2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Volker Lendecke 2010
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "../lib/crypto/arcfour.h"
22 #include "../librpc/gen_ndr/netlogon.h"
23 #include "../libcli/security/security.h"
24 #include "rpc_client/util_netlogon.h"
27 #define DBGC_CLASS DBGC_AUTH
29 /* FIXME: do we really still need this ? */
30 static int server_info_dtor(struct auth_serversupplied_info
*server_info
)
32 TALLOC_FREE(server_info
->info3
);
33 ZERO_STRUCTP(server_info
);
37 /***************************************************************************
38 Make a server_info struct. Free with TALLOC_FREE().
39 ***************************************************************************/
41 struct auth_serversupplied_info
*make_server_info(TALLOC_CTX
*mem_ctx
)
43 struct auth_serversupplied_info
*result
;
45 result
= TALLOC_ZERO_P(mem_ctx
, struct auth_serversupplied_info
);
47 DEBUG(0, ("talloc failed\n"));
51 talloc_set_destructor(result
, server_info_dtor
);
53 /* Initialise the uid and gid values to something non-zero
54 which may save us from giving away root access if there
55 is a bug in allocating these fields. */
57 result
->utok
.uid
= -1;
58 result
->utok
.gid
= -1;
63 /****************************************************************************
64 inits a netr_SamInfo2 structure from an auth_serversupplied_info. sam2 must
65 already be initialized and is used as the talloc parent for its members.
66 *****************************************************************************/
68 NTSTATUS
serverinfo_to_SamInfo2(struct auth_serversupplied_info
*server_info
,
69 uint8_t *pipe_session_key
,
70 size_t pipe_session_key_len
,
71 struct netr_SamInfo2
*sam2
)
73 struct netr_SamInfo3
*info3
;
75 info3
= copy_netr_SamInfo3(sam2
, server_info
->info3
);
77 return NT_STATUS_NO_MEMORY
;
80 if (server_info
->user_session_key
.length
) {
81 memcpy(info3
->base
.key
.key
,
82 server_info
->user_session_key
.data
,
83 MIN(sizeof(info3
->base
.key
.key
),
84 server_info
->user_session_key
.length
));
85 if (pipe_session_key
) {
86 arcfour_crypt(info3
->base
.key
.key
,
87 pipe_session_key
, 16);
90 if (server_info
->lm_session_key
.length
) {
91 memcpy(info3
->base
.LMSessKey
.key
,
92 server_info
->lm_session_key
.data
,
93 MIN(sizeof(info3
->base
.LMSessKey
.key
),
94 server_info
->lm_session_key
.length
));
95 if (pipe_session_key
) {
96 arcfour_crypt(info3
->base
.LMSessKey
.key
,
101 sam2
->base
= info3
->base
;
106 /****************************************************************************
107 inits a netr_SamInfo3 structure from an auth_serversupplied_info. sam3 must
108 already be initialized and is used as the talloc parent for its members.
109 *****************************************************************************/
111 NTSTATUS
serverinfo_to_SamInfo3(const struct auth_serversupplied_info
*server_info
,
112 uint8_t *pipe_session_key
,
113 size_t pipe_session_key_len
,
114 struct netr_SamInfo3
*sam3
)
116 struct netr_SamInfo3
*info3
;
118 info3
= copy_netr_SamInfo3(sam3
, server_info
->info3
);
120 return NT_STATUS_NO_MEMORY
;
123 if (server_info
->user_session_key
.length
) {
124 memcpy(info3
->base
.key
.key
,
125 server_info
->user_session_key
.data
,
126 MIN(sizeof(info3
->base
.key
.key
),
127 server_info
->user_session_key
.length
));
128 if (pipe_session_key
) {
129 arcfour_crypt(info3
->base
.key
.key
,
130 pipe_session_key
, 16);
133 if (server_info
->lm_session_key
.length
) {
134 memcpy(info3
->base
.LMSessKey
.key
,
135 server_info
->lm_session_key
.data
,
136 MIN(sizeof(info3
->base
.LMSessKey
.key
),
137 server_info
->lm_session_key
.length
));
138 if (pipe_session_key
) {
139 arcfour_crypt(info3
->base
.LMSessKey
.key
,
140 pipe_session_key
, 8);
144 sam3
->base
= info3
->base
;
152 /****************************************************************************
153 inits a netr_SamInfo6 structure from an auth_serversupplied_info. sam6 must
154 already be initialized and is used as the talloc parent for its members.
