source3/winbindd/winbindd_ccache_access.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - cached credentials funcions
   5
   6    Copyright (C) Robert O'Callahan 2006
   7    Copyright (C) Jeremy Allison 2006 (minor fixes to fit into Samba and
   8                                       protect against integer wrap).
   9    Copyright (C) Andrew Bartlett 2011
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #include "auth/gensec/gensec.h"
  28 #include "auth_generic.h"
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_WINBIND
  32
  33 static bool client_can_access_ccache_entry(uid_t client_uid,
  34                                         struct WINBINDD_MEMORY_CREDS *entry)
  35 {
  36         if (client_uid == entry->uid || client_uid == 0) {
  37                 DEBUG(10, ("Access granted to uid %u\n", (unsigned int)client_uid));
  38                 return True;
  39         }
  40
  41         DEBUG(1, ("Access denied to uid %u (expected %u)\n",
  42                 (unsigned int)client_uid, (unsigned int)entry->uid));
  43         return False;
  44 }
  45
  46 static NTSTATUS do_ntlm_auth_with_stored_pw(const char *namespace,
  47                                             const char *domain,
  48                                             const char *username,
  49                                             const char *password,
  50                                             const DATA_BLOB initial_msg,
  51                                             const DATA_BLOB challenge_msg,
  52                                             TALLOC_CTX *mem_ctx,
  53                                             DATA_BLOB *auth_msg,
  54                                             uint8_t session_key[16],
  55                                             uint8_t *new_spnego)
  56 {
  57         NTSTATUS status;
  58         struct auth_generic_state *auth_generic_state = NULL;
  59         DATA_BLOB reply, session_key_blob;
  60
  61         status = auth_generic_client_prepare(mem_ctx, &auth_generic_state);
  62
  63         if (!NT_STATUS_IS_OK(status)) {
  64                 DEBUG(1, ("Could not start NTLMSSP client: %s\n",
  65                         nt_errstr(status)));
  66                 goto done;
  67         }
  68
  69         status = auth_generic_set_username(auth_generic_state, username);
  70
  71         if (!NT_STATUS_IS_OK(status)) {
  72                 DEBUG(1, ("Could not set username: %s\n",
  73                         nt_errstr(status)));
  74                 goto done;
  75         }
  76
  77         status = auth_generic_set_domain(auth_generic_state, domain);
  78
  79         if (!NT_STATUS_IS_OK(status)) {
  80                 DEBUG(1, ("Could not set domain: %s\n",
  81                         nt_errstr(status)));
  82                 goto done;
  83         }
  84
  85         status = auth_generic_set_password(auth_generic_state, password);
  86
  87         if (!NT_STATUS_IS_OK(status)) {
  88                 DEBUG(1, ("Could not set password: %s\n",
  89                         nt_errstr(status)));
  90                 goto done;
  91         }
  92
  93         if (initial_msg.length == 0) {
  94                 gensec_want_feature(auth_generic_state->gensec_security,
  95                                     GENSEC_FEATURE_SESSION_KEY);
  96         }
  97
  98         status = auth_generic_client_start_by_name(auth_generic_state,
  99                                                    "ntlmssp_resume_ccache");
 100         if (!NT_STATUS_IS_OK(status)) {
 101                 DEBUG(1, ("Could not start NTLMSSP resume mech: %s\n",
 102                         nt_errstr(status)));
 103                 goto done;
 104         }
 105
 106         /*
 107          * We inject the initial NEGOTIATE message our caller used
 108          * in order to get the state machine into the correct position.
