source3/rpc_client/cli_netlogon.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    NT Domain Authentication SMB / MSRPC client
   4    Copyright (C) Andrew Tridgell 1992-2000
   5    Copyright (C) Jeremy Allison                    1998.
   6    Largely re-written by Jeremy Allison (C)        2005.
   7    Copyright (C) Guenther Deschner                 2008.
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/filesys.h"
  25 #include "libsmb/libsmb.h"
  26 #include "rpc_client/rpc_client.h"
  27 #include "rpc_client/cli_pipe.h"
  28 #include "../libcli/auth/libcli_auth.h"
  29 #include "../libcli/auth/netlogon_creds_cli.h"
  30 #include "../librpc/gen_ndr/ndr_netlogon_c.h"
  31 #include "../librpc/gen_ndr/schannel.h"
  32 #include "rpc_client/cli_netlogon.h"
  33 #include "rpc_client/util_netlogon.h"
  34 #include "../libcli/security/security.h"
  35 #include "lib/param/param.h"
  36 #include "libcli/smb/smbXcli_base.h"
  37 #include "dbwrap/dbwrap.h"
  38 #include "dbwrap/dbwrap_open.h"
  39 #include "util_tdb.h"
  40 #include "lib/crypto/gnutls_helpers.h"
  41
  42
  43 NTSTATUS rpccli_pre_open_netlogon_creds(void)
  44 {
  45         static bool already_open = false;
  46         TALLOC_CTX *frame;
  47         struct loadparm_context *lp_ctx;
  48         char *fname;
  49         struct db_context *global_db;
  50         NTSTATUS status;
  51
  52         if (already_open) {
  53                 return NT_STATUS_OK;
  54         }
  55
  56         frame = talloc_stackframe();
  57
  58         lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());
  59         if (lp_ctx == NULL) {
  60                 TALLOC_FREE(frame);
  61                 return NT_STATUS_NO_MEMORY;
  62         }
  63
  64         fname = lpcfg_private_db_path(frame, lp_ctx, "netlogon_creds_cli");
  65         if (fname == NULL) {
  66                 TALLOC_FREE(frame);
  67                 return NT_STATUS_NO_MEMORY;
  68         }
  69
  70         global_db = db_open(frame, fname,
  71                             0, TDB_CLEAR_IF_FIRST|TDB_INCOMPATIBLE_HASH,
  72                             O_RDWR|O_CREAT, 0600, DBWRAP_LOCK_ORDER_2,
  73                             DBWRAP_FLAG_OPTIMIZE_READONLY_ACCESS);
  74         if (global_db == NULL) {
  75                 TALLOC_FREE(frame);
  76                 return NT_STATUS_NO_MEMORY;
  77         }
  78
  79         status = netlogon_creds_cli_set_global_db(lp_ctx, &global_db);
  80         TALLOC_FREE(frame);
  81         if (!NT_STATUS_IS_OK(status)) {
  82                 return status;
  83         }
  84
  85         already_open = true;
  86         return NT_STATUS_OK;
  87 }
  88
  89 static NTSTATUS rpccli_create_netlogon_creds(
  90         const char *server_computer,
  91         const char *server_netbios_domain,
  92         const char *server_dns_domain,
  93         const char *client_account,
  94         enum netr_SchannelType sec_chan_type,
  95         struct messaging_context *msg_ctx,
  96         TALLOC_CTX *mem_ctx,
  97         struct netlogon_creds_cli_context **netlogon_creds)
  98 {
  99         TALLOC_CTX *frame = talloc_stackframe();
 100         struct loadparm_context *lp_ctx;
 101         NTSTATUS status;
 102
 103         status = rpccli_pre_open_netlogon_creds();
 104         if (!NT_STATUS_IS_OK(status)) {
 105                 TALLOC_FREE(frame);
 106                 return status;
 107         }
 108
 109         lp_ctx = loadparm_init_s3(frame, loadparm_s3_helpers());
 110         if (lp_ctx == NULL) {
 111                 TALLOC_FREE(frame);
 112                 return NT_STATUS_NO_MEMORY;
 113         }
 114         status = netlogon_creds_cli_context_global(lp_ctx,
 115                                                    msg_ctx,
 116                                                    client_account,
 117                                                    sec_chan_type,
 118                                                    server_computer,
 119                                                    server_netbios_domain,
 120                                                    server_dns_domain,
 121                                                    mem_ctx, netlogon_creds);
 122         TALLOC_FREE(frame);
 123         if (!NT_STATUS_IS_OK(status)) {
 124                 return status;
 125         }
 126
 127         return NT_STATUS_OK;
 128 }
 129
