source3/auth/auth_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6    Copyright (C) Jeremy Allison 2000-2001
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_AUTH
  27
  28 extern pstring global_myname;
  29
  30 /****************************************************************************
  31  Create a UNIX user on demand.
  32 ****************************************************************************/
  33
  34 static int smb_create_user(const char *unix_user, const char *homedir)
  35 {
  36         pstring add_script;
  37         int ret;
  38
  39         pstrcpy(add_script, lp_adduser_script());
  40         if (! *add_script)
  41                 return -1;
  42         all_string_sub(add_script, "%u", unix_user, sizeof(pstring));
  43         if (homedir)
  44                 all_string_sub(add_script, "%H", homedir, sizeof(pstring));
  45         ret = smbrun(add_script,NULL);
  46         DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
  47         return ret;
  48 }
  49
  50 /****************************************************************************
  51  Add and Delete UNIX users on demand, based on NTSTATUS codes.
  52 ****************************************************************************/
  53
  54 void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status)
  55 {
  56         struct passwd *pwd=NULL;
  57
  58         if (NT_STATUS_IS_OK(nt_status)) {
  59
  60                 if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
  61
  62                         /*
  63                          * User validated ok against Domain controller.
  64                          * If the admin wants us to try and create a UNIX
  65                          * user on the fly, do so.
  66                          */
  67
  68                         if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
  69                                 smb_create_user(user_info->internal_username.str, NULL);
  70                         }
  71                 }
  72         }
  73 }
  74
  75 /****************************************************************************
  76  Create an auth_usersupplied_data structure
  77 ****************************************************************************/
  78
  79 static BOOL make_user_info(auth_usersupplied_info **user_info,
  80                            const char *smb_name,
  81                            const char *internal_username,
  82                            const char *client_domain,
  83                            const char *domain,
  84                            const char *wksta_name,
  85                            DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
  86                            DATA_BLOB plaintext,
  87                            uint32 auth_flags, BOOL encrypted)
  88 {
  89
  90         DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
  91
  92         *user_info = malloc(sizeof(**user_info));
  93         if (!user_info) {
  94                 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info)));
  95                 return False;
  96         }
  97
  98         ZERO_STRUCTP(*user_info);
  99
 100         DEBUG(5,("making strings for %s's user_info struct\n", internal_username));
 101
 102         (*user_info)->smb_name.str = strdup(smb_name);
 103         if ((*user_info)->smb_name.str) {
 104                 (*user_info)->smb_name.len = strlen(smb_name);
 105         } else {
 106                 free_user_info(user_info);
 107                 return False;
 108         }
 109
 110         (*user_info)->internal_username.str = strdup(internal_username);
 111         if ((*user_info)->internal_username.str) {
 112                 (*user_info)->internal_username.len = strlen(internal_username);
 113         } else {
 114                 free_user_info(user_info);
 115                 return False;
 116         }
 117
 118         (*user_info)->domain.str = strdup(domain);
 119         if ((*user_info)->domain.str) {
 120                 (*user_info)->domain.len = strlen(domain);
 121         } else {
 122                 free_user_info(user_info);
 123                 return False;
 124         }
 125
 126         (*user_info)->client_domain.str = strdup(client_domain);
 127         if ((*user_info)->client_domain.str) {
 128                 (*user_info)->client_domain.len = strlen(client_domain);
 129         } else {
 130                 free_user_info(user_info);
 131                 return False;
 132         }
 133
 134         (*user_info)->wksta_name.str = strdup(wksta_name);
 135         if ((*user_info)->wksta_name.str) {
 136                 (*user_info)->wksta_name.len = strlen(wksta_name);
 137         } else {
 138                 free_user_info(user_info);
 139                 return False;
 140         }
 141
 142         DEBUG(5,("making blobs for %s's user_info struct\n", internal_username));
 143
 144         (*user_info)->lm_resp = data_blob(lm_pwd.data, lm_pwd.length);
 145         (*user_info)->nt_resp = data_blob(nt_pwd.data, nt_pwd.length);
 146         (*user_info)->plaintext_password = data_blob(plaintext.data, plaintext.length);
 147
 148         (*user_info)->encrypted = encrypted;
 149         (*user_info)->auth_flags = auth_flags;
 150
 151         DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
 152
 153         return True;
 154 }
 155
 156 /****************************************************************************
