source: vendor/3.6.24/source4/auth/system_session.c

Last change on this file was 740, checked in by Silvan Scherrer, 13 years ago

Samba Server: update vendor to 3.6.0
File size: 13.3 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001-2010
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Stefan Metzmacher 2005
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22*/
23
24#include "includes.h"
25#include "libcli/security/security.h"
26#include "auth/credentials/credentials.h"
27#include "param/param.h"
28#include "auth/auth.h" /* for auth_user_info_dc */
29#include "auth/session.h"
30#include "auth/system_session_proto.h"
31
32
33/*
34 prevent the static system session being freed
35 */
36static int system_session_destructor(struct auth_session_info *info)
37{
38 return -1;
39}
40
41/* Create a security token for a session SYSTEM (the most
42 * trusted/prvilaged account), including the local machine account as
43 * the off-host credentials
44 */
45_PUBLIC_ struct auth_session_info *system_session(struct loadparm_context *lp_ctx)
46{
47 static struct auth_session_info *static_session;
48 NTSTATUS nt_status;
49
50 if (static_session) {
51 return static_session;
52 }
53
54 nt_status = auth_system_session_info(talloc_autofree_context(),
55 lp_ctx,
56 &static_session);
57 if (!NT_STATUS_IS_OK(nt_status)) {
58 talloc_free(static_session);
59 static_session = NULL;
60 return NULL;
61 }
62 talloc_set_destructor(static_session, system_session_destructor);
63 return static_session;
64}
65
66NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
67 struct loadparm_context *lp_ctx,
68 struct auth_session_info **_session_info)
69{
70 NTSTATUS nt_status;
71 struct auth_user_info_dc *user_info_dc = NULL;
72 struct auth_session_info *session_info = NULL;
73 TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
74
75 nt_status = auth_system_user_info_dc(mem_ctx, lpcfg_netbios_name(lp_ctx),
76 &user_info_dc);
77 if (!NT_STATUS_IS_OK(nt_status)) {
78 talloc_free(mem_ctx);
79 return nt_status;
80 }
81
82 /* references the user_info_dc into the session_info */
83 nt_status = auth_generate_session_info(parent_ctx, NULL, NULL, user_info_dc, AUTH_SESSION_INFO_SIMPLE_PRIVILEGES, &session_info);
84 talloc_free(mem_ctx);
85
86 NT_STATUS_NOT_OK_RETURN(nt_status);
87
88 session_info->credentials = cli_credentials_init(session_info);
89 if (!session_info->credentials) {
90 return NT_STATUS_NO_MEMORY;
91 }
92
93 cli_credentials_set_conf(session_info->credentials, lp_ctx);
94
95 cli_credentials_set_machine_account_pending(session_info->credentials, lp_ctx);
96 *_session_info = session_info;
97
98 return NT_STATUS_OK;
99}
100
101NTSTATUS auth_system_user_info_dc(TALLOC_CTX *mem_ctx, const char *netbios_name,
102 struct auth_user_info_dc **_user_info_dc)
103{
104 struct auth_user_info_dc *user_info_dc;
105 struct auth_user_info *info;
106
107 user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
108 NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
109
110 /* This returns a pointer to a struct dom_sid, which is the
111 * same as a 1 element list of struct dom_sid */
112 user_info_dc->num_sids = 1;
113 user_info_dc->sids = dom_sid_parse_talloc(user_info_dc, SID_NT_SYSTEM);
114 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->sids);
115
116 /* annoying, but the Anonymous really does have a session key,
117 and it is all zeros! */
118 user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
119 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->user_session_key.data);
120
121 user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
122 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->lm_session_key.data);
123
124 data_blob_clear(&user_info_dc->user_session_key);
125 data_blob_clear(&user_info_dc->lm_session_key);
126
127 user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
128 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
129
130 info->account_name = talloc_strdup(info, "SYSTEM");
131 NT_STATUS_HAVE_NO_MEMORY(info->account_name);
132
133 info->domain_name = talloc_strdup(info, "NT AUTHORITY");
134 NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
135
136 info->full_name = talloc_strdup(info, "System");
137 NT_STATUS_HAVE_NO_MEMORY(info->full_name);
138
139 info->logon_script = talloc_strdup(info, "");
140 NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
141
142 info->profile_path = talloc_strdup(info, "");
143 NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
144
145 info->home_directory = talloc_strdup(info, "");
146 NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