 130 NTSTATUS rpccli_create_netlogon_creds_ctx(
 131         struct cli_credentials *creds,
 132         const char *server_computer,
 133         struct messaging_context *msg_ctx,
 134         TALLOC_CTX *mem_ctx,
 135         struct netlogon_creds_cli_context **creds_ctx)
 136 {
 137         enum netr_SchannelType sec_chan_type;
 138         const char *server_netbios_domain;
 139         const char *server_dns_domain;
 140         const char *client_account;
 141
 142         sec_chan_type = cli_credentials_get_secure_channel_type(creds);
 143         client_account = cli_credentials_get_username(creds);
 144         server_netbios_domain = cli_credentials_get_domain(creds);
 145         server_dns_domain = cli_credentials_get_realm(creds);
 146
 147         return rpccli_create_netlogon_creds(server_computer,
 148                                             server_netbios_domain,
 149                                             server_dns_domain,
 150                                             client_account,
 151                                             sec_chan_type,
 152                                             msg_ctx, mem_ctx,
 153                                             creds_ctx);
 154 }
 155
 156 static NTSTATUS rpccli_setup_netlogon_creds_locked(
 157         struct cli_state *cli,
 158         enum dcerpc_transport_t transport,
 159         const char *remote_name,
 160         const struct sockaddr_storage *remote_sockaddr,
 161         struct netlogon_creds_cli_context *creds_ctx,
 162         bool force_reauth,
 163         struct cli_credentials *cli_creds,
 164         TALLOC_CTX *mem_ctx,
 165         struct rpc_pipe_client **_netlogon_pipe,
 166         uint32_t *negotiate_flags)
 167 {
 168         TALLOC_CTX *frame = talloc_stackframe();
 169         struct rpc_pipe_client *netlogon_pipe = NULL;
 170         struct netlogon_creds_CredentialState *creds = NULL;
 171         uint8_t num_nt_hashes = 0;
 172         const struct samr_Password *nt_hashes[2] = { NULL, NULL };
 173         uint8_t idx_nt_hashes = 0;
 174         NTSTATUS status;
 175
 176         status = netlogon_creds_cli_get(creds_ctx, frame, &creds);
 177         if (NT_STATUS_IS_OK(status)) {
 178                 const char *action = "using";
 179
 180                 if (force_reauth) {
 181                         action = "overwrite";
 182                 }
 183
 184                 if (cli != NULL) {
 185                         remote_name = smbXcli_conn_remote_name(cli->conn);
 186                 } else {
 187                         remote_name = "<UNKNOWN>";
 188                 }
 189
 190                 DEBUG(5,("%s: %s cached netlogon_creds cli[%s/%s] to %s\n",
 191                          __FUNCTION__, action,
 192                          creds->account_name, creds->computer_name,
 193                          remote_name));
 194                 if (!force_reauth) {
 195                         goto done;
 196                 }
 197                 TALLOC_FREE(creds);
 198         }
 199
 200         nt_hashes[0] = cli_credentials_get_nt_hash(cli_creds, talloc_tos());
 201         if (nt_hashes[0] == NULL) {
 202                 TALLOC_FREE(frame);
 203                 return NT_STATUS_NO_MEMORY;
 204         }
 205         num_nt_hashes = 1;
 206
 207         nt_hashes[1] = cli_credentials_get_old_nt_hash(cli_creds,
 208                                                        talloc_tos());
 209         if (nt_hashes[1] != NULL) {
 210                 num_nt_hashes = 2;
 211         }
 212
 213         status = cli_rpc_pipe_open_noauth_transport(cli,
 214                                                     transport,
 215                                                     &ndr_table_netlogon,
 216                                                     remote_name,
 217                                                     remote_sockaddr,
 218                                                     &netlogon_pipe);
 219         if (!NT_STATUS_IS_OK(status)) {
 220                 DEBUG(5,("%s: failed to open noauth netlogon connection to %s - %s\n",
 221                          __FUNCTION__,
 222                          remote_name,
 223                          nt_errstr(status)));
 224                 TALLOC_FREE(frame);
 225                 return status;
 226         }
 227         talloc_steal(frame, netlogon_pipe);
 228