 157  Create an auth_usersupplied_data structure after appropriate mapping.
 158 ****************************************************************************/
 159
 160 BOOL make_user_info_map(auth_usersupplied_info **user_info,
 161                         const char *smb_name,
 162                         const char *client_domain,
 163                         const char *wksta_name,
 164                         DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
 165                         DATA_BLOB plaintext,
 166                         uint32 ntlmssp_flags, BOOL encrypted)
 167 {
 168         const char *domain;
 169         fstring internal_username;
 170         fstrcpy(internal_username, smb_name);
 171         map_username(internal_username);
 172
 173         DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
 174               client_domain, smb_name, wksta_name));
 175
 176         if (lp_allow_trusted_domains() && *client_domain) {
 177
 178                 /* the client could have given us a workstation name
 179                    or other crap for the workgroup - we really need a
 180                    way of telling if this domain name is one of our
 181                    trusted domain names
 182
 183                    Also don't allow "" as a domain, fixes a Win9X bug
 184                    where it doens't supply a domain for logon script
 185                    'net use' commands.
 186
 187                    The way I do it here is by checking if the fully
 188                    qualified username exists. This is rather reliant
 189                    on winbind, but until we have a better method this
 190                    will have to do
 191                 */
 192
 193                 domain = client_domain;
 194
 195                 if ((smb_name) && (*smb_name)) { /* Don't do this for guests */
 196                         char *user = NULL;
 197                         if (asprintf(&user, "%s%s%s",
 198                                  client_domain, lp_winbind_separator(),
 199                                  smb_name) < 0) {
 200                                 DEBUG(0, ("make_user_info_map: asprintf() failed!\n"));
 201                                 return False;
 202                         }
 203
 204                         DEBUG(5, ("make_user_info_map: testing for user %s\n", user));
 205
 206                         if (Get_Pwnam(user) == NULL) {
 207                                 DEBUG(5, ("make_user_info_map: test for user %s failed\n", user));
 208                                 domain = lp_workgroup();
 209                                 DEBUG(5, ("make_user_info_map: trusted domain %s doesn't appear to exist, using %s\n",
 210                                           client_domain, domain));
 211                         } else {
 212                                 DEBUG(5, ("make_user_info_map: using trusted domain %s\n", domain));
 213                         }
 214                         SAFE_FREE(user);
 215                 }
 216         } else {
 217                 domain = lp_workgroup();
 218         }
 219
 220         return make_user_info(user_info,
 221                               smb_name, internal_username,
 222                               client_domain, domain,
 223                               wksta_name,
 224                               lm_pwd, nt_pwd,
 225                               plaintext,
 226                               ntlmssp_flags, encrypted);
 227
 228 }
 229
 230 /****************************************************************************
 231  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 232  Decrypt and encrypt the passwords.
 233 ****************************************************************************/
 234
 235 BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
 236                                      const char *smb_name,
 237                                      const char *client_domain,
 238                                      const char *wksta_name,
 239                                      const uchar *lm_network_pwd, int lm_pwd_len,
 240                                      const uchar *nt_network_pwd, int nt_pwd_len)
 241 {
 242         BOOL ret;
 243         DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
 244         DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
 245         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 246         uint32 auth_flags = AUTH_FLAG_NONE;
 247
 248         if (lm_pwd_len)
 249                 auth_flags |= AUTH_FLAG_LM_RESP;
 250         if (nt_pwd_len == 24) {
 251                 auth_flags |= AUTH_FLAG_NTLM_RESP;
 252         } else if (nt_pwd_len != 0) {
 253                 auth_flags |= AUTH_FLAG_NTLMv2_RESP;
 254         }
 255
 256         ret = make_user_info_map(user_info,
 257                                  smb_name, client_domain,
 258                                  wksta_name,
 259                                  lm_blob, nt_blob,
 260                                  plaintext_blob,
 261                                  auth_flags, True);
 262
 263         data_blob_free(&lm_blob);
 264         data_blob_free(&nt_blob);
 265         return ret;
 266 }
 267
 268 /****************************************************************************
 269  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 270  Decrypt and encrypt the passwords.
