2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #include "librpc/gen_ndr/ndr_samr.h"
26 #include "librpc/gen_ndr/ndr_netlogon.h"
27 #include "libcli/security/security.h"
28 #include "auth/auth.h"
31 #define DBGC_CLASS DBGC_AUTH
33 /****************************************************************************
34 Create an auth_usersupplied_data structure
35 ****************************************************************************/
36 static NTSTATUS make_user_info(TALLOC_CTX *mem_ctx,
37 struct auth_usersupplied_info **user_info,
39 const char *internal_username,
40 const char *client_domain,
42 const char *wksta_name,
43 DATA_BLOB *lm_password, DATA_BLOB *nt_password,
44 DATA_BLOB *lm_interactive_password, DATA_BLOB *nt_interactive_password,
49 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
51 *user_info = talloc_p(mem_ctx, struct auth_usersupplied_info);
53 return NT_STATUS_NO_MEMORY;
56 ZERO_STRUCTP(*user_info);
58 DEBUG(5,("making strings for %s's user_info struct\n", internal_username));
60 (*user_info)->smb_name.str = talloc_strdup(*user_info, smb_name);
61 if ((*user_info)->smb_name.str) {
62 (*user_info)->smb_name.len = strlen(smb_name);
64 free_user_info(user_info);
65 return NT_STATUS_NO_MEMORY;
68 (*user_info)->internal_username.str = talloc_strdup(*user_info, internal_username);
69 if ((*user_info)->internal_username.str) {
70 (*user_info)->internal_username.len = strlen(internal_username);
72 free_user_info(user_info);
73 return NT_STATUS_NO_MEMORY;
76 (*user_info)->domain.str = talloc_strdup(*user_info, domain);
77 if ((*user_info)->domain.str) {
78 (*user_info)->domain.len = strlen(domain);
80 free_user_info(user_info);
81 return NT_STATUS_NO_MEMORY;
84 (*user_info)->client_domain.str = talloc_strdup(*user_info, client_domain);
85 if ((*user_info)->client_domain.str) {
86 (*user_info)->client_domain.len = strlen(client_domain);
88 free_user_info(user_info);
89 return NT_STATUS_NO_MEMORY;
92 (*user_info)->wksta_name.str = talloc_strdup(*user_info, wksta_name);
93 if ((*user_info)->wksta_name.str) {
94 (*user_info)->wksta_name.len = strlen(wksta_name);
96 free_user_info(user_info);
97 return NT_STATUS_NO_MEMORY;
100 DEBUG(5,("making blobs for %s's user_info struct\n", internal_username));
103 (*user_info)->lm_resp = data_blob_talloc(*user_info,
105 lm_password->length);
107 (*user_info)->nt_resp = data_blob_talloc(*user_info,
109 nt_password->length);
110 if (lm_interactive_password)
111 (*user_info)->lm_interactive_password =
112 data_blob_talloc(*user_info,
113 lm_interactive_password->data,
114 lm_interactive_password->length);
115 if (nt_interactive_password)
116 (*user_info)->nt_interactive_password =
117 data_blob_talloc(*user_info,
118 nt_interactive_password->data,
119 nt_interactive_password->length);
122 (*user_info)->plaintext_password =
123 data_blob_talloc(*user_info,
127 (*user_info)->encrypted = encrypted;
129 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
134 /****************************************************************************
135 Create an auth_usersupplied_data structure after appropriate mapping.
136 ****************************************************************************/
138 NTSTATUS make_user_info_map(TALLOC_CTX *mem_ctx,
139 struct auth_usersupplied_info **user_info,
140 const char *smb_name,
141 const char *client_domain,
142 const char *wksta_name,
143 DATA_BLOB *lm_password, DATA_BLOB *nt_password,
144 DATA_BLOB *lm_interactive_password, DATA_BLOB *nt_interactive_password,
145 DATA_BLOB *plaintext,
150 DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
151 client_domain, smb_name, wksta_name));
153 /* don't allow "" as a domain, fixes a Win9X bug
154 where it doens't supply a domain for logon script
155 'net use' commands. */
157 if ( *client_domain )
158 domain = client_domain;
160 domain = lp_workgroup();
162 /* we know that it is a trusted domain (and we are allowing
163 them) or it is our domain */
165 return make_user_info(mem_ctx,
166 user_info, smb_name, smb_name,
167 client_domain, domain, wksta_name,
168 lm_password, nt_password,
169 lm_interactive_password, nt_interactive_password,
170 plaintext, encrypted);
173 /****************************************************************************