 229         status = netlogon_creds_cli_auth(creds_ctx,
 230                                          netlogon_pipe->binding_handle,
 231                                          num_nt_hashes,
 232                                          nt_hashes,
 233                                          &idx_nt_hashes);
 234         if (!NT_STATUS_IS_OK(status)) {
 235                 TALLOC_FREE(frame);
 236                 return status;
 237         }
 238
 239         status = netlogon_creds_cli_get(creds_ctx, frame, &creds);
 240         if (!NT_STATUS_IS_OK(status)) {
 241                 TALLOC_FREE(frame);
 242                 return NT_STATUS_INTERNAL_ERROR;
 243         }
 244
 245         DEBUG(5,("%s: using new netlogon_creds cli[%s/%s] to %s\n",
 246                  __FUNCTION__,
 247                  creds->account_name, creds->computer_name,
 248                  remote_name));
 249
 250 done:
 251         if (_netlogon_pipe != NULL) {
 252                 *_netlogon_pipe = talloc_move(mem_ctx, &netlogon_pipe);
 253         }
 254
 255         if (negotiate_flags != NULL) {
 256                 *negotiate_flags = creds->negotiate_flags;
 257         }
 258
 259         TALLOC_FREE(frame);
 260         return NT_STATUS_OK;
 261 }
 262
 263 NTSTATUS rpccli_setup_netlogon_creds(
 264         struct cli_state *cli,
 265         enum dcerpc_transport_t transport,
 266         const char *remote_name,
 267         const struct sockaddr_storage *remote_sockaddr,
 268         struct netlogon_creds_cli_context *creds_ctx,
 269         bool force_reauth,
 270         struct cli_credentials *cli_creds)
 271 {
 272         TALLOC_CTX *frame = talloc_stackframe();
 273         struct netlogon_creds_cli_lck *lck;
 274         NTSTATUS status;
 275
 276         status = netlogon_creds_cli_lck(
 277                 creds_ctx, NETLOGON_CREDS_CLI_LCK_EXCLUSIVE,
 278                 frame, &lck);
 279         if (!NT_STATUS_IS_OK(status)) {
 280                 DBG_WARNING("netlogon_creds_cli_lck failed: %s\n",
 281                             nt_errstr(status));
 282                 TALLOC_FREE(frame);
 283                 return status;
 284         }
 285
 286         status = rpccli_setup_netlogon_creds_locked(cli,
 287                                                     transport,
 288                                                     remote_name,
 289                                                     remote_sockaddr,
 290                                                     creds_ctx,
 291                                                     force_reauth,
 292                                                     cli_creds,
 293                                                     NULL,
 294                                                     NULL,
 295                                                     NULL);
 296
 297         TALLOC_FREE(frame);
 298
 299         return status;
 300 }
 301
 302 NTSTATUS rpccli_connect_netlogon(
 303         struct cli_state *cli,
 304         enum dcerpc_transport_t transport,
 305         const char *remote_name,
 306         const struct sockaddr_storage *remote_sockaddr,
 307         struct netlogon_creds_cli_context *creds_ctx,
 308         bool force_reauth,
 309         struct cli_credentials *trust_creds,
 310         struct rpc_pipe_client **_rpccli)
 311 {
 312         TALLOC_CTX *frame = talloc_stackframe();
 313         struct netlogon_creds_CredentialState *creds = NULL;
 314         enum netlogon_creds_cli_lck_type lck_type;
 315         enum netr_SchannelType sec_chan_type;
 316         struct netlogon_creds_cli_lck *lck = NULL;
 317         uint32_t negotiate_flags;
 318         uint8_t found_session_key[16] = {0};
 319         bool found_existing_creds = false;
 320         bool do_serverauth;
 321         struct rpc_pipe_client *rpccli;
 322         NTSTATUS status;
 323         bool retry = false;
 324
 325         sec_chan_type = cli_credentials_get_secure_channel_type(trust_creds);
 326         if (sec_chan_type == SEC_CHAN_NULL) {
 327                 DBG_ERR("secure_channel_type gave SEC_CHAN_NULL\n");
 328                 status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 329                 goto fail;
 330         }
 331
 332 again:
 333
 334         /*
 335          * See whether we can use existing netlogon_creds or
 336          * whether we have to serverauthenticate.
