source/libads/authdata.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos authorization data (PAC) utility library
   4    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Luke Howard 2002-2003
   8    Copyright (C) Stefan Metzmacher 2004-2005
   9    Copyright (C) Guenther Deschner 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 2 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program; if not, write to the Free Software
  23    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24 */
  25
  26 #include "includes.h"
  27
  28 #ifdef HAVE_KRB5
  29
  30 static BOOL pac_io_logon_name(const char *desc, PAC_LOGON_NAME *logon_name,
  31                               prs_struct *ps, int depth)
  32 {
  33         if (NULL == logon_name)
  34                 return False;
  35
  36         prs_debug(ps, depth, desc, "pac_io_logon_name");
  37         depth++;
  38
  39         if (!smb_io_time("logon_time", &logon_name->logon_time, ps, depth))
  40                 return False;
  41
  42         if (!prs_uint16("len", ps, depth, &logon_name->len))
  43                 return False;
  44
  45         /* The following string is always in little endian 16 bit values,
  46            copy as 8 bits to avoid endian reversal on big-endian machines.
  47            len is the length in bytes. */
  48
  49         if (UNMARSHALLING(ps) && logon_name->len) {
  50                 logon_name->username = PRS_ALLOC_MEM(ps, uint8, logon_name->len);
  51                 if (!logon_name->username) {
  52                         DEBUG(3, ("No memory available\n"));
  53                         return False;
  54                 }
  55         }
  56
  57         if (!prs_uint8s(True, "name", ps, depth, logon_name->username, logon_name->len))
  58                 return False;
  59
  60         return True;
  61 }
  62
  63 #if 0 /* Unused (handled now in net_io_user_info3()) - Guenther */
  64 static BOOL pac_io_krb_sids(const char *desc, KRB_SID_AND_ATTRS *sid_and_attr,
  65                             prs_struct *ps, int depth)
  66 {
  67         if (NULL == sid_and_attr)
  68                 return False;
  69
  70         prs_debug(ps, depth, desc, "pac_io_krb_sids");
  71         depth++;
  72
  73         if (UNMARSHALLING(ps)) {
  74                 sid_and_attr->sid = PRS_ALLOC_MEM(ps, DOM_SID2, 1);
  75                 if (!sid_and_attr->sid) {
  76                         DEBUG(3, ("No memory available\n"));
  77                         return False;
  78                 }
  79         }
  80
  81         if(!smb_io_dom_sid2("sid", sid_and_attr->sid, ps, depth))
  82                 return False;
  83
  84         return True;
  85 }
  86
  87
  88 static BOOL pac_io_krb_attrs(const char *desc, KRB_SID_AND_ATTRS *sid_and_attr,
  89                              prs_struct *ps, int depth)
  90 {
  91         if (NULL == sid_and_attr)
  92                 return False;
  93
  94         prs_debug(ps, depth, desc, "pac_io_krb_attrs");
  95         depth++;
  96
  97         if (!prs_uint32("sid_ptr", ps, depth, &sid_and_attr->sid_ptr))
  98                 return False;
  99         if (!prs_uint32("attrs", ps, depth, &sid_and_attr->attrs))
 100                 return False;
 101
 102         return True;
 103 }
 104
 105 static BOOL pac_io_krb_sid_and_attr_array(const char *desc,
 106                                           KRB_SID_AND_ATTR_ARRAY *array,
 107                                           uint32 num,
 108                                           prs_struct *ps, int depth)
 109 {
 110         int i;
 111
 112         if (NULL == array)
 113                 return False;
 114
 115         prs_debug(ps, depth, desc, "pac_io_krb_sid_and_attr_array");
 116         depth++;
 117
 118
 119         if (!prs_uint32("count", ps, depth, &array->count))
 120                 return False;
 121
 122         if (UNMARSHALLING(ps)) {
 123                 if (num) {
 124                         array->krb_sid_and_attrs = PRS_ALLOC_MEM(ps, KRB_SID_AND_ATTRS, num);
 125                         if (!array->krb_sid_and_attrs) {
 126                                 DEBUG(3, ("No memory available\n"));
 127                                 return False;
 128                         }
 129                 } else {
 130                         array->krb_sid_and_attrs = NULL;
 131                 }
 132         }
 133
 134         for (i=0; i<num; i++) {
 135                 if (!pac_io_krb_attrs(desc,
 136                                       &array->krb_sid_and_attrs[i],
 137                                       ps, depth))
 138                         return False;
 139
 140         }
 141         for (i=0; i<num; i++) {
 142                 if (!pac_io_krb_sids(desc,
 143                                      &array->krb_sid_and_attrs[i],
 144                                      ps, depth))
 145                         return False;
