2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Volker Lendecke 2010
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "../lib/crypto/arcfour.h"
23 #include "../librpc/gen_ndr/netlogon.h"
24 #include "../libcli/security/security.h"
25 #include "rpc_client/util_netlogon.h"
26 #include "nsswitch/libwbclient/wbclient.h"
30 #define DBGC_CLASS DBGC_AUTH
32 /* FIXME: do we really still need this ? */
33 static int server_info_dtor(struct auth_serversupplied_info
*server_info
)
35 TALLOC_FREE(server_info
->info3
);
36 ZERO_STRUCTP(server_info
);
40 /***************************************************************************
41 Make a server_info struct. Free with TALLOC_FREE().
42 ***************************************************************************/
44 struct auth_serversupplied_info
*make_server_info(TALLOC_CTX
*mem_ctx
)
46 struct auth_serversupplied_info
*result
;
48 result
= TALLOC_ZERO_P(mem_ctx
, struct auth_serversupplied_info
);
50 DEBUG(0, ("talloc failed\n"));
54 talloc_set_destructor(result
, server_info_dtor
);
56 /* Initialise the uid and gid values to something non-zero
57 which may save us from giving away root access if there
58 is a bug in allocating these fields. */
60 result
->utok
.uid
= -1;
61 result
->utok
.gid
= -1;
66 /****************************************************************************
67 inits a netr_SamInfo2 structure from an auth_serversupplied_info. sam2 must
68 already be initialized and is used as the talloc parent for its members.
69 *****************************************************************************/
71 NTSTATUS
serverinfo_to_SamInfo2(struct auth_serversupplied_info
*server_info
,
72 uint8_t *pipe_session_key
,
73 size_t pipe_session_key_len
,
74 struct netr_SamInfo2
*sam2
)
76 struct netr_SamInfo3
*info3
;
78 info3
= copy_netr_SamInfo3(sam2
, server_info
->info3
);
80 return NT_STATUS_NO_MEMORY
;
83 if (server_info
->user_session_key
.length
) {
84 memcpy(info3
->base
.key
.key
,
85 server_info
->user_session_key
.data
,
86 MIN(sizeof(info3
->base
.key
.key
),
87 server_info
->user_session_key
.length
));
88 if (pipe_session_key
) {
89 arcfour_crypt(info3
->base
.key
.key
,
90 pipe_session_key
, 16);
93 if (server_info
->lm_session_key
.length
) {
94 memcpy(info3
->base
.LMSessKey
.key
,
95 server_info
->lm_session_key
.data
,
96 MIN(sizeof(info3
->base
.LMSessKey
.key
),
97 server_info
->lm_session_key
.length
));
98 if (pipe_session_key
) {
99 arcfour_crypt(info3
->base
.LMSessKey
.key
,
100 pipe_session_key
, 8);
104 sam2
->base
= info3
->base
;
109 /****************************************************************************
110 inits a netr_SamInfo3 structure from an auth_serversupplied_info. sam3 must
111 already be initialized and is used as the talloc parent for its members.
112 *****************************************************************************/
114 NTSTATUS
serverinfo_to_SamInfo3(const struct auth_serversupplied_info
*server_info
,
115 uint8_t *pipe_session_key
,
116 size_t pipe_session_key_len
,
117 struct netr_SamInfo3
*sam3
)
119 struct netr_SamInfo3
*info3
;
121 info3
= copy_netr_SamInfo3(sam3
, server_info
->info3
);
123 return NT_STATUS_NO_MEMORY
;
126 if (server_info
->user_session_key
.length
) {
127 memcpy(info3
->base
.key
.key
,
128 server_info
->user_session_key
.data
,
129 MIN(sizeof(info3
->base
.key
.key
),
130 server_info
->user_session_key
.length
));
131 if (pipe_session_key
) {
132 arcfour_crypt(info3
->base
.key
.key
,
133 pipe_session_key
, 16);
136 if (server_info
->lm_session_key
.length
) {
137 memcpy(info3
->base
.LMSessKey
.key
,
138 server_info
->lm_session_key
.data
,
139 MIN(sizeof(info3
->base
.LMSessKey
.key
),
140 server_info
->lm_session_key
.length
));
141 if (pipe_session_key
) {
142 arcfour_crypt(info3
->base
.LMSessKey
.key
,
143 pipe_session_key
, 8);
147 sam3
->base
= info3
->base
;
155 /****************************************************************************
156 inits a netr_SamInfo6 structure from an auth_serversupplied_info. sam6 must
157 already be initialized and is used as the talloc parent for its members.