 337          */
 338         status = netlogon_creds_cli_get(creds_ctx, frame, &creds);
 339
 340         if (NT_STATUS_IS_OK(status)) {
 341                 bool cmp = mem_equal_const_time(found_session_key,
 342                                                 creds->session_key,
 343                                                 sizeof(found_session_key));
 344                 found_existing_creds = !cmp;
 345
 346                 memcpy(found_session_key,
 347                        creds->session_key,
 348                        sizeof(found_session_key));
 349
 350                 TALLOC_FREE(creds);
 351         }
 352
 353         lck_type = (force_reauth || !found_existing_creds) ?
 354                 NETLOGON_CREDS_CLI_LCK_EXCLUSIVE :
 355                 NETLOGON_CREDS_CLI_LCK_SHARED;
 356
 357         status = netlogon_creds_cli_lck(creds_ctx, lck_type, frame, &lck);
 358         if (!NT_STATUS_IS_OK(status)) {
 359                 DBG_DEBUG("netlogon_creds_cli_lck failed: %s\n",
 360                           nt_errstr(status));
 361                 goto fail;
 362         }
 363
 364         if (!found_existing_creds) {
 365                 /*
 366                  * Try to find creds under the lock again. Someone
 367                  * else might have done it for us.
 368                  */
 369                 status = netlogon_creds_cli_get(creds_ctx, frame, &creds);
 370
 371                 if (NT_STATUS_IS_OK(status)) {
 372                         bool cmp = mem_equal_const_time(found_session_key,
 373                                                         creds->session_key,
 374                                                         sizeof(found_session_key));
 375                         found_existing_creds = !cmp;
 376
 377                         memcpy(found_session_key, creds->session_key,
 378                                sizeof(found_session_key));
 379
 380                         TALLOC_FREE(creds);
 381                 }
 382         }
 383
 384         do_serverauth = force_reauth || !found_existing_creds;
 385
 386         if (!do_serverauth) {
 387                 /*
 388                  * Do the quick schannel bind without a reauth
 389                  */
 390                 status = cli_rpc_pipe_open_bind_schannel(cli,
 391                                                          &ndr_table_netlogon,
 392                                                          transport,
 393                                                          creds_ctx,
 394                                                          remote_name,
 395                                                          remote_sockaddr,
 396                                                          &rpccli);
 397                 if (!retry && NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
 398                         DBG_DEBUG("Retrying with serverauthenticate\n");
 399                         TALLOC_FREE(lck);
 400                         retry = true;
 401                         goto again;
 402                 }
 403                 if (!NT_STATUS_IS_OK(status)) {
 404                         DBG_DEBUG("cli_rpc_pipe_open_bind_schannel "
 405                                   "failed: %s\n", nt_errstr(status));
 406                         goto fail;
 407                 }
 408                 goto done;
 409         }
 410
 411         if (cli_credentials_is_anonymous(trust_creds)) {
 412                 DBG_WARNING("get_trust_credential for %s only gave anonymous,"
 413                             "unable to negotiate NETLOGON credentials\n",
 414                             netlogon_creds_cli_debug_string(
 415                                     creds_ctx, frame));
 416                 status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 417                 goto fail;
 418         }
 419
 420         status = rpccli_setup_netlogon_creds_locked(cli,
 421                                                     transport,
 422                                                     remote_name,
 423                                                     remote_sockaddr,
 424                                                     creds_ctx,
 425                                                     true,
 426                                                     trust_creds,
 427                                                     NULL,
 428                                                     &rpccli,
 429                                                     &negotiate_flags);
 430         if (!NT_STATUS_IS_OK(status)) {
 431                 DBG_DEBUG("rpccli_setup_netlogon_creds failed for %s, "
 432                           "unable to setup NETLOGON credentials: %s\n",
 433                           netlogon_creds_cli_debug_string(
 434                                   creds_ctx, frame),
 435                           nt_errstr(status));
 436                 goto fail;
 437         }
 438         talloc_steal(frame, rpccli);
 439
 440         if (!(negotiate_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
 441                 if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
 442                         status = NT_STATUS_DOWNGRADE_DETECTED;
 443                         DBG_WARNING("Unwilling to make connection to %s"
 444                                     "without connection level security, "
 445                                     "must set 'winbind sealed pipes = false'"
 446                                     " and 'require strong key = false' "
 447                                     "to proceed: %s\n",
 448                                     netlogon_creds_cli_debug_string(
 449                                             creds_ctx, frame),
 450                                     nt_errstr(status));
 451                         goto fail;
 452                 }
 453
 454                 /*
 455                  * we keep the AUTH_TYPE_NONE rpccli for the
 456                  * caller...
