source3/winbindd/winbindd_ccache_access.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - cached credentials funcions
   5
   6    Copyright (C) Robert O'Callahan 2006
   7    Copyright (C) Jeremy Allison 2006 (minor fixes to fit into Samba and
   8                                       protect against integer wrap).
   9    Copyright (C) Andrew Bartlett 2011
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #include "auth/gensec/gensec.h"
  28 #include "auth_generic.h"
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_WINBIND
  32
  33 static bool client_can_access_ccache_entry(uid_t client_uid,
  34                                         struct WINBINDD_MEMORY_CREDS *entry)
  35 {
  36         if (client_uid == entry->uid || client_uid == 0) {
  37                 DEBUG(10, ("Access granted to uid %u\n", (unsigned int)client_uid));
  38                 return True;
  39         }
  40
  41         DEBUG(1, ("Access denied to uid %u (expected %u)\n",
  42                 (unsigned int)client_uid, (unsigned int)entry->uid));
  43         return False;
  44 }
  45
  46 static NTSTATUS do_ntlm_auth_with_stored_pw(const char *username,
  47                                             const char *domain,
  48                                             const char *password,
  49                                             const DATA_BLOB initial_msg,
  50                                             const DATA_BLOB challenge_msg,
  51                                             TALLOC_CTX *mem_ctx,
  52                                             DATA_BLOB *auth_msg,
  53                                             uint8_t session_key[16],
  54                                             uint8_t *new_spnego)
  55 {
  56         NTSTATUS status;
  57         struct auth_generic_state *auth_generic_state = NULL;
  58         DATA_BLOB reply, session_key_blob;
  59
  60         status = auth_generic_client_prepare(mem_ctx, &auth_generic_state);
  61
  62         if (!NT_STATUS_IS_OK(status)) {
  63                 DEBUG(1, ("Could not start NTLMSSP client: %s\n",
  64                         nt_errstr(status)));
  65                 goto done;
  66         }
  67
  68         status = auth_generic_set_username(auth_generic_state, username);
  69
  70         if (!NT_STATUS_IS_OK(status)) {
  71                 DEBUG(1, ("Could not set username: %s\n",
  72                         nt_errstr(status)));
  73                 goto done;
  74         }
  75
  76         status = auth_generic_set_domain(auth_generic_state, domain);
  77
  78         if (!NT_STATUS_IS_OK(status)) {
  79                 DEBUG(1, ("Could not set domain: %s\n",
  80                         nt_errstr(status)));
  81                 goto done;
  82         }
  83
  84         status = auth_generic_set_password(auth_generic_state, password);
  85
  86         if (!NT_STATUS_IS_OK(status)) {
  87                 DEBUG(1, ("Could not set password: %s\n",
  88                         nt_errstr(status)));
  89                 goto done;
  90         }
  91
  92         if (initial_msg.length == 0) {
  93                 gensec_want_feature(auth_generic_state->gensec_security,
  94                                     GENSEC_FEATURE_SESSION_KEY);
  95         }
  96
  97         status = auth_generic_client_start_by_name(auth_generic_state,
  98                                                    "ntlmssp_resume_ccache");
  99         if (!NT_STATUS_IS_OK(status)) {
 100                 DEBUG(1, ("Could not start NTLMSSP resume mech: %s\n",
 101                         nt_errstr(status)));
 102                 goto done;
 103         }
 104
 105         /*
 106          * We inject the inital NEGOTIATE message our caller used
 107          * in order to get the state machine into the correct possition.
