s3-rpc_client: Move client pipe functions to own header.
[samba.git] / source3 / auth / auth_domain.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Authenticate against a remote domain
4    Copyright (C) Andrew Tridgell 1992-1998
5    Copyright (C) Andrew Bartlett 2001
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../libcli/auth/libcli_auth.h"
23 #include "../librpc/gen_ndr/ndr_netlogon.h"
24 #include "rpc_client/cli_pipe.h"
25 #include "rpc_client/cli_netlogon.h"
26 #include "secrets.h"
27
28 #undef DBGC_CLASS
29 #define DBGC_CLASS DBGC_AUTH
30
31 extern bool global_machine_password_needs_changing;
32 static struct named_mutex *mutex;
33
34 /*
35  * Change machine password (called from main loop
36  * idle timeout. Must be done as root.
37  */
38
39 void attempt_machine_password_change(void)
40 {
41         unsigned char trust_passwd_hash[16];
42         time_t lct;
43         void *lock;
44
45         if (!global_machine_password_needs_changing) {
46                 return;
47         }
48
49         if (lp_security() != SEC_DOMAIN) {
50                 return;
51         }
52
53         /*
54          * We're in domain level security, and the code that
55          * read the machine password flagged that the machine
56          * password needs changing.
57          */
58
59         /*
60          * First, open the machine password file with an exclusive lock.
61          */
62
63         lock = secrets_get_trust_account_lock(NULL, lp_workgroup());
64
65         if (lock == NULL) {
66                 DEBUG(0,("attempt_machine_password_change: unable to lock "
67                         "the machine account password for machine %s in "
68                         "domain %s.\n",
69                         global_myname(), lp_workgroup() ));
70                 return;
71         }
72
73         if(!secrets_fetch_trust_account_password(lp_workgroup(),
74                         trust_passwd_hash, &lct, NULL)) {
75                 DEBUG(0,("attempt_machine_password_change: unable to read the "
76                         "machine account password for %s in domain %s.\n",
77                         global_myname(), lp_workgroup()));
78                 TALLOC_FREE(lock);
79                 return;
80         }
81
82         /*
83          * Make sure someone else hasn't already done this.
84          */
85
86         if(time(NULL) < lct + lp_machine_password_timeout()) {
87                 global_machine_password_needs_changing = false;
88                 TALLOC_FREE(lock);
89                 return;
90         }
91
92         /* always just contact the PDC here */
93
94         change_trust_account_password( lp_workgroup(), NULL);
95         global_machine_password_needs_changing = false;
96         TALLOC_FREE(lock);
97 }
98
99 /**
100  * Connect to a remote server for (inter)domain security authenticaion.
101  *
102  * @param cli the cli to return containing the active connection
103  * @param server either a machine name or text IP address to
104  *               connect to.
105  * @param setup_creds_as domain account to setup credentials as
106  * @param sec_chan a switch value to distinguish between domain
107  *                 member and interdomain authentication
108  * @param trust_passwd the trust password to establish the
109  *                     credentials with.
110  *
111  **/
112
113 static NTSTATUS connect_to_domain_password_server(struct cli_state **cli,
114                                                 const char *domain,
115                                                 const char *dc_name,
116                                                 struct sockaddr_storage *dc_ss, 
117                                                 struct rpc_pipe_client **pipe_ret)
118 {
119         NTSTATUS result;
120         struct rpc_pipe_client *netlogon_pipe = NULL;
121
122         *cli = NULL;
123
124         *pipe_ret = NULL;
125
126         /* TODO: Send a SAMLOGON request to determine whether this is a valid
127            logonserver.  We can avoid a 30-second timeout if the DC is down
128            if the SAMLOGON request fails as it is only over UDP. */
129
130         /* we use a mutex to prevent two connections at once - when a 
131            Win2k PDC get two connections where one hasn't completed a 
132            session setup yet it will send a TCP reset to the first 
133            connection (tridge) */
134
135         /*
136          * With NT4.x DC's *all* authentication must be serialized to avoid
137          * ACCESS_DENIED errors if 2 auths are done from the same machine. JRA.
138          */
139
140         mutex = grab_named_mutex(NULL, dc_name, 10);
141         if (mutex == NULL) {
142                 return NT_STATUS_NO_LOGON_SERVERS;
143         }
144
145         /* Attempt connection */
146         result = cli_full_connection(cli, global_myname(), dc_name, dc_ss, 0, 
147                 "IPC$", "IPC", "", "", "", 0, Undefined);
148
149         if (!NT_STATUS_IS_OK(result)) {
150                 /* map to something more useful */
151                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
152                         result = NT_STATUS_NO_LOGON_SERVERS;
153                 }
154
155                 if (*cli) {
156                         cli_shutdown(*cli);
157                         *cli = NULL;
158                 }
159
160                 TALLOC_FREE(mutex);
161                 return result;
162         }
163
164         /*
165          * We now have an anonymous connection to IPC$ on the domain password server.
