Add a touch of 'const' to some auth components, and move the simple plaintext
[ira/wip.git] / source3 / auth / auth_util.c
1 /* 
2    Unix SMB/Netbios implementation.
3    Version 1.9.
4    Authentication utility functions
5    Copyright (C) Andrew Tridgell 1992-1998
6    Copyright (C) Andrew Bartlett 2001
7    Copyright (C) Jeremy Allison 2000-2001
8
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 2 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program; if not, write to the Free Software
21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #include "includes.h"
25
26 extern fstring remote_machine;
27 extern pstring global_myname;
28
29 /****************************************************************************
30  Create a UNIX user on demand.
31 ****************************************************************************/
32
33 static int smb_create_user(const char *unix_user, const char *homedir)
34 {
35         pstring add_script;
36         int ret;
37
38         pstrcpy(add_script, lp_adduser_script());
39         if (! *add_script)
40                 return -1;
41         all_string_sub(add_script, "%u", unix_user, sizeof(pstring));
42         if (homedir)
43                 all_string_sub(add_script, "%H", homedir, sizeof(pstring));
44         ret = smbrun(add_script,NULL);
45         DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
46         return ret;
47 }
48
49 /****************************************************************************
50  Delete a UNIX user on demand.
51 ****************************************************************************/
52
53 int smb_delete_user(const char *unix_user)
54 {
55         pstring del_script;
56         int ret;
57
58         pstrcpy(del_script, lp_deluser_script());
59         if (! *del_script)
60                 return -1;
61         all_string_sub(del_script, "%u", unix_user, sizeof(pstring));
62         ret = smbrun(del_script,NULL);
63         DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
64         return ret;
65 }
66
67 /****************************************************************************
68  Add and Delete UNIX users on demand, based on NTSTATUS codes.
69 ****************************************************************************/
70
71 void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status) 
72 {
73         struct passwd *pwd=NULL;
74
75         if (NT_STATUS_IS_OK(nt_status)) {
76
77                 if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
78                         
79                         /*
80                          * User validated ok against Domain controller.
81                          * If the admin wants us to try and create a UNIX
82                          * user on the fly, do so.
83                          */
84                         
85                         if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
86                                 smb_create_user(user_info->internal_username.str, NULL);
87                         }
88                 }
89         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
90                 /*
91                  * User failed to validate ok against Domain controller.
92                  * If the failure was "user doesn't exist" and admin 
93                  * wants us to try and delete that UNIX user on the fly,
94                  * do so.
95                  */
96                 if (lp_deluser_script()) {
97                         smb_delete_user(user_info->internal_username.str);
98                 }
99         }
100 }
101
102 /****************************************************************************
103  Create an auth_usersupplied_data structure
104 ****************************************************************************/
105
106 static BOOL make_user_info(auth_usersupplied_info **user_info, 
107                            const char *smb_name, 
108                            const char *internal_username,
109                            const char *client_domain, 
110                            const char *domain,
111                            const char *wksta_name, 
112                            DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
113                            DATA_BLOB plaintext, 
114                            uint32 auth_flags, BOOL encrypted)
115 {
116
117         DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
118
119         *user_info = malloc(sizeof(**user_info));
120         if (!user_info) {
121                 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info)));
122                 return False;
123         }
124
125         ZERO_STRUCTP(*user_info);
126
127         DEBUG(5,("makeing strings for %s's user_info struct\n", internal_username));
128
129         (*user_info)->smb_name.str = strdup(smb_name);
130         if ((*user_info)->smb_name.str) { 
131                 (*user_info)->smb_name.len = strlen(smb_name);
132         } else {
133                 free_user_info(user_info);
134                 return False;
135         }
136         
137         (*user_info)->internal_username.str = strdup(internal_username);
138         if ((*user_info)->internal_username.str) { 
139                 (*user_info)->internal_username.len = strlen(internal_username);
140         } else {
141                 free_user_info(user_info);
142                 return False;
143         }
144
145         (*user_info)->domain.str = strdup(domain);
146         if ((*user_info)->domain.str) { 
147                 (*user_info)->domain.len = strlen(domain);
148         } else {
149                 free_user_info(user_info);
150                 return False;
151         }
152
153         (*user_info)->client_domain.str = strdup(client_domain);
154         if ((*user_info)->client_domain.str) { 
155                 (*user_info)->client_domain.len = strlen(client_domain);
156         } else {
157                 free_user_info(user_info);
158                 return False;
159         }
160
161         (*user_info)->wksta_name.str = strdup(wksta_name);
162         if ((*user_info)->wksta_name.str) { 
163                 (*user_info)->wksta_name.len = strlen(wksta_name);
164         } else {
165                 free_user_info(user_info);
166                 return False;
167         }
168
169         DEBUG(5,("makeing blobs for %s's user_info struct\n", internal_username));
170
171         (*user_info)->lm_resp = data_blob(lm_pwd.data, lm_pwd.length);
172         (*user_info)->nt_resp = data_blob(nt_pwd.data, nt_pwd.length);
173         (*user_info)->plaintext_password = data_blob(plaintext.data, plaintext.length);
174
175         (*user_info)->encrypted = encrypted;
176         (*user_info)->auth_flags = auth_flags;
177
178         DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
179
180         return True;
181 }
182
183 /****************************************************************************
