source4/auth/system_session.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001-2010
   6    Copyright (C) Jeremy Allison 2000-2001
   7    Copyright (C) Rafal Szczesniak 2002
   8    Copyright (C) Stefan Metzmacher 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "libcli/security/security.h"
  26 #include "auth/credentials/credentials.h"
  27 #include "param/param.h"
  28 #include "auth/auth.h" /* for auth_serversupplied_info */
  29 #include "auth/session.h"
  30 #include "auth/system_session_proto.h"
  31
  32
  33 /*
  34   prevent the static system session being freed
  35  */
  36 static int system_session_destructor(struct auth_session_info *info)
  37 {
  38         return -1;
  39 }
  40
  41 /* Create a security token for a session SYSTEM (the most
  42  * trusted/prvilaged account), including the local machine account as
  43  * the off-host credentials
  44  */
  45 _PUBLIC_ struct auth_session_info *system_session(struct loadparm_context *lp_ctx)
  46 {
  47         static struct auth_session_info *static_session;
  48         NTSTATUS nt_status;
  49
  50         if (static_session) {
  51                 return static_session;
  52         }
  53
  54         nt_status = auth_system_session_info(talloc_autofree_context(),
  55                                              lp_ctx,
  56                                              &static_session);
  57         if (!NT_STATUS_IS_OK(nt_status)) {
  58                 talloc_free(static_session);
  59                 static_session = NULL;
  60                 return NULL;
  61         }
  62         talloc_set_destructor(static_session, system_session_destructor);
  63         return static_session;
  64 }
  65
  66 NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
  67                                   struct loadparm_context *lp_ctx,
  68                                   struct auth_session_info **_session_info)
  69 {
  70         NTSTATUS nt_status;
  71         struct auth_serversupplied_info *server_info = NULL;
  72         struct auth_session_info *session_info = NULL;
  73         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
  74
  75         nt_status = auth_system_server_info(mem_ctx, lpcfg_netbios_name(lp_ctx),
  76                                             &server_info);
  77         if (!NT_STATUS_IS_OK(nt_status)) {
  78                 talloc_free(mem_ctx);
  79                 return nt_status;
  80         }
  81
  82         /* references the server_info into the session_info */
  83         nt_status = auth_generate_session_info(parent_ctx, NULL, NULL, server_info, AUTH_SESSION_INFO_SIMPLE_PRIVILEGES, &session_info);
  84         talloc_free(mem_ctx);
  85
  86         NT_STATUS_NOT_OK_RETURN(nt_status);
  87
  88         session_info->credentials = cli_credentials_init(session_info);
  89         if (!session_info->credentials) {
  90                 return NT_STATUS_NO_MEMORY;
  91         }
  92
  93         cli_credentials_set_conf(session_info->credentials, lp_ctx);
  94
  95         cli_credentials_set_machine_account_pending(session_info->credentials, lp_ctx);
  96         *_session_info = session_info;
  97
  98         return NT_STATUS_OK;
  99 }
 100
 101 NTSTATUS auth_system_server_info(TALLOC_CTX *mem_ctx, const char *netbios_name,
 102                                  struct auth_serversupplied_info **_server_info)
 103 {
 104         struct auth_serversupplied_info *server_info;
 105
 106         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 107         NT_STATUS_HAVE_NO_MEMORY(server_info);
 108
 109         /* This returns a pointer to a struct dom_sid, which is the
 110          * same as a 1 element list of struct dom_sid */
 111         server_info->num_sids = 1;
 112         server_info->sids = dom_sid_parse_talloc(server_info, SID_NT_SYSTEM);
 113         NT_STATUS_HAVE_NO_MEMORY(server_info->sids);
 114
 115         /* annoying, but the Anonymous really does have a session key,
 116            and it is all zeros! */
 117         server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
 118         NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 119
 120         server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
 121         NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 122
 123         data_blob_clear(&server_info->user_session_key);
 124         data_blob_clear(&server_info->lm_session_key);
 125
 126         server_info->account_name = talloc_strdup(server_info, "SYSTEM");
 127         NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 128
 129         server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
 130         NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
 131
 132         server_info->full_name = talloc_strdup(server_info, "System");
 133         NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
 134
 135         server_info->logon_script = talloc_strdup(server_info, "");
 136         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
 137
 138         server_info->profile_path = talloc_strdup(server_info, "");
 139         NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
 140
 141         server_info->home_directory = talloc_strdup(server_info, "");
 142         NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
 143
 144         server_info->home_drive = talloc_strdup(server_info, "");
 145         NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
 146
 147         server_info->logon_server = talloc_strdup(server_info, netbios_name);
 148         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
 149
 150         server_info->last_logon = 0;
