source4/auth/auth_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6    Copyright (C) Jeremy Allison 2000-2001
   7    Copyright (C) Rafal Szczesniak 2002
   8    Copyright (C) Stefan Metzmacher 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth/auth.h"
  26 #include "libcli/security/security.h"
  27 #include "libcli/auth/libcli_auth.h"
  28 #include "dsdb/samdb/samdb.h"
  29 #include "auth/credentials/credentials.h"
  30 #include "param/param.h"
  31
  32 /* this default function can be used by mostly all backends
  33  * which don't want to set a challenge
  34  */
  35 NTSTATUS auth_get_challenge_not_implemented(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *challenge)
  36 {
  37         /* we don't want to set a challenge */
  38         return NT_STATUS_NOT_IMPLEMENTED;
  39 }
  40
  41 /****************************************************************************
  42  Create an auth_usersupplied_data structure after appropriate mapping.
  43 ****************************************************************************/
  44
  45 NTSTATUS map_user_info(TALLOC_CTX *mem_ctx,
  46                        const struct auth_usersupplied_info *user_info,
  47                        struct auth_usersupplied_info **user_info_mapped)
  48 {
  49         const char *domain;
  50         char *account_name;
  51         char *d;
  52         DEBUG(5,("map_user_info: Mapping user [%s]\\[%s] from workstation [%s]\n",
  53                 user_info->client.domain_name, user_info->client.account_name, user_info->workstation_name));
  54
  55         account_name = talloc_strdup(mem_ctx, user_info->client.account_name);
  56         if (!account_name) {
  57                 return NT_STATUS_NO_MEMORY;
  58         }
  59
  60         /* don't allow "" as a domain, fixes a Win9X bug
  61            where it doens't supply a domain for logon script
  62            'net use' commands.                                 */
  63
  64         /* Split user@realm names into user and realm components.  This is TODO to fix with proper userprincipalname support */
  65         if (user_info->client.domain_name && *user_info->client.domain_name) {
  66                 domain = user_info->client.domain_name;
  67         } else if (strchr_m(user_info->client.account_name, '@')) {
  68                 d = strchr_m(account_name, '@');
  69                 if (!d) {
  70                         return NT_STATUS_INTERNAL_ERROR;
  71                 }
  72                 d[0] = '\0';
  73                 d++;
  74                 domain = d;
  75         } else {
  76                 domain = lp_workgroup();
  77         }
  78
  79         *user_info_mapped = talloc(mem_ctx, struct auth_usersupplied_info);
  80         if (!*user_info_mapped) {
  81                 return NT_STATUS_NO_MEMORY;
  82         }
  83         talloc_reference(*user_info_mapped, user_info);
  84         **user_info_mapped = *user_info;
  85         (*user_info_mapped)->mapped_state = True;
  86         (*user_info_mapped)->mapped.domain_name = talloc_strdup(*user_info_mapped, domain);
  87         (*user_info_mapped)->mapped.account_name = talloc_strdup(*user_info_mapped, account_name);
  88         talloc_free(account_name);
  89         if (!(*user_info_mapped)->mapped.domain_name
  90             || !(*user_info_mapped)->mapped.account_name) {
  91                 return NT_STATUS_NO_MEMORY;
  92         }
  93
  94         return NT_STATUS_OK;