 146
 147         }
 148
 149         return True;
 150
 151 }
 152 #endif
 153
 154 static BOOL pac_io_group_membership(const char *desc,
 155                                     GROUP_MEMBERSHIP *membership,
 156                                     prs_struct *ps, int depth)
 157 {
 158         if (NULL == membership)
 159                 return False;
 160
 161         prs_debug(ps, depth, desc, "pac_io_group_membership");
 162         depth++;
 163
 164         if (!prs_uint32("rid", ps, depth, &membership->rid))
 165                 return False;
 166         if (!prs_uint32("attrs", ps, depth, &membership->attrs))
 167                 return False;
 168
 169         return True;
 170 }
 171
 172
 173 static BOOL pac_io_group_membership_array(const char *desc,
 174                                           GROUP_MEMBERSHIP_ARRAY *array,
 175                                           uint32 num,
 176                                           prs_struct *ps, int depth)
 177 {
 178         int i;
 179
 180         if (NULL == array)
 181                 return False;
 182
 183         prs_debug(ps, depth, desc, "pac_io_group_membership_array");
 184         depth++;
 185
 186
 187         if (!prs_uint32("count", ps, depth, &array->count))
 188                 return False;
 189
 190         if (UNMARSHALLING(ps)) {
 191                 if (num) {
 192                         array->group_membership = PRS_ALLOC_MEM(ps, GROUP_MEMBERSHIP, num);
 193                         if (!array->group_membership) {
 194                                 DEBUG(3, ("No memory available\n"));
 195                                 return False;
 196                         }
 197                 } else {
 198                         array->group_membership = NULL;
 199                 }
 200         }
 201
 202         for (i=0; i<num; i++) {
 203                 if (!pac_io_group_membership(desc,
 204                                              &array->group_membership[i],
 205                                              ps, depth))
 206                         return False;
 207
 208         }
 209
 210         return True;
 211
 212 }
 213
 214 #if 0 /* Unused, replaced using an expanded net_io_user_info3() now - Guenther */
 215 static BOOL pac_io_pac_logon_info(const char *desc, PAC_LOGON_INFO *info,
 216                                   prs_struct *ps, int depth)
 217 {
 218         uint32 garbage, i;
 219
 220         if (NULL == info)
 221                 return False;
 222
 223         prs_debug(ps, depth, desc, "pac_io_pac_logon_info");
 224         depth++;
 225
 226         if (!prs_align(ps))
 227                 return False;
 228         if (!prs_uint32("unknown", ps, depth, &garbage)) /* 00081001 */
 229                 return False;
 230         if (!prs_uint32("unknown", ps, depth, &garbage)) /* cccccccc */
 231                 return False;
 232         if (!prs_uint32("bufferlen", ps, depth, &garbage))
 233                 return False;
 234         if (!prs_uint32("bufferlenhi", ps, depth, &garbage)) /* 00000000 */
 235                 return False;
 236
 237         if (!prs_uint32("pointer", ps, depth, &garbage))
 238                 return False;
 239
 240         if (!prs_align(ps))
 241                 return False;
 242         if (!smb_io_time("logon_time", &info->logon_time, ps, depth))
 243                 return False;
 244         if (!smb_io_time("logoff_time", &info->logoff_time, ps, depth))
 245                 return False;
 246         if (!smb_io_time("kickoff_time", &info->kickoff_time, ps, depth))
 247                 return False;
 248         if (!smb_io_time("pass_last_set_time", &info->pass_last_set_time,
 249                          ps, depth))
 250                 return False;
 251         if (!smb_io_time("pass_can_change_time", &info->pass_can_change_time,
 252                          ps, depth))
 253                 return False;
 254         if (!smb_io_time("pass_must_change_time", &info->pass_must_change_time,
 255                          ps, depth))
 256                 return False;
 257
 258         if (!smb_io_unihdr("hdr_user_name", &info->hdr_user_name, ps, depth))
 259                 return False;
 260         if (!smb_io_unihdr("hdr_full_name", &info->hdr_full_name, ps, depth))
 261                 return False;
 262         if (!smb_io_unihdr("hdr_logon_script", &info->hdr_logon_script,
 263                            ps, depth))
 264                 return False;
 265         if (!smb_io_unihdr("hdr_profile_path", &info->hdr_profile_path,
 266                            ps, depth))
 267                 return False;
 268         if (!smb_io_unihdr("hdr_home_dir", &info->hdr_home_dir, ps, depth))
 269                 return False;
 270         if (!smb_io_unihdr("hdr_dir_drive", &info->hdr_dir_drive, ps, depth))
 271                 return False;
 272
