039e653401322dc21809f83846de7420277982ae
[nivanova/samba-autobuild/.git] / source3 / winbindd / winbindd_ccache_access.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    Winbind daemon - cached credentials funcions
5
6    Copyright (C) Robert O'Callahan 2006
7    Copyright (C) Jeremy Allison 2006 (minor fixes to fit into Samba and
8                                       protect against integer wrap).
9    Copyright (C) Andrew Bartlett 2011
10
11    This program is free software; you can redistribute it and/or modify
12    it under the terms of the GNU General Public License as published by
13    the Free Software Foundation; either version 3 of the License, or
14    (at your option) any later version.
15
16    This program is distributed in the hope that it will be useful,
17    but WITHOUT ANY WARRANTY; without even the implied warranty of
18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19    GNU General Public License for more details.
20
21    You should have received a copy of the GNU General Public License
22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27 #include "auth/gensec/gensec.h"
28 #include "auth_generic.h"
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_WINBIND
32
33 static bool client_can_access_ccache_entry(uid_t client_uid,
34                                         struct WINBINDD_MEMORY_CREDS *entry)
35 {
36         if (client_uid == entry->uid || client_uid == 0) {
37                 DEBUG(10, ("Access granted to uid %u\n", (unsigned int)client_uid));
38                 return True;
39         }
40
41         DEBUG(1, ("Access denied to uid %u (expected %u)\n",
42                 (unsigned int)client_uid, (unsigned int)entry->uid));
43         return False;
44 }
45
46 static NTSTATUS do_ntlm_auth_with_stored_pw(const char *username,
47                                             const char *domain,
48                                             const char *password,
49                                             const DATA_BLOB initial_msg,
50                                             const DATA_BLOB challenge_msg,
51                                             TALLOC_CTX *mem_ctx,
52                                             DATA_BLOB *auth_msg,
53                                             uint8_t session_key[16],
54                                             uint8_t *new_spnego)
55 {
56         NTSTATUS status;
57         struct auth_generic_state *auth_generic_state = NULL;
58         DATA_BLOB reply, session_key_blob;
59
60         status = auth_generic_client_prepare(mem_ctx, &auth_generic_state);
61
62         if (!NT_STATUS_IS_OK(status)) {
63                 DEBUG(1, ("Could not start NTLMSSP client: %s\n",
64                         nt_errstr(status)));
65                 goto done;
66         }
67
68         status = auth_generic_set_username(auth_generic_state, username);
69
70         if (!NT_STATUS_IS_OK(status)) {
71                 DEBUG(1, ("Could not set username: %s\n",
72                         nt_errstr(status)));
73                 goto done;
74         }
75
76         status = auth_generic_set_domain(auth_generic_state, domain);
77
78         if (!NT_STATUS_IS_OK(status)) {
79                 DEBUG(1, ("Could not set domain: %s\n",
80                         nt_errstr(status)));
81                 goto done;
82         }
83
84         status = auth_generic_set_password(auth_generic_state, password);
85
86         if (!NT_STATUS_IS_OK(status)) {
87                 DEBUG(1, ("Could not set password: %s\n",
88                         nt_errstr(status)));
89                 goto done;
90         }
91
92         if (initial_msg.length == 0) {
93                 gensec_want_feature(auth_generic_state->gensec_security,
94                                     GENSEC_FEATURE_SESSION_KEY);
95         }
96
97         status = auth_generic_client_start_by_name(auth_generic_state,
98                                                    "ntlmssp_resume_ccache");
99         if (!NT_STATUS_IS_OK(status)) {
100                 DEBUG(1, ("Could not start NTLMSSP resume mech: %s\n",
101                         nt_errstr(status)));
102                 goto done;
103         }
104
105         /*
106          * We inject the inital NEGOTIATE message our caller used
107          * in order to get the state machine into the correct possition.