155 *****************************************************************************/
157 NTSTATUS
serverinfo_to_SamInfo6(struct auth_serversupplied_info
*server_info
,
158 uint8_t *pipe_session_key
,
159 size_t pipe_session_key_len
,
160 struct netr_SamInfo6
*sam6
)
162 struct pdb_domain_info
*dominfo
;
163 struct netr_SamInfo3
*info3
;
165 if ((pdb_capabilities() & PDB_CAP_ADS
) == 0) {
166 DEBUG(10,("Not adding validation info level 6 "
167 "without ADS passdb backend\n"));
168 return NT_STATUS_INVALID_INFO_CLASS
;
171 dominfo
= pdb_get_domain_info(sam6
);
172 if (dominfo
== NULL
) {
173 return NT_STATUS_NO_MEMORY
;
176 info3
= copy_netr_SamInfo3(sam6
, server_info
->info3
);
178 return NT_STATUS_NO_MEMORY
;
181 if (server_info
->user_session_key
.length
) {
182 memcpy(info3
->base
.key
.key
,
183 server_info
->user_session_key
.data
,
184 MIN(sizeof(info3
->base
.key
.key
),
185 server_info
->user_session_key
.length
));
186 if (pipe_session_key
) {
187 arcfour_crypt(info3
->base
.key
.key
,
188 pipe_session_key
, 16);
191 if (server_info
->lm_session_key
.length
) {
192 memcpy(info3
->base
.LMSessKey
.key
,
193 server_info
->lm_session_key
.data
,
194 MIN(sizeof(info3
->base
.LMSessKey
.key
),
195 server_info
->lm_session_key
.length
));
196 if (pipe_session_key
) {
197 arcfour_crypt(info3
->base
.LMSessKey
.key
,
198 pipe_session_key
, 8);
202 sam6
->base
= info3
->base
;
207 sam6
->dns_domainname
.string
= talloc_strdup(sam6
, dominfo
->dns_domain
);
208 if (sam6
->dns_domainname
.string
== NULL
) {
209 return NT_STATUS_NO_MEMORY
;
212 sam6
->principle
.string
= talloc_asprintf(sam6
, "%s@%s",
213 sam6
->base
.account_name
.string
,
214 sam6
->dns_domainname
.string
);
215 if (sam6
->principle
.string
== NULL
) {
216 return NT_STATUS_NO_MEMORY
;
222 static NTSTATUS
append_netr_SidAttr(TALLOC_CTX
*mem_ctx
,
223 struct netr_SidAttr
**sids
,
225 const struct dom_sid2
*asid
,
230 *sids
= talloc_realloc(mem_ctx
, *sids
, struct netr_SidAttr
, t
+ 1);
232 return NT_STATUS_NO_MEMORY
;
234 (*sids
)[t
].sid
= dom_sid_dup(*sids
, asid
);
235 if ((*sids
)[t
].sid
== NULL
) {
236 return NT_STATUS_NO_MEMORY
;
238 (*sids
)[t
].attributes
= attributes
;
244 /* Fills the samr_RidWithAttributeArray with the provided sids.
