source3/winbindd/winbindd_pam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - pam auth funcions
   5
   6    Copyright (C) Andrew Tridgell 2000
   7    Copyright (C) Tim Potter 2001
   8    Copyright (C) Andrew Bartlett 2001-2002
   9    Copyright (C) Guenther Deschner 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #include "libsmb/namequery.h"
  28 #include "../libcli/auth/libcli_auth.h"
  29 #include "../librpc/gen_ndr/ndr_samr_c.h"
  30 #include "rpc_client/cli_pipe.h"
  31 #include "rpc_client/cli_samr.h"
  32 #include "../librpc/gen_ndr/ndr_netlogon.h"
  33 #include "rpc_client/cli_netlogon.h"
  34 #include "smb_krb5.h"
  35 #include "../libcli/security/security.h"
  36 #include "ads.h"
  37 #include "../librpc/gen_ndr/krb5pac.h"
  38 #include "passdb/machine_sid.h"
  39 #include "auth.h"
  40 #include "../lib/tsocket/tsocket.h"
  41 #include "auth/kerberos/pac_utils.h"
  42 #include "auth/gensec/gensec.h"
  43 #include "librpc/crypto/gse_krb5.h"
  44 #include "lib/afs/afs_funcs.h"
  45 #include "libsmb/samlogon_cache.h"
  46 #include "rpc_client/util_netlogon.h"
  47 #include "libads/krb5_errs.h"
  48 #include "param/param.h"
  49 #include "messaging/messaging.h"
  50 #include "lib/crypto/gnutls_helpers.h"
  51
  52 #include "lib/crypto/gnutls_helpers.h"
  53 #include <gnutls/crypto.h>
  54
  55 #undef DBGC_CLASS
  56 #define DBGC_CLASS DBGC_WINBIND
  57
  58 #define LOGON_KRB5_FAIL_CLOCK_SKEW      0x02000000
  59
  60 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
  61                                     struct winbindd_response *resp,
  62                                     uint16_t validation_level,
  63                                     union netr_Validation *validation)
  64 {
  65         struct netr_SamInfo3 *info3 = NULL;
  66         char *ex = NULL;
  67         uint32_t i;
  68         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
  69         TALLOC_CTX *frame = talloc_stackframe();
  70
  71         status = map_validation_to_info3(frame,
  72                                          validation_level,
  73                                          validation,
  74                                          &info3);
  75         if (!NT_STATUS_IS_OK(status)) {
  76                 goto out;
  77         }
  78
  79         resp->data.auth.info3.logon_time =
  80                 nt_time_to_unix(info3->base.logon_time);
  81         resp->data.auth.info3.logoff_time =
  82                 nt_time_to_unix(info3->base.logoff_time);
  83         resp->data.auth.info3.kickoff_time =
  84                 nt_time_to_unix(info3->base.kickoff_time);
  85         resp->data.auth.info3.pass_last_set_time =
  86                 nt_time_to_unix(info3->base.last_password_change);
  87         resp->data.auth.info3.pass_can_change_time =
  88                 nt_time_to_unix(info3->base.allow_password_change);
  89         resp->data.auth.info3.pass_must_change_time =
  90                 nt_time_to_unix(info3->base.force_password_change);
  91
  92         resp->data.auth.info3.logon_count = info3->base.logon_count;
  93         resp->data.auth.info3.bad_pw_count = info3->base.bad_password_count;
  94
  95         resp->data.auth.info3.user_rid = info3->base.rid;
  96         resp->data.auth.info3.group_rid = info3->base.primary_gid;
  97         sid_to_fstring(resp->data.auth.info3.dom_sid, info3->base.domain_sid);
  98
  99         resp->data.auth.info3.num_groups = info3->base.groups.count;
 100         resp->data.auth.info3.user_flgs = info3->base.user_flags;
 101
 102         resp->data.auth.info3.acct_flags = info3->base.acct_flags;
 103         resp->data.auth.info3.num_other_sids = info3->sidcount;
 104
 105         fstrcpy(resp->data.auth.info3.user_name,
 106                 info3->base.account_name.string);
 107         fstrcpy(resp->data.auth.info3.full_name,
 108                 info3->base.full_name.string);
 109         fstrcpy(resp->data.auth.info3.logon_script,
 110                 info3->base.logon_script.string);
 111         fstrcpy(resp->data.auth.info3.profile_path,
 112                 info3->base.profile_path.string);
 113         fstrcpy(resp->data.auth.info3.home_dir,
 114                 info3->base.home_directory.string);
 115         fstrcpy(resp->data.auth.info3.dir_drive,
 116                 info3->base.home_drive.string);
 117
 118         fstrcpy(resp->data.auth.info3.logon_srv,
 119                 info3->base.logon_server.string);
 120         fstrcpy(resp->data.auth.info3.logon_dom,
 121                 info3->base.logon_domain.string);
 122
 123         resp->data.auth.validation_level = validation_level;
 124         if (validation_level == 6) {
 125                 fstrcpy(resp->data.auth.info6.dns_domainname,
 126                         validation->sam6->dns_domainname.string);
 127                 fstrcpy(resp->data.auth.info6.principal_name,
 128                         validation->sam6->principal_name.string);
 129         }
 130
 131         ex = talloc_strdup(frame, "");
 132         if (ex == NULL) {
 133                 status = NT_STATUS_NO_MEMORY;
 134                 goto out;
 135         }
 136
 137         for (i=0; i < info3->base.groups.count; i++) {
 138                 ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
 139                                                    info3->base.groups.rids[i].rid,
 140                                                    info3->base.groups.rids[i].attributes);
 141                 if (ex == NULL) {
 142                         status = NT_STATUS_NO_MEMORY;
 143                         goto out;
 144                 }
 145         }
 146
 147         for (i=0; i < info3->sidcount; i++) {
 148                 struct dom_sid_buf sidbuf;
 149
 150                 ex = talloc_asprintf_append_buffer(
 151                         ex,
 152                         "%s:0x%08X\n",
 153                         dom_sid_str_buf(info3->sids[i].sid, &sidbuf),
 154                         info3->sids[i].attributes);
 155                 if (ex == NULL) {
 156                         status = NT_STATUS_NO_MEMORY;
 157                         goto out;
 158                 }
 159         }
 160
 161         resp->length += talloc_get_size(ex);
 162         resp->extra_data.data = talloc_move(mem_ctx, &ex);
 163
 164         status = NT_STATUS_OK;
 165 out:
 166         TALLOC_FREE(frame);
 167         return status;
 168 }
 169
 170 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
 171                                     struct winbindd_response *resp,
 172                                     struct netr_SamInfo3 *info3)
 173 {
 174         DATA_BLOB blob;
 175         enum ndr_err_code ndr_err;
 176
 177         ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
 178                                        (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
 179         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 180                 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
 181                 return ndr_map_error2ntstatus(ndr_err);
 182         }
 183
 184         resp->extra_data.data = blob.data;
 185         resp->length += blob.length;
 186
 187         return NT_STATUS_OK;
 188 }
 189
 190 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
 191                                      struct winbindd_response *resp,
 192                                      const struct netr_SamInfo3 *info3,
 193                                      const char *name_domain,
 194                                      const char *name_user)
 195 {
 196         /* We've been asked to return the unix username, per
 197            'winbind use default domain' settings and the like */
 198
 199         const char *nt_username, *nt_domain, *unix_username;
 200
 201         nt_domain = talloc_strdup(mem_ctx, info3->base.logon_domain.string);
 202         if (!nt_domain) {
 203                 /* If the server didn't give us one, just use the one
 204                  * we sent them */
 205                 nt_domain = name_domain;
 206         }
 207
 208         nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
 209         if (!nt_username) {
 210                 /* If the server didn't give us one, just use the one
 211                  * we sent them */
 212                 nt_username = name_user;
 213         }
 214
 215         unix_username = fill_domain_username_talloc(mem_ctx,
 216                                                     nt_domain,
 217                                                     nt_username,
 218                                                     true);
 219         if (unix_username == NULL) {
 220                 return NT_STATUS_NO_MEMORY;
 221         }
 222
 223         fstrcpy(resp->data.auth.unix_username, unix_username);
 224
 225         DEBUG(5, ("Setting unix username to [%s]\n",
 226                   resp->data.auth.unix_username));
 227
 228         return NT_STATUS_OK;
 229 }
 230
 231 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
 232                                  struct winbindd_response *resp,
 233                                  const struct netr_SamInfo3 *info3,
 234                                  const char *name_domain,
 235                                  const char *name_user)
 236 {
 237         char *afsname = NULL;
 238         char *cell;
 239         char *token;
 240
 241         afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
 242         if (afsname == NULL) {
 243                 return NT_STATUS_NO_MEMORY;
 244         }
 245
 246         afsname = talloc_string_sub(mem_ctx,
 247                                     lp_afs_username_map(),
 248                                     "%D", name_domain);
 249         afsname = talloc_string_sub(mem_ctx, afsname,
 250                                     "%u", name_user);
 251         afsname = talloc_string_sub(mem_ctx, afsname,
 252                                     "%U", name_user);
 253
 254         {
 255                 struct dom_sid user_sid;
 256                 struct dom_sid_buf sidstr;
 257
 258                 sid_compose(&user_sid, info3->base.domain_sid,
 259                             info3->base.rid);
 260                 afsname = talloc_string_sub(
 261                         mem_ctx,
 262                         afsname,
 263                         "%s",
 264                         dom_sid_str_buf(&user_sid, &sidstr));
 265         }
 266
 267         if (afsname == NULL) {
 268                 return NT_STATUS_NO_MEMORY;
 269         }
 270
 271         if (!strlower_m(afsname)) {
 272                 return NT_STATUS_INVALID_PARAMETER;
 273         }
 274
 275         DEBUG(10, ("Generating token for user %s\n", afsname));
 276
 277         cell = strchr(afsname, '@');
 278
 279         if (cell == NULL) {
 280                 return NT_STATUS_NO_MEMORY;
 281         }
 282
 283         *cell = '\0';
 284         cell += 1;
 285
 286         token = afs_createtoken_str(afsname, cell);
 287         if (token == NULL) {
 288                 return NT_STATUS_OK;
 289         }
 290         resp->extra_data.data = talloc_strdup(mem_ctx, token);
 291         if (resp->extra_data.data == NULL) {
 292                 return NT_STATUS_NO_MEMORY;
 293         }
 294         resp->length += strlen((const char *)resp->extra_data.data)+1;
 295
 296         return NT_STATUS_OK;
 297 }
 298
 299 static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
 300                                      const char *group_sid)
 301 /**
 302  * Check whether a user belongs to a group or list of groups.
 303  *
 304  * @param mem_ctx talloc memory context.
 305  * @param info3 user information, including group membership info.
 306  * @param group_sid One or more groups , separated by commas.
 307  *
 308  * @return NT_STATUS_OK on success,
 309  *    NT_STATUS_LOGON_FAILURE if the user does not belong,
 310  *    or other NT_STATUS_IS_ERR(status) for other kinds of failure.
 311  */
 312 {
 313         struct dom_sid *require_membership_of_sid;
 314         uint32_t num_require_membership_of_sid;
 315         char *req_sid;
 316         const char *p;
 317         struct dom_sid sid;
 318         size_t i;
 319         struct security_token *token;
 320         TALLOC_CTX *frame = talloc_stackframe();
 321         NTSTATUS status;
 322
 323         /* Parse the 'required group' SID */
 324
 325         if (!group_sid || !group_sid[0]) {
 326                 /* NO sid supplied, all users may access */
 327                 TALLOC_FREE(frame);
 328                 return NT_STATUS_OK;
 329         }
 330
 331         token = talloc_zero(talloc_tos(), struct security_token);
 332         if (token == NULL) {
 333                 DEBUG(0, ("talloc failed\n"));
 334                 TALLOC_FREE(frame);
 335                 return NT_STATUS_NO_MEMORY;
 336         }
 337
 338         num_require_membership_of_sid = 0;
 339         require_membership_of_sid = NULL;
 340
 341         p = group_sid;
 342
 343         while (next_token_talloc(talloc_tos(), &p, &req_sid, ",")) {
 344                 if (!string_to_sid(&sid, req_sid)) {
 345                         DEBUG(0, ("check_info3_in_group: could not parse %s "
 346                                   "as a SID!", req_sid));
 347                         TALLOC_FREE(frame);
 348                         return NT_STATUS_INVALID_PARAMETER;
 349                 }
 350
 351                 status = add_sid_to_array(talloc_tos(), &sid,
 352                                           &require_membership_of_sid,
 353                                           &num_require_membership_of_sid);
 354                 if (!NT_STATUS_IS_OK(status)) {
 355                         DEBUG(0, ("add_sid_to_array failed\n"));
 356                         TALLOC_FREE(frame);
 357                         return status;
 358                 }
 359         }
 360
 361         status = sid_array_from_info3(talloc_tos(), info3,
 362                                       &token->sids,
 363                                       &token->num_sids,
 364                                       true);
 365         if (!NT_STATUS_IS_OK(status)) {
 366                 TALLOC_FREE(frame);
 367                 return status;
 368         }
 369
 370         if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
 371                                                   token))
 372             || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
 373                                                      token))) {
 374                 DEBUG(3, ("could not add aliases: %s\n",
 375                           nt_errstr(status)));
 376                 TALLOC_FREE(frame);
 377                 return status;
 378         }
 379
 380         security_token_debug(DBGC_CLASS, 10, token);
 381
 382         for (i=0; i<num_require_membership_of_sid; i++) {
 383                 struct dom_sid_buf buf;
 384                 DEBUG(10, ("Checking SID %s\n",
 385                            dom_sid_str_buf(&require_membership_of_sid[i],
 386                                            &buf)));
 387                 if (nt_token_check_sid(&require_membership_of_sid[i],
 388                                        token)) {
 389                         DEBUG(10, ("Access ok\n"));
 390                         TALLOC_FREE(frame);
 391                         return NT_STATUS_OK;
 392                 }
 393         }
 394
 395         /* Do not distinguish this error from a wrong username/pw */
 396
 397         TALLOC_FREE(frame);
 398         return NT_STATUS_LOGON_FAILURE;
 399 }
 400
 401 struct winbindd_domain *find_auth_domain(uint8_t flags,
 402                                          const char *domain_name)
 403 {
 404         struct winbindd_domain *domain;
 405
 406         if (IS_DC) {
 407                 domain = find_domain_from_name_noinit(domain_name);
 408                 if (domain == NULL) {
 409                         DEBUG(3, ("Authentication for domain [%s] refused "
 410                                   "as it is not a trusted domain\n",
 411                                   domain_name));
 412                         return NULL;
 413                 }
 414
 415                 if (domain->secure_channel_type != SEC_CHAN_NULL) {
 416                         return domain;
 417                 }
 418
 419                 return domain->routing_domain;
 420         }
 421
 422         if (strequal(domain_name, get_global_sam_name())) {
 423                 return find_domain_from_name_noinit(domain_name);
 424         }
 425
 426         if (lp_winbind_use_krb5_enterprise_principals()) {
 427                 /*
 428                  * If we use enterprise principals
 429                  * we always go trough our primary domain
 430                  * and follow the WRONG_REALM replies.