 108          */
 109         reply = data_blob_null;
 110         status = gensec_update(auth_generic_state->gensec_security,
 111                                talloc_tos(), initial_msg, &reply);
 112         data_blob_free(&reply);
 113
 114         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 115                 DEBUG(1, ("Failed to create initial message! [%s]\n",
 116                         nt_errstr(status)));
 117                 goto done;
 118         }
 119
 120         /* Now we are ready to handle the server's actual response. */
 121         status = gensec_update(auth_generic_state->gensec_security,
 122                                mem_ctx, challenge_msg, &reply);
 123         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 124                 DEBUG(1, ("We didn't get a response to the challenge! [%s]\n",
 125                         nt_errstr(status)));
 126                 data_blob_free(&reply);
 127                 goto done;
 128         }
 129
 130         status = gensec_session_key(auth_generic_state->gensec_security,
 131                                     talloc_tos(), &session_key_blob);
 132         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 133                 DEBUG(1, ("We didn't get the session key we requested! [%s]\n",
 134                         nt_errstr(status)));
 135                 data_blob_free(&reply);
 136                 goto done;
 137         }
 138
 139         if (session_key_blob.length != 16) {
 140                 DEBUG(1, ("invalid session key length %d\n",
 141                           (int)session_key_blob.length));
 142                 data_blob_free(&reply);
 143                 goto done;
 144         }
 145         memcpy(session_key, session_key_blob.data, 16);
 146         data_blob_free(&session_key_blob);
 147         *auth_msg = reply;
 148         *new_spnego = gensec_have_feature(auth_generic_state->gensec_security,
 149                                           GENSEC_FEATURE_NEW_SPNEGO);
 150         status = NT_STATUS_OK;
 151
 152 done:
 153         TALLOC_FREE(auth_generic_state);
 154         return status;
 155 }
 156
 157 static bool check_client_uid(struct winbindd_cli_state *state, uid_t uid)
 158 {
 159         int ret;
 160         uid_t ret_uid;
 161         gid_t ret_gid;
 162
 163         ret_uid = (uid_t)-1;
 164
 165         ret = getpeereid(state->sock, &ret_uid, &ret_gid);
 166         if (ret != 0) {
 167                 DEBUG(1, ("check_client_uid: Could not get socket peer uid: %s; "
 168                         "denying access\n", strerror(errno)));
 169                 return False;
 170         }
 171
 172         if (uid != ret_uid && ret_uid != sec_initial_uid()) {
 173                 DEBUG(1, ("check_client_uid: Client lied about its uid: said %u, "
 174                         "actually was %u; denying access\n",
 175                         (unsigned int)uid, (unsigned int)ret_uid));
 176                 return False;
 177         }
 178
 179         return True;
 180 }
 181
 182 void winbindd_ccache_ntlm_auth(struct winbindd_cli_state *state)
 183 {
 184         struct winbindd_domain *domain;
 185         fstring name_domain, name_user;
 186         NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
 187         struct WINBINDD_MEMORY_CREDS *entry;
 188         DATA_BLOB initial, challenge, auth;
 189         uint32_t initial_blob_len, challenge_blob_len, extra_len;
 190
 191         /* Ensure null termination */
 192         state->request->data.ccache_ntlm_auth.user[
 193                         sizeof(state->request->data.ccache_ntlm_auth.user)-1]='\0';
 194
 195         DEBUG(3, ("[%5lu]: perform NTLM auth on behalf of user %s\n", (unsigned long)state->pid,
 196                 state->request->data.ccache_ntlm_auth.user));
 197
 198         /* Parse domain and username */
 199
 200         if (!canonicalize_username(state->request->data.ccache_ntlm_auth.user,
 201                                 name_domain, name_user)) {
 202                 DEBUG(5,("winbindd_ccache_ntlm_auth: cannot parse domain and user from name [%s]\n",
 203                         state->request->data.ccache_ntlm_auth.user));
 204                 request_error(state);
 205                 return;
 206         }
 207
 208         domain = find_auth_domain(state->request->flags, name_domain);
 209
 210         if (domain == NULL) {
 211                 DEBUG(5,("winbindd_ccache_ntlm_auth: can't get domain [%s]\n",
 212                         name_domain));
 213                 request_error(state);
 214                 return;
 215         }
 216
 217         if (!check_client_uid(state, state->request->data.ccache_ntlm_auth.uid)) {
 218                 request_error(state);
 219                 return;
 220         }
 221
 222         /* validate blob lengths */
 223         initial_blob_len = state->request->data.ccache_ntlm_auth.initial_blob_len;
 224         challenge_blob_len = state->request->data.ccache_ntlm_auth.challenge_blob_len;
 225         extra_len = state->request->extra_len;
 226
 227         if (initial_blob_len > extra_len || challenge_blob_len > extra_len ||
 228                 initial_blob_len + challenge_blob_len > extra_len ||
 229                 initial_blob_len + challenge_blob_len < initial_blob_len ||
 230                 initial_blob_len + challenge_blob_len < challenge_blob_len) {
 231
 232                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: blob lengths overrun "
 233                         "or wrap. Buffer [%d+%d > %d]\n",
 234                         initial_blob_len,
 235                         challenge_blob_len,
