s3-auth: remove crypto from serverinfo_to_SamInfoX calls.
[kai/samba.git] / source3 / auth / check_samsec.c
1 /*
2    Unix SMB/CIFS implementation.
3    Password and authentication handling
4    Copyright (C) Andrew Tridgell              1992-2000
5    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
6    Copyright (C) Andrew Bartlett              2001-2003
7    Copyright (C) Gerald Carter                2003
8
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "auth.h"
25 #include "../libcli/auth/libcli_auth.h"
26 #include "passdb.h"
27
28 #undef DBGC_CLASS
29 #define DBGC_CLASS DBGC_AUTH
30
31 /****************************************************************************
32  Do a specific test for an smb password being correct, given a smb_password and
33  the lanman and NT responses.
34 ****************************************************************************/
35
36 static NTSTATUS sam_password_ok(TALLOC_CTX *mem_ctx,
37                                 const char *username,
38                                 uint32_t acct_ctrl,
39                                 const DATA_BLOB *challenge,
40                                 const uint8_t *lm_pw,
41                                 const uint8_t *nt_pw,
42                                 const struct auth_usersupplied_info *user_info,
43                                 DATA_BLOB *user_sess_key,
44                                 DATA_BLOB *lm_sess_key)
45 {
46         NTSTATUS status;
47         struct samr_Password _lm_hash, _nt_hash;
48         struct samr_Password *lm_hash = NULL;
49         struct samr_Password *nt_hash = NULL;
50
51         *user_sess_key = data_blob_null;
52         *lm_sess_key = data_blob_null;
53
54         if (acct_ctrl & ACB_PWNOTREQ) {
55                 if (lp_null_passwords()) {
56                         DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", username));
57                         return NT_STATUS_OK;
58                 } else {
59                         DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", username));
60                         return NT_STATUS_LOGON_FAILURE;
61                 }
62         }
63
64         if (lm_pw) {
65                 memcpy(_lm_hash.hash, lm_pw, sizeof(_lm_hash.hash));
66                 lm_hash = &_lm_hash;
67         }
68         if (nt_pw) {
69                 memcpy(_nt_hash.hash, nt_pw, sizeof(_nt_hash.hash));
70                 nt_hash = &_nt_hash;
71         }
72         switch (user_info->password_state) {
73         case AUTH_PASSWORD_HASH:
74                 status = hash_password_check(mem_ctx, lp_lanman_auth(),
75                                              user_info->password.hash.lanman,
76                                              user_info->password.hash.nt,
77                                              username,
78                                              lm_hash,
79                                              nt_hash);
80                 if (NT_STATUS_IS_OK(status)) {
81                         if (nt_pw) {
82                                 *user_sess_key = data_blob_talloc(mem_ctx, NULL, 16);
83                                 if (!user_sess_key->data) {
84                                         return NT_STATUS_NO_MEMORY;
85                                 }
86                                 SMBsesskeygen_ntv1(nt_pw, user_sess_key->data);
87                         }
88                 }
89                 return status;
90
91         /* Eventually we should test plaintext passwords in their own
92          * function, not assuming the caller has done a
93          * mapping */
94         case AUTH_PASSWORD_PLAIN:
95         case AUTH_PASSWORD_RESPONSE:
96                 return ntlm_password_check(mem_ctx, lp_lanman_auth(),
97                                            lp_ntlm_auth(),
98                                            user_info->logon_parameters,
99                                            challenge,
100                                            &user_info->password.response.lanman, &user_info->password.response.nt,
101                                            username,
102                                            user_info->client.account_name,
103                                            user_info->client.domain_name,
104                                            lm_hash,
105                                            nt_hash,
106                                            user_sess_key, lm_sess_key);
107         default:
108                 DEBUG(0,("user_info constructed for user '%s' was invalid - password_state=%u invalid.\n", username, user_info->password_state));
109                 return NT_STATUS_INTERNAL_ERROR;
110         }
111 }
112
113 /****************************************************************************
114  Check if a user is allowed to logon at this time. Note this is the
115  servers local time, as logon hours are just specified as a weekly
116  bitmask.
