source/auth/auth_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6    Copyright (C) Jeremy Allison 2000-2001
   7    Copyright (C) Rafal Szczesniak 2002
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "librpc/gen_ndr/ndr_samr.h"
  26 #include "librpc/gen_ndr/ndr_netlogon.h"
  27 #include "librpc/gen_ndr/ndr_security.h"
  28 #include "auth/auth.h"
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_AUTH
  32
  33 /****************************************************************************
  34  Create an auth_usersupplied_data structure
  35 ****************************************************************************/
  36 static NTSTATUS make_user_info(TALLOC_CTX *mem_ctx,
  37                                struct auth_usersupplied_info **user_info,
  38                                const char *smb_name,
  39                                const char *internal_username,
  40                                const char *client_domain,
  41                                const char *domain,
  42                                const char *wksta_name,
  43                                DATA_BLOB *lm_password, DATA_BLOB *nt_password,
  44                                DATA_BLOB *lm_interactive_password, DATA_BLOB *nt_interactive_password,
  45                                DATA_BLOB *plaintext,
  46                                BOOL encrypted)
  47 {
  48
  49         DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
  50
  51         *user_info = talloc_p(mem_ctx, struct auth_usersupplied_info);
  52         if (!user_info) {
  53                 return NT_STATUS_NO_MEMORY;
  54         }
  55
  56         ZERO_STRUCTP(*user_info);
  57
  58         DEBUG(5,("making strings for %s's user_info struct\n", internal_username));
  59
  60         (*user_info)->smb_name.str = talloc_strdup(*user_info, smb_name);
  61         if ((*user_info)->smb_name.str) {
  62                 (*user_info)->smb_name.len = strlen(smb_name);
  63         } else {
  64                 free_user_info(user_info);
  65                 return NT_STATUS_NO_MEMORY;
  66         }
  67
  68         (*user_info)->internal_username.str = talloc_strdup(*user_info, internal_username);
  69         if ((*user_info)->internal_username.str) {
  70                 (*user_info)->internal_username.len = strlen(internal_username);
  71         } else {
  72                 free_user_info(user_info);
  73                 return NT_STATUS_NO_MEMORY;
  74         }
  75
  76         (*user_info)->domain.str = talloc_strdup(*user_info, domain);
  77         if ((*user_info)->domain.str) {
  78                 (*user_info)->domain.len = strlen(domain);
  79         } else {
  80                 free_user_info(user_info);
  81                 return NT_STATUS_NO_MEMORY;
  82         }
  83
  84         (*user_info)->client_domain.str = talloc_strdup(*user_info, client_domain);
  85         if ((*user_info)->client_domain.str) {
  86                 (*user_info)->client_domain.len = strlen(client_domain);
  87         } else {
  88                 free_user_info(user_info);
  89                 return NT_STATUS_NO_MEMORY;
  90         }
  91
  92         (*user_info)->wksta_name.str = talloc_strdup(*user_info, wksta_name);
  93         if ((*user_info)->wksta_name.str) {
  94                 (*user_info)->wksta_name.len = strlen(wksta_name);
  95         } else {
  96                 free_user_info(user_info);
  97                 return NT_STATUS_NO_MEMORY;
  98         }
  99
 100         DEBUG(5,("making blobs for %s's user_info struct\n", internal_username));
 101
 102         if (lm_password)
 103                 (*user_info)->lm_resp = data_blob_talloc(*user_info,
 104                                                          lm_password->data,
 105                                                          lm_password->length);
 106         if (nt_password)
 107                 (*user_info)->nt_resp = data_blob_talloc(*user_info,
 108                                                          nt_password->data,
 109                                                          nt_password->length);
 110         if (lm_interactive_password)
 111                 (*user_info)->lm_interactive_password =
 112                         data_blob_talloc(*user_info,
 113                                          lm_interactive_password->data,
 114                                          lm_interactive_password->length);
 115         if (nt_interactive_password)
 116                 (*user_info)->nt_interactive_password =
 117                         data_blob_talloc(*user_info,
 118                                          nt_interactive_password->data,
 119                                          nt_interactive_password->length);
 120
 121         if (plaintext)
 122                 (*user_info)->plaintext_password =
 123                         data_blob_talloc(*user_info,
 124                                          plaintext->data,
 125                                          plaintext->length);
 126
 127         (*user_info)->encrypted = encrypted;
 128
 129         DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
 130
 131         return NT_STATUS_OK;
 132 }
 133
 134 /****************************************************************************