 431                  */
 432                 flags &= ~WBFLAG_PAM_CONTACT_TRUSTDOM;
 433         }
 434
 435         /* we can auth against trusted domains */
 436         if (flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
 437                 domain = find_domain_from_name_noinit(domain_name);
 438                 if (domain == NULL) {
 439                         DEBUG(3, ("Authentication for domain [%s] skipped "
 440                                   "as it is not a trusted domain\n",
 441                                   domain_name));
 442                 } else {
 443                         return domain;
 444                 }
 445         }
 446
 447         return find_our_domain();
 448 }
 449
 450 static void fake_password_policy(struct winbindd_response *r,
 451                                  const struct netr_SamBaseInfo *bi)
 452 {
 453         NTTIME min_password_age;
 454         NTTIME max_password_age;
 455
 456         if (bi->allow_password_change > bi->last_password_change) {
 457                 min_password_age = bi->allow_password_change -
 458                                    bi->last_password_change;
 459         } else {
 460                 min_password_age = 0;
 461         }
 462
 463         if (bi->force_password_change > bi->last_password_change) {
 464                 max_password_age = bi->force_password_change -
 465                                    bi->last_password_change;
 466         } else {
 467                 max_password_age = 0;
 468         }
 469
 470         r->data.auth.policy.min_length_password = 0;
 471         r->data.auth.policy.password_history = 0;
 472         r->data.auth.policy.password_properties = 0;
 473         r->data.auth.policy.expire =
 474                 nt_time_to_unix_abs(&max_password_age);
 475         r->data.auth.policy.min_passwordage =
 476                 nt_time_to_unix_abs(&min_password_age);
 477 }
 478
 479 static void fill_in_password_policy(struct winbindd_response *r,
 480                                     const struct samr_DomInfo1 *p)
 481 {
 482         r->data.auth.policy.min_length_password =
 483                 p->min_password_length;
 484         r->data.auth.policy.password_history =
 485                 p->password_history_length;
 486         r->data.auth.policy.password_properties =
 487                 p->password_properties;
 488         r->data.auth.policy.expire      =
 489                 nt_time_to_unix_abs((const NTTIME *)&(p->max_password_age));
 490         r->data.auth.policy.min_passwordage =
 491                 nt_time_to_unix_abs((const NTTIME *)&(p->min_password_age));
 492 }
 493
 494 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
 495                                        struct winbindd_response *response)
 496 {
 497         TALLOC_CTX *frame = talloc_stackframe();
 498         NTSTATUS status;
 499         struct samr_DomInfo1 password_policy;
 500
 501         if ( !winbindd_can_contact_domain( domain ) ) {
 502                 DEBUG(5,("fillup_password_policy: No inbound trust to "
 503                          "contact domain %s\n", domain->name));
 504                 status = NT_STATUS_NOT_SUPPORTED;
 505                 goto done;
 506         }
 507
 508         status = wb_cache_password_policy(domain, talloc_tos(),
 509                                           &password_policy);
 510         if (NT_STATUS_IS_ERR(status)) {
 511                 goto done;
 512         }
 513
 514         fill_in_password_policy(response, &password_policy);
 515
 516 done:
 517         TALLOC_FREE(frame);
 518         return NT_STATUS_OK;
 519 }
 520
 521 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
 522                                                          TALLOC_CTX *mem_ctx,
 523                                                          uint16_t *lockout_threshold)
 524 {
 525         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 526         struct samr_DomInfo12 lockout_policy;
 527
 528         *lockout_threshold = 0;
 529
 530         status = wb_cache_lockout_policy(domain, mem_ctx, &lockout_policy);
 531         if (NT_STATUS_IS_ERR(status)) {
 532                 return status;
 533         }
 534
 535         *lockout_threshold = lockout_policy.lockout_threshold;
 536
 537         return NT_STATUS_OK;
 538 }
 539
 540 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
 541                                    TALLOC_CTX *mem_ctx,
 542                                    uint32_t *password_properties)
 543 {
 544         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 545         struct samr_DomInfo1 password_policy;
 546
 547         *password_properties = 0;
 548
 549         status = wb_cache_password_policy(domain, mem_ctx, &password_policy);
 550         if (NT_STATUS_IS_ERR(status)) {
 551                 return status;
 552         }
 553
 554         *password_properties = password_policy.password_properties;
 555
 556         return NT_STATUS_OK;
 557 }
 558
 559 #ifdef HAVE_KRB5
 560
 561 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 562                                         const char *type,
 563                                         uid_t uid,
 564                                         const char **user_ccache_file)
 565 {
 566         /* accept FILE and WRFILE as krb5_cc_type from the client and then
 567          * build the full ccname string based on the user's uid here -
 568          * Guenther*/
 569
 570         const char *gen_cc = NULL;
 571
 572         if (uid != -1) {
 573                 if (strequal(type, "FILE")) {
 574                         gen_cc = talloc_asprintf(
 575                                 mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
 576                 }
 577                 if (strequal(type, "WRFILE")) {
 578                         gen_cc = talloc_asprintf(
 579                                 mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
 580                 }
 581                 if (strequal(type, "KEYRING")) {
 582                         gen_cc = talloc_asprintf(
 583                                 mem_ctx, "KEYRING:persistent:%d", uid);
 584                 }
 585                 if (strequal(type, "KCM")) {
 586                         gen_cc = talloc_asprintf(mem_ctx,
 587                                                  "KCM:%d",
 588                                                  uid);
 589                 }
 590
 591                 if (strnequal(type, "FILE:/", 6) ||
 592                     strnequal(type, "WRFILE:/", 8) ||
 593                     strnequal(type, "DIR:/", 5)) {
 594
 595                         /* we allow only one "%u" substitution */
 596
 597                         char *p;
 598
 599                         p = strchr(type, '%');
 600                         if (p != NULL) {
 601
 602                                 p++;
 603
 604                                 if (p != NULL && *p == 'u' && strchr(p, '%') == NULL) {
 605                                         char uid_str[sizeof("18446744073709551615")];
 606
 607                                         snprintf(uid_str, sizeof(uid_str), "%u", uid);
 608
 609                                         gen_cc = talloc_string_sub2(mem_ctx,
 610                                                         type,
 611                                                         "%u",
 612                                                         uid_str,
 613                                                         /* remove_unsafe_characters */
 614                                                         false,
 615                                                         /* replace_once */
 616                                                         true,
 617                                                         /* allow_trailing_dollar */
 618                                                         false);
 619                                 }
 620                         }
 621                 }
 622         }
 623
 624         *user_ccache_file = gen_cc;
 625
 626         if (gen_cc == NULL) {
 627                 gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
 628         }
 629         if (gen_cc == NULL) {
 630                 DEBUG(0,("out of memory\n"));
 631                 return NULL;
 632         }
 633
 634         DEBUG(10, ("using ccache: %s%s\n", gen_cc,
 635                    (*user_ccache_file == NULL) ? " (internal)":""));
 636
 637         return gen_cc;
 638 }
 639
 640 #endif
 641
 642 uid_t get_uid_from_request(struct winbindd_request *request)
 643 {
 644         uid_t uid;
 645
 646         uid = request->data.auth.uid;
 647
 648         if (uid == (uid_t)-1) {
 649                 DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
 650                 return -1;
 651         }
 652         return uid;
 653 }
 654
 655 /**********************************************************************
 656  Authenticate a user with a clear text password using Kerberos and fill up
 657  ccache if required
 658  **********************************************************************/
 659
 660 static NTSTATUS winbindd_raw_kerberos_login(TALLOC_CTX *mem_ctx,
 661                                             struct winbindd_domain *domain,
 662                                             const char *user,
 663                                             const char *pass,
 664                                             const char *krb5_cc_type,
 665                                             uid_t uid,
 666                                             struct netr_SamInfo6 **info6,
 667                                             fstring krb5ccname)
 668 {
 669 #ifdef HAVE_KRB5
 670         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 671         krb5_error_code krb5_ret;
 672         const char *cc = NULL;
 673         const char *principal_s = NULL;
 674         const char *service = NULL;
 675         char *realm = NULL;
 676         fstring name_namespace, name_domain, name_user;
 677         time_t ticket_lifetime = 0;
 678         time_t renewal_until = 0;
 679         ADS_STRUCT *ads;
 680         time_t time_offset = 0;
 681         const char *user_ccache_file;
 682         struct PAC_LOGON_INFO *logon_info = NULL;
 683         struct PAC_UPN_DNS_INFO *upn_dns_info = NULL;
 684         struct PAC_DATA *pac_data = NULL;
 685         struct PAC_DATA_CTR *pac_data_ctr = NULL;
 686         const char *local_service;
 687         uint32_t i;
 688         struct netr_SamInfo6 *info6_copy = NULL;
 689         bool ok;
 690
 691         *info6 = NULL;
 692
 693         if (domain->alt_name == NULL) {
 694                 return NT_STATUS_INVALID_PARAMETER;
 695         }
 696
 697         /* 1st step:
 698          * prepare a krb5_cc_cache string for the user */
 699
 700         if (uid == -1) {
 701                 DEBUG(0,("no valid uid\n"));
 702         }
 703
 704         cc = generate_krb5_ccache(mem_ctx,
 705                                   krb5_cc_type,
 706                                   uid,
 707                                   &user_ccache_file);
 708         if (cc == NULL) {
 709                 return NT_STATUS_NO_MEMORY;
 710         }
 711
 712
 713         /* 2nd step:
 714          * get kerberos properties */
 715
 716         if (domain->private_data) {
 717                 ads = (ADS_STRUCT *)domain->private_data;
 718                 time_offset = ads->auth.time_offset;
 719         }
 720
 721
 722         /* 3rd step:
 723          * do kerberos auth and setup ccache as the user */
 724
 725         ok = parse_domain_user(user, name_namespace, name_domain, name_user);
 726         if (!ok) {
 727                 return NT_STATUS_INVALID_PARAMETER;
 728         }
 729
 730         realm = talloc_strdup(mem_ctx, domain->alt_name);
 731         if (realm == NULL) {
 732                 return NT_STATUS_NO_MEMORY;
 733         }
 734
 735         if (!strupper_m(realm)) {
 736                 return NT_STATUS_INVALID_PARAMETER;
 737         }
 738
 739         if (lp_winbind_use_krb5_enterprise_principals() &&
 740             name_namespace[0] != '\0')
 741         {
 742                 principal_s = talloc_asprintf(mem_ctx,
 743                                               "%s@%s@%s",
 744                                               name_user,
 745                                               name_namespace,
 746                                               realm);
 747         } else {
 748                 principal_s = talloc_asprintf(mem_ctx,
 749                                               "%s@%s",
 750                                               name_user,
 751                                               realm);
 752         }
 753         if (principal_s == NULL) {
 754                 return NT_STATUS_NO_MEMORY;
 755         }
 756
 757         service = talloc_asprintf(mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
 758         if (service == NULL) {
 759                 return NT_STATUS_NO_MEMORY;
 760         }
 761
 762         local_service = talloc_asprintf(mem_ctx, "%s$@%s",
 763                                         lp_netbios_name(), lp_realm());
 764         if (local_service == NULL) {
 765                 return NT_STATUS_NO_MEMORY;
 766         }
 767
 768
 769         /* if this is a user ccache, we need to act as the user to let the krb5
 770          * library handle the chown, etc. */
 771
 772         /************************ ENTERING NON-ROOT **********************/
 773
 774         if (user_ccache_file != NULL) {
 775                 set_effective_uid(uid);
 776                 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
 777         }
 778
 779         result = kerberos_return_pac(mem_ctx,
 780                                      principal_s,
 781                                      pass,
 782                                      time_offset,
 783                                      &ticket_lifetime,
 784                                      &renewal_until,
 785                                      cc,
 786                                      true,
 787                                      true,
 788                                      WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 789                                      NULL,
 790                                      local_service,
 791                                      &pac_data_ctr);
 792         if (user_ccache_file != NULL) {
 793                 gain_root_privilege();
 794         }
 795
 796         /************************ RETURNED TO ROOT **********************/
 797
 798         if (!NT_STATUS_IS_OK(result)) {
 799                 goto failed;
 800         }
 801
 802         if (pac_data_ctr == NULL) {
 803                 goto failed;
 804         }
 805
 806         pac_data = pac_data_ctr->pac_data;
 807         if (pac_data == NULL) {
 808                 goto failed;
 809         }
 810
 811         for (i=0; i < pac_data->num_buffers; i++) {
 812
 813                 if (pac_data->buffers[i].type == PAC_TYPE_LOGON_INFO) {
 814                         logon_info = pac_data->buffers[i].info->logon_info.info;
 815                         continue;
 816                 }
 817
 818                 if (pac_data->buffers[i].type == PAC_TYPE_UPN_DNS_INFO) {
 819                         upn_dns_info = &pac_data->buffers[i].info->upn_dns_info;
 820                         continue;
 821                 }
 822         }
 823
 824         if (logon_info == NULL) {
 825                 DEBUG(10,("Missing logon_info in ticket of %s\n",
 826                         principal_s));
 827                 return NT_STATUS_INVALID_PARAMETER;
 828         }
 829
 830         DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
 831                 principal_s));
 832
 833         result = create_info6_from_pac(mem_ctx, logon_info,
 834                                        upn_dns_info, &info6_copy);
 835         if (!NT_STATUS_IS_OK(result)) {
 836                 goto failed;
 837         }
 838
 839         /* if we had a user's ccache then return that string for the pam
 840          * environment */
 841
 842         if (user_ccache_file != NULL) {
 843
 844                 fstrcpy(krb5ccname, user_ccache_file);
 845
 846                 result = add_ccache_to_list(principal_s,
 847                                             cc,
 848                                             service,
 849                                             user,
 850                                             pass,
 851                                             realm,
 852                                             uid,
 853                                             time(NULL),
 854                                             ticket_lifetime,
 855                                             renewal_until,
 856                                             false);
 857
 858                 if (!NT_STATUS_IS_OK(result)) {
 859                         DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
 860                                 nt_errstr(result)));
 861                 }
 862         } else {
 863
 864                 /* need to delete the memory cred cache, it is not used anymore */
 865
 866                 krb5_ret = ads_kdestroy(cc);
 867                 if (krb5_ret) {
 868                         DEBUG(3,("winbindd_raw_kerberos_login: "
 869                                  "could not destroy krb5 credential cache: "
 870                                  "%s\n", error_message(krb5_ret)));
 871                 }
 872
 873         }
 874         *info6 = info6_copy;
 875         return NT_STATUS_OK;
 876
 877 failed:
 878         /*
 879          * Do not delete an existing valid credential cache, if the user
 880          * e.g. enters a wrong password
 881          */
 882         if ((strequal(krb5_cc_type, "FILE") || strequal(krb5_cc_type, "WRFILE"))
 883             && user_ccache_file != NULL) {
 884                 return result;
 885         }
 886
 887         /* we could have created a new credential cache with a valid tgt in it
 888          * but we werent able to get or verify the service ticket for this
 889          * local host and therefor didn't get the PAC, we need to remove that
 890          * cache entirely now */
 891