117 ****************************************************************************/
118
119 static bool logon_hours_ok(struct samu *sampass)
120 {
121         /* In logon hours first bit is Sunday from 12AM to 1AM */
122         const uint8 *hours;
123         struct tm *utctime;
124         time_t lasttime;
125         const char *asct;
126         uint8 bitmask, bitpos;
127
128         hours = pdb_get_hours(sampass);
129         if (!hours) {
130                 DEBUG(5,("logon_hours_ok: No hours restrictions for user %s\n",pdb_get_username(sampass)));
131                 return True;
132         }
133
134         lasttime = time(NULL);
135         utctime = gmtime(&lasttime);
136         if (!utctime) {
137                 DEBUG(1, ("logon_hours_ok: failed to get gmtime. Failing logon for user %s\n",
138                         pdb_get_username(sampass) ));
139                 return False;
140         }
141
142         /* find the corresponding byte and bit */
143         bitpos = (utctime->tm_wday * 24 + utctime->tm_hour) % 168;
144         bitmask = 1 << (bitpos % 8);
145
146         if (! (hours[bitpos/8] & bitmask)) {
147                 struct tm *t = localtime(&lasttime);
148                 if (!t) {
149                         asct = "INVALID TIME";
150                 } else {
151                         asct = asctime(t);
152                         if (!asct) {
153                                 asct = "INVALID TIME";
154                         }
155                 }
156
157                 DEBUG(1, ("logon_hours_ok: Account for user %s not allowed to "
158                           "logon at this time (%s).\n",
159                           pdb_get_username(sampass), asct ));
160                 return False;
161         }
162
163         asct = asctime(utctime);
164         DEBUG(5,("logon_hours_ok: user %s allowed to logon at this time (%s)\n",
165                 pdb_get_username(sampass), asct ? asct : "UNKNOWN TIME" ));
166
167         return True;
168 }
169
170 /****************************************************************************
171  Do a specific test for a struct samu being valid for this connection
172  (ie not disabled, expired and the like).
173 ****************************************************************************/
174
175 static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
176                                struct samu *sampass,
177                                const struct auth_usersupplied_info *user_info)
178 {
179         uint32  acct_ctrl = pdb_get_acct_ctrl(sampass);
180         char *workstation_list;
181         time_t kickoff_time;
182
183         DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n",pdb_get_username(sampass)));
184
185         /* Quit if the account was disabled. */
186         if (acct_ctrl & ACB_DISABLED) {
187                 DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", pdb_get_username(sampass)));
188                 return NT_STATUS_ACCOUNT_DISABLED;
189         }
190
191         /* Quit if the account was locked out. */
192         if (acct_ctrl & ACB_AUTOLOCK) {
193                 DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", pdb_get_username(sampass)));
194                 return NT_STATUS_ACCOUNT_LOCKED_OUT;
195         }
196
197         /* Quit if the account is not allowed to logon at this time. */
198         if (! logon_hours_ok(sampass)) {
199                 return NT_STATUS_INVALID_LOGON_HOURS;
200         }
201
202         /* Test account expire time */
203
204         kickoff_time = pdb_get_kickoff_time(sampass);
205         if (kickoff_time != 0 && time(NULL) > kickoff_time) {
206                 DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", pdb_get_username(sampass)));
207                 DEBUG(3,("sam_account_ok: Account expired at '%ld' unix time.\n", (long)kickoff_time));
208                 return NT_STATUS_ACCOUNT_EXPIRED;
209         }
210
211         if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP) && !(pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ)) {
212                 time_t must_change_time = pdb_get_pass_must_change_time(sampass);
