source3/auth/auth_generic.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle GENSEC authentication, server side
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett 2001-2003,2011
   8    Copyright (C) Simo Sorce 2010.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "auth/gensec/gensec.h"
  28 #include "lib/param/param.h"
  29 #ifdef HAVE_KRB5
  30 #include "libcli/auth/krb5_wrap.h"
  31 #endif
  32 #include "librpc/crypto/gse.h"
  33 #include "auth/credentials/credentials.h"
  34
  35 static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx,
  36                                                 TALLOC_CTX *mem_ctx,
  37                                                 struct smb_krb5_context *smb_krb5_context,
  38                                                 DATA_BLOB *pac_blob,
  39                                                 const char *princ_name,
  40                                                 const struct tsocket_address *remote_address,
  41                                                 uint32_t session_info_flags,
  42                                                 struct auth_session_info **session_info)
  43 {
  44         TALLOC_CTX *tmp_ctx;
  45         struct PAC_DATA *pac_data = NULL;
  46         struct PAC_LOGON_INFO *logon_info = NULL;
  47         unsigned int i;
  48         bool is_mapped;
  49         bool is_guest;
  50         char *ntuser;
  51         char *ntdomain;
  52         char *username;
  53         char *rhost;
  54         struct passwd *pw;
  55         NTSTATUS status;
  56         int rc;
  57
  58         tmp_ctx = talloc_new(mem_ctx);
  59         if (!tmp_ctx) {
  60                 return NT_STATUS_NO_MEMORY;
  61         }
  62
  63         if (pac_blob) {
  64 #ifdef HAVE_KRB5
  65                 status = kerberos_decode_pac(tmp_ctx,
  66                                      *pac_blob,
  67                                      NULL, NULL, NULL, NULL, 0, &pac_data);
  68 #else
  69                 status = NT_STATUS_ACCESS_DENIED;
  70 #endif
  71                 if (!NT_STATUS_IS_OK(status)) {
  72                         goto done;
  73                 }
  74
  75                 /* get logon name and logon info */
  76                 for (i = 0; i < pac_data->num_buffers; i++) {
  77                         struct PAC_BUFFER *data_buf = &pac_data->buffers[i];
  78
  79                         switch (data_buf->type) {
  80                         case PAC_TYPE_LOGON_INFO:
  81                                 if (!data_buf->info) {
  82                                         break;
  83                                 }
  84                                 logon_info = data_buf->info->logon_info.info;
  85                                 break;
  86                         default:
  87                                 break;
  88                         }
  89                 }
  90                 if (!logon_info) {
  91                         DEBUG(1, ("Invalid PAC data, missing logon info!\n"));
  92                         status = NT_STATUS_NOT_FOUND;
  93                         goto done;
  94                 }
  95         }
  96
  97         rc = get_remote_hostname(remote_address,
  98                                  &rhost,
  99                                  tmp_ctx);
 100         if (rc < 0) {
 101                 status = NT_STATUS_NO_MEMORY;
 102                 goto done;
 103         }
 104         if (strequal(rhost, "UNKNOWN")) {
 105                 rhost = tsocket_address_inet_addr_string(remote_address,
 106                                                          tmp_ctx);
 107                 if (rhost == NULL) {
 108                         status = NT_STATUS_NO_MEMORY;
 109                         goto done;
 110                 }
 111         }
 112
 113         status = get_user_from_kerberos_info(tmp_ctx, rhost,
 114                                              princ_name, logon_info,
 115                                              &is_mapped, &is_guest,
 116                                              &ntuser, &ntdomain,
 117                                              &username, &pw);
 118         if (!NT_STATUS_IS_OK(status)) {
 119                 DEBUG(1, ("Failed to map kerberos principal to system user "
 120                           "(%s)\n", nt_errstr(status)));
 121                 status = NT_STATUS_ACCESS_DENIED;
 122                 goto done;
 123         }
 124
 125         /* save the PAC data if we have it */
 126         if (logon_info) {
 127                 netsamlogon_cache_store(ntuser, &logon_info->info3);
 128         }
 129
 130         /* setup the string used by %U */
 131         sub_set_smb_name(username);
 132
 133         /* reload services so that the new %U is taken into account */
 134         lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
 135
 136         status = make_session_info_krb5(mem_ctx,
 137                                         ntuser, ntdomain, username, pw,
 138                                         logon_info, is_guest, is_mapped, NULL /* No session key for now, caller will sort it out */,
 139                                         session_info);
 140         if (!NT_STATUS_IS_OK(status)) {
 141                 DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
 142                           nt_errstr(status)));
 143                 status = NT_STATUS_ACCESS_DENIED;
 144                 goto done;
 145         }
 146
 147         DEBUG(5, (__location__ "OK: user: %s domain: %s client: %s\n",
 148                   ntuser, ntdomain, rhost));
 149
 150         status = NT_STATUS_OK;
 151
 152 done:
 153         TALLOC_FREE(tmp_ctx);
 154         return status;
 155 }
 156
 157 NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
 158                               const struct tsocket_address *remote_address,
 159                               struct gensec_security **gensec_security_out)
 160 {
 161         struct gensec_security *gensec_security;
 162         struct auth_context *auth_context;
 163         NTSTATUS nt_status;
 164
 165         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 166         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 167
 168         nt_status = make_auth_context_subsystem(tmp_ctx, &auth_context);
 169         if (!NT_STATUS_IS_OK(nt_status)) {
 170                 TALLOC_FREE(tmp_ctx);
 171                 return nt_status;
 172         }
 173