108          */
109         reply = data_blob_null;
110         status = gensec_update(auth_generic_state->gensec_security,
111                                talloc_tos(), initial_msg, &reply);
112         data_blob_free(&reply);
113
114         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
115                 DEBUG(1, ("Failed to create initial message! [%s]\n",
116                         nt_errstr(status)));
117                 goto done;
118         }
119
120         /* Now we are ready to handle the server's actual response. */
121         status = gensec_update(auth_generic_state->gensec_security,
122                                mem_ctx, challenge_msg, &reply);
123         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
124                 DEBUG(1, ("We didn't get a response to the challenge! [%s]\n",
125                         nt_errstr(status)));
126                 data_blob_free(&reply);
127                 goto done;
128         }
129
130         status = gensec_session_key(auth_generic_state->gensec_security,
131                                     talloc_tos(), &session_key_blob);
132         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
133                 DEBUG(1, ("We didn't get the session key we requested! [%s]\n",
134                         nt_errstr(status)));
135                 data_blob_free(&reply);
136                 goto done;
137         }
138
139         if (session_key_blob.length != 16) {
140                 DEBUG(1, ("invalid session key length %d\n",
141                           (int)session_key_blob.length));
142                 data_blob_free(&reply);
143                 goto done;
144         }
145         memcpy(session_key, session_key_blob.data, 16);
146         data_blob_free(&session_key_blob);
147         *auth_msg = reply;
148         *new_spnego = gensec_have_feature(auth_generic_state->gensec_security,
149                                           GENSEC_FEATURE_NEW_SPNEGO);
150         status = NT_STATUS_OK;
151
152 done:
153         TALLOC_FREE(auth_generic_state);
154         return status;
155 }
156
157 static bool check_client_uid(struct winbindd_cli_state *state, uid_t uid)
158 {
159         int ret;
160         uid_t ret_uid;
161         gid_t ret_gid;
162
163         ret_uid = (uid_t)-1;
164
165         ret = getpeereid(state->sock, &ret_uid, &ret_gid);
166         if (ret != 0) {
167                 DEBUG(1, ("check_client_uid: Could not get socket peer uid: %s; "
168                         "denying access\n", strerror(errno)));
169                 return False;
170         }
171
172         if (uid != ret_uid && ret_uid != sec_initial_uid()) {
173                 DEBUG(1, ("check_client_uid: Client lied about its uid: said %u, "
174                         "actually was %u; denying access\n",
175                         (unsigned int)uid, (unsigned int)ret_uid));
176                 return False;
177         }
178
179         return True;
180 }
181
182 void winbindd_ccache_ntlm_auth(struct winbindd_cli_state *state)
183 {
184         struct winbindd_domain *domain;
185         fstring name_domain, name_user;
186         NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
187         struct WINBINDD_MEMORY_CREDS *entry;
188         DATA_BLOB initial, challenge, auth;
189         uint32_t initial_blob_len, challenge_blob_len, extra_len;
190
191         /* Ensure null termination */
192         state->request->data.ccache_ntlm_auth.user[
193                         sizeof(state->request->data.ccache_ntlm_auth.user)-1]='\0';
194
195         DEBUG(3, ("[%5lu]: perform NTLM auth on behalf of user %s\n", (unsigned long)state->pid,
196                 state->request->data.ccache_ntlm_auth.user));
197
198         /* Parse domain and username */
199
200         if (!canonicalize_username(state->request->data.ccache_ntlm_auth.user,
201                                 name_domain, name_user)) {
202                 DEBUG(5,("winbindd_ccache_ntlm_auth: cannot parse domain and user from name [%s]\n",
203                         state->request->data.ccache_ntlm_auth.user));
204                 request_error(state);
205                 return;
206         }
207
208         domain = find_auth_domain(state->request->flags, name_domain);
209
210         if (domain == NULL) {
211                 DEBUG(5,("winbindd_ccache_ntlm_auth: can't get domain [%s]\n",
212                         name_domain));
213                 request_error(state);
214                 return;
215         }
216
217         if (!check_client_uid(state, state->request->data.ccache_ntlm_auth.uid)) {
218                 request_error(state);
219                 return;
220         }
221
222         /* validate blob lengths */
223         initial_blob_len = state->request->data.ccache_ntlm_auth.initial_blob_len;
224         challenge_blob_len = state->request->data.ccache_ntlm_auth.challenge_blob_len;
225         extra_len = state->request->extra_len;
226
227         if (initial_blob_len > extra_len || challenge_blob_len > extra_len ||
228                 initial_blob_len + challenge_blob_len > extra_len ||
229                 initial_blob_len + challenge_blob_len < initial_blob_len ||
230                 initial_blob_len + challenge_blob_len < challenge_blob_len) {
231
232                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: blob lengths overrun "
233                         "or wrap. Buffer [%d+%d > %d]\n",
234                         initial_blob_len,
235                         challenge_blob_len,