 273         if (!prs_uint16("logon_count", ps, depth, &info->logon_count))
 274                 return False;
 275         if (!prs_uint16("bad_password_count", ps, depth, &info->bad_password_count))
 276                 return False;
 277         if (!prs_uint32("user_rid", ps, depth, &info->user_rid))
 278                 return False;
 279         if (!prs_uint32("group_rid", ps, depth, &info->group_rid))
 280                 return False;
 281         if (!prs_uint32("group_count", ps, depth, &info->group_count))
 282                 return False;
 283         /* I haven't seen this contain anything yet, but when it does
 284            we will have to make sure we decode the contents in the middle
 285            all the unistr2s ... */
 286         if (!prs_uint32("group_mem_ptr", ps, depth,
 287                         &info->group_membership_ptr))
 288                 return False;
 289         if (!prs_uint32("user_flags", ps, depth, &info->user_flags))
 290                 return False;
 291
 292         if (!prs_uint8s(False, "session_key", ps, depth, info->session_key, 16))
 293                 return False;
 294
 295         if (!smb_io_unihdr("hdr_dom_controller",
 296                            &info->hdr_dom_controller, ps, depth))
 297                 return False;
 298         if (!smb_io_unihdr("hdr_dom_name", &info->hdr_dom_name, ps, depth))
 299                 return False;
 300
 301         /* this should be followed, but just get ptr for now */
 302         if (!prs_uint32("ptr_dom_sid", ps, depth, &info->ptr_dom_sid))
 303                 return False;
 304
 305         if (!prs_uint8s(False, "lm_session_key", ps, depth, info->lm_session_key, 8))
 306                 return False;
 307
 308         if (!prs_uint32("acct_flags", ps, depth, &info->acct_flags))
 309                 return False;
 310
 311         for (i = 0; i < 7; i++)
 312         {
 313                 if (!prs_uint32("unkown", ps, depth, &info->unknown[i])) /* unknown */
 314                         return False;
 315         }
 316
 317         if (!prs_uint32("sid_count", ps, depth, &info->sid_count))
 318                 return False;
 319         if (!prs_uint32("ptr_extra_sids", ps, depth, &info->ptr_extra_sids))
 320                 return False;
 321         if (!prs_uint32("ptr_res_group_dom_sid", ps, depth,
 322                         &info->ptr_res_group_dom_sid))
 323                 return False;
 324         if (!prs_uint32("res_group_count", ps, depth, &info->res_group_count))
 325                 return False;
 326         if (!prs_uint32("ptr_res_groups", ps, depth, &info->ptr_res_groups))
 327                 return False;
 328
 329         if(!smb_io_unistr2("uni_user_name", &info->uni_user_name,
 330                            info->hdr_user_name.buffer, ps, depth))
 331                 return False;
 332         if(!smb_io_unistr2("uni_full_name", &info->uni_full_name,
 333                            info->hdr_full_name.buffer, ps, depth))
 334                 return False;
 335         if(!smb_io_unistr2("uni_logon_script", &info->uni_logon_script,
 336                            info->hdr_logon_script.buffer, ps, depth))
 337                 return False;
 338         if(!smb_io_unistr2("uni_profile_path", &info->uni_profile_path,
 339                            info->hdr_profile_path.buffer, ps, depth))
 340                 return False;
 341         if(!smb_io_unistr2("uni_home_dir", &info->uni_home_dir,
 342                            info->hdr_home_dir.buffer, ps, depth))
 343                 return False;
 344         if(!smb_io_unistr2("uni_dir_drive", &info->uni_dir_drive,
 345                            info->hdr_dir_drive.buffer, ps, depth))
 346                 return False;
 347
 348         if (info->group_membership_ptr) {
 349                 if (!pac_io_group_membership_array("group membership",
 350                                                    &info->groups,
 351                                                    info->group_count,
 352                                                    ps, depth))
 353                         return False;
 354         }
 355
 356
 357         if(!smb_io_unistr2("uni_dom_controller", &info->uni_dom_controller,
 358                            info->hdr_dom_controller.buffer, ps, depth))
 359                 return False;
 360         if(!smb_io_unistr2("uni_dom_name", &info->uni_dom_name,
 361                            info->hdr_dom_name.buffer, ps, depth))
 362                 return False;
 363
 364         if(info->ptr_dom_sid)
 365                 if(!smb_io_dom_sid2("dom_sid", &info->dom_sid, ps, depth))
 366                         return False;
 367
 368
 369         if (info->sid_count && info->ptr_extra_sids)
 370                 if (!pac_io_krb_sid_and_attr_array("extra_sids",
 371                                                    &info->extra_sids,