 109          */
 110         reply = data_blob_null;
 111         status = gensec_update(auth_generic_state->gensec_security,
 112                                talloc_tos(), initial_msg, &reply);
 113         data_blob_free(&reply);
 114
 115         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 116                 DEBUG(1, ("Failed to create initial message! [%s]\n",
 117                         nt_errstr(status)));
 118                 goto done;
 119         }
 120
 121         /* Now we are ready to handle the server's actual response. */
 122         status = gensec_update(auth_generic_state->gensec_security,
 123                                mem_ctx, challenge_msg, &reply);
 124         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 125                 DEBUG(1, ("We didn't get a response to the challenge! [%s]\n",
 126                         nt_errstr(status)));
 127                 data_blob_free(&reply);
 128                 goto done;
 129         }
 130
 131         status = gensec_session_key(auth_generic_state->gensec_security,
 132                                     talloc_tos(), &session_key_blob);
 133         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 134                 DEBUG(1, ("We didn't get the session key we requested! [%s]\n",
 135                         nt_errstr(status)));
 136                 data_blob_free(&reply);
 137                 goto done;
 138         }
 139
 140         if (session_key_blob.length != 16) {
 141                 DEBUG(1, ("invalid session key length %d\n",
 142                           (int)session_key_blob.length));
 143                 data_blob_free(&reply);
 144                 goto done;
 145         }
 146         memcpy(session_key, session_key_blob.data, 16);
 147         data_blob_free(&session_key_blob);
 148         *auth_msg = reply;
 149         *new_spnego = gensec_have_feature(auth_generic_state->gensec_security,
 150                                           GENSEC_FEATURE_NEW_SPNEGO);
 151         status = NT_STATUS_OK;
 152
 153 done:
 154         TALLOC_FREE(auth_generic_state);
 155         return status;
 156 }
 157
 158 static bool check_client_uid(struct winbindd_cli_state *state, uid_t uid)
 159 {
 160         int ret;
 161         uid_t ret_uid;
 162         gid_t ret_gid;
 163
 164         ret_uid = (uid_t)-1;
 165
 166         ret = getpeereid(state->sock, &ret_uid, &ret_gid);
 167         if (ret != 0) {
 168                 DEBUG(1, ("check_client_uid: Could not get socket peer uid: %s; "
 169                         "denying access\n", strerror(errno)));
 170                 return False;
 171         }
 172
 173         if (uid != ret_uid && ret_uid != sec_initial_uid()) {
 174                 DEBUG(1, ("check_client_uid: Client lied about its uid: said %u, "
 175                         "actually was %u; denying access\n",
 176                         (unsigned int)uid, (unsigned int)ret_uid));
 177                 return False;
 178         }
 179
 180         return True;
 181 }
 182
 183 bool winbindd_ccache_ntlm_auth(struct winbindd_cli_state *state)
 184 {
 185         struct winbindd_domain *domain;
 186         fstring name_namespace, name_domain, name_user;
 187         NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
 188         struct WINBINDD_MEMORY_CREDS *entry;
 189         DATA_BLOB initial, challenge, auth;
 190         uint32_t initial_blob_len, challenge_blob_len, extra_len;
 191         bool ok;
 192
 193         /* Ensure null termination */
 194         state->request->data.ccache_ntlm_auth.user[
 195                         sizeof(state->request->data.ccache_ntlm_auth.user)-1]='\0';
 196
 197         DEBUG(3, ("[%5lu]: perform NTLM auth on behalf of user %s\n", (unsigned long)state->pid,
 198                 state->request->data.ccache_ntlm_auth.user));
 199
 200         /* Parse domain and username */
 201
 202         ok = canonicalize_username(state->request->data.ccache_ntlm_auth.user,
 203                                    name_namespace,
 204                                    name_domain,
 205                                    name_user);
 206         if (!ok) {
 207                 DEBUG(5,("winbindd_ccache_ntlm_auth: cannot parse domain and user from name [%s]\n",
 208                         state->request->data.ccache_ntlm_auth.user));
 209                 return false;
 210         }
 211
 212         domain = find_auth_domain(state->request->flags, name_domain);
 213
 214         if (domain == NULL) {
 215                 DEBUG(5,("winbindd_ccache_ntlm_auth: can't get domain [%s]\n",
 216                         name_domain));
 217                 return false;
 218         }
 219
 220         if (!check_client_uid(state, state->request->data.ccache_ntlm_auth.uid)) {
 221                 return false;
 222         }
 223
 224         /* validate blob lengths */
 225         initial_blob_len = state->request->data.ccache_ntlm_auth.initial_blob_len;
 226         challenge_blob_len = state->request->data.ccache_ntlm_auth.challenge_blob_len;
 227         extra_len = state->request->extra_len;
 228
 229         if (initial_blob_len > extra_len || challenge_blob_len > extra_len ||
 230                 initial_blob_len + challenge_blob_len > extra_len ||
 231                 initial_blob_len + challenge_blob_len < initial_blob_len ||
 232                 initial_blob_len + challenge_blob_len < challenge_blob_len) {
 233
 234                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: blob lengths overrun "
 235                         "or wrap. Buffer [%d+%d > %d]\n",
 236                         initial_blob_len,
 237                         challenge_blob_len,
 238                         extra_len));
 239                 goto process_result;
 240         }
 241