 271 ****************************************************************************/
 272
 273 BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
 274                                          const char *smb_name,
 275                                          const char *client_domain,
 276                                          const char *wksta_name,
 277                                          const uchar chal[8],
 278                                          const uchar lm_interactive_pwd[16],
 279                                          const uchar nt_interactive_pwd[16],
 280                                          const uchar *dc_sess_key)
 281 {
 282         char lm_pwd[16];
 283         char nt_pwd[16];
 284         unsigned char local_lm_response[24];
 285         unsigned char local_nt_response[24];
 286         unsigned char key[16];
 287         uint32 auth_flags = AUTH_FLAG_NONE;
 288
 289         ZERO_STRUCT(key);
 290         memcpy(key, dc_sess_key, 8);
 291
 292         if (lm_interactive_pwd) memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
 293         if (nt_interactive_pwd) memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
 294
 295 #ifdef DEBUG_PASSWORD
 296         DEBUG(100,("key:"));
 297         dump_data(100, (char *)key, sizeof(key));
 298
 299         DEBUG(100,("lm owf password:"));
 300         dump_data(100, lm_pwd, sizeof(lm_pwd));
 301
 302         DEBUG(100,("nt owf password:"));
 303         dump_data(100, nt_pwd, sizeof(nt_pwd));
 304 #endif
 305
 306         SamOEMhash((uchar *)lm_pwd, key, sizeof(lm_pwd));
 307         SamOEMhash((uchar *)nt_pwd, key, sizeof(nt_pwd));
 308
 309 #ifdef DEBUG_PASSWORD
 310         DEBUG(100,("decrypt of lm owf password:"));
 311         dump_data(100, lm_pwd, sizeof(lm_pwd));
 312
 313         DEBUG(100,("decrypt of nt owf password:"));
 314         dump_data(100, nt_pwd, sizeof(nt_pwd));
 315 #endif
 316
 317         SMBOWFencrypt((const unsigned char *)lm_pwd, chal, local_lm_response);
 318         SMBOWFencrypt((const unsigned char *)nt_pwd, chal, local_nt_response);
 319
 320         /* Password info paranoia */
 321         ZERO_STRUCT(lm_pwd);
 322         ZERO_STRUCT(nt_pwd);
 323         ZERO_STRUCT(key);
 324
 325         {
 326                 BOOL ret;
 327                 DATA_BLOB local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
 328                 DATA_BLOB local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
 329                 DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 330
 331                 if (lm_interactive_pwd)
 332                         auth_flags |= AUTH_FLAG_LM_RESP;
 333                 if (nt_interactive_pwd)
 334                         auth_flags |= AUTH_FLAG_NTLM_RESP;
 335
 336                 ret = make_user_info_map(user_info,
 337                                          smb_name, client_domain,
 338                                          wksta_name,
 339                                          local_lm_blob,
 340                                          local_nt_blob,
 341                                          plaintext_blob,
 342                                          auth_flags, True);
 343
 344                 data_blob_free(&local_lm_blob);
 345                 data_blob_free(&local_nt_blob);
 346                 return ret;
 347         }
 348 }
 349
 350
 351 /****************************************************************************
 352  Create an auth_usersupplied_data structure
 353 ****************************************************************************/
 354
 355 BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
 356                               const char *smb_name,
 357                               const char *client_domain,
 358                               const uint8 chal[8],
 359                               DATA_BLOB plaintext_password)
 360 {
 361
 362         DATA_BLOB local_lm_blob;
 363         DATA_BLOB local_nt_blob;
 364         BOOL ret = False;
 365         uint32 auth_flags = AUTH_FLAG_NONE;
 366
 367         /*
 368          * Not encrypted - do so.
