source4/nbt_server/dgram/netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    NBT datagram netlogon server
   5
   6    Copyright (C) Andrew Tridgell        2005
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "nbt_server/nbt_server.h"
  25 #include "lib/socket/socket.h"
  26 #include <ldb.h>
  27 #include "dsdb/samdb/samdb.h"
  28 #include "auth/auth.h"
  29 #include "param/param.h"
  30 #include "samba/service_task.h"
  31 #include "dsdb/samdb/ldb_modules/util.h"
  32 #include "libcli/security/security.h"
  33 #include "nbt_server/dgram/proto.h"
  34 #include "libds/common/roles.h"
  35
  36 /*
  37   reply to a GETDC request
  38  */
  39 static NTSTATUS nbtd_netlogon_getdc(struct nbtd_server *nbtsrv,
  40                                     struct nbt_name *dst_name,
  41                                     struct nbt_netlogon_packet *netlogon,
  42                                     TALLOC_CTX *mem_ctx,
  43                                     struct nbt_netlogon_response **presponse,
  44                                     char **preply_mailslot)
  45 {
  46         struct nbt_netlogon_response_from_pdc *pdc;
  47         struct ldb_context *samctx;
  48         struct nbt_netlogon_response *response = NULL;
  49         char *reply_mailslot = NULL;
  50
  51         /* only answer getdc requests on the PDC or LOGON names */
  52         if ((dst_name->type != NBT_NAME_PDC) &&
  53             (dst_name->type != NBT_NAME_LOGON)) {
  54                 return NT_STATUS_NOT_SUPPORTED;
  55         }
  56
  57         samctx = nbtsrv->sam_ctx;
  58
  59         if (lpcfg_server_role(nbtsrv->task->lp_ctx) != ROLE_ACTIVE_DIRECTORY_DC
  60             || !samdb_is_pdc(samctx)) {
  61                 DEBUG(2, ("Not a PDC, so not processing LOGON_PRIMARY_QUERY\n"));
  62                 return NT_STATUS_NOT_SUPPORTED;
  63         }
  64
  65         if (strcasecmp_m(dst_name->name,
  66                          lpcfg_workgroup(nbtsrv->task->lp_ctx)) != 0) {
  67                 DBG_INFO("GetDC requested for a domain %s that we don't "
  68                          "host\n", dst_name->name);
  69                 return NT_STATUS_NOT_SUPPORTED;
  70         }
  71
  72         reply_mailslot = talloc_strdup(
  73                 mem_ctx, netlogon->req.pdc.mailslot_name);
  74         if (reply_mailslot == NULL) {
  75                 goto nomem;
  76         }
  77
  78         /* setup a GETDC reply */
  79         response = talloc_zero(mem_ctx, struct nbt_netlogon_response);
  80         if (response == NULL) {
  81                 goto nomem;
  82         }
  83         response->response_type = NETLOGON_GET_PDC;
  84         pdc = &response->data.get_pdc;
  85
  86         pdc->command = NETLOGON_RESPONSE_FROM_PDC;
  87
  88         pdc->pdc_name = talloc_strdup(
  89                 response, lpcfg_netbios_name(nbtsrv->task->lp_ctx));
  90         if (pdc->pdc_name == NULL) {
  91                 goto nomem;
  92         }
  93
  94         pdc->unicode_pdc_name = pdc->pdc_name;
  95
  96         pdc->domain_name = talloc_strdup(
  97                 response, lpcfg_workgroup(nbtsrv->task->lp_ctx));
  98         if (pdc->domain_name == NULL) {
  99                 goto nomem;
 100         }
 101
 102         pdc->nt_version       = 1;
 103         pdc->lmnt_token       = 0xFFFF;
 104         pdc->lm20_token       = 0xFFFF;
 105
 106         *presponse = response;
 107         *preply_mailslot = reply_mailslot;
 108         return NT_STATUS_OK;
 109
 110 nomem:
 111         TALLOC_FREE(response);
 112         TALLOC_FREE(reply_mailslot);
 113         return NT_STATUS_NO_MEMORY;
 114 }
 115
 116 /*
 117   reply to a ADS style GETDC request
 118  */
 119 static NTSTATUS nbtd_netlogon_samlogon(
 120         struct nbtd_server *nbtsrv,
 121         struct nbt_name *dst_name,
 122         const struct socket_address *src,
 123         struct nbt_netlogon_packet *netlogon,
 124         TALLOC_CTX *mem_ctx,
 125         struct nbt_netlogon_response **presponse,
 126         char **preply_mailslot)
 127 {
 128         struct ldb_context *samctx;
 129         struct dom_sid *sid = NULL;
 130         struct nbt_netlogon_response *response = NULL;
 131         char *reply_mailslot = NULL;
 132         NTSTATUS status;
 133
 134         /* only answer getdc requests on the PDC or LOGON names */
 135         if ((dst_name->type != NBT_NAME_PDC) &&
 136             (dst_name->type != NBT_NAME_LOGON)) {
 137                 return NT_STATUS_NOT_SUPPORTED;
 138         }
 139
 140         samctx = nbtsrv->sam_ctx;
 141
 142         if (netlogon->req.logon.sid_size != 0) {
 143                 sid = &netlogon->req.logon.sid;
 144         }
 145
 146         reply_mailslot = talloc_strdup(
 147                 mem_ctx, netlogon->req.logon.mailslot_name);
 148         if (reply_mailslot == NULL) {
 149                 return NT_STATUS_NO_MEMORY;
 150         }
 151
 152         response = talloc_zero(mem_ctx, struct nbt_netlogon_response);
 153         if (response == NULL) {
 154                 TALLOC_FREE(reply_mailslot);
 155                 return NT_STATUS_NO_MEMORY;
 156         }
 157         response->response_type = NETLOGON_SAMLOGON;
 158