236                         extra_len));
237                 goto process_result;
238         }
239
240         /* Parse domain and username */
241         if (!parse_domain_user(state->request->data.ccache_ntlm_auth.user, name_domain, name_user)) {
242                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: cannot parse "
243                         "domain and user from name [%s]\n",
244                         state->request->data.ccache_ntlm_auth.user));
245                 goto process_result;
246         }
247
248         entry = find_memory_creds_by_name(state->request->data.ccache_ntlm_auth.user);
249         if (entry == NULL || entry->nt_hash == NULL || entry->lm_hash == NULL) {
250                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: could not find "
251                         "credentials for user %s\n", 
252                         state->request->data.ccache_ntlm_auth.user));
253                 goto process_result;
254         }
255
256         DEBUG(10,("winbindd_dual_ccache_ntlm_auth: found ccache [%s]\n", entry->username));
257
258         if (!client_can_access_ccache_entry(state->request->data.ccache_ntlm_auth.uid, entry)) {
259                 goto process_result;
260         }
261
262         if (initial_blob_len == 0 && challenge_blob_len == 0) {
263                 /* this is just a probe to see if credentials are available. */
264                 result = NT_STATUS_OK;
265                 state->response->data.ccache_ntlm_auth.auth_blob_len = 0;
266                 goto process_result;
267         }
268
269         initial = data_blob_const(state->request->extra_data.data,
270                                   initial_blob_len);
271         challenge = data_blob_const(
272                 state->request->extra_data.data + initial_blob_len,
273                 state->request->data.ccache_ntlm_auth.challenge_blob_len);
274
275         result = do_ntlm_auth_with_stored_pw(
276                 name_user, name_domain, entry->pass,
277                 initial, challenge, talloc_tos(), &auth,
278                 state->response->data.ccache_ntlm_auth.session_key,
279                 &state->response->data.ccache_ntlm_auth.new_spnego);
280
281         if (!NT_STATUS_IS_OK(result)) {
282                 goto process_result;
283         }
284
285         state->response->extra_data.data = talloc_memdup(
286                 state->mem_ctx, auth.data, auth.length);
287         if (!state->response->extra_data.data) {
288                 result = NT_STATUS_NO_MEMORY;
289                 goto process_result;
290         }
291         state->response->length += auth.length;
292         state->response->data.ccache_ntlm_auth.auth_blob_len = auth.length;
293
294         data_blob_free(&auth);
295
296   process_result:
297         if (!NT_STATUS_IS_OK(result)) {
298                 request_error(state);
299                 return;
300         }
301         request_ok(state);
302 }
303
304 void winbindd_ccache_save(struct winbindd_cli_state *state)
305 {
306         struct winbindd_domain *domain;
307         fstring name_domain, name_user;
308         NTSTATUS status;
309
310         /* Ensure null termination */
311         state->request->data.ccache_save.user[
312                 sizeof(state->request->data.ccache_save.user)-1]='\0';
313         state->request->data.ccache_save.pass[
314                 sizeof(state->request->data.ccache_save.pass)-1]='\0';
315
316         DEBUG(3, ("[%5lu]: save password of user %s\n",
317                   (unsigned long)state->pid,
318                   state->request->data.ccache_save.user));
319
320         /* Parse domain and username */
321
322         if (!canonicalize_username(state->request->data.ccache_save.user,
323                                    name_domain, name_user)) {
324                 DEBUG(5,("winbindd_ccache_save: cannot parse domain and user "
325                          "from name [%s]\n",
326                          state->request->data.ccache_save.user));
327                 request_error(state);
328                 return;
329         }
330
331         /*
332          * The domain is checked here only for compatibility
333          * reasons. We used to do the winbindd memory ccache for
334          * ntlm_auth in the domain child. With that code, we had to
335          * make sure that we do have a domain around to send this
336          * to. Now we do the memory cache in the parent winbindd,
337          * where it would not matter if we have a domain or not.
338          */
339
340         domain = find_auth_domain(state->request->flags, name_domain);
341         if (domain == NULL) {
342                 DEBUG(5, ("winbindd_ccache_save: can't get domain [%s]\n",
343                           name_domain));
344                 request_error(state);
345                 return;
346         }
347
348         if (!check_client_uid(state, state->request->data.ccache_save.uid)) {
349                 request_error(state);
350                 return;
351         }
352
353         status = winbindd_add_memory_creds(
354                 state->request->data.ccache_save.user,
355                 state->request->data.ccache_save.uid,
356                 state->request->data.ccache_save.pass);
357
358         if (!NT_STATUS_IS_OK(status)) {
359                 DEBUG(1, ("winbindd_add_memory_creds failed %s\n",
360                           nt_errstr(status)));
361                 request_error(state);
362                 return;
363         }
364         request_ok(state);
365 }