ddeaf1d99402e75ecca05a0e4b2d58d19561baab
[samba.git] / source3 / winbindd / winbindd_ccache_access.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    Winbind daemon - cached credentials funcions
5
6    Copyright (C) Robert O'Callahan 2006
7    Copyright (C) Jeremy Allison 2006 (minor fixes to fit into Samba and
8                                       protect against integer wrap).
9    Copyright (C) Andrew Bartlett 2011
10
11    This program is free software; you can redistribute it and/or modify
12    it under the terms of the GNU General Public License as published by
13    the Free Software Foundation; either version 3 of the License, or
14    (at your option) any later version.
15
16    This program is distributed in the hope that it will be useful,
17    but WITHOUT ANY WARRANTY; without even the implied warranty of
18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19    GNU General Public License for more details.
20
21    You should have received a copy of the GNU General Public License
22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27 #include "auth/gensec/gensec.h"
28 #include "auth_generic.h"
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_WINBIND
32
33 static bool client_can_access_ccache_entry(uid_t client_uid,
34                                         struct WINBINDD_MEMORY_CREDS *entry)
35 {
36         if (client_uid == entry->uid || client_uid == 0) {
37                 DEBUG(10, ("Access granted to uid %u\n", (unsigned int)client_uid));
38                 return True;
39         }
40
41         DEBUG(1, ("Access denied to uid %u (expected %u)\n",
42                 (unsigned int)client_uid, (unsigned int)entry->uid));
43         return False;
44 }
45
46 static NTSTATUS do_ntlm_auth_with_stored_pw(const char *namespace,
47                                             const char *domain,
48                                             const char *username,
49                                             const char *password,
50                                             const DATA_BLOB initial_msg,
51                                             const DATA_BLOB challenge_msg,
52                                             TALLOC_CTX *mem_ctx,
53                                             DATA_BLOB *auth_msg,
54                                             uint8_t session_key[16],
55                                             uint8_t *new_spnego)
56 {
57         NTSTATUS status;
58         struct auth_generic_state *auth_generic_state = NULL;
59         DATA_BLOB reply, session_key_blob;
60
61         status = auth_generic_client_prepare(mem_ctx, &auth_generic_state);
62
63         if (!NT_STATUS_IS_OK(status)) {
64                 DEBUG(1, ("Could not start NTLMSSP client: %s\n",
65                         nt_errstr(status)));
66                 goto done;
67         }
68
69         status = auth_generic_set_username(auth_generic_state, username);
70
71         if (!NT_STATUS_IS_OK(status)) {
72                 DEBUG(1, ("Could not set username: %s\n",
73                         nt_errstr(status)));
74                 goto done;
75         }
76
77         status = auth_generic_set_domain(auth_generic_state, domain);
78
79         if (!NT_STATUS_IS_OK(status)) {
80                 DEBUG(1, ("Could not set domain: %s\n",
81                         nt_errstr(status)));
82                 goto done;
83         }
84
85         status = auth_generic_set_password(auth_generic_state, password);
86
87         if (!NT_STATUS_IS_OK(status)) {
88                 DEBUG(1, ("Could not set password: %s\n",
89                         nt_errstr(status)));
90                 goto done;
91         }
92
93         if (initial_msg.length == 0) {
94                 gensec_want_feature(auth_generic_state->gensec_security,
95                                     GENSEC_FEATURE_SESSION_KEY);
96         }
97
98         status = auth_generic_client_start_by_name(auth_generic_state,
99                                                    "ntlmssp_resume_ccache");
100         if (!NT_STATUS_IS_OK(status)) {
101                 DEBUG(1, ("Could not start NTLMSSP resume mech: %s\n",
102                         nt_errstr(status)));
103                 goto done;
104         }
105
106         /*
107          * We inject the inital NEGOTIATE message our caller used
108          * in order to get the state machine into the correct possition.
