#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
+/****************************************************************************
+ Ensure primary group SID is always at position 0 in a
+ auth_serversupplied_info struct.
+****************************************************************************/
+
+static void sort_sid_array_for_smbd(auth_serversupplied_info *result,
+ const DOM_SID *pgroup_sid)
+{
+ unsigned int i;
+
+ if (!result->sids) {
+ return;
+ }
+
+ if (sid_compare(&result->sids[0], pgroup_sid)==0) {
+ return;
+ }
+
+ for (i = 1; i < result->num_sids; i++) {
+ if (sid_compare(pgroup_sid,
+ &result->sids[i]) == 0) {
+ sid_copy(&result->sids[i], &result->sids[0]);
+ sid_copy(&result->sids[0], pgroup_sid);
+ return;
+ }
+ }
+}
+
/****************************************************************************
Create a UNIX user on demand.
****************************************************************************/
Create an auth_usersupplied_data structure after appropriate mapping.
****************************************************************************/
-NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
- const char *smb_name,
- const char *client_domain,
- const char *wksta_name,
- DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
- DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
- DATA_BLOB *plaintext,
+NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
+ const char *smb_name,
+ const char *client_domain,
+ const char *wksta_name,
+ DATA_BLOB *lm_pwd,
+ DATA_BLOB *nt_pwd,
+ DATA_BLOB *lm_interactive_pwd,
+ DATA_BLOB *nt_interactive_pwd,
+ DATA_BLOB *plaintext,
bool encrypted)
{
const char *domain;
bool was_mapped;
fstring internal_username;
fstrcpy(internal_username, smb_name);
- was_mapped = map_username(internal_username);
-
- DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
- client_domain, smb_name, wksta_name));
-
- /* don't allow "" as a domain, fixes a Win9X bug
+ was_mapped = map_username(internal_username);
+
+ DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
+ client_domain, smb_name, wksta_name));
+
+ /* don't allow "" as a domain, fixes a Win9X bug
where it doens't supply a domain for logon script
'net use' commands. */
else
domain = lp_workgroup();
- /* do what win2k does. Always map unknown domains to our own
- and let the "passdb backend" handle unknown users. */
+ /* If you connect to a Windows domain member using a bogus domain name,
+ * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
+ * the Windows box is a DC the name will become DOMAIN\user and be
+ * authenticated against AD, if the Windows box is a member server but
+ * not a DC the name will become WORKSTATION\user. A standalone
+ * non-domain member box will also map to WORKSTATION\user. */
- if ( !is_trusted_domain(domain) && !strequal(domain, get_global_sam_name()) )
- domain = my_sam_name();
-
- /* we know that it is a trusted domain (and we are allowing them) or it is our domain */
-
- result = make_user_info(user_info, smb_name, internal_username,
- client_domain, domain, wksta_name,
+ if (!is_trusted_domain(domain) &&
+ !strequal(domain, get_global_sam_name()) )
+ {
+ if (lp_map_untrusted_to_domain())
+ domain = my_sam_name();
+ else
+ domain = get_global_sam_name();
+ DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
+ "workstation [%s]\n",
+ client_domain, domain, smb_name, wksta_name));
+ }
+
+ /* We know that the given domain is trusted (and we are allowing them),
+ * it is our global SAM name, or for legacy behavior it is our
+ * primary domain name */
+
+ result = make_user_info(user_info, smb_name, internal_username,
+ client_domain, domain, wksta_name,
lm_pwd, nt_pwd,
lm_interactive_pwd, nt_interactive_pwd,
plaintext, encrypted);
which may save us from giving away root access if there
is a bug in allocating these fields. */
- result->uid = -1;
- result->gid = -1;
+ result->utok.uid = -1;
+ result->utok.gid = -1;
return result;
}
+static char *sanitize_username(TALLOC_CTX *mem_ctx, const char *username)
+{
+ fstring tmp;
+
+ alpha_strcpy(tmp, username, ". _-$", sizeof(tmp));
+ return talloc_strdup(mem_ctx, tmp);
+}
+
+/***************************************************************************
+ Is the incoming username our own machine account ?
+ If so, the connection is almost certainly from winbindd.