 369          */
 370
 371         DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
 372
 373         if (plaintext_password.data) {
 374                 unsigned char local_lm_response[24];
 375
 376 #ifdef DEBUG_PASSWORD
 377                 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password.length));
 378                 dump_data(100, plaintext_password.data, plaintext_password.length);
 379 #endif
 380
 381                 SMBencrypt( (const uchar *)plaintext_password.data, (const uchar*)chal, local_lm_response);
 382                 local_lm_blob = data_blob(local_lm_response, 24);
 383
 384                 /* We can't do an NT hash here, as the password needs to be
 385                    case insensitive */
 386                 local_nt_blob = data_blob(NULL, 0);
 387
 388                 auth_flags = (AUTH_FLAG_PLAINTEXT | AUTH_FLAG_LM_RESP);
 389         } else {
 390                 local_lm_blob = data_blob(NULL, 0);
 391                 local_nt_blob = data_blob(NULL, 0);
 392         }
 393
 394         ret = make_user_info_map(user_info, smb_name,
 395                                  client_domain,
 396                                  get_remote_machine_name(),
 397                                  local_lm_blob,
 398                                  local_nt_blob,
 399                                  plaintext_password,
 400                                  auth_flags, False);
 401
 402         data_blob_free(&local_lm_blob);
 403         return ret;
 404 }
 405
 406 /****************************************************************************
 407  Create an auth_usersupplied_data structure
 408 ****************************************************************************/
 409
 410 BOOL make_user_info_for_reply_enc(auth_usersupplied_info **user_info,
 411                                   const char *smb_name,
 412                                   const char *client_domain,
 413                                   DATA_BLOB lm_resp, DATA_BLOB nt_resp)
 414 {
 415         uint32 auth_flags = AUTH_FLAG_NONE;
 416
 417         DATA_BLOB no_plaintext_blob = data_blob(NULL, 0);
 418
 419         if (lm_resp.length == 24) {
 420                 auth_flags |= AUTH_FLAG_LM_RESP;
 421         }
 422         if (nt_resp.length == 0) {
 423         } else if (nt_resp.length == 24) {
 424                 auth_flags |= AUTH_FLAG_NTLM_RESP;
 425         } else {
 426                 auth_flags |= AUTH_FLAG_NTLMv2_RESP;
 427         }
 428
 429         return make_user_info_map(user_info, smb_name,
 430                                  client_domain,
 431                                  get_remote_machine_name(),
 432                                  lm_resp,
 433                                  nt_resp,
 434                                  no_plaintext_blob,
 435                                  auth_flags, True);
 436 }
 437
 438 /****************************************************************************
 439  Create a guest user_info blob, for anonymous authenticaion.
 440 ****************************************************************************/
 441
 442 BOOL make_user_info_guest(auth_usersupplied_info **user_info)
 443 {
 444         DATA_BLOB lm_blob = data_blob(NULL, 0);
 445         DATA_BLOB nt_blob = data_blob(NULL, 0);
 446         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 447         uint32 auth_flags = AUTH_FLAG_NONE;
 448
 449         return make_user_info(user_info,
 450                               "","",
 451                               "","",
 452                               "",
 453                               nt_blob, lm_blob,
 454                               plaintext_blob,
 455                               auth_flags, True);
 456 }
 457
 458 /***************************************************************************
 459  Make a user_info struct
 460 ***************************************************************************/
 461
 462 static BOOL make_server_info(auth_serversupplied_info **server_info)
 463 {
 464         *server_info = malloc(sizeof(**server_info));
 465         if (!*server_info) {
 466                 DEBUG(0,("make_server_info: malloc failed!\n"));
 467                 return False;
 468         }
 469         ZERO_STRUCTP(*server_info);
 470         return True;
 471 }
 472
 473 /***************************************************************************
 474  Make (and fill) a user_info struct from a SAM_ACCOUNT
 475 ***************************************************************************/
 476
 477 BOOL make_server_info_sam(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
 478 {
 479         if (!make_server_info(server_info)) {
 480                 return False;
 481         }
 482
 483         (*server_info)->sam_fill_level = SAM_FILL_ALL;