 457                  */
 458                 goto done;
 459         }
 460
 461         status = cli_rpc_pipe_client_prepare_alter(rpccli,
 462                                                    true, /* new_auth_context */
 463                                                    &ndr_table_netlogon,
 464                                                    false); /* new_pres_context */
 465         if (!NT_STATUS_IS_OK(status)) {
 466                 DBG_WARNING("cli_rpc_pipe_client_prepare_alter "
 467                             "failed: %s\n", nt_errstr(status));
 468                 goto fail;
 469         }
 470
 471         status = cli_rpc_pipe_client_auth_schannel(rpccli,
 472                                                    &ndr_table_netlogon,
 473                                                    creds_ctx);
 474         if (!NT_STATUS_IS_OK(status)) {
 475                 DBG_DEBUG("cli_rpc_pipe_client_auth_schannel "
 476                           "failed: %s\n", nt_errstr(status));
 477                 goto fail;
 478         }
 479
 480         status = netlogon_creds_cli_check(creds_ctx, rpccli->binding_handle,
 481                                           NULL);
 482         if (!NT_STATUS_IS_OK(status)) {
 483                 DBG_WARNING("netlogon_creds_cli_check failed: %s\n",
 484                             nt_errstr(status));
 485                 goto fail;
 486         }
 487
 488 done:
 489         *_rpccli = talloc_move(NULL, &rpccli);
 490         status = NT_STATUS_OK;
 491 fail:
 492         ZERO_STRUCT(found_session_key);
 493         TALLOC_FREE(lck);
 494         TALLOC_FREE(frame);
 495         return status;
 496 }
 497
 498 /* Logon domain user */
 499
 500 NTSTATUS rpccli_netlogon_password_logon(
 501         struct netlogon_creds_cli_context *creds_ctx,
 502         struct dcerpc_binding_handle *binding_handle,
 503         TALLOC_CTX *mem_ctx,
 504         uint32_t logon_parameters,
 505         const char *domain,
 506         const char *username,
 507         const char *password,
 508         const char *workstation,
 509         const uint64_t logon_id,
 510         enum netr_LogonInfoClass logon_type,
 511         uint8_t *authoritative,
 512         uint32_t *flags,
 513         uint16_t *_validation_level,
 514         union netr_Validation **_validation)
 515 {
 516         TALLOC_CTX *frame = talloc_stackframe();
 517         NTSTATUS status;
 518         union netr_LogonLevel *logon;
 519         uint16_t validation_level = 0;
 520         union netr_Validation *validation = NULL;
 521         char *workstation_slash = NULL;
 522
 523         unsigned char local_nt_response[24];
 524         unsigned char local_lm_response[24];
 525         struct samr_Password lmpassword = {.hash = {0}};
 526         struct samr_Password ntpassword = {.hash = {0}};
 527         struct netr_ChallengeResponse lm = {0};
 528         struct netr_ChallengeResponse nt = {0};
 529
 530         logon = talloc_zero(frame, union netr_LogonLevel);
 531         if (logon == NULL) {
 532                 TALLOC_FREE(frame);
 533                 return NT_STATUS_NO_MEMORY;
 534         }
 535
 536         if (workstation == NULL) {
 537                 workstation = lp_netbios_name();
 538         }
 539
 540         workstation_slash = talloc_asprintf(frame, "\\\\%s", workstation);
 541         if (workstation_slash == NULL) {
 542                 TALLOC_FREE(frame);
 543                 return NT_STATUS_NO_MEMORY;
 544         }
 545
 546         /* Initialise input parameters */
 547
 548         switch (logon_type) {
 549         case NetlogonInteractiveInformation:
 550         case NetlogonInteractiveTransitiveInformation: {
 551
 552                 struct netr_PasswordInfo *password_info;
 553
 554
 555                 password_info = talloc_zero(frame, struct netr_PasswordInfo);
 556                 if (password_info == NULL) {
 557                         TALLOC_FREE(frame);
 558                         return NT_STATUS_NO_MEMORY;