 135  Create an auth_usersupplied_data structure after appropriate mapping.
 136 ****************************************************************************/
 137
 138 NTSTATUS make_user_info_map(TALLOC_CTX *mem_ctx,
 139                             struct auth_usersupplied_info **user_info,
 140                             const char *smb_name,
 141                             const char *client_domain,
 142                             const char *wksta_name,
 143                             DATA_BLOB *lm_password, DATA_BLOB *nt_password,
 144                             DATA_BLOB *lm_interactive_password, DATA_BLOB *nt_interactive_password,
 145                             DATA_BLOB *plaintext,
 146                             BOOL encrypted)
 147 {
 148         const char *domain;
 149
 150         DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
 151               client_domain, smb_name, wksta_name));
 152
 153         /* don't allow "" as a domain, fixes a Win9X bug
 154            where it doens't supply a domain for logon script
 155            'net use' commands.                                 */
 156
 157         if ( *client_domain )
 158                 domain = client_domain;
 159         else
 160                 domain = lp_workgroup();
 161
 162         /* we know that it is a trusted domain (and we are allowing
 163            them) or it is our domain */
 164
 165         return make_user_info(mem_ctx,
 166                               user_info, smb_name, smb_name,
 167                               client_domain, domain, wksta_name,
 168                               lm_password, nt_password,
 169                               lm_interactive_password, nt_interactive_password,
 170                               plaintext, encrypted);
 171 }
 172
 173 /****************************************************************************
 174  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 175  Decrypt and encrypt the passwords.
 176 ****************************************************************************/
 177
 178 NTSTATUS make_user_info_netlogon_network(TALLOC_CTX *mem_ctx,
 179                                          struct auth_usersupplied_info **user_info,
 180                                          const char *smb_name,
 181                                          const char *client_domain,
 182                                          const char *wksta_name,
 183                                          const uint8_t *lm_network_password, int lm_password_len,
 184                                          const uint8_t *nt_network_password, int nt_password_len)
 185 {
 186         NTSTATUS nt_status;
 187         DATA_BLOB lm_blob = data_blob(lm_network_password, lm_password_len);
 188         DATA_BLOB nt_blob = data_blob(nt_network_password, nt_password_len);
 189
 190         nt_status = make_user_info_map(mem_ctx,
 191                                        user_info,
 192                                        smb_name, client_domain,
 193                                        wksta_name,
 194                                        lm_password_len ? &lm_blob : NULL,
 195                                        nt_password_len ? &nt_blob : NULL,
 196                                        NULL, NULL, NULL,
 197                                        True);
 198
 199         data_blob_free(&lm_blob);
 200         data_blob_free(&nt_blob);
 201         return nt_status;
 202 }
 203
 204 /****************************************************************************
 205  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 206  Decrypt and encrypt the passwords.
