From: Gary Lockyer Date: Fri, 1 Feb 2019 00:49:49 +0000 (+1300) Subject: winbind: Generate and pass logon ID X-Git-Tag: ldb-1.6.1~64 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0e2acf6cfb3dc6e0be9130e20890551ee88fcf60;p=thirdparty%2Fsamba.git winbind: Generate and pass logon ID Generate a random logon_id and pass it in the SamLogon calls. Signed-off-by: Gary Lockyer Reviewed-by: Andrew Bartlett --- diff --git a/source3/rpc_client/cli_netlogon.c b/source3/rpc_client/cli_netlogon.c index c7cc183dd16..3ed49686206 100644 --- a/source3/rpc_client/cli_netlogon.c +++ b/source3/rpc_client/cli_netlogon.c @@ -458,6 +458,7 @@ NTSTATUS rpccli_netlogon_password_logon( const char *username, const char *password, const char *workstation, + const uint64_t logon_id, enum netr_LogonInfoClass logon_type, uint8_t *authoritative, uint32_t *flags, @@ -508,7 +509,7 @@ NTSTATUS rpccli_netlogon_password_logon( password_info->identity_info.domain_name.string = domain; password_info->identity_info.parameter_control = logon_parameters; - password_info->identity_info.logon_id = 0xbeef0000dead; + password_info->identity_info.logon_id = logon_id; password_info->identity_info.account_name.string = username; password_info->identity_info.workstation.string = workstation_slash; @@ -550,7 +551,7 @@ NTSTATUS rpccli_netlogon_password_logon( network_info->identity_info.domain_name.string = domain; network_info->identity_info.parameter_control = logon_parameters; - network_info->identity_info.logon_id = 0xbeef0000dead; + network_info->identity_info.logon_id = logon_id; network_info->identity_info.account_name.string = username; network_info->identity_info.workstation.string = workstation_slash; @@ -605,6 +606,7 @@ NTSTATUS rpccli_netlogon_network_logon( const char *username, const char *domain, const char *workstation, + const uint64_t logon_id, const uint8_t chal[8], DATA_BLOB lm_response, DATA_BLOB nt_response, @@ -668,7 +670,7 @@ NTSTATUS rpccli_netlogon_network_logon( network_info->identity_info.domain_name.string = domain; network_info->identity_info.parameter_control = logon_parameters; - network_info->identity_info.logon_id = 0xbeef0000dead; + network_info->identity_info.logon_id = logon_id; network_info->identity_info.account_name.string = username; network_info->identity_info.workstation.string = workstation_name_slash; @@ -707,6 +709,7 @@ NTSTATUS rpccli_netlogon_interactive_logon( const char *username, const char *domain, const char *workstation, + const uint64_t logon_id, DATA_BLOB lm_hash, DATA_BLOB nt_hash, enum netr_LogonInfoClass logon_type, @@ -768,7 +771,7 @@ NTSTATUS rpccli_netlogon_interactive_logon( password_info->identity_info.domain_name.string = domain; password_info->identity_info.parameter_control = logon_parameters; - password_info->identity_info.logon_id = 0xbeef0000dead; + password_info->identity_info.logon_id = logon_id; password_info->identity_info.account_name.string = username; password_info->identity_info.workstation.string = workstation_name_slash; diff --git a/source3/rpc_client/cli_netlogon.h b/source3/rpc_client/cli_netlogon.h index d0232b51d98..362321f312f 100644 --- a/source3/rpc_client/cli_netlogon.h +++ b/source3/rpc_client/cli_netlogon.h @@ -68,6 +68,7 @@ NTSTATUS rpccli_netlogon_password_logon( const char *username, const char *password, const char *workstation, + const uint64_t logon_id, enum netr_LogonInfoClass logon_type, uint8_t *authoritative, uint32_t *flags, @@ -81,6 +82,7 @@ NTSTATUS rpccli_netlogon_network_logon( const char *username, const char *domain, const char *workstation, + const uint64_t logon_id, const uint8_t chal[8], DATA_BLOB lm_response, DATA_BLOB nt_response, @@ -97,6 +99,7 @@ NTSTATUS rpccli_netlogon_interactive_logon( const char *username, const char *domain, const char *workstation, + const uint64_t logon_id, DATA_BLOB lm_hash, DATA_BLOB nt_hash, enum netr_LogonInfoClass logon_type, diff --git a/source3/rpcclient/cmd_netlogon.c b/source3/rpcclient/cmd_netlogon.c index 39bee441b73..4db23793c63 100644 --- a/source3/rpcclient/cmd_netlogon.c +++ b/source3/rpcclient/cmd_netlogon.c @@ -500,6 +500,7 @@ static NTSTATUS cmd_netlogon_sam_logon(struct rpc_pipe_client *cli, uint32_t flags = 0; uint16_t validation_level; union netr_Validation *validation = NULL; + uint64_t logon_id = 0; /* Check arguments */ @@ -525,6 +526,7 @@ static NTSTATUS cmd_netlogon_sam_logon(struct rpc_pipe_client *cli, result = NT_STATUS_UNSUCCESSFUL; goto done; } + logon_id = generate_random_u64(); /* Perform the sam logon */ @@ -536,6 +538,7 @@ static NTSTATUS cmd_netlogon_sam_logon(struct rpc_pipe_client *cli, username, password, workstation, + logon_id, logon_type, &authoritative, &flags, diff --git a/source3/winbindd/winbindd_dual_srv.c b/source3/winbindd/winbindd_dual_srv.c index ab14f5d51a0..a34fce4bbe5 100644 --- a/source3/winbindd/winbindd_dual_srv.c +++ b/source3/winbindd/winbindd_dual_srv.c @@ -1001,6 +1001,7 @@ NTSTATUS _winbind_SamLogon(struct pipes_struct *p, identity_info->account_name.string, identity_info->domain_name.string, identity_info->workstation.string, + identity_info->logon_id, challenge, lm_response, nt_response, &r->out.authoritative, diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c index b81f2722c42..4405205a5f2 100644 --- a/source3/winbindd/winbindd_pam.c +++ b/source3/winbindd/winbindd_pam.c @@ -1337,7 +1337,9 @@ done: static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx, uint32_t