 892         krb5_ret = ads_kdestroy(cc);
 893         if (krb5_ret) {
 894                 DEBUG(3,("winbindd_raw_kerberos_login: "
 895                          "could not destroy krb5 credential cache: "
 896                          "%s\n", error_message(krb5_ret)));
 897         }
 898
 899         if (!NT_STATUS_IS_OK(remove_ccache(user))) {
 900                 DEBUG(3,("winbindd_raw_kerberos_login: "
 901                           "could not remove ccache for user %s\n",
 902                         user));
 903         }
 904
 905         return result;
 906 #else
 907         return NT_STATUS_NOT_SUPPORTED;
 908 #endif /* HAVE_KRB5 */
 909 }
 910
 911 /****************************************************************
 912 ****************************************************************/
 913
 914 bool check_request_flags(uint32_t flags)
 915 {
 916         uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
 917                                WBFLAG_PAM_INFO3_TEXT |
 918                                WBFLAG_PAM_INFO3_NDR;
 919
 920         if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
 921              ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
 922              ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
 923               !(flags & flags_edata) ) {
 924                 return true;
 925         }
 926
 927         DEBUG(1, ("check_request_flags: invalid request flags[0x%08X]\n",
 928                   flags));
 929
 930         return false;
 931 }
 932
 933 /****************************************************************
 934 ****************************************************************/
 935
 936 NTSTATUS append_auth_data(TALLOC_CTX *mem_ctx,
 937                           struct winbindd_response *resp,
 938                           uint32_t request_flags,
 939                           uint16_t validation_level,
 940                           union netr_Validation *validation,
 941                           const char *name_domain,
 942                           const char *name_user)
 943 {
 944         struct netr_SamInfo3 *info3 = NULL;
 945         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 946
 947         result = map_validation_to_info3(talloc_tos(),
 948                                          validation_level,
 949                                          validation,
 950                                          &info3);
 951         if (!NT_STATUS_IS_OK(result)) {
 952                 goto out;
 953         }
 954
 955         if (request_flags & WBFLAG_PAM_USER_SESSION_KEY) {
 956                 memcpy(resp->data.auth.user_session_key,
 957                        info3->base.key.key,
 958                        sizeof(resp->data.auth.user_session_key)
 959                        /* 16 */);
 960         }
 961
 962         if (request_flags & WBFLAG_PAM_LMKEY) {
 963                 memcpy(resp->data.auth.first_8_lm_hash,
 964                        info3->base.LMSessKey.key,
 965                        sizeof(resp->data.auth.first_8_lm_hash)
 966                        /* 8 */);
 967         }
 968
 969         if (request_flags & WBFLAG_PAM_UNIX_NAME) {
 970                 result = append_unix_username(mem_ctx, resp,
 971                                               info3, name_domain, name_user);
 972                 if (!NT_STATUS_IS_OK(result)) {
 973                         DEBUG(10,("Failed to append Unix Username: %s\n",
 974                                 nt_errstr(result)));
 975                         goto out;
 976                 }
 977         }
 978
 979         /* currently, anything from here on potentially overwrites extra_data. */
 980
 981         if (request_flags & WBFLAG_PAM_INFO3_NDR) {
 982                 result = append_info3_as_ndr(mem_ctx, resp, info3);
 983                 if (!NT_STATUS_IS_OK(result)) {
 984                         DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
 985                                 nt_errstr(result)));
 986                         goto out;
 987                 }
 988         }
 989
 990         if (request_flags & WBFLAG_PAM_INFO3_TEXT) {
 991                 result = append_info3_as_txt(mem_ctx, resp,
 992                                              validation_level,
 993                                              validation);
 994                 if (!NT_STATUS_IS_OK(result)) {
 995                         DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
 996                                 nt_errstr(result)));
 997                         goto out;
 998                 }
 999         }
1000
1001         if (request_flags & WBFLAG_PAM_AFS_TOKEN) {
1002                 result = append_afs_token(mem_ctx, resp,
1003                                           info3, name_domain, name_user);
1004                 if (!NT_STATUS_IS_OK(result)) {
1005                         DEBUG(10,("Failed to append AFS token: %s\n",
1006                                 nt_errstr(result)));
1007                         goto out;
1008                 }
1009         }
1010
1011         result = NT_STATUS_OK;
1012 out:
1013         TALLOC_FREE(info3);
1014         return result;
1015 }
1016
1017 static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
1018                                               struct winbindd_cli_state *state,
1019                                               struct netr_SamInfo3 **info3)
1020 {
1021         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1022         uint16_t max_allowed_bad_attempts;
1023         fstring name_namespace, name_domain, name_user;
1024         struct dom_sid sid;
1025         enum lsa_SidType type;
1026         uchar new_nt_pass[NT_HASH_LEN];
1027         const uint8_t *cached_nt_pass;
1028         const uint8_t *cached_salt;
1029         struct netr_SamInfo3 *my_info3;
1030         time_t kickoff_time, must_change_time;
1031         bool password_good = false;
1032         bool ok;
1033 #ifdef HAVE_KRB5
1034         struct winbindd_tdc_domain *tdc_domain = NULL;
1035 #endif
1036
1037         *info3 = NULL;
1038
1039         ZERO_STRUCTP(info3);
1040
1041         DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
1042
1043         /* Parse domain and username */
1044
1045         ok = parse_domain_user(state->request->data.auth.user,
1046                                name_namespace,
1047                                name_domain,
1048                                name_user);
1049         if (!ok) {
1050                 DBG_DEBUG("parse_domain_user failed\n");
1051                 return NT_STATUS_NO_SUCH_USER;
1052         }
1053
1054         if (!lookup_cached_name(name_namespace,
1055                                 name_domain,
1056                                 name_user,
1057                                 &sid,
1058                                 &type)) {
1059                 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
1060                 return NT_STATUS_NO_SUCH_USER;
1061         }
1062
1063         if (type != SID_NAME_USER) {
1064                 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
1065                 return NT_STATUS_LOGON_FAILURE;
1066         }
1067
1068         result = winbindd_get_creds(domain,
1069                                     state->mem_ctx,
1070                                     &sid,
1071                                     &my_info3,
1072                                     &cached_nt_pass,
1073                                     &cached_salt);
1074         if (!NT_STATUS_IS_OK(result)) {
1075                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
1076                 return result;
1077         }
1078
1079         *info3 = my_info3;
1080
1081         E_md4hash(state->request->data.auth.pass, new_nt_pass);
1082
1083         dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
1084         dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
1085         if (cached_salt) {
1086                 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
1087         }
1088
1089         if (cached_salt) {
1090                 /* In this case we didn't store the nt_hash itself,
1091                    but the MD5 combination of salt + nt_hash. */
1092                 uchar salted_hash[NT_HASH_LEN];
1093                 gnutls_hash_hd_t hash_hnd = NULL;
1094                 int rc;
1095
1096                 rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);
1097                 if (rc < 0) {
1098                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
1099                 }
1100
1101                 rc = gnutls_hash(hash_hnd, cached_salt, 16);
1102                 if (rc < 0) {
1103                         gnutls_hash_deinit(hash_hnd, NULL);
1104                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
1105                 }
1106                 rc = gnutls_hash(hash_hnd, new_nt_pass, 16);
1107                 if (rc < 0) {
1108                         gnutls_hash_deinit(hash_hnd, NULL);
1109                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
1110                 }
1111                 gnutls_hash_deinit(hash_hnd, salted_hash);
1112
1113                 password_good = (memcmp(cached_nt_pass, salted_hash,
1114                                         NT_HASH_LEN) == 0);
1115         } else {
1116                 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
1117                 password_good = (memcmp(cached_nt_pass, new_nt_pass,
1118                                         NT_HASH_LEN) == 0);
1119         }
1120
1121         if (password_good) {
1122
1123                 /* User *DOES* know the password, update logon_time and reset
1124                  * bad_pw_count */
1125
1126                 my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
1127
1128                 if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
1129                         return NT_STATUS_ACCOUNT_LOCKED_OUT;
1130                 }
1131
1132                 if (my_info3->base.acct_flags & ACB_DISABLED) {
1133                         return NT_STATUS_ACCOUNT_DISABLED;
1134                 }
1135
1136                 if (my_info3->base.acct_flags & ACB_WSTRUST) {
1137                         return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
1138                 }
1139
1140                 if (my_info3->base.acct_flags & ACB_SVRTRUST) {
1141                         return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
1142                 }
1143
1144                 if (my_info3->base.acct_flags & ACB_DOMTRUST) {
1145                         return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
1146                 }
1147
1148                 if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
1149                         DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
1150                                 my_info3->base.acct_flags));
1151                         return NT_STATUS_LOGON_FAILURE;
1152                 }
1153
1154                 kickoff_time = nt_time_to_unix(my_info3->base.kickoff_time);
1155                 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
1156                         return NT_STATUS_ACCOUNT_EXPIRED;
1157                 }
1158
1159                 must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
1160                 if (must_change_time != 0 && must_change_time < time(NULL)) {
1161                         /* we allow grace logons when the password has expired */
1162                         my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
1163                         /* return NT_STATUS_PASSWORD_EXPIRED; */
1164                         goto success;
1165                 }
1166
1167 #ifdef HAVE_KRB5
1168                 if ((state->request->flags & WBFLAG_PAM_KRB5) &&
1169                     ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
1170                     ((tdc_domain->trust_type & LSA_TRUST_TYPE_UPLEVEL) ||
1171                     /* used to cope with the case winbindd starting without network. */
1172                     !strequal(tdc_domain->domain_name, tdc_domain->dns_name))) {
1173
1174                         uid_t uid = -1;
1175                         const char *cc = NULL;
1176                         char *realm = NULL;
1177                         const char *principal_s = NULL;
1178                         const char *service = NULL;
1179                         const char *user_ccache_file;
1180
1181                         if (domain->alt_name == NULL) {
1182                                 return NT_STATUS_INVALID_PARAMETER;
1183                         }
1184
1185                         uid = get_uid_from_request(state->request);
1186                         if (uid == -1) {
1187                                 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
1188                                 return NT_STATUS_INVALID_PARAMETER;
1189                         }
1190
1191                         cc = generate_krb5_ccache(state->mem_ctx,
1192                                                 state->request->data.auth.krb5_cc_type,
1193                                                 state->request->data.auth.uid,
1194                                                 &user_ccache_file);
1195                         if (cc == NULL) {
1196                                 return NT_STATUS_NO_MEMORY;
1197                         }
1198
1199                         realm = talloc_strdup(state->mem_ctx, domain->alt_name);
1200                         if (realm == NULL) {
1201                                 return NT_STATUS_NO_MEMORY;
1202                         }
1203
1204                         if (!strupper_m(realm)) {
1205                                 return NT_STATUS_INVALID_PARAMETER;
1206                         }
1207
1208                         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
1209                         if (principal_s == NULL) {
1210                                 return NT_STATUS_NO_MEMORY;
1211                         }
1212
1213                         service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
1214                         if (service == NULL) {
1215                                 return NT_STATUS_NO_MEMORY;
1216                         }
1217
1218                         if (user_ccache_file != NULL) {
1219
1220                                 fstrcpy(state->response->data.auth.krb5ccname,
1221                                         user_ccache_file);
1222
1223                                 result = add_ccache_to_list(principal_s,
1224                                                             cc,
1225                                                             service,
1226                                                             state->request->data.auth.user,
1227                                                             state->request->data.auth.pass,
1228                                                             realm,
1229                                                             uid,
1230                                                             time(NULL),
1231                                                             time(NULL) + lp_winbind_cache_time(),
1232                                                             time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
1233                                                             true);
1234
1235                                 if (!NT_STATUS_IS_OK(result)) {
1236                                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
1237                                                 "to add ccache to list: %s\n",
1238                                                 nt_errstr(result)));
1239                                 }
1240                         }
1241                 }
1242 #endif /* HAVE_KRB5 */
1243  success:
1244                 /* FIXME: we possibly should handle logon hours as well (does xp when
1245                  * offline?) see auth/auth_sam.c:sam_account_ok for details */
1246
1247                 unix_to_nt_time(&my_info3->base.logon_time, time(NULL));
1248                 my_info3->base.bad_password_count = 0;
1249
1250                 result = winbindd_update_creds_by_info3(domain,
1251                                                         state->request->data.auth.user,
1252                                                         state->request->data.auth.pass,
1253                                                         my_info3);
1254                 if (!NT_STATUS_IS_OK(result)) {
1255                         DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
1256                                 nt_errstr(result)));
1257                         return result;
1258                 }
1259
1260                 return NT_STATUS_OK;
1261
1262         }
1263
1264         /* User does *NOT* know the correct password, modify info3 accordingly, but only if online */
1265         if (domain->online == false) {
1266                 goto failed;
1267         }
1268
1269         /* failure of this is not critical */
1270         result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1271         if (!NT_STATUS_IS_OK(result)) {
1272                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1273                           "Won't be able to honour account lockout policies\n"));
1274         }
1275
1276         /* increase counter */
1277         my_info3->base.bad_password_count++;
1278
1279         if (max_allowed_bad_attempts == 0) {
1280                 goto failed;
1281         }
1282
1283         /* lockout user */
1284         if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
1285
1286                 uint32_t password_properties;
1287
1288                 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1289                 if (!NT_STATUS_IS_OK(result)) {
1290                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1291                 }
1292
1293                 if ((my_info3->base.rid != DOMAIN_RID_ADMINISTRATOR) ||
1294                     (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1295                         my_info3->base.acct_flags |= ACB_AUTOLOCK;
1296                 }
1297         }
1298
1299 failed:
1300         result = winbindd_update_creds_by_info3(domain,