 207 ****************************************************************************/
 208
 209 NTSTATUS make_user_info_netlogon_interactive(TALLOC_CTX *mem_ctx,
 210                                              struct auth_usersupplied_info **user_info,
 211                                              const char *smb_name,
 212                                              const char *client_domain,
 213                                              const char *wksta_name,
 214                                              const uint8_t chal[8],
 215                                              const struct samr_Password *lm_interactive_password,
 216                                              const struct samr_Password *nt_interactive_password)
 217 {
 218         NTSTATUS nt_status;
 219         DATA_BLOB local_lm_blob;
 220         DATA_BLOB local_nt_blob;
 221
 222         DATA_BLOB lm_interactive_blob;
 223         DATA_BLOB nt_interactive_blob;
 224         uint8_t local_lm_response[24];
 225         uint8_t local_nt_response[24];
 226
 227         SMBOWFencrypt(lm_interactive_password->hash, chal, local_lm_response);
 228         SMBOWFencrypt(nt_interactive_password->hash, chal, local_nt_response);
 229
 230         local_lm_blob = data_blob(local_lm_response,
 231                                   sizeof(local_lm_response));
 232         lm_interactive_blob = data_blob(lm_interactive_password->hash,
 233                                         sizeof(lm_interactive_password->hash));
 234
 235         local_nt_blob = data_blob(local_nt_response,
 236                                   sizeof(local_nt_response));
 237         nt_interactive_blob = data_blob(nt_interactive_password->hash,
 238                                         sizeof(nt_interactive_password->hash));
 239
 240         nt_status = make_user_info_map(mem_ctx,
 241                                        user_info,
 242                                        smb_name, client_domain,
 243                                        wksta_name,
 244                                        &local_lm_blob,
 245                                        &local_nt_blob,
 246                                        &lm_interactive_blob,
 247                                        &nt_interactive_blob,
 248                                        NULL,
 249                                        True);
 250
 251         data_blob_free(&local_lm_blob);
 252         data_blob_free(&local_nt_blob);
 253         data_blob_free(&lm_interactive_blob);
 254         data_blob_free(&nt_interactive_blob);
 255         return nt_status;
 256 }
 257 /****************************************************************************
 258  Create an auth_usersupplied_data structure
 259 ****************************************************************************/
 260
 261 NTSTATUS make_user_info_for_reply_enc(TALLOC_CTX *mem_ctx,
 262                                       struct auth_usersupplied_info **user_info,
 263                                       const char *smb_name,
 264                                       const char *client_domain,
 265                                       const char *remote_machine,
 266                                       DATA_BLOB lm_resp, DATA_BLOB nt_resp)
 267 {
 268         return make_user_info_map(mem_ctx,
 269                                   user_info, smb_name,
 270                                   client_domain,
 271                                   remote_machine,
 272                                   lm_resp.data ? &lm_resp : NULL,
 273                                   nt_resp.data ? &nt_resp : NULL,
 274                                   NULL, NULL, NULL,
 275                                   True);
 276 }
 277
 278 /****************************************************************************
 279  Create a guest user_info blob, for anonymous authenticaion.
 280 ****************************************************************************/
 281
 282 BOOL make_user_info_guest(TALLOC_CTX *mem_ctx,
 283                           struct auth_usersupplied_info **user_info)
 284 {
 285         NTSTATUS nt_status;
 286
 287         nt_status = make_user_info(mem_ctx,
 288                                    user_info,
 289                                    "","",
 290                                    "","",
 291                                    "",
 292                                    NULL, NULL,
 293                                    NULL, NULL,
 294                                    NULL,
 295                                    True);
 296
 297         return NT_STATUS_IS_OK(nt_status) ? True : False;
 298 }
 299
 300 /****************************************************************************
 301  prints a NT_USER_TOKEN to debug output.
 302 ****************************************************************************/
 303
 304 void debug_nt_user_token(int dbg_class, int dbg_lev, const NT_USER_TOKEN *token)
 305 {
 306         TALLOC_CTX *mem_ctx;
 307
 308         size_t     i;
 309
 310         if (!token) {
 311                 DEBUGC(dbg_class, dbg_lev, ("NT user token: (NULL)\n"));
 312                 return;
 313         }
 314
 315         mem_ctx = talloc_init("debug_nt_user_token()");
 316         if (!mem_ctx) {
 317                 return;
 318         }
 319
 320         DEBUGC(dbg_class, dbg_lev, ("NT user token of user %s\n",
 321                                     dom_sid_string(mem_ctx, token->user_sids[0]) ));
 322         DEBUGADDC(dbg_class, dbg_lev, ("contains %lu SIDs\n", (unsigned long)token->num_sids));
 323         for (i = 0; i < token->num_sids; i++)
 324                 DEBUGADDC(dbg_class, dbg_lev, ("SID[%3lu]: %s\n", (unsigned long)i,
 325                                                dom_sid_string(mem_ctx, token->user_sids[i])));
 326
 327         talloc_destroy(mem_ctx);
 328 }
 329
 330 /****************************************************************************
 331  prints a NT_USER_TOKEN to debug output.