 372                                                    info->sid_count,
 373                                                    ps, depth))
 374                         return False;
 375
 376         if (info->ptr_res_group_dom_sid)
 377                 if (!smb_io_dom_sid2("res_group_dom_sid",
 378                                      &info->res_group_dom_sid, ps, depth))
 379                         return False;
 380
 381         if (info->ptr_res_groups) {
 382
 383                 if (!(info->user_flgs & LOGON_RESOURCE_GROUPS)) {
 384                         DEBUG(0,("user_flgs attribute does not have LOGON_RESOURCE_GROUPS\n"));
 385                         /* return False; */
 386                 }
 387
 388                 if (!pac_io_group_membership_array("res group membership",
 389                                                    &info->res_groups,
 390                                                    info->res_group_count,
 391                                                    ps, depth))
 392                         return False;
 393         }
 394
 395         return True;
 396 }
 397 #endif
 398
 399 static BOOL pac_io_pac_logon_info(const char *desc, PAC_LOGON_INFO *info,
 400                                   prs_struct *ps, int depth)
 401 {
 402         uint32 garbage;
 403         BOOL kerb_validation_info = True;
 404
 405         if (NULL == info)
 406                 return False;
 407
 408         prs_debug(ps, depth, desc, "pac_io_pac_logon_info");
 409         depth++;
 410
 411         if (!prs_align(ps))
 412                 return False;
 413         if (!prs_uint32("unknown", ps, depth, &garbage)) /* 00081001 */
 414                 return False;
 415         if (!prs_uint32("unknown", ps, depth, &garbage)) /* cccccccc */
 416                 return False;
 417         if (!prs_uint32("bufferlen", ps, depth, &garbage))
 418                 return False;
 419         if (!prs_uint32("bufferlenhi", ps, depth, &garbage)) /* 00000000 */
 420                 return False;
 421
 422         if(!net_io_user_info3("", &info->info3, ps, depth, 3, kerb_validation_info))
 423                 return False;
 424
 425         if (info->info3.ptr_res_group_dom_sid) {
 426                 if (!smb_io_dom_sid2("res_group_dom_sid",
 427                                      &info->res_group_dom_sid, ps, depth))
 428                         return False;
 429         }
 430
 431         if (info->info3.ptr_res_groups) {
 432
 433                 if (!(info->info3.user_flgs & LOGON_RESOURCE_GROUPS)) {
 434                         DEBUG(0,("user_flgs attribute does not have LOGON_RESOURCE_GROUPS\n"));
 435                         /* return False; */
 436                 }
 437
 438                 if (!pac_io_group_membership_array("res group membership",
 439                                                    &info->res_groups,
 440                                                    info->info3.res_group_count,
 441                                                    ps, depth))
 442                         return False;
 443         }
 444
 445         return True;
 446 }
 447
 448
 449
 450 static BOOL pac_io_pac_signature_data(const char *desc,
 451                                       PAC_SIGNATURE_DATA *data, uint32 length,
 452                                       prs_struct *ps, int depth)
 453 {
 454         uint32 siglen = length - sizeof(uint32);
 455         prs_debug(ps, depth, desc, "pac_io_pac_signature_data");
 456         depth++;
 457
 458         if (data == NULL)
 459                 return False;
 460
 461         if (!prs_align(ps))
 462                 return False;
 463         if (!prs_uint32("type", ps, depth, &data->type))
 464                 return False;
 465
 466         if (UNMARSHALLING(ps) && length) {
 467                 if (siglen) {
 468                         data->signature.buffer = PRS_ALLOC_MEM(ps, uint8, siglen);
 469                         if (!data->signature.buffer) {
 470                                 DEBUG(3, ("No memory available\n"));
 471                                 return False;
 472                         }
 473                 } else {
 474                         data->signature.buffer = NULL;
 475                 }
 476         }
 477
 478         data->signature.buf_len = siglen;
 479
 480         if (!prs_uint8s(False, "signature", ps, depth, data->signature.buffer, data->signature.buf_len))
 481                 return False;
 482
 483
 484         return True;
 485 }
 486
 487 static BOOL pac_io_pac_info_hdr_ctr(const char *desc, PAC_BUFFER *hdr,
 488                                     prs_struct *ps, int depth)
 489 {
 490         if (NULL == hdr)
 491                 return False;
 492
 493         prs_debug(ps, depth, desc, "pac_io_pac_info_hdr_ctr");
 494         depth++;
 495
 496         if (!prs_align(ps))