174 Create an auth_usersupplied_data, making the DATA_BLOBs here.
175 Decrypt and encrypt the passwords.
176 ****************************************************************************/
178 NTSTATUS make_user_info_netlogon_network(TALLOC_CTX *mem_ctx,
179 struct auth_usersupplied_info **user_info,
180 const char *smb_name,
181 const char *client_domain,
182 const char *wksta_name,
183 const uint8_t *lm_network_password, int lm_password_len,
184 const uint8_t *nt_network_password, int nt_password_len)
187 DATA_BLOB lm_blob = data_blob(lm_network_password, lm_password_len);
188 DATA_BLOB nt_blob = data_blob(nt_network_password, nt_password_len);
190 nt_status = make_user_info_map(mem_ctx,
192 smb_name, client_domain,
194 lm_password_len ? &lm_blob : NULL,
195 nt_password_len ? &nt_blob : NULL,
199 data_blob_free(&lm_blob);
200 data_blob_free(&nt_blob);
204 /****************************************************************************
205 Create an auth_usersupplied_data, making the DATA_BLOBs here.
206 Decrypt and encrypt the passwords.
207 ****************************************************************************/
209 NTSTATUS make_user_info_netlogon_interactive(TALLOC_CTX *mem_ctx,
210 struct auth_usersupplied_info **user_info,
211 const char *smb_name,
212 const char *client_domain,
213 const char *wksta_name,
214 const uint8_t chal[8],
215 const struct samr_Password *lm_interactive_password,
216 const struct samr_Password *nt_interactive_password)
219 DATA_BLOB local_lm_blob;
220 DATA_BLOB local_nt_blob;
222 DATA_BLOB lm_interactive_blob;
223 DATA_BLOB nt_interactive_blob;
224 uint8_t local_lm_response[24];
225 uint8_t local_nt_response[24];
227 SMBOWFencrypt(lm_interactive_password->hash, chal, local_lm_response);
228 SMBOWFencrypt(nt_interactive_password->hash, chal, local_nt_response);
230 local_lm_blob = data_blob(local_lm_response,
231 sizeof(local_lm_response));
232 lm_interactive_blob = data_blob(lm_interactive_password->hash,
233 sizeof(lm_interactive_password->hash));
235 local_nt_blob = data_blob(local_nt_response,
236 sizeof(local_nt_response));
237 nt_interactive_blob = data_blob(nt_interactive_password->hash,
238 sizeof(nt_interactive_password->hash));
240 nt_status = make_user_info_map(mem_ctx,
242 smb_name, client_domain,
246 &lm_interactive_blob,
247 &nt_interactive_blob,
251 data_blob_free(&local_lm_blob);
252 data_blob_free(&local_nt_blob);
253 data_blob_free(&lm_interactive_blob);
254 data_blob_free(&nt_interactive_blob);
257 /****************************************************************************
258 Create an auth_usersupplied_data structure
259 ****************************************************************************/
261 NTSTATUS make_user_info_for_reply_enc(TALLOC_CTX *mem_ctx,
262 struct auth_usersupplied_info **user_info,
263 const char *smb_name,
264 const char *client_domain,
265 const char *remote_machine,
266 DATA_BLOB lm_resp, DATA_BLOB nt_resp)
268 return make_user_info_map(mem_ctx,
272 lm_resp.data ? &lm_resp : NULL,
273 nt_resp.data ? &nt_resp : NULL,
278 /****************************************************************************