184  Create an auth_usersupplied_data structure after appropriate mapping.
185 ****************************************************************************/
186
187 BOOL make_user_info_map(auth_usersupplied_info **user_info, 
188                         const char *smb_name, 
189                         const char *client_domain, 
190                         const char *wksta_name, 
191                         DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
192                         DATA_BLOB plaintext, 
193                         uint32 ntlmssp_flags, BOOL encrypted)
194 {
195         const char *domain;
196         fstring internal_username;
197         fstrcpy(internal_username, smb_name);
198         map_username(internal_username); 
199         
200         if (lp_allow_trusted_domains()) {
201                 /* the client could have given us a workstation name
202                    or other crap for the workgroup - we really need a
203                    way of telling if this domain name is one of our
204                    trusted domain names 
205
206                    The way I do it here is by checking if the fully
207                    qualified username exists. This is rather reliant
208                    on winbind, but until we have a better method this
209                    will have to do 
210                 */
211
212                 domain = client_domain;
213
214                 if ((smb_name) && (*smb_name)) { /* Don't do this for guests */
215                         char *user;
216                         asprintf(&user, "%s%s%s", 
217                                  client_domain, lp_winbind_separator(), 
218                                  smb_name);
219                         if (Get_Pwnam(user) == NULL) {
220                                 domain = lp_workgroup();
221                         }
222                         free(user);
223                 }
224         } else {
225                 domain = lp_workgroup();
226         }
227         
228         return make_user_info(user_info, 
229                               smb_name, internal_username,
230                               client_domain, domain,
231                               wksta_name, 
232                               lm_pwd, nt_pwd,
233                               plaintext, 
234                               ntlmssp_flags, encrypted);
235         
236 }
237
238 /****************************************************************************
239  Create an auth_usersupplied_data, making the DATA_BLOBs here. 
240  Decrypt and encrypt the passwords.
241 ****************************************************************************/
242
243 BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info, 
244                                      const char *smb_name, 
245                                      const char *client_domain, 
246                                      const char *wksta_name, 
247                                      const uchar *lm_network_pwd, int lm_pwd_len,
248                                      const uchar *nt_network_pwd, int nt_pwd_len)
249 {
250         BOOL ret;
251         DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
252         DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
253         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
254         uint32 auth_flags = AUTH_FLAG_NONE;
255
256         if (lm_pwd_len)
257                 auth_flags |= AUTH_FLAG_LM_RESP;
258         if (nt_pwd_len == 24) {
259                 auth_flags |= AUTH_FLAG_NTLM_RESP; 
260         } else if (nt_pwd_len != 0) {
261                 auth_flags |= AUTH_FLAG_NTLMv2_RESP; 
262         }
263
264         ret = make_user_info_map(user_info, 
265                                  smb_name, client_domain, 
266                                  wksta_name, 
267                                  lm_blob, nt_blob,
268                                  plaintext_blob, 
269                                  auth_flags, True);
270                 
271         data_blob_free(&lm_blob);
272         data_blob_free(&nt_blob);
273         return ret;
274 }
275
276 /****************************************************************************
