Changeset 745 for trunk/server/source3/auth/auth_ntlmssp.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/auth/auth_ntlmssp.c (modified) (8 diffs)

trunk/server/source3/auth/auth_ntlmssp.c

@@ -22 +22 @@
 
 #include "includes.h"
+#include "auth.h"
+#include "../libcli/auth/ntlmssp.h"
+#include "ntlmssp_wrap.h"
+#include "../librpc/gen_ndr/netlogon.h"
+#include "smbd/smbd.h"
+
+NTSTATUS auth_ntlmssp_steal_session_info(TALLOC_CTX *mem_ctx,
+                                        struct auth_ntlmssp_state *auth_ntlmssp_state,
+                                        struct auth_serversupplied_info **session_info)
+{
+        /* Free the current server_info user_session_key and reset it from the
+         * current ntlmssp_state session_key */
+        data_blob_free(&auth_ntlmssp_state->server_info->user_session_key);
+        /* Set up the final session key for the connection */
+        auth_ntlmssp_state->server_info->user_session_key =
+                data_blob_talloc(
+                        auth_ntlmssp_state->server_info,
+                        auth_ntlmssp_state->ntlmssp_state->session_key.data,
+                        auth_ntlmssp_state->ntlmssp_state->session_key.length);
+        if (auth_ntlmssp_state->ntlmssp_state->session_key.length &&
+            !auth_ntlmssp_state->server_info->user_session_key.data) {
+                *session_info = NULL;
+                return NT_STATUS_NO_MEMORY;
+        }
+        /* Steal session_info away from auth_ntlmssp_state */
+        *session_info = talloc_move(mem_ctx, &auth_ntlmssp_state->server_info);
+        return NT_STATUS_OK;
+}
 
 /**
@@ -28 +56 @@
  */
 
-static void auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state,
-                                       uint8_t chal[8])
-{
-        AUTH_NTLMSSP_STATE *auth_ntlmssp_state =
-                (AUTH_NTLMSSP_STATE *)ntlmssp_state->auth_context;
+static NTSTATUS auth_ntlmssp_get_challenge(const struct ntlmssp_state *ntlmssp_state,
+                                           uint8_t chal[8])
+{
+        struct auth_ntlmssp_state *auth_ntlmssp_state =
+                (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
         auth_ntlmssp_state->auth_context->get_ntlm_challenge(
                 auth_ntlmssp_state->auth_context, chal);
+        return NT_STATUS_OK;
 }
 
@@ -44 +73 @@
 static bool auth_ntlmssp_may_set_challenge(const struct ntlmssp_state *ntlmssp_state)
 {
-        AUTH_NTLMSSP_STATE *auth_ntlmssp_state =
-                (AUTH_NTLMSSP_STATE *)ntlmssp_state->auth_context;
+        struct auth_ntlmssp_state *auth_ntlmssp_state =
+                (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
         struct auth_context *auth_context = auth_ntlmssp_state->auth_context;
 
@@ -57 +86 @@
 static NTSTATUS auth_ntlmssp_set_challenge(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *challenge)
 {
-        AUTH_NTLMSSP_STATE *auth_ntlmssp_state =
-                (AUTH_NTLMSSP_STATE *)ntlmssp_state->auth_context;
+        struct auth_ntlmssp_state *auth_ntlmssp_state =
+                (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
         struct auth_context *auth_context = auth_ntlmssp_state->auth_context;
 
         SMB_ASSERT(challenge->length == 8);
 
-        auth_context->challenge = data_blob_talloc(auth_context->mem_ctx, 
+        auth_context->challenge = data_blob_talloc(auth_context,
                                                    challenge->data, challenge->length);
 
@@ -80 +109 @@
  */
 
-static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key) 
-{
-        AUTH_NTLMSSP_STATE *auth_ntlmssp_state =
-                (AUTH_NTLMSSP_STATE *)ntlmssp_state->auth_context;
-        auth_usersupplied_info *user_info = NULL;
+static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, TALLOC_CTX *mem_ctx,
+                                            DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key)
+{
+        struct auth_ntlmssp_state *auth_ntlmssp_state =
+                (struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
+        struct auth_usersupplied_info *user_info = NULL;
         NTSTATUS nt_status;
         bool username_was_mapped;
@@ -91 +121 @@
            we need to possibly reload smb.conf if smb.conf includes depend on the machine name */
 
-        set_remote_machine_name(auth_ntlmssp_state->ntlmssp_state->workstation, True);
+        set_remote_machine_name(auth_ntlmssp_state->ntlmssp_state->client.netbios_name, True);
 