 332 ****************************************************************************/
 333
 334 void debug_session_info(int dbg_class, int dbg_lev, const struct auth_session_info *session_info)
 335 {
 336         if (!session_info) {
 337                 DEBUGC(dbg_class, dbg_lev, ("Session Info: (NULL)\n"));
 338                 return;
 339         }
 340
 341         debug_nt_user_token(dbg_class, dbg_lev, session_info->nt_user_token);
 342 }
 343
 344 /****************************************************************************
 345  Create the SID list for this user.
 346 ****************************************************************************/
 347
 348 NTSTATUS create_nt_user_token(TALLOC_CTX *mem_ctx,
 349                               struct dom_sid *user_sid, struct dom_sid *group_sid,
 350                               int n_groupSIDs, struct dom_sid **groupSIDs,
 351                               BOOL is_guest, struct nt_user_token **token)
 352 {
 353         NTSTATUS       nt_status = NT_STATUS_OK;
 354         struct nt_user_token *ptoken;
 355         int i;
 356         int sid_ndx;
 357
 358         if (!(ptoken = talloc_p(mem_ctx, struct nt_user_token))) {
 359                 DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
 360                 nt_status = NT_STATUS_NO_MEMORY;
 361                 return nt_status;
 362         }
 363
 364         ptoken->num_sids = 0;
 365
 366         if (!(ptoken->user_sids = talloc_array_p(mem_ctx, struct dom_sid*, n_groupSIDs + 5))) {
 367                 DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
 368                 nt_status = NT_STATUS_NO_MEMORY;
 369                 return nt_status;
 370         }
 371
 372         /*
 373          * Note - user SID *MUST* be first in token !
 374          * se_access_check depends on this.
 375          *
 376          * Primary group SID is second in token. Convention.
 377          */
 378
 379         ptoken->user_sids[PRIMARY_USER_SID_INDEX] = user_sid;
 380         ptoken->num_sids++;
 381         ptoken->user_sids[PRIMARY_GROUP_SID_INDEX] = group_sid;
 382         ptoken->num_sids++;
 383
 384         /*
 385          * Finally add the "standard" SIDs.
 386          * The only difference between guest and "anonymous" (which we
 387          * don't really support) is the addition of Authenticated_Users.
 388          */
 389         ptoken->user_sids[2] = dom_sid_parse_talloc(mem_ctx, SID_WORLD);
 390         ptoken->user_sids[3] = dom_sid_parse_talloc(mem_ctx, SID_NT_NETWORK);
 391
 392         if (is_guest) {
 393                 ptoken->user_sids[4] = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN_GUESTS);
 394                 ptoken->num_sids++;
 395         } else {
 396                 ptoken->user_sids[4] = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHENTICATED_USERS);
 397                 ptoken->num_sids++;
 398         }
 399
 400         sid_ndx = 5; /* next available spot */
 401
 402         for (i = 0; i < n_groupSIDs; i++) {
 403                 size_t check_sid_idx;
 404                 for (check_sid_idx = 1; check_sid_idx < ptoken->num_sids; check_sid_idx++) {
 405                         if (dom_sid_equal(ptoken->user_sids[check_sid_idx],
 406                                       groupSIDs[i])) {
 407                                 break;
 408                         }
 409                 }
 410
 411                 if (check_sid_idx >= ptoken->num_sids) /* Not found already */ {
 412                         ptoken->user_sids[sid_ndx++] = groupSIDs[i];
 413                         ptoken->num_sids++;
 414                 }
 415         }
 416
 417         debug_nt_user_token(DBGC_AUTH, 10, ptoken);
 418
 419         *token = ptoken;
 420
 421         return nt_status;
 422 }
 423
 424 /***************************************************************************
 425  Make a user_info struct
 426 ***************************************************************************/
 427
 428 NTSTATUS make_server_info(const TALLOC_CTX *mem_ctx,
 429                           struct auth_serversupplied_info **server_info,
 430                           const char *username)
 431 {
 432         *server_info = talloc_p(mem_ctx, struct auth_serversupplied_info);
 433         if (!*server_info) {
 434                 return NT_STATUS_NO_MEMORY;
 435         }
 436         ZERO_STRUCTP(*server_info);
 437
 438         return NT_STATUS_OK;