166          */
167
168         /*
169          * Even if the connect succeeds we need to setup the netlogon
170          * pipe here. We do this as we may just have changed the domain
171          * account password on the PDC and yet we may be talking to
172          * a BDC that doesn't have this replicated yet. In this case
173          * a successful connect to a DC needs to take the netlogon connect
174          * into account also. This patch from "Bjart Kvarme" <bjart.kvarme@usit.uio.no>.
175          */
176
177         /* open the netlogon pipe. */
178         if (lp_client_schannel()) {
179                 /* We also setup the creds chain in the open_schannel call. */
180                 result = cli_rpc_pipe_open_schannel(
181                         *cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
182                         DCERPC_AUTH_LEVEL_PRIVACY, domain, &netlogon_pipe);
183         } else {
184                 result = cli_rpc_pipe_open_noauth(
185                         *cli, &ndr_table_netlogon.syntax_id, &netlogon_pipe);
186         }
187
188         if (!NT_STATUS_IS_OK(result)) {
189                 DEBUG(0,("connect_to_domain_password_server: unable to open the domain client session to \
190 machine %s. Error was : %s.\n", dc_name, nt_errstr(result)));
191                 cli_shutdown(*cli);
192                 *cli = NULL;
193                 TALLOC_FREE(mutex);
194                 return result;
195         }
196
197         if (!lp_client_schannel()) {
198                 /* We need to set up a creds chain on an unauthenticated netlogon pipe. */
199                 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
200                 enum netr_SchannelType sec_chan_type = 0;
201                 unsigned char machine_pwd[16];
202                 const char *account_name;
203
204                 if (!get_trust_pw_hash(domain, machine_pwd, &account_name,
205                                        &sec_chan_type))
206                 {
207                         DEBUG(0, ("connect_to_domain_password_server: could not fetch "
208                         "trust account password for domain '%s'\n",
209                                 domain));
210                         cli_shutdown(*cli);
211                         *cli = NULL;
212                         TALLOC_FREE(mutex);
213                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
214                 }
215
216                 result = rpccli_netlogon_setup_creds(netlogon_pipe,
217                                         dc_name, /* server name */
218                                         domain, /* domain */
219                                         global_myname(), /* client name */
220                                         account_name, /* machine account name */
221                                         machine_pwd,
222                                         sec_chan_type,
223                                         &neg_flags);
224
225                 if (!NT_STATUS_IS_OK(result)) {
226                         cli_shutdown(*cli);
227                         *cli = NULL;
228                         TALLOC_FREE(mutex);
229                         return result;
230                 }
231         }
232
233         if(!netlogon_pipe) {
234                 DEBUG(0,("connect_to_domain_password_server: unable to open the domain client session to \
235 machine %s. Error was : %s.\n", dc_name, cli_errstr(*cli)));
236                 cli_shutdown(*cli);
237                 *cli = NULL;
238                 TALLOC_FREE(mutex);
239                 return NT_STATUS_NO_LOGON_SERVERS;
240         }
241
242         /* We exit here with the mutex *locked*. JRA */
243
244         *pipe_ret = netlogon_pipe;
245
246         return NT_STATUS_OK;
247 }
248
249 /***********************************************************************
250  Do the same as security=server, but using NT Domain calls and a session
251  key from the machine password.  If the server parameter is specified
252  use it, otherwise figure out a server from the 'password server' param.
253 ************************************************************************/
254
255 static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx,
256                                         const struct auth_usersupplied_info *user_info,
257                                         const char *domain,
258                                         uchar chal[8],
259                                         struct auth_serversupplied_info **server_info,
260                                         const char *dc_name,
261                                         struct sockaddr_storage *dc_ss)
262
263 {
264         struct netr_SamInfo3 *info3 = NULL;
265         struct cli_state *cli = NULL;
266         struct rpc_pipe_client *netlogon_pipe = NULL;
267         NTSTATUS nt_status = NT_STATUS_NO_LOGON_SERVERS;
268         int i;
269
270         /*
271          * At this point, smb_apasswd points to the lanman response to
272          * the challenge in local_challenge, and smb_ntpasswd points to
273          * the NT response to the challenge in local_challenge. Ship
274          * these over the secure channel to a domain controller and
275          * see if they were valid.