245 * If it happens that we have additional groups that do not belong
246 * to the domain, add their sids as extra sids */
247 static NTSTATUS
group_sids_to_info3(struct netr_SamInfo3
*info3
,
248 const struct dom_sid
*sids
,
251 uint32_t attributes
= SE_GROUP_MANDATORY
|
252 SE_GROUP_ENABLED_BY_DEFAULT
|
254 struct samr_RidWithAttributeArray
*groups
;
255 struct dom_sid
*domain_sid
;
261 domain_sid
= info3
->base
.domain_sid
;
262 groups
= &info3
->base
.groups
;
264 groups
->rids
= talloc_array(info3
,
265 struct samr_RidWithAttribute
, num_sids
);
267 return NT_STATUS_NO_MEMORY
;
270 for (i
= 0; i
< num_sids
; i
++) {
271 ok
= sid_peek_check_rid(domain_sid
, &sids
[i
], &rid
);
274 /* if it is the primary gid, skip it, we
275 * obviously already have it */
276 if (info3
->base
.primary_gid
== rid
) continue;
278 /* store domain group rid */
279 groups
->rids
[i
].rid
= rid
;
280 groups
->rids
[i
].attributes
= attributes
;
285 /* if this wasn't a domain sid, add it as extra sid */
286 status
= append_netr_SidAttr(info3
, &info3
->sids
,
288 &sids
[i
], attributes
);
289 if (!NT_STATUS_IS_OK(status
)) {
297 #define RET_NOMEM(ptr) do { \
299 TALLOC_FREE(info3); \
300 return NT_STATUS_NO_MEMORY; \
303 NTSTATUS
samu_to_SamInfo3(TALLOC_CTX
*mem_ctx
,
305 const char *login_server
,
306 struct netr_SamInfo3
**_info3
,
307 struct extra_auth_info
*extra
)
309 struct netr_SamInfo3
*info3
;
310 const struct dom_sid
*user_sid
;
311 const struct dom_sid
*group_sid
;
312 struct dom_sid domain_sid
;
313 struct dom_sid
*group_sids
;
314 uint32_t num_group_sids
= 0;
320 user_sid
= pdb_get_user_sid(samu
);
321 group_sid
= pdb_get_group_sid(samu
);
323 if (!user_sid
|| !group_sid
) {
324 DEBUG(1, ("Sam account is missing sids!\n"));
325 return NT_STATUS_UNSUCCESSFUL
;
328 info3
= talloc_zero(mem_ctx
, struct netr_SamInfo3
);
330 return NT_STATUS_NO_MEMORY
;
333 ZERO_STRUCT(domain_sid
);
335 /* check if this is a "Unix Users" domain user,
336 * we need to handle it in a special way if that's the case */
337 if (sid_check_is_in_unix_users(user_sid
)) {
338 /* in info3 you can only set rids for the user and the
339 * primary group, and the domain sid must be that of
342 * Store a completely bogus value here.
343 * The real SID is stored in the extra sids.
344 * Other code will know to look there if (-1) is found
346 info3
->base
.rid
= (uint32_t)(-1);
347 sid_copy(&extra
->user_sid
, user_sid
);
349 DEBUG(10, ("Unix User found in struct samu. Rid marked as "
350 "special and sid (%s) saved as extra sid\n",
351 sid_string_dbg(user_sid
)));
353 sid_copy(&domain_sid
, user_sid
);
354 sid_split_rid(&domain_sid
, &info3
->base
.rid
);
357 if (is_null_sid(&domain_sid
)) {
358 sid_copy(&domain_sid
, get_global_sam_sid());
361 /* check if this is a "Unix Groups" domain group,
362 * if so we need special handling */
363 if (sid_check_is_in_unix_groups(group_sid
)) {
364 /* in info3 you can only set rids for the user and the
365 * primary group, and the domain sid must be that of
368 * Store a completely bogus value here.
369 * The real SID is stored in the extra sids.
370 * Other code will know to look there if (-1) is found
372 info3
->base
.primary_gid
= (uint32_t)(-1);
373 sid_copy(&extra
->pgid_sid
, group_sid
);
375 DEBUG(10, ("Unix Group found in struct samu. Rid marked as "
376 "special and sid (%s) saved as extra sid\n",
377 sid_string_dbg(group_sid
)));
380 ok
= sid_peek_check_rid(&domain_sid
, group_sid
,
381 &info3
->base
.primary_gid
);
383 DEBUG(1, ("The primary group domain sid(%s) does not "
384 "match the domain sid(%s) for %s(%s)\n",