 236                         extra_len));
 237                 goto process_result;
 238         }
 239
 240         /* Parse domain and username */
 241         if (!parse_domain_user(state->request->data.ccache_ntlm_auth.user, name_domain, name_user)) {
 242                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: cannot parse "
 243                         "domain and user from name [%s]\n",
 244                         state->request->data.ccache_ntlm_auth.user));
 245                 goto process_result;
 246         }
 247
 248         entry = find_memory_creds_by_name(state->request->data.ccache_ntlm_auth.user);
 249         if (entry == NULL || entry->nt_hash == NULL || entry->lm_hash == NULL) {
 250                 DEBUG(10,("winbindd_dual_ccache_ntlm_auth: could not find "
 251                         "credentials for user %s\n",
 252                         state->request->data.ccache_ntlm_auth.user));
 253                 goto process_result;
 254         }
 255
 256         DEBUG(10,("winbindd_dual_ccache_ntlm_auth: found ccache [%s]\n", entry->username));
 257
 258         if (!client_can_access_ccache_entry(state->request->data.ccache_ntlm_auth.uid, entry)) {
 259                 goto process_result;
 260         }
 261
 262         if (initial_blob_len == 0 && challenge_blob_len == 0) {
 263                 /* this is just a probe to see if credentials are available. */
 264                 result = NT_STATUS_OK;
 265                 state->response->data.ccache_ntlm_auth.auth_blob_len = 0;
 266                 goto process_result;
 267         }
 268
 269         initial = data_blob_const(state->request->extra_data.data,
 270                                   initial_blob_len);
 271         challenge = data_blob_const(
 272                 state->request->extra_data.data + initial_blob_len,
 273                 state->request->data.ccache_ntlm_auth.challenge_blob_len);
 274
 275         result = do_ntlm_auth_with_stored_pw(
 276                 name_user, name_domain, entry->pass,
 277                 initial, challenge, talloc_tos(), &auth,
 278                 state->response->data.ccache_ntlm_auth.session_key,
 279                 &state->response->data.ccache_ntlm_auth.new_spnego);
 280
 281         if (!NT_STATUS_IS_OK(result)) {
 282                 goto process_result;
 283         }
 284
 285         state->response->extra_data.data = talloc_memdup(
 286                 state->mem_ctx, auth.data, auth.length);
 287         if (!state->response->extra_data.data) {
 288                 result = NT_STATUS_NO_MEMORY;
 289                 goto process_result;
 290         }
 291         state->response->length += auth.length;
 292         state->response->data.ccache_ntlm_auth.auth_blob_len = auth.length;
 293
 294         data_blob_free(&auth);
 295
 296   process_result:
 297         if (!NT_STATUS_IS_OK(result)) {
 298                 request_error(state);
 299                 return;
 300         }
 301         request_ok(state);
 302 }
 303
 304 void winbindd_ccache_save(struct winbindd_cli_state *state)
 305 {
 306         struct winbindd_domain *domain;
 307         fstring name_domain, name_user;
 308         NTSTATUS status;
 309
 310         /* Ensure null termination */
 311         state->request->data.ccache_save.user[
 312                 sizeof(state->request->data.ccache_save.user)-1]='\0';
 313         state->request->data.ccache_save.pass[
 314                 sizeof(state->request->data.ccache_save.pass)-1]='\0';
 315
 316         DEBUG(3, ("[%5lu]: save password of user %s\n",
 317                   (unsigned long)state->pid,
 318                   state->request->data.ccache_save.user));
 319
 320         /* Parse domain and username */
 321
 322         if (!canonicalize_username(state->request->data.ccache_save.user,
 323                                    name_domain, name_user)) {
 324                 DEBUG(5,("winbindd_ccache_save: cannot parse domain and user "
 325                          "from name [%s]\n",
 326                          state->request->data.ccache_save.user));
 327                 request_error(state);
 328                 return;
 329         }
 330
 331         /*
 332          * The domain is checked here only for compatibility
 333          * reasons. We used to do the winbindd memory ccache for
 334          * ntlm_auth in the domain child. With that code, we had to
 335          * make sure that we do have a domain around to send this
 336          * to. Now we do the memory cache in the parent winbindd,
 337          * where it would not matter if we have a domain or not.
 338          */
 339
 340         domain = find_auth_domain(state->request->flags, name_domain);
 341         if (domain == NULL) {
 342                 DEBUG(5, ("winbindd_ccache_save: can't get domain [%s]\n",
 343                           name_domain));
 344                 request_error(state);
 345                 return;
 346         }
 347
 348         if (!check_client_uid(state, state->request->data.ccache_save.uid)) {
 349                 request_error(state);
 350                 return;
 351         }
 352
 353         status = winbindd_add_memory_creds(
 354                 state->request->data.ccache_save.user,
 355                 state->request->data.ccache_save.uid,
 356                 state->request->data.ccache_save.pass);
 357
 358         if (!NT_STATUS_IS_OK(status)) {
 359                 DEBUG(1, ("winbindd_add_memory_creds failed %s\n",
 360                           nt_errstr(status)));
 361                 request_error(state);
 362                 return;
 363         }
 364         request_ok(state);
 365 }