  95 }
  96
  97 /****************************************************************************
  98  Create an auth_usersupplied_data structure after appropriate mapping.
  99 ****************************************************************************/
 100
 101  NTSTATUS encrypt_user_info(TALLOC_CTX *mem_ctx, struct auth_context *auth_context,
 102                            enum auth_password_state to_state,
 103                            const struct auth_usersupplied_info *user_info_in,
 104                            const struct auth_usersupplied_info **user_info_encrypted)
 105 {
 106         NTSTATUS nt_status;
 107         struct auth_usersupplied_info *user_info_temp;
 108         switch (to_state) {
 109         case AUTH_PASSWORD_RESPONSE:
 110                 switch (user_info_in->password_state) {
 111                 case AUTH_PASSWORD_PLAIN:
 112                 {
 113                         const struct auth_usersupplied_info *user_info_temp2;
 114                         nt_status = encrypt_user_info(mem_ctx, auth_context,
 115                                                       AUTH_PASSWORD_HASH,
 116                                                       user_info_in, &user_info_temp2);
 117                         if (!NT_STATUS_IS_OK(nt_status)) {
 118                                 return nt_status;
 119                         }
 120                         user_info_in = user_info_temp2;
 121                         /* fall through */
 122                 }
 123                 case AUTH_PASSWORD_HASH:
 124                 {
 125                         const uint8_t *challenge;
 126                         DATA_BLOB chall_blob;
 127                         user_info_temp = talloc(mem_ctx, struct auth_usersupplied_info);
 128                         if (!user_info_temp) {
 129                                 return NT_STATUS_NO_MEMORY;
 130                         }
 131                         talloc_reference(user_info_temp, user_info_in);
 132                         *user_info_temp = *user_info_in;
 133                         user_info_temp->mapped_state = to_state;
 134
 135                         nt_status = auth_get_challenge(auth_context, &challenge);
 136                         if (!NT_STATUS_IS_OK(nt_status)) {
 137                                 return nt_status;
 138                         }
 139
 140                         chall_blob = data_blob_talloc(mem_ctx, challenge, 8);
 141                         if (lp_client_ntlmv2_auth()) {
 142                                 DATA_BLOB names_blob = NTLMv2_generate_names_blob(mem_ctx, lp_netbios_name(), lp_workgroup());
 143                                 DATA_BLOB lmv2_response, ntlmv2_response, lmv2_session_key, ntlmv2_session_key;
 144
 145                                 if (!SMBNTLMv2encrypt_hash(user_info_temp,
 146                                                            user_info_in->client.account_name,
 147                                                            user_info_in->client.domain_name,
 148                                                            user_info_in->password.hash.nt->hash, &chall_blob,
 149                                                            &names_blob,
 150                                                            &lmv2_response, &ntlmv2_response,
 151                                                            &lmv2_session_key, &ntlmv2_session_key)) {
 152                                         data_blob_free(&names_blob);
 153                                         return NT_STATUS_NO_MEMORY;
 154                                 }
 155                                 data_blob_free(&names_blob);
 156                                 user_info_temp->password.response.lanman = lmv2_response;
 157                                 user_info_temp->password.response.nt = ntlmv2_response;
 158
 159                                 data_blob_free(&lmv2_session_key);
 160                                 data_blob_free(&ntlmv2_session_key);
 161                         } else {
 162                                 DATA_BLOB blob = data_blob_talloc(mem_ctx, NULL, 24);
 163                                 SMBOWFencrypt(user_info_in->password.hash.nt->hash, challenge, blob.data);
 164
 165                                 user_info_temp->password.response.nt = blob;
 166                                 if (lp_client_lanman_auth() && user_info_in->password.hash.lanman) {
 167                                         DATA_BLOB lm_blob = data_blob_talloc(mem_ctx, NULL, 24);
 168                                         SMBOWFencrypt(user_info_in->password.hash.lanman->hash, challenge, blob.data);
 169                                         user_info_temp->password.response.lanman = lm_blob;
 170                                 } else {
 171                                         /* if not sending the LM password, send the NT password twice */
 172                                         user_info_temp->password.response.lanman = user_info_temp->password.response.nt;
 173                                 }
 174                         }
 175
 176                         user_info_in = user_info_temp;
 177                         /* fall through */
 178                 }
 179                 case AUTH_PASSWORD_RESPONSE:
 180                         *user_info_encrypted = user_info_in;
 181                 }
 182                 break;
 183         case AUTH_PASSWORD_HASH:
 184         {
 185                 switch (user_info_in->password_state) {
 186                 case AUTH_PASSWORD_PLAIN:
 187                 {
 188                         struct samr_Password lanman;