279 Create a guest user_info blob, for anonymous authenticaion.
280 ****************************************************************************/
282 BOOL make_user_info_guest(TALLOC_CTX *mem_ctx,
283 struct auth_usersupplied_info **user_info)
287 nt_status = make_user_info(mem_ctx,
297 return NT_STATUS_IS_OK(nt_status) ? True : False;
302 /***************************************************************************
303 Make a user_info struct
304 ***************************************************************************/
306 NTSTATUS make_server_info(const TALLOC_CTX *mem_ctx,
307 struct auth_serversupplied_info **server_info,
308 const char *username)
310 *server_info = talloc_p(mem_ctx, struct auth_serversupplied_info);
312 return NT_STATUS_NO_MEMORY;
314 ZERO_STRUCTP(*server_info);
319 /***************************************************************************
320 Make a server_info struct from the info3 returned by a domain logon
321 ***************************************************************************/
323 NTSTATUS make_server_info_netlogon_validation(TALLOC_CTX *mem_ctx,
324 const char *internal_username,
325 struct auth_serversupplied_info **server_info,
326 uint16 validation_level,
327 union netr_Validation *validation)
330 struct netr_SamBaseInfo *base = NULL;
331 switch (validation_level) {
333 if (!validation || !validation->sam2) {
334 return NT_STATUS_INVALID_PARAMETER;
336 base = &validation->sam2->base;
339 if (!validation || !validation->sam3) {
340 return NT_STATUS_INVALID_PARAMETER;
342 base = &validation->sam3->base;
345 if (!validation || !validation->sam6) {
346 return NT_STATUS_INVALID_PARAMETER;
348 base = &validation->sam6->base;
351 return NT_STATUS_INVALID_LEVEL;
354 nt_status = make_server_info(mem_ctx, server_info, internal_username);
356 if (!NT_STATUS_IS_OK(nt_status)) {
360 (*server_info)->guest = False;
363 Here is where we should check the list of
364 trusted domains, and verify that the SID
368 (*server_info)->user_sid = dom_sid_add_rid(*server_info, dom_sid_dup(*server_info, base->domain_sid), base->rid);
369 (*server_info)->primary_group_sid = dom_sid_add_rid(*server_info, dom_sid_dup(*server_info, base->domain_sid), base->primary_gid);
371 (*server_info)->domain_groups = talloc_array_p((*server_info), struct dom_sid*, base->group_count);
372 if (!(*server_info)->domain_groups) {
373 return NT_STATUS_NO_MEMORY;
376 for ((*server_info)->n_domain_groups = 0;
377 (*server_info)->n_domain_groups < base->group_count;
378 (*server_info)->n_domain_groups++) {
380 sid = dom_sid_dup((*server_info)->domain_groups, base->domain_sid);
382 return NT_STATUS_NO_MEMORY;
384 (*server_info)->domain_groups[(*server_info)->n_domain_groups]
385 = dom_sid_add_rid(*server_info, sid,
386 base->groupids[(*server_info)->n_domain_groups].rid);
387 if (!(*server_info)->domain_groups[(*server_info)->n_domain_groups]) {
388 return NT_STATUS_NO_MEMORY;
392 /* Copy 'other' sids. We need to do sid filtering here to
393 prevent possible elevation of privileges. See:
395 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
398 if (validation_level == 3) {
400 (*server_info)->domain_groups
401 = talloc_realloc_p((*server_info),
402 (*server_info)->domain_groups,
404 base->group_count + validation->sam3->sidcount);
406 if (!(*server_info)->domain_groups) {
407 return NT_STATUS_NO_MEMORY;
410 for (i = 0; i < validation->sam3->sidcount; i++) {
411 (*server_info)->domain_groups[(*server_info)->n_domain_groups + i] =
412 dom_sid_dup((*server_info)->domain_groups,
413 validation->sam3->sids[i].sid);
416 /* Where are the 'global' sids?... */
419 if (base->account_name.string) {
420 (*server_info)->account_name = talloc_reference(*server_info, base->account_name.string);
422 (*server_info)->account_name = talloc_strdup(*server_info, internal_username);
425 (*server_info)->domain = talloc_reference(*server_info, base->domain.string);
426 (*server_info)->full_name = talloc_reference(*server_info, base->full_name.string);
427 (*server_info)->logon_script = talloc_reference(*server_info, base->logon_script.string);
428 (*server_info)->profile_path = talloc_reference(*server_info, base->profile_path.string);
429 (*server_info)->home_directory = talloc_reference(*server_info, base->home_directory.string);
430 (*server_info)->home_drive = talloc_reference(*server_info, base->home_drive.string);
431 (*server_info)->last_logon = base->last_logon;
432 (*server_info)->last_logoff = base->last_logoff;
433 (*server_info)->acct_expiry = base->acct_expiry;
434 (*server_info)->last_password_change = base->last_password_change;
