source/auth/auth_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6    Copyright (C) Jeremy Allison 2000-2001
   7    Copyright (C) Rafal Szczesniak 2002
   8    Copyright (C) Stefan Metzmacher 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "auth/auth.h"
  27
  28 /* this default function can be used by mostly all backends
  29  * which don't want to set a challlenge
  30  */
  31 NTSTATUS auth_get_challenge_not_implemented(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *challenge)
  32 {
  33         /* we don't want to set a challenge */
  34         return NT_STATUS_NOT_IMPLEMENTED;
  35 }
  36
  37 /****************************************************************************
  38  Create an auth_usersupplied_data structure after appropriate mapping.
  39 ****************************************************************************/
  40
  41 NTSTATUS map_user_info(TALLOC_CTX *mem_ctx,
  42                        const struct auth_usersupplied_info *user_info,
  43                        struct auth_usersupplied_info **user_info_mapped)
  44 {
  45         const char *domain;
  46         char *account_name;
  47         char *d;
  48         DEBUG(5,("map_user_info: Mapping user [%s]\\[%s] from workstation [%s]\n",
  49                 user_info->client.domain_name, user_info->client.account_name, user_info->workstation_name));
  50
  51         account_name = talloc_strdup(mem_ctx, user_info->client.account_name);
  52         if (!account_name) {
  53                 return NT_STATUS_NO_MEMORY;
  54         }
  55
  56         /* don't allow "" as a domain, fixes a Win9X bug
  57            where it doens't supply a domain for logon script
  58            'net use' commands.                                 */
  59
  60         /* Split user@realm names into user and realm components.  This is TODO to fix with proper userprincipalname support */
  61         if (user_info->client.domain_name && *user_info->client.domain_name) {
  62                 domain = user_info->client.domain_name;
  63         } else if (strchr_m(user_info->client.account_name, '@')) {
  64                 d = strchr_m(account_name, '@');
  65                 if (!d) {
  66                         return NT_STATUS_INTERNAL_ERROR;
  67                 }
  68                 d[0] = '\0';
  69                 d++;
  70                 domain = d;
  71         } else {
  72                 domain = lp_workgroup();
  73         }
  74
  75         *user_info_mapped = talloc(mem_ctx, struct auth_usersupplied_info);
  76         if (!*user_info_mapped) {
  77                 return NT_STATUS_NO_MEMORY;
  78         }
  79         talloc_reference(*user_info_mapped, user_info);
  80         **user_info_mapped = *user_info;
  81         (*user_info_mapped)->mapped_state = True;
  82         (*user_info_mapped)->mapped.domain_name = talloc_strdup(*user_info_mapped, domain);
  83         (*user_info_mapped)->mapped.account_name = talloc_strdup(*user_info_mapped, account_name);
  84         talloc_free(account_name);
  85         if (!(*user_info_mapped)->mapped.domain_name
  86             || !(*user_info_mapped)->mapped.account_name) {
  87                 return NT_STATUS_NO_MEMORY;
  88         }
  89
  90         return NT_STATUS_OK;