 439 }
 440
 441 /***************************************************************************
 442  Make (and fill) a user_info struct for a guest login.
 443 ***************************************************************************/
 444 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx, struct auth_serversupplied_info **server_info)
 445 {
 446         NTSTATUS nt_status;
 447
 448         nt_status = make_server_info(mem_ctx, server_info, "");
 449
 450         if (!NT_STATUS_IS_OK(nt_status)) {
 451                 return nt_status;
 452         }
 453
 454         (*server_info)->guest = True;
 455
 456         (*server_info)->user_sid = dom_sid_parse_talloc((*server_info), SID_NT_ANONYMOUS);
 457         (*server_info)->primary_group_sid = dom_sid_parse_talloc((*server_info), SID_BUILTIN_GUESTS);
 458         (*server_info)->n_domain_groups = 0;
 459         (*server_info)->domain_groups = NULL;
 460
 461         /* annoying, but the Guest really does have a session key,
 462            and it is all zeros! */
 463         (*server_info)->user_session_key = data_blob_talloc(*server_info, NULL, 16);
 464         (*server_info)->lm_session_key = data_blob_talloc(*server_info, NULL, 16);
 465
 466         data_blob_clear(&(*server_info)->user_session_key);
 467         data_blob_clear(&(*server_info)->lm_session_key);
 468
 469         (*server_info)->account_name = "";
 470         (*server_info)->domain = "";
 471         (*server_info)->full_name = "Anonymous";
 472         (*server_info)->logon_script = "";
 473         (*server_info)->profile_path = "";
 474         (*server_info)->home_directory = "";
 475         (*server_info)->home_drive = "";
 476
 477         (*server_info)->last_logon = 0;
 478         (*server_info)->last_logoff = 0;
 479         (*server_info)->acct_expiry = 0;
 480         (*server_info)->last_password_change = 0;
 481         (*server_info)->allow_password_change = 0;
 482         (*server_info)->force_password_change = 0;
 483
 484         (*server_info)->logon_count = 0;
 485         (*server_info)->bad_password_count = 0;
 486
 487         (*server_info)->acct_flags = ACB_NORMAL;
 488
 489         return nt_status;
 490 }
 491
 492 /***************************************************************************
 493  Make a server_info struct from the info3 returned by a domain logon
 494 ***************************************************************************/
 495
 496 NTSTATUS make_server_info_netlogon_validation(TALLOC_CTX *mem_ctx,
 497                                               const char *internal_username,
 498                                               struct auth_serversupplied_info **server_info,
 499                                               uint16 validation_level,
 500                                               union netr_Validation *validation)
 501 {
 502         NTSTATUS nt_status;
 503         struct netr_SamBaseInfo *base = NULL;
 504         switch (validation_level) {
 505         case 2:
 506                 if (!validation || !validation->sam2) {
 507                         return NT_STATUS_INVALID_PARAMETER;
 508                 }
 509                 base = &validation->sam2->base;
 510                 break;
 511         case 3:
 512                 if (!validation || !validation->sam3) {
 513                         return NT_STATUS_INVALID_PARAMETER;
 514                 }
 515                 base = &validation->sam3->base;
 516                 break;
 517         case 6:
 518                 if (!validation || !validation->sam6) {
 519                         return NT_STATUS_INVALID_PARAMETER;
 520                 }
 521                 base = &validation->sam6->base;
 522                 break;
 523         default:
 524                 return NT_STATUS_INVALID_LEVEL;
 525         }
 526
 527         nt_status = make_server_info(mem_ctx, server_info, internal_username);
 528
 529         if (!NT_STATUS_IS_OK(nt_status)) {
 530                 return nt_status;
 531         }
 532
 533         (*server_info)->guest = False;
 534
 535         /*
 536            Here is where we should check the list of
 537            trusted domains, and verify that the SID
 538            matches.