213                 time_t last_set_time = pdb_get_pass_last_set_time(sampass);
214
215                 /* check for immediate expiry "must change at next logon"
216                  * for a user account. */
217                 if (((acct_ctrl & (ACB_WSTRUST|ACB_SVRTRUST)) == 0) && (last_set_time == 0)) {
218                         DEBUG(1,("sam_account_ok: Account for user '%s' password must change!\n", pdb_get_username(sampass)));
219                         return NT_STATUS_PASSWORD_MUST_CHANGE;
220                 }
221
222                 /* check for expired password */
223                 if (must_change_time < time(NULL) && must_change_time != 0) {
224                         DEBUG(1,("sam_account_ok: Account for user '%s' password expired!\n", pdb_get_username(sampass)));
225                         DEBUG(1,("sam_account_ok: Password expired at '%s' (%ld) unix time.\n", http_timestring(talloc_tos(), must_change_time), (long)must_change_time));
226                         return NT_STATUS_PASSWORD_EXPIRED;
227                 }
228         }
229
230         /* Test workstation. Workstation list is comma separated. */
231
232         workstation_list = talloc_strdup(mem_ctx, pdb_get_workstations(sampass));
233         if (!workstation_list)
234                 return NT_STATUS_NO_MEMORY;
235
236         if (*workstation_list) {
237                 bool invalid_ws = True;
238                 char *tok = NULL;
239                 const char *s = workstation_list;
240                 char *machine_name = talloc_asprintf(mem_ctx, "%s$", user_info->workstation_name);
241
242                 if (machine_name == NULL)
243                         return NT_STATUS_NO_MEMORY;
244
245                 while (next_token_talloc(mem_ctx, &s, &tok, ",")) {
246                         DEBUG(10,("sam_account_ok: checking for workstation match %s and %s\n",
247                                   tok, user_info->workstation_name));
248                         if(strequal(tok, user_info->workstation_name)) {
249                                 invalid_ws = False;
250                                 break;
251                         }
252                         if (tok[0] == '+') {
253                                 DEBUG(10,("sam_account_ok: checking for workstation %s in group: %s\n",
254                                         machine_name, tok + 1));
255                                 if (user_in_group(machine_name, tok + 1)) {
256                                         invalid_ws = False;
257                                         break;
258                                 }
259                         }
260                         TALLOC_FREE(tok);
261                 }
262                 TALLOC_FREE(tok);
263                 TALLOC_FREE(machine_name);
264
265                 if (invalid_ws)
266                         return NT_STATUS_INVALID_WORKSTATION;
267         }
268
269         if (acct_ctrl & ACB_DOMTRUST) {
270                 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", pdb_get_username(sampass)));
271                 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
272         }
273
274         if (acct_ctrl & ACB_SVRTRUST) {
275                 if (!(user_info->logon_parameters & MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT)) {
276                         DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", pdb_get_username(sampass)));
277                         return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
278                 }
279         }
280
281         if (acct_ctrl & ACB_WSTRUST) {
282                 if (!(user_info->logon_parameters & MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT)) {
283                         DEBUG(2,("sam_account_ok: Wksta trust account %s denied by server\n", pdb_get_username(sampass)));
284                         return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
285                 }
286         }
287         return NT_STATUS_OK;
288 }
289
290 /**
291  * Check whether the given password is one of the last two
292  * password history entries. If so, the bad pwcount should
293  * not be incremented even thought the actual password check
294  * failed.