158 *****************************************************************************/
160 NTSTATUS
serverinfo_to_SamInfo6(struct auth_serversupplied_info
*server_info
,
161 uint8_t *pipe_session_key
,
162 size_t pipe_session_key_len
,
163 struct netr_SamInfo6
*sam6
)
165 struct pdb_domain_info
*dominfo
;
166 struct netr_SamInfo3
*info3
;
168 if ((pdb_capabilities() & PDB_CAP_ADS
) == 0) {
169 DEBUG(10,("Not adding validation info level 6 "
170 "without ADS passdb backend\n"));
171 return NT_STATUS_INVALID_INFO_CLASS
;
174 dominfo
= pdb_get_domain_info(sam6
);
175 if (dominfo
== NULL
) {
176 return NT_STATUS_NO_MEMORY
;
179 info3
= copy_netr_SamInfo3(sam6
, server_info
->info3
);
181 return NT_STATUS_NO_MEMORY
;
184 if (server_info
->user_session_key
.length
) {
185 memcpy(info3
->base
.key
.key
,
186 server_info
->user_session_key
.data
,
187 MIN(sizeof(info3
->base
.key
.key
),
188 server_info
->user_session_key
.length
));
189 if (pipe_session_key
) {
190 arcfour_crypt(info3
->base
.key
.key
,
191 pipe_session_key
, 16);
194 if (server_info
->lm_session_key
.length
) {
195 memcpy(info3
->base
.LMSessKey
.key
,
196 server_info
->lm_session_key
.data
,
197 MIN(sizeof(info3
->base
.LMSessKey
.key
),
198 server_info
->lm_session_key
.length
));
199 if (pipe_session_key
) {
200 arcfour_crypt(info3
->base
.LMSessKey
.key
,
201 pipe_session_key
, 8);
205 sam6
->base
= info3
->base
;
210 sam6
->dns_domainname
.string
= talloc_strdup(sam6
, dominfo
->dns_domain
);
211 if (sam6
->dns_domainname
.string
== NULL
) {
212 return NT_STATUS_NO_MEMORY
;
215 sam6
->principle
.string
= talloc_asprintf(sam6
, "%s@%s",
216 sam6
->base
.account_name
.string
,
217 sam6
->dns_domainname
.string
);
218 if (sam6
->principle
.string
== NULL
) {
219 return NT_STATUS_NO_MEMORY
;
225 static NTSTATUS
append_netr_SidAttr(TALLOC_CTX
*mem_ctx
,
226 struct netr_SidAttr
**sids
,
228 const struct dom_sid2
*asid
,
233 *sids
= talloc_realloc(mem_ctx
, *sids
, struct netr_SidAttr
, t
+ 1);
235 return NT_STATUS_NO_MEMORY
;
237 (*sids
)[t
].sid
= dom_sid_dup(*sids
, asid
);
238 if ((*sids
)[t
].sid
== NULL
) {
239 return NT_STATUS_NO_MEMORY
;
241 (*sids
)[t
].attributes
= attributes
;
247 /* Fills the samr_RidWithAttributeArray with the provided sids.