277  Create an auth_usersupplied_data, making the DATA_BLOBs here. 
278  Decrypt and encrypt the passwords.
279 ****************************************************************************/
280
281 BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info, 
282                                          const char *smb_name, 
283                                          const char *client_domain, 
284                                          const char *wksta_name, 
285                                          const uchar chal[8], 
286                                          const uchar lm_interactive_pwd[16], 
287                                          const uchar nt_interactive_pwd[16], 
288                                          const uchar *dc_sess_key)
289 {
290         char lm_pwd[16];
291         char nt_pwd[16];
292         unsigned char local_lm_response[24];
293         unsigned char local_nt_response[24];
294         unsigned char key[16];
295         uint32 auth_flags = AUTH_FLAG_NONE;
296         
297         ZERO_STRUCT(key);
298         memcpy(key, dc_sess_key, 8);
299         
300         if (lm_interactive_pwd) memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
301         if (nt_interactive_pwd) memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
302         
303 #ifdef DEBUG_PASSWORD
304         DEBUG(100,("key:"));
305         dump_data(100, (char *)key, sizeof(key));
306         
307         DEBUG(100,("lm owf password:"));
308         dump_data(100, lm_pwd, sizeof(lm_pwd));
309         
310         DEBUG(100,("nt owf password:"));
311         dump_data(100, nt_pwd, sizeof(nt_pwd));
312 #endif
313         
314         SamOEMhash((uchar *)lm_pwd, key, sizeof(lm_pwd));
315         SamOEMhash((uchar *)nt_pwd, key, sizeof(nt_pwd));
316         
317 #ifdef DEBUG_PASSWORD
318         DEBUG(100,("decrypt of lm owf password:"));
319         dump_data(100, lm_pwd, sizeof(lm_pwd));
320         
321         DEBUG(100,("decrypt of nt owf password:"));
322         dump_data(100, nt_pwd, sizeof(nt_pwd));
323 #endif
324         
325         SMBOWFencrypt((const unsigned char *)lm_pwd, chal, local_lm_response);
326         SMBOWFencrypt((const unsigned char *)nt_pwd, chal, local_nt_response);
327         
328         /* Password info parinoia */
329         ZERO_STRUCT(lm_pwd);
330         ZERO_STRUCT(nt_pwd);
331         ZERO_STRUCT(key);
332
333         {
334                 BOOL ret;
335                 DATA_BLOB local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
336                 DATA_BLOB local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
337                 DATA_BLOB plaintext_blob = data_blob(NULL, 0);
338
339                 if (lm_interactive_pwd)
340                         auth_flags |= AUTH_FLAG_LM_RESP;
341                 if (nt_interactive_pwd)
342                         auth_flags |= AUTH_FLAG_NTLM_RESP; 
343
344                 ret = make_user_info_map(user_info, 
345                                          smb_name, client_domain, 
346                                          wksta_name, 
347                                          local_lm_blob,
348                                          local_nt_blob,
349                                          plaintext_blob, 
350                                          auth_flags, True);
351                 
352                 data_blob_free(&local_lm_blob);
353                 data_blob_free(&local_nt_blob);
354                 return ret;
355         }
356 }
357
358
359 /****************************************************************************
360  Create an auth_usersupplied_data structure
361 ****************************************************************************/
362
363 BOOL make_user_info_for_reply(auth_usersupplied_info **user_info, 
364                               const char *smb_name, 
365                               const char *client_domain,
366                               const uint8 chal[8],
367                               DATA_BLOB plaintext_password)
368 {
369
370         DATA_BLOB local_lm_blob;
371         DATA_BLOB local_nt_blob;
372         BOOL ret = False;
373         uint32 auth_flags = AUTH_FLAG_NONE;
374                         
375         /*
376          * Not encrypted - do so.