295  */
296 static bool need_to_increment_bad_pw_count(
297         const DATA_BLOB *challenge,
298         struct samu* sampass,
299         const struct auth_usersupplied_info *user_info)
300 {
301         uint8_t i;
302         const uint8_t *pwhistory;
303         uint32_t pwhistory_len;
304         uint32_t policy_pwhistory_len;
305         uint32_t acct_ctrl;
306         const char *username;
307         TALLOC_CTX *mem_ctx = talloc_stackframe();
308         bool result = true;
309
310         pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY,
311                                &policy_pwhistory_len);
312         if (policy_pwhistory_len == 0) {
313                 goto done;
314         }
315
316         pwhistory = pdb_get_pw_history(sampass, &pwhistory_len);
317         if (!pwhistory || pwhistory_len == 0) {
318                 goto done;
319         }
320
321         acct_ctrl = pdb_get_acct_ctrl(sampass);
322         username = pdb_get_username(sampass);
323
324         for (i=1; i < MIN(MIN(3, policy_pwhistory_len), pwhistory_len); i++) {
325                 static const uint8_t zero16[SALTED_MD5_HASH_LEN];
326                 const uint8_t *salt;
327                 const uint8_t *nt_pw;
328                 NTSTATUS status;
329                 DATA_BLOB user_sess_key = data_blob_null;
330                 DATA_BLOB lm_sess_key = data_blob_null;
331
332                 salt = &pwhistory[i*PW_HISTORY_ENTRY_LEN];
333                 nt_pw = salt + PW_HISTORY_SALT_LEN;
334
335                 if (memcmp(zero16, nt_pw, NT_HASH_LEN) == 0) {
336                         /* skip zero password hash */
337                         continue;
338                 }
339
340                 if (memcmp(zero16, salt, PW_HISTORY_SALT_LEN) != 0) {
341                         /* skip nonzero salt (old format entry) */
342                         continue;
343                 }
344
345                 status = sam_password_ok(mem_ctx,
346                                          username, acct_ctrl,
347                                          challenge,
348                                          NULL, nt_pw,
349                                          user_info, &user_sess_key, &lm_sess_key);
350                 if (NT_STATUS_IS_OK(status)) {
351                         result = false;
352                         break;
353                 }
354         }
355
356 done:
357         TALLOC_FREE(mem_ctx);
358         return result;
359 }
360
361 /****************************************************************************
362 check if a username/password is OK assuming the password is a 24 byte
363 SMB hash supplied in the user_info structure
364 return an NT_STATUS constant.
365 ****************************************************************************/
366
367 NTSTATUS check_sam_security(const DATA_BLOB *challenge,
368                             TALLOC_CTX *mem_ctx,
369                             const struct auth_usersupplied_info *user_info,
370                             struct auth_serversupplied_info **server_info)
371 {
372         struct samu *sampass=NULL;
373         bool ret;
374         NTSTATUS nt_status;
375         NTSTATUS update_login_attempts_status;
376         DATA_BLOB user_sess_key = data_blob_null;
377         DATA_BLOB lm_sess_key = data_blob_null;
378         bool updated_badpw = False;
379         const char *username;
380         const uint8_t *nt_pw;
381         const uint8_t *lm_pw;
382
383         /* the returned struct gets kept on the server_info, by means
384            of a steal further down */
385
386         sampass = samu_new(mem_ctx);
387         if (sampass == NULL) {
388                 return NT_STATUS_NO_MEMORY;
389         }
390
391         /* get the account information */
392
393         become_root();
394         ret = pdb_getsampwnam(sampass, user_info->mapped.account_name);
395         unbecome_root();
396
397         if (ret == False) {
398                 DEBUG(3,("check_sam_security: Couldn't find user '%s' in "
399                          "passdb.\n", user_info->mapped.account_name));
400                 TALLOC_FREE(sampass);
401                 return NT_STATUS_NO_SUCH_USER;
402         }
403
404         username = pdb_get_username(sampass);
405         nt_pw = pdb_get_nt_passwd(sampass);
406         lm_pw = pdb_get_lanman_passwd(sampass);
407
408         /* Quit if the account was locked out. */
409         if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) {
410                 DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", username));
411                 return NT_STATUS_ACCOUNT_LOCKED_OUT;
412         }
413
414         nt_status = sam_password_ok(mem_ctx,
415                                     username, pdb_get_acct_ctrl(sampass),
416                                     challenge, lm_pw, nt_pw,
417                                     user_info, &user_sess_key, &lm_sess_key);
418
419         /* Notify passdb backend of login success/failure. If not
420            NT_STATUS_OK the backend doesn't like the login */
421