385 sid_string_dbg(group_sid
),
386 sid_string_dbg(&domain_sid
),
387 pdb_get_username(samu
),
388 sid_string_dbg(user_sid
)));
390 return NT_STATUS_UNSUCCESSFUL
;
394 unix_to_nt_time(&info3
->base
.last_logon
, pdb_get_logon_time(samu
));
395 unix_to_nt_time(&info3
->base
.last_logoff
, get_time_t_max());
396 unix_to_nt_time(&info3
->base
.acct_expiry
, get_time_t_max());
397 unix_to_nt_time(&info3
->base
.last_password_change
,
398 pdb_get_pass_last_set_time(samu
));
399 unix_to_nt_time(&info3
->base
.allow_password_change
,
400 pdb_get_pass_can_change_time(samu
));
401 unix_to_nt_time(&info3
->base
.force_password_change
,
402 pdb_get_pass_must_change_time(samu
));
404 tmp
= pdb_get_username(samu
);
406 info3
->base
.account_name
.string
= talloc_strdup(info3
, tmp
);
407 RET_NOMEM(info3
->base
.account_name
.string
);
409 tmp
= pdb_get_fullname(samu
);
411 info3
->base
.full_name
.string
= talloc_strdup(info3
, tmp
);
412 RET_NOMEM(info3
->base
.full_name
.string
);
414 tmp
= pdb_get_logon_script(samu
);
416 info3
->base
.logon_script
.string
= talloc_strdup(info3
, tmp
);
417 RET_NOMEM(info3
->base
.logon_script
.string
);
419 tmp
= pdb_get_profile_path(samu
);
421 info3
->base
.profile_path
.string
= talloc_strdup(info3
, tmp
);
422 RET_NOMEM(info3
->base
.profile_path
.string
);
424 tmp
= pdb_get_homedir(samu
);
426 info3
->base
.home_directory
.string
= talloc_strdup(info3
, tmp
);
427 RET_NOMEM(info3
->base
.home_directory
.string
);
429 tmp
= pdb_get_dir_drive(samu
);
431 info3
->base
.home_drive
.string
= talloc_strdup(info3
, tmp
);
432 RET_NOMEM(info3
->base
.home_drive
.string
);
435 info3
->base
.logon_count
= pdb_get_logon_count(samu
);
436 info3
->base
.bad_password_count
= pdb_get_bad_password_count(samu
);
438 status
= pdb_enum_group_memberships(mem_ctx
, samu
,
441 if (!NT_STATUS_IS_OK(status
)) {
442 DEBUG(1, ("Failed to get groups from sam account.\n"));
447 if (num_group_sids
) {
448 status
= group_sids_to_info3(info3
, group_sids
, num_group_sids
);
449 if (!NT_STATUS_IS_OK(status
)) {
455 /* We don't need sids and gids after the conversion */
456 TALLOC_FREE(group_sids
);
460 /* FIXME: should we add other flags ? */
461 info3
->base
.user_flags
= NETLOGON_EXTRA_SIDS
;
464 info3
->base
.logon_server
.string
= talloc_strdup(info3
, login_server
);
465 RET_NOMEM(info3
->base
.logon_server
.string
);
468 info3
->base
.domain
.string
= talloc_strdup(info3
,
469 pdb_get_domain(samu
));
470 RET_NOMEM(info3
->base
.domain
.string
);
472 info3
->base
.domain_sid
= dom_sid_dup(info3
, &domain_sid
);
473 RET_NOMEM(info3
->base
.domain_sid
);
475 info3
->base
.acct_flags
= pdb_get_acct_ctrl(samu
);
483 #define RET_NOMEM(ptr) do { \
485 TALLOC_FREE(info3); \
489 struct netr_SamInfo3
*copy_netr_SamInfo3(TALLOC_CTX
*mem_ctx
,
490 struct netr_SamInfo3
*orig
)
492 struct netr_SamInfo3
*info3
;
496 info3
= talloc_zero(mem_ctx
, struct netr_SamInfo3
);
497 if (!info3
) return NULL
;
499 status
= copy_netr_SamBaseInfo(info3
, &orig
->base
, &info3
->base
);
500 if (!NT_STATUS_IS_OK(status
)) {
505 if (orig
->sidcount
) {
506 info3
->sidcount
= orig
->sidcount
;
507 info3
->sids
= talloc_array(info3
, struct netr_SidAttr
,
509 RET_NOMEM(info3
->sids
);
510 for (i
= 0; i
< orig
->sidcount
; i
++) {
511 info3
->sids
[i
].sid
= dom_sid_dup(info3
->sids
,
513 RET_NOMEM(info3
->sids
[i
].sid
);
514 info3
->sids
[i
].attributes
=
515 orig
->sids
[i
].attributes
;
522 static NTSTATUS
wbcsids_to_samr_RidWithAttributeArray(
524 struct samr_RidWithAttributeArray
*groups
,
525 const struct dom_sid
*domain_sid
,