248 * If it happens that we have additional groups that do not belong
249 * to the domain, add their sids as extra sids */
250 static NTSTATUS
group_sids_to_info3(struct netr_SamInfo3
*info3
,
251 const struct dom_sid
*sids
,
254 uint32_t attributes
= SE_GROUP_MANDATORY
|
255 SE_GROUP_ENABLED_BY_DEFAULT
|
257 struct samr_RidWithAttributeArray
*groups
;
258 struct dom_sid
*domain_sid
;
264 domain_sid
= info3
->base
.domain_sid
;
265 groups
= &info3
->base
.groups
;
267 groups
->rids
= talloc_array(info3
,
268 struct samr_RidWithAttribute
, num_sids
);
270 return NT_STATUS_NO_MEMORY
;
273 for (i
= 0; i
< num_sids
; i
++) {
274 ok
= sid_peek_check_rid(domain_sid
, &sids
[i
], &rid
);
277 /* if it is the primary gid, skip it, we
278 * obviously already have it */
279 if (info3
->base
.primary_gid
== rid
) continue;
281 /* store domain group rid */
282 groups
->rids
[groups
->count
].rid
= rid
;
283 groups
->rids
[groups
->count
].attributes
= attributes
;
288 /* if this wasn't a domain sid, add it as extra sid */
289 status
= append_netr_SidAttr(info3
, &info3
->sids
,
291 &sids
[i
], attributes
);
292 if (!NT_STATUS_IS_OK(status
)) {
300 #define RET_NOMEM(ptr) do { \
302 TALLOC_FREE(info3); \
303 return NT_STATUS_NO_MEMORY; \
306 NTSTATUS
samu_to_SamInfo3(TALLOC_CTX
*mem_ctx
,
308 const char *login_server
,
309 struct netr_SamInfo3
**_info3
,
310 struct extra_auth_info
*extra
)
312 struct netr_SamInfo3
*info3
;
313 const struct dom_sid
*user_sid
;
314 const struct dom_sid
*group_sid
;
315 struct dom_sid domain_sid
;
316 struct dom_sid
*group_sids
;
317 uint32_t num_group_sids
= 0;
323 user_sid
= pdb_get_user_sid(samu
);
324 group_sid
= pdb_get_group_sid(samu
);
326 if (!user_sid
|| !group_sid
) {
327 DEBUG(1, ("Sam account is missing sids!\n"));
328 return NT_STATUS_UNSUCCESSFUL
;
331 info3
= talloc_zero(mem_ctx
, struct netr_SamInfo3
);
333 return NT_STATUS_NO_MEMORY
;
336 ZERO_STRUCT(domain_sid
);
338 /* check if this is a "Unix Users" domain user,
339 * we need to handle it in a special way if that's the case */
340 if (sid_check_is_in_unix_users(user_sid
)) {
341 /* in info3 you can only set rids for the user and the
342 * primary group, and the domain sid must be that of
345 * Store a completely bogus value here.
346 * The real SID is stored in the extra sids.
347 * Other code will know to look there if (-1) is found
349 info3
->base
.rid
= (uint32_t)(-1);
350 sid_copy(&extra
->user_sid
, user_sid
);
352 DEBUG(10, ("Unix User found in struct samu. Rid marked as "
353 "special and sid (%s) saved as extra sid\n",
354 sid_string_dbg(user_sid
)));
356 sid_copy(&domain_sid
, user_sid
);
357 sid_split_rid(&domain_sid
, &info3
->base
.rid
);
360 if (is_null_sid(&domain_sid
)) {
361 sid_copy(&domain_sid
, get_global_sam_sid());
364 /* check if this is a "Unix Groups" domain group,
365 * if so we need special handling */
366 if (sid_check_is_in_unix_groups(group_sid
)) {
367 /* in info3 you can only set rids for the user and the
368 * primary group, and the domain sid must be that of
371 * Store a completely bogus value here.
372 * The real SID is stored in the extra sids.
