Commit a9c81414 authored by jan.koester's avatar jan.koester
Browse files

netlogon: endpoint-mapper lookup for the NETLOGON port (best-effort) 

resolveNetlogonPort() asks a DC's endpoint mapper (ept_map) for the port
its NETLOGON interface listens on, which real Windows AD needs since that
port is dynamic. The ept_map NDR is not yet validated against a live DC:
the Samba test DC pins its RPC port, so the dynamic-port path can't be
exercised here, and ept_map currently returns an NDR fault. Marked as such
in the header; samLogonNetwork() takes the port directly and does not use
this, so the tested logon path is unaffected.

Co-Authored-By: default avatarClaude Opus 4.8 <noreply@anthropic.com>
parent 070b39f6

src/netlogon.cpp

+4 −0
Changes for src/netlogon.cpp: 4 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -460,6 +460,10 @@ int epmMapNetlogon(const std::string &host, int epmPort, int timeoutMs) { 


} // namespace



int resolveNetlogonPort(const std::string &host, int epmPort, int timeoutMs) {

    return epmMapNetlogon(host, epmPort, timeoutMs);

}



NtlmResult samLogonNetwork(const NetlogonConfig &cfg, const NtlmPassthrough &in) {

    if (cfg.rpcPort <= 0) throw std::runtime_error("netlogon: no RPC port");

    if (in.serverChallenge.size() != 8) throw std::runtime_error("netlogon: server challenge must be 8 bytes");

src/netlogon.h

+11 −0
Changes for src/netlogon.h: 11 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -71,6 +71,17 @@ struct NtlmResult { 
    uint32_t rid = 0;

};



/* Ask a domain controller's endpoint mapper (epmPort, usually 135) for the

 * TCP port its NETLOGON interface listens on. Returns 0 if not found; throws

 * std::runtime_error if the DC can't be reached.

 *

 * NOTE: not yet validated against a live DC -- the ept_map NDR still needs

 * fixing against real Windows AD (the Samba test DC pins its RPC port, so the

 * dynamic-port path can't be exercised here). Until then a deployment should

 * configure the NETLOGON port explicitly; samLogonNetwork() takes it directly

 * and does not depend on this. */

int resolveNetlogonPort(const std::string &host, int epmPort, int timeoutMs = 10000);



/* One SamLogonEx network logon against the DC in cfg. A fresh secure channel

 * is set up for the call (ReqChallenge/Authenticate3 then netsec schannel).

 * Throws std::runtime_error if the DC can't be reached or the protocol fails;