377          */
378         
379         DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
380         
381         if (plaintext_password.data) {
382                 unsigned char local_lm_response[24];
383                 
384 #ifdef DEBUG_PASSWORD
385                 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password.length));
386                 dump_data(100, plaintext_password.data, plaintext_password.length);
387 #endif
388
389                 SMBencrypt( (const uchar *)plaintext_password.data, (const uchar*)chal, local_lm_response);
390                 local_lm_blob = data_blob(local_lm_response, 24);
391                 
392                 /* We can't do an NT hash here, as the password needs to be
393                    case insensitive */
394                 local_nt_blob = data_blob(NULL, 0); 
395                 
396                 auth_flags = (AUTH_FLAG_PLAINTEXT | AUTH_FLAG_LM_RESP);
397         } else {
398                 local_lm_blob = data_blob(NULL, 0); 
399                 local_nt_blob = data_blob(NULL, 0); 
400         }
401         
402         ret = make_user_info_map(user_info, smb_name,
403                                  client_domain, 
404                                  remote_machine,
405                                  local_lm_blob,
406                                  local_nt_blob,
407                                  plaintext_password, 
408                                  auth_flags, False);
409         
410         data_blob_free(&local_lm_blob);
411         return ret;
412 }
413
414 /****************************************************************************
415  Create an auth_usersupplied_data structure
416 ****************************************************************************/
417
418 BOOL make_user_info_for_reply_enc(auth_usersupplied_info **user_info, 
419                                   const char *smb_name,
420                                   const char *client_domain, 
421                                   DATA_BLOB lm_resp, DATA_BLOB nt_resp)
422 {
423         uint32 auth_flags = AUTH_FLAG_NONE;
424
425         DATA_BLOB no_plaintext_blob = data_blob(NULL, 0); 
426         
427         if (lm_resp.length == 24) {
428                 auth_flags |= AUTH_FLAG_LM_RESP;
429         }
430         if (nt_resp.length == 0) {
431         } else if (nt_resp.length == 24) {
432                 auth_flags |= AUTH_FLAG_NTLM_RESP;
433         } else {
434                 auth_flags |= AUTH_FLAG_NTLMv2_RESP;
435         }
436
437         return make_user_info_map(user_info, smb_name, 
438                                  client_domain, 
439                                  remote_machine, 
440                                  lm_resp, 
441                                  nt_resp, 
442                                  no_plaintext_blob, 
443                                  auth_flags, True);
444 }
445
446 /****************************************************************************
447  Create a guest user_info blob, for anonymous authenticaion.
448 ****************************************************************************/
449
450 BOOL make_user_info_guest(auth_usersupplied_info **user_info) 
451 {
452         DATA_BLOB lm_blob = data_blob(NULL, 0);
453         DATA_BLOB nt_blob = data_blob(NULL, 0);
454         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
455         uint32 auth_flags = AUTH_FLAG_NONE;
456
457         return make_user_info(user_info, 
458                               "","", 
459                               "","", 
460                               "", 
461                               nt_blob, lm_blob,
462                               plaintext_blob, 
463                               auth_flags, True);
464 }
465
466 /***************************************************************************
467  Make a user_info struct
468 ***************************************************************************/
469
470 BOOL make_server_info(auth_serversupplied_info **server_info) 
471 {
472         *server_info = malloc(sizeof(**server_info));
473         if (!*server_info) {
474                 DEBUG(0,("make_server_info: malloc failed!\n"));
475                 return False;
476         }
477         ZERO_STRUCTP(*server_info);
478         return True;
479 }
480
481 /***************************************************************************
482  Make (and fill) a user_info struct from a SAM_ACCOUNT
483 ***************************************************************************/
484
485 BOOL make_server_info_sam(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass) 
486 {
487         if (!make_server_info(server_info)) {
488                 return False;
489         }
490
491         (*server_info)->sam_fill_level = SAM_FILL_ALL;
492         (*server_info)->sam_account = sampass;
493
494         DEBUG(5,("make_server_info_sam: made server info for user %s\n",
495                  pdb_get_username((*server_info)->sam_account)));
496         return True;
497 }
498
499 /***************************************************************************
500  Make (and fill) a user_info struct from a 'struct passwd' by conversion 
501  to a SAM_ACCOUNT
502 ***************************************************************************/
503
504 BOOL make_server_info_pw(auth_serversupplied_info **server_info, const struct passwd *pwd)
505 {
506         SAM_ACCOUNT *sampass = NULL;
507         if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sampass, pwd))) {         
508                 return False;
509         }
510         return make_server_info_sam(server_info, sampass);
511 }
512
513 /***************************************************************************
