samba-mirror/source3/auth/auth_netlogond.c

/*
   Unix SMB/CIFS implementation.
   Authenticate against a netlogon pipe listening on a unix domain socket
   Copyright (C) Volker Lendecke 2008

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "includes.h"
#include "auth.h"
#include "../libcli/auth/libcli_auth.h"
#include "../librpc/gen_ndr/ndr_netlogon.h"
#include "librpc/gen_ndr/ndr_schannel.h"
#include "rpc_client/cli_pipe.h"
#include "rpc_client/cli_netlogon.h"
#include "secrets.h"
#include "tldap.h"
#include "tldap_util.h"

#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH

static bool secrets_store_local_schannel_creds(
	const struct netlogon_creds_CredentialState *creds)
{
	DATA_BLOB blob;
	enum ndr_err_code ndr_err;
	bool ret;

	ndr_err = ndr_push_struct_blob(
		&blob, talloc_tos(), creds,
		(ndr_push_flags_fn_t)ndr_push_netlogon_creds_CredentialState);
	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
		DEBUG(10, ("ndr_push_netlogon_creds_CredentialState failed: "
			   "%s\n", ndr_errstr(ndr_err)));
		return false;
	}
	ret = secrets_store(SECRETS_LOCAL_SCHANNEL_KEY,
			    blob.data, blob.length);
	data_blob_free(&blob);
	return ret;
}

static struct netlogon_creds_CredentialState *
secrets_fetch_local_schannel_creds(TALLOC_CTX *mem_ctx)
{
	struct netlogon_creds_CredentialState *creds;
	enum ndr_err_code ndr_err;
	DATA_BLOB blob;

	blob.data = (uint8_t *)secrets_fetch(SECRETS_LOCAL_SCHANNEL_KEY,
					     &blob.length);
	if (blob.data == NULL) {
		DEBUG(10, ("secrets_fetch failed\n"));
		return NULL;
	}

	creds = talloc(mem_ctx, struct netlogon_creds_CredentialState);
	if (creds == NULL) {
		DEBUG(10, ("talloc failed\n"));
		SAFE_FREE(blob.data);
		return NULL;
	}
	ndr_err = ndr_pull_struct_blob(
		&blob, creds, creds,
		(ndr_pull_flags_fn_t)ndr_pull_netlogon_creds_CredentialState);
	SAFE_FREE(blob.data);
	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
		DEBUG(10, ("ndr_pull_netlogon_creds_CredentialState failed: "
			   "%s\n", ndr_errstr(ndr_err)));
		TALLOC_FREE(creds);
		return NULL;
	}

	return creds;
}

static NTSTATUS netlogond_validate(TALLOC_CTX *mem_ctx,
				   const struct auth_context *auth_context,
				   const char *ncalrpc_sockname,
				   struct netlogon_creds_CredentialState *creds,
				   const struct auth_usersupplied_info *user_info,
				   struct netr_SamInfo3 **pinfo3,
				   NTSTATUS *schannel_bind_result)
{
	struct rpc_pipe_client *p = NULL;
	struct pipe_auth_data *auth = NULL;
	struct netr_SamInfo3 *info3 = NULL;
	NTSTATUS status;

	*schannel_bind_result = NT_STATUS_OK;

	status = rpc_pipe_open_ncalrpc(talloc_tos(), ncalrpc_sockname,
				       &ndr_table_netlogon.syntax_id, &p);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("rpc_pipe_open_ncalrpc failed: %s\n",
			   nt_errstr(status)));
		return status;
	}

	p->dc = creds;

	status = rpccli_schannel_bind_data(p, lp_workgroup(),
					   DCERPC_AUTH_LEVEL_PRIVACY,
					   p->dc, &auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("rpccli_schannel_bind_data failed: %s\n",
			   nt_errstr(status)));
		TALLOC_FREE(p);
		return status;
	}

	status = rpc_pipe_bind(p, auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
		TALLOC_FREE(p);
		*schannel_bind_result = status;
		return status;
	}

	status = rpccli_netlogon_sam_network_logon_ex(
		p, p,
		user_info->logon_parameters,           /* flags such as 'allow
					                * workstation logon' */
		lp_netbios_name(),                       /* server name */
		user_info->client.account_name,        /* user name logging on. */
		user_info->client.domain_name,         /* domain name */
		user_info->workstation_name,           /* workstation name */
		(uchar *)auth_context->challenge.data, /* 8 byte challenge. */
		3,				       /* validation level */
		user_info->password.response.lanman,   /* lanman 24 byte response */
		user_info->password.response.nt,       /* nt 24 byte response */
		&info3);                               /* info3 out */

	DEBUG(10, ("rpccli_netlogon_sam_network_logon_ex returned %s\n",
		   nt_errstr(status)));

	if (!NT_STATUS_IS_OK(status)) {
		TALLOC_FREE(p);
		return status;
	}

	*pinfo3 = talloc_move(mem_ctx, &info3);