1301                                                 state->request->data.auth.user,
1302                                                 NULL,
1303                                                 my_info3);
1304
1305         if (!NT_STATUS_IS_OK(result)) {
1306                 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1307                         nt_errstr(result)));
1308         }
1309
1310         return NT_STATUS_LOGON_FAILURE;
1311 }
1312
1313 static NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1314                                                 struct winbindd_cli_state *state,
1315                                                 struct netr_SamInfo6 **info6)
1316 {
1317         struct winbindd_domain *contact_domain;
1318         fstring name_namespace, name_domain, name_user;
1319         NTSTATUS result;
1320         bool ok;
1321
1322         DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1323
1324         /* Parse domain and username */
1325
1326         ok = parse_domain_user(state->request->data.auth.user,
1327                                name_namespace,
1328                                name_domain,
1329                                name_user);
1330         if (!ok) {
1331                 result = NT_STATUS_INVALID_PARAMETER;
1332                 goto done;
1333         }
1334
1335         /* what domain should we contact? */
1336
1337         if (lp_winbind_use_krb5_enterprise_principals()) {
1338                 contact_domain = find_auth_domain(0, name_namespace);
1339         } else {
1340                 contact_domain = find_domain_from_name(name_namespace);
1341         }
1342         if (contact_domain == NULL) {
1343                 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1344                           state->request->data.auth.user, name_domain, name_user, name_namespace));
1345                 result = NT_STATUS_NO_SUCH_USER;
1346                 goto done;
1347         }
1348
1349         if (contact_domain->initialized &&
1350             contact_domain->active_directory) {
1351                 goto try_login;
1352         }
1353
1354         if (!contact_domain->initialized) {
1355                 init_dc_connection(contact_domain, false);
1356         }
1357
1358         if (!contact_domain->active_directory) {
1359                 DEBUG(3,("krb5 auth requested but domain (%s) is not Active Directory\n",
1360                       contact_domain->name));
1361                 return NT_STATUS_INVALID_LOGON_TYPE;
1362         }
1363 try_login:
1364         result = winbindd_raw_kerberos_login(
1365                 state->mem_ctx, contact_domain,
1366                 state->request->data.auth.user,
1367                 state->request->data.auth.pass,
1368                 state->request->data.auth.krb5_cc_type,
1369                 get_uid_from_request(state->request),
1370                 info6, state->response->data.auth.krb5ccname);
1371 done:
1372         return result;
1373 }
1374
1375 static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
1376                                           uint32_t logon_parameters,
1377                                           const char *domain,
1378                                           const char *user,
1379                                           const uint64_t logon_id,
1380                                           const char *client_name,
1381                                           const int client_pid,
1382                                           const DATA_BLOB *challenge,
1383                                           const DATA_BLOB *lm_resp,
1384                                           const DATA_BLOB *nt_resp,
1385                                           const struct tsocket_address *remote,
1386                                           const struct tsocket_address *local,
1387                                           bool interactive,
1388                                           uint8_t *pauthoritative,
1389                                           struct netr_SamInfo3 **pinfo3)
1390 {
1391         struct auth_context *auth_context;
1392         struct auth_serversupplied_info *server_info;
1393         struct auth_usersupplied_info *user_info = NULL;
1394         struct netr_SamInfo3 *info3;
1395         NTSTATUS status;
1396         bool ok;
1397         TALLOC_CTX *frame = talloc_stackframe();
1398
1399         /*
1400          * We are authoritative by default
1401          */
1402         *pauthoritative = 1;
1403
1404         status = make_user_info(frame, &user_info, user, user, domain, domain,
1405                                 lp_netbios_name(), remote, local,
1406                                 "winbind",
1407                                 lm_resp, nt_resp, NULL, NULL,
1408                                 NULL, AUTH_PASSWORD_RESPONSE);
1409         if (!NT_STATUS_IS_OK(status)) {
1410                 DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
1411                 TALLOC_FREE(frame);
1412                 return status;
1413         }
1414
1415         user_info->logon_parameters = logon_parameters;
1416         user_info->logon_id = logon_id;
1417         user_info->auth_description = talloc_asprintf(
1418                 frame, "PASSDB, %s, %d", client_name, client_pid);
1419         if (user_info->auth_description == NULL) {
1420                 TALLOC_FREE(frame);
1421                 return NT_STATUS_NO_MEMORY;
1422         }
1423
1424         /* We don't want any more mapping of the username */
1425         user_info->mapped_state = True;
1426
1427         /* We don't want to come back to winbindd or to do PAM account checks */
1428         user_info->flags |= USER_INFO_INFO3_AND_NO_AUTHZ;
1429
1430         if (interactive) {
1431                 user_info->flags |= USER_INFO_INTERACTIVE_LOGON;
1432         }
1433
1434         status = make_auth3_context_for_winbind(frame, &auth_context);
1435         if (!NT_STATUS_IS_OK(status)) {
1436                 DBG_ERR("make_auth3_context_for_winbind failed: %s\n",
1437                         nt_errstr(status));
1438                 TALLOC_FREE(frame);
1439                 return status;
1440         }
1441
1442         ok = auth3_context_set_challenge(auth_context,
1443                                          challenge->data, "fixed");
1444         if (!ok) {
1445                 TALLOC_FREE(frame);
1446                 return NT_STATUS_NO_MEMORY;
1447         }
1448
1449         status = auth_check_ntlm_password(mem_ctx,
1450                                           auth_context,
1451                                           user_info,
1452                                           &server_info,
1453                                           pauthoritative);
1454         if (!NT_STATUS_IS_OK(status)) {
1455                 TALLOC_FREE(frame);
1456                 return status;
1457         }
1458
1459         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
1460         if (info3 == NULL) {
1461                 TALLOC_FREE(frame);
1462                 return NT_STATUS_NO_MEMORY;
1463         }
1464
1465         status = serverinfo_to_SamInfo3(server_info, info3);
1466         if (!NT_STATUS_IS_OK(status)) {
1467                 TALLOC_FREE(frame);
1468                 TALLOC_FREE(info3);
1469                 DEBUG(0, ("serverinfo_to_SamInfo3 failed: %s\n",
1470                           nt_errstr(status)));
1471                 return status;
1472         }
1473
1474         *pinfo3 = info3;
1475         DEBUG(10, ("Authenticaticating user %s\\%s returned %s\n", domain,
1476                    user, nt_errstr(status)));
1477         TALLOC_FREE(frame);
1478         return status;
1479 }
1480
1481 static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
1482                                             TALLOC_CTX *mem_ctx,
1483                                             uint32_t logon_parameters,
1484                                             const char *username,
1485                                             const char *password,
1486                                             const char *domainname,
1487                                             const char *workstation,
1488                                             const uint64_t logon_id,
1489                                             bool plaintext_given,
1490                                             const uint8_t chal[8],
1491                                             DATA_BLOB lm_response,
1492                                             DATA_BLOB nt_response,
1493                                             bool interactive,
1494                                             uint8_t *authoritative,
1495                                             uint32_t *flags,
1496                                             uint16_t *_validation_level,
1497                                             union netr_Validation **_validation)
1498 {
1499         int attempts = 0;
1500         int netr_attempts = 0;
1501         bool retry = false;
1502         NTSTATUS result;
1503         enum netr_LogonInfoClass logon_type_i;
1504         enum netr_LogonInfoClass logon_type_n;
1505         uint16_t validation_level = UINT16_MAX;
1506         union netr_Validation *validation = NULL;
1507
1508         do {
1509                 struct rpc_pipe_client *netlogon_pipe;
1510                 struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;
1511
1512                 retry = false;
1513
1514                 result = cm_connect_netlogon_secure(domain, &netlogon_pipe,
1515                                                     &netlogon_creds_ctx);
1516
1517                 if (NT_STATUS_EQUAL(result,
1518                                     NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
1519                         /*
1520                          * This means we don't have a trust account.
1521                          */
1522                         *authoritative = 0;
1523                         result = NT_STATUS_NO_SUCH_USER;
1524                         break;
1525                 }
1526
1527                 if (!NT_STATUS_IS_OK(result)) {
1528                         DEBUG(3,("Could not open handle to NETLOGON pipe "
1529                                  "(error: %s, attempts: %d)\n",
1530                                   nt_errstr(result), netr_attempts));
1531
1532                         /* After the first retry always close the connection */
1533                         if (netr_attempts > 0) {
1534                                 DEBUG(3, ("This is again a problem for this "
1535                                           "particular call, forcing the close "
1536                                           "of this connection\n"));
1537                                 invalidate_cm_connection(domain);
1538                         }
1539
1540                         /* After the second retry failover to the next DC */
1541                         if (netr_attempts > 1) {
1542                                 /*
1543                                  * If the netlogon server is not reachable then
1544                                  * it is possible that the DC is rebuilding
1545                                  * sysvol and shutdown netlogon for that time.
1546                                  * We should failover to the next dc.
1547                                  */
1548                                 DEBUG(3, ("This is the third problem for this "
1549                                           "particular call, adding DC to the "
1550                                           "negative cache list: %s %s\n", domain->name, domain->dcname));
1551                                 add_failed_connection_entry(domain->name,
1552                                                             domain->dcname,
1553                                                             result);
1554                                 saf_delete(domain->name);
1555                         }
1556
1557                         /* Only allow 3 retries */
1558                         if (netr_attempts < 3) {
1559                                 DEBUG(3, ("The connection to netlogon "
1560                                           "failed, retrying\n"));
1561                                 netr_attempts++;
1562                                 retry = true;
1563                                 continue;
1564                         }
1565                         return result;
1566                 }
1567
1568                 logon_type_i = NetlogonInteractiveInformation;
1569                 logon_type_n = NetlogonNetworkInformation;
1570                 if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST) {
1571                         logon_type_i = NetlogonInteractiveTransitiveInformation;
1572                         logon_type_n = NetlogonNetworkTransitiveInformation;
1573                 }
1574
1575                 if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
1576                         logon_type_i = NetlogonInteractiveTransitiveInformation;
1577                         logon_type_n = NetlogonNetworkTransitiveInformation;
1578                 }
1579
1580                 if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE) {
1581                         logon_type_i = NetlogonInteractiveInformation;
1582                         logon_type_n = NetlogonNetworkInformation;
1583                 }
1584
1585                 if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) {
1586                         logon_type_i = NetlogonInteractiveInformation;
1587                         logon_type_n = NetlogonNetworkInformation;
1588                 }
1589
1590                 netr_attempts = 0;
1591                 if (plaintext_given) {
1592                         result = rpccli_netlogon_password_logon(
1593                                 netlogon_creds_ctx,
1594                                 netlogon_pipe->binding_handle,
1595                                 mem_ctx,
1596                                 logon_parameters,
1597                                 domainname,
1598                                 username,
1599                                 password,
1600                                 workstation,
1601                                 logon_id,
1602                                 logon_type_i,
1603                                 authoritative,
1604                                 flags,
1605                                 &validation_level,
1606                                 &validation);
1607                 } else if (interactive) {
1608                         result = rpccli_netlogon_interactive_logon(
1609                                 netlogon_creds_ctx,
1610                                 netlogon_pipe->binding_handle,
1611                                 mem_ctx,
1612                                 logon_parameters,
1613                                 username,
1614                                 domainname,
1615                                 workstation,
1616                                 logon_id,
1617                                 lm_response,
1618                                 nt_response,
1619                                 logon_type_i,
1620                                 authoritative,
1621                                 flags,
1622                                 &validation_level,
1623                                 &validation);
1624                 } else {
1625                         result = rpccli_netlogon_network_logon(
1626                                 netlogon_creds_ctx,
1627                                 netlogon_pipe->binding_handle,
1628                                 mem_ctx,
1629                                 logon_parameters,
1630                                 username,
1631                                 domainname,
1632                                 workstation,
1633                                 logon_id,
1634                                 chal,
1635                                 lm_response,
1636                                 nt_response,
1637                                 logon_type_n,
1638                                 authoritative,
1639                                 flags,
1640                                 &validation_level,
1641                                 &validation);
1642                 }
1643
1644                 /*
1645                  * we increment this after the "feature negotiation"
1646                  * for can_do_samlogon_ex and can_do_validation6
1647                  */
1648                 attempts += 1;
1649
1650                 /* We have to try a second time as cm_connect_netlogon
1651                    might not yet have noticed that the DC has killed
1652                    our connection. */
1653
1654                 if (!rpccli_is_connected(netlogon_pipe)) {
1655                         retry = true;
1656                         continue;
1657                 }
1658
1659                 /* if we get access denied, a possible cause was that we had
1660                    an open connection to the DC, but someone changed our
1661                    machine account password out from underneath us using 'net
1662                    rpc changetrustpw' */
1663
1664                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1665                         DEBUG(1,("winbind_samlogon_retry_loop: sam_logon returned "
1666                                  "ACCESS_DENIED.  Maybe the DC has Restrict "
1667                                  "NTLM set or the trust account "
1668                                 "password was changed and we didn't know it. "
1669                                  "Killing connections to domain %s\n",
1670                                 domainname));
1671                         invalidate_cm_connection(domain);
1672                         retry = true;
1673                 }
1674
1675                 if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1676                         /*
1677                          * Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
1678                          * (no Ex). This happens against old Samba
1679                          * DCs, if LogonSamLogonEx() fails with an error
1680                          * e.g. NT_STATUS_NO_SUCH_USER or NT_STATUS_WRONG_PASSWORD.
