2000 or later . Need
2008-02-13 14:24:56 +03:00
to test against a standalone 2 k server and see what it
does . A windows 2000 DC includes its own domain in the
2004-04-13 18:39:48 +04:00
list . - - jerry */
return status ;
}
# endif /* JERRY */
2008-01-31 02:38:12 +03:00
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_LogonUasLogon ( pipes_struct * p ,
struct netr_LogonUasLogon * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_LogonUasLogoff ( pipes_struct * p ,
struct netr_LogonUasLogoff * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_DatabaseDeltas ( pipes_struct * p ,
struct netr_DatabaseDeltas * r )
{
p - > rng_fault_state = true ;
return NT_STATUS_NOT_IMPLEMENTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_DatabaseSync ( pipes_struct * p ,
struct netr_DatabaseSync * r )
{
p - > rng_fault_state = true ;
return NT_STATUS_NOT_IMPLEMENTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_AccountDeltas ( pipes_struct * p ,
struct netr_AccountDeltas * r )
{
p - > rng_fault_state = true ;
return NT_STATUS_NOT_IMPLEMENTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_AccountSync ( pipes_struct * p ,
struct netr_AccountSync * r )
{
p - > rng_fault_state = true ;
return NT_STATUS_NOT_IMPLEMENTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-09-30 15:40:17 +04:00
static bool wb_getdcname ( TALLOC_CTX * mem_ctx ,
const char * domain ,
const char * * dcname ,
uint32_t flags ,
WERROR * werr )
{
wbcErr result ;
struct wbcDomainControllerInfo * dc_info = NULL ;
result = wbcLookupDomainController ( domain ,
flags ,
& dc_info ) ;
switch ( result ) {
case WBC_ERR_SUCCESS :
break ;
case WBC_ERR_WINBIND_NOT_AVAILABLE :
return false ;
case WBC_ERR_DOMAIN_NOT_FOUND :
* werr = WERR_NO_SUCH_DOMAIN ;
return true ;
default :
* werr = WERR_DOMAIN_CONTROLLER_NOT_FOUND ;
return true ;
}
* dcname = talloc_strdup ( mem_ctx , dc_info - > dc_name ) ;
wbcFreeMemory ( dc_info ) ;
if ( ! * dcname ) {
* werr = WERR_NOMEM ;
return false ;
}
* werr = WERR_OK ;
return true ;
}
/****************************************************************
_netr_GetDcName
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-01-31 02:38:12 +03:00
WERROR _netr_GetDcName ( pipes_struct * p ,
struct netr_GetDcName * r )
{
2009-09-30 15:40:17 +04:00
NTSTATUS status ;
WERROR werr ;
uint32_t flags ;
struct netr_DsRGetDCNameInfo * info ;
bool ret ;
ret = wb_getdcname ( p - > mem_ctx ,
r - > in . domainname ,
r - > out . dcname ,
WBC_LOOKUP_DC_IS_FLAT_NAME |
WBC_LOOKUP_DC_RETURN_FLAT_NAME |
WBC_LOOKUP_DC_PDC_REQUIRED ,
& werr ) ;
if ( ret = = true ) {
return werr ;
}
flags = DS_PDC_REQUIRED | DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME ;
status = dsgetdcname ( p - > mem_ctx ,
smbd_messaging_context ( ) ,
r - > in . domainname ,
NULL ,
NULL ,
flags ,
& info ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return ntstatus_to_werror ( status ) ;
}
* r - > out . dcname = talloc_strdup ( p - > mem_ctx , info - > dc_unc ) ;
talloc_free ( info ) ;
if ( ! * r - > out . dcname ) {
return WERR_NOMEM ;
}
return WERR_OK ;
2008-01-31 02:38:12 +03:00
}
/****************************************************************
2009-09-30 15:40:17 +04:00
_netr_GetAnyDCName
2008-01-31 02:38:12 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_GetAnyDCName ( pipes_struct * p ,
struct netr_GetAnyDCName * r )
{
2009-09-30 15:40:17 +04:00
NTSTATUS status ;
WERROR werr ;
uint32_t flags ;
struct netr_DsRGetDCNameInfo * info ;
bool ret ;
ret = wb_getdcname ( p - > mem_ctx ,
r - > in . domainname ,
r - > out . dcname ,
WBC_LOOKUP_DC_IS_FLAT_NAME |
WBC_LOOKUP_DC_RETURN_FLAT_NAME ,
& werr ) ;
if ( ret = = true ) {
return werr ;
}
flags = DS_IS_FLAT_NAME | DS_RETURN_FLAT_NAME ;
status = dsgetdcname ( p - > mem_ctx ,
smbd_messaging_context ( ) ,
r - > in . domainname ,
NULL ,
NULL ,
flags ,
& info ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return ntstatus_to_werror ( status ) ;
}
* r - > out . dcname = talloc_strdup ( p - > mem_ctx , info - > dc_unc ) ;
talloc_free ( info ) ;
if ( ! * r - > out . dcname ) {
return WERR_NOMEM ;
}
return WERR_OK ;
2008-01-31 02:38:12 +03:00
