source3/winbindd/winbindd_creds.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - cached credentials funcions
   5
   6    Copyright (C) Guenther Deschner 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "winbindd.h"
  24 #include "../libcli/auth/libcli_auth.h"
  25 #include "../libcli/security/security.h"
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_WINBIND
  28
  29 #define MAX_CACHED_LOGINS 10
  30
  31 NTSTATUS winbindd_get_creds(struct winbindd_domain *domain,
  32                             TALLOC_CTX *mem_ctx,
  33                             const struct dom_sid *sid,
  34                             struct netr_SamInfo3 **info3,
  35                             const uint8 *cached_nt_pass[NT_HASH_LEN],
  36                             const uint8 *cred_salt[NT_HASH_LEN])
  37 {
  38         struct netr_SamInfo3 *info;
  39         NTSTATUS status;
  40
  41         if (!winbindd_use_cache()) {
  42                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
  43         }
  44
  45         status = wcache_get_creds(domain, mem_ctx, sid, cached_nt_pass, cred_salt);
  46         if (!NT_STATUS_IS_OK(status)) {
  47                 return status;
  48         }
  49
  50         info = netsamlogon_cache_get(mem_ctx, sid);
  51         if (info == NULL) {
  52                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
  53         }
  54
  55         *info3 = info;
  56
  57         return NT_STATUS_OK;
  58 }
  59
  60
  61 NTSTATUS winbindd_store_creds(struct winbindd_domain *domain,
  62                               const char *user,
  63                               const char *pass,
  64                               struct netr_SamInfo3 *info3)
  65 {
  66         NTSTATUS status;
  67         uchar nt_pass[NT_HASH_LEN];
  68         struct dom_sid cred_sid;
  69
  70         if (info3 != NULL) {
  71
  72                 sid_compose(&cred_sid, info3->base.domain_sid,
  73                             info3->base.rid);
  74                 info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
  75
  76         } else if (user != NULL) {
  77
  78                 /* do lookup ourself */
  79
  80                 enum lsa_SidType type;
  81
  82                 if (!lookup_cached_name(domain->name,
  83                                         user,
  84                                         &cred_sid,
  85                                         &type)) {
  86                         return NT_STATUS_NO_SUCH_USER;
  87                 }
  88         } else {
  89                 return NT_STATUS_INVALID_PARAMETER;
  90         }
  91
  92         if (pass) {
  93
  94                 int count = 0;
  95
  96                 status = wcache_count_cached_creds(domain, &count);
  97                 if (!NT_STATUS_IS_OK(status)) {
  98                         return status;
  99                 }
 100
 101                 DEBUG(11,("we have %d cached creds\n", count));
 102
 103                 if (count + 1 > MAX_CACHED_LOGINS) {
 104
 105                         DEBUG(10,("need to delete the oldest cached login\n"));
 106
 107                         status = wcache_remove_oldest_cached_creds(domain, &cred_sid);
 108                         if (!NT_STATUS_IS_OK(status)) {
 109                                 DEBUG(10,("failed to remove oldest cached cred: %s\n",
 110                                         nt_errstr(status)));
 111                                 return status;
 112                         }
 113                 }
 114
 115                 E_md4hash(pass, nt_pass);
 116
 117                 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
 118
 119                 status = wcache_save_creds(domain, &cred_sid, nt_pass);
 120                 if (!NT_STATUS_IS_OK(status)) {
 121                         return status;
 122                 }
 123         }
 124
 125         if (info3 != NULL && user != NULL) {
 126                 if (!netsamlogon_cache_store(user, info3)) {
 127                         return NT_STATUS_ACCESS_DENIED;
 128                 }
 129         }
 130
 131         return NT_STATUS_OK;
 132 }
 133
 134 NTSTATUS winbindd_update_creds_by_info3(struct winbindd_domain *domain,
 135                                         const char *user,
 136                                         const char *pass,
 137                                         struct netr_SamInfo3 *info3)
 138 {
 139         return winbindd_store_creds(domain, user, pass, info3);
 140 }
 141
 142 NTSTATUS winbindd_update_creds_by_name(struct winbindd_domain *domain,
 143                                        const char *user,
 144                                        const char *pass)
 145 {
 146         return winbindd_store_creds(domain, user, pass, NULL);
 147 }
 148
 149