source: vendor/current/source3/auth/auth_generic.c

Last change on this file was 989, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.7
File size: 11.3 KB
Line 
1/*
2 Unix SMB/Netbios implementation.
3 Version 3.0
4 handle GENSEC authentication, server side
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003,2011
8 Copyright (C) Simo Sorce 2010.
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22*/
23
24#include "includes.h"
25#include "auth.h"
26#include "../lib/tsocket/tsocket.h"
27#include "auth/gensec/gensec.h"
28#include "lib/param/param.h"
29#ifdef HAVE_KRB5
30#include "auth/kerberos/pac_utils.h"
31#include "nsswitch/libwbclient/wbclient.h"
32#endif
33#include "librpc/crypto/gse.h"
34#include "auth/credentials/credentials.h"
35#include "lib/param/loadparm.h"
36#include "librpc/gen_ndr/dcerpc.h"
37
38static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx,
39 TALLOC_CTX *mem_ctx,
40 struct smb_krb5_context *smb_krb5_context,
41 DATA_BLOB *pac_blob,
42 const char *princ_name,
43 const struct tsocket_address *remote_address,
44 uint32_t session_info_flags,
45 struct auth_session_info **session_info)
46{
47 TALLOC_CTX *tmp_ctx;
48 struct PAC_LOGON_INFO *logon_info = NULL;
49 struct netr_SamInfo3 *info3_copy = NULL;
50 bool is_mapped;
51 bool is_guest;
52 char *ntuser;
53 char *ntdomain;
54 char *username;
55 char *rhost;
56 struct passwd *pw;
57 NTSTATUS status;
58 int rc;
59
60 tmp_ctx = talloc_new(mem_ctx);
61 if (!tmp_ctx) {
62 return NT_STATUS_NO_MEMORY;
63 }
64
65 if (pac_blob) {
66#ifdef HAVE_KRB5
67 struct wbcAuthUserParams params = {};
68 struct wbcAuthUserInfo *info = NULL;
69 struct wbcAuthErrorInfo *err = NULL;
70 wbcErr wbc_err;
71
72 /*
73 * Let winbind decode the PAC.
74 * This will also store the user
75 * data in the netsamlogon cache.
76 *
77 * We need to do this *before* we
78 * call get_user_from_kerberos_info()
79 * as that does a user lookup that
80 * expects info in the netsamlogon cache.
81 *
82 * See BUG: https://bugzilla.samba.org/show_bug.cgi?id=11259
83 */
84 params.level = WBC_AUTH_USER_LEVEL_PAC;
85 params.password.pac.data = pac_blob->data;
86 params.password.pac.length = pac_blob->length;
87
88 become_root();
89 wbc_err = wbcAuthenticateUserEx(&params, &info, &err);
90 unbecome_root();
91
92 /*
93 * As this is merely a cache prime
94 * WBC_ERR_WINBIND_NOT_AVAILABLE
95 * is not a fatal error, treat it
96 * as success.
97 */
98
99 switch (wbc_err) {
100 case WBC_ERR_WINBIND_NOT_AVAILABLE:
101 case WBC_ERR_SUCCESS:
102 break;
103 case WBC_ERR_AUTH_ERROR:
104 status = NT_STATUS(err->nt_status);
105 wbcFreeMemory(err);
106 goto done;
107 default:
108 status = NT_STATUS_LOGON_FAILURE;
109 goto done;
110 }
111
112 status = kerberos_pac_logon_info(tmp_ctx, *pac_blob, NULL, NULL,
113 NULL, NULL, 0, &logon_info);
114#else
115 status = NT_STATUS_ACCESS_DENIED;
116#endif
117 if (!NT_STATUS_IS_OK(status)) {
118 goto done;
119 }
120 }
121
122 rc = get_remote_hostname(remote_address,
123 &rhost,
124 tmp_ctx);
125 if (rc < 0) {
126 status = NT_STATUS_NO_MEMORY;
127 goto done;
128 }
129 if (strequal(rhost, "UNKNOWN")) {
130 rhost = tsocket_address_inet_addr_string(remote_address,
131 tmp_ctx);
132 if (rhost == NULL) {
133 status = NT_STATUS_NO_MEMORY;
134 goto done;
135 }
136 }
137
138 status = get_user_from_kerberos_info(tmp_ctx, rhost,
139 princ_name, logon_info,
140 &is_mapped, &is_guest,
141 &ntuser, &ntdomain,
142 &username, &pw);
143 if (!NT_STATUS_IS_OK(status)) {
144 DBG_NOTICE("Failed to map kerberos principal to system user "
145 "(%s)\n", nt_errstr(status));
146 status = NT_STATUS_ACCESS_DENIED;
147 goto done;
148 }
149
150 /* Get the info3 from the PAC data if we have it */
151 if (logon_info) {
152 status = create_info3_from_pac_logon_info(tmp_ctx,
153 logon_info,
154 &info3_copy);
155 if (!NT_STATUS_IS_OK(status)) {
156 goto done;
157 }
158 }
159
160 /* setup the string used by %U */
161 sub_set_smb_name(username);
162
163 /* reload services so that the new %U is taken into account */
164 lp_load_with_shares(get_dyn_CONFIGFILE());
165