  91 }
  92
  93 /****************************************************************************
  94  Create an auth_usersupplied_data structure after appropriate mapping.
  95 ****************************************************************************/
  96
  97  NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth_context *auth_context,
  98                            enum auth_password_state to_state,
  99                            const struct auth_usersupplied_info *user_info_in,
 100                            const struct auth_usersupplied_info **user_info_encrypted)
 101 {
 102         NTSTATUS nt_status;
 103         struct auth_usersupplied_info *user_info_temp;
 104         switch (to_state) {
 105         case AUTH_PASSWORD_RESPONSE:
 106                 switch (user_info_in->password_state) {
 107                 case AUTH_PASSWORD_PLAIN:
 108                 {
 109                         const struct auth_usersupplied_info *user_info_temp2;
 110                         nt_status = encrypt_user_info(mem_ctx, auth_context,
 111                                                       AUTH_PASSWORD_HASH,
 112                                                       user_info_in, &user_info_temp2);
 113                         if (!NT_STATUS_IS_OK(nt_status)) {
 114                                 return nt_status;
 115                         }
 116                         user_info_in = user_info_temp2;
 117                 }
 118                 case AUTH_PASSWORD_HASH:
 119                 {
 120                         const uint8_t *challenge;
 121                         DATA_BLOB chall_blob;
 122                         user_info_temp = talloc(mem_ctx, struct auth_usersupplied_info);
 123                         if (!user_info_temp) {
 124                                 return NT_STATUS_NO_MEMORY;
 125                         }
 126                         talloc_reference(user_info_temp, user_info_in);
 127                         *user_info_temp = *user_info_in;
 128                         user_info_temp->mapped_state = to_state;
 129
 130                         nt_status = auth_get_challenge(auth_context, &challenge);
 131                         if (!NT_STATUS_IS_OK(nt_status)) {
 132                                 return nt_status;
 133                         }
 134
 135                         chall_blob = data_blob_talloc(mem_ctx, challenge, 8);
 136                         if (lp_client_ntlmv2_auth()) {
 137                                 DATA_BLOB names_blob = NTLMv2_generate_names_blob(mem_ctx, lp_netbios_name(), lp_workgroup());
 138                                 DATA_BLOB lmv2_response, ntlmv2_response, lmv2_session_key, ntlmv2_session_key;
 139
 140                                 if (!SMBNTLMv2encrypt_hash(user_info_temp,
 141                                                            user_info_in->client.account_name,
 142                                                            user_info_in->client.domain_name,
 143                                                            user_info_in->password.hash.nt->hash, &chall_blob,
 144                                                            &names_blob,
 145                                                            &lmv2_response, &ntlmv2_response,
 146                                                            &lmv2_session_key, &ntlmv2_session_key)) {
 147                                         data_blob_free(&names_blob);
 148                                         return NT_STATUS_NO_MEMORY;
 149                                 }
 150                                 data_blob_free(&names_blob);
 151                                 user_info_temp->password.response.lanman = lmv2_response;
 152                                 user_info_temp->password.response.nt = ntlmv2_response;
 153
 154                                 data_blob_free(&lmv2_session_key);
 155                                 data_blob_free(&ntlmv2_session_key);
 156                         } else {
 157                                 DATA_BLOB blob = data_blob_talloc(mem_ctx, NULL, 24);
 158                                 SMBOWFencrypt(user_info_in->password.hash.nt->hash, challenge, blob.data);
 159
 160                                 user_info_temp->password.response.nt = blob;
 161                                 if (lp_client_lanman_auth() && user_info_in->password.hash.lanman) {
 162                                         DATA_BLOB lm_blob = data_blob_talloc(mem_ctx, NULL, 24);
 163                                         SMBOWFencrypt(user_info_in->password.hash.lanman->hash, challenge, blob.data);
 164                                         user_info_temp->password.response.lanman = lm_blob;
 165                                 } else {
 166                                         /* if not sending the LM password, send the NT password twice */
 167                                         user_info_temp->password.response.lanman = user_info_temp->password.response.nt;
 168                                 }
 169                         }
 170
 171                         user_info_in = user_info_temp;
 172                 }
 173                 case AUTH_PASSWORD_RESPONSE:
 174                         *user_info_encrypted = user_info_in;
 175                 }
 176                 break;
 177         case AUTH_PASSWORD_HASH:
 178         {
 179                 switch (user_info_in->password_state) {
 180                 case AUTH_PASSWORD_PLAIN:
 181                 {
 182                         struct samr_Password lanman;
 183                         struct samr_Password nt;
 184
 185                         user_info_temp = talloc(mem_ctx, struct auth_usersupplied_info);
 186                         if (!user_info_temp) {
 187                                 return NT_STATUS_NO_MEMORY;
 188                         }
 189                         talloc_reference(user_info_temp, user_info_in);
 190                         *user_info_temp = *user_info_in;
 191                         user_info_temp->mapped_state = to_state;
 192
 193                         if (E_deshash(user_info_in->password.plaintext, lanman.hash)) {
 194                                 user_info_temp->password.hash.lanman = talloc(user_info_temp,
 195                                                                               struct samr_Password);
 196                                 *user_info_temp->password.hash.lanman = lanman;
 197                         } else {
 198                                 user_info_temp->password.hash.lanman = NULL;
 199                         }
 200
 201                         E_md4hash(user_info_in->password.plaintext, nt.hash);
 202                         user_info_temp->password.hash.nt = talloc(user_info_temp,
 203                                                                    struct samr_Password);
 204                         *user_info_temp->password.hash.nt = nt;
 205
 206                         user_info_in = user_info_temp;
 207                 }
 208                 case AUTH_PASSWORD_HASH:
 209                         *user_info_encrypted = user_info_in;
 210                         break;
 211                 default:
 212                         return NT_STATUS_INVALID_PARAMETER;
 213                         break;
 214                 }
 215                 break;
 216         }
 217         default:
 218                 return NT_STATUS_INVALID_PARAMETER;
 219         }
 220
 221         return NT_STATUS_OK;
 222 }
 223
 224 /***************************************************************************
 225  Make a server_info struct from the info3 returned by a domain logon
 226 ***************************************************************************/
 227 NTSTATUS make_server_info_netlogon_validation(TALLOC_CTX *mem_ctx,
 228                                               const char *account_name,
 229                                               uint16_t validation_level,
 230                                               union netr_Validation *validation,
 231                                               struct auth_serversupplied_info **_server_info)
 232 {
 233         struct auth_serversupplied_info *server_info;
 234         struct netr_SamBaseInfo *base = NULL;
 235         int i;
 236
 237         switch (validation_level) {
 238         case 2:
 239                 if (!validation || !validation->sam2) {
 240                         return NT_STATUS_INVALID_PARAMETER;
 241                 }
 242                 base = &validation->sam2->base;
 243                 break;
 244         case 3:
 245                 if (!validation || !validation->sam3) {
 246                         return NT_STATUS_INVALID_PARAMETER;
 247                 }
 248                 base = &validation->sam3->base;
 249                 break;
 250         case 6:
 251                 if (!validation || !validation->sam6) {
 252                         return NT_STATUS_INVALID_PARAMETER;
 253                 }
 254                 base = &validation->sam6->base;
 255                 break;
 256         default:
 257                 return NT_STATUS_INVALID_LEVEL;
 258         }
 259
 260         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 261         NT_STATUS_HAVE_NO_MEMORY(server_info);
 262
 263         /*
 264            Here is where we should check the list of
 265            trusted domains, and verify that the SID
 266            matches.
 267         */
 268         server_info->account_sid = dom_sid_add_rid(server_info, base->domain_sid, base->rid);
 269         NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
 270
 271
 272         server_info->primary_group_sid = dom_sid_add_rid(server_info, base->domain_sid, base->primary_gid);
 273         NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
 274
 275         server_info->n_domain_groups = base->groups.count;
 276         if (base->groups.count) {
 277                 server_info->domain_groups = talloc_array(server_info, struct dom_sid*, base->groups.count);
 278                 NT_STATUS_HAVE_NO_MEMORY(server_info->domain_groups);
 279         } else {
 280                 server_info->domain_groups = NULL;
 281         }
 282
 283         for (i = 0; i < base->groups.count; i++) {
 284                 server_info->domain_groups[i] = dom_sid_add_rid(server_info, base->domain_sid, base->groups.rids[i].rid);
 285                 NT_STATUS_HAVE_NO_MEMORY(server_info->domain_groups[i]);
 286         }
 287
 288         /* Copy 'other' sids.  We need to do sid filtering here to
 289            prevent possible elevation of privileges.  See:
 290
 291            http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
 292          */