 559                 }
 560
 561                 nt_lm_owf_gen(password, ntpassword.hash, lmpassword.hash);
 562
 563                 password_info->identity_info.domain_name.string         = domain;
 564                 password_info->identity_info.parameter_control          = logon_parameters;
 565                 password_info->identity_info.logon_id                   = logon_id;
 566                 password_info->identity_info.account_name.string        = username;
 567                 password_info->identity_info.workstation.string         = workstation_slash;
 568
 569                 password_info->lmpassword = lmpassword;
 570                 password_info->ntpassword = ntpassword;
 571
 572                 logon->password = password_info;
 573
 574                 break;
 575         }
 576         case NetlogonNetworkInformation:
 577         case NetlogonNetworkTransitiveInformation: {
 578                 struct netr_NetworkInfo *network_info;
 579                 uint8_t chal[8];
 580                 int rc;
 581
 582                 ZERO_STRUCT(lm);
 583                 ZERO_STRUCT(nt);
 584
 585                 network_info = talloc_zero(frame, struct netr_NetworkInfo);
 586                 if (network_info == NULL) {
 587                         TALLOC_FREE(frame);
 588                         return NT_STATUS_NO_MEMORY;
 589                 }
 590
 591                 generate_random_buffer(chal, 8);
 592
 593                 SMBencrypt(password, chal, local_lm_response);
 594                 rc = SMBNTencrypt(password, chal, local_nt_response);
 595                 if (rc != 0) {
 596                         TALLOC_FREE(frame);
 597                         return gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
 598                 }
 599
 600                 lm.length = 24;
 601                 lm.data = local_lm_response;
 602
 603                 nt.length = 24;
 604                 nt.data = local_nt_response;
 605
 606                 network_info->identity_info.domain_name.string          = domain;
 607                 network_info->identity_info.parameter_control           = logon_parameters;
 608                 network_info->identity_info.logon_id                    = logon_id;
 609                 network_info->identity_info.account_name.string         = username;
 610                 network_info->identity_info.workstation.string          = workstation_slash;
 611
 612                 memcpy(network_info->challenge, chal, 8);
 613                 network_info->nt = nt;
 614                 network_info->lm = lm;
 615
 616                 logon->network = network_info;
 617
 618                 break;
 619         }
 620         default:
 621                 DEBUG(0, ("switch value %d not supported\n",
 622                         logon_type));
 623                 TALLOC_FREE(frame);
 624                 return NT_STATUS_INVALID_INFO_CLASS;
 625         }
 626
 627         status = netlogon_creds_cli_LogonSamLogon(creds_ctx,
 628                                                   binding_handle,
 629                                                   logon_type,
 630                                                   logon,
 631                                                   mem_ctx,
 632                                                   &validation_level,
 633                                                   &validation,
 634                                                   authoritative,
 635                                                   flags);
 636         if (!NT_STATUS_IS_OK(status)) {
 637                 TALLOC_FREE(frame);
 638                 return status;
 639         }
 640
 641         TALLOC_FREE(frame);
 642         *_validation_level = validation_level;
 643         *_validation = validation;
 644
 645         return NT_STATUS_OK;
 646 }
 647
 648 /**
 649  * Logon domain user with an 'network' SAM logon
 650  *
 651  * @param info3 Pointer to a NET_USER_INFO_3 already allocated by the caller.
