Copyright (C) Robert O'Callahan 2006
Copyright (C) Jeremy Allison 2006 (minor fixes to fit into Samba and
protect against integer wrap).
+ Copyright (C) Andrew Bartlett 2011
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
#include "includes.h"
#include "winbindd.h"
-#include "ntlmssp.h"
+#include "auth/gensec/gensec.h"
+#include "auth_generic.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_WINBIND
return False;
}
-static NTSTATUS do_ntlm_auth_with_hashes(const char *username,
- const char *domain,
- const unsigned char lm_hash[LM_HASH_LEN],
- const unsigned char nt_hash[NT_HASH_LEN],
- const DATA_BLOB initial_msg,
- const DATA_BLOB challenge_msg,
- DATA_BLOB *auth_msg)
+static NTSTATUS do_ntlm_auth_with_stored_pw(const char *username,
+ const char *domain,
+ const char *password,
+ const DATA_BLOB initial_msg,
+ const DATA_BLOB challenge_msg,
+ TALLOC_CTX *mem_ctx,
+ DATA_BLOB *auth_msg,
+ uint8_t session_key[16],
+ uint8_t *new_spnego)
{
NTSTATUS status;
- struct ntlmssp_state *ntlmssp_state = NULL;
- DATA_BLOB dummy_msg, reply;
+ struct auth_generic_state *auth_generic_state = NULL;
+ DATA_BLOB reply, session_key_blob;
- status = ntlmssp_client_start(&ntlmssp_state);
+ status = auth_generic_client_prepare(mem_ctx, &auth_generic_state);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Could not start NTLMSSP client: %s\n",
goto done;
}
- status = ntlmssp_set_username(ntlmssp_state, username);
+ status = auth_generic_set_username(auth_generic_state, username);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Could not set username: %s\n",
goto done;
}
- status = ntlmssp_set_domain(ntlmssp_state, domain);
+ status = auth_generic_set_domain(auth_generic_state, domain);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Could not set domain: %s\n",
goto done;
}
- status = ntlmssp_set_hashes(ntlmssp_state, lm_hash, nt_hash);
+ status = auth_generic_set_password(auth_generic_state, password);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Could not set hashes: %s\n",
+ DEBUG(1, ("Could not set password: %s\n",
nt_errstr(status)));
goto done;
}
- /* We need to get our protocol handler into the right state. So first
- we ask it to generate the initial message. Actually the client has already
- sent its own initial message, so we're going to drop this one on the floor.
- The client might have sent a different message, for example with different
- negotiation options, but as far as I can tell this won't hurt us. (Unless
- the client sent a different username or domain, in which case that's their
- problem for telling us the wrong username or domain.)
- Since we have a copy of the initial message that the client sent, we could
- resolve any discrepancies if we had to.
- */
- dummy_msg = data_blob_null;
+ if (initial_msg.length == 0) {
+ gensec_want_feature(auth_generic_state->gensec_security,
+ GENSEC_FEATURE_SESSION_KEY);
+ }
+
+ status = auth_generic_client_start_by_name(auth_generic_state,
+ "ntlmssp_resume_ccache");
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Could not start NTLMSSP resume mech: %s\n",
+ nt_errstr(status)));
+ goto done;
+ }
+
+ /*
+ * We inject the inital NEGOTIATE message our caller used
+ * in order to get the state machine into the correct possition.
+ */
reply = data_blob_null;
- status = ntlmssp_update(ntlmssp_state, dummy_msg, &reply);
- data_blob_free(&dummy_msg);
+ status = gensec_update(auth_generic_state->gensec_security,
+ talloc_tos(), initial_msg, &reply);
data_blob_free(&reply);
if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
}
/* Now we are ready to handle the server's actual response. */
- status = ntlmssp_update(ntlmssp_state, challenge_msg, &reply);
-
+ status = gensec_update(auth_generic_state->gensec_security,
+ mem_ctx, challenge_msg, &reply);
if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
DEBUG(1, ("We didn't get a response to the challenge! [%s]\n",
nt_errstr(status)));
data_blob_free(&reply);
goto done;
}
+
+ status = gensec_session_key(auth_generic_state->gensec_security,
+ talloc_tos(), &session_key_blob);
+ if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
+ DEBUG(1, ("We didn't get the session key we requested! [%s]\n",
+ nt_errstr(status)));
+ data_blob_free(&reply);
+ goto done;
+ }
+
+ if (session_key_blob.length != 16) {
+ DEBUG(1, ("invalid session key length %d\n",
+ (int)session_key_blob.length));
+ data_blob_free(&reply);
+ goto done;
+ }
+ memcpy(session_key, session_key_blob.data, 16);
+ data_blob_free(&session_key_blob);
*auth_msg = reply;