276          */
277
278         /* rety loop for robustness */
279
280         for (i = 0; !NT_STATUS_IS_OK(nt_status) && (i < 3); i++) {
281                 nt_status = connect_to_domain_password_server(&cli,
282                                                         domain,
283                                                         dc_name,
284                                                         dc_ss,
285                                                         &netlogon_pipe);
286         }
287
288         if ( !NT_STATUS_IS_OK(nt_status) ) {
289                 DEBUG(0,("domain_client_validate: Domain password server not available.\n"));
290                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
291                         return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
292                 }
293                 return nt_status;
294         }
295
296         /* store a successful connection */
297
298         saf_store( domain, cli->desthost );
299
300         /*
301          * If this call succeeds, we now have lots of info about the user
302          * in the info3 structure.  
303          */
304
305         nt_status = rpccli_netlogon_sam_network_logon(netlogon_pipe,
306                                                       mem_ctx,
307                                                       user_info->logon_parameters,         /* flags such as 'allow workstation logon' */
308                                                       dc_name,                             /* server name */
309                                                       user_info->client.account_name,      /* user name logging on. */
310                                                       user_info->client.domain_name,       /* domain name */
311                                                       user_info->workstation_name,         /* workstation name */
312                                                       chal,                                /* 8 byte challenge. */
313                                                       3,                                   /* validation level */
314                                                       user_info->password.response.lanman, /* lanman 24 byte response */
315                                                       user_info->password.response.nt,     /* nt 24 byte response */
316                                                       &info3);                             /* info3 out */
317
318         /* Let go as soon as possible so we avoid any potential deadlocks
319            with winbind lookup up users or groups. */
320
321         TALLOC_FREE(mutex);
322
323         if (!NT_STATUS_IS_OK(nt_status)) {
324                 DEBUG(0,("domain_client_validate: unable to validate password "
325                          "for user %s in domain %s to Domain controller %s. "
326                          "Error was %s.\n", user_info->client.account_name,
327                          user_info->client.domain_name, dc_name,
328                          nt_errstr(nt_status)));
329
330                 /* map to something more useful */
331                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_UNSUCCESSFUL)) {
332                         nt_status = NT_STATUS_NO_LOGON_SERVERS;
333                 }
334         } else {
335                 nt_status = make_server_info_info3(mem_ctx,
336                                                    user_info->client.account_name,
337                                                    domain,
338                                                    server_info,
339                                                    info3);
340
341                 if (NT_STATUS_IS_OK(nt_status)) {
342                         (*server_info)->nss_token |= user_info->was_mapped;
343                         netsamlogon_cache_store(user_info->client.account_name, info3);
344                         TALLOC_FREE(info3);
345                 }
346         }
347
348         /* Note - once the cli stream is shutdown the mem_ctx used
349            to allocate the other_sids and gids structures has been deleted - so
350            these pointers are no longer valid..... */
351
352         cli_shutdown(cli);
353         return nt_status;
354 }
355
356 /****************************************************************************
357  Check for a valid username and password in security=domain mode.
358 ****************************************************************************/
359
360 static NTSTATUS check_ntdomain_security(const struct auth_context *auth_context,
361                                         void *my_private_data, 
362                                         TALLOC_CTX *mem_ctx,
363                                         const struct auth_usersupplied_info *user_info,
364                                         struct auth_serversupplied_info **server_info)
365 {
366         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
367         const char *domain = lp_workgroup();
368         fstring dc_name;
369         struct sockaddr_storage dc_ss;
370
371         if ( lp_server_role() != ROLE_DOMAIN_MEMBER ) {
372                 DEBUG(0,("check_ntdomain_security: Configuration error!  Cannot use "
373                         "ntdomain auth method when not a member of a domain.\n"));
374                 return NT_STATUS_NOT_IMPLEMENTED;
375         }
376
377         if (!user_info || !server_info || !auth_context) {
378                 DEBUG(1,("check_ntdomain_security: Critical variables not present.  Failing.\n"));
379                 return NT_STATUS_INVALID_PARAMETER;
380         }
381
382         DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
383
384         /* 
385          * Check that the requested domain is not our own machine name.
386          * If it is, we should never check the PDC here, we use our own local
387          * password file.