147
148 info->home_drive = talloc_strdup(info, "");
149 NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
150
151 info->logon_server = talloc_strdup(info, netbios_name);
152 NT_STATUS_HAVE_NO_MEMORY(info->logon_server);
153
154 info->last_logon = 0;
155 info->last_logoff = 0;
156 info->acct_expiry = 0;
157 info->last_password_change = 0;
158 info->allow_password_change = 0;
159 info->force_password_change = 0;
160
161 info->logon_count = 0;
162 info->bad_password_count = 0;
163
164 info->acct_flags = ACB_NORMAL;
165
166 info->authenticated = true;
167
168 *_user_info_dc = user_info_dc;
169
170 return NT_STATUS_OK;
171}
172
173
174static NTSTATUS auth_domain_admin_user_info_dc(TALLOC_CTX *mem_ctx,
175 const char *netbios_name,
176 const char *domain_name,
177 struct dom_sid *domain_sid,
178 struct auth_user_info_dc **_user_info_dc)
179{
180 struct auth_user_info_dc *user_info_dc;
181 struct auth_user_info *info;
182
183 user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
184 NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
185
186 user_info_dc->num_sids = 7;
187 user_info_dc->sids = talloc_array(user_info_dc, struct dom_sid, user_info_dc->num_sids);
188
189 user_info_dc->sids[PRIMARY_USER_SID_INDEX] = *domain_sid;
190 sid_append_rid(&user_info_dc->sids[PRIMARY_USER_SID_INDEX], DOMAIN_RID_ADMINISTRATOR);
191
192 user_info_dc->sids[PRIMARY_GROUP_SID_INDEX] = *domain_sid;
193 sid_append_rid(&user_info_dc->sids[PRIMARY_USER_SID_INDEX], DOMAIN_RID_USERS);
194
195 user_info_dc->sids[2] = global_sid_Builtin_Administrators;
196
197 user_info_dc->sids[3] = *domain_sid;
198 sid_append_rid(&user_info_dc->sids[3], DOMAIN_RID_ADMINS);
199 user_info_dc->sids[4] = *domain_sid;
200 sid_append_rid(&user_info_dc->sids[4], DOMAIN_RID_ENTERPRISE_ADMINS);
201 user_info_dc->sids[5] = *domain_sid;
202 sid_append_rid(&user_info_dc->sids[5], DOMAIN_RID_POLICY_ADMINS);
203 user_info_dc->sids[6] = *domain_sid;
204 sid_append_rid(&user_info_dc->sids[6], DOMAIN_RID_SCHEMA_ADMINS);
205
206 /* What should the session key be?*/
207 user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
208 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->user_session_key.data);
209
210 user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
211 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->lm_session_key.data);
212
213 data_blob_clear(&user_info_dc->user_session_key);
214 data_blob_clear(&user_info_dc->lm_session_key);
215
216 user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
217 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
218
219 info->account_name = talloc_strdup(info, "Administrator");
220 NT_STATUS_HAVE_NO_MEMORY(info->account_name);
221
222 info->domain_name = talloc_strdup(info, domain_name);
223 NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
224
225 info->full_name = talloc_strdup(info, "Administrator");
226 NT_STATUS_HAVE_NO_MEMORY(info->full_name);
227
228 info->logon_script = talloc_strdup(info, "");
229 NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
230
231 info->profile_path = talloc_strdup(info, "");
232 NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
233
234 info->home_directory = talloc_strdup(info, "");
235 NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
236
237 info->home_drive = talloc_strdup(info, "");
238 NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
239
240 info->logon_server = talloc_strdup(info, netbios_name);
241 NT_STATUS_HAVE_NO_MEMORY(info->logon_server);
242
243 info->last_logon = 0;
244 info->last_logoff = 0;
245 info->acct_expiry = 0;
246 info->last_password_change = 0;
247 info->allow_password_change = 0;
248 info->force_password_change = 0;
249
250 info->logon_count = 0;
251 info->bad_password_count = 0;
252
253 info->acct_flags = ACB_NORMAL;
254
255 info->authenticated = true;
256
257 *_user_info_dc = user_info_dc;
258
259 return NT_STATUS_OK;
260}
261
262static NTSTATUS auth_domain_admin_session_info(TALLOC_CTX *parent_ctx,
263 struct loadparm_context *lp_ctx,
264 struct dom_sid *domain_sid,
265 struct auth_session_info **session_info)
266{
267 NTSTATUS nt_status;
268 struct auth_user_info_dc *user_info_dc = NULL;
269 TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
270
271 nt_status = auth_domain_admin_user_info_dc(mem_ctx, lpcfg_netbios_name(lp_ctx),
272 lpcfg_workgroup(lp_ctx), domain_sid,
273 &user_info_dc);
274 if (!NT_STATUS_IS_OK(nt_status)) {
275 talloc_free(mem_ctx);
276 return nt_status;
277 }
278
279 nt_status = auth_generate_session_info(mem_ctx, NULL, NULL, user_info_dc,