373 * Other code will know to look there if (-1) is found
375 info3
->base
.primary_gid
= (uint32_t)(-1);
376 sid_copy(&extra
->pgid_sid
, group_sid
);
378 DEBUG(10, ("Unix Group found in struct samu. Rid marked as "
379 "special and sid (%s) saved as extra sid\n",
380 sid_string_dbg(group_sid
)));
383 ok
= sid_peek_check_rid(&domain_sid
, group_sid
,
384 &info3
->base
.primary_gid
);
386 DEBUG(1, ("The primary group domain sid(%s) does not "
387 "match the domain sid(%s) for %s(%s)\n",
388 sid_string_dbg(group_sid
),
389 sid_string_dbg(&domain_sid
),
390 pdb_get_username(samu
),
391 sid_string_dbg(user_sid
)));
393 return NT_STATUS_UNSUCCESSFUL
;
397 unix_to_nt_time(&info3
->base
.last_logon
, pdb_get_logon_time(samu
));
398 unix_to_nt_time(&info3
->base
.last_logoff
, get_time_t_max());
399 unix_to_nt_time(&info3
->base
.acct_expiry
, get_time_t_max());
400 unix_to_nt_time(&info3
->base
.last_password_change
,
401 pdb_get_pass_last_set_time(samu
));
402 unix_to_nt_time(&info3
->base
.allow_password_change
,
403 pdb_get_pass_can_change_time(samu
));
404 unix_to_nt_time(&info3
->base
.force_password_change
,
405 pdb_get_pass_must_change_time(samu
));
407 tmp
= pdb_get_username(samu
);
409 info3
->base
.account_name
.string
= talloc_strdup(info3
, tmp
);
410 RET_NOMEM(info3
->base
.account_name
.string
);
412 tmp
= pdb_get_fullname(samu
);
414 info3
->base
.full_name
.string
= talloc_strdup(info3
, tmp
);
415 RET_NOMEM(info3
->base
.full_name
.string
);
417 tmp
= pdb_get_logon_script(samu
);
419 info3
->base
.logon_script
.string
= talloc_strdup(info3
, tmp
);
420 RET_NOMEM(info3
->base
.logon_script
.string
);
422 tmp
= pdb_get_profile_path(samu
);
424 info3
->base
.profile_path
.string
= talloc_strdup(info3
, tmp
);
425 RET_NOMEM(info3
->base
.profile_path
.string
);
427 tmp
= pdb_get_homedir(samu
);
429 info3
->base
.home_directory
.string
= talloc_strdup(info3
, tmp
);
430 RET_NOMEM(info3
->base
.home_directory
.string
);
432 tmp
= pdb_get_dir_drive(samu
);
434 info3
->base
.home_drive
.string
= talloc_strdup(info3
, tmp
);
435 RET_NOMEM(info3
->base
.home_drive
.string
);
438 info3
->base
.logon_count
= pdb_get_logon_count(samu
);
439 info3
->base
.bad_password_count
= pdb_get_bad_password_count(samu
);
441 info3
->base
.domain
.string
= talloc_strdup(info3
,
442 pdb_get_domain(samu
));
443 RET_NOMEM(info3
->base
.domain
.string
);
445 info3
->base
.domain_sid
= dom_sid_dup(info3
, &domain_sid
);
446 RET_NOMEM(info3
->base
.domain_sid
);
448 status
= pdb_enum_group_memberships(mem_ctx
, samu
,
451 if (!NT_STATUS_IS_OK(status
)) {
452 DEBUG(1, ("Failed to get groups from sam account.\n"));
457 if (num_group_sids
) {
458 status
= group_sids_to_info3(info3
, group_sids
, num_group_sids
);
459 if (!NT_STATUS_IS_OK(status
)) {
465 /* We don't need sids and gids after the conversion */
466 TALLOC_FREE(group_sids
);
470 /* FIXME: should we add other flags ? */