388          */
389
390         if(strequal(get_global_sam_name(), user_info->mapped.domain_name)) {
391                 DEBUG(3,("check_ntdomain_security: Requested domain was for this machine.\n"));
392                 return NT_STATUS_NOT_IMPLEMENTED;
393         }
394
395         /* we need our DC to send the net_sam_logon() request to */
396
397         if ( !get_dc_name(domain, NULL, dc_name, &dc_ss) ) {
398                 DEBUG(5,("check_ntdomain_security: unable to locate a DC for domain %s\n",
399                         user_info->mapped.domain_name));
400                 return NT_STATUS_NO_LOGON_SERVERS;
401         }
402
403         nt_status = domain_client_validate(mem_ctx,
404                                         user_info,
405                                         domain,
406                                         (uchar *)auth_context->challenge.data,
407                                         server_info,
408                                         dc_name,
409                                         &dc_ss);
410
411         return nt_status;
412 }
413
414 /* module initialisation */
415 static NTSTATUS auth_init_ntdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method) 
416 {
417         struct auth_methods *result;
418
419         result = TALLOC_ZERO_P(auth_context, struct auth_methods);
420         if (result == NULL) {
421                 return NT_STATUS_NO_MEMORY;
422         }
423         result->name = "ntdomain";
424         result->auth = check_ntdomain_security;
425
426         *auth_method = result;
427         return NT_STATUS_OK;
428 }
429
430
431 /****************************************************************************
432  Check for a valid username and password in a trusted domain
433 ****************************************************************************/
434
435 static NTSTATUS check_trustdomain_security(const struct auth_context *auth_context,
436                                            void *my_private_data, 
437                                            TALLOC_CTX *mem_ctx,
438                                            const struct auth_usersupplied_info *user_info,
439                                            struct auth_serversupplied_info **server_info)
440 {
441         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
442         unsigned char trust_md4_password[16];
443         char *trust_password;
444         fstring dc_name;
445         struct sockaddr_storage dc_ss;
446
447         if (!user_info || !server_info || !auth_context) {
448                 DEBUG(1,("check_trustdomain_security: Critical variables not present.  Failing.\n"));
449                 return NT_STATUS_INVALID_PARAMETER;
450         }
451
452         DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
453
454         /* 
455          * Check that the requested domain is not our own machine name or domain name.
456          */
457
458         if( strequal(get_global_sam_name(), user_info->mapped.domain_name)) {
459                 DEBUG(3,("check_trustdomain_security: Requested domain [%s] was for this machine.\n",
460                         user_info->mapped.domain_name));
461                 return NT_STATUS_NOT_IMPLEMENTED;
462         }
463
464         /* No point is bothering if this is not a trusted domain.
465            This return makes "map to guest = bad user" work again.
466            The logic is that if we know nothing about the domain, that
467            user is not known to us and does not exist */
468
469         if ( !is_trusted_domain( user_info->mapped.domain_name ) )
470                 return NT_STATUS_NOT_IMPLEMENTED;
471
472         /*
473          * Get the trusted account password for the trusted domain
474          * No need to become_root() as secrets_init() is done at startup.
475          */
476
477         if (!pdb_get_trusteddom_pw(user_info->mapped.domain_name, &trust_password,
478                                    NULL, NULL)) {
479                 DEBUG(0, ("check_trustdomain_security: could not fetch trust "
480                           "account password for domain %s\n",
481                           user_info->mapped.domain_name));
482                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
483         }
484
485 #ifdef DEBUG_PASSWORD
486         DEBUG(100, ("Trust password for domain %s is %s\n", user_info->mapped.domain_name,
487                     trust_password));
488 #endif
489         E_md4hash(trust_password, trust_md4_password);
490         SAFE_FREE(trust_password);
491
492 #if 0
493         /* Test if machine password is expired and need to be changed */
494         if (time(NULL) > last_change_time + (time_t)lp_machine_password_timeout())
495         {
496                 global_machine_password_needs_changing = True;
497         }
498 #endif
499
500         /* use get_dc_name() for consistency even through we know that it will be 
501            a netbios name */
502
503         if ( !get_dc_name(user_info->mapped.domain_name, NULL, dc_name, &dc_ss) ) {
504                 DEBUG(5,("check_trustdomain_security: unable to locate a DC for domain %s\n",
505                         user_info->mapped.domain_name));
506                 return NT_STATUS_NO_LOGON_SERVERS;
507         }
508
509         nt_status = domain_client_validate(mem_ctx,
510                                            user_info,
511                                            user_info->mapped.domain_name,
512                                            (uchar *)auth_context->challenge.data,
513                                            server_info,
514                                            dc_name,
515                                            &dc_ss);
516
517         return nt_status;
518 }
519
520 /* module initialisation */
521 static NTSTATUS auth_init_trustdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method) 
522 {
523         struct auth_methods *result;
524
525         result = TALLOC_ZERO_P(auth_context, struct auth_methods);
526         if (result == NULL) {
527                 return NT_STATUS_NO_MEMORY;
528         }
529         result->name = "trustdomain";
530         result->auth = check_trustdomain_security;
531
532         *auth_method = result;
533         return NT_STATUS_OK;
534 }
535
536 NTSTATUS auth_domain_init(void) 
537 {
538         smb_register_auth(AUTH_INTERFACE_VERSION, "trustdomain", auth_init_trustdomain);
539         smb_register_auth(AUTH_INTERFACE_VERSION, "ntdomain", auth_init_ntdomain);
540         return NT_STATUS_OK;
541 }