+***************************************************************************/
+
+static bool is_our_machine_account(const char *username)
+{
+ bool ret;
+ char *truncname = NULL;
+ size_t ulen = strlen(username);
+
+ if (ulen == 0 || username[ulen-1] != '$') {
+ return false;
+ }
+ truncname = SMB_STRDUP(username);
+ if (!truncname) {
+ return false;
+ }
+ truncname[ulen-1] = '\0';
+ ret = strequal(truncname, global_myname());
+ SAFE_FREE(truncname);
+ return ret;
+}
+
/***************************************************************************
Make (and fill) a user_info struct from a struct samu
***************************************************************************/
-NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
+NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
struct samu *sampass)
{
- NTSTATUS status;
struct passwd *pwd;
gid_t *gids;
auth_serversupplied_info *result;
- int i;
- size_t num_gids;
- DOM_SID unix_group_sid;
-
+ const char *username = pdb_get_username(sampass);
+ NTSTATUS status;
if ( !(result = make_server_info(NULL)) ) {
return NT_STATUS_NO_MEMORY;
}
- if ( !(pwd = getpwnam_alloc(result, pdb_get_username(sampass))) ) {
+ if ( !(pwd = getpwnam_alloc(result, username)) ) {
DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
pdb_get_username(sampass)));
TALLOC_FREE(result);
}
result->sam_account = sampass;
- /* Ensure thaat the sampass will be freed with the result */
- talloc_steal(result, sampass);
result->unix_name = pwd->pw_name;
/* Ensure that we keep pwd->pw_name, because we will free pwd below */
talloc_steal(result, pwd->pw_name);
- result->gid = pwd->pw_gid;
- result->uid = pwd->pw_uid;
-
+ result->utok.gid = pwd->pw_gid;
+ result->utok.uid = pwd->pw_uid;
+
TALLOC_FREE(pwd);
- status = pdb_enum_group_memberships(result, sampass,
+ result->sanitized_username = sanitize_username(result,
+ result->unix_name);
+ if (result->sanitized_username == NULL) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (IS_DC && is_our_machine_account(username)) {
+ /*
+ * Ensure for a connection from our own
+ * machine account (from winbindd on a DC)
+ * there are no supplementary groups.
+ * Prevents loops in calling gid_to_sid().
+ */
+ result->sids = NULL;
+ gids = NULL;
+ result->num_sids = 0;
+
+ /*
+ * This is a hack of monstrous proportions.
+ * If we know it's winbindd talking to us,
+ * we know we must never recurse into it,
+ * so turn off contacting winbindd for this
+ * entire process. This will get fixed when
+ * winbindd doesn't need to talk to smbd on
+ * a PDC. JRA.
+ */
+
+ (void)winbind_off();
+
+ DEBUG(10, ("make_server_info_sam: our machine account %s "
+ "setting supplementary group list empty and "
+ "turning off winbindd requests.\n",
+ username));
+ } else {
+ status = pdb_enum_group_memberships(result, sampass,
&result->sids, &gids,
&result->num_sids);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
- nt_errstr(status)));
- result->sam_account = NULL; /* Don't free on error exit. */
- TALLOC_FREE(result);
- return status;
- }
-
- /* Add the "Unix Group" SID for each gid to catch mapped groups
- and their Unix equivalent. This is to solve the backwards
- compatibility problem of 'valid users = +ntadmin' where
- ntadmin has been paired with "Domain Admins" in the group
- mapping table. Otherwise smb.conf would need to be changed
- to 'valid user = "Domain Admins"'. --jerry */
-
- num_gids = result->num_sids;
- for ( i=0; i<num_gids; i++ ) {
- if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
- DEBUG(1,("make_server_info_sam: Failed to create SID "
- "for gid %d!\n", gids[i]));
- continue;
- }
- status = add_sid_to_array_unique(result, &unix_group_sid,
