diff options
Diffstat (limited to 'source4/nbt_server/dgram')
| -rw-r--r-- | source4/nbt_server/dgram/browse.c | 85 | ||||
| -rw-r--r-- | source4/nbt_server/dgram/netlogon.c | 286 | ||||
| -rw-r--r-- | source4/nbt_server/dgram/ntlogon.c | 121 | ||||
| -rw-r--r-- | source4/nbt_server/dgram/request.c | 150 |
4 files changed, 642 insertions, 0 deletions
diff --git a/source4/nbt_server/dgram/browse.c b/source4/nbt_server/dgram/browse.c new file mode 100644 index 0000000..1e4f28b --- /dev/null +++ b/source4/nbt_server/dgram/browse.c @@ -0,0 +1,85 @@ +/* + Unix SMB/CIFS implementation. + + NBT datagram browse server + + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "nbt_server/nbt_server.h" +#include "lib/socket/socket.h" +#include "librpc/gen_ndr/ndr_nbt.h" +#include "nbt_server/dgram/proto.h" + +static const char *nbt_browse_opcode_string(enum nbt_browse_opcode r) +{ + const char *val = NULL; + + switch (r) { + case HostAnnouncement: val = "HostAnnouncement"; break; + case AnnouncementRequest: val = "AnnouncementRequest"; break; + case Election: val = "Election"; break; + case GetBackupListReq: val = "GetBackupListReq"; break; + case GetBackupListResp: val = "GetBackupListResp"; break; + case BecomeBackup: val = "BecomeBackup"; break; + case DomainAnnouncement: val = "DomainAnnouncement"; break; + case MasterAnnouncement: val = "MasterAnnouncement"; break; + case ResetBrowserState: val = "ResetBrowserState"; break; + case LocalMasterAnnouncement: val = "LocalMasterAnnouncement"; break; + } + + return val; +} + +/* + handle incoming browse mailslot requests +*/ +void nbtd_mailslot_browse_handler(struct dgram_mailslot_handler *dgmslot, + struct nbt_dgram_packet *packet, + struct socket_address *src) +{ + struct nbt_browse_packet *browse = talloc(dgmslot, struct nbt_browse_packet); + struct nbt_name *name = &packet->data.msg.dest_name; + NTSTATUS status; + + if (browse == NULL) { + status = NT_STATUS_INVALID_PARAMETER; + goto failed; + } + + status = dgram_mailslot_browse_parse(dgmslot, browse, packet, browse); + if (!NT_STATUS_IS_OK(status)) goto failed; + + DEBUG(4,("Browse %s (Op %d) on '%s' '%s' from %s:%d\n", + nbt_browse_opcode_string(browse->opcode), browse->opcode, + nbt_name_string(browse, name), dgmslot->mailslot_name, + src->addr, src->port)); + + if (DEBUGLEVEL >= 10) { + NDR_PRINT_DEBUG(nbt_browse_packet, browse); + } + + talloc_free(browse); + return; + +failed: + DEBUG(2,("nbtd browse handler failed from %s:%d to %s - %s\n", + src->addr, src->port, nbt_name_string(browse, name), + nt_errstr(status))); + talloc_free(browse); + +} diff --git a/source4/nbt_server/dgram/netlogon.c b/source4/nbt_server/dgram/netlogon.c new file mode 100644 index 0000000..e9d89e5 --- /dev/null +++ b/source4/nbt_server/dgram/netlogon.c @@ -0,0 +1,286 @@ +/* + Unix SMB/CIFS implementation. + + NBT datagram netlogon server + + Copyright (C) Andrew Tridgell 2005 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2008 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "nbt_server/nbt_server.h" +#include "lib/socket/socket.h" +#include <ldb.h> +#include "dsdb/samdb/samdb.h" +#include "auth/auth.h" +#include "param/param.h" +#include "samba/service_task.h" +#include "dsdb/samdb/ldb_modules/util.h" +#include "libcli/security/security.h" +#include "nbt_server/dgram/proto.h" +#include "libds/common/roles.h" + +/* + reply to a GETDC request + */ +static NTSTATUS nbtd_netlogon_getdc(struct nbtd_server *nbtsrv, + struct nbt_name *dst_name, + struct nbt_netlogon_packet *netlogon, + TALLOC_CTX *mem_ctx, + struct nbt_netlogon_response **presponse, + char **preply_mailslot) +{ + struct nbt_netlogon_response_from_pdc *pdc; + struct ldb_context *samctx; + struct nbt_netlogon_response *response = NULL; + char *reply_mailslot = NULL; + + /* only answer getdc requests on the PDC or LOGON names */ + if ((dst_name->type != NBT_NAME_PDC) && + (dst_name->type != NBT_NAME_LOGON)) { + return NT_STATUS_NOT_SUPPORTED; + } + + samctx = nbtsrv->sam_ctx; + + if (lpcfg_server_role(nbtsrv->task->lp_ctx) != ROLE_ACTIVE_DIRECTORY_DC + || !samdb_is_pdc(samctx)) { + DEBUG(2, ("Not a PDC, so not processing LOGON_PRIMARY_QUERY\n")); + return NT_STATUS_NOT_SUPPORTED; + } + + if (strcasecmp_m(dst_name->name, + lpcfg_workgroup(nbtsrv->task->lp_ctx)) != 0) { + DBG_INFO("GetDC requested for a domain %s that we don't " + "host\n", dst_name->name); + return NT_STATUS_NOT_SUPPORTED; + } + + reply_mailslot = talloc_strdup( + mem_ctx, netlogon->req.pdc.mailslot_name); + if (reply_mailslot == NULL) { + goto nomem; + } + + /* setup a GETDC reply */ + response = talloc_zero(mem_ctx, struct nbt_netlogon_response); + if (response == NULL) { + goto nomem; + } + response->response_type = NETLOGON_GET_PDC; + pdc = &response->data.get_pdc; + + pdc->command = NETLOGON_RESPONSE_FROM_PDC; + + pdc->pdc_name = talloc_strdup( + response, lpcfg_netbios_name(nbtsrv->task->lp_ctx)); + if (pdc->pdc_name == NULL) { + goto nomem; + } + + pdc->unicode_pdc_name = pdc->pdc_name; + + pdc->domain_name = talloc_strdup( + response, lpcfg_workgroup(nbtsrv->task->lp_ctx)); + if (pdc->domain_name == NULL) { + goto nomem; + } + + pdc->nt_version = 1; + pdc->lmnt_token = 0xFFFF; + pdc->lm20_token = 0xFFFF; + + *presponse = response; + *preply_mailslot = reply_mailslot; + return NT_STATUS_OK; + +nomem: + TALLOC_FREE(response); + TALLOC_FREE(reply_mailslot); + return NT_STATUS_NO_MEMORY; +} + +/* + reply to a ADS style GETDC request + */ +static NTSTATUS nbtd_netlogon_samlogon( + struct nbtd_server *nbtsrv, + struct nbt_name *dst_name, + const struct socket_address *src, + struct nbt_netlogon_packet *netlogon, + TALLOC_CTX *mem_ctx, + struct nbt_netlogon_response **presponse, + char **preply_mailslot) +{ + struct ldb_context *samctx; + struct dom_sid *sid = NULL; + struct nbt_netlogon_response *response = NULL; + char *reply_mailslot = NULL; + NTSTATUS status; + + /* only answer getdc requests on the PDC or LOGON names */ + if ((dst_name->type != NBT_NAME_PDC) && + (dst_name->type != NBT_NAME_LOGON)) { + return NT_STATUS_NOT_SUPPORTED; + } + + samctx = nbtsrv->sam_ctx; + + if (netlogon->req.logon.sid_size != 0) { + sid = &netlogon->req.logon.sid; + } + + reply_mailslot = talloc_strdup( + mem_ctx, netlogon->req.logon.mailslot_name); + if (reply_mailslot == NULL) { + return NT_STATUS_NO_MEMORY; + } + + response = talloc_zero(mem_ctx, struct nbt_netlogon_response); + if (response == NULL) { + TALLOC_FREE(reply_mailslot); + return NT_STATUS_NO_MEMORY; + } + response->response_type = NETLOGON_SAMLOGON; + + status = fill_netlogon_samlogon_response( + samctx, response, NULL, dst_name->name, sid, NULL, + netlogon->req.logon.user_name, + netlogon->req.logon.acct_control, src->addr, + netlogon->req.logon.nt_version, nbtsrv->task->lp_ctx, + &response->data.samlogon, false); + if (!NT_STATUS_IS_OK(status)) { + struct dom_sid_buf buf; + + DBG_NOTICE("NBT netlogon query failed domain=%s sid=%s " + "version=%d - %s\n", + dst_name->name, + dom_sid_str_buf(sid, &buf), + netlogon->req.logon.nt_version, + nt_errstr(status)); + TALLOC_FREE(reply_mailslot); + TALLOC_FREE(response); + return status; + } + + *presponse = response; + *preply_mailslot = reply_mailslot; + return NT_STATUS_OK; +} + +static NTSTATUS nbtd_mailslot_netlogon_reply( + struct nbtd_interface *iface, + struct nbt_dgram_packet *packet, + struct socket_address *src, + TALLOC_CTX *mem_ctx, + struct nbt_netlogon_response **presponse, + char **preply_mailslot) +{ + struct nbt_netlogon_packet *netlogon; + struct nbt_name *dst_name = &packet->data.msg.dest_name; + struct nbt_netlogon_response *response = NULL; + struct nbtd_iface_name *iname; + char *reply_mailslot = NULL; + NTSTATUS status; + + /* + see if the we are listening on the destination netbios name + */ + iname = nbtd_find_iname(iface, dst_name, 0); + if (iname == NULL) { + return NT_STATUS_BAD_NETWORK_NAME; + } + + netlogon = talloc(mem_ctx, struct nbt_netlogon_packet); + if (netlogon == NULL) { + return NT_STATUS_NO_MEMORY; + } + + status = dgram_mailslot_netlogon_parse_request(netlogon, packet, + netlogon); + if (!NT_STATUS_IS_OK(status)) { + goto failed; + } + + switch (netlogon->command) { + case LOGON_PRIMARY_QUERY: + status = nbtd_netlogon_getdc( + iface->nbtsrv, &packet->data.msg.dest_name, + netlogon, mem_ctx, &response, &reply_mailslot); + break; + case LOGON_SAM_LOGON_REQUEST: + status = nbtd_netlogon_samlogon( + iface->nbtsrv, &packet->data.msg.dest_name, src, + netlogon, mem_ctx, &response, &reply_mailslot); + break; + default: + DEBUG(2,("unknown netlogon op %d from %s:%d\n", + netlogon->command, src->addr, src->port)); + NDR_PRINT_DEBUG(nbt_netlogon_packet, netlogon); + status = NT_STATUS_NOT_SUPPORTED; + break; + } + + if (!NT_STATUS_IS_OK(status)) { + DBG_DEBUG("Calculating reply failed: %s\n", + nt_errstr(status)); + goto failed; + } + + *presponse = response; + *preply_mailslot = reply_mailslot; + return NT_STATUS_OK; + +failed: + TALLOC_FREE(reply_mailslot); + TALLOC_FREE(netlogon); + return status; +} + +/* + handle incoming netlogon mailslot requests +*/ +void nbtd_mailslot_netlogon_handler(struct dgram_mailslot_handler *dgmslot, + struct nbt_dgram_packet *packet, + struct socket_address *src) +{ + NTSTATUS status = NT_STATUS_NO_MEMORY; + struct nbtd_interface *iface = + talloc_get_type(dgmslot->private_data, struct nbtd_interface); + struct nbtd_interface *reply_iface = nbtd_find_reply_iface( + iface, src->addr, false); + struct nbt_netlogon_response *response = NULL; + char *reply_mailslot = NULL; + + if (reply_iface->ip_address == NULL) { + DBG_WARNING("Could not obtain own IP address for datagram " + "socket\n"); + return; + } + + status = nbtd_mailslot_netlogon_reply( + iface, packet, src, dgmslot, &response, &reply_mailslot); + + if (NT_STATUS_IS_OK(status)) { + dgram_mailslot_netlogon_reply( + reply_iface->dgmsock, packet, + lpcfg_netbios_name(iface->nbtsrv->task->lp_ctx), + reply_mailslot, response); + } + + TALLOC_FREE(response); + TALLOC_FREE(reply_mailslot); +} diff --git a/source4/nbt_server/dgram/ntlogon.c b/source4/nbt_server/dgram/ntlogon.c new file mode 100644 index 0000000..8c6a6e9 --- /dev/null +++ b/source4/nbt_server/dgram/ntlogon.c @@ -0,0 +1,121 @@ +/* + Unix SMB/CIFS implementation. + + NBT datagram ntlogon server + + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "nbt_server/nbt_server.h" +#include "samba/service_task.h" +#include "lib/socket/socket.h" +#include "librpc/gen_ndr/ndr_nbt.h" +#include "param/param.h" + +/* + reply to a SAM LOGON request + */ +static void nbtd_ntlogon_sam_logon(struct dgram_mailslot_handler *dgmslot, + struct nbtd_interface *iface, + struct nbt_dgram_packet *packet, + const struct socket_address *src, + struct nbt_ntlogon_packet *ntlogon) +{ + struct nbt_name *name = &packet->data.msg.dest_name; + struct nbtd_interface *reply_iface = nbtd_find_reply_iface(iface, src->addr, false); + struct nbt_ntlogon_packet reply; + struct nbt_ntlogon_sam_logon_reply *logon; + + /* only answer sam logon requests on the PDC or LOGON names */ + if (name->type != NBT_NAME_PDC && name->type != NBT_NAME_LOGON) { + return; + } + + /* setup a SAM LOGON reply */ + ZERO_STRUCT(reply); + reply.command = NTLOGON_SAM_LOGON_REPLY; + logon = &reply.req.reply; + + logon->server = talloc_asprintf(packet, "\\\\%s", + lpcfg_netbios_name(iface->nbtsrv->task->lp_ctx)); + logon->user_name = ntlogon->req.logon.user_name; + logon->domain = lpcfg_workgroup(iface->nbtsrv->task->lp_ctx); + logon->nt_version = 1; + logon->lmnt_token = 0xFFFF; + logon->lm20_token = 0xFFFF; + + packet->data.msg.dest_name.type = 0; + + dgram_mailslot_ntlogon_reply(reply_iface->dgmsock, + packet, + lpcfg_netbios_name(iface->nbtsrv->task->lp_ctx), + ntlogon->req.logon.mailslot_name, + &reply); +} + +/* + handle incoming ntlogon mailslot requests +*/ +void nbtd_mailslot_ntlogon_handler(struct dgram_mailslot_handler *dgmslot, + struct nbt_dgram_packet *packet, + struct socket_address *src) +{ + NTSTATUS status = NT_STATUS_NO_MEMORY; + struct nbtd_interface *iface = + talloc_get_type(dgmslot->private_data, struct nbtd_interface); + struct nbt_ntlogon_packet *ntlogon = + talloc(dgmslot, struct nbt_ntlogon_packet); + struct nbtd_iface_name *iname; + struct nbt_name *name = &packet->data.msg.dest_name; + + if (ntlogon == NULL) goto failed; + + /* + see if the we are listening on the destination netbios name + */ + iname = nbtd_find_iname(iface, name, 0); + if (iname == NULL) { + status = NT_STATUS_BAD_NETWORK_NAME; + goto failed; + } + + DEBUG(2,("ntlogon request to %s from %s:%d\n", + nbt_name_string(ntlogon, name), src->addr, src->port)); + status = dgram_mailslot_ntlogon_parse(dgmslot, ntlogon, packet, ntlogon); + if (!NT_STATUS_IS_OK(status)) goto failed; + + NDR_PRINT_DEBUG(nbt_ntlogon_packet, ntlogon); + + switch (ntlogon->command) { + case NTLOGON_SAM_LOGON: + nbtd_ntlogon_sam_logon(dgmslot, iface, packet, src, ntlogon); + break; + default: + DEBUG(2,("unknown ntlogon op %d from %s:%d\n", + ntlogon->command, src->addr, src->port)); + break; + } + + talloc_free(ntlogon); + return; + +failed: + DEBUG(2,("nbtd ntlogon handler failed from %s:%d to %s - %s\n", + src->addr, src->port, nbt_name_string(ntlogon, name), + nt_errstr(status))); + talloc_free(ntlogon); +} diff --git a/source4/nbt_server/dgram/request.c b/source4/nbt_server/dgram/request.c new file mode 100644 index 0000000..ea2b6e8 --- /dev/null +++ b/source4/nbt_server/dgram/request.c @@ -0,0 +1,150 @@ +/* + Unix SMB/CIFS implementation. + + NBT datagram server + + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "nbt_server/nbt_server.h" +#include "samba/service_task.h" +#include "lib/socket/socket.h" +#include "libcli/resolve/resolve.h" +#include "nbt_server/dgram/proto.h" +#include "librpc/gen_ndr/ndr_nbt.h" +#include "param/param.h" + +/* + a list of mailslots that we have static handlers for +*/ +static const struct { + const char *mailslot_name; + dgram_mailslot_handler_t