 652  **/
 653
 654
 655 NTSTATUS rpccli_netlogon_network_logon(
 656         struct netlogon_creds_cli_context *creds_ctx,
 657         struct dcerpc_binding_handle *binding_handle,
 658         TALLOC_CTX *mem_ctx,
 659         uint32_t logon_parameters,
 660         const char *username,
 661         const char *domain,
 662         const char *workstation,
 663         const uint64_t logon_id,
 664         DATA_BLOB chal,
 665         DATA_BLOB lm_response,
 666         DATA_BLOB nt_response,
 667         enum netr_LogonInfoClass logon_type,
 668         uint8_t *authoritative,
 669         uint32_t *flags,
 670         uint16_t *_validation_level,
 671         union netr_Validation **_validation)
 672 {
 673         NTSTATUS status;
 674         const char *workstation_name_slash;
 675         union netr_LogonLevel *logon = NULL;
 676         struct netr_NetworkInfo *network_info;
 677         uint16_t validation_level = 0;
 678         union netr_Validation *validation = NULL;
 679         struct netr_ChallengeResponse lm;
 680         struct netr_ChallengeResponse nt;
 681
 682         *_validation = NULL;
 683
 684         ZERO_STRUCT(lm);
 685         ZERO_STRUCT(nt);
 686
 687         switch (logon_type) {
 688         case NetlogonNetworkInformation:
 689         case NetlogonNetworkTransitiveInformation:
 690                 break;
 691         default:
 692                 DEBUG(0, ("switch value %d not supported\n",
 693                         logon_type));
 694                 return NT_STATUS_INVALID_INFO_CLASS;
 695         }
 696
 697         logon = talloc_zero(mem_ctx, union netr_LogonLevel);
 698         if (!logon) {
 699                 return NT_STATUS_NO_MEMORY;
 700         }
 701
 702         network_info = talloc_zero(mem_ctx, struct netr_NetworkInfo);
 703         if (!network_info) {
 704                 return NT_STATUS_NO_MEMORY;
 705         }
 706
 707         if (workstation == NULL) {
 708                 workstation = lp_netbios_name();
 709         }
 710
 711         if (workstation[0] != '\\' && workstation[1] != '\\') {
 712                 workstation_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", workstation);
 713         } else {
 714                 workstation_name_slash = workstation;
 715         }
 716
 717         if (!workstation_name_slash) {
 718                 DEBUG(0, ("talloc_asprintf failed!\n"));
 719                 return NT_STATUS_NO_MEMORY;
 720         }
 721
 722         /* Initialise input parameters */
 723
 724         lm.data = lm_response.data;
 725         lm.length = lm_response.length;
 726         nt.data = nt_response.data;
 727         nt.length = nt_response.length;
 728
 729         network_info->identity_info.domain_name.string          = domain;
 730         network_info->identity_info.parameter_control           = logon_parameters;
 731         network_info->identity_info.logon_id                    = logon_id;
 732         network_info->identity_info.account_name.string         = username;
 733         network_info->identity_info.workstation.string          = workstation_name_slash;
 734
 735         if (chal.length != 8) {
 736                 DBG_WARNING("Invalid challenge length %zd\n", chal.length);
 737                 return NT_STATUS_INVALID_PARAMETER;
 738         }
 739
 740         memcpy(network_info->challenge, chal.data, chal.length);
 741         network_info->nt = nt;
 742         network_info->lm = lm;
 743
 744         logon->network = network_info;
 745
 746         /* Marshall data and send request */
 747
 748         status = netlogon_creds_cli_LogonSamLogon(creds_ctx,
 749                                                   binding_handle,
 750                                                   logon_type,
 751                                                   logon,
 752                                                   mem_ctx,
 753                                                   &validation_level,
 754                                                   &validation,
 755                                                   authoritative,
 756                                                   flags);
 757         if (!NT_STATUS_IS_OK(status)) {
 758                 return status;
 759         }
 760
 761         *_validation_level = validation_level;
 762         *_validation = validation;
 763
 764         return NT_STATUS_OK;
 765 }
 766
 767 NTSTATUS rpccli_netlogon_interactive_logon(
 768         struct netlogon_creds_cli_context *creds_ctx,