435 (*server_info)->allow_password_change = base->allow_password_change;
436 (*server_info)->force_password_change = base->force_password_change;
438 (*server_info)->logon_count = base->logon_count;
439 (*server_info)->bad_password_count = base->bad_password_count;
441 (*server_info)->acct_flags = base->acct_flags;
443 /* ensure we are never given NULL session keys */
445 if (all_zero(base->key.key, sizeof(base->key.key))) {
446 (*server_info)->user_session_key = data_blob(NULL, 0);
448 (*server_info)->user_session_key = data_blob_talloc((*server_info), base->key.key, sizeof(base->key.key));
451 if (all_zero(base->LMSessKey.key, sizeof(base->LMSessKey.key))) {
452 (*server_info)->lm_session_key = data_blob(NULL, 0);
454 (*server_info)->lm_session_key = data_blob_talloc((*server_info), base->LMSessKey.key, sizeof(base->LMSessKey.key));
459 /***************************************************************************
460 Free a user_info struct
461 ***************************************************************************/
463 void free_user_info(struct auth_usersupplied_info **user_info)
465 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
467 data_blob_clear(&(*user_info)->plaintext_password);
470 talloc_free(*user_info);
474 /***************************************************************************
475 Clear out a server_info struct that has been allocated
476 ***************************************************************************/
478 void free_server_info(struct auth_serversupplied_info **server_info)
480 DEBUG(5,("attempting to free a server_info structure\n"));
481 talloc_free(*server_info);
485 /***************************************************************************
486 Make an auth_methods struct
487 ***************************************************************************/
489 BOOL make_auth_methods(struct auth_context *auth_context, struct auth_methods **auth_method)
492 smb_panic("no auth_context supplied to make_auth_methods()!\n");
496 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
499 *auth_method = talloc_p(auth_context, struct auth_methods);
503 ZERO_STRUCTP(*auth_method);
508 NTSTATUS make_session_info(TALLOC_CTX *mem_ctx,
509 struct auth_serversupplied_info *server_info,
510 struct auth_session_info **session_info)
514 *session_info = talloc_p(mem_ctx, struct auth_session_info);
515 if (!*session_info) {
516 return NT_STATUS_NO_MEMORY;
519 (*session_info)->server_info = server_info;
520 talloc_reference(*session_info, (*session_info)->server_info);
522 /* unless set otherwise, the session key is the user session
523 * key from the auth subsystem */
525 (*session_info)->session_key = server_info->user_session_key;
527 /* we should search for local groups here */
529 nt_status = security_token_create((*session_info),
530 server_info->user_sid,
531 server_info->primary_group_sid,
532 server_info->n_domain_groups,
533 server_info->domain_groups,
535 &(*session_info)->security_token);
540 /***************************************************************************
541 Clear out a server_info struct that has been allocated
542 ***************************************************************************/
544 void free_session_info(struct auth_session_info **session_info)
546 DEBUG(5,("attempting to free a session_info structure\n"));
547 talloc_free((*session_info));
548 *session_info = NULL;
551 /****************************************************************************
552 prints a struct auth_session_info security token to debug output.
553 ****************************************************************************/
554 void auth_session_info_debug(int dbg_lev,
555 const struct auth_session_info *session_info)
558 DEBUGC(dbg_class, dbg_lev, ("Session Info: (NULL)\n"));
562 security_token_debug(dbg_lev, session_info->security_token);
566 * Squash an NT_STATUS in line with security requirements.
567 * In an attempt to avoid giving the whole game away when users
568 * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
569 * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
570 * (session setups in particular).
572 * @param nt_status NTSTATUS input for squashing.
573 * @return the 'squashed' nt_status
576 NTSTATUS nt_status_squash(NTSTATUS nt_status)
578 if NT_STATUS_IS_OK(nt_status) {
580 } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
581 /* Match WinXP and don't give the game away */
582 return NT_STATUS_LOGON_FAILURE;
584 } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
585 /* Match WinXP and don't give the game away */
586 return NT_STATUS_LOGON_FAILURE;