109          */
110         reply = data_blob_null;
111         status = gensec_update(auth_generic_state->gensec_security,
112                                talloc_tos(), initial_msg, &reply);
113         data_blob_free(&reply);
114
115         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
116                 DEBUG(1, ("Failed to create initial message! [%s]\n",
117                         nt_errstr(status)));
118                 goto done;
119         }
120
121         /* Now we are ready to handle the server's actual response. */
122         status = gensec_update(auth_generic_state->gensec_security,
123                                mem_ctx, challenge_msg, &reply);
124         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
125                 DEBUG(1, ("We didn't get a response to the challenge! [%s]\n",
126                         nt_errstr(status)));
127                 data_blob_free(&reply);
128                 goto done;
129         }
130
131         status = gensec_session_key(auth_generic_state->gensec_security,
132                                     talloc_tos(), &session_key_blob);
133         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
134                 DEBUG(1, ("We didn't get the session key we requested! [%s]\n",
135                         nt_errstr(status)));
136                 data_blob_free(&reply);
137                 goto done;
138         }
139
140         if (session_key_blob.length != 16) {
141                 DEBUG(1, ("invalid session key length %d\n",
142                           (int)session_key_blob.length));
143                 data_blob_free(&reply);
144                 goto done;
145         }
146         memcpy(session_key, session_key_blob.data, 16);
147         data_blob_free(&session_key_blob);
148         *auth_msg = reply;
149         *new_spnego = gensec_have_feature(auth_generic_state->gensec_security,
150                                           GENSEC_FEATURE_NEW_SPNEGO);
151         status = NT_STATUS_OK;
152
153 done:
154         TALLOC_FREE(auth_generic_state);
155         return status;
156 }
157
158 static bool check_client_uid(struct winbindd_cli_state *state, uid_t uid)
159 {
160         int ret;
161         uid_t ret_uid;
162         gid_t ret_gid;
163
164         ret_uid = (uid_t)-1;
165
166         ret = getpeereid(state->sock, &ret_uid, &ret_gid);
167         if (ret != 0) {
168                 DEBUG(1, ("check_client_uid: Could not get socket peer uid: %s; "
169                         "denying access\n", strerror(errno)));
170                 return False;
171         }
172
173         if (uid != ret_uid && ret_uid != sec_initial_uid()) {
174                 DEBUG(1, ("check_client_uid: Client lied about its uid: said %u, "
175                         "actually was %u; denying access\n",
176                         (unsigned int)uid, (unsigned int)ret_uid));
177                 return False;
178         }
179
180         return True;
181 }
182
183 void winbindd_ccache_ntlm_auth(struct winbindd_cli_state *state)
184 {
185         struct winbindd_domain *domain;
186         fstring name_namespace, name_domain, name_user;
187         NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
188         struct WINBINDD_MEMORY_CREDS *entry;
189         DATA_BLOB initial, challenge, auth;
190         uint32_t initial_blob_len, challenge_blob_len, extra_len;
191         bool ok;
192
193         /* Ensure null termination */
194         state->request->data.ccache_ntlm_auth.user[
195                         sizeof(state->request->data.ccache_ntlm_auth.user)-1]='\0';
196
197         DEBUG(3, ("[%5lu]: perform NTLM auth on behalf of user %s\n", (unsigned long)state->pid,
198                 state->request->data.ccache_ntlm_auth.user));
199
200         /* Parse domain and username */
201
202         ok = canonicalize_username(state->request->data.ccache_ntlm_auth.user,
203                                    name_namespace,
204                                    name_domain,
205                                    name_user);
206         if (!ok) {
207                 DEBUG(5,("winbindd_ccache_ntlm_auth: cannot parse domain and user from name [%s]\n",
208                         state->request->data.ccache_ntlm_auth.user));
209                 request_error(state);
210                 return;
211         }
212
213         domain = find_auth_domain(state->request->flags, name_domain);
214
215         if (domain == NULL) {
216                 DEBUG(5,("winbindd_ccache_ntlm_auth: can't get domain [%s]\n",
217                         name_domain));
218                 request_error(state);
219                 return;
220         }
221
222         if (!check_client_uid(state, state->request->data.ccache_ntlm_auth.uid)) {
223                 request_error(state);
224                 return;
225         }
226
227         /* validate blob lengths */
228         initial_blob_len = state->request->data.ccache_ntlm_auth.initial_blob_len;
229         challenge_blob_len = state->request->data.ccache_ntlm_auth.challenge_blob_len;
230         extra_len = state->request->extra_len;
231
232         if (initial_blob_len > extra_len || challenge_blob_len > extra_len ||
233                 initial_blob_len + challenge_blob_len > extra_len ||
234                 initial_blob_len + challenge_blob_len < initial_blob_len ||
235                 initial_blob_len + challenge_blob_len < challenge_blob_len) {
236
237                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: blob lengths overrun "
238                         "or wrap. Buffer [%d+%d > %d]\n",
239                         initial_blob_len,
240                         challenge_blob_len,
241                         extra_len));
242                 goto process_result;
243         }
244
245         /* Parse domain and username */
246         ok = parse_domain_user(state->request->data.ccache_ntlm_auth.user,