- &result->sids,
- &result->num_sids);
if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
+ nt_errstr(status)));
result->sam_account = NULL; /* Don't free on error exit. */
TALLOC_FREE(result);
return status;
pdb_get_username(sampass), result->unix_name));
*server_info = result;
+ /* Ensure that the sampass will be freed with the result */
+ talloc_steal(result, sampass);
return NT_STATUS_OK;
}
-static NTSTATUS log_nt_token(TALLOC_CTX *tmp_ctx, NT_USER_TOKEN *token)
+static NTSTATUS log_nt_token(NT_USER_TOKEN *token)
{
+ TALLOC_CTX *frame = talloc_stackframe();
char *command;
char *group_sidstr;
size_t i;
if ((lp_log_nt_token_command() == NULL) ||
(strlen(lp_log_nt_token_command()) == 0)) {
+ TALLOC_FREE(frame);
return NT_STATUS_OK;
}
- group_sidstr = talloc_strdup(tmp_ctx, "");
+ group_sidstr = talloc_strdup(frame, "");
for (i=1; i<token->num_sids; i++) {
group_sidstr = talloc_asprintf(
- tmp_ctx, "%s %s", group_sidstr,
- sid_string_talloc(tmp_ctx, &token->user_sids[i]));
+ frame, "%s %s", group_sidstr,
+ sid_string_talloc(frame, &token->user_sids[i]));
}
command = talloc_string_sub(
- tmp_ctx, lp_log_nt_token_command(),
- "%s", sid_string_talloc(tmp_ctx, &token->user_sids[0]));
- command = talloc_string_sub(tmp_ctx, command, "%t", group_sidstr);
+ frame, lp_log_nt_token_command(),
+ "%s", sid_string_talloc(frame, &token->user_sids[0]));
+ command = talloc_string_sub(frame, command, "%t", group_sidstr);
if (command == NULL) {
+ TALLOC_FREE(frame);
return NT_STATUS_NO_MEMORY;
}
DEBUG(8, ("running command: [%s]\n", command));
if (smbrun(command, NULL) != 0) {
DEBUG(0, ("Could not log NT token\n"));
+ TALLOC_FREE(frame);
return NT_STATUS_ACCESS_DENIED;
}
+ TALLOC_FREE(frame);
return NT_STATUS_OK;
}
NTSTATUS create_local_token(auth_serversupplied_info *server_info)
{
- TALLOC_CTX *mem_ctx;
NTSTATUS status;
size_t i;
-
-
- mem_ctx = talloc_new(NULL);
- if (mem_ctx == NULL) {
- DEBUG(0, ("talloc_new failed\n"));
- return NT_STATUS_NO_MEMORY;
- }
+ struct dom_sid tmp_sid;
/*
* If winbind is not around, we can not make much use of the SIDs the
*/
if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
- (server_info->was_mapped)) {
+ (server_info->nss_token)) {
status = create_token_from_username(server_info,
server_info->unix_name,
server_info->guest,
- &server_info->uid,
- &server_info->gid,
+ &server_info->utok.uid,
+ &server_info->utok.gid,
&server_info->unix_name,
&server_info->ptok);
-
+
} else {
server_info->ptok = create_local_nt_token(
server_info,
}
if (!NT_STATUS_IS_OK(status)) {
- TALLOC_FREE(mem_ctx);
return status;
}
-
+
/* Convert the SIDs to gids. */
- server_info->n_groups = 0;
- server_info->groups = NULL;
+ server_info->utok.ngroups = 0;
+ server_info->utok.groups = NULL;
/* Start at index 1, where the groups start. */
"ignoring it\n", sid_string_dbg(sid)));
continue;
}
- add_gid_to_array_unique(server_info, gid, &server_info->groups,
- &server_info->n_groups);
+ add_gid_to_array_unique(server_info, gid,
+ &server_info->utok.groups,
+ &server_info->utok.ngroups);
}
-
- debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
- status = log_nt_token(mem_ctx, server_info->ptok);
+ /*
+ * Add the "Unix Group" SID for each gid to catch mapped groups
+ * and their Unix equivalent. This is to solve the backwards
+ * compatibility problem of 'valid users = +ntadmin' where
+ * ntadmin has been paired with "Domain Admins" in the group
+ * mapping table. Otherwise smb.conf would need to be changed
+ * to 'valid user = "Domain Admins"'. --jerry
+ *
+ * For consistency we also add the "Unix User" SID,
+ * so that the complete unix token is represented within
+ * the nt token.