514  Free a user_info struct
515 ***************************************************************************/
516
517 void free_user_info(auth_usersupplied_info **user_info)
518 {
519         DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
520         if (*user_info != NULL) {
521                 if ((*user_info)->smb_name.str) {
522                         DEBUG(10,("structure was created for %s\n", (*user_info)->smb_name.str));
523                 }
524                 SAFE_FREE((*user_info)->smb_name.str);
525                 SAFE_FREE((*user_info)->internal_username.str);
526                 SAFE_FREE((*user_info)->client_domain.str);
527                 SAFE_FREE((*user_info)->domain.str);
528                 SAFE_FREE((*user_info)->wksta_name.str);
529                 data_blob_free(&(*user_info)->lm_resp);
530                 data_blob_free(&(*user_info)->nt_resp);
531                 SAFE_FREE((*user_info)->interactive_password);
532                 data_blob_clear_free(&(*user_info)->plaintext_password);
533                 ZERO_STRUCT(**user_info);
534         }
535         SAFE_FREE(*user_info);
536 }
537
538 /***************************************************************************
539  Clear out a server_info struct that has been allocated
540 ***************************************************************************/
541
542 void free_server_info(auth_serversupplied_info **server_info)
543 {
544         if (*server_info != NULL) {
545                 pdb_free_sam(&(*server_info)->sam_account);
546                 
547                 /* call pam_end here, unless we know we are keeping it */
548                 delete_nt_token( &(*server_info)->ptok );
549                 ZERO_STRUCT(**server_info);
550         }
551         SAFE_FREE(*server_info);
552 }
553
554 /***************************************************************************
555  Make a server_info struct for a guest user 
556 ***************************************************************************/
557
558 BOOL make_server_info_guest(auth_serversupplied_info **server_info) 
559 {
560         struct passwd *pass = getpwnam_alloc(lp_guestaccount());
561         
562         if (pass) {
563                 if (!make_server_info_pw(server_info, pass)) {
564                         passwd_free(&pass);
565                         return False;
566                 }
567                 (*server_info)->guest = True;
568                 passwd_free(&pass);
569                 return True;
570         }
571         DEBUG(0,("make_server_info_guest: getpwnam_alloc() failed on guest account!\n")); 
572         return False;
573 }
574
575 /***************************************************************************
576  Make an auth_methods struct
577 ***************************************************************************/
578
579 BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method) 
580 {
581         if (!auth_context) {
582                 smb_panic("no auth_context supplied to make_auth_methods()!\n");
583         }
584
585         if (!auth_method) {
586                 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
587         }
588
589         *auth_method = talloc(auth_context->mem_ctx, sizeof(**auth_method));
590         if (!*auth_method) {
591                 DEBUG(0,("make_auth_method: malloc failed!\n"));
592                 return False;
593         }
594         ZERO_STRUCTP(*auth_method);
595         
596         return True;
597 }
598
599 /****************************************************************************
600  Delete a SID token.
601 ****************************************************************************/
602
603 void delete_nt_token(NT_USER_TOKEN **pptoken)
604 {
605     if (*pptoken) {
606                 NT_USER_TOKEN *ptoken = *pptoken;
607         SAFE_FREE( ptoken->user_sids );
608         ZERO_STRUCTP(ptoken);
609     }
610     SAFE_FREE(*pptoken);
611 }
612
613 /****************************************************************************
614  Duplicate a SID token.
615 ****************************************************************************/
616
617 NT_USER_TOKEN *dup_nt_token(NT_USER_TOKEN *ptoken)
618 {
619         NT_USER_TOKEN *token;
620
621         if (!ptoken)
622                 return NULL;
623
624     if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
625         return NULL;
626
627     ZERO_STRUCTP(token);
628
629     if ((token->user_sids = (DOM_SID *)memdup( ptoken->user_sids, sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
630         SAFE_FREE(token);
631         return NULL;
632     }
633
634     token->num_sids = ptoken->num_sids;
635
636         return token;
637 }
638
639 /**
640  * Squash an NT_STATUS in line with security requirements.
641  * In an attempt to avoid giving the whole game away when users
642  * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and 
643  * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations 
644  * (session setups in particular).
645  *
646  * @param nt_status NTSTATUS input for squashing.
647  * @return the 'squashed' nt_status
648  **/
649
650 NTSTATUS nt_status_squash(NTSTATUS nt_status)
651 {
652         if NT_STATUS_IS_OK(nt_status) {
653                 return nt_status;               
654         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
655                 /* Match WinXP and don't give the game away */
656                 return NT_STATUS_LOGON_FAILURE;
657                 
658         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
659                 /* Match WinXP and don't give the game away */
660                 return NT_STATUS_LOGON_FAILURE;
661         } else {
662                 return nt_status;
663         }  
664 }
665
666
667