166 status = make_session_info_krb5(mem_ctx,
167 ntuser, ntdomain, username, pw,
168 info3_copy, is_guest, is_mapped, NULL /* No session key for now, caller will sort it out */,
169 session_info);
170 if (!NT_STATUS_IS_OK(status)) {
171 DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
172 nt_errstr(status)));
173 status = NT_STATUS_ACCESS_DENIED;
174 goto done;
175 }
176
177 DEBUG(5, (__location__ "OK: user: %s domain: %s client: %s\n",
178 ntuser, ntdomain, rhost));
179
180 status = NT_STATUS_OK;
181
182done:
183 TALLOC_FREE(tmp_ctx);
184 return status;
185}
186
187static struct auth4_context *make_auth4_context_s3(TALLOC_CTX *mem_ctx, struct auth_context *auth_context)
188{
189 struct auth4_context *auth4_context = talloc_zero(mem_ctx, struct auth4_context);
190 if (auth4_context == NULL) {
191 DEBUG(10, ("failed to allocate auth4_context failed\n"));
192 return NULL;
193 }
194 auth4_context->generate_session_info_pac = auth3_generate_session_info_pac;
195 auth4_context->generate_session_info = auth3_generate_session_info;
196 auth4_context->get_ntlm_challenge = auth3_get_challenge;
197 auth4_context->set_ntlm_challenge = auth3_set_challenge;
198 auth4_context->check_ntlm_password = auth3_check_password;
199 auth4_context->private_data = talloc_steal(auth4_context, auth_context);
200 return auth4_context;
201}
202
203NTSTATUS make_auth4_context(TALLOC_CTX *mem_ctx, struct auth4_context **auth4_context_out)
204{
205 struct auth_context *auth_context;
206 NTSTATUS nt_status;
207
208 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
209 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
210
211 nt_status = make_auth_context_subsystem(tmp_ctx, &auth_context);
212 if (!NT_STATUS_IS_OK(nt_status)) {
213 TALLOC_FREE(tmp_ctx);
214 return nt_status;
215 }
216
217 if (auth_context->make_auth4_context) {
218 nt_status = auth_context->make_auth4_context(auth_context, mem_ctx, auth4_context_out);
219 TALLOC_FREE(tmp_ctx);
220 return nt_status;
221
222 } else {
223 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
224 if (auth4_context == NULL) {
225 TALLOC_FREE(tmp_ctx);
226 return NT_STATUS_NO_MEMORY;
227 }
228 *auth4_context_out = talloc_steal(mem_ctx, auth4_context);
229 TALLOC_FREE(tmp_ctx);
230 return NT_STATUS_OK;
231 }
232}
233
234NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
235 const struct tsocket_address *remote_address,
236 struct gensec_security **gensec_security_out)
237{
238 struct gensec_security *gensec_security;
239 struct auth_context *auth_context;
240 NTSTATUS nt_status;
241
242 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
243 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
244
245 nt_status = make_auth_context_subsystem(tmp_ctx, &auth_context);
246 if (!NT_STATUS_IS_OK(nt_status)) {
247 TALLOC_FREE(tmp_ctx);
248 return nt_status;
249 }
250
251 if (auth_context->prepare_gensec) {
252 nt_status = auth_context->prepare_gensec(auth_context, tmp_ctx,
253 &gensec_security);
254 if (!NT_STATUS_IS_OK(nt_status)) {
255 TALLOC_FREE(tmp_ctx);
256 return nt_status;
257 }
258 } else {
259 const struct gensec_security_ops **backends = NULL;
260 struct gensec_settings *gensec_settings;
261 struct loadparm_context *lp_ctx;
262 size_t idx = 0;
263 struct cli_credentials *server_credentials;
264 const char *dns_name;
265 const char *dns_domain;
266 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
267 if (auth4_context == NULL) {
268 TALLOC_FREE(tmp_ctx);
269 return NT_STATUS_NO_MEMORY;
270 }
271
272 lp_ctx = loadparm_init_s3(tmp_ctx, loadparm_s3_helpers());
273 if (lp_ctx == NULL) {
274 DEBUG(10, ("loadparm_init_s3 failed\n"));
275 TALLOC_FREE(tmp_ctx);
276 return NT_STATUS_INVALID_SERVER_STATE;
277 }
278
279 gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
280 if (lp_ctx == NULL) {
281 DEBUG(10, ("lpcfg_gensec_settings failed\n"));
282 TALLOC_FREE(tmp_ctx);
283 return NT_STATUS_NO_MEMORY;
284 }
285
286 /*
287 * This should be a 'netbios domain -> DNS domain'
288 * mapping, and can currently validly return NULL on
289 * poorly configured systems.