 151         server_info->last_logoff = 0;
 152         server_info->acct_expiry = 0;
 153         server_info->last_password_change = 0;
 154         server_info->allow_password_change = 0;
 155         server_info->force_password_change = 0;
 156
 157         server_info->logon_count = 0;
 158         server_info->bad_password_count = 0;
 159
 160         server_info->acct_flags = ACB_NORMAL;
 161
 162         server_info->authenticated = true;
 163
 164         *_server_info = server_info;
 165
 166         return NT_STATUS_OK;
 167 }
 168
 169
 170 static NTSTATUS auth_domain_admin_server_info(TALLOC_CTX *mem_ctx,
 171                                               const char *netbios_name,
 172                                               const char *domain_name,
 173                                               struct dom_sid *domain_sid,
 174                                               struct auth_serversupplied_info **_server_info)
 175 {
 176         struct auth_serversupplied_info *server_info;
 177
 178         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 179         NT_STATUS_HAVE_NO_MEMORY(server_info);
 180
 181         server_info->num_sids = 7;
 182         server_info->sids = talloc_array(server_info, struct dom_sid, server_info->num_sids);
 183
 184         server_info->sids[PRIMARY_USER_SID_INDEX] = *domain_sid;
 185         sid_append_rid(&server_info->sids[PRIMARY_USER_SID_INDEX], DOMAIN_RID_ADMINISTRATOR);
 186
 187         server_info->sids[PRIMARY_GROUP_SID_INDEX] = *domain_sid;
 188         sid_append_rid(&server_info->sids[PRIMARY_USER_SID_INDEX], DOMAIN_RID_USERS);
 189
 190         server_info->sids[2] = global_sid_Builtin_Administrators;
 191
 192         server_info->sids[3] = *domain_sid;
 193         sid_append_rid(&server_info->sids[3], DOMAIN_RID_ADMINS);
 194         server_info->sids[4] = *domain_sid;
 195         sid_append_rid(&server_info->sids[4], DOMAIN_RID_ENTERPRISE_ADMINS);
 196         server_info->sids[5] = *domain_sid;
 197         sid_append_rid(&server_info->sids[5], DOMAIN_RID_POLICY_ADMINS);
 198         server_info->sids[6] = *domain_sid;
 199         sid_append_rid(&server_info->sids[6], DOMAIN_RID_SCHEMA_ADMINS);
 200
 201         /* What should the session key be?*/
 202         server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
 203         NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 204
 205         server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
 206         NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 207
 208         data_blob_clear(&server_info->user_session_key);
 209         data_blob_clear(&server_info->lm_session_key);
 210
 211         server_info->account_name = talloc_strdup(server_info, "Administrator");
 212         NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 213
 214         server_info->domain_name = talloc_strdup(server_info, domain_name);
 215         NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
 216
 217         server_info->full_name = talloc_strdup(server_info, "Administrator");
 218         NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
 219
 220         server_info->logon_script = talloc_strdup(server_info, "");
 221         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
 222
 223         server_info->profile_path = talloc_strdup(server_info, "");
 224         NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
 225
 226         server_info->home_directory = talloc_strdup(server_info, "");
 227         NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
 228
 229         server_info->home_drive = talloc_strdup(server_info, "");
 230         NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
 231
 232         server_info->logon_server = talloc_strdup(server_info, netbios_name);
 233         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
 234
 235         server_info->last_logon = 0;
 236         server_info->last_logoff = 0;
 237         server_info->acct_expiry = 0;
 238         server_info->last_password_change = 0;
 239         server_info->allow_password_change = 0;
 240         server_info->force_password_change = 0;
 241
 242         server_info->logon_count = 0;
 243         server_info->bad_password_count = 0;
 244
 245         server_info->acct_flags = ACB_NORMAL;
 246
 247         server_info->authenticated = true;
 248
 249         *_server_info = server_info;
 250
 251         return NT_STATUS_OK;
 252 }
 253
 254 static NTSTATUS auth_domain_admin_session_info(TALLOC_CTX *parent_ctx,
 255                                                struct loadparm_context *lp_ctx,
 256                                                struct dom_sid *domain_sid,
 257                                                struct auth_session_info **session_info)
 258 {
 259         NTSTATUS nt_status;
 260         struct auth_serversupplied_info *server_info = NULL;
 261         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 262
 263         nt_status = auth_domain_admin_server_info(mem_ctx, lpcfg_netbios_name(lp_ctx),
 264                                                   lpcfg_workgroup(lp_ctx), domain_sid,
 265                                                   &server_info);
 266         if (!NT_STATUS_IS_OK(nt_status)) {
 267                 talloc_free(mem_ctx);
 268                 return nt_status;
 269         }
 270
 271         nt_status = auth_generate_session_info(mem_ctx, NULL, NULL, server_info,
 272                                                AUTH_SESSION_INFO_SIMPLE_PRIVILEGES|AUTH_SESSION_INFO_AUTHENTICATED|AUTH_SESSION_INFO_DEFAULT_GROUPS,