471 info3
->base
.user_flags
= NETLOGON_EXTRA_SIDS
;
474 info3
->base
.logon_server
.string
= talloc_strdup(info3
, login_server
);
475 RET_NOMEM(info3
->base
.logon_server
.string
);
478 info3
->base
.acct_flags
= pdb_get_acct_ctrl(samu
);
486 #define RET_NOMEM(ptr) do { \
488 TALLOC_FREE(info3); \
492 struct netr_SamInfo3
*copy_netr_SamInfo3(TALLOC_CTX
*mem_ctx
,
493 struct netr_SamInfo3
*orig
)
495 struct netr_SamInfo3
*info3
;
499 info3
= talloc_zero(mem_ctx
, struct netr_SamInfo3
);
500 if (!info3
) return NULL
;
502 status
= copy_netr_SamBaseInfo(info3
, &orig
->base
, &info3
->base
);
503 if (!NT_STATUS_IS_OK(status
)) {
508 if (orig
->sidcount
) {
509 info3
->sidcount
= orig
->sidcount
;
510 info3
->sids
= talloc_array(info3
, struct netr_SidAttr
,
512 RET_NOMEM(info3
->sids
);
513 for (i
= 0; i
< orig
->sidcount
; i
++) {
514 info3
->sids
[i
].sid
= dom_sid_dup(info3
->sids
,
516 RET_NOMEM(info3
->sids
[i
].sid
);
517 info3
->sids
[i
].attributes
=
518 orig
->sids
[i
].attributes
;
525 static NTSTATUS
wbcsids_to_samr_RidWithAttributeArray(
527 struct samr_RidWithAttributeArray
*groups
,
528 const struct dom_sid
*domain_sid
,
529 const struct wbcSidWithAttr
*sids
,
532 unsigned int i
, j
= 0;
535 groups
->rids
= talloc_array(mem_ctx
,
536 struct samr_RidWithAttribute
, num_sids
);
538 return NT_STATUS_NO_MEMORY
;
541 /* a wbcDomainSid is the same as a dom_sid */
542 for (i
= 0; i
< num_sids
; i
++) {
543 ok
= sid_peek_check_rid(domain_sid
,
544 (const struct dom_sid
*)&sids
[i
].sid
,
545 &groups
->rids
[j
].rid
);
548 groups
->rids
[j
].attributes
= SE_GROUP_MANDATORY
|
549 SE_GROUP_ENABLED_BY_DEFAULT
|
558 static NTSTATUS
wbcsids_to_netr_SidAttrArray(
559 const struct dom_sid
*domain_sid
,
560 const struct wbcSidWithAttr
*sids
,
563 struct netr_SidAttr
**_info3_sids
,
564 uint32_t *info3_num_sids
)
566 unsigned int i
, j
= 0;
567 struct netr_SidAttr
*info3_sids
;
569 info3_sids
= talloc_array(mem_ctx
, struct netr_SidAttr
, num_sids
);
570 if (info3_sids
== NULL
) {
571 return NT_STATUS_NO_MEMORY
;
574 /* a wbcDomainSid is the same as a dom_sid */
575 for (i
= 0; i
< num_sids
; i
++) {
576 const struct dom_sid
*sid
;
578 sid
= (const struct dom_sid
*)&sids
[i
].sid
;
580 if (dom_sid_in_domain(domain_sid
, sid
)) {
584 info3_sids
[j
].sid
= dom_sid_dup(info3_sids
, sid
);
585 if (info3_sids
[j
].sid
== NULL
) {
586 talloc_free(info3_sids
);
587 return NT_STATUS_NO_MEMORY
;
589 info3_sids
[j
].attributes
= SE_GROUP_MANDATORY
|
590 SE_GROUP_ENABLED_BY_DEFAULT
|
596 *_info3_sids
= info3_sids
;
600 struct netr_SamInfo3
*wbcAuthUserInfo_to_netr_SamInfo3(TALLOC_CTX
*mem_ctx
,
601 const struct wbcAuthUserInfo
*info
)
603 struct netr_SamInfo3
*info3
;
604 struct dom_sid user_sid
;
605 struct dom_sid group_sid
;
606 struct dom_sid domain_sid
;
610 memcpy(&user_sid
, &info
->sids
[0].sid
, sizeof(user_sid
));
611 memcpy(&group_sid
