2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #include "librpc/gen_ndr/ndr_samr.h"
26 #include "librpc/gen_ndr/ndr_netlogon.h"
27 #include "librpc/gen_ndr/ndr_security.h"
28 #include "auth/auth.h"
31 #define DBGC_CLASS DBGC_AUTH
33 /****************************************************************************
34 Create an auth_usersupplied_data structure
35 ****************************************************************************/
36 static NTSTATUS make_user_info(TALLOC_CTX *mem_ctx,
37 struct auth_usersupplied_info **user_info,
39 const char *internal_username,
40 const char *client_domain,
42 const char *wksta_name,
43 DATA_BLOB *lm_password, DATA_BLOB *nt_password,
44 DATA_BLOB *lm_interactive_password, DATA_BLOB *nt_interactive_password,
49 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
51 *user_info = talloc_p(mem_ctx, struct auth_usersupplied_info);
53 return NT_STATUS_NO_MEMORY;
56 ZERO_STRUCTP(*user_info);
58 DEBUG(5,("making strings for %s's user_info struct\n", internal_username));
60 (*user_info)->smb_name.str = talloc_strdup(*user_info, smb_name);
61 if ((*user_info)->smb_name.str) {
62 (*user_info)->smb_name.len = strlen(smb_name);
64 free_user_info(user_info);
65 return NT_STATUS_NO_MEMORY;
68 (*user_info)->internal_username.str = talloc_strdup(*user_info, internal_username);
69 if ((*user_info)->internal_username.str) {
70 (*user_info)->internal_username.len = strlen(internal_username);
72 free_user_info(user_info);
73 return NT_STATUS_NO_MEMORY;
76 (*user_info)->domain.str = talloc_strdup(*user_info, domain);
77 if ((*user_info)->domain.str) {
78 (*user_info)->domain.len = strlen(domain);
80 free_user_info(user_info);
81 return NT_STATUS_NO_MEMORY;
84 (*user_info)->client_domain.str = talloc_strdup(*user_info, client_domain);
85 if ((*user_info)->client_domain.str) {
86 (*user_info)->client_domain.len = strlen(client_domain);
88 free_user_info(user_info);
89 return NT_STATUS_NO_MEMORY;
92 (*user_info)->wksta_name.str = talloc_strdup(*user_info, wksta_name);
93 if ((*user_info)->wksta_name.str) {
94 (*user_info)->wksta_name.len = strlen(wksta_name);
96 free_user_info(user_info);
97 return NT_STATUS_NO_MEMORY;
100 DEBUG(5,("making blobs for %s's user_info struct\n", internal_username));
103 (*user_info)->lm_resp = data_blob_talloc(*user_info,
105 lm_password->length);
107 (*user_info)->nt_resp = data_blob_talloc(*user_info,
109 nt_password->length);
110 if (lm_interactive_password)
111 (*user_info)->lm_interactive_password =
112 data_blob_talloc(*user_info,
113 lm_interactive_password->data,
114 lm_interactive_password->length);
115 if (nt_interactive_password)
116 (*user_info)->nt_interactive_password =
117 data_blob_talloc(*user_info,
118 nt_interactive_password->data,
119 nt_interactive_password->length);
122 (*user_info)->plaintext_password =
123 data_blob_talloc(*user_info,
127 (*user_info)->encrypted = encrypted;
129 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
134 /****************************************************************************
135 Create an auth_usersupplied_data structure after appropriate mapping.
136 ****************************************************************************/
138 NTSTATUS make_user_info_map(TALLOC_CTX *mem_ctx,
139 struct auth_usersupplied_info **user_info,
140 const char *smb_name,
141 const char *client_domain,
142 const char *wksta_name,
143 DATA_BLOB *lm_password, DATA_BLOB *nt_password,
144 DATA_BLOB *lm_interactive_password, DATA_BLOB *nt_interactive_password,
145 DATA_BLOB *plaintext,
150 DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
151 client_domain, smb_name, wksta_name));
153 /* don't allow "" as a domain, fixes a Win9X bug
154 where it doens't supply a domain for logon script
155 'net use' commands. */
157 if ( *client_domain )
158 domain = client_domain;
160 domain = lp_workgroup();
162 /* we know that it is a trusted domain (and we are allowing
163 them) or it is our domain */
165 return make_user_info(mem_ctx,
166 user_info, smb_name, smb_name,
167 client_domain, domain, wksta_name,
168 lm_password, nt_password,
169 lm_interactive_password, nt_interactive_password,
170 plaintext, encrypted);
173 /****************************************************************************