+ */
- TALLOC_FREE(mem_ctx);
+ if (!uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid)) {
+ DEBUG(1,("create_local_token: Failed to create SID "
+ "for uid %d!\n", server_info->utok.uid));
+ }
+ add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+ &server_info->ptok->user_sids,
+ &server_info->ptok->num_sids);
+
+ for ( i=0; i<server_info->utok.ngroups; i++ ) {
+ if (!gid_to_unix_groups_sid( server_info->utok.groups[i], &tmp_sid ) ) {
+ DEBUG(1,("create_local_token: Failed to create SID "
+ "for gid %d!\n", server_info->utok.groups[i]));
+ continue;
+ }
+ add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+ &server_info->ptok->user_sids,
+ &server_info->ptok->num_sids);
+ }
+
+ debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
+ debug_unix_user_token(DBGC_AUTH, 10,
+ server_info->utok.uid,
+ server_info->utok.gid,
+ server_info->utok.ngroups,
+ server_info->utok.groups);
+
+ status = log_nt_token(server_info->ptok);
return status;
}
/*
- * Create an artificial NT token given just a username. (Initially indended
+ * Create an artificial NT token given just a username. (Initially intended
* for force user)
*
* We go through lookup_name() to avoid problems we had with 'winbind use
goto done;
}
- if (!sid_to_uid(&user_sid, uid)) {
- DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
- username, sid_string_dbg(&user_sid)));
- goto done;
- }
-
if (sid_check_is_in_our_domain(&user_sid)) {
bool ret;
unix_user:
+ if (!sid_to_uid(&user_sid, uid)) {
+ DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
+ username, sid_string_dbg(&user_sid)));
+ goto done;
+ }
+
uid_to_unix_users_sid(*uid, &user_sid);
pass = getpwuid_alloc(tmp_ctx, *uid);
return user_in_group_sid(username, &group_sid);
}
-
/***************************************************************************
- Make (and fill) a user_info struct from a 'struct passwd' by conversion
+ Make (and fill) a server_info struct from a 'struct passwd' by conversion
to a struct samu
***************************************************************************/
}
result->sam_account = sampass;
+
result->unix_name = talloc_strdup(result, unix_username);
- result->uid = pwd->pw_uid;
- result->gid = pwd->pw_gid;
+ result->sanitized_username = sanitize_username(result, unix_username);
+
+ if ((result->unix_name == NULL)
+ || (result->sanitized_username == NULL)) {
+ TALLOC_FREE(sampass);
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ result->utok.uid = pwd->pw_uid;
+ result->utok.gid = pwd->pw_gid;
status = pdb_enum_group_memberships(result, sampass,
&result->sids, &gids,
DOM_SID guest_sid;
bool ret;
char zeros[16];
+ fstring tmp;
if ( !(sampass = samu_new( NULL )) ) {
return NT_STATUS_NO_MEMORY;
(*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
(*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
+ alpha_strcpy(tmp, pdb_get_username(sampass), ". _-$", sizeof(tmp));
+ (*server_info)->sanitized_username = talloc_strdup(*server_info, tmp);
+
+ return NT_STATUS_OK;
+}
+
+/****************************************************************************
+ Fake a auth_serversupplied_info just from a username
+****************************************************************************/
+
+NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
+ const char *username,
+ bool is_guest,
+ struct auth_serversupplied_info **presult)
+{
+ struct auth_serversupplied_info *result;
+ struct passwd *pwd;
+ NTSTATUS status;
+
+ pwd = getpwnam_alloc(talloc_tos(), username);
+ if (pwd == NULL) {
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ status = make_server_info_pw(&result, pwd->pw_name, pwd);
+
+ TALLOC_FREE(pwd);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ result->nss_token = true;
+ result->guest = is_guest;
+
+ status = create_local_token(result);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(result);
+ return status;
+ }
+
+ *presult = result;
return NT_STATUS_OK;
}
-static auth_serversupplied_info *copy_serverinfo(auth_serversupplied_info *src)
+
+struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
+ const auth_serversupplied_info *src)