 189                         struct samr_Password nt;
 190
 191                         user_info_temp = talloc(mem_ctx, struct auth_usersupplied_info);
 192                         if (!user_info_temp) {
 193                                 return NT_STATUS_NO_MEMORY;
 194                         }
 195                         talloc_reference(user_info_temp, user_info_in);
 196                         *user_info_temp = *user_info_in;
 197                         user_info_temp->mapped_state = to_state;
 198
 199                         if (E_deshash(user_info_in->password.plaintext, lanman.hash)) {
 200                                 user_info_temp->password.hash.lanman = talloc(user_info_temp,
 201                                                                               struct samr_Password);
 202                                 *user_info_temp->password.hash.lanman = lanman;
 203                         } else {
 204                                 user_info_temp->password.hash.lanman = NULL;
 205                         }
 206
 207                         E_md4hash(user_info_in->password.plaintext, nt.hash);
 208                         user_info_temp->password.hash.nt = talloc(user_info_temp,
 209                                                                    struct samr_Password);
 210                         *user_info_temp->password.hash.nt = nt;
 211
 212                         user_info_in = user_info_temp;
 213                         /* fall through */
 214                 }
 215                 case AUTH_PASSWORD_HASH:
 216                         *user_info_encrypted = user_info_in;
 217                         break;
 218                 default:
 219                         return NT_STATUS_INVALID_PARAMETER;
 220                         break;
 221                 }
 222                 break;
 223         }
 224         default:
 225                 return NT_STATUS_INVALID_PARAMETER;
 226         }
 227
 228         return NT_STATUS_OK;
 229 }
 230
 231 /***************************************************************************
 232  Make a server_info struct from the info3 returned by a domain logon
 233 ***************************************************************************/
 234 NTSTATUS make_server_info_netlogon_validation(TALLOC_CTX *mem_ctx,
 235                                               const char *account_name,
 236                                               uint16_t validation_level,
 237                                               union netr_Validation *validation,
 238                                               struct auth_serversupplied_info **_server_info)
 239 {
 240         struct auth_serversupplied_info *server_info;
 241         struct netr_SamBaseInfo *base = NULL;
 242         int i;
 243
 244         switch (validation_level) {
 245         case 2:
 246                 if (!validation || !validation->sam2) {
 247                         return NT_STATUS_INVALID_PARAMETER;
 248                 }
 249                 base = &validation->sam2->base;
 250                 break;
 251         case 3:
 252                 if (!validation || !validation->sam3) {
 253                         return NT_STATUS_INVALID_PARAMETER;
 254                 }
 255                 base = &validation->sam3->base;
 256                 break;
 257         case 6:
 258                 if (!validation || !validation->sam6) {
 259                         return NT_STATUS_INVALID_PARAMETER;
 260                 }
 261                 base = &validation->sam6->base;
 262                 break;
 263         default:
 264                 return NT_STATUS_INVALID_LEVEL;
 265         }
 266
 267         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 268         NT_STATUS_HAVE_NO_MEMORY(server_info);
 269
 270         /*
 271            Here is where we should check the list of
 272            trusted domains, and verify that the SID
 273            matches.
 274         */
 275         server_info->account_sid = dom_sid_add_rid(server_info, base->domain_sid, base->rid);
 276         NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
 277
 278
 279         server_info->primary_group_sid = dom_sid_add_rid(server_info, base->domain_sid, base->primary_gid);
 280         NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
 281
 282         server_info->n_domain_groups = base->groups.count;
 283         if (base->groups.count) {
 284                 server_info->domain_groups = talloc_array(server_info, struct dom_sid*, base->groups.count);
 285                 NT_STATUS_HAVE_NO_MEMORY(server_info->domain_groups);
 286         } else {
 287                 server_info->domain_groups = NULL;
 288         }
 289
 290         for (i = 0; i < base->groups.count; i++) {
 291                 server_info->domain_groups[i] = dom_sid_add_rid(server_info, base->domain_sid, base->groups.rids[i].rid);
 292                 NT_STATUS_HAVE_NO_MEMORY(server_info->domain_groups[i]);
 293         }
 294
 295         /* Copy 'other' sids.  We need to do sid filtering here to
 296            prevent possible elevation of privileges.  See:
 297
 298            http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
 299          */
 300
 301         if (validation_level == 3) {
 302                 struct dom_sid **dgrps = server_info->domain_groups;
 303                 size_t sidcount = server_info->n_domain_groups + validation->sam3->sidcount;
 304                 size_t n_dgrps = server_info->n_domain_groups;
 305
 306                 if (validation->sam3->sidcount > 0) {
 307                         dgrps = talloc_realloc(server_info, dgrps, struct dom_sid*, sidcount);