 769         struct dcerpc_binding_handle *binding_handle,
 770         TALLOC_CTX *mem_ctx,
 771         uint32_t logon_parameters,
 772         const char *username,
 773         const char *domain,
 774         const char *workstation,
 775         const uint64_t logon_id,
 776         DATA_BLOB lm_hash,
 777         DATA_BLOB nt_hash,
 778         enum netr_LogonInfoClass logon_type,
 779         uint8_t *authoritative,
 780         uint32_t *flags,
 781         uint16_t *_validation_level,
 782         union netr_Validation **_validation)
 783 {
 784         TALLOC_CTX *frame = talloc_stackframe();
 785         NTSTATUS status;
 786         const char *workstation_name_slash;
 787         union netr_LogonLevel *logon = NULL;
 788         struct netr_PasswordInfo *password_info = NULL;
 789         uint16_t validation_level = 0;
 790         union netr_Validation *validation = NULL;
 791         struct netr_ChallengeResponse lm;
 792         struct netr_ChallengeResponse nt;
 793
 794         *_validation = NULL;
 795
 796         ZERO_STRUCT(lm);
 797         ZERO_STRUCT(nt);
 798
 799         switch (logon_type) {
 800         case NetlogonInteractiveInformation:
 801         case NetlogonInteractiveTransitiveInformation:
 802                 break;
 803         default:
 804                 DEBUG(0, ("switch value %d not supported\n",
 805                         logon_type));
 806                 TALLOC_FREE(frame);
 807                 return NT_STATUS_INVALID_INFO_CLASS;
 808         }
 809
 810         logon = talloc_zero(mem_ctx, union netr_LogonLevel);
 811         if (logon == NULL) {
 812                 TALLOC_FREE(frame);
 813                 return NT_STATUS_NO_MEMORY;
 814         }
 815
 816         password_info = talloc_zero(logon, struct netr_PasswordInfo);
 817         if (password_info == NULL) {
 818                 TALLOC_FREE(frame);
 819                 return NT_STATUS_NO_MEMORY;
 820         }
 821
 822         if (workstation[0] != '\\' && workstation[1] != '\\') {
 823                 workstation_name_slash = talloc_asprintf(frame, "\\\\%s", workstation);
 824         } else {
 825                 workstation_name_slash = workstation;
 826         }
 827
 828         if (workstation_name_slash == NULL) {
 829                 TALLOC_FREE(frame);
 830                 return NT_STATUS_NO_MEMORY;
 831         }
 832
 833         /* Initialise input parameters */
 834
 835         password_info->identity_info.domain_name.string         = domain;
 836         password_info->identity_info.parameter_control          = logon_parameters;
 837         password_info->identity_info.logon_id                   = logon_id;
 838         password_info->identity_info.account_name.string        = username;
 839         password_info->identity_info.workstation.string         = workstation_name_slash;
 840
 841         if (nt_hash.length != sizeof(password_info->ntpassword.hash)) {
 842                 TALLOC_FREE(frame);
 843                 return NT_STATUS_INVALID_PARAMETER;
 844         }
 845         memcpy(password_info->ntpassword.hash, nt_hash.data, nt_hash.length);
 846         if (lm_hash.length != 0) {
 847                 if (lm_hash.length != sizeof(password_info->lmpassword.hash)) {
 848                         TALLOC_FREE(frame);
 849                         return NT_STATUS_INVALID_PARAMETER;
 850                 }
 851                 memcpy(password_info->lmpassword.hash, lm_hash.data, lm_hash.length);
 852         }
 853
 854         logon->password = password_info;
 855
 856         /* Marshall data and send request */
 857
 858         status = netlogon_creds_cli_LogonSamLogon(creds_ctx,
 859                                                   binding_handle,
 860                                                   logon_type,
 861                                                   logon,
 862                                                   mem_ctx,
 863                                                   &validation_level,
 864                                                   &validation,
 865                                                   authoritative,
 866                                                   flags);
 867         if (!NT_STATUS_IS_OK(status)) {
 868                 TALLOC_FREE(frame);
 869                 return status;
 870         }
 871
 872         *_validation_level = validation_level;
 873         *_validation = validation;
 874
 875         TALLOC_FREE(frame);
 876         return NT_STATUS_OK;
 877 }