1681                          *
1682                          * The server will log something like this:
1683                          * api_net_sam_logon_ex: Failed to marshall NET_R_SAM_LOGON_EX.
1684                          *
1685                          * This sets the whole connection into a fault_state mode
1686                          * and all following request get NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE.
1687                          *
1688                          * This also happens to our retry with LogonSamLogonWithFlags()
1689                          * and LogonSamLogon().
1690                          *
1691                          * In order to recover from this situation, we need to
1692                          * drop the connection.
1693                          */
1694                         invalidate_cm_connection(domain);
1695                         result = NT_STATUS_LOGON_FAILURE;
1696                         break;
1697                 }
1698
1699         } while ( (attempts < 2) && retry );
1700
1701         if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT)) {
1702                 DEBUG(3,("winbind_samlogon_retry_loop: sam_network_logon(ex) "
1703                                 "returned NT_STATUS_IO_TIMEOUT after the retry. "
1704                                 "Killing connections to domain %s\n",
1705                         domainname));
1706                 invalidate_cm_connection(domain);
1707         }
1708
1709         if (!NT_STATUS_IS_OK(result)) {
1710                 return result;
1711         }
1712
1713         *_validation_level = validation_level;
1714         *_validation = validation;
1715         return NT_STATUS_OK;
1716 }
1717
1718 static NTSTATUS winbindd_dual_pam_auth_samlogon(
1719         TALLOC_CTX *mem_ctx,
1720         struct winbindd_domain *domain,
1721         const char *user,
1722         const char *pass,
1723         uint64_t logon_id,
1724         const char *client_name,
1725         const int client_pid,
1726         uint32_t request_flags,
1727         const struct tsocket_address *remote,
1728         const struct tsocket_address *local,
1729         uint16_t *_validation_level,
1730         union netr_Validation **_validation)
1731 {
1732
1733         uchar chal[8];
1734         DATA_BLOB lm_resp;
1735         DATA_BLOB nt_resp;
1736         unsigned char local_nt_response[24];
1737         fstring name_namespace, name_domain, name_user;
1738         NTSTATUS result;
1739         uint8_t authoritative = 0;
1740         uint32_t flags = 0;
1741         uint16_t validation_level = 0;
1742         union netr_Validation *validation = NULL;
1743         struct netr_SamBaseInfo *base_info = NULL;
1744         bool ok;
1745
1746         DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1747
1748         /* Parse domain and username */
1749
1750         ok = parse_domain_user(user, name_namespace, name_domain, name_user);
1751         if (!ok) {
1752                 return NT_STATUS_INVALID_PARAMETER;
1753         }
1754
1755         /*
1756          * We check against domain->name instead of
1757          * name_domain, as find_auth_domain() ->
1758          * find_domain_from_name_noinit() already decided
1759          * that we are in a child for the correct domain.
1760          *
1761          * name_domain can also be lp_realm()
1762          * we need to check against domain->name.
1763          */
1764         if (strequal(domain->name, get_global_sam_name())) {
1765                 DATA_BLOB chal_blob = data_blob_const(chal, sizeof(chal));
1766                 struct netr_SamInfo3 *info3 = NULL;
1767
1768                 /* do password magic */
1769
1770                 generate_random_buffer(chal, sizeof(chal));
1771
1772                 if (lp_client_ntlmv2_auth()) {
1773                         DATA_BLOB server_chal;
1774                         DATA_BLOB names_blob;
1775                         server_chal = data_blob_const(chal, 8);
1776
1777                         /* note that the 'workgroup' here is for the local
1778                            machine.  The 'server name' must match the
1779                            'workstation' passed to the actual SamLogon call.
1780                         */
1781                         names_blob = NTLMv2_generate_names_blob(
1782                                 mem_ctx, lp_netbios_name(), lp_workgroup());
1783
1784                         if (!SMBNTLMv2encrypt(mem_ctx, name_user, name_domain,
1785                                               pass,
1786                                               &server_chal,
1787                                               &names_blob,
1788                                               &lm_resp, &nt_resp, NULL, NULL)) {
1789                                 data_blob_free(&names_blob);
1790                                 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1791                                 result = NT_STATUS_NO_MEMORY;
1792                                 goto done;
1793                         }
1794                         data_blob_free(&names_blob);
1795                 } else {
1796                         int rc;
1797                         lm_resp = data_blob_null;
1798                         rc = SMBNTencrypt(pass, chal, local_nt_response);
1799                         if (rc != 0) {
1800                                 DEBUG(0, ("winbindd_pam_auth: SMBNTencrypt() failed!\n"));
1801                                 result = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
1802                                 goto done;
1803                         }
1804
1805                         nt_resp = data_blob_talloc(mem_ctx, local_nt_response,
1806                                                    sizeof(local_nt_response));
1807                 }
1808
1809                 result = winbindd_dual_auth_passdb(
1810                         talloc_tos(), 0, name_domain, name_user,
1811                         logon_id,
1812                         client_name,
1813                         client_pid,
1814                         &chal_blob, &lm_resp, &nt_resp,
1815                         remote,
1816                         local,
1817                         true, /* interactive */
1818                         &authoritative,
1819                         &info3);
1820
1821                 /*
1822                  * We need to try the remote NETLOGON server if this is
1823                  * not authoritative (for example on the RODC).
1824                  */
1825                 if (authoritative != 0) {
1826                         if (NT_STATUS_IS_OK(result)) {
1827                                 result = map_info3_to_validation(
1828                                                 mem_ctx,
1829                                                 info3,
1830                                                 &validation_level,
1831                                                 &validation);
1832                                 TALLOC_FREE(info3);
1833                                 if (!NT_STATUS_IS_OK(result)) {
1834                                         goto done;
1835                                 }
1836                         }
1837
1838                         goto done;
1839                 }
1840         }
1841
1842         /* check authentication loop */
1843
1844         result = winbind_samlogon_retry_loop(domain,
1845                                              mem_ctx,
1846                                              0,
1847                                              name_user,
1848                                              pass,
1849                                              name_domain,
1850                                              lp_netbios_name(),
1851                                              logon_id,
1852                                              true, /* plaintext_given */
1853                                              NULL,
1854                                              data_blob_null, data_blob_null,
1855                                              true, /* interactive */
1856                                              &authoritative,
1857                                              &flags,
1858                                              &validation_level,
1859                                              &validation);
1860         if (!NT_STATUS_IS_OK(result)) {
1861                 goto done;
1862         }
1863
1864         /* handle the case where a NT4 DC does not fill in the acct_flags in
1865          * the samlogon reply info3. When accurate info3 is required by the
1866          * caller, we look up the account flags ourselves - gd */
1867
1868         switch (validation_level) {
1869         case 3:
1870                 base_info = &validation->sam3->base;
1871                 break;
1872         case 6:
1873                 base_info = &validation->sam6->base;
1874                 break;
1875         default:
1876                 DBG_ERR("Bad validation level %d", (int)validation_level);
1877                 result = NT_STATUS_INTERNAL_ERROR;
1878                 goto done;
1879         }
1880         if ((request_flags & WBFLAG_PAM_INFO3_TEXT) &&
1881             (base_info->acct_flags == 0))
1882         {
1883                 struct rpc_pipe_client *samr_pipe;
1884                 struct policy_handle samr_domain_handle, user_pol;
1885                 union samr_UserInfo *info = NULL;
1886                 NTSTATUS status_tmp, result_tmp;
1887                 uint32_t acct_flags;
1888                 struct dcerpc_binding_handle *b;
1889
1890                 status_tmp = cm_connect_sam(domain, mem_ctx, false,
1891                                             &samr_pipe, &samr_domain_handle);
1892
1893                 if (!NT_STATUS_IS_OK(status_tmp)) {
1894                         DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1895                                 nt_errstr(status_tmp)));
1896                         goto done;
1897                 }
1898
1899                 b = samr_pipe->binding_handle;
1900
1901                 status_tmp = dcerpc_samr_OpenUser(b, mem_ctx,
1902                                                   &samr_domain_handle,
1903                                                   MAXIMUM_ALLOWED_ACCESS,
1904                                                   base_info->rid,
1905                                                   &user_pol,
1906                                                   &result_tmp);
1907
1908                 if (!NT_STATUS_IS_OK(status_tmp)) {
1909                         DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1910                                 nt_errstr(status_tmp)));
1911                         goto done;
1912                 }
1913                 if (!NT_STATUS_IS_OK(result_tmp)) {
1914                         DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1915                                 nt_errstr(result_tmp)));
1916                         goto done;
1917                 }
1918
1919                 status_tmp = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1920                                                        &user_pol,
1921                                                        16,
1922                                                        &info,
1923                                                        &result_tmp);
1924
1925                 if (any_nt_status_not_ok(status_tmp, result_tmp,
1926                                          &status_tmp)) {
1927                         DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1928                                 nt_errstr(status_tmp)));
1929                         dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1930                         goto done;
1931                 }
1932
1933                 acct_flags = info->info16.acct_flags;
1934
1935                 if (acct_flags == 0) {
1936                         dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1937                         goto done;
1938                 }
1939
1940                 base_info->acct_flags = acct_flags;
1941
1942                 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1943
1944                 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1945         }
1946
1947 done:
1948         if (NT_STATUS_IS_OK(result)) {
1949                 *_validation_level = validation_level;
1950                 *_validation = validation;
1951         }
1952         return result;
1953 }
1954
1955 /*
1956  * @brief build a tsocket_address for the remote address of the supplied socket
1957  *
1958  */
1959 static struct tsocket_address *get_remote_address(TALLOC_CTX *mem_ctx, int sock)
1960 {
1961         struct sockaddr_storage st = {0};
1962         struct sockaddr *sar = (struct sockaddr *)&st;
1963         socklen_t sa_len = sizeof(st);
1964         struct tsocket_address *remote = NULL;
1965         int ret = 0;
1966
1967         ret = getpeername(sock, sar, &sa_len);
1968         if (ret != 0) {
1969                 DBG_ERR("getpeername failed - %s", strerror(errno));
1970                 return NULL;
1971         }
1972         ret = tsocket_address_bsd_from_sockaddr(mem_ctx, sar, sa_len, &remote);
1973         if (ret != 0) {
1974                 DBG_ERR("tsocket_address_bsd_from_sockaddr failed - %s",
1975                         strerror(errno));
1976                 return NULL;
1977         }
1978         return remote;
1979 }
1980
1981 /*
1982  * @brief build a tsocket_address for the local address of the supplied socket
1983  *
1984  */
1985 static struct tsocket_address *get_local_address(TALLOC_CTX *mem_ctx, int sock)
1986 {
1987         struct sockaddr_storage st = {0};
1988         struct sockaddr *sar = (struct sockaddr *)&st;
1989         socklen_t sa_len = sizeof(st);
1990         struct tsocket_address *local = NULL;
1991         int ret = 0;
1992
1993         ret = getsockname(sock, sar, &sa_len);
1994         if (ret != 0) {
1995                 DBG_ERR("getsockname failed - %s", strerror(errno));
1996                 return NULL;
1997         }
1998         ret = tsocket_address_bsd_from_sockaddr(mem_ctx, sar, sa_len, &local);
1999         if (ret != 0) {
2000                 DBG_ERR("tsocket_address_bsd_from_sockaddr failed - %s",
2001                         strerror(errno));
2002                 return NULL;
2003         }
2004         return local;
2005 }
2006
2007 /*
2008  * @brief generate an authentication message in the logs.
2009  *
2010  */
2011 static void log_authentication(
2012         TALLOC_CTX *mem_ctx,
2013         const struct winbindd_domain *domain,
2014         const struct winbindd_cli_state *state,
2015         const struct timeval start_time,
2016         const uint64_t logon_id,
2017         const char *command,
2018         const char *user_name,
2019         const char *domain_name,
2020         const char *workstation,
2021         const DATA_BLOB lm_resp,
2022         const DATA_BLOB nt_resp,
2023         const struct tsocket_address *remote,
2024         const struct tsocket_address *local,
2025         NTSTATUS result)
2026 {
2027
2028         struct auth_usersupplied_info *ui = NULL;
2029         struct dom_sid *sid = NULL;
2030         struct loadparm_context *lp_ctx = NULL;
2031         struct imessaging_context *msg_ctx = NULL;
2032
2033         ui = talloc_zero(mem_ctx, struct auth_usersupplied_info);
2034         ui->logon_id = logon_id;
2035         ui->service_description = "winbind";
2036         ui->password.response.nt.length = nt_resp.length;
2037         ui->password.response.nt.data = nt_resp.data;
2038         ui->password.response.lanman.length = lm_resp.length;
2039         ui->password.response.lanman.data = lm_resp.data;
2040         if (nt_resp.length == 0 && lm_resp.length == 0) {
2041                 ui->password_state = AUTH_PASSWORD_PLAIN;
2042         } else {
2043                 ui->password_state = AUTH_PASSWORD_RESPONSE;
2044         }
2045         /*
2046          * In the event of a failure ui->auth_description will be null,
2047          * the logging code handles this correctly so it can be ignored.