 174         if (auth_context->prepare_gensec) {
 175                 nt_status = auth_context->prepare_gensec(tmp_ctx,
 176                                                          &gensec_security);
 177                 if (!NT_STATUS_IS_OK(nt_status)) {
 178                         TALLOC_FREE(tmp_ctx);
 179                         return nt_status;
 180                 }
 181         } else {
 182                 struct gensec_settings *gensec_settings;
 183                 struct loadparm_context *lp_ctx;
 184                 size_t idx = 0;
 185                 struct cli_credentials *server_credentials;
 186                 const char *dns_name;
 187                 const char *dns_domain;
 188                 struct auth4_context *auth4_context = talloc_zero(tmp_ctx, struct auth4_context);
 189                 if (auth4_context == NULL) {
 190                         DEBUG(10, ("failed to allocate auth4_context failed\n"));
 191                         TALLOC_FREE(tmp_ctx);
 192                         return NT_STATUS_NO_MEMORY;
 193                 }
 194                 auth4_context->generate_session_info_pac = auth3_generate_session_info_pac;
 195                 auth4_context->generate_session_info = auth3_generate_session_info;
 196                 auth4_context->get_challenge = auth3_get_challenge;
 197                 auth4_context->set_challenge = auth3_set_challenge;
 198                 auth4_context->challenge_may_be_modified = auth3_may_set_challenge;
 199                 auth4_context->check_password = auth3_check_password;
 200                 auth4_context->private_data = talloc_steal(auth4_context, auth_context);
 201
 202                 lp_ctx = loadparm_init_s3(tmp_ctx, loadparm_s3_context());
 203                 if (lp_ctx == NULL) {
 204                         DEBUG(10, ("loadparm_init_s3 failed\n"));
 205                         TALLOC_FREE(tmp_ctx);
 206                         return NT_STATUS_INVALID_SERVER_STATE;
 207                 }
 208
 209                 gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
 210                 if (lp_ctx == NULL) {
 211                         DEBUG(10, ("lpcfg_gensec_settings failed\n"));
 212                         TALLOC_FREE(tmp_ctx);
 213                         return NT_STATUS_NO_MEMORY;
 214                 }
 215
 216                 /*
 217                  * This should be a 'netbios domain -> DNS domain'
 218                  * mapping, and can currently validly return NULL on
 219                  * poorly configured systems.
 220                  *
 221                  * This is used for the NTLMSSP server
 222                  *
 223                  */
 224                 dns_name = get_mydnsfullname();
 225                 if (dns_name == NULL) {
 226                         dns_name = "";
 227                 }
 228
 229                 dns_domain = get_mydnsdomname(tmp_ctx);
 230                 if (dns_domain == NULL) {
 231                         dns_domain = "";
 232                 }
 233
 234                 gensec_settings->server_dns_name = strlower_talloc(gensec_settings, dns_name);
 235                 if (gensec_settings->server_dns_name == NULL) {
 236                         TALLOC_FREE(tmp_ctx);
 237                         return NT_STATUS_NO_MEMORY;
 238                 }
 239
 240                 gensec_settings->server_dns_domain = strlower_talloc(gensec_settings, dns_domain);
 241                 if (gensec_settings->server_dns_domain == NULL) {
 242                         TALLOC_FREE(tmp_ctx);
 243                         return NT_STATUS_NO_MEMORY;
 244                 }
 245
 246                 gensec_settings->backends = talloc_zero_array(gensec_settings,
 247                                                 struct gensec_security_ops *, 4);
 248                 if (gensec_settings->backends == NULL) {
 249                         TALLOC_FREE(tmp_ctx);
 250                         return NT_STATUS_NO_MEMORY;
 251                 }
 252
 253                 gensec_settings->backends[idx++] = &gensec_ntlmssp3_server_ops;
 254
 255 #if defined(HAVE_KRB5) && defined(HAVE_GSS_WRAP_IOV)
 256                 gensec_settings->backends[idx++] = &gensec_gse_krb5_security_ops;
 257 #endif
 258
 259                 gensec_init();
 260                 gensec_settings->backends[idx++] = gensec_security_by_oid(NULL,
 261                                                         GENSEC_OID_SPNEGO);
 262
 263                 /*
 264                  * This is anonymous for now, because we just use it
 265                  * to set the kerberos state at the moment
 266                  */
 267                 server_credentials = cli_credentials_init_anon(tmp_ctx);
 268                 if (!server_credentials) {
 269                         DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
 270                         return NT_STATUS_NO_MEMORY;
 271                 }
 272
 273                 cli_credentials_set_conf(server_credentials, lp_ctx);
 274
 275                 if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
 276                         cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS);
 277                 } else {
 278                         cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS);
 279                 }
 280
 281                 nt_status = gensec_server_start(tmp_ctx, gensec_settings,
 282                                                 auth4_context, &gensec_security);
 283
 284                 if (!NT_STATUS_IS_OK(nt_status)) {
 285                         TALLOC_FREE(tmp_ctx);
 286                         return nt_status;
 287                 }
 288
 289                 gensec_set_credentials(gensec_security, server_credentials);
 290
 291                 talloc_unlink(tmp_ctx, lp_ctx);
 292                 talloc_unlink(tmp_ctx, server_credentials);
 293                 talloc_unlink(tmp_ctx, gensec_settings);
 294                 talloc_unlink(tmp_ctx, auth4_context);
 295         }
 296
 297         nt_status = gensec_set_remote_address(gensec_security,
 298                                               remote_address);
 299         if (!NT_STATUS_IS_OK(nt_status)) {
 300                 TALLOC_FREE(tmp_ctx);
 301                 return nt_status;
 302         }
 303
 304         *gensec_security_out = talloc_steal(mem_ctx, gensec_security);
 305         TALLOC_FREE(tmp_ctx);
 306         return NT_STATUS_OK;
 307 }