source3/auth/auth_ntlmssp.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle NLTMSSP, server side
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett 2001-2005,2011
   8    Copyright (C) Stefan Metzmacher 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth.h"
  26
  27 NTSTATUS auth3_generate_session_info(struct auth4_context *auth_context,
  28                                      TALLOC_CTX *mem_ctx,
  29                                      void *server_returned_info,
  30                                      const char *original_user_name,
  31                                      uint32_t session_info_flags,
  32                                      struct auth_session_info **session_info)
  33 {
  34         struct auth_serversupplied_info *server_info = talloc_get_type_abort(server_returned_info,
  35                                                                              struct auth_serversupplied_info);
  36         NTSTATUS nt_status;
  37
  38         nt_status = create_local_token(mem_ctx,
  39                                        server_info,
  40                                        NULL,
  41                                        original_user_name,
  42                                        session_info);
  43         if (!NT_STATUS_IS_OK(nt_status)) {
  44                 DEBUG(10, ("create_local_token failed: %s\n",
  45                            nt_errstr(nt_status)));
  46                 return nt_status;
  47         }
  48
  49         return NT_STATUS_OK;
  50 }
  51
  52 /**
  53  * Return the challenge as determined by the authentication subsystem
  54  * @return an 8 byte random challenge
  55  */
  56
  57 NTSTATUS auth3_get_challenge(struct auth4_context *auth4_context,
  58                                            uint8_t chal[8])
  59 {
  60         struct auth_context *auth_context = talloc_get_type_abort(auth4_context->private_data,
  61                                                                   struct auth_context);
  62         auth_get_ntlm_challenge(auth_context, chal);
  63         return NT_STATUS_OK;
  64 }
  65
  66 /**
  67  * NTLM2 authentication modifies the effective challenge,
  68  * @param challenge The new challenge value
  69  */
  70 NTSTATUS auth3_set_challenge(struct auth4_context *auth4_context, const uint8_t *chal,
  71                              const char *challenge_set_by)
  72 {
  73         struct auth_context *auth_context = talloc_get_type_abort(auth4_context->private_data,
  74                                                                   struct auth_context);
  75
  76         auth_context->challenge = data_blob_talloc(auth_context,
  77                                                    chal, 8);
  78         NT_STATUS_HAVE_NO_MEMORY(auth_context->challenge.data);
  79
  80         auth_context->challenge_set_by = talloc_strdup(auth_context, challenge_set_by);
  81         NT_STATUS_HAVE_NO_MEMORY(auth_context->challenge_set_by);
  82
  83         DEBUG(5, ("auth_context challenge set by %s\n", auth_context->challenge_set_by));
  84         DEBUG(5, ("challenge is: \n"));
  85         dump_data(5, auth_context->challenge.data, auth_context->challenge.length);
  86         return NT_STATUS_OK;
  87 }
  88
  89 /**
  90  * Check the password on an NTLMSSP login.
  91  *
  92  * Return the session keys used on the connection.
  93  */
  94
  95 NTSTATUS auth3_check_password(struct auth4_context *auth4_context,
  96                               TALLOC_CTX *mem_ctx,
  97                               const struct auth_usersupplied_info *user_info,
  98                               void **server_returned_info,
  99                               DATA_BLOB *session_key, DATA_BLOB *lm_session_key)
 100 {
 101         struct auth_context *auth_context = talloc_get_type_abort(auth4_context->private_data,
 102                                                                   struct auth_context);
 103         struct auth_usersupplied_info *mapped_user_info = NULL;
 104         struct auth_serversupplied_info *server_info;
 105         NTSTATUS nt_status;
 106         bool username_was_mapped;
 107
 108         /* The client has given us its machine name (which we only get over NBT transport).
 109            We need to possibly reload smb.conf if smb.conf includes depend on the machine name. */
 110
 111         set_remote_machine_name(user_info->workstation_name, True);
 112
 113         /* setup the string used by %U */
 114         /* sub_set_smb_name checks for weird internally */
 115         sub_set_smb_name(user_info->client.account_name);
 116
 117         lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
 118
 119         nt_status = make_user_info_map(talloc_tos(),
 120                                        &mapped_user_info,
 121                                        user_info->client.account_name,
 122                                        user_info->client.domain_name,
 123                                        user_info->workstation_name,
 124                                        user_info->remote_host,
 125                                        user_info->password.response.lanman.data ? &user_info->password.response.lanman : NULL,
 126                                        user_info->password.response.nt.data ? &user_info->password.response.nt : NULL,
 127                                        NULL, NULL, NULL,
 128                                        AUTH_PASSWORD_RESPONSE);
 129
 130         if (!NT_STATUS_IS_OK(nt_status)) {
 131                 return nt_status;
 132         }
 133
 134         mapped_user_info->logon_parameters = user_info->logon_parameters;
 135
 136         mapped_user_info->flags = user_info->flags;
 137
 138         nt_status = auth_check_ntlm_password(mem_ctx,
 139                                              auth_context,
 140                                              mapped_user_info,
 141                                              &server_info);
 142
 143         if (!NT_STATUS_IS_OK(nt_status)) {
 144                 DEBUG(5,("Checking NTLMSSP password for %s\\%s failed: %s\n",
 145                          user_info->client.domain_name,
 146                          user_info->client.account_name,
 147                          nt_errstr(nt_status)));
 148         }
 149
 150         username_was_mapped = mapped_user_info->was_mapped;
 151
 152         TALLOC_FREE(mapped_user_info);
 153
 154         if (!NT_STATUS_IS_OK(nt_status)) {
 155                 nt_status = do_map_to_guest_server_info(mem_ctx,
 156                                                         nt_status,
 157                                                         user_info->client.account_name,
 158                                                         user_info->client.domain_name,
 159                                                         &server_info);
 160                 *server_returned_info = talloc_steal(mem_ctx, server_info);
 161                 return nt_status;
 162         }
 163
 164         server_info->nss_token |= username_was_mapped;
 165
 166         /* Clear out the session keys, and pass them to the caller.
 167          * They will not be used in this form again - instead the
 168          * NTLMSSP code will decide on the final correct session key,
 169          * and supply it to create_local_token() */
 170         if (session_key) {
 171                 DEBUG(10, ("Got NT session key of length %u\n",
 172                         (unsigned int)server_info->session_key.length));
 173                 *session_key = server_info->session_key;
 174                 talloc_steal(mem_ctx, server_info->session_key.data);
 175                 server_info->session_key = data_blob_null;
 176         }
 177         if (lm_session_key) {
 178                 DEBUG(10, ("Got LM session key of length %u\n",
 179                         (unsigned int)server_info->lm_session_key.length));
 180                 *lm_session_key = server_info->lm_session_key;
 181                 talloc_steal(mem_ctx, server_info->lm_session_key.data);
 182                 server_info->lm_session_key = data_blob_null;
 183         }
 184
 185         *server_returned_info = talloc_steal(mem_ctx, server_info);
 186         return nt_status;
 187 }