174 Create an auth_usersupplied_data, making the DATA_BLOBs here.
175 Decrypt and encrypt the passwords.
176 ****************************************************************************/
178 NTSTATUS make_user_info_netlogon_network(TALLOC_CTX *mem_ctx,
179 struct auth_usersupplied_info **user_info,
180 const char *smb_name,
181 const char *client_domain,
182 const char *wksta_name,
183 const uint8_t *lm_network_password, int lm_password_len,
184 const uint8_t *nt_network_password, int nt_password_len)
187 DATA_BLOB lm_blob = data_blob(lm_network_password, lm_password_len);
188 DATA_BLOB nt_blob = data_blob(nt_network_password, nt_password_len);
190 nt_status = make_user_info_map(mem_ctx,
192 smb_name, client_domain,
194 lm_password_len ? &lm_blob : NULL,
195 nt_password_len ? &nt_blob : NULL,
199 data_blob_free(&lm_blob);
200 data_blob_free(&nt_blob);
204 /****************************************************************************
205 Create an auth_usersupplied_data, making the DATA_BLOBs here.
206 Decrypt and encrypt the passwords.
207 ****************************************************************************/
209 NTSTATUS make_user_info_netlogon_interactive(TALLOC_CTX *mem_ctx,
210 struct auth_usersupplied_info **user_info,
211 const char *smb_name,
212 const char *client_domain,
213 const char *wksta_name,
214 const uint8_t chal[8],
215 const struct samr_Password *lm_interactive_password,
216 const struct samr_Password *nt_interactive_password)
219 DATA_BLOB local_lm_blob;
220 DATA_BLOB local_nt_blob;
222 DATA_BLOB lm_interactive_blob;
223 DATA_BLOB nt_interactive_blob;
224 uint8_t local_lm_response[24];
225 uint8_t local_nt_response[24];
227 SMBOWFencrypt(lm_interactive_password->hash, chal, local_lm_response);
228 SMBOWFencrypt(nt_interactive_password->hash, chal, local_nt_response);
230 local_lm_blob = data_blob(local_lm_response,
231 sizeof(local_lm_response));
232 lm_interactive_blob = data_blob(lm_interactive_password->hash,
233 sizeof(lm_interactive_password->hash));
235 local_nt_blob = data_blob(local_nt_response,
236 sizeof(local_nt_response));
237 nt_interactive_blob = data_blob(nt_interactive_password->hash,
238 sizeof(nt_interactive_password->hash));
240 nt_status = make_user_info_map(mem_ctx,
242 smb_name, client_domain,
246 &lm_interactive_blob,
247 &nt_interactive_blob,
251 data_blob_free(&local_lm_blob);
252 data_blob_free(&local_nt_blob);
253 data_blob_free(&lm_interactive_blob);
254 data_blob_free(&nt_interactive_blob);
257 /****************************************************************************
258 Create an auth_usersupplied_data structure
259 ****************************************************************************/
261 NTSTATUS make_user_info_for_reply_enc(TALLOC_CTX *mem_ctx,
262 struct auth_usersupplied_info **user_info,
263 const char *smb_name,
264 const char *client_domain,
265 const char *remote_machine,
266 DATA_BLOB lm_resp, DATA_BLOB nt_resp)
268 return make_user_info_map(mem_ctx,
272 lm_resp.data ? &lm_resp : NULL,
273 nt_resp.data ? &nt_resp : NULL,
278 /****************************************************************************
279 Create a guest user_info blob, for anonymous authenticaion.
280 ****************************************************************************/
282 BOOL make_user_info_guest(TALLOC_CTX *mem_ctx,
283 struct auth_usersupplied_info **user_info)
287 nt_status = make_user_info(mem_ctx,
297 return NT_STATUS_IS_OK(nt_status) ? True : False;
300 /****************************************************************************
301 prints a NT_USER_TOKEN to debug output.