 497                 return False;
 498
 499         if (hdr->offset != prs_offset(ps)) {
 500                 DEBUG(5,("offset in header(x%x) and data(x%x) do not match, correcting\n",
 501                          hdr->offset, prs_offset(ps)));
 502                 prs_set_offset(ps, hdr->offset);
 503         }
 504
 505         if (UNMARSHALLING(ps) && hdr->size > 0) {
 506                 hdr->ctr = PRS_ALLOC_MEM(ps, PAC_INFO_CTR, 1);
 507                 if (!hdr->ctr) {
 508                         DEBUG(3, ("No memory available\n"));
 509                         return False;
 510                 }
 511         }
 512
 513         switch(hdr->type) {
 514         case PAC_TYPE_LOGON_INFO:
 515                 DEBUG(5, ("PAC_TYPE_LOGON_INFO\n"));
 516                 if (UNMARSHALLING(ps))
 517                         hdr->ctr->pac.logon_info = PRS_ALLOC_MEM(ps, PAC_LOGON_INFO, 1);
 518                 if (!hdr->ctr->pac.logon_info) {
 519                         DEBUG(3, ("No memory available\n"));
 520                         return False;
 521                 }
 522                 if (!pac_io_pac_logon_info(desc, hdr->ctr->pac.logon_info,
 523                                            ps, depth))
 524                         return False;
 525                 break;
 526
 527         case PAC_TYPE_SERVER_CHECKSUM:
 528                 DEBUG(5, ("PAC_TYPE_SERVER_CHECKSUM\n"));
 529                 if (UNMARSHALLING(ps))
 530                         hdr->ctr->pac.srv_cksum = PRS_ALLOC_MEM(ps, PAC_SIGNATURE_DATA, 1);
 531                 if (!hdr->ctr->pac.srv_cksum) {
 532                         DEBUG(3, ("No memory available\n"));
 533                         return False;
 534                 }
 535                 if (!pac_io_pac_signature_data(desc, hdr->ctr->pac.srv_cksum,
 536                                                hdr->size, ps, depth))
 537                         return False;
 538                 break;
 539
 540         case PAC_TYPE_PRIVSVR_CHECKSUM:
 541                 DEBUG(5, ("PAC_TYPE_PRIVSVR_CHECKSUM\n"));
 542                 if (UNMARSHALLING(ps))
 543                         hdr->ctr->pac.privsrv_cksum = PRS_ALLOC_MEM(ps, PAC_SIGNATURE_DATA, 1);
 544                 if (!hdr->ctr->pac.privsrv_cksum) {
 545                         DEBUG(3, ("No memory available\n"));
 546                         return False;
 547                 }
 548                 if (!pac_io_pac_signature_data(desc,
 549                                                hdr->ctr->pac.privsrv_cksum,
 550                                                hdr->size, ps, depth))
 551                         return False;
 552                 break;
 553
 554         case PAC_TYPE_LOGON_NAME:
 555                 DEBUG(5, ("PAC_TYPE_LOGON_NAME\n"));
 556                 if (UNMARSHALLING(ps))
 557                         hdr->ctr->pac.logon_name = PRS_ALLOC_MEM(ps, PAC_LOGON_NAME, 1);
 558                 if (!hdr->ctr->pac.logon_name) {
 559                         DEBUG(3, ("No memory available\n"));
 560                         return False;
 561                 }
 562                 if (!pac_io_logon_name(desc, hdr->ctr->pac.logon_name,
 563                                             ps, depth))
 564                         return False;
 565                 break;
 566
 567         default:
 568                 /* dont' know, so we need to skip it */
 569                 DEBUG(3, ("unknown PAC type %d\n", hdr->type));
 570                 prs_set_offset(ps, prs_offset(ps) + hdr->size);
 571         }
 572
 573 #if 0
 574         /* obscure pad */
 575         if (!prs_uint32("pad", ps, depth, &hdr->pad))
 576                 return False;
 577 #endif
 578         return True;
 579 }
 580
 581 static BOOL pac_io_pac_info_hdr(const char *desc, PAC_BUFFER *hdr,
 582                                 prs_struct *ps, int depth)
 583 {
 584         if (NULL == hdr)
 585                 return False;
 586
 587         prs_debug(ps, depth, desc, "pac_io_pac_info_hdr");
 588         depth++;
 589
 590         if (!prs_align(ps))
 591                 return False;
 592         if (!prs_uint32("type", ps, depth, &hdr->type))
 593                 return False;
 594         if (!prs_uint32("size", ps, depth, &hdr->size))
 595                 return False;
 596         if (!prs_uint32("offset", ps, depth, &hdr->offset))
 597                 return False;
 598         if (!prs_uint32("offsethi", ps, depth, &hdr->offsethi))
 599                 return False;
 600
 601         return True;
 602 }
 603
 604 static BOOL pac_io_pac_data(const char *desc, PAC_DATA *data,
 605                             prs_struct *ps, int depth)
 606 {
 607         int i;
 608
 609         if (NULL == data)
 610                 return False;
 611
 612         prs_debug(ps, depth, desc, "pac_io_pac_data");
 613         depth++;
 614
 615         if (!prs_align(ps))