logon_parameters, - const char *domain, const char *user, + const char *domain, + const char *user, + const uint64_t logon_id, const DATA_BLOB *challenge, const DATA_BLOB *lm_resp, const DATA_BLOB *nt_resp, @@ -1387,6 +1389,7 @@ static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx, } user_info->logon_parameters = logon_parameters; + user_info->logon_id = logon_id; /* We don't want any more mapping of the username */ user_info->mapped_state = True; @@ -1452,6 +1455,7 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain, const char *password, const char *domainname, const char *workstation, + const uint64_t logon_id, bool plaintext_given, const uint8_t chal[8], DATA_BLOB lm_response, @@ -1564,6 +1568,7 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain, username, password, workstation, + logon_id, logon_type_i, authoritative, flags, @@ -1578,6 +1583,7 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain, username, domainname, workstation, + logon_id, lm_response, nt_response, logon_type_i, @@ -1594,6 +1600,7 @@ static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain, username, domainname, workstation, + logon_id, chal, lm_response, nt_response, @@ -1683,6 +1690,7 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon( struct winbindd_domain *domain, const char *user, const char *pass, + uint64_t logon_id, uint32_t request_flags, uint16_t *_validation_level, union netr_Validation **_validation) @@ -1760,6 +1768,7 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon( result = winbindd_dual_auth_passdb( talloc_tos(), 0, name_domain, name_user, + logon_id, &chal_blob, &lm_resp, &nt_resp, true, /* interactive */ &authoritative, @@ -1795,6 +1804,7 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon( pass, name_domain, lp_netbios_name(), + logon_id, true, /* plaintext_given */ NULL, data_blob_null, data_blob_null, @@ -1910,6 +1920,7 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain, union netr_Validation *validation = NULL; NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL; bool ok; + uint64_t logon_id = 0; /* Ensure null termination */ state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0'; @@ -1917,6 +1928,10 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain, /* Ensure null termination */ state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0'; + /* + * Generate a logon_id for this session. + */ + logon_id = generate_random_u64(); DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid, state->request->data.auth.user)); @@ -2037,6 +2052,7 @@ sam_logon: state->mem_ctx, domain, state->request->data.auth.user, state->request->data.auth.pass, + logon_id, state->request->flags, &validation_level, &validation); @@ -2246,6 +2262,7 @@ NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain, const char *name_user, const char *name_domain, const char *workstation, + const uint64_t logon_id, const uint8_t chal[8], DATA_BLOB lm_response, DATA_BLOB nt_response, @@ -2277,6 +2294,7 @@ NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain, talloc_tos(), logon_parameters, name_domain, name_user, + logon_id, &chal_blob, &lm_response, &nt_response, interactive, authoritative, @@ -2310,6 +2328,7 @@ NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain, name_domain, /* Bug #3248 - found by Stefan Burkei. */ workstation, /* We carefully set this above so use it... */ + logon_id, false, /* plaintext_given */ chal, lm_response, @@ -2411,6 +2430,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain, const char *name_user = NULL; const char *name_domain = NULL; const char *workstation; + uint64_t logon_id = 0; uint8_t authoritative = 0; uint32_t flags = 0; uint16_t validation_level; @@ -2427,6 +2447,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain, name_user = state->request->data.auth_crap.user; name_domain = state->request->data.auth_crap.domain; workstation = state->request->data.auth_crap.workstation; + logon_id = generate_random_u64(); DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid, name_domain, name_user)); @@ -2464,6 +2485,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain, name_domain, /* Bug #3248 - found by Stefan Burkei. */ workstation, /* We carefully set this above so use it... */ + logon_id, state->request->data.auth_crap.chal, lm_resp, nt_resp, diff --git a/source3/winbindd/winbindd_proto.h b/source3/winbindd/winbindd_proto.h index be3626dc477..85a490a4feb 100644 --- a/source3/winbindd/winbindd_proto.h +++ b/source3/winbindd/winbindd_proto.h @@ -439,6 +439,7 @@ NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain, const char *name_user, const char *name_domain, const char *workstation, + const uint64_t logon_id, const uint8_t chal[8], DATA_BLOB lm_response, DATA_BLOB nt_response, diff --git a/source4/auth/ntlm/auth_winbind.c b/source4/auth/ntlm/auth_winbind.c index d7c26e7a1a7..d7879966603 100644 --- a/source4/auth/ntlm/auth_winbind.c +++ b/source4/auth/ntlm/auth_winbind.c @@ -174,7 +174,7 @@ static struct tevent_req *winbind_check_password_send(TALLOC_CTX *mem_ctx, identity_info->domain_name.string = user_info->client.domain_name; identity_info->parameter_control = user_info->logon_parameters; /* see MSV1_0_* */ - identity_info->logon_id = 0; + identity_info->logon_id = user_info->logon_id; identity_info->account_name.string = user_info->client.account_name; identity_info->workstation.string = user_info->workstation_name;