source3/auth/auth_ntlmssp.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle NLTMSSP, server side
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett 2001-2005,2011
   8    Copyright (C) Stefan Metzmacher 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth.h"
  26 #include "libcli/security/security.h"
  27
  28 NTSTATUS auth3_generate_session_info(struct auth4_context *auth_context,
  29                                      TALLOC_CTX *mem_ctx,
  30                                      void *server_returned_info,
  31                                      const char *original_user_name,
  32                                      uint32_t session_info_flags,
  33                                      struct auth_session_info **session_info)
  34 {
  35         struct auth_user_info_dc *user_info = NULL;
  36         struct auth_serversupplied_info *server_info = NULL;
  37         NTSTATUS nt_status;
  38
  39         /*
  40          * This is a hack, some callers...
  41          *
  42          * Some callers pass auth_user_info_dc, the SCHANNEL and
  43          * NCALRPC_AS_SYSTEM gensec modules.
  44          *
  45          * While the reset passes auth3_check_password() returned.
  46          */
  47         user_info = talloc_get_type(server_returned_info,
  48                                     struct auth_user_info_dc);
  49         if (user_info != NULL) {
  50                 const struct dom_sid *sid;
  51                 int cmp;
  52
  53                 /*
  54                  * This should only be called from SCHANNEL or NCALRPC_AS_SYSTEM
  55                  */
  56                 if (user_info->num_sids != 1) {
  57                         return NT_STATUS_INTERNAL_ERROR;
  58                 }
  59                 sid = &user_info->sids[PRIMARY_USER_SID_INDEX];
  60
  61                 cmp = dom_sid_compare(sid, &global_sid_System);
  62                 if (cmp == 0) {
  63                         return make_session_info_system(mem_ctx, session_info);
  64                 }
  65
  66                 cmp = dom_sid_compare(sid, &global_sid_Anonymous);
  67                 if (cmp == 0) {
  68                         return make_session_info_anonymous(mem_ctx, session_info);
  69                 }
  70
  71                 return NT_STATUS_INTERNAL_ERROR;
  72         }
  73
  74         server_info = talloc_get_type_abort(server_returned_info,
  75                                             struct auth_serversupplied_info);
  76         nt_status = create_local_token(mem_ctx,
  77                                        server_info,
  78                                        NULL,
  79                                        original_user_name,
  80                                        session_info);
  81         if (!NT_STATUS_IS_OK(nt_status)) {
  82                 DEBUG(10, ("create_local_token failed: %s\n",
  83                            nt_errstr(nt_status)));
  84                 return nt_status;
  85         }
  86
  87         return NT_STATUS_OK;
  88 }
  89
  90 /**
  91  * Return the challenge as determined by the authentication subsystem
  92  * @return an 8 byte random challenge
  93  */
  94
  95 NTSTATUS auth3_get_challenge(struct auth4_context *auth4_context,
  96                                            uint8_t chal[8])
  97 {
  98         struct auth_context *auth_context = talloc_get_type_abort(auth4_context->private_data,
  99                                                                   struct auth_context);
 100         auth_get_ntlm_challenge(auth_context, chal);
 101         return NT_STATUS_OK;
 102 }
 103
 104 /**
 105  * NTLM2 authentication modifies the effective challenge,
 106  * @param challenge The new challenge value
 107  */
 108 NTSTATUS auth3_set_challenge(struct auth4_context *auth4_context, const uint8_t *chal,
 109                              const char *challenge_set_by)
 110 {
 111         struct auth_context *auth_context = talloc_get_type_abort(auth4_context->private_data,
 112                                                                   struct auth_context);
 113
 114         auth_context->challenge = data_blob_talloc(auth_context,
 115                                                    chal, 8);
 116         NT_STATUS_HAVE_NO_MEMORY(auth_context->challenge.data);
 117
 118         auth_context->challenge_set_by = talloc_strdup(auth_context, challenge_set_by);
 119         NT_STATUS_HAVE_NO_MEMORY(auth_context->challenge_set_by);
 120
 121         DEBUG(5, ("auth_context challenge set by %s\n", auth_context->challenge_set_by));
 122         DEBUG(5, ("challenge is: \n"));
 123         dump_data(5, auth_context->challenge.data, auth_context->challenge.length);
 124         return NT_STATUS_OK;
 125 }
 126
 127 /**
 128  * Check the password on an NTLMSSP login.
 129  *
 130  * Return the session keys used on the connection.