 539         */
 540
 541         (*server_info)->user_sid = dom_sid_add_rid(*server_info, dom_sid_dup(*server_info, base->domain_sid), base->rid);
 542         (*server_info)->primary_group_sid = dom_sid_add_rid(*server_info, dom_sid_dup(*server_info, base->domain_sid), base->primary_gid);
 543
 544         (*server_info)->domain_groups = talloc_array_p((*server_info), struct dom_sid*, base->group_count);
 545         if (!(*server_info)->domain_groups) {
 546                 return NT_STATUS_NO_MEMORY;
 547         }
 548
 549         for ((*server_info)->n_domain_groups = 0;
 550              (*server_info)->n_domain_groups < base->group_count;
 551              (*server_info)->n_domain_groups++) {
 552                 struct dom_sid *sid;
 553                 sid = dom_sid_dup((*server_info)->domain_groups, base->domain_sid);
 554                 if (!sid) {
 555                         return NT_STATUS_NO_MEMORY;
 556                 }
 557                 (*server_info)->domain_groups[(*server_info)->n_domain_groups]
 558                         = dom_sid_add_rid(*server_info, sid,
 559                                           base->groupids[(*server_info)->n_domain_groups].rid);
 560                 if (!(*server_info)->domain_groups[(*server_info)->n_domain_groups]) {
 561                         return NT_STATUS_NO_MEMORY;
 562                 }
 563         }
 564
 565         /* Copy 'other' sids.  We need to do sid filtering here to
 566            prevent possible elevation of privileges.  See:
 567
 568            http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
 569          */
 570
 571         if (validation_level == 3) {
 572                 int i;
 573                 (*server_info)->domain_groups
 574                         = talloc_realloc_p((*server_info),
 575                                            (*server_info)->domain_groups,
 576                                            struct dom_sid*,
 577                                            base->group_count + validation->sam3->sidcount);
 578
 579                 if (!(*server_info)->domain_groups) {
 580                         return NT_STATUS_NO_MEMORY;
 581                 }
 582
 583                 for (i = 0; i < validation->sam3->sidcount; i++) {
 584                         (*server_info)->domain_groups[(*server_info)->n_domain_groups + i] =
 585                                 dom_sid_dup((*server_info)->domain_groups,
 586                                             validation->sam3->sids[i].sid);
 587                 }
 588
 589                 /* Where are the 'global' sids?... */
 590         }
 591
 592         if (base->account_name.string) {
 593                 (*server_info)->account_name = talloc_reference(*server_info, base->account_name.string);
 594         } else {
 595                 (*server_info)->account_name = talloc_strdup(*server_info, internal_username);
 596         }
 597
 598         (*server_info)->domain = talloc_reference(*server_info, base->domain.string);
 599         (*server_info)->full_name = talloc_reference(*server_info, base->full_name.string);
 600         (*server_info)->logon_script = talloc_reference(*server_info, base->logon_script.string);
 601         (*server_info)->profile_path = talloc_reference(*server_info, base->profile_path.string);
 602         (*server_info)->home_directory = talloc_reference(*server_info, base->home_directory.string);
 603         (*server_info)->home_drive = talloc_reference(*server_info, base->home_drive.string);
 604         (*server_info)->last_logon = base->last_logon;
 605         (*server_info)->last_logoff = base->last_logoff;
 606         (*server_info)->acct_expiry = base->acct_expiry;
 607         (*server_info)->last_password_change = base->last_password_change;
 608         (*server_info)->allow_password_change = base->allow_password_change;
 609         (*server_info)->force_password_change = base->force_password_change;
 610
 611         (*server_info)->logon_count = base->logon_count;
 612         (*server_info)->bad_password_count = base->bad_password_count;
 613
 614         (*server_info)->acct_flags = base->acct_flags;
 615
 616         /* ensure we are never given NULL session keys */
 617
 618         if (all_zero(base->key.key, sizeof(base->key.key))) {
 619                 (*server_info)->user_session_key = data_blob(NULL, 0);
 620         } else {
 621                 (*server_info)->user_session_key = data_blob_talloc((*server_info), base->key.key, sizeof(base->key.key));
 622         }
 623
 624         if (all_zero(base->LMSessKey.key, sizeof(base->LMSessKey.key))) {
 625                 (*server_info)->lm_session_key = data_blob(NULL, 0);
 626         } else {
 627                 (*server_info)->lm_session_key = data_blob_talloc((*server_info), base->LMSessKey.key, sizeof(base->LMSessKey.key));