	TALLOC_FREE(p);
	return NT_STATUS_OK;
}

static NTSTATUS get_ldapi_ctx(TALLOC_CTX *mem_ctx, struct tldap_context **pld)
{
	struct tldap_context *ld;
	struct sockaddr_un addr;
	char *sockaddr;
	int fd;
	NTSTATUS status;
	int res;

	sockaddr = talloc_asprintf(talloc_tos(), "/%s/ldap_priv/ldapi",
				   lp_private_dir());
	if (sockaddr == NULL) {
		DEBUG(10, ("talloc failed\n"));
		return NT_STATUS_NO_MEMORY;
	}

	ZERO_STRUCT(addr);
	addr.sun_family = AF_UNIX;
	strncpy(addr.sun_path, sockaddr, sizeof(addr.sun_path));
	TALLOC_FREE(sockaddr);

	status = open_socket_out((struct sockaddr_storage *)(void *)&addr,
				 0, 0, &fd);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("Could not connect to %s: %s\n", addr.sun_path,
			   nt_errstr(status)));
		return status;
	}
	set_blocking(fd, false);

	ld = tldap_context_create(mem_ctx, fd);
	if (ld == NULL) {
		close(fd);
		return NT_STATUS_NO_MEMORY;
	}
	res = tldap_fetch_rootdse(ld);
	if (res != TLDAP_SUCCESS) {
		DEBUG(10, ("tldap_fetch_rootdse failed: %s\n",
			   tldap_errstr(talloc_tos(), ld, res)));
		TALLOC_FREE(ld);
		return NT_STATUS_LDAP(res);
	}
	*pld = ld;
	return NT_STATUS_OK;;
}

static NTSTATUS mymachinepw(uint8_t pwd[16])
{
	TALLOC_CTX *frame = talloc_stackframe();
	struct tldap_context *ld = NULL;
	struct tldap_message *rootdse, **msg;
	const char *attrs[1] = { "unicodePwd" };
	char *default_nc, *myname;
	int rc, num_msg;
	DATA_BLOB pwdblob;
	NTSTATUS status;

	status = get_ldapi_ctx(talloc_tos(), &ld);
	if (!NT_STATUS_IS_OK(status)) {
		goto fail;
	}
	rootdse = tldap_rootdse(ld);
	if (rootdse == NULL) {
		DEBUG(10, ("Could not get rootdse\n"));
		status = NT_STATUS_INTERNAL_ERROR;
		goto fail;
	}
	default_nc = tldap_talloc_single_attribute(
		rootdse, "defaultNamingContext", talloc_tos());
	if (default_nc == NULL) {
		DEBUG(10, ("Could not get defaultNamingContext\n"));
		status = NT_STATUS_NO_MEMORY;
		goto fail;
	}
	DEBUG(10, ("default_nc = %s\n", default_nc));

	myname = talloc_asprintf_strupper_m(talloc_tos(), "%s$",
					    lp_netbios_name());
	if (myname == NULL) {
		DEBUG(10, ("talloc failed\n"));
		status = NT_STATUS_NO_MEMORY;
		goto fail;
	}

	rc = tldap_search_fmt(
		ld, default_nc, TLDAP_SCOPE_SUB, attrs, ARRAY_SIZE(attrs), 0,
		talloc_tos(), &msg,
		"(&(sAMAccountName=%s)(objectClass=computer))", myname);
	if (rc != TLDAP_SUCCESS) {
		DEBUG(10, ("Could not retrieve our account: %s\n",
			   tldap_errstr(talloc_tos(), ld, rc)));
		status = NT_STATUS_LDAP(rc);
		goto fail;
	}
	num_msg = talloc_array_length(msg);
	if (num_msg != 1) {
		DEBUG(10, ("Got %d accounts, expected one\n", num_msg));
		status = NT_STATUS_INTERNAL_DB_CORRUPTION;
		goto fail;
	}
	if (!tldap_get_single_valueblob(msg[0], "unicodePwd", &pwdblob)) {
		char *dn = NULL;
		tldap_entry_dn(msg[0], &dn);
		DEBUG(10, ("No unicodePwd attribute in %s\n",
			   dn ? dn : "<unknown DN>"));
		status = NT_STATUS_INTERNAL_DB_CORRUPTION;
		goto fail;
	}
	if (pwdblob.length != 16) {
		DEBUG(10, ("Password hash hash has length %d, expected 16\n",
			   (int)pwdblob.length));
		status = NT_STATUS_INTERNAL_DB_CORRUPTION;
		goto fail;
	}
	memcpy(pwd, pwdblob.data, 16);

fail:
	TALLOC_FREE(frame);
	return status;
}

static NTSTATUS check_netlogond_security(const struct auth_context *auth_context,
					 void *my_private_data,
					 TALLOC_CTX *mem_ctx,
					 const struct auth_usersupplied_info *user_info,
					 struct auth_serversupplied_info **server_info)
{
	TALLOC_CTX *frame = talloc_stackframe();
	struct netr_SamInfo3 *info3 = NULL;
	struct rpc_pipe_client *p = NULL;
	struct pipe_auth_data *auth = NULL;
	uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
	uint8_t machine_password[16];
	struct netlogon_creds_CredentialState *creds;
	NTSTATUS schannel_bind_result, status;
	struct named_mutex *mutex = NULL;
	const char *ncalrpcsock;

	DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));

	ncalrpcsock = lp_parm_const_string(
		GLOBAL_SECTION_SNUM, "auth_netlogond", "socket", NULL);

	if (ncalrpcsock == NULL) {
		ncalrpcsock = talloc_asprintf(talloc_tos(), "%s/%s",
					      get_dyn_NCALRPCDIR(), "DEFAULT");
	}

	if (ncalrpcsock == NULL) {
		status = NT_STATUS_NO_MEMORY;
		goto done;
	}

	creds = secrets_fetch_local_schannel_creds(talloc_tos());
	if (creds == NULL) {
		goto new_key;
	}

	status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
				    creds, user_info, &info3,
				    &schannel_bind_result);

	DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));

	if (NT_STATUS_IS_OK(status)) {
		goto okay;
	}

	if (NT_STATUS_IS_OK(schannel_bind_result)) {
		/*
		 * This is a real failure from the DC
		 */
		goto done;
	}

 new_key:

	mutex = grab_named_mutex(talloc_tos(), "LOCAL_SCHANNEL_KEY", 60);
	if (mutex == NULL) {
		DEBUG(10, ("Could not get mutex LOCAL_SCHANNEL_KEY\n"));
		status = NT_STATUS_ACCESS_DENIED;
		goto done;
	}

	DEBUG(10, ("schannel bind failed, setting up new key\n"));

	status = rpc_pipe_open_ncalrpc(talloc_tos(), ncalrpcsock,
				       &ndr_table_netlogon.syntax_id, &p);

	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("rpc_pipe_open_ncalrpc failed: %s\n",
			   nt_errstr(status)));
		goto done;
	}

	status = rpccli_anon_bind_data(p, &auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("rpccli_anon_bind_data failed: %s\n",
			   nt_errstr(status)));
		goto done;
	}

	status = rpc_pipe_bind(p, auth);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
		goto done;
	}

	status = mymachinepw(machine_password);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("mymachinepw failed: %s\n", nt_errstr(status)));
		goto done;
	}

	DEBUG(10, ("machinepw "));
	dump_data(10, machine_password, 16);

	status = rpccli_netlogon_setup_creds(
		p, lp_netbios_name(), lp_workgroup(), lp_netbios_name(),
		lp_netbios_name(), machine_password, SEC_CHAN_BDC, &neg_flags);

	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("rpccli_netlogon_setup_creds failed: %s\n",
			   nt_errstr(status)));
		goto done;
	}

	secrets_store_local_schannel_creds(p->dc);

	/*
	 * Retry the authentication with the mutex held. This way nobody else
	 * can step on our toes.
	 */

	status = netlogond_validate(talloc_tos(), auth_context, ncalrpcsock,
				    p->dc, user_info, &info3,
				    &schannel_bind_result);

	TALLOC_FREE(p);

	DEBUG(10, ("netlogond_validate returned %s\n", nt_errstr(status)));

	if (!NT_STATUS_IS_OK(status)) {
		goto done;
	}

 okay:

	status = make_server_info_info3(mem_ctx, user_info->client.account_name,
					user_info->mapped.domain_name, server_info,
					info3);
	if (!NT_STATUS_IS_OK(status)) {
		DEBUG(10, ("make_server_info_info3 failed: %s\n",
			   nt_errstr(status)));
		TALLOC_FREE(frame);
		return status;
	}

	status = NT_STATUS_OK;

 done:
	TALLOC_FREE(frame);
	return status;
}

/* module initialisation */
static NTSTATUS auth_init_netlogond(struct auth_context *auth_context,
				    const char *param,
				    auth_methods **auth_method)
{
	struct auth_methods *result;

	result = talloc_zero(auth_context, struct auth_methods);
	if (result == NULL) {
		return NT_STATUS_NO_MEMORY;
	}
	result->name = "netlogond";
	result->auth = check_netlogond_security;

        *auth_method = result;
	return NT_STATUS_OK;
}

NTSTATUS auth_netlogond_init(void)
{
	smb_register_auth(AUTH_INTERFACE_VERSION, "netlogond",
			  auth_init_netlogond);
	return NT_STATUS_OK;
}