 616                 return False;
 617         if (!prs_uint32("num_buffers", ps, depth, &data->num_buffers))
 618                 return False;
 619         if (!prs_uint32("version", ps, depth, &data->version))
 620                 return False;
 621
 622         if (UNMARSHALLING(ps) && data->num_buffers > 0) {
 623                 if ((data->pac_buffer = PRS_ALLOC_MEM(ps, PAC_BUFFER, data->num_buffers)) == NULL) {
 624                         return False;
 625                 }
 626         }
 627
 628         for (i=0; i<data->num_buffers; i++) {
 629                 if (!pac_io_pac_info_hdr(desc, &data->pac_buffer[i], ps,
 630                                          depth))
 631                         return False;
 632         }
 633
 634         for (i=0; i<data->num_buffers; i++) {
 635                 if (!pac_io_pac_info_hdr_ctr(desc, &data->pac_buffer[i],
 636                                              ps, depth))
 637                         return False;
 638         }
 639
 640         return True;
 641 }
 642
 643 static NTSTATUS check_pac_checksum(TALLOC_CTX *mem_ctx,
 644                                    DATA_BLOB pac_data,
 645                                    PAC_SIGNATURE_DATA *sig,
 646                                    krb5_context context,
 647                                    krb5_keyblock *keyblock)
 648 {
 649         krb5_error_code ret;
 650         krb5_checksum cksum;
 651         krb5_keyusage usage = 0;
 652
 653         smb_krb5_checksum_from_pac_sig(&cksum, sig);
 654
 655 #ifdef HAVE_KRB5_KU_OTHER_CKSUM /* Heimdal */
 656         usage = KRB5_KU_OTHER_CKSUM;
 657 #elif defined(HAVE_KRB5_KEYUSAGE_APP_DATA_CKSUM) /* MIT */
 658         usage = KRB5_KEYUSAGE_APP_DATA_CKSUM;
 659 #else
 660 #error UNKNOWN_KRB5_KEYUSAGE
 661 #endif
 662
 663         ret = smb_krb5_verify_checksum(context,
 664                                        keyblock,
 665                                        usage,
 666                                        &cksum,
 667                                        pac_data.data,
 668                                        pac_data.length);
 669
 670         if (ret) {
 671                 DEBUG(2,("check_pac_checksum: PAC Verification failed: %s (%d)\n",
 672                         error_message(ret), ret));
 673                 return NT_STATUS_ACCESS_DENIED;
 674         }
 675
 676         return NT_STATUS_OK;
 677 }
 678
 679 static NTSTATUS parse_pac_data(TALLOC_CTX *mem_ctx, DATA_BLOB *pac_data_blob, PAC_DATA *pac_data)
 680 {
 681         prs_struct ps;
 682         PAC_DATA *my_pac;
 683
 684         if (!prs_init(&ps, pac_data_blob->length, mem_ctx, UNMARSHALL))
 685                 return NT_STATUS_NO_MEMORY;
 686
 687         if (!prs_copy_data_in(&ps, (char *)pac_data_blob->data, pac_data_blob->length))
 688                 return NT_STATUS_INVALID_PARAMETER;
 689
 690         prs_set_offset(&ps, 0);
 691
 692         my_pac = TALLOC_ZERO_P(mem_ctx, PAC_DATA);
 693         if (!pac_io_pac_data("pac data", my_pac, &ps, 0))
 694                 return NT_STATUS_INVALID_PARAMETER;
 695
 696         prs_mem_free(&ps);
 697
 698         *pac_data = *my_pac;
 699
 700         return NT_STATUS_OK;
 701 }
 702
 703 /* just for debugging, will be removed later - Guenther */
 704 char *pac_group_attr_string(uint32 attr)
 705 {
 706         fstring name = "";
 707
 708         if (!attr)
 709                 return NULL;
 710
 711         if (attr & SE_GROUP_MANDATORY)                  fstrcat(name, "SE_GROUP_MANDATORY ");
 712         if (attr & SE_GROUP_ENABLED_BY_DEFAULT)         fstrcat(name, "SE_GROUP_ENABLED_BY_DEFAULT ");
 713         if (attr & SE_GROUP_ENABLED)                    fstrcat(name, "SE_GROUP_ENABLED ");
 714         if (attr & SE_GROUP_OWNER)                      fstrcat(name, "SE_GROUP_OWNER ");
 715         if (attr & SE_GROUP_USE_FOR_DENY_ONLY)          fstrcat(name, "SE_GROUP_USE_FOR_DENY_ONLY ");
 716         if (attr & SE_GROUP_LOGON_ID)                   fstrcat(name, "SE_GROUP_LOGON_ID ");
 717         if (attr & SE_GROUP_RESOURCE)                   fstrcat(name, "SE_GROUP_RESOURCE ");
 718
 719         return SMB_STRDUP(name);
 720 }
 721
 722 /* just for debugging, will be removed later - Guenther */
 723 static void dump_pac_logon_info(PAC_LOGON_INFO *logon_info) {
 724
 725         DOM_SID dom_sid, res_group_dom_sid;
 726         int i;
 727         char *attr_string;
 728         uint32 user_flgs = logon_info->info3.user_flgs;
 729
 730         if (logon_info->info3.ptr_res_group_dom_sid) {
 731                 sid_copy(&res_group_dom_sid, &logon_info->res_group_dom_sid.sid);
 732         }
 733         sid_copy(&dom_sid, &logon_info->info3.dom_sid.sid);
 734
 735         DEBUG(10,("The PAC:\n"));
 736
 737         DEBUGADD(10,("\tUser Flags: 0x%x (%d)\n", user_flgs, user_flgs));
 738         if (user_flgs & LOGON_EXTRA_SIDS)