2048          */
2049         ui->auth_description = talloc_asprintf(
2050                 ui,
2051                 "%s, %s, %d",
2052                 command,
2053                 state->request->client_name,
2054                 state->pid);
2055         if (ui->auth_description == NULL) {
2056                 DBG_ERR("OOM Unable to create auth_description");
2057         }
2058         ui->client.account_name = user_name;
2059         ui->client.domain_name = domain_name;
2060         ui->workstation_name = workstation;
2061         ui->remote_host = remote;
2062         ui->local_host = local;
2063
2064         sid = dom_sid_parse_talloc(
2065             ui, state->response->data.auth.info3.dom_sid);
2066         if (sid != NULL) {
2067                 sid_append_rid(sid, state->response->data.auth.info3.user_rid);
2068         }
2069
2070         if (lp_auth_event_notification()) {
2071                 lp_ctx = loadparm_init_s3(ui, loadparm_s3_helpers());
2072                 msg_ctx = imessaging_client_init(
2073                     ui, lp_ctx, global_event_context());
2074         }
2075         log_authentication_event(
2076             msg_ctx,
2077             lp_ctx,
2078             &start_time,
2079             ui,
2080             result,
2081             state->response->data.auth.info3.logon_dom,
2082             state->response->data.auth.info3.user_name,
2083             sid);
2084         TALLOC_FREE(ui);
2085 }
2086
2087 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
2088                                             struct winbindd_cli_state *state)
2089 {
2090         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
2091         NTSTATUS krb5_result = NT_STATUS_OK;
2092         fstring name_namespace, name_domain, name_user;
2093         char *mapped_user;
2094         fstring domain_user;
2095         uint16_t validation_level = UINT16_MAX;
2096         union netr_Validation *validation = NULL;
2097         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
2098         bool ok;
2099         uint64_t logon_id = 0;
2100         const struct timeval start_time = timeval_current();
2101         const struct tsocket_address *remote = NULL;
2102         const struct tsocket_address *local = NULL;
2103
2104         /* Ensure null termination */
2105         state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0';
2106
2107         /* Ensure null termination */
2108         state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0';
2109
2110         /*
2111          * Generate a logon_id for this session.
2112          */
2113         logon_id = generate_random_u64();
2114         remote = get_remote_address(state->mem_ctx, state->sock);
2115         local = get_local_address(state->mem_ctx, state->sock);
2116         DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
2117                   state->request->data.auth.user));
2118
2119         /* Parse domain and username */
2120
2121         name_map_status = normalize_name_unmap(state->mem_ctx,
2122                                                state->request->data.auth.user,
2123                                                &mapped_user);
2124
2125         /* If the name normalization didn't actually do anything,
2126            just use the original name */
2127
2128         if (!NT_STATUS_IS_OK(name_map_status) &&
2129             !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
2130         {
2131                 mapped_user = state->request->data.auth.user;
2132         }
2133
2134         ok = parse_domain_user(mapped_user,
2135                                name_namespace,
2136                                name_domain,
2137                                name_user);
2138         if (!ok) {
2139                 result = NT_STATUS_INVALID_PARAMETER;
2140                 goto process_result;
2141         }
2142
2143         if ( mapped_user != state->request->data.auth.user ) {
2144                 fstr_sprintf( domain_user, "%s%c%s", name_domain,
2145                         *lp_winbind_separator(),
2146                         name_user );
2147                 strlcpy( state->request->data.auth.user, domain_user,
2148                              sizeof(state->request->data.auth.user));
2149         }
2150
2151         if (!domain->online) {
2152                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
2153                 if (domain->startup) {
2154                         /* Logons are very important to users. If we're offline and
2155                            we get a request within the first 30 seconds of startup,
2156                            try very hard to find a DC and go online. */
2157
2158                         DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
2159                                 "request in startup mode.\n", domain->name ));
2160
2161                         winbindd_flush_negative_conn_cache(domain);
2162                         result = init_dc_connection(domain, false);
2163                 }
2164         }
2165
2166         DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
2167
2168         /* Check for Kerberos authentication */
2169         if (domain->online && (state->request->flags & WBFLAG_PAM_KRB5)) {
2170                 struct netr_SamInfo6 *info6 = NULL;
2171
2172                 result = winbindd_dual_pam_auth_kerberos(domain, state, &info6);
2173                 /* save for later */
2174                 krb5_result = result;
2175
2176                 if (NT_STATUS_IS_OK(result)) {
2177                         DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
2178
2179                         result = map_info6_to_validation(state->mem_ctx,
2180                                                          info6,
2181                                                          &validation_level,
2182                                                          &validation);
2183                         TALLOC_FREE(info6);
2184                         if (!NT_STATUS_IS_OK(result)) {
2185                                 DBG_ERR("map_info6_to_validation failed\n");
2186                                 goto done;
2187                         }
2188                         goto process_result;
2189                 }
2190
2191                 DBG_DEBUG("winbindd_dual_pam_auth_kerberos failed: %s\n",
2192                           nt_errstr(result));
2193
2194                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
2195                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2196                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
2197                         DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
2198                         set_domain_offline( domain );
2199                         goto cached_logon;
2200                 }
2201
2202                 /* there are quite some NT_STATUS errors where there is no
2203                  * point in retrying with a samlogon, we explictly have to take
2204                  * care not to increase the bad logon counter on the DC */
2205
2206                 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
2207                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
2208                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
2209                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
2210                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
2211                     NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
2212                     NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
2213                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
2214                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
2215                     NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
2216                         goto done;
2217                 }
2218
2219                 if (state->request->flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
2220                         DEBUG(3,("falling back to samlogon\n"));
2221                         goto sam_logon;
2222                 } else {
2223                         goto cached_logon;
2224                 }
2225         }
2226
2227 sam_logon:
2228         /* Check for Samlogon authentication */
2229         if (domain->online) {
2230                 struct netr_SamBaseInfo *base_info = NULL;
2231
2232                 result = winbindd_dual_pam_auth_samlogon(
2233                         state->mem_ctx, domain,
2234                         state->request->data.auth.user,
2235                         state->request->data.auth.pass,
2236                         logon_id,
2237                         state->request->client_name,
2238                         state->pid,
2239                         state->request->flags,
2240                         remote,
2241                         local,
2242                         &validation_level,
2243                         &validation);
2244
2245                 if (NT_STATUS_IS_OK(result)) {
2246                         DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
2247
2248                         switch (validation_level) {
2249                         case 3:
2250                                 base_info = &validation->sam3->base;
2251                                 break;
2252                         case 6:
2253                                 base_info = &validation->sam6->base;
2254                                 break;
2255                         default:
2256                                 DBG_ERR("Bad validation level %d\n",
2257                                         validation_level);
2258                                 result = NT_STATUS_INTERNAL_ERROR;
2259                                 goto done;
2260                         }
2261
2262                         /* add the Krb5 err if we have one */
2263                         if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
2264                                 base_info->user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
2265                         }
2266
2267                         goto process_result;
2268                 }
2269
2270                 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
2271                           nt_errstr(result)));
2272
2273                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
2274                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
2275                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
2276                 {
2277                         DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
2278                         set_domain_offline( domain );
2279                         goto cached_logon;
2280                 }
2281
2282                 if (domain->online) {
2283                         /* We're still online - fail. */
2284                         goto done;
2285                 }
2286         }
2287
2288 cached_logon:
2289         /* Check for Cached logons */
2290         if (!domain->online && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN) &&
2291             lp_winbind_offline_logon()) {
2292                 struct netr_SamInfo3 *info3 = NULL;
2293
2294                 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
2295
2296                 if (!NT_STATUS_IS_OK(result)) {
2297                         DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
2298                         goto done;
2299                 }
2300                 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
2301
2302                 result = map_info3_to_validation(state->mem_ctx,
2303                                                  info3,
2304                                                  &validation_level,
2305                                                  &validation);
2306                 TALLOC_FREE(info3);
2307                 if (!NT_STATUS_IS_OK(result)) {
2308                         DBG_ERR("map_info3_to_validation failed\n");
2309                         goto done;
2310                 }
2311         }
2312
2313 process_result:
2314
2315         if (NT_STATUS_IS_OK(result)) {
2316                 struct dom_sid user_sid;
2317                 TALLOC_CTX *base_ctx = NULL;
2318                 struct netr_SamBaseInfo *base_info = NULL;
2319                 struct netr_SamInfo3 *info3 = NULL;
2320
2321                 switch (validation_level) {
2322                 case 3:
2323                         base_ctx = validation->sam3;
2324                         base_info = &validation->sam3->base;
2325                         break;
2326                 case 6:
2327                         base_ctx = validation->sam6;
2328                         base_info = &validation->sam6->base;
2329                         break;
2330                 default:
2331                         result = NT_STATUS_INTERNAL_ERROR;
2332                         goto done;
2333                 }
2334
2335                 sid_compose(&user_sid, base_info->domain_sid, base_info->rid);
2336
2337                 if (base_info->full_name.string == NULL) {
2338                         struct netr_SamInfo3 *cached_info3;
2339
2340                         cached_info3 = netsamlogon_cache_get(state->mem_ctx,
2341                                                              &user_sid);
2342                         if (cached_info3 != NULL &&
2343                             cached_info3->base.full_name.string != NULL) {
2344                                 base_info->full_name.string = talloc_strdup(
2345                                         base_ctx,
2346                                         cached_info3->base.full_name.string);
2347                                 if (base_info->full_name.string == NULL) {
2348                                         result = NT_STATUS_NO_MEMORY;
2349                                         goto done;
2350                                 }
2351                         } else {
2352
2353                                 /* this might fail so we don't check the return code */
2354                                 wcache_query_user_fullname(domain,
2355                                                 base_ctx,
2356                                                 &user_sid,
2357                                                 &base_info->full_name.string);
2358                         }
2359                 }
2360
2361                 result = map_validation_to_info3(talloc_tos(),
2362                                                  validation_level,
2363                                                  validation,
2364                                                  &info3);
2365                 if (!NT_STATUS_IS_OK(result)) {
2366                         goto done;
2367                 }
2368
2369                 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
2370                                            &user_sid);
2371                 netsamlogon_cache_store(name_user, info3);
2372
2373                 /* save name_to_sid info as early as possible (only if
2374                    this is our primary domain so we don't invalidate
2375                    the cache entry by storing the seq_num for the wrong
2376                    domain). */
2377                 if ( domain->primary ) {
2378                         cache_name2sid(domain, name_domain, name_user,
2379                                        SID_NAME_USER, &user_sid);
2380                 }
2381
2382                 /* Check if the user is in the right group */
2383
2384                 result = check_info3_in_group(
2385                         info3,
2386                         state->request->data.auth.require_membership_of_sid);
2387                 if (!NT_STATUS_IS_OK(result)) {
2388                         DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
2389                                   state->request->data.auth.user,
2390                                   state->request->data.auth.require_membership_of_sid));
2391                         goto done;
2392                 }
2393
2394                 result = append_auth_data(state->mem_ctx, state->response,
2395                                           state->request->flags,
2396                                           validation_level,
2397                                           validation,
2398                                           name_domain, name_user);
2399                 if (!NT_STATUS_IS_OK(result)) {
2400                         goto done;
2401                 }
2402
2403                 if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
2404                     && lp_winbind_offline_logon()) {
2405
2406                         result = winbindd_store_creds(domain,
2407                                                       state->request->data.auth.user,
2408                                                       state->request->data.auth.pass,
2409                                                       info3);
2410                 }
2411
2412                 if (state->request->flags & WBFLAG_PAM_GET_PWD_POLICY) {
2413                         /*
2414                          * WBFLAG_PAM_GET_PWD_POLICY is not used within
2415                          * any Samba caller anymore.
2416                          *
2417                          * We just fake this based on the effective values
2418                          * for the user, for legacy callers.
2419                          */
2420                         fake_password_policy(state->response, &info3->base);
2421                 }
2422
2423                 result = NT_STATUS_OK;
2424         }
2425
2426 done:
2427         /* give us a more useful (more correct?) error code */
2428         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
2429             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
2430                 result = NT_STATUS_NO_LOGON_SERVERS;
2431         }
2432
2433         set_auth_errors(state->response, result);
2434
2435         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
2436               state->request->data.auth.user,
2437               state->response->data.auth.nt_status_string,
2438               state->response->data.auth.pam_error));
2439
2440         /*
2441          * Log the winbind pam authentication, the logon_id will tie this to
2442          * any of the logons invoked from this request.
2443          */
2444         log_authentication(
2445             state->mem_ctx,
2446             domain,
2447             state,
2448             start_time,
2449             logon_id,
2450             "PAM_AUTH",
2451             name_user,
2452             name_domain,
2453             NULL,
2454             data_blob_null,
2455             data_blob_null,
2456             remote,
2457             local,
2458             result);
2459
2460         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2461 }
2462
2463 NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain,
2464                                TALLOC_CTX *mem_ctx,
2465                                bool interactive,
2466                                uint32_t logon_parameters,
2467                                const char *name_user,
2468                                const char *name_domain,
2469                                const char *workstation,
2470                                const uint64_t logon_id,
2471                                const char* client_name,
2472                                const int client_pid,
2473                                const uint8_t chal[8],
2474                                DATA_BLOB lm_response,
2475                                DATA_BLOB nt_response,
2476                                const struct tsocket_address *remote,
2477                                const struct tsocket_address *local,
2478                                uint8_t *authoritative,
2479                                bool skip_sam,
2480                                uint32_t *flags,
2481                                uint16_t *_validation_level,
2482                                union netr_Validation **_validation)
2483 {
2484         uint16_t validation_level = 0;
2485         union netr_Validation *validation = NULL;
2486         NTSTATUS result;
2487
2488         /*
2489          * We check against domain->name instead of
2490          * name_domain, as find_auth_domain() ->
2491          * find_domain_from_name_noinit() already decided
2492          * that we are in a child for the correct domain.
2493          *
2494          * name_domain can also be lp_realm()
2495          * we need to check against domain->name.
2496          */
2497         if (!skip_sam && strequal(domain->name, get_global_sam_name())) {
2498                 DATA_BLOB chal_blob = data_blob_const(
2499                         chal, 8);
2500                 struct netr_SamInfo3 *info3 = NULL;
2501
2502                 result = winbindd_dual_auth_passdb(
2503                         talloc_tos(),
2504                         logon_parameters,
2505                         name_domain, name_user,
2506                         logon_id,
2507                         client_name,
2508                         client_pid,
2509                         &chal_blob, &lm_response, &nt_response,
2510                         remote,
2511                         local,
2512                         interactive,
2513                         authoritative,
2514                         &info3);
2515                 if (NT_STATUS_IS_OK(result)) {
2516                         result = map_info3_to_validation(mem_ctx,
2517                                                          info3,
2518                                                          &validation_level,
2519                                                          &validation);
2520                         TALLOC_FREE(info3);
2521                         if (!NT_STATUS_IS_OK(result)) {
2522                                 goto done;
2523                         }
2524                 }
2525
2526                 /*
2527                  * We need to try the remote NETLOGON server if this is
2528                  * not authoritative.