 293
 294         if (validation_level == 3) {
 295                 struct dom_sid **dgrps = server_info->domain_groups;
 296                 size_t sidcount = server_info->n_domain_groups + validation->sam3->sidcount;
 297                 size_t n_dgrps = server_info->n_domain_groups;
 298
 299                 if (validation->sam3->sidcount > 0) {
 300                         dgrps = talloc_realloc(server_info, dgrps, struct dom_sid*, sidcount);
 301                         NT_STATUS_HAVE_NO_MEMORY(dgrps);
 302
 303                         for (i = 0; i < validation->sam3->sidcount; i++) {
 304                                 dgrps[n_dgrps + i] = talloc_reference(dgrps, validation->sam3->sids[i].sid);
 305                         }
 306                 }
 307
 308                 server_info->n_domain_groups = sidcount;
 309                 server_info->domain_groups = dgrps;
 310
 311                 /* Where are the 'global' sids?... */
 312         }
 313
 314         if (base->account_name.string) {
 315                 server_info->account_name = talloc_reference(server_info, base->account_name.string);
 316         } else {
 317                 server_info->account_name = talloc_strdup(server_info, account_name);
 318                 NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 319         }
 320
 321         server_info->domain_name = talloc_reference(server_info, base->domain.string);
 322         server_info->full_name = talloc_reference(server_info, base->full_name.string);
 323         server_info->logon_script = talloc_reference(server_info, base->logon_script.string);
 324         server_info->profile_path = talloc_reference(server_info, base->profile_path.string);
 325         server_info->home_directory = talloc_reference(server_info, base->home_directory.string);
 326         server_info->home_drive = talloc_reference(server_info, base->home_drive.string);
 327         server_info->logon_server = talloc_reference(server_info, base->logon_server.string);
 328         server_info->last_logon = base->last_logon;
 329         server_info->last_logoff = base->last_logoff;
 330         server_info->acct_expiry = base->acct_expiry;
 331         server_info->last_password_change = base->last_password_change;
 332         server_info->allow_password_change = base->allow_password_change;
 333         server_info->force_password_change = base->force_password_change;
 334         server_info->logon_count = base->logon_count;
 335         server_info->bad_password_count = base->bad_password_count;
 336         server_info->acct_flags = base->acct_flags;
 337
 338         server_info->authenticated = True;
 339
 340         /* ensure we are never given NULL session keys */
 341
 342         if (all_zero(base->key.key, sizeof(base->key.key))) {
 343                 server_info->user_session_key = data_blob(NULL, 0);
 344         } else {
 345                 server_info->user_session_key = data_blob_talloc(server_info, base->key.key, sizeof(base->key.key));
 346                 NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 347         }
 348
 349         if (all_zero(base->LMSessKey.key, sizeof(base->LMSessKey.key))) {
 350                 server_info->lm_session_key = data_blob(NULL, 0);
 351         } else {
 352                 server_info->lm_session_key = data_blob_talloc(server_info, base->LMSessKey.key, sizeof(base->LMSessKey.key));
 353                 NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 354         }
 355
 356         *_server_info = server_info;
 357         return NT_STATUS_OK;
 358 }
 359
 360
 361 NTSTATUS auth_anonymous_server_info(TALLOC_CTX *mem_ctx, struct auth_serversupplied_info **_server_info)
 362 {
 363         struct auth_serversupplied_info *server_info;
 364         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 365         NT_STATUS_HAVE_NO_MEMORY(server_info);
 366
 367         server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_ANONYMOUS);
 368         NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
 369
 370         /* is this correct? */
 371         server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_GUESTS);
 372         NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
 373
 374         server_info->n_domain_groups = 0;
 375         server_info->domain_groups = NULL;
 376
 377         /* annoying, but the Anonymous really does have a session key,
 378            and it is all zeros! */
 379         server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
 380         NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 381
 382         server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
 383         NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 384
 385         data_blob_clear(&server_info->user_session_key);
 386         data_blob_clear(&server_info->lm_session_key);
 387
 388         server_info->account_name = talloc_strdup(server_info, "ANONYMOUS LOGON");
 389         NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 390
 391         server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
 392         NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
 393
 394         server_info->full_name = talloc_strdup(server_info, "Anonymous Logon");
 395         NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
 396
 397         server_info->logon_script = talloc_strdup(server_info, "");