302 ****************************************************************************/
304 void debug_nt_user_token(int dbg_class, int dbg_lev, const NT_USER_TOKEN *token)
311 DEBUGC(dbg_class, dbg_lev, ("NT user token: (NULL)\n"));
315 mem_ctx = talloc_init("debug_nt_user_token()");
320 DEBUGC(dbg_class, dbg_lev, ("NT user token of user %s\n",
321 dom_sid_string(mem_ctx, token->user_sids[0]) ));
322 DEBUGADDC(dbg_class, dbg_lev, ("contains %lu SIDs\n", (unsigned long)token->num_sids));
323 for (i = 0; i < token->num_sids; i++)
324 DEBUGADDC(dbg_class, dbg_lev, ("SID[%3lu]: %s\n", (unsigned long)i,
325 dom_sid_string(mem_ctx, token->user_sids[i])));
327 talloc_destroy(mem_ctx);
330 /****************************************************************************
331 prints a NT_USER_TOKEN to debug output.
332 ****************************************************************************/
334 void debug_session_info(int dbg_class, int dbg_lev, const struct auth_session_info *session_info)
337 DEBUGC(dbg_class, dbg_lev, ("Session Info: (NULL)\n"));
341 debug_nt_user_token(dbg_class, dbg_lev, session_info->nt_user_token);
344 /****************************************************************************
345 Create the SID list for this user.
346 ****************************************************************************/
348 NTSTATUS create_nt_user_token(TALLOC_CTX *mem_ctx,
349 struct dom_sid *user_sid, struct dom_sid *group_sid,
350 int n_groupSIDs, struct dom_sid **groupSIDs,
351 BOOL is_guest, struct nt_user_token **token)
353 NTSTATUS nt_status = NT_STATUS_OK;
354 struct nt_user_token *ptoken;
358 if (!(ptoken = talloc_p(mem_ctx, struct nt_user_token))) {
359 DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
360 nt_status = NT_STATUS_NO_MEMORY;
364 ptoken->num_sids = 0;
366 if (!(ptoken->user_sids = talloc_array_p(mem_ctx, struct dom_sid*, n_groupSIDs + 5))) {
367 DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
368 nt_status = NT_STATUS_NO_MEMORY;
373 * Note - user SID *MUST* be first in token !
374 * se_access_check depends on this.
376 * Primary group SID is second in token. Convention.
379 ptoken->user_sids[PRIMARY_USER_SID_INDEX] = user_sid;
381 ptoken->user_sids[PRIMARY_GROUP_SID_INDEX] = group_sid;
385 * Finally add the "standard" SIDs.
386 * The only difference between guest and "anonymous" (which we
387 * don't really support) is the addition of Authenticated_Users.
389 ptoken->user_sids[2] = dom_sid_parse_talloc(mem_ctx, SID_WORLD);
390 ptoken->user_sids[3] = dom_sid_parse_talloc(mem_ctx, SID_NETWORK);
393 ptoken->user_sids[4] = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN_GUESTS);
396 ptoken->user_sids[4] = dom_sid_parse_talloc(mem_ctx, SID_AUTHENTICATED_USERS);
400 sid_ndx = 5; /* next available spot */
402 for (i = 0; i < n_groupSIDs; i++) {
403 size_t check_sid_idx;
404 for (check_sid_idx = 1; check_sid_idx < ptoken->num_sids; check_sid_idx++) {
405 if (dom_sid_equal(ptoken->user_sids[check_sid_idx],
411 if (check_sid_idx >= ptoken->num_sids) /* Not found already */ {
412 ptoken->user_sids[sid_ndx++] = groupSIDs[i];
417 debug_nt_user_token(DBGC_AUTH, 10, ptoken);
424 /***************************************************************************
425 Make a user_info struct
426 ***************************************************************************/
428 NTSTATUS make_server_info(const TALLOC_CTX *mem_ctx,
429 struct auth_serversupplied_info **server_info,
430 const char *username)
432 *server_info = talloc_p(mem_ctx, struct auth_serversupplied_info);
434 return NT_STATUS_NO_MEMORY;