, &info
->sids
[1].sid
, sizeof(group_sid
));
613 info3
= talloc_zero(mem_ctx
, struct netr_SamInfo3
);
614 if (!info3
) return NULL
;
616 info3
->base
.last_logon
= info
->logon_time
;
617 info3
->base
.last_logoff
= info
->logoff_time
;
618 info3
->base
.acct_expiry
= info
->kickoff_time
;
619 unix_to_nt_time(&info3
->base
.last_password_change
, info
->pass_last_set_time
);
620 unix_to_nt_time(&info3
->base
.allow_password_change
,
621 info
->pass_can_change_time
);
622 unix_to_nt_time(&info3
->base
.force_password_change
,
623 info
->pass_must_change_time
);
625 if (info
->account_name
) {
626 info3
->base
.account_name
.string
=
627 talloc_strdup(info3
, info
->account_name
);
628 RET_NOMEM(info3
->base
.account_name
.string
);
630 if (info
->full_name
) {
631 info3
->base
.full_name
.string
=
632 talloc_strdup(info3
, info
->full_name
);
633 RET_NOMEM(info3
->base
.full_name
.string
);
635 if (info
->logon_script
) {
636 info3
->base
.logon_script
.string
=
637 talloc_strdup(info3
, info
->logon_script
);
638 RET_NOMEM(info3
->base
.logon_script
.string
);
640 if (info
->profile_path
) {
641 info3
->base
.profile_path
.string
=
642 talloc_strdup(info3
, info
->profile_path
);
643 RET_NOMEM(info3
->base
.profile_path
.string
);
645 if (info
->home_directory
) {
646 info3
->base
.home_directory
.string
=
647 talloc_strdup(info3
, info
->home_directory
);
648 RET_NOMEM(info3
->base
.home_directory
.string
);
650 if (info
->home_drive
) {
651 info3
->base
.home_drive
.string
=
652 talloc_strdup(info3
, info
->home_drive
);
653 RET_NOMEM(info3
->base
.home_drive
.string
);
656 info3
->base
.logon_count
= info
->logon_count
;
657 info3
->base
.bad_password_count
= info
->bad_password_count
;
659 sid_copy(&domain_sid
, &user_sid
);
660 sid_split_rid(&domain_sid
, &info3
->base
.rid
);
662 ok
= sid_peek_check_rid(&domain_sid
, &group_sid
,
663 &info3
->base
.primary_gid
);
665 DEBUG(1, ("The primary group sid domain does not"
666 "match user sid domain for user: %s\n",
667 info
->account_name
));
672 status
= wbcsids_to_samr_RidWithAttributeArray(info3
,
677 if (!NT_STATUS_IS_OK(status
)) {
682 status
= wbcsids_to_netr_SidAttrArray(&domain_sid
,
688 if (!NT_STATUS_IS_OK(status
)) {
693 info3
->base
.user_flags
= info
->user_flags
;
694 memcpy(info3
->base
.key
.key
, info
->user_session_key
, 16);
696 if (info
->logon_server
) {
697 info3
->base
.logon_server
.string
=
698 talloc_strdup(info3
, info
->logon_server
);
699 RET_NOMEM(info3
->base
.logon_server
.string
);
701 if (info
->domain_name
) {
702 info3
->base
.domain
.string
=
703 talloc_strdup(info3
, info
->domain_name
);
704 RET_NOMEM(info3
->base
.domain
.string
);
707 info3
->base
.domain_sid
= dom_sid_dup(info3
, &domain_sid
);
708 RET_NOMEM(info3
->base
.domain_sid
);
710 memcpy(info3
->base
.LMSessKey
.key
, info
->lm_session_key
, 8);
711 info3
->base
.acct_flags
= info
->acct_flags
;