handler; +} mailslot_handlers[] = { + /* Handle both NTLOGON and NETLOGON in the same function, as + * they are very similar */ + { NBT_MAILSLOT_NETLOGON, nbtd_mailslot_netlogon_handler }, + { NBT_MAILSLOT_NTLOGON, nbtd_mailslot_netlogon_handler }, + { NBT_MAILSLOT_BROWSE, nbtd_mailslot_browse_handler } +}; + +/* + receive an incoming dgram request. This is used for general datagram + requests. Mailslot requests for our listening mailslots + are handled in the specific mailslot handlers +*/ +void dgram_request_handler(struct nbt_dgram_socket *dgmsock, + struct nbt_dgram_packet *packet, + struct socket_address *src) +{ + DEBUG(0,("General datagram request from %s:%d\n", src->addr, src->port)); + NDR_PRINT_DEBUG(nbt_dgram_packet, packet); +} + + +/* + setup the port 138 datagram listener for a given interface +*/ +NTSTATUS nbtd_dgram_setup(struct nbtd_interface *iface, const char *bind_address) +{ + struct nbt_dgram_socket *bcast_dgmsock = NULL; + struct nbtd_server *nbtsrv = iface->nbtsrv; + struct socket_address *bcast_addr, *bind_addr; + NTSTATUS status; + TALLOC_CTX *tmp_ctx = talloc_new(iface); + /* the list of mailslots that we are interested in */ + size_t i; + + if (!tmp_ctx) { + return NT_STATUS_NO_MEMORY; + } + + if (strcmp("0.0.0.0", iface->netmask) != 0) { + /* listen for broadcasts on port 138 */ + bcast_dgmsock = nbt_dgram_socket_init(iface, nbtsrv->task->event_ctx); + if (!bcast_dgmsock) { + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + bcast_addr = socket_address_from_strings(tmp_ctx, bcast_dgmsock->sock->backend_name, + iface->bcast_address, + lpcfg_dgram_port(iface->nbtsrv->task->lp_ctx)); + if (!bcast_addr) { + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + status = socket_listen(bcast_dgmsock->sock, bcast_addr, 0, 0); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(tmp_ctx); + DEBUG(0,("Failed to bind to %s:%d - %s\n", + iface->bcast_address, lpcfg_dgram_port(iface->nbtsrv->task->lp_ctx), + nt_errstr(status))); + return status; + } + + dgram_set_incoming_handler(bcast_dgmsock, dgram_request_handler, iface); + } + + /* listen for unicasts on port 138 */ + iface->dgmsock = nbt_dgram_socket_init(iface, nbtsrv->task->event_ctx); + if (!iface->dgmsock) { + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + bind_addr = socket_address_from_strings(tmp_ctx, iface->dgmsock->sock->backend_name, + bind_address, lpcfg_dgram_port(iface->nbtsrv->task->lp_ctx)); + if (!bind_addr) { + talloc_free(tmp_ctx); + return NT_STATUS_NO_MEMORY; + } + + status = socket_listen(iface->dgmsock->sock, bind_addr, 0, 0); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(tmp_ctx); + DEBUG(0,("Failed to bind to %s:%d - %s\n", + bind_address, lpcfg_dgram_port(iface->nbtsrv->task->lp_ctx), nt_errstr(status))); + return status; + } + + dgram_set_incoming_handler(iface->dgmsock, dgram_request_handler, iface); + + talloc_free(tmp_ctx); + + for (i=0;i<ARRAY_SIZE(mailslot_handlers);i++) { + /* note that we don't need to keep the pointer + to the dgmslot around - the callback is all + we need */ + struct dgram_mailslot_handler *dgmslot; + + if (bcast_dgmsock) { + dgmslot = dgram_mailslot_listen(bcast_dgmsock, + mailslot_handlers[i].mailslot_name, + mailslot_handlers[i].handler, iface); + NT_STATUS_HAVE_NO_MEMORY(dgmslot); + } + + dgmslot = dgram_mailslot_listen(iface->dgmsock, + mailslot_handlers[i].mailslot_name, + mailslot_handlers[i].handler, iface); + NT_STATUS_HAVE_NO_MEMORY(dgmslot); + } + + return NT_STATUS_OK; +} |