280 AUTH_SESSION_INFO_SIMPLE_PRIVILEGES|AUTH_SESSION_INFO_AUTHENTICATED|AUTH_SESSION_INFO_DEFAULT_GROUPS,
281 session_info);
282 /* There is already a reference between the sesion_info and user_info_dc */
283 if (NT_STATUS_IS_OK(nt_status)) {
284 talloc_steal(parent_ctx, *session_info);
285 }
286 talloc_free(mem_ctx);
287 return nt_status;
288}
289
290_PUBLIC_ struct auth_session_info *admin_session(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, struct dom_sid *domain_sid)
291{
292 NTSTATUS nt_status;
293 struct auth_session_info *session_info = NULL;
294 nt_status = auth_domain_admin_session_info(mem_ctx,
295 lp_ctx,
296 domain_sid,
297 &session_info);
298 if (!NT_STATUS_IS_OK(nt_status)) {
299 return NULL;
300 }
301 return session_info;
302}
303
304_PUBLIC_ NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
305 struct loadparm_context *lp_ctx,
306 struct auth_session_info **_session_info)
307{
308 NTSTATUS nt_status;
309 struct auth_user_info_dc *user_info_dc = NULL;
310 struct auth_session_info *session_info = NULL;
311 TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
312
313 nt_status = auth_anonymous_user_info_dc(mem_ctx,
314 lpcfg_netbios_name(lp_ctx),
315 &user_info_dc);
316 if (!NT_STATUS_IS_OK(nt_status)) {
317 talloc_free(mem_ctx);
318 return nt_status;
319 }
320
321 /* references the user_info_dc into the session_info */
322 nt_status = auth_generate_session_info(parent_ctx, NULL, NULL, user_info_dc, AUTH_SESSION_INFO_SIMPLE_PRIVILEGES, &session_info);
323 talloc_free(mem_ctx);
324
325 NT_STATUS_NOT_OK_RETURN(nt_status);
326
327 session_info->credentials = cli_credentials_init(session_info);
328 if (!session_info->credentials) {
329 return NT_STATUS_NO_MEMORY;
330 }
331
332 cli_credentials_set_conf(session_info->credentials, lp_ctx);
333 cli_credentials_set_anonymous(session_info->credentials);
334
335 *_session_info = session_info;
336
337 return NT_STATUS_OK;
338}
339
340_PUBLIC_ NTSTATUS auth_anonymous_user_info_dc(TALLOC_CTX *mem_ctx,
341 const char *netbios_name,
342 struct auth_user_info_dc **_user_info_dc)
343{
344 struct auth_user_info_dc *user_info_dc;
345 struct auth_user_info *info;
346 user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
347 NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
348
349 /* This returns a pointer to a struct dom_sid, which is the
350 * same as a 1 element list of struct dom_sid */
351 user_info_dc->num_sids = 1;
352 user_info_dc->sids = dom_sid_parse_talloc(user_info_dc, SID_NT_ANONYMOUS);
353 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->sids);
354
355 /* annoying, but the Anonymous really does have a session key... */
356 user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
357 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->user_session_key.data);
358
359 user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
360 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->lm_session_key.data);
361
362 /* and it is all zeros! */
363 data_blob_clear(&user_info_dc->user_session_key);
364 data_blob_clear(&user_info_dc->lm_session_key);
365
366 user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
367 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
368
369 info->account_name = talloc_strdup(info, "ANONYMOUS LOGON");
370 NT_STATUS_HAVE_NO_MEMORY(info->account_name);
371
372 info->domain_name = talloc_strdup(info, "NT AUTHORITY");
373 NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
374
375 info->full_name = talloc_strdup(info, "Anonymous Logon");
376 NT_STATUS_HAVE_NO_MEMORY(info->full_name);
377
378 info->logon_script = talloc_strdup(info, "");
379 NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
380
381 info->profile_path = talloc_strdup(info, "");
382 NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
383
384 info->home_directory = talloc_strdup(info, "");
385 NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
386
387 info->home_drive = talloc_strdup(info, "");
388 NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
389
390 info->logon_server = talloc_strdup(info, netbios_name);
391 NT_STATUS_HAVE_NO_MEMORY(info->logon_server);
392
393 info->last_logon = 0;
394 info->last_logoff = 0;
395 info->acct_expiry = 0;
396 info->last_password_change = 0;
397 info->allow_password_change = 0;
398 info->force_password_change = 0;
399
400 info->logon_count = 0;
401 info->bad_password_count = 0;
402
403 info->acct_flags = ACB_NORMAL;
404
405 info->authenticated = false;
406
407 *_user_info_dc = user_info_dc;
408
409 return NT_STATUS_OK;
410}
411
Note: See TracBrowser for help on using the repository browser.