source3/auth/auth_generic.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle GENSEC authentication, server side
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett 2001-2003,2011
   8    Copyright (C) Simo Sorce 2010.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "auth/gensec/gensec.h"
  28 #include "lib/param/param.h"
  29 #ifdef HAVE_KRB5
  30 #include "auth/kerberos/pac_utils.h"
  31 #endif
  32 #include "librpc/crypto/gse.h"
  33 #include "auth/credentials/credentials.h"
  34 #include "lib/param/loadparm.h"
  35
  36 static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx,
  37                                                 TALLOC_CTX *mem_ctx,
  38                                                 struct smb_krb5_context *smb_krb5_context,
  39                                                 DATA_BLOB *pac_blob,
  40                                                 const char *princ_name,
  41                                                 const struct tsocket_address *remote_address,
  42                                                 uint32_t session_info_flags,
  43                                                 struct auth_session_info **session_info)
  44 {
  45         TALLOC_CTX *tmp_ctx;
  46         struct PAC_LOGON_INFO *logon_info = NULL;
  47         bool is_mapped;
  48         bool is_guest;
  49         char *ntuser;
  50         char *ntdomain;
  51         char *username;
  52         char *rhost;
  53         struct passwd *pw;
  54         NTSTATUS status;
  55         int rc;
  56
  57         tmp_ctx = talloc_new(mem_ctx);
  58         if (!tmp_ctx) {
  59                 return NT_STATUS_NO_MEMORY;
  60         }
  61
  62         if (pac_blob) {
  63 #ifdef HAVE_KRB5
  64                 status = kerberos_pac_logon_info(tmp_ctx, *pac_blob, NULL, NULL,
  65                                                  NULL, NULL, 0, &logon_info);
  66 #else
  67                 status = NT_STATUS_ACCESS_DENIED;
  68 #endif
  69                 if (!NT_STATUS_IS_OK(status)) {
  70                         goto done;
  71                 }
  72         }
  73
  74         rc = get_remote_hostname(remote_address,
  75                                  &rhost,
  76                                  tmp_ctx);
  77         if (rc < 0) {
  78                 status = NT_STATUS_NO_MEMORY;
  79                 goto done;
  80         }
  81         if (strequal(rhost, "UNKNOWN")) {
  82                 rhost = tsocket_address_inet_addr_string(remote_address,
  83                                                          tmp_ctx);
  84                 if (rhost == NULL) {
  85                         status = NT_STATUS_NO_MEMORY;
  86                         goto done;
  87                 }
  88         }
  89
  90         status = get_user_from_kerberos_info(tmp_ctx, rhost,
  91                                              princ_name, logon_info,
  92                                              &is_mapped, &is_guest,
  93                                              &ntuser, &ntdomain,
  94                                              &username, &pw);
  95         if (!NT_STATUS_IS_OK(status)) {
  96                 DEBUG(1, ("Failed to map kerberos principal to system user "
  97                           "(%s)\n", nt_errstr(status)));
  98                 status = NT_STATUS_ACCESS_DENIED;
  99                 goto done;
 100         }
 101
 102         /* save the PAC data if we have it */
 103         if (logon_info) {
 104                 netsamlogon_cache_store(ntuser, &logon_info->info3);
 105         }
 106
 107         /* setup the string used by %U */
 108         sub_set_smb_name(username);
 109
 110         /* reload services so that the new %U is taken into account */
 111         lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
 112
 113         status = make_session_info_krb5(mem_ctx,
 114                                         ntuser, ntdomain, username, pw,
 115                                         logon_info, is_guest, is_mapped, NULL /* No session key for now, caller will sort it out */,
 116                                         session_info);
 117         if (!NT_STATUS_IS_OK(status)) {
 118                 DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
 119                           nt_errstr(status)));
 120                 status = NT_STATUS_ACCESS_DENIED;
 121                 goto done;
 122         }
 123
 124         DEBUG(5, (__location__ "OK: user: %s domain: %s client: %s\n",
 125                   ntuser, ntdomain, rhost));
 126
 127         status = NT_STATUS_OK;
 128
 129 done:
 130         TALLOC_FREE(tmp_ctx);
 131         return status;
 132 }
 133
