2 Unix SMB/CIFS implementation.
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/composite/composite.h"
25 #include "winbind/wb_server.h"
26 #include "smbd/service_task.h"
27 #include "auth/credentials/credentials.h"
28 #include "libcli/auth/libcli_auth.h"
29 #include "librpc/gen_ndr/ndr_netlogon.h"
30 #include "librpc/gen_ndr/ndr_netlogon_c.h"
31 #include "librpc/gen_ndr/winbind.h"
32 #include "param/param.h"
34 /* Oh, there is so much to keep an eye on when authenticating a user. Oh my! */
35 struct pam_auth_crap_state {
36 struct composite_context *ctx;
37 struct event_context *event_ctx;
39 struct winbind_SamLogon *req;
42 struct netr_NetworkInfo ninfo;
43 struct netr_LogonSamLogon r;
45 const char *user_name;
46 const char *domain_name;
48 struct netr_UserSessionKey user_session_key;
49 struct netr_LMSessionKey lm_key;
54 * NTLM authentication.
57 static void pam_auth_crap_recv_logon(struct composite_context *ctx);
59 struct composite_context *wb_cmd_pam_auth_crap_send(TALLOC_CTX *mem_ctx,
60 struct wbsrv_service *service,
61 uint32_t logon_parameters,
64 const char *workstation,
69 struct composite_context *result, *ctx;
70 struct pam_auth_crap_state *state;
71 struct netr_NetworkInfo *ninfo;
72 DATA_BLOB tmp_nt_resp, tmp_lm_resp;
74 result = composite_create(mem_ctx, service->task->event_ctx);
75 if (result == NULL) goto failed;
77 state = talloc(result, struct pam_auth_crap_state);
78 if (state == NULL) goto failed;
80 result->private_data = state;
82 state->req = talloc(state, struct winbind_SamLogon);
84 state->req->in.logon_level = 2;
85 state->req->in.validation_level = 3;
86 ninfo = state->req->in.logon.network = talloc(state, struct netr_NetworkInfo);
87 if (ninfo == NULL) goto failed;
89 ninfo->identity_info.account_name.string = talloc_strdup(state, user);
90 ninfo->identity_info.domain_name.string = talloc_strdup(state, domain);
91 ninfo->identity_info.parameter_control = logon_parameters;
92 ninfo->identity_info.logon_id_low = 0;
93 ninfo->identity_info.logon_id_high = 0;
94 ninfo->identity_info.workstation.string = talloc_strdup(state, workstation);
96 SMB_ASSERT(chal.length == sizeof(ninfo->challenge));
97 memcpy(ninfo->challenge, chal.data,
98 sizeof(ninfo->challenge));
100 tmp_nt_resp = data_blob_talloc(ninfo, nt_resp.data, nt_resp.length);
101 if ((nt_resp.data != NULL) &&
102 (tmp_nt_resp.data == NULL)) goto failed;
104 tmp_lm_resp = data_blob_talloc(ninfo, lm_resp.data, lm_resp.length);
105 if ((lm_resp.data != NULL) &&
106 (tmp_lm_resp.data == NULL)) goto failed;
108 ninfo->nt.length = tmp_nt_resp.length;
109 ninfo->nt.data = tmp_nt_resp.data;
110 ninfo->lm.length = tmp_lm_resp.length;
111 ninfo->lm.data = tmp_lm_resp.data;
113 state->unix_username = NULL;
115 ctx = wb_sam_logon_send(mem_ctx, service, state->req);
116 if (ctx == NULL) goto failed;
118 composite_continue(result, ctx, pam_auth_crap_recv_logon, state);
129 Send of a SamLogon request to authenticate a user.
131 static void pam_auth_crap_recv_logon(struct composite_context *ctx)
134 struct netr_SamBaseInfo *base;
135 struct pam_auth_crap_state *state =
136 talloc_get_type(ctx->async.private_data,
137 struct pam_auth_crap_state);
139 state->ctx->status = wb_sam_logon_recv(ctx, state, state->req);
140 if (!composite_is_ok(state->ctx)) return;
142 state->ctx->status = ndr_push_struct_blob(
143 &tmp_blob, state, state->req->out.validation.sam3,
144 (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
145 if (!composite_is_ok(state->ctx)) return;
147 /* The Samba3 protocol is a bit broken (due to non-IDL
148 * heritage, so for compatability we must add a non-zero 4
149 * bytes to the info3 */
150 state->info3 = data_blob_talloc(state, NULL, tmp_blob.length+4);
151 if (composite_nomem(state->info3.data, state->ctx)) return;
153 SIVAL(state->info3.data, 0, 1);
154 memcpy(state->info3.data+4, tmp_blob.data, tmp_blob.length);
156 base = &state->req->out.validation.sam3->base;
158 state->user_session_key = base->key;
159 state->lm_key = base->LMSessKey;
161 /* Give the caller the most accurate username possible.
