source3/auth/auth_generic.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle GENSEC authentication, server side
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett 2001-2003,2011
   8    Copyright (C) Simo Sorce 2010.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include <tevent.h>
  26 #include "../lib/util/tevent_ntstatus.h"
  27 #include "auth.h"
  28 #include "../lib/tsocket/tsocket.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "lib/param/param.h"
  31 #ifdef HAVE_KRB5
  32 #include "auth/kerberos/pac_utils.h"
  33 #include "nsswitch/libwbclient/wbclient.h"
  34 #endif
  35 #include "librpc/crypto/gse.h"
  36 #include "auth/credentials/credentials.h"
  37 #include "lib/param/loadparm.h"
  38 #include "librpc/gen_ndr/dcerpc.h"
  39 #include "source3/lib/substitute.h"
  40
  41 static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx,
  42                                                 TALLOC_CTX *mem_ctx,
  43                                                 struct smb_krb5_context *smb_krb5_context,
  44                                                 DATA_BLOB *pac_blob,
  45                                                 const char *princ_name,
  46                                                 const struct tsocket_address *remote_address,
  47                                                 uint32_t session_info_flags,
  48                                                 struct auth_session_info **session_info)
  49 {
  50         enum server_role server_role = lp_server_role();
  51         TALLOC_CTX *tmp_ctx;
  52         bool is_mapped;
  53         bool is_guest;
  54         char *ntuser;
  55         char *ntdomain;
  56         char *username;
  57         const char *rhost;
  58         struct passwd *pw;
  59         NTSTATUS status;
  60
  61         tmp_ctx = talloc_new(mem_ctx);
  62         if (!tmp_ctx) {
  63                 return NT_STATUS_NO_MEMORY;
  64         }
  65
  66         if (tsocket_address_is_inet(remote_address, "ip")) {
  67                 rhost = tsocket_address_inet_addr_string(
  68                         remote_address, tmp_ctx);
  69                 if (rhost == NULL) {
  70                         status = NT_STATUS_NO_MEMORY;
  71                         goto done;
  72                 }
  73         } else {
  74                 rhost = "127.0.0.1";
  75         }
  76
  77         if (server_role != ROLE_STANDALONE) {
  78                 struct wbcAuthUserParams params = { 0 };
  79                 struct wbcAuthUserInfo *info = NULL;
  80                 struct wbcAuthErrorInfo *err = NULL;
  81                 struct auth_serversupplied_info *server_info = NULL;
  82                 char *original_user_name = NULL;
  83                 char *p = NULL;
  84                 wbcErr wbc_err;
  85
  86                 if (pac_blob == NULL) {
  87                         /*
  88                          * This should already be catched at the main
  89                          * gensec layer, but better check twice
  90                          */
  91                         status = NT_STATUS_INTERNAL_ERROR;
  92                         goto done;
  93                 }
  94
  95                 /*
  96                  * Let winbind decode the PAC.
  97                  * This will also store the user
  98                  * data in the netsamlogon cache.
  99                  *
 100                  * This used to be a cache prime
 101                  * optimization, but now we delegate
 102                  * all logic to winbindd, as we require
 103                  * winbindd as domain member anyway.
 104                  */
 105                 params.level = WBC_AUTH_USER_LEVEL_PAC;
 106                 params.password.pac.data = pac_blob->data;
 107                 params.password.pac.length = pac_blob->length;
 108
 109                 /* we are contacting the privileged pipe */
 110                 become_root();
 111                 wbc_err = wbcAuthenticateUserEx(&params, &info, &err);
 112                 unbecome_root();
 113
 114                 /*
 115                  * As this is merely a cache prime
 116                  * WBC_ERR_WINBIND_NOT_AVAILABLE
 117                  * is not a fatal error, treat it
 118                  * as success.