526 const struct wbcSidWithAttr
*sids
,
532 groups
->rids
= talloc_array(mem_ctx
,
533 struct samr_RidWithAttribute
, num_sids
);
535 return NT_STATUS_NO_MEMORY
;
538 /* a wbcDomainSid is the same as a dom_sid */
539 for (i
= 0; i
< num_sids
; i
++) {
540 ok
= sid_peek_check_rid(domain_sid
,
541 (const struct dom_sid
*)&sids
[i
].sid
,
542 &groups
->rids
[i
].rid
);
545 groups
->rids
[i
].attributes
= SE_GROUP_MANDATORY
|
546 SE_GROUP_ENABLED_BY_DEFAULT
|
554 struct netr_SamInfo3
*wbcAuthUserInfo_to_netr_SamInfo3(TALLOC_CTX
*mem_ctx
,
555 const struct wbcAuthUserInfo
*info
)
557 struct netr_SamInfo3
*info3
;
558 struct dom_sid user_sid
;
559 struct dom_sid group_sid
;
560 struct dom_sid domain_sid
;
564 memcpy(&user_sid
, &info
->sids
[0].sid
, sizeof(user_sid
));
565 memcpy(&group_sid
, &info
->sids
[1].sid
, sizeof(group_sid
));
567 info3
= talloc_zero(mem_ctx
, struct netr_SamInfo3
);
568 if (!info3
) return NULL
;
570 info3
->base
.last_logon
= info
->logon_time
;
571 info3
->base
.last_logoff
= info
->logoff_time
;
572 info3
->base
.acct_expiry
= info
->kickoff_time
;
573 unix_to_nt_time(&info3
->base
.last_password_change
, info
->pass_last_set_time
);
574 unix_to_nt_time(&info3
->base
.allow_password_change
,
575 info
->pass_can_change_time
);
576 unix_to_nt_time(&info3
->base
.force_password_change
,
577 info
->pass_must_change_time
);
579 if (info
->account_name
) {
580 info3
->base
.account_name
.string
=
581 talloc_strdup(info3
, info
->account_name
);
582 RET_NOMEM(info3
->base
.account_name
.string
);
584 if (info
->full_name
) {
585 info3
->base
.full_name
.string
=
586 talloc_strdup(info3
, info
->full_name
);
587 RET_NOMEM(info3
->base
.full_name
.string
);
589 if (info
->logon_script
) {
590 info3
->base
.logon_script
.string
=
591 talloc_strdup(info3
, info
->logon_script
);
592 RET_NOMEM(info3
->base
.logon_script
.string
);
594 if (info
->profile_path
) {
595 info3
->base
.profile_path
.string
=
596 talloc_strdup(info3
, info
->profile_path
);
597 RET_NOMEM(info3
->base
.profile_path
.string
);
599 if (info
->home_directory
) {
600 info3
->base
.home_directory
.string
=
601 talloc_strdup(info3
, info
->home_directory
);
602 RET_NOMEM(info3
->base
.home_directory
.string
);
604 if (info
->home_drive
) {
605 info3
->base
.home_drive
.string
=
606 talloc_strdup(info3
, info
->home_drive
);
607 RET_NOMEM(info3
->base
.home_drive
.string
);
610 info3
->base
.logon_count
= info
->logon_count
;
611 info3
->base
.bad_password_count
= info
->bad_password_count
;
613 sid_copy(&domain_sid
, &user_sid
);
614 sid_split_rid(&domain_sid
, &info3
->base
.rid
);
616 ok
= sid_peek_check_rid(&domain_sid
, &group_sid
,
617 &info3
->base
.primary_gid
);
619 DEBUG(1, ("The primary group sid domain does not"
620 "match user sid domain for user: %s\n",
621 info
->account_name
));
626 status
= wbcsids_to_samr_RidWithAttributeArray(info3
,
631 if (!NT_STATUS_IS_OK(status
)) {
636 info3
->base
.user_flags
= info
->user_flags
;
637 memcpy(info3
->base
.key
.key
, info
->user_session_key
, 16);
639 if (info
->logon_server
) {
640 info3
->base
.logon_server
.string
=
641 talloc_strdup(info3
, info
->logon_server
);
642 RET_NOMEM(info3
->base
.logon_server
.string
);
644 if (info
->domain_name
) {
645 info3
->base
.domain
.string
=
646 talloc_strdup(info3
, info
->domain_name
);
647 RET_NOMEM(info3
->base
.domain
.string
);
650 info3
->base
.domain_sid
= dom_sid_dup(info3
, &domain_sid
);
651 RET_NOMEM(info3
->base
.domain_sid
);
653 memcpy(info3
->base
.LMSessKey
.key
, info
->lm_session_key
, 8);
654 info3
->base
.acct_flags
= info
->acct_flags
;