 484         (*server_info)->sam_account = sampass;
 485
 486         DEBUG(5,("make_server_info_sam: made server info for user %s\n",
 487                  pdb_get_username((*server_info)->sam_account)));
 488         return True;
 489 }
 490
 491 /***************************************************************************
 492  Make (and fill) a user_info struct from a 'struct passwd' by conversion
 493  to a SAM_ACCOUNT
 494 ***************************************************************************/
 495
 496 BOOL make_server_info_pw(auth_serversupplied_info **server_info, const struct passwd *pwd)
 497 {
 498         SAM_ACCOUNT *sampass = NULL;
 499         if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sampass, pwd))) {
 500                 return False;
 501         }
 502         return make_server_info_sam(server_info, sampass);
 503 }
 504
 505 /***************************************************************************
 506  Free a user_info struct
 507 ***************************************************************************/
 508
 509 void free_user_info(auth_usersupplied_info **user_info)
 510 {
 511         DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
 512         if (*user_info != NULL) {
 513                 if ((*user_info)->smb_name.str) {
 514                         DEBUG(10,("structure was created for %s\n", (*user_info)->smb_name.str));
 515                 }
 516                 SAFE_FREE((*user_info)->smb_name.str);
 517                 SAFE_FREE((*user_info)->internal_username.str);
 518                 SAFE_FREE((*user_info)->client_domain.str);
 519                 SAFE_FREE((*user_info)->domain.str);
 520                 SAFE_FREE((*user_info)->wksta_name.str);
 521                 data_blob_free(&(*user_info)->lm_resp);
 522                 data_blob_free(&(*user_info)->nt_resp);
 523                 SAFE_FREE((*user_info)->interactive_password);
 524                 data_blob_clear_free(&(*user_info)->plaintext_password);
 525                 ZERO_STRUCT(**user_info);
 526         }
 527         SAFE_FREE(*user_info);
 528 }
 529
 530 /***************************************************************************
 531  Clear out a server_info struct that has been allocated
 532 ***************************************************************************/
 533
 534 void free_server_info(auth_serversupplied_info **server_info)
 535 {
 536         if (*server_info != NULL) {
 537                 pdb_free_sam(&(*server_info)->sam_account);
 538
 539                 /* call pam_end here, unless we know we are keeping it */
 540                 delete_nt_token( &(*server_info)->ptok );
 541                 ZERO_STRUCT(**server_info);
 542         }
 543         SAFE_FREE(*server_info);
 544 }
 545
 546 /***************************************************************************
 547  Make a server_info struct for a guest user
 548 ***************************************************************************/
 549
 550 BOOL make_server_info_guest(auth_serversupplied_info **server_info)
 551 {
 552         struct passwd *pass = getpwnam_alloc(lp_guestaccount());
 553
 554         if (pass) {
 555                 if (!make_server_info_pw(server_info, pass)) {
 556                         passwd_free(&pass);
 557                         return False;
 558                 }
 559                 (*server_info)->guest = True;
 560                 passwd_free(&pass);
 561                 return True;
 562         }
 563         DEBUG(0,("make_server_info_guest: getpwnam_alloc() failed on guest account!\n"));
 564         return False;
 565 }
 566
 567 /***************************************************************************
 568  Make a server_info struct from the info3 returned by a domain logon
 569 ***************************************************************************/
 570
 571 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 572                                 const char *internal_username,
 573                                 const char *sent_nt_username,
 574                                 const char *domain,
 575                                 auth_serversupplied_info **server_info,
 576                                 NET_USER_INFO_3 *info3)
 577 {
 578         NTSTATUS nt_status = NT_STATUS_OK;
 579
 580         const char *nt_domain;
 581         const char *nt_username;
 582
 583         SAM_ACCOUNT *sam_account = NULL;
 584         DOM_SID user_sid;
 585         DOM_SID group_sid;
 586
 587         struct passwd *passwd;
 588
 589         uid_t uid;
 590         gid_t gid;
 591
 592         /*
 593            Here is where we should check the list of
 594            trusted domains, and verify that the SID
 595            matches.