 119                  */
 120
 121                 switch (wbc_err) {
 122                         case WBC_ERR_SUCCESS:
 123                                 break;
 124                         case WBC_ERR_WINBIND_NOT_AVAILABLE:
 125                                 status = NT_STATUS_NO_LOGON_SERVERS;
 126                                 DBG_ERR("winbindd not running - "
 127                                         "but required as domain member: %s\n",
 128                                         nt_errstr(status));
 129                                 goto done;
 130                         case WBC_ERR_AUTH_ERROR:
 131                                 status = NT_STATUS(err->nt_status);
 132                                 wbcFreeMemory(err);
 133                                 goto done;
 134                         case WBC_ERR_NO_MEMORY:
 135                                 status = NT_STATUS_NO_MEMORY;
 136                                 goto done;
 137                         default:
 138                                 status = NT_STATUS_LOGON_FAILURE;
 139                                 goto done;
 140                 }
 141
 142                 status = make_server_info_wbcAuthUserInfo(tmp_ctx,
 143                                                           info->account_name,
 144                                                           info->domain_name,
 145                                                           info, &server_info);
 146                 wbcFreeMemory(info);
 147                 if (!NT_STATUS_IS_OK(status)) {
 148                         DEBUG(10, ("make_server_info_wbcAuthUserInfo failed: %s\n",
 149                                    nt_errstr(status)));
 150                         goto done;
 151                 }
 152
 153                 /* We skip doing this step if the caller asked us not to */
 154                 if (!(server_info->guest)) {
 155                         const char *unix_username = server_info->unix_name;
 156
 157                         /* We might not be root if we are an RPC call */
 158                         become_root();
 159                         status = smb_pam_accountcheck(unix_username, rhost);
 160                         unbecome_root();
 161
 162                         if (!NT_STATUS_IS_OK(status)) {
 163                                 DEBUG(3, ("check_ntlm_password:  PAM Account for user [%s] "
 164                                           "FAILED with error %s\n",
 165                                           unix_username, nt_errstr(status)));
 166                                 goto done;
 167                         }
 168
 169                         DEBUG(5, ("check_ntlm_password:  PAM Account for user [%s] "
 170                                   "succeeded\n", unix_username));
 171                 }
 172
 173                 DEBUG(3, ("Kerberos ticket principal name is [%s]\n", princ_name));
 174
 175                 p = strchr_m(princ_name, '@');
 176                 if (!p) {
 177                         DEBUG(3, ("[%s] Doesn't look like a valid principal\n",
 178                                   princ_name));
 179                         status = NT_STATUS_LOGON_FAILURE;
 180                         goto done;
 181                 }
 182
 183                 original_user_name = talloc_strndup(tmp_ctx, princ_name, p - princ_name);
 184                 if (original_user_name == NULL) {
 185                         status = NT_STATUS_NO_MEMORY;
 186                         goto done;
 187                 }
 188
 189                 status = create_local_token(mem_ctx,
 190                                             server_info,
 191                                             NULL,
 192                                             original_user_name,
 193                                             session_info);
 194                 if (!NT_STATUS_IS_OK(status)) {
 195                         DEBUG(10, ("create_local_token failed: %s\n",
 196                                    nt_errstr(status)));
 197                         goto done;
 198                 }
 199
 200                 goto session_info_ready;
 201         }
 202
 203         /* This is the standalone legacy code path */
 204
 205         if (pac_blob != NULL) {
 206                 /*
 207                  * In standalone mode we don't expect a PAC!