 308                         NT_STATUS_HAVE_NO_MEMORY(dgrps);
 309
 310                         for (i = 0; i < validation->sam3->sidcount; i++) {
 311                                 dgrps[n_dgrps + i] = talloc_reference(dgrps, validation->sam3->sids[i].sid);
 312                         }
 313                 }
 314
 315                 server_info->n_domain_groups = sidcount;
 316                 server_info->domain_groups = dgrps;
 317
 318                 /* Where are the 'global' sids?... */
 319         }
 320
 321         if (base->account_name.string) {
 322                 server_info->account_name = talloc_reference(server_info, base->account_name.string);
 323         } else {
 324                 server_info->account_name = talloc_strdup(server_info, account_name);
 325                 NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 326         }
 327
 328         server_info->domain_name = talloc_reference(server_info, base->domain.string);
 329         server_info->full_name = talloc_reference(server_info, base->full_name.string);
 330         server_info->logon_script = talloc_reference(server_info, base->logon_script.string);
 331         server_info->profile_path = talloc_reference(server_info, base->profile_path.string);
 332         server_info->home_directory = talloc_reference(server_info, base->home_directory.string);
 333         server_info->home_drive = talloc_reference(server_info, base->home_drive.string);
 334         server_info->logon_server = talloc_reference(server_info, base->logon_server.string);
 335         server_info->last_logon = base->last_logon;
 336         server_info->last_logoff = base->last_logoff;
 337         server_info->acct_expiry = base->acct_expiry;
 338         server_info->last_password_change = base->last_password_change;
 339         server_info->allow_password_change = base->allow_password_change;
 340         server_info->force_password_change = base->force_password_change;
 341         server_info->logon_count = base->logon_count;
 342         server_info->bad_password_count = base->bad_password_count;
 343         server_info->acct_flags = base->acct_flags;
 344
 345         server_info->authenticated = True;
 346
 347         /* ensure we are never given NULL session keys */
 348
 349         if (all_zero(base->key.key, sizeof(base->key.key))) {
 350                 server_info->user_session_key = data_blob(NULL, 0);
 351         } else {
 352                 server_info->user_session_key = data_blob_talloc(server_info, base->key.key, sizeof(base->key.key));
 353                 NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 354         }
 355
 356         if (all_zero(base->LMSessKey.key, sizeof(base->LMSessKey.key))) {
 357                 server_info->lm_session_key = data_blob(NULL, 0);
 358         } else {
 359                 server_info->lm_session_key = data_blob_talloc(server_info, base->LMSessKey.key, sizeof(base->LMSessKey.key));
 360                 NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 361         }
 362
 363         *_server_info = server_info;
 364         return NT_STATUS_OK;
 365 }
 366
 367
 368 NTSTATUS auth_anonymous_server_info(TALLOC_CTX *mem_ctx, struct auth_serversupplied_info **_server_info)
 369 {
 370         struct auth_serversupplied_info *server_info;
 371         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 372         NT_STATUS_HAVE_NO_MEMORY(server_info);
 373
 374         server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_ANONYMOUS);
 375         NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
 376
 377         /* is this correct? */
 378         server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_GUESTS);
 379         NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
 380
 381         server_info->n_domain_groups = 0;
 382         server_info->domain_groups = NULL;
 383
 384         /* annoying, but the Anonymous really does have a session key,
 385            and it is all zeros! */
 386         server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
 387         NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 388
 389         server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
 390         NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 391
 392         data_blob_clear(&server_info->user_session_key);
 393         data_blob_clear(&server_info->lm_session_key);
 394
 395         server_info->account_name = talloc_strdup(server_info, "ANONYMOUS LOGON");
 396         NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 397
 398         server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
 399         NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
 400
 401         server_info->full_name = talloc_strdup(server_info, "Anonymous Logon");
 402         NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
 403
 404         server_info->logon_script = talloc_strdup(server_info, "");
 405         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
 406
 407         server_info->profile_path = talloc_strdup(server_info, "");
 408         NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
 409
 410         server_info->home_directory = talloc_strdup(server_info, "");
 411         NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
 412
 413         server_info->home_drive = talloc_strdup(server_info, "");
 414         NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
 415
 416         server_info->logon_server = talloc_strdup(server_info, lp_netbios_name());
 417         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
 418