162 * Assists where case sensitive comparisons may be done by our
163 * ntlm_auth callers */
164 if (base->account_name.string) {
165 state->user_name = base->account_name.string;
166 talloc_steal(state, base->account_name.string);
168 if (base->domain.string) {
169 state->domain_name = base->domain.string;
170 talloc_steal(state, base->domain.string);
173 state->unix_username = talloc_asprintf(state, "%s%s%s",
175 lp_winbind_separator(),
177 if (composite_nomem(state->unix_username, state->ctx)) return;
179 composite_done(state->ctx);
182 /* Having received a NTLM authentication reply, parse out the useful
183 * reply data for the caller */
184 NTSTATUS wb_cmd_pam_auth_crap_recv(struct composite_context *c,
187 struct netr_UserSessionKey *user_session_key,
188 struct netr_LMSessionKey *lm_key,
189 char **unix_username)
191 struct pam_auth_crap_state *state =
192 talloc_get_type(c->private_data, struct pam_auth_crap_state);
193 NTSTATUS status = composite_wait(c);
194 if (NT_STATUS_IS_OK(status)) {
195 info3->length = state->info3.length;
196 info3->data = talloc_steal(mem_ctx, state->info3.data);
197 *user_session_key = state->user_session_key;
198 *lm_key = state->lm_key;
199 *unix_username = talloc_steal(mem_ctx, state->unix_username);
205 /* Handle plaintext authentication, by encrypting the password and
206 * then sending via the NTLM calls */
208 struct composite_context *wb_cmd_pam_auth_send(TALLOC_CTX *mem_ctx,
209 struct wbsrv_service *service,
212 const char *password)
214 struct cli_credentials *credentials;
215 const char *workstation;
218 DATA_BLOB chal, nt_resp, lm_resp, names_blob;
219 int flags = CLI_CRED_NTLM_AUTH;
220 if (lp_client_lanman_auth()) {
221 flags |= CLI_CRED_LANMAN_AUTH;
224 if (lp_client_ntlmv2_auth()) {
225 flags |= CLI_CRED_NTLMv2_AUTH;
228 DEBUG(5, ("wbsrv_samba3_pam_auth called\n"));
230 credentials = cli_credentials_init(mem_ctx);
234 cli_credentials_set_conf(credentials);
235 cli_credentials_set_domain(credentials, domain, CRED_SPECIFIED);
236 cli_credentials_set_username(credentials, user, CRED_SPECIFIED);
238 cli_credentials_set_password(credentials, password, CRED_SPECIFIED);
240 chal = data_blob_talloc(mem_ctx, NULL, 8);
244 generate_random_buffer(chal.data, chal.length);
245 cli_credentials_get_ntlm_username_domain(credentials, mem_ctx,
247 /* for best compatability with multiple vitual netbios names
248 * on the host, this should be generated from the
249 * cli_credentials associated with the machine account */
250 workstation = cli_credentials_get_workstation(credentials);
252 names_blob = NTLMv2_generate_names_blob(
254 cli_credentials_get_workstation(credentials),
255 cli_credentials_get_domain(credentials));
257 status = cli_credentials_get_ntlm_response(
258 credentials, mem_ctx, &flags, chal, names_blob,
259 &lm_resp, &nt_resp, NULL, NULL);
260 if (!NT_STATUS_IS_OK(status)) {
263 return wb_cmd_pam_auth_crap_send(mem_ctx, service,
264 0 /* logon parameters */,
265 domain, user, workstation,
266 chal, nt_resp, lm_resp);
269 NTSTATUS wb_cmd_pam_auth_recv(struct composite_context *c)
271 struct pam_auth_crap_state *state =
272 talloc_get_type(c->private_data, struct pam_auth_crap_state);
273 NTSTATUS status = composite_wait(c);