436 ZERO_STRUCTP(*server_info);
441 /***************************************************************************
442 Make (and fill) a user_info struct for a guest login.
443 ***************************************************************************/
444 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx, struct auth_serversupplied_info **server_info)
448 nt_status = make_server_info(mem_ctx, server_info, "");
450 if (!NT_STATUS_IS_OK(nt_status)) {
454 (*server_info)->guest = True;
456 (*server_info)->user_sid = dom_sid_parse_talloc((*server_info), SID_ANONYMOUS);
457 (*server_info)->primary_group_sid = dom_sid_parse_talloc((*server_info), SID_BUILTIN_GUESTS);
458 (*server_info)->n_domain_groups = 0;
459 (*server_info)->domain_groups = NULL;
461 /* annoying, but the Guest really does have a session key,
462 and it is all zeros! */
463 (*server_info)->user_session_key = data_blob_talloc(*server_info, NULL, 16);
464 (*server_info)->lm_session_key = data_blob_talloc(*server_info, NULL, 16);
466 data_blob_clear(&(*server_info)->user_session_key);
467 data_blob_clear(&(*server_info)->lm_session_key);
469 (*server_info)->account_name = "";
470 (*server_info)->domain = "";
471 (*server_info)->full_name = "Anonymous";
472 (*server_info)->logon_script = "";
473 (*server_info)->profile_path = "";
474 (*server_info)->home_directory = "";
475 (*server_info)->home_drive = "";
477 (*server_info)->last_logon = 0;
478 (*server_info)->last_logoff = 0;
479 (*server_info)->acct_expiry = 0;
480 (*server_info)->last_password_change = 0;
481 (*server_info)->allow_password_change = 0;
482 (*server_info)->force_password_change = 0;
484 (*server_info)->logon_count = 0;
485 (*server_info)->bad_password_count = 0;
487 (*server_info)->acct_flags = ACB_NORMAL;
492 /***************************************************************************
493 Make a server_info struct from the info3 returned by a domain logon
494 ***************************************************************************/
496 NTSTATUS make_server_info_netlogon_validation(TALLOC_CTX *mem_ctx,
497 const char *internal_username,
498 struct auth_serversupplied_info **server_info,
499 uint16 validation_level,
500 union netr_Validation *validation)
503 struct netr_SamBaseInfo *base = NULL;
504 switch (validation_level) {
506 if (!validation || !validation->sam2) {
507 return NT_STATUS_INVALID_PARAMETER;
509 base = &validation->sam2->base;
512 if (!validation || !validation->sam3) {
513 return NT_STATUS_INVALID_PARAMETER;
515 base = &validation->sam3->base;
518 if (!validation || !validation->sam6) {
519 return NT_STATUS_INVALID_PARAMETER;
521 base = &validation->sam6->base;
524 return NT_STATUS_INVALID_LEVEL;
527 nt_status = make_server_info(mem_ctx, server_info, internal_username);
529 if (!NT_STATUS_IS_OK(nt_status)) {
533 (*server_info)->guest = False;
536 Here is where we should check the list of
537 trusted domains, and verify that the SID
541 (*server_info)->user_sid = dom_sid_add_rid(*server_info, dom_sid_dup(*server_info, base->domain_sid), base->rid);
542 (*server_info)->primary_group_sid = dom_sid_add_rid(*server_info, dom_sid_dup(*server_info, base->domain_sid), base->primary_gid);
544 (*server_info)->domain_groups = talloc_array_p((*server_info), struct dom_sid*, base->group_count);
545 if (!(*server_info)->domain_groups) {
546 return NT_STATUS_NO_MEMORY;
549 for ((*server_info)->n_domain_groups = 0;
550 (*server_info)->n_domain_groups < base->group_count;
551 (*server_info)->n_domain_groups++) {
553 sid = dom_sid_dup((*server_info)->domain_groups, base->domain_sid);
555 return NT_STATUS_NO_MEMORY;
557 (*server_info)->domain_groups[(*server_info)->n_domain_groups]
558 = dom_sid_add_rid(*server_info, sid,
559 base->groupids[(*server_info)->n_domain_groups].rid);
560 if (!(*server_info)->domain_groups[(*server_info)->n_domain_groups]) {
561 return NT_STATUS_NO_MEMORY;
565 /* Copy 'other' sids. We need to do sid filtering here to
566 prevent possible elevation of privileges. See:
568 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
571 if (validation_level == 3) {
573 (*server_info)->domain_groups
574 = talloc_realloc_p((*server_info),
575 (*server_info)->domain_groups,
577 base->group_count + validation->sam3->sidcount);
579 if (!(*server_info)->domain_groups) {
580 return NT_STATUS_NO_MEMORY;
583 for (i = 0; i < validation->sam3->sidcount; i++) {
584 (*server_info)->domain_groups[(*server_info)->n_domain_groups + i] =
585 dom_sid_dup((*server_info)->domain_groups,
586 validation->sam3->sids[i].sid);
589 /* Where are the 'global' sids?... */
592 if (base->account_name.string) {
593 (*server_info)->account_name = talloc_reference(*server_info, base->account_name.string);
595 (*server_info)->account_name = talloc_strdup(*server_info, internal_username);
598 (*server_info)->domain = talloc_reference(*server_info, base->domain.string);