 419         server_info->last_logon = 0;
 420         server_info->last_logoff = 0;
 421         server_info->acct_expiry = 0;
 422         server_info->last_password_change = 0;
 423         server_info->allow_password_change = 0;
 424         server_info->force_password_change = 0;
 425
 426         server_info->logon_count = 0;
 427         server_info->bad_password_count = 0;
 428
 429         server_info->acct_flags = ACB_NORMAL;
 430
 431         server_info->authenticated = False;
 432
 433         *_server_info = server_info;
 434
 435         return NT_STATUS_OK;
 436 }
 437
 438 NTSTATUS auth_system_server_info(TALLOC_CTX *mem_ctx, struct auth_serversupplied_info **_server_info)
 439 {
 440         struct auth_serversupplied_info *server_info;
 441         server_info = talloc(mem_ctx, struct auth_serversupplied_info);
 442         NT_STATUS_HAVE_NO_MEMORY(server_info);
 443
 444         server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_SYSTEM);
 445         NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
 446
 447         /* is this correct? */
 448         server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_ADMINISTRATORS);
 449         NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
 450
 451         server_info->n_domain_groups = 0;
 452         server_info->domain_groups = NULL;
 453
 454         /* annoying, but the Anonymous really does have a session key,
 455            and it is all zeros! */
 456         server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
 457         NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
 458
 459         server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
 460         NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
 461
 462         data_blob_clear(&server_info->user_session_key);
 463         data_blob_clear(&server_info->lm_session_key);
 464
 465         server_info->account_name = talloc_strdup(server_info, "SYSTEM");
 466         NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
 467
 468         server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
 469         NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
 470
 471         server_info->full_name = talloc_strdup(server_info, "System");
 472         NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
 473
 474         server_info->logon_script = talloc_strdup(server_info, "");
 475         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
 476
 477         server_info->profile_path = talloc_strdup(server_info, "");
 478         NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
 479
 480         server_info->home_directory = talloc_strdup(server_info, "");
 481         NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
 482
 483         server_info->home_drive = talloc_strdup(server_info, "");
 484         NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
 485
 486         server_info->logon_server = talloc_strdup(server_info, lp_netbios_name());
 487         NT_STATUS_HAVE_NO_MEMORY(server_info->logon_server);
 488
 489         server_info->last_logon = 0;
 490         server_info->last_logoff = 0;
 491         server_info->acct_expiry = 0;
 492         server_info->last_password_change = 0;
 493         server_info->allow_password_change = 0;
 494         server_info->force_password_change = 0;
 495
 496         server_info->logon_count = 0;
 497         server_info->bad_password_count = 0;
 498
 499         server_info->acct_flags = ACB_NORMAL;
 500
 501         server_info->authenticated = True;
 502
 503         *_server_info = server_info;
 504
 505         return NT_STATUS_OK;
 506 }
 507
 508 NTSTATUS auth_generate_session_info(TALLOC_CTX *mem_ctx,
 509                                     struct auth_serversupplied_info *server_info,
 510                                     struct auth_session_info **_session_info)
 511 {
 512         struct auth_session_info *session_info;
 513         NTSTATUS nt_status;
 514
 515         session_info = talloc(mem_ctx, struct auth_session_info);
 516         NT_STATUS_HAVE_NO_MEMORY(session_info);
 517
 518         session_info->server_info = talloc_reference(session_info, server_info);
 519
 520         /* unless set otherwise, the session key is the user session
 521          * key from the auth subsystem */
 522         session_info->session_key = server_info->user_session_key;
 523
 524         nt_status = security_token_create(session_info,
 525                                           server_info->account_sid,
 526                                           server_info->primary_group_sid,
 527                                           server_info->n_domain_groups,
 528                                           server_info->domain_groups,
 529                                           server_info->authenticated,
 530                                           &session_info->security_token);
 531         NT_STATUS_NOT_OK_RETURN(nt_status);
 532
 533         session_info->credentials = NULL;
 534
 535         *_session_info = session_info;
 536         return NT_STATUS_OK;
 537 }
 538
 539 NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
 540                                      struct auth_session_info **_session_info)
 541 {
 542         NTSTATUS nt_status;
 543         struct auth_serversupplied_info *server_info = NULL;
 544         struct auth_session_info *session_info = NULL;
 545         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 546
 547         nt_status = auth_anonymous_server_info(mem_ctx,
 548                                                &server_info);
 549         if (!NT_STATUS_IS_OK(nt_status)) {