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_DatabaseSync2 ( pipes_struct * p ,
struct netr_DatabaseSync2 * r )
{
p - > rng_fault_state = true ;
return NT_STATUS_NOT_IMPLEMENTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_DatabaseRedo ( pipes_struct * p ,
struct netr_DatabaseRedo * r )
{
p - > rng_fault_state = true ;
return NT_STATUS_NOT_IMPLEMENTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsRGetDCName ( pipes_struct * p ,
struct netr_DsRGetDCName * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-02-16 12:20:55 +03:00
NTSTATUS _netr_LogonGetCapabilities ( pipes_struct * p ,
struct netr_LogonGetCapabilities * r )
2008-01-31 02:38:12 +03:00
{
2009-02-16 12:20:55 +03:00
return NT_STATUS_NOT_IMPLEMENTED ;
2008-01-31 02:38:12 +03:00
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_NETRLOGONSETSERVICEBITS ( pipes_struct * p ,
struct netr_NETRLOGONSETSERVICEBITS * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_LogonGetTrustRid ( pipes_struct * p ,
struct netr_LogonGetTrustRid * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_NETRLOGONCOMPUTESERVERDIGEST ( pipes_struct * p ,
struct netr_NETRLOGONCOMPUTESERVERDIGEST * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_NETRLOGONCOMPUTECLIENTDIGEST ( pipes_struct * p ,
struct netr_NETRLOGONCOMPUTECLIENTDIGEST * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsRGetDCNameEx ( pipes_struct * p ,
struct netr_DsRGetDCNameEx * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsRGetSiteName ( pipes_struct * p ,
struct netr_DsRGetSiteName * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_LogonGetDomainInfo ( pipes_struct * p ,
struct netr_LogonGetDomainInfo * r )
{
p - > rng_fault_state = true ;
return NT_STATUS_NOT_IMPLEMENTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_ServerPasswordGet ( pipes_struct * p ,
struct netr_ServerPasswordGet * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_NETRLOGONSENDTOSAM ( pipes_struct * p ,
struct netr_NETRLOGONSENDTOSAM * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsRAddressToSitenamesW ( pipes_struct * p ,
struct netr_DsRAddressToSitenamesW * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsRGetDCNameEx2 ( pipes_struct * p ,
struct netr_DsRGetDCNameEx2 * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN ( pipes_struct * p ,
struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_NetrEnumerateTrustedDomainsEx ( pipes_struct * p ,
struct netr_NetrEnumerateTrustedDomainsEx * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsRAddressToSitenamesExW ( pipes_struct * p ,
struct netr_DsRAddressToSitenamesExW * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsrGetDcSiteCoverageW ( pipes_struct * p ,
struct netr_DsrGetDcSiteCoverageW * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsrEnumerateDomainTrusts ( pipes_struct * p ,
struct netr_DsrEnumerateDomainTrusts * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsrDeregisterDNSHostRecords ( pipes_struct * p ,
struct netr_DsrDeregisterDNSHostRecords * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS _netr_ServerTrustPasswordsGet ( pipes_struct * p ,
struct netr_ServerTrustPasswordsGet * r )
{
p - > rng_fault_state = true ;
return NT_STATUS_NOT_IMPLEMENTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
WERROR _netr_DsRGetForestTrustInformation ( pipes_struct * p ,
struct netr_DsRGetForestTrustInformation * r )
{
p - > rng_fault_state = true ;
return WERR_NOT_SUPPORTED ;
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2010-02-23 05:18:07 +03:00
NTSTATUS _netr_GetForestTrustInformation ( pipes_struct * p ,
struct netr_GetForestTrustInformation * r )
2008-01-31 02:38:12 +03:00
{
p - > rng_fault_state = true ;
2010-02-23 05:18:07 +03:00
return NT_STATUS_NOT_IMPLEMENTED ;
2008-01-31 02:38:12 +03:00
}
/****************************************************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2008-12-13 02:27:25 +03:00
NTSTATUS _netr_ServerGetTrustInfo ( pipes_struct * p ,
struct netr_ServerGetTrustInfo * r )
2008-01-31 02:38:12 +03:00
{
p - > rng_fault_state = true ;
2008-12-13 02:27:25 +03:00
return NT_STATUS_NOT_IMPLEMENTED ;
2008-01-31 02:38:12 +03:00
}