+ *new_spnego = gensec_have_feature(auth_generic_state->gensec_security,
+ GENSEC_FEATURE_NEW_SPNEGO);
status = NT_STATUS_OK;
done:
- ntlmssp_end(&ntlmssp_state);
+ TALLOC_FREE(auth_generic_state);
return status;
}
{
int ret;
uid_t ret_uid;
+ gid_t ret_gid;
ret_uid = (uid_t)-1;
- ret = sys_getpeereid(state->sock, &ret_uid);
+ ret = getpeereid(state->sock, &ret_uid, &ret_gid);
if (ret != 0) {
DEBUG(1, ("check_client_uid: Could not get socket peer uid: %s; "
"denying access\n", strerror(errno)));
return False;
}
- if (uid != ret_uid) {
+ if (uid != ret_uid && ret_uid != sec_initial_uid()) {
DEBUG(1, ("check_client_uid: Client lied about its uid: said %u, "
"actually was %u; denying access\n",
(unsigned int)uid, (unsigned int)ret_uid));
{
struct winbindd_domain *domain;
fstring name_domain, name_user;
+ NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
+ struct WINBINDD_MEMORY_CREDS *entry;
+ DATA_BLOB initial, challenge, auth;
+ uint32_t initial_blob_len, challenge_blob_len, extra_len;
/* Ensure null termination */
state->request->data.ccache_ntlm_auth.user[
return;
}
- sendto_domain(state, domain);
-}
-
-enum winbindd_result winbindd_dual_ccache_ntlm_auth(struct winbindd_domain *domain,
- struct winbindd_cli_state *state)
-{
- NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
- struct WINBINDD_MEMORY_CREDS *entry;
- DATA_BLOB initial, challenge, auth;
- fstring name_domain, name_user;
- uint32 initial_blob_len, challenge_blob_len, extra_len;
-
- /* Ensure null termination */
- state->request->data.ccache_ntlm_auth.user[
- sizeof(state->request->data.ccache_ntlm_auth.user)-1]='\0';
-
- DEBUG(3, ("winbindd_dual_ccache_ntlm_auth: [%5lu]: perform NTLM auth on "
- "behalf of user %s (dual)\n", (unsigned long)state->pid,
- state->request->data.ccache_ntlm_auth.user));
-
/* validate blob lengths */
initial_blob_len = state->request->data.ccache_ntlm_auth.initial_blob_len;
challenge_blob_len = state->request->data.ccache_ntlm_auth.challenge_blob_len;
state->request->extra_data.data + initial_blob_len,
state->request->data.ccache_ntlm_auth.challenge_blob_len);
- result = do_ntlm_auth_with_hashes(name_user, name_domain,
- entry->lm_hash, entry->nt_hash,
- initial, challenge, &auth);
+ result = do_ntlm_auth_with_stored_pw(
+ name_user, name_domain, entry->pass,
+ initial, challenge, talloc_tos(), &auth,
+ state->response->data.ccache_ntlm_auth.session_key,
+ &state->response->data.ccache_ntlm_auth.new_spnego);
+
if (!NT_STATUS_IS_OK(result)) {
goto process_result;
}
data_blob_free(&auth);
process_result:
- return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
+ if (!NT_STATUS_IS_OK(result)) {
+ request_error(state);
+ return;
+ }
+ request_ok(state);
+}
+
+void winbindd_ccache_save(struct winbindd_cli_state *state)
+{
+ struct winbindd_domain *domain;
+ fstring name_domain, name_user;
+ NTSTATUS status;
+
+ /* Ensure null termination */
+ state->request->data.ccache_save.user[
+ sizeof(state->request->data.ccache_save.user)-1]='\0';
+ state->request->data.ccache_save.pass[
+ sizeof(state->request->data.ccache_save.pass)-1]='\0';
+
+ DEBUG(3, ("[%5lu]: save password of user %s\n",
+ (unsigned long)state->pid,
+ state->request->data.ccache_save.user));
+
+ /* Parse domain and username */
+
+ if (!canonicalize_username(state->request->data.ccache_save.user,
+ name_domain, name_user)) {
+ DEBUG(5,("winbindd_ccache_save: cannot parse domain and user "
+ "from name [%s]\n",
+ state->request->data.ccache_save.user));
+ request_error(state);
+ return;
+ }
+
+ /*
+ * The domain is checked here only for compatibility
+ * reasons. We used to do the winbindd memory ccache for
+ * ntlm_auth in the domain child. With that code, we had to
+ * make sure that we do have a domain around to send this
+ * to. Now we do the memory cache in the parent winbindd,
+ * where it would not matter if we have a domain or not.
+ */
+
+ domain = find_auth_domain(state->request->flags, name_domain);
+ if (domain == NULL) {
+ DEBUG(5, ("winbindd_ccache_save: can't get domain [%s]\n",
+ name_domain));
+ request_error(state);
+ return;
+ }
+
+ if (!check_client_uid(state, state->request->data.ccache_save.uid)) {
+ request_error(state);
+ return;
+ }
+
+ status = winbindd_add_memory_creds(
+ state->request->data.ccache_save.user,
+ state->request->data.ccache_save.uid,
+ state->request->data.ccache_save.pass);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("winbindd_add_memory_creds failed %s\n",
+ nt_errstr(status)));
+ request_error(state);
+ return;
+ }
+ request_ok(state);
}