 242         /* Parse domain and username */
 243         ok = parse_domain_user(state->request->data.ccache_ntlm_auth.user,
 244                                name_namespace,
 245                                name_domain,
 246                                name_user);
 247         if (!ok) {
 248                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: cannot parse "
 249                         "domain and user from name [%s]\n",
 250                         state->request->data.ccache_ntlm_auth.user));
 251                 goto process_result;
 252         }
 253
 254         entry = find_memory_creds_by_name(state->request->data.ccache_ntlm_auth.user);
 255         if (entry == NULL || entry->nt_hash == NULL || entry->lm_hash == NULL) {
 256                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: could not find "
 257                         "credentials for user %s\n",
 258                         state->request->data.ccache_ntlm_auth.user));
 259                 goto process_result;
 260         }
 261
 262         DEBUG(10,("winbindd_dual_ccache_ntlm_auth: found ccache [%s]\n", entry->username));
 263
 264         if (!client_can_access_ccache_entry(state->request->data.ccache_ntlm_auth.uid, entry)) {
 265                 goto process_result;
 266         }
 267
 268         if (initial_blob_len == 0 && challenge_blob_len == 0) {
 269                 /* this is just a probe to see if credentials are available. */
 270                 result = NT_STATUS_OK;
 271                 state->response->data.ccache_ntlm_auth.auth_blob_len = 0;
 272                 goto process_result;
 273         }
 274
 275         initial = data_blob_const(state->request->extra_data.data,
 276                                   initial_blob_len);
 277         challenge = data_blob_const(
 278                 state->request->extra_data.data + initial_blob_len,
 279                 state->request->data.ccache_ntlm_auth.challenge_blob_len);
 280
 281         result = do_ntlm_auth_with_stored_pw(
 282                         name_namespace,
 283                         name_domain,
 284                         name_user,
 285                         entry->pass,
 286                         initial,
 287                         challenge,
 288                         talloc_tos(),
 289                         &auth,
 290                         state->response->data.ccache_ntlm_auth.session_key,
 291                         &state->response->data.ccache_ntlm_auth.new_spnego);
 292
 293         if (!NT_STATUS_IS_OK(result)) {
 294                 goto process_result;
 295         }
 296
 297         state->response->extra_data.data = talloc_memdup(
 298                 state->mem_ctx, auth.data, auth.length);
 299         if (!state->response->extra_data.data) {
 300                 result = NT_STATUS_NO_MEMORY;
 301                 goto process_result;
 302         }
 303         state->response->length += auth.length;
 304         state->response->data.ccache_ntlm_auth.auth_blob_len = auth.length;
 305
 306         data_blob_free(&auth);
 307
 308   process_result:
 309         return NT_STATUS_IS_OK(result);
 310 }
 311
 312 bool winbindd_ccache_save(struct winbindd_cli_state *state)
 313 {
 314         struct winbindd_domain *domain;
 315         fstring name_namespace, name_domain, name_user;
 316         NTSTATUS status;
 317         bool ok;
 318
 319         /* Ensure null termination */
 320         state->request->data.ccache_save.user[
 321                 sizeof(state->request->data.ccache_save.user)-1]='\0';
 322         state->request->data.ccache_save.pass[
 323                 sizeof(state->request->data.ccache_save.pass)-1]='\0';
 324
 325         DEBUG(3, ("[%5lu]: save password of user %s\n",
 326                   (unsigned long)state->pid,
 327                   state->request->data.ccache_save.user));
 328
 329         /* Parse domain and username */
 330
 331         ok = canonicalize_username(state->request->data.ccache_save.user,
 332                                    name_namespace,
 333                                    name_domain,
 334                                    name_user);
 335         if (!ok) {
 336                 DEBUG(5,("winbindd_ccache_save: cannot parse domain and user "
 337                          "from name [%s]\n",
 338                          state->request->data.ccache_save.user));
 339                 return false;
 340         }
 341
 342         /*
 343          * The domain is checked here only for compatibility
 344          * reasons. We used to do the winbindd memory ccache for
 345          * ntlm_auth in the domain child. With that code, we had to
 346          * make sure that we do have a domain around to send this
 347          * to. Now we do the memory cache in the parent winbindd,
 348          * where it would not matter if we have a domain or not.
 349          */
 350
 351         domain = find_auth_domain(state->request->flags, name_domain);
 352         if (domain == NULL) {
 353                 DEBUG(5, ("winbindd_ccache_save: can't get domain [%s]\n",
 354                           name_domain));
 355                 return false;
 356         }
 357
 358         if (!check_client_uid(state, state->request->data.ccache_save.uid)) {
 359                 return false;
 360         }
 361
 362         status = winbindd_add_memory_creds(
 363                 state->request->data.ccache_save.user,
 364                 state->request->data.ccache_save.uid,
 365                 state->request->data.ccache_save.pass);
 366
 367         if (!NT_STATUS_IS_OK(status)) {
 368                 DEBUG(1, ("winbindd_add_memory_creds failed %s\n",
 369                           nt_errstr(status)));
 370                 return false;
 371         }
 372         return true;
 373 }