 596         */
 597
 598         sid_copy(&user_sid, &info3->dom_sid.sid);
 599         if (!sid_append_rid(&user_sid, info3->user_rid)) {
 600                 return NT_STATUS_INVALID_PARAMETER;
 601         }
 602
 603         sid_copy(&group_sid, &info3->dom_sid.sid);
 604         if (!sid_append_rid(&group_sid, info3->group_rid)) {
 605                 return NT_STATUS_INVALID_PARAMETER;
 606         }
 607
 608         if (!(nt_username = unistr2_tdup(mem_ctx, &(info3->uni_user_name)))) {
 609                 /* If the server didn't give us one, just use the one we sent them */
 610                 nt_username = sent_nt_username;
 611         }
 612
 613         if (!(nt_domain = unistr2_tdup(mem_ctx, &(info3->uni_logon_dom)))) {
 614                 /* If the server didn't give us one, just use the one we sent them */
 615                 domain = domain;
 616         }
 617
 618         if (winbind_sid_to_uid(&uid, &user_sid)
 619             && winbind_sid_to_gid(&gid, &group_sid)
 620             && ((passwd = getpwuid_alloc(uid)))) {
 621                 nt_status = pdb_init_sam_pw(&sam_account, passwd);
 622                 passwd_free(&passwd);
 623         } else {
 624                 char *dom_user;
 625                 dom_user = talloc_asprintf(mem_ctx, "%s%s%s",
 626                                            nt_domain,
 627                                            lp_winbind_separator(),
 628                                            internal_username);
 629
 630                 if (!dom_user) {
 631                         DEBUG(0, ("talloc_asprintf failed!\n"));
 632                         return NT_STATUS_NO_MEMORY;
 633                 } else {
 634
 635                         if (!(passwd = Get_Pwnam(dom_user))
 636                                 /* Only lookup local for the local
 637                                    domain, we don't want this for
 638                                    trusted domains */
 639                             && strequal(nt_domain, lp_workgroup())) {
 640                                 passwd = Get_Pwnam(internal_username);
 641                         }
 642
 643                         if (!passwd) {
 644                                 return NT_STATUS_NO_SUCH_USER;
 645                         } else {
 646                                 nt_status = pdb_init_sam_pw(&sam_account, passwd);
 647                         }
 648                 }
 649         }
 650
 651         if (!NT_STATUS_IS_OK(nt_status)) {
 652                 DEBUG(0, ("make_server_info_info3: pdb_init_sam failed!\n"));
 653                 return nt_status;
 654         }
 655
 656         if (!pdb_set_user_sid(sam_account, &user_sid)) {
 657                 pdb_free_sam(&sam_account);
 658                 return NT_STATUS_UNSUCCESSFUL;
 659         }
 660
 661         if (!pdb_set_group_sid(sam_account, &group_sid)) {
 662                 pdb_free_sam(&sam_account);
 663                 return NT_STATUS_UNSUCCESSFUL;
 664         }
 665
 666         if (!pdb_set_nt_username(sam_account, nt_username)) {
 667                 pdb_free_sam(&sam_account);
 668                 return NT_STATUS_NO_MEMORY;
 669         }
 670
 671         if (!pdb_set_domain(sam_account, nt_domain)) {
 672                 pdb_free_sam(&sam_account);
 673                 return NT_STATUS_NO_MEMORY;
 674         }
 675
 676         if (!pdb_set_fullname(sam_account, pdb_unistr2_convert(&(info3->uni_full_name)))) {
 677                 pdb_free_sam(&sam_account);
 678                 return NT_STATUS_NO_MEMORY;
 679         }
 680
 681         if (!pdb_set_logon_script(sam_account, pdb_unistr2_convert(&(info3->uni_logon_script)), True)) {
 682                 pdb_free_sam(&sam_account);
 683                 return NT_STATUS_NO_MEMORY;
 684         }
 685
 686         if (!pdb_set_profile_path(sam_account, pdb_unistr2_convert(&(info3->uni_profile_path)), True)) {
 687                 pdb_free_sam(&sam_account);
 688                 return NT_STATUS_NO_MEMORY;
 689         }
 690
 691         if (!pdb_set_homedir(sam_account, pdb_unistr2_convert(&(info3->uni_home_dir)), True)) {
 692                 pdb_free_sam(&sam_account);
 693                 return NT_STATUS_NO_MEMORY;
 694         }
 695
 696         if (!pdb_set_dir_drive(sam_account, pdb_unistr2_convert(&(info3->uni_dir_drive)), True)) {
 697                 pdb_free_sam(&sam_account);
 698                 return NT_STATUS_NO_MEMORY;
 699         }
 700
 701         if (!make_server_info_sam(server_info, sam_account)) {
 702                 DEBUG(0, ("make_server_info_info3: make_server_info_sam failed!\n"));
 703                 pdb_free_sam(&sam_account);
 704                 return NT_STATUS_NO_MEMORY;
 705         }
 706
 707         /* Store the user group information in the server_info
 708            returned to the caller. */