 131  */
 132
 133 NTSTATUS auth3_check_password(struct auth4_context *auth4_context,
 134                               TALLOC_CTX *mem_ctx,
 135                               const struct auth_usersupplied_info *user_info,
 136                               uint8_t *pauthoritative,
 137                               void **server_returned_info,
 138                               DATA_BLOB *session_key, DATA_BLOB *lm_session_key)
 139 {
 140         struct auth_context *auth_context = talloc_get_type_abort(auth4_context->private_data,
 141                                                                   struct auth_context);
 142         struct auth_usersupplied_info *mapped_user_info = NULL;
 143         struct auth_serversupplied_info *server_info;
 144         NTSTATUS nt_status;
 145         bool username_was_mapped;
 146
 147         /*
 148          * Be authoritative by default.
 149          */
 150         *pauthoritative = 1;
 151
 152         /* The client has given us its machine name (which we only get over NBT transport).
 153            We need to possibly reload smb.conf if smb.conf includes depend on the machine name. */
 154
 155         set_remote_machine_name(user_info->workstation_name, True);
 156
 157         /* setup the string used by %U */
 158         /* sub_set_smb_name checks for weird internally */
 159         sub_set_smb_name(user_info->client.account_name);
 160
 161         lp_load_with_shares(get_dyn_CONFIGFILE());
 162
 163         nt_status = make_user_info_map(talloc_tos(),
 164                                        &mapped_user_info,
 165                                        user_info->client.account_name,
 166                                        user_info->client.domain_name,
 167                                        user_info->workstation_name,
 168                                        user_info->remote_host,
 169                                        user_info->local_host,
 170                                        user_info->service_description,
 171                                        user_info->password.response.lanman.data ? &user_info->password.response.lanman : NULL,
 172                                        user_info->password.response.nt.data ? &user_info->password.response.nt : NULL,
 173                                        NULL, NULL, NULL,
 174                                        AUTH_PASSWORD_RESPONSE);
 175
 176         if (!NT_STATUS_IS_OK(nt_status)) {
 177                 return nt_status;
 178         }
 179
 180         mapped_user_info->logon_parameters = user_info->logon_parameters;
 181
 182         mapped_user_info->flags = user_info->flags;
 183
 184         nt_status = auth_check_ntlm_password(mem_ctx,
 185                                              auth_context,
 186                                              mapped_user_info,
 187                                              &server_info,
 188                                              pauthoritative);
 189
 190         if (!NT_STATUS_IS_OK(nt_status)) {
 191                 DEBUG(5,("Checking NTLMSSP password for %s\\%s failed: "
 192                          "%s, authoritative=%u\n",
 193                          user_info->client.domain_name,
 194                          user_info->client.account_name,
 195                          nt_errstr(nt_status),
 196                          *pauthoritative));
 197         }
 198
 199         username_was_mapped = mapped_user_info->was_mapped;
 200
 201         TALLOC_FREE(mapped_user_info);
 202
 203         if (!NT_STATUS_IS_OK(nt_status)) {
 204                 nt_status = do_map_to_guest_server_info(mem_ctx,
 205                                                         nt_status,
 206                                                         user_info->client.account_name,
 207                                                         user_info->client.domain_name,
 208                                                         &server_info);
 209                 if (NT_STATUS_IS_OK(nt_status)) {
 210                         *pauthoritative = 1;
 211                         *server_returned_info = talloc_steal(mem_ctx, server_info);
 212                 }
 213                 return nt_status;
 214         }
 215
 216         server_info->nss_token |= username_was_mapped;
 217
 218         /* Clear out the session keys, and pass them to the caller.
 219          * They will not be used in this form again - instead the
 220          * NTLMSSP code will decide on the final correct session key,
 221          * and supply it to create_local_token() */
 222         if (session_key) {
 223                 DEBUG(10, ("Got NT session key of length %u\n",
 224                         (unsigned int)server_info->session_key.length));
 225                 *session_key = server_info->session_key;
 226                 talloc_steal(mem_ctx, server_info->session_key.data);
 227                 server_info->session_key = data_blob_null;
 228         }
 229         if (lm_session_key) {
 230                 DEBUG(10, ("Got LM session key of length %u\n",
 231                         (unsigned int)server_info->lm_session_key.length));
 232                 *lm_session_key = server_info->lm_session_key;
 233                 talloc_steal(mem_ctx, server_info->lm_session_key.data);
 234                 server_info->lm_session_key = data_blob_null;
 235         }
 236
 237         *server_returned_info = talloc_steal(mem_ctx, server_info);
 238         return nt_status;
 239 }