 739                 DEBUGADD(10,("\tUser Flags: LOGON_EXTRA_SIDS 0x%x (%d)\n", LOGON_EXTRA_SIDS, LOGON_EXTRA_SIDS));
 740         if (user_flgs & LOGON_RESOURCE_GROUPS)
 741                 DEBUGADD(10,("\tUser Flags: LOGON_RESOURCE_GROUPS 0x%x (%d)\n", LOGON_RESOURCE_GROUPS, LOGON_RESOURCE_GROUPS));
 742         DEBUGADD(10,("\tUser SID: %s-%d\n", sid_string_static(&dom_sid), logon_info->info3.user_rid));
 743         DEBUGADD(10,("\tGroup SID: %s-%d\n", sid_string_static(&dom_sid), logon_info->info3.group_rid));
 744
 745         DEBUGADD(10,("\tGroup Membership (Global and Universal Groups of own domain):\n"));
 746         for (i = 0; i < logon_info->info3.num_groups; i++) {
 747                 attr_string = pac_group_attr_string(logon_info->info3.gids[i].attr);
 748                 DEBUGADD(10,("\t\t%d: sid: %s-%d\n\t\t   attr: 0x%x == %s\n",
 749                         i, sid_string_static(&dom_sid),
 750                         logon_info->info3.gids[i].g_rid,
 751                         logon_info->info3.gids[i].attr,
 752                         attr_string));
 753                 SAFE_FREE(attr_string);
 754         }
 755
 756         DEBUGADD(10,("\tGroup Membership (Domain Local Groups and Groups from Trusted Domains):\n"));
 757         for (i = 0; i < logon_info->info3.num_other_sids; i++) {
 758                 attr_string = pac_group_attr_string(logon_info->info3.other_sids_attrib[i]);
 759                 DEBUGADD(10,("\t\t%d: sid: %s\n\t\t   attr: 0x%x == %s\n",
 760                         i, sid_string_static(&logon_info->info3.other_sids[i].sid),
 761                         logon_info->info3.other_sids_attrib[i],
 762                         attr_string));
 763                 SAFE_FREE(attr_string);
 764         }
 765
 766         DEBUGADD(10,("\tGroup Membership (Ressource Groups (SID History ?)):\n"));
 767         for (i = 0; i < logon_info->info3.res_group_count; i++) {
 768                 attr_string = pac_group_attr_string(logon_info->res_groups.group_membership[i].attrs);
 769                 DEBUGADD(10,("\t\t%d: sid: %s-%d\n\t\t   attr: 0x%x == %s\n",
 770                         i, sid_string_static(&res_group_dom_sid),
 771                         logon_info->res_groups.group_membership[i].rid,
 772                         logon_info->res_groups.group_membership[i].attrs,
 773                         attr_string));
 774                 SAFE_FREE(attr_string);
 775         }
 776 }
 777
 778  NTSTATUS decode_pac_data(TALLOC_CTX *mem_ctx,
 779                          DATA_BLOB *pac_data_blob,
 780                          krb5_context context,
 781                          krb5_keyblock *service_keyblock,
 782                          krb5_const_principal client_principal,
 783                          time_t tgs_authtime,
 784                          PAC_DATA **pac_data)
 785
 786 {
 787         DATA_BLOB modified_pac_blob;
 788         PAC_DATA *my_pac;
 789         NTSTATUS nt_status;
 790         krb5_error_code ret;
 791         PAC_SIGNATURE_DATA *srv_sig = NULL;
 792         PAC_SIGNATURE_DATA *kdc_sig = NULL;
 793         PAC_LOGON_NAME *logon_name = NULL;
 794         PAC_LOGON_INFO *logon_info = NULL;
 795         krb5_principal client_principal_pac = NULL;
 796         NTTIME tgs_authtime_nttime;
 797         int i, srv_sig_pos = 0, kdc_sig_pos = 0;
 798         fstring username;
 799
 800         *pac_data = NULL;
 801
 802         my_pac = talloc(mem_ctx, PAC_DATA);
 803         if (!my_pac) {
 804                 return NT_STATUS_NO_MEMORY;
 805         }
 806
 807         nt_status = parse_pac_data(mem_ctx, pac_data_blob, my_pac);
 808         if (!NT_STATUS_IS_OK(nt_status)) {
 809                 DEBUG(0,("decode_pac_data: failed to parse PAC\n"));
 810                 return nt_status;
 811         }
 812
 813         modified_pac_blob = data_blob_talloc(mem_ctx, pac_data_blob->data, pac_data_blob->length);
 814
 815         if (my_pac->num_buffers < 4) {
 816                 nt_status = NT_STATUS_INVALID_PARAMETER;
 817                 goto out;
 818         }
 819
 820         /* store signatures */
 821         for (i=0; i < my_pac->num_buffers; i++) {
 822
 823                 switch (my_pac->pac_buffer[i].type) {
 824
 825                         case PAC_TYPE_SERVER_CHECKSUM:
 826                                 if (!my_pac->pac_buffer[i].ctr->pac.srv_cksum) {
 827                                         break;
 828                                 }
 829
 830                                 srv_sig = my_pac->pac_buffer[i].ctr->pac.srv_cksum;
 831
 832                                 /* get position of signature buffer */
 833                                 srv_sig_pos = my_pac->pac_buffer[i].offset;
 834                                 srv_sig_pos += sizeof(uint32);
 835
 836                                 break;
 837
 838                         case PAC_TYPE_PRIVSVR_CHECKSUM:
 839                                 if (!my_pac->pac_buffer[i].ctr->pac.privsrv_cksum) {
 840                                         break;
 841                                 }
 842
 843                                 kdc_sig = my_pac->pac_buffer[i].ctr->pac.privsrv_cksum;
 844
 845                                 /* get position of signature buffer */
 846                                 kdc_sig_pos = my_pac->pac_buffer[i].offset;
 847                                 kdc_sig_pos += sizeof(uint32);
 848
 849                                 break;
 850
 851                         case PAC_TYPE_LOGON_NAME:
 852                                 if (!my_pac->pac_buffer[i].ctr->pac.logon_name) {
 853                                         break;
 854                                 }
 855
 856                                 logon_name = my_pac->pac_buffer[i].ctr->pac.logon_name;
 857                                 break;
 858
 859                         case PAC_TYPE_LOGON_INFO:
 860                                 if (!my_pac->pac_buffer[i].ctr->pac.logon_info) {
 861                                         break;
 862                                 }
 863
 864                                 logon_info = my_pac->pac_buffer[i].ctr->pac.logon_info;
 865                                 break;
 866                         }
 867
 868         }
 869
 870         if (!srv_sig || !kdc_sig || !logon_name || !logon_info) {
 871                 nt_status = NT_STATUS_INVALID_PARAMETER;
 872                 goto out;
 873         }
 874
 875         /* zero PAC_SIGNATURE_DATA signature buffer */
 876         memset(&modified_pac_blob.data[srv_sig_pos], '\0', srv_sig->signature.buf_len);
 877         memset(&modified_pac_blob.data[kdc_sig_pos], '\0', kdc_sig->signature.buf_len);
 878
 879         /* check server signature */
 880         nt_status = check_pac_checksum(mem_ctx, modified_pac_blob, srv_sig, context, service_keyblock);
 881         if (!NT_STATUS_IS_OK(nt_status)) {
 882                 DEBUG(0,("decode_pac_data: failed to verify PAC server signature\n"));
 883                 goto out;
 884         }
 885
 886         /* Convert to NT time, so as not to loose accuracy in comparison */
 887         unix_to_nt_time(&tgs_authtime_nttime, tgs_authtime);
 888
 889         if (!nt_time_equals(&tgs_authtime_nttime, &logon_name->logon_time)) {
 890
 891                 DEBUG(2,("decode_pac_data: Logon time mismatch between ticket and PAC!\n"));
 892                 DEBUGADD(2, ("decode_pac_data: PAC: %s\n",
 893                         http_timestring(nt_time_to_unix(logon_name->logon_time))));
 894                 DEBUGADD(2, ("decode_pac_data: Ticket: %s\n",
 895                         http_timestring(nt_time_to_unix(tgs_authtime_nttime))));
 896
 897                 nt_status = NT_STATUS_ACCESS_DENIED;
 898                 goto out;
 899         }
 900
 901         if (!logon_name->len) {
 902                 DEBUG(2,("decode_pac_data: No Logon Name available\n"));
 903                 nt_status = NT_STATUS_INVALID_PARAMETER;
 904                 goto out;
 905         }
 906         rpcstr_pull(username, logon_name->username, sizeof(username), logon_name->len, 0);
 907
 908         ret = smb_krb5_parse_name_norealm(context, username, &client_principal_pac);
 909         if (ret) {
 910                 DEBUG(2,("decode_pac_data: Could not parse name from incoming PAC: [%s]: %s\n",
 911                         username, error_message(ret)));
 912                 nt_status = NT_STATUS_INVALID_PARAMETER;
 913                 goto out;
 914         }
 915
 916         if (!smb_krb5_principal_compare_any_realm(context, client_principal, client_principal_pac)) {
 917                 DEBUG(2,("decode_pac_data: Name in PAC [%s] does not match principal name in ticket\n",
 918                         username));
 919                 nt_status = NT_STATUS_ACCESS_DENIED;
 920                 goto out;
 921         }
 922
 923         DEBUG(10,("Successfully validated Kerberos PAC\n"));
 924
 925         dump_pac_logon_info(logon_info);
 926
 927         *pac_data = my_pac;
 928
 929         nt_status = NT_STATUS_OK;
 930
 931 out:
 932         if (client_principal_pac) {
 933                 krb5_free_principal(context, client_principal_pac);
 934         }
 935
 936         return nt_status;
 937 }
 938
 939  PAC_LOGON_INFO *get_logon_info_from_pac(PAC_DATA *pac_data)
 940 {
 941         PAC_LOGON_INFO *logon_info = NULL;
 942         int i;
 943
 944         for (i=0; i < pac_data->num_buffers; i++) {
 945
 946                 if (pac_data->pac_buffer[i].type != PAC_TYPE_LOGON_INFO)
 947                         continue;
 948
 949                 logon_info = pac_data->pac_buffer[i].ctr->pac.logon_info;
 950                 break;
 951         }
 952         return logon_info;
 953 }
 954
 955 #endif