290 *
291 * This is used for the NTLMSSP server
292 *
293 */
294 dns_name = get_mydnsfullname();
295 if (dns_name == NULL) {
296 dns_name = "";
297 }
298
299 dns_domain = get_mydnsdomname(tmp_ctx);
300 if (dns_domain == NULL) {
301 dns_domain = "";
302 }
303
304 gensec_settings->server_dns_name = strlower_talloc(gensec_settings, dns_name);
305 if (gensec_settings->server_dns_name == NULL) {
306 TALLOC_FREE(tmp_ctx);
307 return NT_STATUS_NO_MEMORY;
308 }
309
310 gensec_settings->server_dns_domain = strlower_talloc(gensec_settings, dns_domain);
311 if (gensec_settings->server_dns_domain == NULL) {
312 TALLOC_FREE(tmp_ctx);
313 return NT_STATUS_NO_MEMORY;
314 }
315
316 backends = talloc_zero_array(gensec_settings,
317 const struct gensec_security_ops *, 6);
318 if (backends == NULL) {
319 TALLOC_FREE(tmp_ctx);
320 return NT_STATUS_NO_MEMORY;
321 }
322 gensec_settings->backends = backends;
323
324 gensec_init();
325
326 /* These need to be in priority order, krb5 before NTLMSSP */
327#if defined(HAVE_KRB5)
328 backends[idx++] = &gensec_gse_krb5_security_ops;
329#endif
330
331 backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
332
333 backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO);
334
335 backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_SCHANNEL);
336
337 backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM);
338
339 /*
340 * This is anonymous for now, because we just use it
341 * to set the kerberos state at the moment
342 */
343 server_credentials = cli_credentials_init_anon(tmp_ctx);
344 if (!server_credentials) {
345 DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
346 return NT_STATUS_NO_MEMORY;
347 }
348
349 cli_credentials_set_conf(server_credentials, lp_ctx);
350
351 if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
352 cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS);
353 } else {
354 cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS);
355 }
356
357 nt_status = gensec_server_start(tmp_ctx, gensec_settings,
358 auth4_context, &gensec_security);
359
360 if (!NT_STATUS_IS_OK(nt_status)) {
361 TALLOC_FREE(tmp_ctx);
362 return nt_status;
363 }
364
365 gensec_set_credentials(gensec_security, server_credentials);
366
367 talloc_unlink(tmp_ctx, lp_ctx);
368 talloc_unlink(tmp_ctx, server_credentials);
369 talloc_unlink(tmp_ctx, gensec_settings);
370 talloc_unlink(tmp_ctx, auth4_context);
371 }
372
373 nt_status = gensec_set_remote_address(gensec_security,
374 remote_address);
375 if (!NT_STATUS_IS_OK(nt_status)) {
376 TALLOC_FREE(tmp_ctx);
377 return nt_status;
378 }
379
380 *gensec_security_out = talloc_steal(mem_ctx, gensec_security);
381 TALLOC_FREE(tmp_ctx);
382 return NT_STATUS_OK;
383}
384
385NTSTATUS auth_check_password_session_info(struct auth4_context *auth_context,
386 TALLOC_CTX *mem_ctx,
387 struct auth_usersupplied_info *user_info,
388 struct auth_session_info **session_info)
389{
390 NTSTATUS nt_status;
391 void *server_info;
392
393 nt_status = auth_context->check_ntlm_password(auth_context,
394 talloc_tos(),
395 user_info,
396 &server_info, NULL, NULL);
397
398 if (NT_STATUS_IS_OK(nt_status)) {
399 nt_status = auth_context->generate_session_info(auth_context,
400 mem_ctx,
401 server_info,
402 user_info->client.account_name,
403 AUTH_SESSION_INFO_UNIX_TOKEN |
404 AUTH_SESSION_INFO_DEFAULT_GROUPS,
405 session_info);
406 TALLOC_FREE(server_info);
407 }
408 return nt_status;
409}
Note: See TracBrowser for help on using the repository browser.