 134 static struct auth4_context *make_auth4_context_s3(TALLOC_CTX *mem_ctx, struct auth_context *auth_context)
 135 {
 136         struct auth4_context *auth4_context = talloc_zero(mem_ctx, struct auth4_context);
 137         if (auth4_context == NULL) {
 138                 DEBUG(10, ("failed to allocate auth4_context failed\n"));
 139                 return NULL;
 140         }
 141         auth4_context->generate_session_info_pac = auth3_generate_session_info_pac;
 142         auth4_context->generate_session_info = auth3_generate_session_info;
 143         auth4_context->get_ntlm_challenge = auth3_get_challenge;
 144         auth4_context->set_ntlm_challenge = auth3_set_challenge;
 145         auth4_context->check_ntlm_password = auth3_check_password;
 146         auth4_context->private_data = talloc_steal(auth4_context, auth_context);
 147         return auth4_context;
 148 }
 149
 150 NTSTATUS make_auth4_context(TALLOC_CTX *mem_ctx, struct auth4_context **auth4_context_out)
 151 {
 152         struct auth_context *auth_context;
 153         NTSTATUS nt_status;
 154
 155         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 156         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 157
 158         nt_status = make_auth_context_subsystem(tmp_ctx, &auth_context);
 159         if (!NT_STATUS_IS_OK(nt_status)) {
 160                 TALLOC_FREE(tmp_ctx);
 161                 return nt_status;
 162         }
 163
 164         if (auth_context->make_auth4_context) {
 165                 nt_status = auth_context->make_auth4_context(mem_ctx, auth4_context_out);
 166                 TALLOC_FREE(tmp_ctx);
 167                 return nt_status;
 168
 169         } else {
 170                 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
 171                 if (auth4_context == NULL) {
 172                         TALLOC_FREE(tmp_ctx);
 173                         return NT_STATUS_NO_MEMORY;
 174                 }
 175                 *auth4_context_out = talloc_steal(mem_ctx, auth4_context);
 176                 TALLOC_FREE(tmp_ctx);
 177                 return NT_STATUS_OK;
 178         }
 179 }
 180
 181 NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
 182                               const struct tsocket_address *remote_address,
 183                               struct gensec_security **gensec_security_out)
 184 {
 185         struct gensec_security *gensec_security;
 186         struct auth_context *auth_context;
 187         NTSTATUS nt_status;
 188
 189         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 190         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 191
 192         nt_status = make_auth_context_subsystem(tmp_ctx, &auth_context);
 193         if (!NT_STATUS_IS_OK(nt_status)) {
 194                 TALLOC_FREE(tmp_ctx);
 195                 return nt_status;
 196         }
 197
 198         if (auth_context->prepare_gensec) {
 199                 nt_status = auth_context->prepare_gensec(tmp_ctx,
 200                                                          &gensec_security);
 201                 if (!NT_STATUS_IS_OK(nt_status)) {
 202                         TALLOC_FREE(tmp_ctx);
 203                         return nt_status;
 204                 }
 205         } else {
 206                 struct gensec_settings *gensec_settings;
 207                 struct loadparm_context *lp_ctx;
 208                 size_t idx = 0;
 209                 struct cli_credentials *server_credentials;
 210                 const char *dns_name;
 211                 const char *dns_domain;
 212                 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
 213                 if (auth4_context == NULL) {
 214                         TALLOC_FREE(tmp_ctx);
 215                         return NT_STATUS_NO_MEMORY;
 216                 }
 217
 218                 lp_ctx = loadparm_init_s3(tmp_ctx, loadparm_s3_helpers());
 219                 if (lp_ctx == NULL) {
 220                         DEBUG(10, ("loadparm_init_s3 failed\n"));
 221                         TALLOC_FREE(tmp_ctx);
 222                         return NT_STATUS_INVALID_SERVER_STATE;
 223                 }
 224
 225                 gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
 226                 if (lp_ctx == NULL) {
 227                         DEBUG(10, ("lpcfg_gensec_settings failed\n"));
 228                         TALLOC_FREE(tmp_ctx);
 229                         return NT_STATUS_NO_MEMORY;
 230                 }
 231
 232                 /*
 233                  * This should be a 'netbios domain -> DNS domain'
 234                  * mapping, and can currently validly return NULL on
 235                  * poorly configured systems.