         /* setup the string used by %U */
@@ -97 +127 @@
         sub_set_smb_name(auth_ntlmssp_state->ntlmssp_state->user);
 
-        reload_services(True);
+        reload_services(smbd_messaging_context(), -1, True);
 
         nt_status = make_user_info_map(&user_info, 
                                        auth_ntlmssp_state->ntlmssp_state->user, 
                                        auth_ntlmssp_state->ntlmssp_state->domain, 
-                                       auth_ntlmssp_state->ntlmssp_state->workstation, 
+                                       auth_ntlmssp_state->ntlmssp_state->client.netbios_name,
                                        auth_ntlmssp_state->ntlmssp_state->lm_resp.data ? &auth_ntlmssp_state->ntlmssp_state->lm_resp : NULL, 
                                        auth_ntlmssp_state->ntlmssp_state->nt_resp.data ? &auth_ntlmssp_state->ntlmssp_state->nt_resp : NULL, 
                                        NULL, NULL, NULL,
-                                       True);
+                                       AUTH_PASSWORD_RESPONSE);
+
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
 
         user_info->logon_parameters = MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT;
-
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
-        }
 
         nt_status = auth_ntlmssp_state->auth_context->check_ntlm_password(auth_ntlmssp_state->auth_context, 
@@ -127 +157 @@
         auth_ntlmssp_state->server_info->nss_token |= username_was_mapped;
 
-        if (auth_ntlmssp_state->server_info->ptok == NULL) {
-                nt_status = create_local_token(auth_ntlmssp_state->server_info);
-                if (!NT_STATUS_IS_OK(nt_status)) {
-                        DEBUG(10, ("create_local_token failed: %s\n",
-                                   nt_errstr(nt_status)));
-                        return nt_status;
-                }
-        }
-
+        nt_status = create_local_token(auth_ntlmssp_state->server_info);
+
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                DEBUG(10, ("create_local_token failed: %s\n",
+                        nt_errstr(nt_status)));
+                return nt_status;
+        }
+
+        /* Clear out the session keys, and pass them to the caller.
+         * They will not be used in this form again - instead the
+         * NTLMSSP code will decide on the final correct session key,
+         * and put it back here at the end of
+         * auth_ntlmssp_steal_server_info */
         if (auth_ntlmssp_state->server_info->user_session_key.length) {
                 DEBUG(10, ("Got NT session key of length %u\n",
                         (unsigned int)auth_ntlmssp_state->server_info->user_session_key.length));
-                *user_session_key = data_blob_talloc(auth_ntlmssp_state->mem_ctx, 
-                                                   auth_ntlmssp_state->server_info->user_session_key.data,
-                                                   auth_ntlmssp_state->server_info->user_session_key.length);
+                *user_session_key = auth_ntlmssp_state->server_info->user_session_key;
+                talloc_steal(mem_ctx, auth_ntlmssp_state->server_info->user_session_key.data);
+                auth_ntlmssp_state->server_info->user_session_key = data_blob_null;
         }
         if (auth_ntlmssp_state->server_info->lm_session_key.length) {
                 DEBUG(10, ("Got LM session key of length %u\n",
                         (unsigned int)auth_ntlmssp_state->server_info->lm_session_key.length));
-                *lm_session_key = data_blob_talloc(auth_ntlmssp_state->mem_ctx, 
-                                                   auth_ntlmssp_state->server_info->lm_session_key.data,
-                                                   auth_ntlmssp_state->server_info->lm_session_key.length);
+                *lm_session_key = auth_ntlmssp_state->server_info->lm_session_key;
+                talloc_steal(mem_ctx, auth_ntlmssp_state->server_info->lm_session_key.data);
+                auth_ntlmssp_state->server_info->lm_session_key = data_blob_null;
         }
         return nt_status;
 }
 
-NTSTATUS auth_ntlmssp_start(AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
+static int auth_ntlmssp_state_destructor(void *ptr);
+
+NTSTATUS auth_ntlmssp_start(struct auth_ntlmssp_state **auth_ntlmssp_state)
 {
         NTSTATUS nt_status;
-        TALLOC_CTX *mem_ctx;
-
-        mem_ctx = talloc_init("AUTH NTLMSSP context");
-        
-        *auth_ntlmssp_state = TALLOC_ZERO_P(mem_ctx, AUTH_NTLMSSP_STATE);
-        if (!*auth_ntlmssp_state) {
+        bool is_standalone;
+        const char *netbios_name;
+        const char *netbios_domain;
+        const char *dns_name;
+        char *dns_domain;
+        struct auth_ntlmssp_state *ans;
+        struct auth_context *auth_context;
+
+        if ((enum server_types)lp_server_role() == ROLE_STANDALONE) {
+                is_standalone = true;
+        } else {
+                is_standalone = false;
+        }
+
+        netbios_name = global_myname();
+        netbios_domain = lp_workgroup();
+        /* This should be a 'netbios domain -> DNS domain' mapping */
+        dns_domain = get_mydnsdomname(talloc_tos());
+        if (dns_domain) {
+                strlower_m(dns_domain);
+        }
+        dns_name = get_mydnsfullname();
+
+        ans = talloc_zero(NULL, struct auth_ntlmssp_state);
+        if (!ans) {
                 DEBUG(0,("auth_ntlmssp_start: talloc failed!\n"));
-                talloc_destroy(mem_ctx);
                 return NT_STATUS_NO_MEMORY;
         }
 
