auth->a_u.auth_ntlmssp_state = NULL;
}
-static DATA_BLOB generic_session_key(void)
-{
- return data_blob("SystemLibraryDTC", 16);
-}
-
/*******************************************************************
Generate the next PDU to be returned from the data in p->rdata.
Handle NTLMSSP.
ZERO_STRUCT(reply);
+ memset(p->user_name, '\0', sizeof(p->user_name));
+ memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
+ memset(p->domain, '\0', sizeof(p->domain));
+ memset(p->wks, '\0', sizeof(p->wks));
+
+ /* Set up for non-authenticated user. */
+ TALLOC_FREE(p->pipe_user.nt_user_token);
+ p->pipe_user.ut.ngroups = 0;
+ SAFE_FREE( p->pipe_user.ut.groups);
+
/* this has to be done as root in order to verify the password */
become_root();
status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
return False;
}
- if (a->server_info->ptok == NULL) {
- DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
- p->pipe_user.nt_user_token = NULL;
- return False;
- }
-
/* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
ensure the underlying NTLMSSP flags are also set. If not we should
refuse the bind. */
}
}
+ fstrcpy(p->user_name, a->ntlmssp_state->user);
+ fstrcpy(p->pipe_user_name, a->server_info->unix_name);
+ fstrcpy(p->domain, a->ntlmssp_state->domain);
+ fstrcpy(p->wks, a->ntlmssp_state->workstation);
+
DEBUG(5,("pipe_ntlmssp_verify_final: OK: user: %s domain: %s workstation: %s\n",
- a->ntlmssp_state->user, a->ntlmssp_state->domain,
- a->ntlmssp_state->workstation));
+ p->user_name, p->domain, p->wks));
/*
* Store the UNIX credential data (uid/gid pair) in the pipe structure.
p->pipe_user.ut.gid = a->server_info->gid;
/*
- * We're an authenticated bind over smb, so the session key needs to
- * be set to "SystemLibraryDTC". Weird, but this is what Windows
- * does. See the RPC-SAMBA3SESSIONKEY.
+ * Copy the session key from the ntlmssp state.
*/
data_blob_free(&p->session_key);
- p->session_key = generic_session_key();
+ p->session_key = data_blob(a->ntlmssp_state->session_key.data, a->ntlmssp_state->session_key.length);
if (!p->session_key.data) {
return False;
}
p->pipe_user.ut.ngroups = a->server_info->n_groups;
if (p->pipe_user.ut.ngroups) {
- if (!(p->pipe_user.ut.groups = (gid_t *)
- memdup(a->server_info->groups,
- sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
- DEBUG(0,("pipe_ntlmssp_verify_final: failed to memdup group list to p->pipe_user.groups\n"));
- data_blob_free(&p->session_key);
+ if (!(p->pipe_user.ut.groups = (gid_t *)memdup(a->server_info->groups,
+ sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
+ DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
return False;
}
}
- if (!a->server_info->ptok) {
- DEBUG(1,("pipe_ntlmssp_verify_final: Error: Authmodule failed to provide nt_user_token\n"));
- data_blob_free(&p->session_key);
- SAFE_FREE(p->pipe_user.ut.groups);
- return False;
- }
-
- p->pipe_user.nt_user_token = dup_nt_token(NULL, a->server_info->ptok);
- if (!p->pipe_user.nt_user_token) {
- DEBUG(1,("pipe_ntlmssp_verify_final: dup_nt_token failed.\n"));
- data_blob_free(&p->session_key);
- SAFE_FREE(p->pipe_user.ut.groups);
+ if (a->server_info->ptok) {
+ p->pipe_user.nt_user_token =
+ dup_nt_token(NULL, a->server_info->ptok);
+ } else {
+ DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
+ p->pipe_user.nt_user_token = NULL;
return False;
}
* JRA. Should we also copy the schannel session key into the pipe session key p->session_key
* here ? We do that for NTLMSSP, but the session key is already set up from the vuser
* struct of the person who opened the pipe. I need to test this further. JRA.
- *
- * VL. As we are mapping this to guest set the generic key
- * "SystemLibraryDTC" key here. It's a bit difficult to test against
- * W2k3, as it does not allow schannel binds against SAMR and LSA
- * anymore.
*/
- data_blob_free(&p->session_key);
- p->session_key = generic_session_key();
- if (p->session_key.data == NULL) {
- DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
- " key\n"));
- return False;
- }
-
init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
p->auth.auth_data_free_func = NULL;
p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
- if (!set_current_user_guest(&p->pipe_user)) {
- DEBUG(1, ("pipe_schannel_auth_bind: Could not set guest "
- "token\n"));
- return False;
- }
-
p->pipe_bound = True;
return True;
return True;
}
+/****************************************************************************
+ Return a user struct for a pipe user.
+****************************************************************************/
+
+struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
+{
+ if (p->pipe_bound &&
+ (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
+ (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
+ memcpy(user, &p->pipe_user, sizeof(struct current_user));
+ } else {
+ memcpy(user, ¤t_user, sizeof(struct current_user));
+ }
+
+ return user;
+}
+
/****************************************************************************
Find the set of RPC functions associated with this context_id
****************************************************************************/
BOOL changed_user = False;
PIPE_RPC_FNS *pipe_fns;
- if (p->pipe_bound) {
+ if (p->pipe_bound &&
+ ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
+ (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
if(!become_authenticated_pipe_user(p)) {
prs_mem_free(&p->out_data.rdata);
return False;
netlog_get_pipe_fns( &cmds, &n_cmds );
break;
case PI_SRVSVC:
- srvsvc_get_pipe_fns( &cmds, &n_cmds );
+ srvsvc2_get_pipe_fns( &cmds, &n_cmds );
break;
case PI_WKSSVC:
wkssvc_get_pipe_fns( &cmds, &n_cmds );
case PI_SVCCTL:
svcctl2_get_pipe_fns( &cmds, &n_cmds );
break;
- case PI_EVENTLOG:
+ case PI_EVENTLOG:
eventlog2_get_pipe_fns( &cmds, &n_cmds );
break;
- case PI_UNIXINFO:
- unixinfo_get_pipe_fns( &cmds, &n_cmds );
- break;
case PI_NTSVCS:
ntsvcs_get_pipe_fns( &cmds, &n_cmds );
break;
rpcecho_get_pipe_fns( &cmds, &n_cmds );
break;
#endif
- case PI_EPMAPPER:
- epmapper_get_pipe_fns( &cmds, &n_cmds );
- break;
default:
DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
}
git.samba.org / samba.git / blobdiff