 628         }
 629         return NT_STATUS_OK;
 630 }
 631
 632 /***************************************************************************
 633  Free a user_info struct
 634 ***************************************************************************/
 635
 636 void free_user_info(struct auth_usersupplied_info **user_info)
 637 {
 638         DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
 639         if (*user_info) {
 640                 data_blob_clear(&(*user_info)->plaintext_password);
 641         }
 642
 643         talloc_free(*user_info);
 644         *user_info = NULL;
 645 }
 646
 647 /***************************************************************************
 648  Clear out a server_info struct that has been allocated
 649 ***************************************************************************/
 650
 651 void free_server_info(struct auth_serversupplied_info **server_info)
 652 {
 653         DEBUG(5,("attempting to free a server_info structure\n"));
 654         talloc_free(*server_info);
 655         *server_info = NULL;
 656 }
 657
 658 /***************************************************************************
 659  Make an auth_methods struct
 660 ***************************************************************************/
 661
 662 BOOL make_auth_methods(struct auth_context *auth_context, struct auth_methods **auth_method)
 663 {
 664         if (!auth_context) {
 665                 smb_panic("no auth_context supplied to make_auth_methods()!\n");
 666         }
 667
 668         if (!auth_method) {
 669                 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
 670         }
 671
 672         *auth_method = talloc_p(auth_context, struct auth_methods);
 673         if (!*auth_method) {
 674                 return False;
 675         }
 676         ZERO_STRUCTP(*auth_method);
 677
 678         return True;
 679 }
 680
 681 NTSTATUS make_session_info(TALLOC_CTX *mem_ctx,
 682                            struct auth_serversupplied_info *server_info,
 683                            struct auth_session_info **session_info)
 684 {
 685         NTSTATUS nt_status;
 686
 687         *session_info = talloc_p(mem_ctx, struct auth_session_info);
 688         if (!*session_info) {
 689                 return NT_STATUS_NO_MEMORY;
 690         }
 691
 692         (*session_info)->server_info = server_info;
 693         talloc_reference(*session_info, (*session_info)->server_info);
 694
 695         /* unless set otherwise, the session key is the user session
 696          * key from the auth subsystem */
 697
 698         (*session_info)->session_key = server_info->user_session_key;
 699
 700         /* we should search for local groups here */
 701
 702         nt_status = create_nt_user_token((*session_info),
 703                                          server_info->user_sid,
 704                                          server_info->primary_group_sid,
 705                                          server_info->n_domain_groups,
 706                                          server_info->domain_groups,
 707                                          False,
 708                                          &(*session_info)->nt_user_token);
 709
 710         return nt_status;
 711 }
 712
 713 /***************************************************************************
 714  Clear out a server_info struct that has been allocated
 715 ***************************************************************************/
 716
 717 void free_session_info(struct auth_session_info **session_info)
 718 {
 719         DEBUG(5,("attempting to free a session_info structure\n"));
 720         talloc_free((*session_info));
 721         *session_info = NULL;
 722 }
 723
 724 /**
 725  * Squash an NT_STATUS in line with security requirements.
 726  * In an attempt to avoid giving the whole game away when users
 727  * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
 728  * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
 729  * (session setups in particular).
 730  *
 731  * @param nt_status NTSTATUS input for squashing.
 732  * @return the 'squashed' nt_status
 733  **/
 734
 735 NTSTATUS nt_status_squash(NTSTATUS nt_status)
 736 {
 737         if NT_STATUS_IS_OK(nt_status) {
 738                 return nt_status;
 739         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
 740                 /* Match WinXP and don't give the game away */
 741                 return NT_STATUS_LOGON_FAILURE;
 742
 743         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
 744                 /* Match WinXP and don't give the game away */
 745                 return NT_STATUS_LOGON_FAILURE;
 746         } else {
 747                 return nt_status;
 748         }
 749 }
 750
 751
 752