 398         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
 399
 400         server_info->profile_path = talloc_strdup(server_info, "");
 401         NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
 402
 403         server_info->home_directory = talloc_strdup(server_info, "");
 404         NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
 405
 406         server_info->home_drive = talloc_strdup(server_info, "");
 407         NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
 408
 409         server_info->logon_server = talloc_strdup(server_info, lp_netbios_name());
 410         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
 411
 412         server_info->last_logon = 0;
 413         server_info->last_logoff = 0;
 414         server_info->acct_expiry = 0;
 415         server_info->last_password_change = 0;
 416         server_info->allow_password_change = 0;
 417         server_info->force_password_change = 0;
 418
 419         server_info->logon_count = 0;
 420         server_info->bad_password_count = 0;
 421
 422         server_info->acct_flags = ACB_NORMAL;
 423
 424         server_info->authenticated = False;
 425
 426         *_server_info = server_info;
 427
 428         return NT_STATUS_OK;
 429 }
 430
 431 NTSTATUS auth_system_server_info(TALLOC_CTX *mem_ctx, struct auth_serversupplied_info **_server_info)
 432 {
 433         struct auth_serversupplied_info *server_info;
 434         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 435         NT_STATUS_HAVE_NO_MEMORY(server_info);
 436
 437         server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_SYSTEM);
 438         NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
 439
 440         /* is this correct? */
 441         server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_ADMINISTRATORS);
 442         NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
 443
 444         server_info->n_domain_groups = 0;
 445         server_info->domain_groups = NULL;
 446
 447         /* annoying, but the Anonymous really does have a session key,
 448            and it is all zeros! */
 449         server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
 450         NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 451
 452         server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
 453         NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 454
 455         data_blob_clear(&server_info->user_session_key);
 456         data_blob_clear(&server_info->lm_session_key);
 457
 458         server_info->account_name = talloc_strdup(server_info, "SYSTEM");
 459         NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 460
 461         server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
 462         NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
 463
 464         server_info->full_name = talloc_strdup(server_info, "System");
 465         NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
 466
 467         server_info->logon_script = talloc_strdup(server_info, "");
 468         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
 469
 470         server_info->profile_path = talloc_strdup(server_info, "");
 471         NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
 472
 473         server_info->home_directory = talloc_strdup(server_info, "");
 474         NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
 475
 476         server_info->home_drive = talloc_strdup(server_info, "");
 477         NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
 478
 479         server_info->logon_server = talloc_strdup(server_info, lp_netbios_name());
 480         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
 481
 482         server_info->last_logon = 0;
 483         server_info->last_logoff = 0;
 484         server_info->acct_expiry = 0;
 485         server_info->last_password_change = 0;
 486         server_info->allow_password_change = 0;
 487         server_info->force_password_change = 0;
 488
 489         server_info->logon_count = 0;
 490         server_info->bad_password_count = 0;
 491
 492         server_info->acct_flags = ACB_NORMAL;
 493
 494         server_info->authenticated = False;
 495
 496         *_server_info = server_info;
 497
 498         return NT_STATUS_OK;
 499 }
 500
 501 NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx,
 502                                     struct auth_serversupplied_info *server_info,
 503                                     struct auth_session_info **_session_info)
 504 {
 505         struct auth_session_info *session_info;
 506         NTSTATUS nt_status;
 507
 508         session_info = talloc(mem_ctx, struct auth_session_info);
 509         NT_STATUS_HAVE_NO_MEMORY(session_info);
 510
 511         session_info->server_info = talloc_reference(session_info, server_info);
 512
 513         /* unless set otherwise, the session key is the user session
 514          * key from the auth subsystem */
 515         session_info->session_key = server_info->user_session_key;
 516
 517         nt_status = security_token_create(session_info,
 518                                           server_info->account_sid,
 519                                           server_info->primary_group_sid,
 520                                           server_info->n_domain_groups,