 550                 talloc_free(mem_ctx);
 551                 return nt_status;
 552         }
 553
 554         /* references the server_info into the session_info */
 555         nt_status = auth_generate_session_info(parent_ctx, server_info, &session_info);
 556         talloc_free(mem_ctx);
 557
 558         NT_STATUS_NOT_OK_RETURN(nt_status);
 559
 560         session_info->credentials = cli_credentials_init(session_info);
 561         if (!session_info->credentials) {
 562                 return NT_STATUS_NO_MEMORY;
 563         }
 564
 565         cli_credentials_set_conf(session_info->credentials);
 566         cli_credentials_set_anonymous(session_info->credentials);
 567
 568         *_session_info = session_info;
 569
 570         return NT_STATUS_OK;
 571 }
 572
 573 struct auth_session_info *anonymous_session(TALLOC_CTX *mem_ctx)
 574 {
 575         NTSTATUS nt_status;
 576         struct auth_session_info *session_info = NULL;
 577         nt_status = auth_anonymous_session_info(mem_ctx, &session_info);
 578         if (!NT_STATUS_IS_OK(nt_status)) {
 579                 return NULL;
 580         }
 581         return session_info;
 582 }
 583
 584 static NTSTATUS _auth_system_session_info(TALLOC_CTX *parent_ctx,
 585                                           BOOL anonymous_credentials,
 586                                           struct auth_session_info **_session_info)
 587 {
 588         NTSTATUS nt_status;
 589         struct auth_serversupplied_info *server_info = NULL;
 590         struct auth_session_info *session_info = NULL;
 591         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 592
 593         nt_status = auth_system_server_info(mem_ctx,
 594                                             &server_info);
 595         if (!NT_STATUS_IS_OK(nt_status)) {
 596                 talloc_free(mem_ctx);
 597                 return nt_status;
 598         }
 599
 600         /* references the server_info into the session_info */
 601         nt_status = auth_generate_session_info(parent_ctx, server_info, &session_info);
 602         talloc_free(mem_ctx);
 603
 604         NT_STATUS_NOT_OK_RETURN(nt_status);
 605
 606         session_info->credentials = cli_credentials_init(session_info);
 607         if (!session_info->credentials) {
 608                 return NT_STATUS_NO_MEMORY;
 609         }
 610
 611         cli_credentials_set_conf(session_info->credentials);
 612
 613         if (anonymous_credentials) {
 614                 cli_credentials_set_anonymous(session_info->credentials);
 615         } else {
 616                 cli_credentials_set_machine_account_pending(session_info->credentials);
 617         }
 618         *_session_info = session_info;
 619
 620         return NT_STATUS_OK;
 621 }
 622
 623 _PUBLIC_ NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
 624                                            struct auth_session_info **_session_info)
 625 {
 626         return _auth_system_session_info(parent_ctx, lp_parm_bool(-1,"system","anonymous", False),
 627                                          _session_info);
 628 }
 629
 630 /*
 631   Create a system session, with machine account credentials
 632 */
 633 _PUBLIC_ struct auth_session_info *system_session(TALLOC_CTX *mem_ctx)
 634 {
 635         NTSTATUS nt_status;
 636         struct auth_session_info *session_info = NULL;
 637         nt_status = auth_system_session_info(mem_ctx,
 638                                              &session_info);
 639         if (!NT_STATUS_IS_OK(nt_status)) {
 640                 return NULL;
 641         }
 642         return session_info;
 643 }
 644
 645 /*
 646   Create a system session, but with anonymous credentials (so we do not need to open secrets.ldb)
 647 */
 648 _PUBLIC_ struct auth_session_info *system_session_anon(TALLOC_CTX *mem_ctx)
 649 {
 650         NTSTATUS nt_status;
 651         struct auth_session_info *session_info = NULL;
 652         nt_status = _auth_system_session_info(mem_ctx, False, &session_info);
 653         if (!NT_STATUS_IS_OK(nt_status)) {
 654                 return NULL;
 655         }
 656         return session_info;
 657 }
 658
 659 /****************************************************************************
 660  prints a struct auth_session_info security token to debug output.
 661 ****************************************************************************/
 662 void auth_session_info_debug(int dbg_lev,
 663                              const struct auth_session_info *session_info)
 664 {
 665         if (!session_info) {
 666                 DEBUG(dbg_lev, ("Session Info: (NULL)\n"));
 667                 return;
 668         }
 669
 670         security_token_debug(dbg_lev, session_info->security_token);
 671 }
 672
 673 /**
 674  * Squash an NT_STATUS in line with security requirements.
 675  * In an attempt to avoid giving the whole game away when users
 676  * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
 677  * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
 678  * (session setups in particular).
 679  *
 680  * @param nt_status NTSTATUS input for squashing.
 681  * @return the 'squashed' nt_status
 682  **/
 683 NTSTATUS auth_nt_status_squash(NTSTATUS nt_status)
 684 {
 685         if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
 686                 /* Match WinXP and don't give the game away */
 687                 return NT_STATUS_LOGON_FAILURE;
 688         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
 689                 /* Match WinXP and don't give the game away */
 690                 return NT_STATUS_LOGON_FAILURE;
 691         }
 692
 693         return nt_status;
 694 }