2529                  */
2530                 if (*authoritative != 0) {
2531                         *flags = 0;
2532                         goto process_result;
2533                 }
2534         }
2535
2536         result = winbind_samlogon_retry_loop(domain,
2537                                              mem_ctx,
2538                                              logon_parameters,
2539                                              name_user,
2540                                              NULL, /* password */
2541                                              name_domain,
2542                                              /* Bug #3248 - found by Stefan Burkei. */
2543                                              workstation, /* We carefully set this above so use it... */
2544                                              logon_id,
2545                                              false, /* plaintext_given */
2546                                              chal,
2547                                              lm_response,
2548                                              nt_response,
2549                                              interactive,
2550                                              authoritative,
2551                                              flags,
2552                                              &validation_level,
2553                                              &validation);
2554         if (!NT_STATUS_IS_OK(result)) {
2555                 goto done;
2556         }
2557
2558 process_result:
2559
2560         if (NT_STATUS_IS_OK(result)) {
2561                 struct dom_sid user_sid;
2562                 TALLOC_CTX *base_ctx = NULL;
2563                 struct netr_SamBaseInfo *base_info = NULL;
2564                 struct netr_SamInfo3 *info3 = NULL;
2565
2566                 switch (validation_level) {
2567                 case 3:
2568                         base_ctx = validation->sam3;
2569                         base_info = &validation->sam3->base;
2570                         break;
2571                 case 6:
2572                         base_ctx = validation->sam6;
2573                         base_info = &validation->sam6->base;
2574                         break;
2575                 default:
2576                         result = NT_STATUS_INTERNAL_ERROR;
2577                         goto done;
2578                 }
2579
2580                 sid_compose(&user_sid, base_info->domain_sid, base_info->rid);
2581
2582                 if (base_info->full_name.string == NULL) {
2583                         struct netr_SamInfo3 *cached_info3;
2584
2585                         cached_info3 = netsamlogon_cache_get(mem_ctx,
2586                                                              &user_sid);
2587                         if (cached_info3 != NULL &&
2588                             cached_info3->base.full_name.string != NULL)
2589                         {
2590                                 base_info->full_name.string = talloc_strdup(
2591                                         base_ctx,
2592                                         cached_info3->base.full_name.string);
2593                         } else {
2594
2595                                 /* this might fail so we don't check the return code */
2596                                 wcache_query_user_fullname(domain,
2597                                                 base_ctx,
2598                                                 &user_sid,
2599                                                 &base_info->full_name.string);
2600                         }
2601                 }
2602
2603                 result = map_validation_to_info3(talloc_tos(),
2604                                                  validation_level,
2605                                                  validation,
2606                                                  &info3);
2607                 if (!NT_STATUS_IS_OK(result)) {
2608                         goto done;
2609                 }
2610                 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
2611                                            &user_sid);
2612                 netsamlogon_cache_store(name_user, info3);
2613                 TALLOC_FREE(info3);
2614         }
2615
2616 done:
2617
2618         /* give us a more useful (more correct?) error code */
2619         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
2620             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
2621                 result = NT_STATUS_NO_LOGON_SERVERS;
2622         }
2623
2624         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2625               ("NTLM CRAP authentication for user [%s]\\[%s] returned %s\n",
2626                name_domain,
2627                name_user,
2628                nt_errstr(result)));
2629
2630         if (!NT_STATUS_IS_OK(result)) {
2631                 return result;
2632         }
2633
2634         *_validation_level = validation_level;
2635         *_validation = validation;
2636         return NT_STATUS_OK;
2637 }
2638
2639 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
2640                                                  struct winbindd_cli_state *state)
2641 {
2642         NTSTATUS result;
2643         const char *name_user = NULL;
2644         const char *name_domain = NULL;
2645         const char *workstation;
2646         uint64_t logon_id = 0;
2647         uint8_t authoritative = 0;
2648         uint32_t flags = 0;
2649         uint16_t validation_level;
2650         union netr_Validation *validation = NULL;
2651         DATA_BLOB lm_resp = { 0 }, nt_resp = { 0 };
2652         const struct timeval start_time = timeval_current();
2653         const struct tsocket_address *remote = NULL;
2654         const struct tsocket_address *local = NULL;
2655
2656         /* This is child-only, so no check for privileged access is needed
2657            anymore */
2658
2659         /* Ensure null termination */
2660         state->request->data.auth_crap.user[sizeof(state->request->data.auth_crap.user)-1]=0;
2661         state->request->data.auth_crap.domain[sizeof(state->request->data.auth_crap.domain)-1]=0;
2662
2663         name_user = state->request->data.auth_crap.user;
2664         name_domain = state->request->data.auth_crap.domain;
2665         workstation = state->request->data.auth_crap.workstation;
2666         logon_id = generate_random_u64();
2667         remote = get_remote_address(state->mem_ctx, state->sock);
2668         local = get_local_address(state->mem_ctx, state->sock);
2669
2670         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
2671                   name_domain, name_user));
2672
2673         if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
2674                 || state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
2675                 if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
2676                      state->request->extra_len != state->request->data.auth_crap.nt_resp_len) {
2677                         DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
2678                                   state->request->data.auth_crap.lm_resp_len,
2679                                   state->request->data.auth_crap.nt_resp_len));
2680                         result = NT_STATUS_INVALID_PARAMETER;
2681                         goto done;
2682                 }
2683         }
2684
2685         lm_resp = data_blob_talloc(state->mem_ctx, state->request->data.auth_crap.lm_resp,
2686                                         state->request->data.auth_crap.lm_resp_len);
2687
2688         if (state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) {
2689                 nt_resp = data_blob_talloc(state->mem_ctx,
2690                                            state->request->extra_data.data,
2691                                            state->request->data.auth_crap.nt_resp_len);
2692         } else {
2693                 nt_resp = data_blob_talloc(state->mem_ctx,
2694                                            state->request->data.auth_crap.nt_resp,
2695                                            state->request->data.auth_crap.nt_resp_len);
2696         }
2697
2698         result = winbind_dual_SamLogon(domain,
2699                                        state->mem_ctx,
2700                                        false, /* interactive */
2701                                        state->request->data.auth_crap.logon_parameters,
2702                                        name_user,
2703                                        name_domain,
2704                                        /* Bug #3248 - found by Stefan Burkei. */
2705                                        workstation, /* We carefully set this above so use it... */
2706                                        logon_id,
2707                                        state->request->client_name,
2708                                        state->request->pid,
2709                                        state->request->data.auth_crap.chal,
2710                                        lm_resp,
2711                                        nt_resp,
2712                                        remote,
2713                                        local,
2714                                        &authoritative,
2715                                        false,
2716                                        &flags,
2717                                        &validation_level,
2718                                        &validation);
2719         if (!NT_STATUS_IS_OK(result)) {
2720                 state->response->data.auth.authoritative = authoritative;
2721                 goto done;
2722         }
2723
2724         if (NT_STATUS_IS_OK(result)) {
2725                 struct netr_SamInfo3 *info3 = NULL;
2726
2727                 result = map_validation_to_info3(state->mem_ctx,
2728                                                  validation_level,
2729                                                  validation,
2730                                                  &info3);
2731                 if (!NT_STATUS_IS_OK(result)) {
2732                         goto done;
2733                 }
2734
2735                 /* Check if the user is in the right group */
2736                 result = check_info3_in_group(
2737                         info3,
2738                         state->request->data.auth_crap.require_membership_of_sid);
2739                 if (!NT_STATUS_IS_OK(result)) {
2740                         DEBUG(3, ("User %s is not in the required group (%s), so "
2741                                   "crap authentication is rejected\n",
2742                                   state->request->data.auth_crap.user,
2743                                   state->request->data.auth_crap.require_membership_of_sid));
2744                         goto done;
2745                 }
2746
2747                 result = append_auth_data(state->mem_ctx, state->response,
2748                                           state->request->flags,
2749                                           validation_level,
2750                                           validation,
2751                                           name_domain, name_user);
2752                 if (!NT_STATUS_IS_OK(result)) {
2753                         goto done;
2754                 }
2755         }
2756
2757 done:
2758
2759         if (state->request->flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
2760                 result = nt_status_squash(result);
2761         }
2762
2763         set_auth_errors(state->response, result);
2764         /*
2765          * Log the winbind pam authentication, the logon_id will tie this to
2766          * any of the logons invoked from this request.
2767          */
2768         log_authentication(
2769             state->mem_ctx,
2770             domain,
2771             state,
2772             start_time,
2773             logon_id,
2774             "NTLM_AUTH",
2775             name_user,
2776             name_domain,
2777             workstation,
2778             lm_resp,
2779             nt_resp,
2780             remote,
2781             local,
2782             result);
2783
2784         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2785 }
2786
2787 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
2788                                                  struct winbindd_cli_state *state)
2789 {
2790         char *oldpass;
2791         char *newpass = NULL;
2792         struct policy_handle dom_pol;
2793         struct rpc_pipe_client *cli = NULL;
2794         bool got_info = false;
2795         struct samr_DomInfo1 *info = NULL;
2796         struct userPwdChangeFailureInformation *reject = NULL;
2797         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2798         fstring namespace, domain, user;
2799         struct dcerpc_binding_handle *b = NULL;
2800         bool ok;
2801
2802         ZERO_STRUCT(dom_pol);
2803
2804         DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
2805                   state->request->data.auth.user));
2806
2807         ok = parse_domain_user(state->request->data.chauthtok.user,
2808                                namespace,
2809                                domain,
2810                                user);
2811         if (!ok) {
2812                 goto done;
2813         }
2814
2815         /* Change password */
2816
2817         oldpass = state->request->data.chauthtok.oldpass;
2818         newpass = state->request->data.chauthtok.newpass;
2819
2820         /* Initialize reject reason */
2821         state->response->data.auth.reject_reason = Undefined;
2822
2823         /* Get sam handle */
2824
2825         result = cm_connect_sam(contact_domain, state->mem_ctx, true, &cli,
2826                                 &dom_pol);
2827         if (!NT_STATUS_IS_OK(result)) {
2828                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2829                 goto done;
2830         }
2831
2832         b = cli->binding_handle;
2833
2834         result = rpccli_samr_chgpasswd_user3(cli, state->mem_ctx,
2835                                              user,
2836                                              newpass,
2837                                              oldpass,
2838                                              &info,
2839                                              &reject);
2840
2841         /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2842
2843         if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
2844
2845                 fill_in_password_policy(state->response, info);
2846
2847                 state->response->data.auth.reject_reason =
2848                         reject->extendedFailureReason;
2849
2850                 got_info = true;
2851         }
2852
2853         /* atm the pidl generated rpccli_samr_ChangePasswordUser3 function will
2854          * return with NT_STATUS_BUFFER_TOO_SMALL for w2k dcs as w2k just
2855          * returns with 4byte error code (NT_STATUS_NOT_SUPPORTED) which is too
2856          * short to comply with the samr_ChangePasswordUser3 idl - gd */
2857
2858         /* only fallback when the chgpasswd_user3 call is not supported */
2859         if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
2860             NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) ||
2861             NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL) ||
2862             NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
2863
2864                 DEBUG(10,("Password change with chgpasswd_user3 failed with: %s, retrying chgpasswd_user2\n",
2865                         nt_errstr(result)));
2866
2867                 result = rpccli_samr_chgpasswd_user2(cli, state->mem_ctx, user, newpass, oldpass);
2868
2869                 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2870                    Map to the same status code as Windows 2003. */
2871
2872                 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2873                         result = NT_STATUS_PASSWORD_RESTRICTION;
2874                 }
2875         }
2876
2877 done:
2878
2879         if (NT_STATUS_IS_OK(result)
2880             && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
2881             && lp_winbind_offline_logon()) {
2882                 result = winbindd_update_creds_by_name(contact_domain, user,
2883                                                        newpass);
2884                 /* Again, this happens when we login from gdm or xdm
2885                  * and the password expires, *BUT* cached crendentials
2886                  * doesn't exist. winbindd_update_creds_by_name()
2887                  * returns NT_STATUS_NO_SUCH_USER.
2888                  * This is not a failure.
2889                  * --- BoYang
2890                  * */
2891                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
2892                         result = NT_STATUS_OK;
2893                 }
2894
2895                 if (!NT_STATUS_IS_OK(result)) {
2896                         DEBUG(10, ("Failed to store creds: %s\n",
2897                                    nt_errstr(result)));
2898                         goto process_result;
2899                 }
2900         }
2901
2902         if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2903
2904                 NTSTATUS policy_ret;
2905
2906                 policy_ret = fillup_password_policy(
2907                         contact_domain, state->response);
2908
2909                 /* failure of this is non critical, it will just provide no
2910                  * additional information to the client why the change has
2911                  * failed - Guenther */
2912
2913                 if (!NT_STATUS_IS_OK(policy_ret)) {
2914                         DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2915                         goto process_result;
2916                 }
2917         }
2918
2919 process_result:
2920
2921         if (strequal(contact_domain->name, get_global_sam_name())) {
2922                 /* FIXME: internal rpc pipe does not cache handles yet */
2923                 if (b) {
2924                         if (is_valid_policy_hnd(&dom_pol)) {
2925                                 NTSTATUS _result;
2926                                 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
2927                         }
2928                         TALLOC_FREE(cli);
2929                 }
2930         }
2931
2932         set_auth_errors(state->response, result);
2933
2934         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2935               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2936                domain,
2937                user,
2938                state->response->data.auth.nt_status_string,
2939                state->response->data.auth.pam_error));
2940
2941         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2942 }
2943
2944 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2945                                               struct winbindd_cli_state *state)
2946 {
2947         NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2948
2949         DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2950                 state->request->data.logoff.user));
2951
2952         if (!(state->request->flags & WBFLAG_PAM_KRB5)) {
2953                 result = NT_STATUS_OK;
2954                 goto process_result;
2955         }
2956
2957         if (state->request->data.logoff.krb5ccname[0] == '\0') {
2958                 result = NT_STATUS_OK;
2959                 goto process_result;
2960         }
2961
2962 #ifdef HAVE_KRB5
2963
2964         if (state->request->data.logoff.uid == (uid_t)-1) {
2965                 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2966                 goto process_result;
2967         }
2968
2969         /* what we need here is to find the corresponding krb5 ccache name *we*
2970          * created for a given username and destroy it */
2971
2972         if (!ccache_entry_exists(state->request->data.logoff.user)) {
2973                 result = NT_STATUS_OK;
2974                 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2975                 goto process_result;
2976         }
2977
2978         if (!ccache_entry_identical(state->request->data.logoff.user,
2979                                         state->request->data.logoff.uid,
2980                                         state->request->data.logoff.krb5ccname)) {
2981                 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2982                 goto process_result;
2983         }
2984
2985         result = remove_ccache(state->request->data.logoff.user);
2986         if (!NT_STATUS_IS_OK(result)) {
2987                 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2988                         nt_errstr(result)));
2989                 goto process_result;
2990         }
2991
2992         /*
2993          * Remove any mlock'ed memory creds in the child
2994          * we might be using for krb5 ticket renewal.