 208                  * we only support MIT realms
 209                  */
 210                 status = NT_STATUS_BAD_TOKEN_TYPE;
 211                 DBG_WARNING("Unexpected PAC for [%s] in standalone mode - %s\n",
 212                             princ_name, nt_errstr(status));
 213                 if (!NT_STATUS_IS_OK(status)) {
 214                         goto done;
 215                 }
 216         }
 217
 218         status = get_user_from_kerberos_info(tmp_ctx, rhost,
 219                                              princ_name,
 220                                              &is_mapped, &is_guest,
 221                                              &ntuser, &ntdomain,
 222                                              &username, &pw);
 223         if (!NT_STATUS_IS_OK(status)) {
 224                 DBG_NOTICE("Failed to map kerberos principal to system user "
 225                           "(%s)\n", nt_errstr(status));
 226                 status = NT_STATUS_ACCESS_DENIED;
 227                 goto done;
 228         }
 229
 230         status = make_session_info_krb5(mem_ctx,
 231                                         ntuser, ntdomain, username, pw,
 232                                         is_guest, is_mapped,
 233                                         session_info);
 234         if (!NT_STATUS_IS_OK(status)) {
 235                 DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
 236                           nt_errstr(status)));
 237                 status = nt_status_squash(status);
 238                 goto done;
 239         }
 240
 241 session_info_ready:
 242
 243         /* setup the string used by %U */
 244         set_current_user_info((*session_info)->unix_info->sanitized_username,
 245                               (*session_info)->unix_info->unix_name,
 246                               (*session_info)->info->domain_name);
 247
 248         /* reload services so that the new %U is taken into account */
 249         lp_load_with_shares(get_dyn_CONFIGFILE());
 250
 251         DEBUG(5, (__location__ "OK: user: %s domain: %s client: %s\n",
 252                   (*session_info)->info->account_name,
 253                   (*session_info)->info->domain_name,
 254                   rhost));
 255
 256         status = NT_STATUS_OK;
 257
 258 done:
 259         TALLOC_FREE(tmp_ctx);
 260         return status;
 261 }
 262
 263 static struct auth4_context *make_auth4_context_s3(TALLOC_CTX *mem_ctx, struct auth_context *auth_context)
 264 {
 265         struct auth4_context *auth4_context = talloc_zero(mem_ctx, struct auth4_context);
 266         if (auth4_context == NULL) {
 267                 DEBUG(10, ("failed to allocate auth4_context failed\n"));
 268                 return NULL;
 269         }
 270         auth4_context->generate_session_info_pac = auth3_generate_session_info_pac;
 271         auth4_context->generate_session_info = auth3_generate_session_info;
 272         auth4_context->get_ntlm_challenge = auth3_get_challenge;
 273         auth4_context->set_ntlm_challenge = auth3_set_challenge;
 274         auth4_context->check_ntlm_password_send = auth3_check_password_send;
 275         auth4_context->check_ntlm_password_recv = auth3_check_password_recv;
 276         auth4_context->private_data = talloc_steal(auth4_context, auth_context);
 277         return auth4_context;
 278 }
 279
 280 NTSTATUS make_auth4_context(TALLOC_CTX *mem_ctx, struct auth4_context **auth4_context_out)
 281 {
 282         struct auth_context *auth_context;
 283         NTSTATUS nt_status;
 284
 285         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 286         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 287
 288         nt_status = make_auth3_context_for_ntlm(tmp_ctx, &auth_context);
 289         if (!NT_STATUS_IS_OK(nt_status)) {
 290                 TALLOC_FREE(tmp_ctx);
 291                 return nt_status;
 292         }
 293
 294         if (auth_context->make_auth4_context) {
 295                 nt_status = auth_context->make_auth4_context(auth_context, mem_ctx, auth4_context_out);
 296                 TALLOC_FREE(tmp_ctx);
 297                 return nt_status;
 298
 299         } else {
 300                 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
 301                 if (auth4_context == NULL) {
 302                         TALLOC_FREE(tmp_ctx);
 303                         return NT_STATUS_NO_MEMORY;
 304                 }
 305                 *auth4_context_out = talloc_steal(mem_ctx, auth4_context);
 306                 TALLOC_FREE(tmp_ctx);
 307                 return NT_STATUS_OK;
 308         }
 309 }
 310
 311 NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
 312                               const struct tsocket_address *remote_address,
 313                               const struct tsocket_address *local_address,
 314                               const char *service_description,
 315                               struct gensec_security **gensec_security_out)
 316 {
 317         struct gensec_security *gensec_security;
 318         struct auth_context *auth_context = NULL;
 319         NTSTATUS nt_status;
 320
 321         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 322         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 323
 324         nt_status = make_auth3_context_for_ntlm(tmp_ctx, &auth_context);
 325         if (!NT_STATUS_IS_OK(nt_status)) {
 326                 goto done;
 327         }
 328
 329         if (auth_context->prepare_gensec) {
 330                 nt_status = auth_context->prepare_gensec(auth_context, tmp_ctx,
 331                                                          &gensec_security);
 332                 if (!NT_STATUS_IS_OK(nt_status)) {
 333                         goto done;
 334                 }
 335         } else {
 336                 const struct gensec_security_ops **backends = NULL;
 337                 struct gensec_settings *gensec_settings;
 338                 struct loadparm_context *lp_ctx;
 339                 size_t idx = 0;
 340                 struct cli_credentials *server_credentials;