 273                                                session_info);
 274         /* There is already a reference between the sesion_info and server_info */
 275         if (NT_STATUS_IS_OK(nt_status)) {
 276                 talloc_steal(parent_ctx, *session_info);
 277         }
 278         talloc_free(mem_ctx);
 279         return nt_status;
 280 }
 281
 282 _PUBLIC_ struct auth_session_info *admin_session(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, struct dom_sid *domain_sid)
 283 {
 284         NTSTATUS nt_status;
 285         struct auth_session_info *session_info = NULL;
 286         nt_status = auth_domain_admin_session_info(mem_ctx,
 287                                                    lp_ctx,
 288                                                    domain_sid,
 289                                                    &session_info);
 290         if (!NT_STATUS_IS_OK(nt_status)) {
 291                 return NULL;
 292         }
 293         return session_info;
 294 }
 295
 296 _PUBLIC_ NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
 297                                               struct loadparm_context *lp_ctx,
 298                                               struct auth_session_info **_session_info)
 299 {
 300         NTSTATUS nt_status;
 301         struct auth_serversupplied_info *server_info = NULL;
 302         struct auth_session_info *session_info = NULL;
 303         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 304
 305         nt_status = auth_anonymous_server_info(mem_ctx,
 306                                                lpcfg_netbios_name(lp_ctx),
 307                                                &server_info);
 308         if (!NT_STATUS_IS_OK(nt_status)) {
 309                 talloc_free(mem_ctx);
 310                 return nt_status;
 311         }
 312
 313         /* references the server_info into the session_info */
 314         nt_status = auth_generate_session_info(parent_ctx, NULL, NULL, server_info, AUTH_SESSION_INFO_SIMPLE_PRIVILEGES, &session_info);
 315         talloc_free(mem_ctx);
 316
 317         NT_STATUS_NOT_OK_RETURN(nt_status);
 318
 319         session_info->credentials = cli_credentials_init(session_info);
 320         if (!session_info->credentials) {
 321                 return NT_STATUS_NO_MEMORY;
 322         }
 323
 324         cli_credentials_set_conf(session_info->credentials, lp_ctx);
 325         cli_credentials_set_anonymous(session_info->credentials);
 326
 327         *_session_info = session_info;
 328
 329         return NT_STATUS_OK;
 330 }
 331
 332 _PUBLIC_ NTSTATUS auth_anonymous_server_info(TALLOC_CTX *mem_ctx,
 333                                     const char *netbios_name,
 334                                     struct auth_serversupplied_info **_server_info)
 335 {
 336         struct auth_serversupplied_info *server_info;
 337         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 338         NT_STATUS_HAVE_NO_MEMORY(server_info);
 339
 340         /* This returns a pointer to a struct dom_sid, which is the
 341          * same as a 1 element list of struct dom_sid */
 342         server_info->num_sids = 1;
 343         server_info->sids = dom_sid_parse_talloc(server_info, SID_NT_ANONYMOUS);
 344         NT_STATUS_HAVE_NO_MEMORY(server_info->sids);
 345
 346         /* annoying, but the Anonymous really does have a session key... */
 347         server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
 348         NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 349
 350         server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
 351         NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 352
 353         /*  and it is all zeros! */
 354         data_blob_clear(&server_info->user_session_key);
 355         data_blob_clear(&server_info->lm_session_key);
 356
 357         server_info->account_name = talloc_strdup(server_info, "ANONYMOUS LOGON");
 358         NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 359
 360         server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
 361         NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
 362
 363         server_info->full_name = talloc_strdup(server_info, "Anonymous Logon");
 364         NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
 365
 366         server_info->logon_script = talloc_strdup(server_info, "");
 367         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
 368
 369         server_info->profile_path = talloc_strdup(server_info, "");
 370         NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
 371
 372         server_info->home_directory = talloc_strdup(server_info, "");
 373         NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
 374
 375         server_info->home_drive = talloc_strdup(server_info, "");
 376         NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
 377
 378         server_info->logon_server = talloc_strdup(server_info, netbios_name);
 379         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
 380
 381         server_info->last_logon = 0;
 382         server_info->last_logoff = 0;
 383         server_info->acct_expiry = 0;
 384         server_info->last_password_change = 0;
 385         server_info->allow_password_change = 0;
 386         server_info->force_password_change = 0;
 387
 388         server_info->logon_count = 0;
 389         server_info->bad_password_count = 0;
 390
 391         server_info->acct_flags = ACB_NORMAL;
 392
 393         server_info->authenticated = false;
 394
 395         *_server_info = server_info;
 396
 397         return NT_STATUS_OK;
 398 }
 399