 159         status = fill_netlogon_samlogon_response(
 160                 samctx, response, NULL, dst_name->name, sid, NULL,
 161                 netlogon->req.logon.user_name,
 162                 netlogon->req.logon.acct_control, src->addr,
 163                 netlogon->req.logon.nt_version, nbtsrv->task->lp_ctx,
 164                 &response->data.samlogon, false);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 struct dom_sid_buf buf;
 167
 168                 DBG_NOTICE("NBT netlogon query failed domain=%s sid=%s "
 169                            "version=%d - %s\n",
 170                            dst_name->name,
 171                            dom_sid_str_buf(sid, &buf),
 172                            netlogon->req.logon.nt_version,
 173                            nt_errstr(status));
 174                 TALLOC_FREE(reply_mailslot);
 175                 TALLOC_FREE(response);
 176                 return status;
 177         }
 178
 179         *presponse = response;
 180         *preply_mailslot = reply_mailslot;
 181         return NT_STATUS_OK;
 182 }
 183
 184 static NTSTATUS nbtd_mailslot_netlogon_reply(
 185         struct nbtd_interface *iface,
 186         struct nbt_dgram_packet *packet,
 187         struct socket_address *src,
 188         TALLOC_CTX *mem_ctx,
 189         struct nbt_netlogon_response **presponse,
 190         char **preply_mailslot)
 191 {
 192         struct nbt_netlogon_packet *netlogon;
 193         struct nbt_name *dst_name = &packet->data.msg.dest_name;
 194         struct nbt_netlogon_response *response = NULL;
 195         struct nbtd_iface_name *iname;
 196         char *reply_mailslot = NULL;
 197         NTSTATUS status;
 198
 199         /*
 200           see if the we are listening on the destination netbios name
 201         */
 202         iname = nbtd_find_iname(iface, dst_name, 0);
 203         if (iname == NULL) {
 204                 return NT_STATUS_BAD_NETWORK_NAME;
 205         }
 206
 207         netlogon = talloc(mem_ctx, struct nbt_netlogon_packet);
 208         if (netlogon == NULL) {
 209                 return NT_STATUS_NO_MEMORY;
 210         }
 211
 212         status = dgram_mailslot_netlogon_parse_request(netlogon, packet,
 213                                                        netlogon);
 214         if (!NT_STATUS_IS_OK(status)) {
 215                 goto failed;
 216         }
 217
 218         switch (netlogon->command) {
 219         case LOGON_PRIMARY_QUERY:
 220                 status = nbtd_netlogon_getdc(
 221                         iface->nbtsrv, &packet->data.msg.dest_name,
 222                         netlogon, mem_ctx, &response, &reply_mailslot);
 223                 break;
 224         case LOGON_SAM_LOGON_REQUEST:
 225                 status = nbtd_netlogon_samlogon(
 226                         iface->nbtsrv, &packet->data.msg.dest_name, src,
 227                         netlogon, mem_ctx, &response, &reply_mailslot);
 228                 break;
 229         default:
 230                 DEBUG(2,("unknown netlogon op %d from %s:%d\n",
 231                          netlogon->command, src->addr, src->port));
 232                 NDR_PRINT_DEBUG(nbt_netlogon_packet, netlogon);
 233                 status = NT_STATUS_NOT_SUPPORTED;
 234                 break;
 235         }
 236
 237         if (!NT_STATUS_IS_OK(status)) {
 238                 DBG_DEBUG("Calculating reply failed: %s\n",
 239                           nt_errstr(status));
 240                 goto failed;
 241         }
 242
 243         *presponse = response;
 244         *preply_mailslot = reply_mailslot;
 245         return NT_STATUS_OK;
 246
 247 failed:
 248         TALLOC_FREE(reply_mailslot);
 249         TALLOC_FREE(netlogon);
 250         return status;
 251 }
 252
 253 /*
 254   handle incoming netlogon mailslot requests
 255 */
 256 void nbtd_mailslot_netlogon_handler(struct dgram_mailslot_handler *dgmslot,
 257                                     struct nbt_dgram_packet *packet,
 258                                     struct socket_address *src)
 259 {
 260         NTSTATUS status = NT_STATUS_NO_MEMORY;
 261         struct nbtd_interface *iface =
 262                 talloc_get_type(dgmslot->private_data, struct nbtd_interface);
 263         struct nbtd_interface *reply_iface = nbtd_find_reply_iface(
 264                 iface, src->addr, false);
 265         struct nbt_netlogon_response *response = NULL;
 266         char *reply_mailslot = NULL;
 267
 268         if (reply_iface->ip_address == NULL) {
 269                 DBG_WARNING("Could not obtain own IP address for datagram "
 270                             "socket\n");
 271                 return;
 272         }
 273
 274         status = nbtd_mailslot_netlogon_reply(
 275                 iface, packet, src, dgmslot, &response, &reply_mailslot);
 276
 277         if (NT_STATUS_IS_OK(status)) {
 278                 dgram_mailslot_netlogon_reply(
 279                         reply_iface->dgmsock, packet,
 280                         lpcfg_netbios_name(iface->nbtsrv->task->lp_ctx),
 281                         reply_mailslot, response);
 282         }
 283
 284         TALLOC_FREE(response);
 285         TALLOC_FREE(reply_mailslot);
 286 }