 236                  *
 237                  * This is used for the NTLMSSP server
 238                  *
 239                  */
 240                 dns_name = get_mydnsfullname();
 241                 if (dns_name == NULL) {
 242                         dns_name = "";
 243                 }
 244
 245                 dns_domain = get_mydnsdomname(tmp_ctx);
 246                 if (dns_domain == NULL) {
 247                         dns_domain = "";
 248                 }
 249
 250                 gensec_settings->server_dns_name = strlower_talloc(gensec_settings, dns_name);
 251                 if (gensec_settings->server_dns_name == NULL) {
 252                         TALLOC_FREE(tmp_ctx);
 253                         return NT_STATUS_NO_MEMORY;
 254                 }
 255
 256                 gensec_settings->server_dns_domain = strlower_talloc(gensec_settings, dns_domain);
 257                 if (gensec_settings->server_dns_domain == NULL) {
 258                         TALLOC_FREE(tmp_ctx);
 259                         return NT_STATUS_NO_MEMORY;
 260                 }
 261
 262                 gensec_settings->backends = talloc_zero_array(gensec_settings,
 263                                                 struct gensec_security_ops *, 4);
 264                 if (gensec_settings->backends == NULL) {
 265                         TALLOC_FREE(tmp_ctx);
 266                         return NT_STATUS_NO_MEMORY;
 267                 }
 268
 269                 gensec_init();
 270
 271                 /* These need to be in priority order, krb5 before NTLMSSP */
 272 #if defined(HAVE_KRB5)
 273                 gensec_settings->backends[idx++] = &gensec_gse_krb5_security_ops;
 274 #endif
 275
 276                 gensec_settings->backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
 277
 278                 gensec_settings->backends[idx++] = gensec_security_by_oid(NULL,
 279                                                         GENSEC_OID_SPNEGO);
 280
 281                 /*
 282                  * This is anonymous for now, because we just use it
 283                  * to set the kerberos state at the moment
 284                  */
 285                 server_credentials = cli_credentials_init_anon(tmp_ctx);
 286                 if (!server_credentials) {
 287                         DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
 288                         return NT_STATUS_NO_MEMORY;
 289                 }
 290
 291                 cli_credentials_set_conf(server_credentials, lp_ctx);
 292
 293                 if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
 294                         cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS);
 295                 } else {
 296                         cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS);
 297                 }
 298
 299                 nt_status = gensec_server_start(tmp_ctx, gensec_settings,
 300                                                 auth4_context, &gensec_security);
 301
 302                 if (!NT_STATUS_IS_OK(nt_status)) {
 303                         TALLOC_FREE(tmp_ctx);
 304                         return nt_status;
 305                 }
 306
 307                 gensec_set_credentials(gensec_security, server_credentials);
 308
 309                 talloc_unlink(tmp_ctx, lp_ctx);
 310                 talloc_unlink(tmp_ctx, server_credentials);
 311                 talloc_unlink(tmp_ctx, gensec_settings);
 312                 talloc_unlink(tmp_ctx, auth4_context);
 313         }
 314
 315         nt_status = gensec_set_remote_address(gensec_security,
 316                                               remote_address);
 317         if (!NT_STATUS_IS_OK(nt_status)) {
 318                 TALLOC_FREE(tmp_ctx);
 319                 return nt_status;
 320         }
 321
 322         *gensec_security_out = talloc_steal(mem_ctx, gensec_security);
 323         TALLOC_FREE(tmp_ctx);
 324         return NT_STATUS_OK;
 325 }
 326
 327 NTSTATUS auth_check_password_session_info(struct auth4_context *auth_context,
 328                                           TALLOC_CTX *mem_ctx,
 329                                           struct auth_usersupplied_info *user_info,
 330                                           struct auth_session_info **session_info)
 331 {
 332         NTSTATUS nt_status;
 333         void *server_info;
 334
 335         nt_status = auth_context->check_ntlm_password(auth_context,
 336                                                       talloc_tos(),
 337                                                       user_info,
 338                                                       &server_info, NULL, NULL);
 339
 340         if (NT_STATUS_IS_OK(nt_status)) {
 341                 nt_status = auth_context->generate_session_info(auth_context,
 342                                                                 mem_ctx,
 343                                                                 server_info,
 344                                                                 user_info->client.account_name,
 345                                                                 AUTH_SESSION_INFO_UNIX_TOKEN |
 346                                                                 AUTH_SESSION_INFO_DEFAULT_GROUPS,
 347                                                                 session_info);
 348                 TALLOC_FREE(server_info);
 349         }
 350         return nt_status;
 351 }