 341                 const char *dns_name;
 342                 const char *dns_domain;
 343                 bool ok;
 344                 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
 345                 if (auth4_context == NULL) {
 346                         goto nomem;
 347                 }
 348
 349                 lp_ctx = loadparm_init_s3(tmp_ctx, loadparm_s3_helpers());
 350                 if (lp_ctx == NULL) {
 351                         DEBUG(10, ("loadparm_init_s3 failed\n"));
 352                         nt_status = NT_STATUS_INVALID_SERVER_STATE;
 353                         goto done;
 354                 }
 355
 356                 gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
 357                 if (lp_ctx == NULL) {
 358                         DEBUG(10, ("lpcfg_gensec_settings failed\n"));
 359                         goto nomem;
 360                 }
 361
 362                 /*
 363                  * This should be a 'netbios domain -> DNS domain'
 364                  * mapping, and can currently validly return NULL on
 365                  * poorly configured systems.
 366                  *
 367                  * This is used for the NTLMSSP server
 368                  *
 369                  */
 370                 dns_name = get_mydnsfullname();
 371                 if (dns_name == NULL) {
 372                         dns_name = "";
 373                 }
 374
 375                 dns_domain = get_mydnsdomname(tmp_ctx);
 376                 if (dns_domain == NULL) {
 377                         dns_domain = "";
 378                 }
 379
 380                 gensec_settings->server_dns_name = strlower_talloc(gensec_settings, dns_name);
 381                 if (gensec_settings->server_dns_name == NULL) {
 382                         goto nomem;
 383                 }
 384
 385                 gensec_settings->server_dns_domain = strlower_talloc(gensec_settings, dns_domain);
 386                 if (gensec_settings->server_dns_domain == NULL) {
 387                         goto nomem;
 388                 }
 389
 390                 backends = talloc_zero_array(gensec_settings,
 391                                              const struct gensec_security_ops *, 6);
 392                 if (backends == NULL) {
 393                         goto nomem;
 394                 }
 395                 gensec_settings->backends = backends;
 396
 397                 gensec_init();
 398
 399                 /* These need to be in priority order, krb5 before NTLMSSP */
 400 #if defined(HAVE_KRB5)
 401                 backends[idx++] = &gensec_gse_krb5_security_ops;
 402 #endif
 403
 404                 backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
 405
 406                 backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO);
 407
 408                 backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_SCHANNEL);
 409
 410                 backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM);
 411
 412                 /*
 413                  * This is anonymous for now, because we just use it
 414                  * to set the kerberos state at the moment
 415                  */
 416                 server_credentials = cli_credentials_init_anon(tmp_ctx);
 417                 if (!server_credentials) {
 418                         DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
 419                         goto nomem;
 420                 }
 421
 422                 ok = cli_credentials_set_conf(server_credentials, lp_ctx);
 423                 if (!ok) {
 424                         DBG_ERR("Failed to set server credentials defaults "
 425                                 "from smb.conf.\n");
 426                         goto nomem;
 427                 }
 428
 429                 if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
 430                         cli_credentials_set_kerberos_state(server_credentials,
 431                                                            CRED_USE_KERBEROS_DESIRED,
 432                                                            CRED_SPECIFIED);
 433                 } else {
 434                         cli_credentials_set_kerberos_state(server_credentials,
 435                                                            CRED_USE_KERBEROS_DISABLED,
 436                                                            CRED_SPECIFIED);
 437                 }
 438
 439                 nt_status = gensec_server_start(tmp_ctx, gensec_settings,
 440                                                 auth4_context, &gensec_security);
 441
 442                 if (!NT_STATUS_IS_OK(nt_status)) {
 443                         goto done;
 444                 }
 445
 446                 nt_status = gensec_set_credentials(
 447                         gensec_security, server_credentials);
 448                 if (!NT_STATUS_IS_OK(nt_status)) {
 449                         goto done;
 450                 }
 451         }
 452
 453         nt_status = gensec_set_remote_address(gensec_security,
 454                                               remote_address);
 455         if (!NT_STATUS_IS_OK(nt_status)) {
 456                 goto done;
 457         }
 458
 459         nt_status = gensec_set_local_address(gensec_security,
 460                                              local_address);
 461         if (!NT_STATUS_IS_OK(nt_status)) {
 462                 goto done;
 463         }
 464
 465         nt_status = gensec_set_target_service_description(gensec_security,
 466                                                           service_description);
 467         if (!NT_STATUS_IS_OK(nt_status)) {
 468                 goto done;
 469         }
 470
 471         *gensec_security_out = talloc_move(mem_ctx, &gensec_security);
 472         nt_status = NT_STATUS_OK;
 473         goto done;
 474 nomem:
 475         nt_status = NT_STATUS_NO_MEMORY;
 476 done:
 477         TALLOC_FREE(tmp_ctx);
 478         return nt_status;
 479 }
 480
 481 /*
 482  * Check a username and password, and return the final session_info.