2995          */
2996
2997         winbindd_delete_memory_creds(state->request->data.logoff.user);
2998
2999 #else
3000         result = NT_STATUS_NOT_SUPPORTED;
3001 #endif
3002
3003 process_result:
3004
3005
3006         set_auth_errors(state->response, result);
3007
3008         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
3009 }
3010
3011 /* Change user password with auth crap*/
3012
3013 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
3014 {
3015         NTSTATUS result;
3016         DATA_BLOB new_nt_password;
3017         DATA_BLOB old_nt_hash_enc;
3018         DATA_BLOB new_lm_password;
3019         DATA_BLOB old_lm_hash_enc;
3020         fstring  namespace, domain, user;
3021         struct policy_handle dom_pol;
3022         struct winbindd_domain *contact_domain = domainSt;
3023         struct rpc_pipe_client *cli = NULL;
3024         struct dcerpc_binding_handle *b = NULL;
3025
3026         ZERO_STRUCT(dom_pol);
3027
3028         /* Ensure null termination */
3029         state->request->data.chng_pswd_auth_crap.user[
3030                 sizeof(state->request->data.chng_pswd_auth_crap.user)-1]=0;
3031         state->request->data.chng_pswd_auth_crap.domain[
3032                 sizeof(state->request->data.chng_pswd_auth_crap.domain)-1]=0;
3033         domain[0] = '\0';
3034         namespace[0] = '\0';
3035         user[0] = '\0';
3036
3037         DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
3038                   (unsigned long)state->pid,
3039                   state->request->data.chng_pswd_auth_crap.domain,
3040                   state->request->data.chng_pswd_auth_crap.user));
3041
3042         if (lp_winbind_offline_logon()) {
3043                 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
3044                 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
3045                 result = NT_STATUS_ACCESS_DENIED;
3046                 goto done;
3047         }
3048
3049         if (*state->request->data.chng_pswd_auth_crap.domain) {
3050                 fstrcpy(domain,state->request->data.chng_pswd_auth_crap.domain);
3051         } else {
3052                 bool ok;
3053
3054                 ok = parse_domain_user(state->request->data.chng_pswd_auth_crap.user,
3055                                        namespace,
3056                                        domain,
3057                                        user);
3058                 if (!ok) {
3059                         result = NT_STATUS_INVALID_PARAMETER;
3060                         goto done;
3061                 }
3062
3063                 if(!*domain) {
3064                         DEBUG(3,("no domain specified with username (%s) - "
3065                                  "failing auth\n",
3066                                  state->request->data.chng_pswd_auth_crap.user));
3067                         result = NT_STATUS_NO_SUCH_USER;
3068                         goto done;
3069                 }
3070         }
3071
3072         if (!*domain && lp_winbind_use_default_domain()) {
3073                 fstrcpy(domain,lp_workgroup());
3074         }
3075
3076         if(!*user) {
3077                 fstrcpy(user, state->request->data.chng_pswd_auth_crap.user);
3078         }
3079
3080         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
3081                   (unsigned long)state->pid, domain, user));
3082
3083         /* Change password */
3084         new_nt_password = data_blob_const(
3085                 state->request->data.chng_pswd_auth_crap.new_nt_pswd,
3086                 state->request->data.chng_pswd_auth_crap.new_nt_pswd_len);
3087
3088         old_nt_hash_enc = data_blob_const(
3089                 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc,
3090                 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc_len);
3091
3092         if(state->request->data.chng_pswd_auth_crap.new_lm_pswd_len > 0)        {
3093                 new_lm_password = data_blob_const(
3094                         state->request->data.chng_pswd_auth_crap.new_lm_pswd,
3095                         state->request->data.chng_pswd_auth_crap.new_lm_pswd_len);
3096
3097                 old_lm_hash_enc = data_blob_const(
3098                         state->request->data.chng_pswd_auth_crap.old_lm_hash_enc,
3099                         state->request->data.chng_pswd_auth_crap.old_lm_hash_enc_len);
3100         } else {
3101                 new_lm_password = data_blob_null;
3102                 old_lm_hash_enc = data_blob_null;
3103         }
3104
3105         /* Get sam handle */
3106
3107         result = cm_connect_sam(contact_domain, state->mem_ctx, true, &cli, &dom_pol);
3108         if (!NT_STATUS_IS_OK(result)) {
3109                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
3110                 goto done;
3111         }
3112
3113         b = cli->binding_handle;
3114
3115         result = rpccli_samr_chng_pswd_auth_crap(
3116                 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
3117                 new_lm_password, old_lm_hash_enc);
3118
3119  done:
3120
3121         if (strequal(contact_domain->name, get_global_sam_name())) {
3122                 /* FIXME: internal rpc pipe does not cache handles yet */
3123                 if (b) {
3124                         if (is_valid_policy_hnd(&dom_pol)) {
3125                                 NTSTATUS _result;
3126                                 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
3127                         }
3128                         TALLOC_FREE(cli);
3129                 }
3130         }
3131
3132         set_auth_errors(state->response, result);
3133
3134         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
3135               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
3136                domain, user,
3137                state->response->data.auth.nt_status_string,
3138                state->response->data.auth.pam_error));
3139
3140         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
3141 }
3142
3143 #ifdef HAVE_KRB5
3144 static NTSTATUS extract_pac_vrfy_sigs(TALLOC_CTX *mem_ctx, DATA_BLOB pac_blob,
3145                                       struct PAC_DATA **p_pac_data)
3146 {
3147         krb5_context krbctx = NULL;
3148         krb5_error_code k5ret;
3149         krb5_keytab keytab;
3150         krb5_kt_cursor cursor;
3151         krb5_keytab_entry entry;
3152         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
3153
3154         ZERO_STRUCT(entry);
3155         ZERO_STRUCT(cursor);
3156
3157         k5ret = smb_krb5_init_context_common(&krbctx);
3158         if (k5ret) {
3159                 DBG_ERR("kerberos init context failed (%s)\n",
3160                         error_message(k5ret));
3161                 status = krb5_to_nt_status(k5ret);
3162                 goto out;
3163         }
3164
3165         k5ret =  gse_krb5_get_server_keytab(krbctx, &keytab);
3166         if (k5ret) {
3167                 DEBUG(1, ("Failed to get keytab: %s\n",
3168                           error_message(k5ret)));
3169                 status = krb5_to_nt_status(k5ret);
3170                 goto out_free;
3171         }
3172
3173         k5ret = krb5_kt_start_seq_get(krbctx, keytab, &cursor);
3174         if (k5ret) {
3175                 DEBUG(1, ("Failed to start seq: %s\n",
3176                           error_message(k5ret)));
3177                 status = krb5_to_nt_status(k5ret);
3178                 goto out_keytab;
3179         }
3180
3181         k5ret = krb5_kt_next_entry(krbctx, keytab, &entry, &cursor);
3182         while (k5ret == 0) {
3183                 status = kerberos_decode_pac(mem_ctx,
3184                                              pac_blob,
3185                                              krbctx,
3186                                              NULL, /* krbtgt_keyblock */
3187                                              KRB5_KT_KEY(&entry), /* service_keyblock */
3188                                              NULL, /* client_principal */
3189                                              0, /* tgs_authtime */
3190                                              p_pac_data);
3191                 if (NT_STATUS_IS_OK(status)) {
3192                         break;
3193                 }
3194                 k5ret = smb_krb5_kt_free_entry(krbctx, &entry);
3195                 k5ret = krb5_kt_next_entry(krbctx, keytab, &entry, &cursor);
3196         }
3197
3198         k5ret = krb5_kt_end_seq_get(krbctx, keytab, &cursor);
3199         if (k5ret) {
3200                 DEBUG(1, ("Failed to end seq: %s\n",
3201                           error_message(k5ret)));
3202         }
3203 out_keytab:
3204         k5ret = krb5_kt_close(krbctx, keytab);
3205         if (k5ret) {
3206                 DEBUG(1, ("Failed to close keytab: %s\n",
3207                           error_message(k5ret)));
3208         }
3209 out_free:
3210         krb5_free_context(krbctx);
3211 out:
3212         return status;
3213 }
3214
3215 NTSTATUS winbindd_pam_auth_pac_verify(struct winbindd_cli_state *state,
3216                                       bool *p_is_trusted,
3217                                       uint16_t *p_validation_level,
3218                                       union netr_Validation **p_validation)
3219 {
3220         struct winbindd_request *req = state->request;
3221         DATA_BLOB pac_blob;
3222         struct PAC_DATA *pac_data = NULL;
3223         struct PAC_LOGON_INFO *logon_info = NULL;
3224         struct PAC_UPN_DNS_INFO *upn_dns_info = NULL;
3225         struct netr_SamInfo6 *info6 = NULL;
3226         uint16_t validation_level = 0;
3227         union netr_Validation *validation = NULL;
3228         struct netr_SamInfo3 *info3_copy = NULL;
3229         NTSTATUS result;
3230         bool is_trusted = false;
3231         uint32_t i;
3232
3233         *p_is_trusted = false;
3234         *p_validation_level = 0;
3235         *p_validation = NULL;
3236
3237         pac_blob = data_blob_const(req->extra_data.data, req->extra_len);
3238         result = extract_pac_vrfy_sigs(state->mem_ctx, pac_blob, &pac_data);
3239         if (NT_STATUS_IS_OK(result)) {
3240                 is_trusted = true;
3241         }
3242         if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
3243                 /* Try without signature verification */
3244                 result = kerberos_decode_pac(state->mem_ctx,
3245                                              pac_blob,
3246                                              NULL, /* krb5_context */
3247                                              NULL, /* krbtgt_keyblock */
3248                                              NULL, /* service_keyblock */
3249                                              NULL, /* client_principal */
3250                                              0, /* tgs_authtime */
3251                                              &pac_data);
3252         }
3253         if (!NT_STATUS_IS_OK(result)) {
3254                 DEBUG(1, ("Error during PAC signature verification: %s\n",
3255                           nt_errstr(result)));
3256                 return result;
3257         }
3258
3259         for (i=0; i < pac_data->num_buffers; i++) {
3260                 if (pac_data->buffers[i].type == PAC_TYPE_LOGON_INFO) {
3261                         logon_info = pac_data->buffers[i].info->logon_info.info;
3262                         continue;
3263                 }
3264                 if (pac_data->buffers[i].type == PAC_TYPE_UPN_DNS_INFO) {
3265                         upn_dns_info = &pac_data->buffers[i].info->upn_dns_info;
3266                         continue;
3267                 }
3268         }
3269
3270         result = create_info6_from_pac(state->mem_ctx,
3271                                        logon_info,
3272                                        upn_dns_info,
3273                                        &info6);
3274         if (!NT_STATUS_IS_OK(result)) {
3275                 return result;
3276         }
3277
3278         result = map_info6_to_validation(state->mem_ctx,
3279                                          info6,
3280                                          &validation_level,
3281                                          &validation);
3282         if (!NT_STATUS_IS_OK(result)) {
3283                 return result;
3284         }
3285
3286         result = map_validation_to_info3(state->mem_ctx,
3287                                          validation_level,
3288                                          validation,
3289                                          &info3_copy);
3290         if (!NT_STATUS_IS_OK(result)) {
3291                 return result;
3292         }
3293
3294         if (is_trusted) {
3295                 /*
3296                  * Signature verification succeeded, we can
3297                  * trust the PAC and prime the netsamlogon
3298                  * and name2sid caches. DO NOT DO THIS
3299                  * in the signature verification failed
3300                  * code path.
3301                  */
3302                 struct winbindd_domain *domain = NULL;
3303
3304                 netsamlogon_cache_store(NULL, info3_copy);
3305
3306                 /*
3307                  * We're in the parent here, so find the child
3308                  * pointer from the PAC domain name.
3309                  */
3310                 domain = find_lookup_domain_from_name(
3311                                 info3_copy->base.logon_domain.string);
3312                 if (domain && domain->primary ) {
3313                         struct dom_sid user_sid;
3314                         struct dom_sid_buf buf;
3315
3316                         sid_compose(&user_sid,
3317                                 info3_copy->base.domain_sid,
3318                                 info3_copy->base.rid);
3319
3320                         cache_name2sid_trusted(domain,
3321                                 info3_copy->base.logon_domain.string,
3322                                 info3_copy->base.account_name.string,
3323                                 SID_NAME_USER,
3324                                 &user_sid);
3325
3326                         DBG_INFO("PAC for user %s\\%s SID %s primed cache\n",
3327                                 info3_copy->base.logon_domain.string,
3328                                 info3_copy->base.account_name.string,
3329                                 dom_sid_str_buf(&user_sid, &buf));
3330                 }
3331         }
3332
3333         *p_is_trusted = is_trusted;
3334         *p_validation_level = validation_level;
3335         *p_validation = validation;
3336         return NT_STATUS_OK;
3337 }
3338 #else /* HAVE_KRB5 */
3339 NTSTATUS winbindd_pam_auth_pac_verify(struct winbindd_cli_state *state,
3340                                       bool *p_is_trusted,
3341                                       uint16_t *p_validation_level,
3342                                       union netr_Validation **p_validation);
3343 {
3344
3345         *p_is_trusted = false;
3346         *p_validation_level = 0;
3347         *p_validation = NULL;
3348         return NT_STATUS_NO_SUCH_USER;
3349 }
3350 #endif /* HAVE_KRB5 */