-        ZERO_STRUCTP(*auth_ntlmssp_state);
-
-        (*auth_ntlmssp_state)->mem_ctx = mem_ctx;
-
-        if (!NT_STATUS_IS_OK(nt_status = ntlmssp_server_start(&(*auth_ntlmssp_state)->ntlmssp_state))) {
-                return nt_status;
-        }
-
-        if (!NT_STATUS_IS_OK(nt_status = make_auth_context_subsystem(&(*auth_ntlmssp_state)->auth_context))) {
-                return nt_status;
-        }
-
-        (*auth_ntlmssp_state)->ntlmssp_state->auth_context = (*auth_ntlmssp_state);
-        (*auth_ntlmssp_state)->ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
-        (*auth_ntlmssp_state)->ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
-        (*auth_ntlmssp_state)->ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
-        (*auth_ntlmssp_state)->ntlmssp_state->check_password = auth_ntlmssp_check_password;
-        (*auth_ntlmssp_state)->ntlmssp_state->server_role = (enum server_types)lp_server_role();
-
-        return NT_STATUS_OK;
-}
-
-void auth_ntlmssp_end(AUTH_NTLMSSP_STATE **auth_ntlmssp_state)
-{
-        TALLOC_CTX *mem_ctx;
-
-        if (*auth_ntlmssp_state == NULL) {
-                return;
-        }
-
-        mem_ctx = (*auth_ntlmssp_state)->mem_ctx;
-        if ((*auth_ntlmssp_state)->ntlmssp_state) {
-                ntlmssp_end(&(*auth_ntlmssp_state)->ntlmssp_state);
-        }
-        if ((*auth_ntlmssp_state)->auth_context) {
-                ((*auth_ntlmssp_state)->auth_context->free)(&(*auth_ntlmssp_state)->auth_context);
-        }
-        if ((*auth_ntlmssp_state)->server_info) {
-                TALLOC_FREE((*auth_ntlmssp_state)->server_info);
-        }
-        talloc_destroy(mem_ctx);
-        *auth_ntlmssp_state = NULL;
-}
-
-NTSTATUS auth_ntlmssp_update(AUTH_NTLMSSP_STATE *auth_ntlmssp_state, 
-                             const DATA_BLOB request, DATA_BLOB *reply) 
-{
-        return ntlmssp_update(auth_ntlmssp_state->ntlmssp_state, request, reply);
-}
+        nt_status = ntlmssp_server_start(ans,
+                                         is_standalone,
+                                         netbios_name,
+                                         netbios_domain,
+                                         dns_name,
+                                         dns_domain,
+                                         &ans->ntlmssp_state);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+
+        nt_status = make_auth_context_subsystem(talloc_tos(), &auth_context);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
+        ans->auth_context = talloc_steal(ans, auth_context);
+
+        ans->ntlmssp_state->callback_private = ans;
+        ans->ntlmssp_state->get_challenge = auth_ntlmssp_get_challenge;
+        ans->ntlmssp_state->may_set_challenge = auth_ntlmssp_may_set_challenge;
+        ans->ntlmssp_state->set_challenge = auth_ntlmssp_set_challenge;
+        ans->ntlmssp_state->check_password = auth_ntlmssp_check_password;
+
+        talloc_set_destructor((TALLOC_CTX *)ans, auth_ntlmssp_state_destructor);
+
+        *auth_ntlmssp_state = ans;
+        return NT_STATUS_OK;
+}
+
+static int auth_ntlmssp_state_destructor(void *ptr)
+{
+        struct auth_ntlmssp_state *ans;
+
+        ans = talloc_get_type(ptr, struct auth_ntlmssp_state);
+
+        TALLOC_FREE(ans->server_info);
+        TALLOC_FREE(ans->ntlmssp_state);
+        return 0;
+}