 483  * We also log the authorization of the session here, just as
 484  * gensec_session_info() does.
 485  */
 486 NTSTATUS auth_check_password_session_info(struct auth4_context *auth_context,
 487                                           TALLOC_CTX *mem_ctx,
 488                                           struct auth_usersupplied_info *user_info,
 489                                           struct auth_session_info **session_info)
 490 {
 491         NTSTATUS nt_status;
 492         void *server_info;
 493         uint8_t authoritative = 1;
 494         struct tevent_context *ev = NULL;
 495         struct tevent_req *subreq = NULL;
 496         bool ok;
 497
 498         ev = samba_tevent_context_init(talloc_tos());
 499         if (ev == NULL) {
 500                 return NT_STATUS_NO_MEMORY;
 501         }
 502
 503         subreq = auth_context->check_ntlm_password_send(ev, ev,
 504                                                         auth_context,
 505                                                         user_info);
 506         if (subreq == NULL) {
 507                 TALLOC_FREE(ev);
 508                 return NT_STATUS_NO_MEMORY;
 509         }
 510         ok = tevent_req_poll_ntstatus(subreq, ev, &nt_status);
 511         if (!ok) {
 512                 TALLOC_FREE(ev);
 513                 return nt_status;
 514         }
 515         nt_status = auth_context->check_ntlm_password_recv(subreq,
 516                                                            talloc_tos(),
 517                                                            &authoritative,
 518                                                            &server_info,
 519                                                            NULL, NULL);
 520         TALLOC_FREE(ev);
 521         if (!NT_STATUS_IS_OK(nt_status)) {
 522                 return nt_status;
 523         }
 524
 525         nt_status = auth_context->generate_session_info(auth_context,
 526                                                         mem_ctx,
 527                                                         server_info,
 528                                                         user_info->client.account_name,
 529                                                         AUTH_SESSION_INFO_UNIX_TOKEN |
 530                                                         AUTH_SESSION_INFO_DEFAULT_GROUPS |
 531                                                         AUTH_SESSION_INFO_NTLM,
 532                                                         session_info);
 533         TALLOC_FREE(server_info);
 534
 535         if (!NT_STATUS_IS_OK(nt_status)) {
 536                 return nt_status;
 537         }
 538
 539         /*
 540          * This is rather redundant (the authentication has just been
 541          * logged, with much the same details), but because we want to
 542          * log all authorizations consistently (be they NLTM, NTLMSSP
 543          * or krb5) we log this info again as an authorization.
 544          */
 545         log_successful_authz_event(auth_context->msg_ctx,
 546                                    auth_context->lp_ctx,
 547                                    user_info->remote_host,
 548                                    user_info->local_host,
 549                                    user_info->service_description,
 550                                    user_info->auth_description,
 551                                    AUTHZ_TRANSPORT_PROTECTION_SMB,
 552                                    *session_info,
 553                                    NULL /* client_audit_info */,
 554                                    NULL /* server_audit_info */);
 555
 556         return nt_status;
 557 }