 521                                           server_info->domain_groups,
 522                                           server_info->authenticated,
 523                                           &session_info->security_token);
 524         NT_STATUS_NOT_OK_RETURN(nt_status);
 525
 526         session_info->credentials = NULL;
 527
 528         *_session_info = session_info;
 529         return NT_STATUS_OK;
 530 }
 531
 532 NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
 533                                      struct auth_session_info **_session_info)
 534 {
 535         NTSTATUS nt_status;
 536         struct auth_serversupplied_info *server_info = NULL;
 537         struct auth_session_info *session_info = NULL;
 538         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 539
 540         nt_status = auth_anonymous_server_info(mem_ctx,
 541                                                &server_info);
 542         if (!NT_STATUS_IS_OK(nt_status)) {
 543                 talloc_free(mem_ctx);
 544                 return nt_status;
 545         }
 546
 547         /* references the server_info into the session_info */
 548         nt_status = auth_generate_session_info(parent_ctx, server_info, &session_info);
 549         talloc_free(mem_ctx);
 550
 551         NT_STATUS_NOT_OK_RETURN(nt_status);
 552
 553         session_info->credentials = cli_credentials_init(session_info);
 554         if (!session_info->credentials) {
 555                 return NT_STATUS_NO_MEMORY;
 556         }
 557
 558         cli_credentials_set_conf(session_info->credentials);
 559         cli_credentials_set_anonymous(session_info->credentials);
 560
 561         *_session_info = session_info;
 562
 563         return NT_STATUS_OK;
 564 }
 565
 566 struct auth_session_info *anonymous_session(TALLOC_CTX *mem_ctx)
 567 {
 568         NTSTATUS nt_status;
 569         struct auth_session_info *session_info = NULL;
 570         nt_status = auth_anonymous_session_info(mem_ctx, &session_info);
 571         if (!NT_STATUS_IS_OK(nt_status)) {
 572                 return NULL;
 573         }
 574         return session_info;
 575 }
 576
 577 NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
 578                                   struct auth_session_info **_session_info)
 579 {
 580         NTSTATUS nt_status;
 581         struct auth_serversupplied_info *server_info = NULL;
 582         struct auth_session_info *session_info = NULL;
 583         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 584
 585         nt_status = auth_system_server_info(mem_ctx,
 586                                             &server_info);
 587         if (!NT_STATUS_IS_OK(nt_status)) {
 588                 talloc_free(mem_ctx);
 589                 return nt_status;
 590         }
 591
 592         /* references the server_info into the session_info */
 593         nt_status = auth_generate_session_info(parent_ctx, server_info, &session_info);
 594         talloc_free(mem_ctx);
 595
 596         NT_STATUS_NOT_OK_RETURN(nt_status);
 597
 598         session_info->credentials = cli_credentials_init(session_info);
 599         if (!session_info->credentials) {
 600                 return NT_STATUS_NO_MEMORY;
 601         }
 602
 603         cli_credentials_set_conf(session_info->credentials);
 604         cli_credentials_set_machine_account_pending(session_info->credentials);
 605         *_session_info = session_info;
 606
 607         return NT_STATUS_OK;
 608 }
 609
 610 struct auth_session_info *system_session(TALLOC_CTX *mem_ctx)
 611 {
 612         NTSTATUS nt_status;
 613         struct auth_session_info *session_info = NULL;
 614         nt_status = auth_system_session_info(mem_ctx, &session_info);
 615         if (!NT_STATUS_IS_OK(nt_status)) {
 616                 return NULL;
 617         }
 618         return session_info;
 619 }
 620
 621 /****************************************************************************
 622  prints a struct auth_session_info security token to debug output.
 623 ****************************************************************************/
 624 void auth_session_info_debug(int dbg_lev,
 625                              const struct auth_session_info *session_info)
 626 {
 627         if (!session_info) {
 628                 DEBUGC(dbg_class, dbg_lev, ("Session Info: (NULL)\n"));
 629                 return;
 630         }
 631
 632         security_token_debug(dbg_lev, session_info->security_token);
 633 }
 634
 635 /**
 636  * Squash an NT_STATUS in line with security requirements.
 637  * In an attempt to avoid giving the whole game away when users
 638  * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
 639  * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
 640  * (session setups in particular).
 641  *
 642  * @param nt_status NTSTATUS input for squashing.
 643  * @return the 'squashed' nt_status
 644  **/
 645 NTSTATUS auth_nt_status_squash(NTSTATUS nt_status)
 646 {
 647         if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
 648                 /* Match WinXP and don't give the game away */
 649                 return NT_STATUS_LOGON_FAILURE;
 650         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
 651                 /* Match WinXP and don't give the game away */
 652                 return NT_STATUS_LOGON_FAILURE;
 653         }
 654
 655         return nt_status;
 656 }