599 (*server_info)->full_name = talloc_reference(*server_info, base->full_name.string);
600 (*server_info)->logon_script = talloc_reference(*server_info, base->logon_script.string);
601 (*server_info)->profile_path = talloc_reference(*server_info, base->profile_path.string);
602 (*server_info)->home_directory = talloc_reference(*server_info, base->home_directory.string);
603 (*server_info)->home_drive = talloc_reference(*server_info, base->home_drive.string);
604 (*server_info)->last_logon = base->last_logon;
605 (*server_info)->last_logoff = base->last_logoff;
606 (*server_info)->acct_expiry = base->acct_expiry;
607 (*server_info)->last_password_change = base->last_password_change;
608 (*server_info)->allow_password_change = base->allow_password_change;
609 (*server_info)->force_password_change = base->force_password_change;
611 (*server_info)->logon_count = base->logon_count;
612 (*server_info)->bad_password_count = base->bad_password_count;
614 (*server_info)->acct_flags = base->acct_flags;
616 /* ensure we are never given NULL session keys */
618 if (all_zero(base->key.key, sizeof(base->key.key))) {
619 (*server_info)->user_session_key = data_blob(NULL, 0);
621 (*server_info)->user_session_key = data_blob_talloc((*server_info), base->key.key, sizeof(base->key.key));
624 if (all_zero(base->LMSessKey.key, sizeof(base->LMSessKey.key))) {
625 (*server_info)->lm_session_key = data_blob(NULL, 0);
627 (*server_info)->lm_session_key = data_blob_talloc((*server_info), base->LMSessKey.key, sizeof(base->LMSessKey.key));
632 /***************************************************************************
633 Free a user_info struct
634 ***************************************************************************/
636 void free_user_info(struct auth_usersupplied_info **user_info)
638 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
640 data_blob_clear(&(*user_info)->plaintext_password);
643 talloc_free(*user_info);
647 /***************************************************************************
648 Clear out a server_info struct that has been allocated
649 ***************************************************************************/
651 void free_server_info(struct auth_serversupplied_info **server_info)
653 DEBUG(5,("attempting to free a server_info structure\n"));
654 talloc_free(*server_info);
658 /***************************************************************************
659 Make an auth_methods struct
660 ***************************************************************************/
662 BOOL make_auth_methods(struct auth_context *auth_context, struct auth_methods **auth_method)
665 smb_panic("no auth_context supplied to make_auth_methods()!\n");
669 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
672 *auth_method = talloc_p(auth_context, struct auth_methods);
676 ZERO_STRUCTP(*auth_method);
681 NTSTATUS make_session_info(TALLOC_CTX *mem_ctx,
682 struct auth_serversupplied_info *server_info,
683 struct auth_session_info **session_info)
687 *session_info = talloc_p(mem_ctx, struct auth_session_info);
688 if (!*session_info) {
689 return NT_STATUS_NO_MEMORY;
692 (*session_info)->server_info = server_info;
693 talloc_reference(*session_info, (*session_info)->server_info);
695 /* unless set otherwise, the session key is the user session
696 * key from the auth subsystem */
698 (*session_info)->session_key = server_info->user_session_key;
700 /* we should search for local groups here */
702 nt_status = create_nt_user_token((*session_info),
703 server_info->user_sid,
704 server_info->primary_group_sid,
705 server_info->n_domain_groups,
706 server_info->domain_groups,
708 &(*session_info)->nt_user_token);
713 /***************************************************************************
714 Clear out a server_info struct that has been allocated
715 ***************************************************************************/
717 void free_session_info(struct auth_session_info **session_info)
719 DEBUG(5,("attempting to free a session_info structure\n"));
720 talloc_free((*session_info));
721 *session_info = NULL;
725 * Squash an NT_STATUS in line with security requirements.
726 * In an attempt to avoid giving the whole game away when users
727 * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
728 * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
729 * (session setups in particular).
731 * @param nt_status NTSTATUS input for squashing.
732 * @return the 'squashed' nt_status
735 NTSTATUS nt_status_squash(NTSTATUS nt_status)
737 if NT_STATUS_IS_OK(nt_status) {
739 } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
740 /* Match WinXP and don't give the game away */
741 return NT_STATUS_LOGON_FAILURE;
743 } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
744 /* Match WinXP and don't give the game away */
745 return NT_STATUS_LOGON_FAILURE;