 709
 710         if (info3->num_groups2 != 0) {
 711                 int i;
 712                 NT_USER_TOKEN *ptok;
 713                 auth_serversupplied_info *pserver_info = *server_info;
 714
 715                 if ((pserver_info->ptok = malloc( sizeof(NT_USER_TOKEN) ) ) == NULL) {
 716                         DEBUG(0, ("domain_client_validate: out of memory allocating rid group membership\n"));
 717                         nt_status = NT_STATUS_NO_MEMORY;
 718                         free_server_info(server_info);
 719                         return nt_status;
 720                 }
 721
 722                 ptok = pserver_info->ptok;
 723                 ptok->num_sids = (size_t)info3->num_groups2;
 724
 725                 if ((ptok->user_sids = (DOM_SID *)malloc( sizeof(DOM_SID) * ptok->num_sids )) == NULL) {
 726                         DEBUG(0, ("domain_client_validate: Out of memory allocating group SIDS\n"));
 727                         nt_status = NT_STATUS_NO_MEMORY;
 728                         free_server_info(server_info);
 729                         return nt_status;
 730                 }
 731
 732                 for (i = 0; i < ptok->num_sids; i++) {
 733                         sid_copy(&ptok->user_sids[i], &(info3->dom_sid.sid));
 734                         if (!sid_append_rid(&ptok->user_sids[i], info3->gids[i].g_rid)) {
 735                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 736                                 free_server_info(server_info);
 737                                 return nt_status;
 738                         }
 739                 }
 740         }
 741         return NT_STATUS_OK;
 742 }
 743
 744 /***************************************************************************
 745  Make an auth_methods struct
 746 ***************************************************************************/
 747
 748 BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method)
 749 {
 750         if (!auth_context) {
 751                 smb_panic("no auth_context supplied to make_auth_methods()!\n");
 752         }
 753
 754         if (!auth_method) {
 755                 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
 756         }
 757
 758         *auth_method = talloc(auth_context->mem_ctx, sizeof(**auth_method));
 759         if (!*auth_method) {
 760                 DEBUG(0,("make_auth_method: malloc failed!\n"));
 761                 return False;
 762         }
 763         ZERO_STRUCTP(*auth_method);
 764
 765         return True;
 766 }
 767
 768 /****************************************************************************
 769  Delete a SID token.
 770 ****************************************************************************/
 771
 772 void delete_nt_token(NT_USER_TOKEN **pptoken)
 773 {
 774     if (*pptoken) {
 775             NT_USER_TOKEN *ptoken = *pptoken;
 776             SAFE_FREE( ptoken->user_sids );
 777             ZERO_STRUCTP(ptoken);
 778     }
 779     SAFE_FREE(*pptoken);
 780 }
 781
 782 /****************************************************************************
 783  Duplicate a SID token.
 784 ****************************************************************************/
 785
 786 NT_USER_TOKEN *dup_nt_token(NT_USER_TOKEN *ptoken)
 787 {
 788         NT_USER_TOKEN *token;
 789
 790         if (!ptoken)
 791                 return NULL;
 792
 793     if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
 794         return NULL;
 795
 796     ZERO_STRUCTP(token);
 797
 798     if ((token->user_sids = (DOM_SID *)memdup( ptoken->user_sids, sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
 799         SAFE_FREE(token);
 800         return NULL;
 801     }
 802
 803     token->num_sids = ptoken->num_sids;
 804
 805         return token;
 806 }
 807
 808 /**
 809  * Squash an NT_STATUS in line with security requirements.
 810  * In an attempt to avoid giving the whole game away when users
 811  * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
 812  * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
 813  * (session setups in particular).
 814  *
 815  * @param nt_status NTSTATUS input for squashing.
 816  * @return the 'squashed' nt_status
 817  **/
 818
 819 NTSTATUS nt_status_squash(NTSTATUS nt_status)
 820 {
 821         if NT_STATUS_IS_OK(nt_status) {
 822                 return nt_status;
 823         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
 824                 /* Match WinXP and don't give the game away */
 825                 return NT_STATUS_LOGON_FAILURE;
 826
 827         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
 828                 /* Match WinXP and don't give the game away */
 829                 return NT_STATUS_LOGON_FAILURE;
 830         } else {
 831                 return nt_status;
 832         }
 833 }
 834
 835
 836