{
auth_serversupplied_info *dst;
- dst = make_server_info(NULL);
+ dst = make_server_info(mem_ctx);
if (dst == NULL) {
return NULL;
}
dst->guest = src->guest;
- dst->uid = src->uid;
- dst->gid = src->gid;
- dst->n_groups = src->n_groups;
- if (src->n_groups != 0) {
- dst->groups = (gid_t *)TALLOC_MEMDUP(
- dst, src->groups, sizeof(gid_t)*dst->n_groups);
+ dst->utok.uid = src->utok.uid;
+ dst->utok.gid = src->utok.gid;
+ dst->utok.ngroups = src->utok.ngroups;
+ if (src->utok.ngroups != 0) {
+ dst->utok.groups = (gid_t *)TALLOC_MEMDUP(
+ dst, src->utok.groups,
+ sizeof(gid_t)*dst->utok.ngroups);
} else {
- dst->groups = NULL;
+ dst->utok.groups = NULL;
}
if (src->ptok) {
return NULL;
}
+ dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
+ if (!dst->sanitized_username) {
+ TALLOC_FREE(dst);
+ return NULL;
+ }
+
return dst;
}
+/*
+ * Set a new session key. Used in the rpc server where we have to override the
+ * SMB level session key with SystemLibraryDTC
+ */
+
+bool server_info_set_session_key(struct auth_serversupplied_info *info,
+ DATA_BLOB session_key)
+{
+ TALLOC_FREE(info->user_session_key.data);
+
+ info->user_session_key = data_blob_talloc(
+ info, session_key.data, session_key.length);
+
+ return (info->user_session_key.data != NULL);
+}
+
static auth_serversupplied_info *guest_info = NULL;
bool init_guest_info(void)
return NT_STATUS_IS_OK(make_new_server_info_guest(&guest_info));
}
-NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
+NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
+ auth_serversupplied_info **server_info)
{
- *server_info = copy_serverinfo(guest_info);
+ *server_info = copy_serverinfo(mem_ctx, guest_info);
return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
}
if (!NT_STATUS_IS_OK(nt_status)) {
TALLOC_FREE( sam_account );
if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
- make_server_info_guest(server_info);
+ make_server_info_guest(NULL, server_info);
return NT_STATUS_OK;
}
return nt_status;
result->sam_account = sam_account;
result->unix_name = talloc_strdup(result, found_username);
+ result->sanitized_username = sanitize_username(result,
+ result->unix_name);
+ if (result->sanitized_username == NULL) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
/* Fill in the unix info we found on the way */
- result->uid = uid;
- result->gid = gid;
+ result->utok.uid = uid;
+ result->utok.gid = gid;
/* Create a 'combined' list of all SIDs we might want in the SD */
return nt_status;
}
+ /* Ensure the primary group sid is at position 0. */
+ sort_sid_array_for_smbd(result, &group_sid);
+
result->login_server = talloc_strdup(result,
info3->base.logon_server.string);
sizeof(info3->base.LMSessKey.key));
}
- result->was_mapped = username_was_mapped;
+ result->nss_token |= username_was_mapped;
*server_info = result;
if (!NT_STATUS_IS_OK(nt_status)) {
TALLOC_FREE( result );
if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
- make_server_info_guest(server_info);
+ make_server_info_guest(NULL, server_info);
return NT_STATUS_OK;
}
return nt_status;
result->sam_account = sam_account;
result->unix_name = talloc_strdup(result, found_username);
+ result->sanitized_username = sanitize_username(result,
+ result->unix_name);
result->login_server = talloc_strdup(result, info->logon_server);
+ if ((result->unix_name == NULL)
+ || (result->sanitized_username == NULL)
+ || (result->login_server == NULL)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
/* Fill in the unix info we found on the way */
- result->uid = uid;
- result->gid = gid;
+ result->utok.uid = uid;
+ result->utok.gid = gid;
/* Create a 'combined' list of all SIDs we might want in the SD */
memcpy(&result->sids[i], &info->sids[i+2].sid, sizeof(result->sids[i]));
}
+ /* Ensure the primary group sid is at position 0. */
+ sort_sid_array_for_smbd(result, &group_sid);
+
/* ensure we are never given NULL session keys */
ZERO_STRUCT(zeros);
sizeof(info->lm_session_key));
}
- result->was_mapped = username_was_mapped;
+ result->nss_token |= username_was_mapped;
*server_info = result;
git.samba.org / jra / samba / .git / blobdiff