422         update_login_attempts_status = pdb_update_login_attempts(sampass, NT_STATUS_IS_OK(nt_status));
423
424         if (!NT_STATUS_IS_OK(nt_status)) {
425                 bool increment_bad_pw_count = false;
426
427                 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_WRONG_PASSWORD) &&
428                     pdb_get_acct_ctrl(sampass) & ACB_NORMAL &&
429                     NT_STATUS_IS_OK(update_login_attempts_status))
430                 {
431                         increment_bad_pw_count =
432                                 need_to_increment_bad_pw_count(
433                                         challenge, sampass, user_info);
434                 }
435
436                 if (increment_bad_pw_count) {
437                         pdb_increment_bad_password_count(sampass);
438                         updated_badpw = True;
439                 } else {
440                         pdb_update_bad_password_count(sampass,
441                                                       &updated_badpw);
442                 }
443                 if (updated_badpw){
444                         NTSTATUS status;
445
446                         become_root();
447                         status = pdb_update_sam_account(sampass);
448                         unbecome_root();
449
450                         if (!NT_STATUS_IS_OK(status)) {
451                                 DEBUG(1, ("Failed to modify entry: %s\n",
452                                           nt_errstr(status)));
453                         }
454                 }
455                 goto done;
456         }
457
458         if ((pdb_get_acct_ctrl(sampass) & ACB_NORMAL) &&
459             (pdb_get_bad_password_count(sampass) > 0)){
460                 pdb_set_bad_password_count(sampass, 0, PDB_CHANGED);
461                 pdb_set_bad_password_time(sampass, 0, PDB_CHANGED);
462                 updated_badpw = True;
463         }
464
465         if (updated_badpw){
466                 NTSTATUS status;
467
468                 become_root();
469                 status = pdb_update_sam_account(sampass);
470                 unbecome_root();
471
472                 if (!NT_STATUS_IS_OK(status)) {
473                         DEBUG(1, ("Failed to modify entry: %s\n",
474                                   nt_errstr(status)));
475                 }
476         }
477
478         nt_status = sam_account_ok(mem_ctx, sampass, user_info);
479
480         if (!NT_STATUS_IS_OK(nt_status)) {
481                 goto done;
482         }
483
484         become_root();
485         nt_status = make_server_info_sam(server_info, sampass);
486         unbecome_root();
487
488         TALLOC_FREE(sampass);
489
490         if (!NT_STATUS_IS_OK(nt_status)) {
491                 DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
492                 goto done;
493         }
494
495         (*server_info)->session_key =
496                 data_blob_talloc(*server_info, user_sess_key.data,
497                                  user_sess_key.length);
498         data_blob_free(&user_sess_key);
499
500         (*server_info)->lm_session_key =
501                 data_blob_talloc(*server_info, lm_sess_key.data,
502                                  lm_sess_key.length);
503         data_blob_free(&lm_sess_key);
504
505         (*server_info)->nss_token |= user_info->was_mapped;
506
507 done:
508         TALLOC_FREE(sampass);
509         data_blob_free(&user_sess_key);
510         data_blob_free(&lm_sess_key);
511         return nt_status;
512 }
513
514 /* This helper function for winbindd returns a very similar value to
515  * what a NETLOGON call would give, without the indirection */
516 NTSTATUS check_sam_security_info3(const DATA_BLOB *challenge,
517                                   TALLOC_CTX *mem_ctx,
518                                   const struct auth_usersupplied_info *user_info,
519                                   struct netr_SamInfo3 **pinfo3)
520 {
521         struct auth_serversupplied_info *server_info = NULL;
522         struct netr_SamInfo3 *info3;
523         NTSTATUS status;
524         TALLOC_CTX *frame = talloc_stackframe();
525
526         status = check_sam_security(challenge, talloc_tos(), user_info,
527                                     &server_info);
528         if (!NT_STATUS_IS_OK(status)) {
529                 DEBUG(10, ("check_sam_security failed: %s\n",
530                            nt_errstr(status)));
531                 goto done;
532         }
533
534         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
535         if (info3 == NULL) {
536                 status = NT_STATUS_NO_MEMORY;
537                 goto done;
538         }
539
540         status = serverinfo_to_SamInfo3(server_info, info3);
541         if (!NT_STATUS_IS_OK(status)) {
542                 DEBUG(10, ("serverinfo_to_SamInfo3 failed: %s\n",
543                            nt_errstr(status)));
544                 goto done;
545         }
546         *pinfo3 = info3;
547         status =  NT_STATUS_OK;
548 done:
549         TALLOC_FREE(frame);
550         return status;
551 }