247                                name_namespace,
248                                name_domain,
249                                name_user);
250         if (!ok) {
251                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: cannot parse "
252                         "domain and user from name [%s]\n",
253                         state->request->data.ccache_ntlm_auth.user));
254                 goto process_result;
255         }
256
257         entry = find_memory_creds_by_name(state->request->data.ccache_ntlm_auth.user);
258         if (entry == NULL || entry->nt_hash == NULL || entry->lm_hash == NULL) {
259                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: could not find "
260                         "credentials for user %s\n", 
261                         state->request->data.ccache_ntlm_auth.user));
262                 goto process_result;
263         }
264
265         DEBUG(10,("winbindd_dual_ccache_ntlm_auth: found ccache [%s]\n", entry->username));
266
267         if (!client_can_access_ccache_entry(state->request->data.ccache_ntlm_auth.uid, entry)) {
268                 goto process_result;
269         }
270
271         if (initial_blob_len == 0 && challenge_blob_len == 0) {
272                 /* this is just a probe to see if credentials are available. */
273                 result = NT_STATUS_OK;
274                 state->response->data.ccache_ntlm_auth.auth_blob_len = 0;
275                 goto process_result;
276         }
277
278         initial = data_blob_const(state->request->extra_data.data,
279                                   initial_blob_len);
280         challenge = data_blob_const(
281                 state->request->extra_data.data + initial_blob_len,
282                 state->request->data.ccache_ntlm_auth.challenge_blob_len);
283
284         result = do_ntlm_auth_with_stored_pw(
285                         name_namespace,
286                         name_domain,
287                         name_user,
288                         entry->pass,
289                         initial,
290                         challenge,
291                         talloc_tos(),
292                         &auth,
293                         state->response->data.ccache_ntlm_auth.session_key,
294                         &state->response->data.ccache_ntlm_auth.new_spnego);
295
296         if (!NT_STATUS_IS_OK(result)) {
297                 goto process_result;
298         }
299
300         state->response->extra_data.data = talloc_memdup(
301                 state->mem_ctx, auth.data, auth.length);
302         if (!state->response->extra_data.data) {
303                 result = NT_STATUS_NO_MEMORY;
304                 goto process_result;
305         }
306         state->response->length += auth.length;
307         state->response->data.ccache_ntlm_auth.auth_blob_len = auth.length;
308
309         data_blob_free(&auth);
310
311   process_result:
312         if (!NT_STATUS_IS_OK(result)) {
313                 request_error(state);
314                 return;
315         }
316         request_ok(state);
317 }
318
319 void winbindd_ccache_save(struct winbindd_cli_state *state)
320 {
321         struct winbindd_domain *domain;
322         fstring name_namespace, name_domain, name_user;
323         NTSTATUS status;
324         bool ok;
325
326         /* Ensure null termination */
327         state->request->data.ccache_save.user[
328                 sizeof(state->request->data.ccache_save.user)-1]='\0';
329         state->request->data.ccache_save.pass[
330                 sizeof(state->request->data.ccache_save.pass)-1]='\0';
331
332         DEBUG(3, ("[%5lu]: save password of user %s\n",
333                   (unsigned long)state->pid,
334                   state->request->data.ccache_save.user));
335
336         /* Parse domain and username */
337
338         ok = canonicalize_username(state->request->data.ccache_save.user,
339                                    name_namespace,
340                                    name_domain,
341                                    name_user);
342         if (!ok) {
343                 DEBUG(5,("winbindd_ccache_save: cannot parse domain and user "
344                          "from name [%s]\n",
345                          state->request->data.ccache_save.user));
346                 request_error(state);
347                 return;
348         }
349
350         /*
351          * The domain is checked here only for compatibility
352          * reasons. We used to do the winbindd memory ccache for
353          * ntlm_auth in the domain child. With that code, we had to
354          * make sure that we do have a domain around to send this
355          * to. Now we do the memory cache in the parent winbindd,
356          * where it would not matter if we have a domain or not.
357          */
358
359         domain = find_auth_domain(state->request->flags, name_domain);
360         if (domain == NULL) {
361                 DEBUG(5, ("winbindd_ccache_save: can't get domain [%s]\n",
362                           name_domain));
363                 request_error(state);
364                 return;
365         }
366
367         if (!check_client_uid(state, state->request->data.ccache_save.uid)) {
368                 request_error(state);
369                 return;
370         }
371
372         status = winbindd_add_memory_creds(
373                 state->request->data.ccache_save.user,
374                 state->request->data.ccache_save.uid,
375                 state->request->data.ccache_save.pass);
376
377         if (!NT_STATUS_IS_OK(status)) {
378                 DEBUG(1, ("winbindd_add_memory_creds failed %s\n",
379                           nt_errstr(status)));
380                 request_error(state);
381                 return;
382         }
383         request_ok(state);
384 }