source3/auth/auth_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6    Copyright (C) Jeremy Allison 2000-2001
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_AUTH
  27
  28 extern fstring remote_machine;
  29 extern pstring global_myname;
  30
  31 /****************************************************************************
  32  Create a UNIX user on demand.
  33 ****************************************************************************/
  34
  35 static int smb_create_user(const char *unix_user, const char *homedir)
  36 {
  37         pstring add_script;
  38         int ret;
  39
  40         pstrcpy(add_script, lp_adduser_script());
  41         if (! *add_script)
  42                 return -1;
  43         all_string_sub(add_script, "%u", unix_user, sizeof(pstring));
  44         if (homedir)
  45                 all_string_sub(add_script, "%H", homedir, sizeof(pstring));
  46         ret = smbrun(add_script,NULL);
  47         DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
  48         return ret;
  49 }
  50
  51 /****************************************************************************
  52  Add and Delete UNIX users on demand, based on NTSTATUS codes.
  53 ****************************************************************************/
  54
  55 void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status)
  56 {
  57         struct passwd *pwd=NULL;
  58
  59         if (NT_STATUS_IS_OK(nt_status)) {
  60
  61                 if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
  62
  63                         /*
  64                          * User validated ok against Domain controller.
  65                          * If the admin wants us to try and create a UNIX
  66                          * user on the fly, do so.
  67                          */
  68
  69                         if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
  70                                 smb_create_user(user_info->internal_username.str, NULL);
  71                         }
  72                 }
  73         }
  74 }
  75
  76 /****************************************************************************
  77  Create an auth_usersupplied_data structure
  78 ****************************************************************************/
  79
  80 static BOOL make_user_info(auth_usersupplied_info **user_info,
  81                            const char *smb_name,
  82                            const char *internal_username,
  83                            const char *client_domain,
  84                            const char *domain,
  85                            const char *wksta_name,
  86                            DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
  87                            DATA_BLOB plaintext,
  88                            uint32 auth_flags, BOOL encrypted)
  89 {
  90
  91         DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
  92
  93         *user_info = malloc(sizeof(**user_info));
  94         if (!user_info) {
  95                 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info)));
  96                 return False;
  97         }
  98
  99         ZERO_STRUCTP(*user_info);
 100
 101         DEBUG(5,("making strings for %s's user_info struct\n", internal_username));
 102
 103         (*user_info)->smb_name.str = strdup(smb_name);
 104         if ((*user_info)->smb_name.str) {
 105                 (*user_info)->smb_name.len = strlen(smb_name);
 106         } else {
 107                 free_user_info(user_info);
 108                 return False;
 109         }
 110
 111         (*user_info)->internal_username.str = strdup(internal_username);
 112         if ((*user_info)->internal_username.str) {
 113                 (*user_info)->internal_username.len = strlen(internal_username);
 114         } else {
 115                 free_user_info(user_info);
 116                 return False;
 117         }
 118
 119         (*user_info)->domain.str = strdup(domain);
 120         if ((*user_info)->domain.str) {
 121                 (*user_info)->domain.len = strlen(domain);
 122         } else {
 123                 free_user_info(user_info);
 124                 return False;
 125         }
 126
 127         (*user_info)->client_domain.str = strdup(client_domain);
 128         if ((*user_info)->client_domain.str) {
 129                 (*user_info)->client_domain.len = strlen(client_domain);
 130         } else {
 131                 free_user_info(user_info);
 132                 return False;
 133         }
 134
 135         (*user_info)->wksta_name.str = strdup(wksta_name);
 136         if ((*user_info)->wksta_name.str) {
 137                 (*user_info)->wksta_name.len = strlen(wksta_name);
 138         } else {
 139                 free_user_info(user_info);
 140                 return False;
 141         }
 142
 143         DEBUG(5,("making blobs for %s's user_info struct\n", internal_username));
 144
 145         (*user_info)->lm_resp = data_blob(lm_pwd.data, lm_pwd.length);
 146         (*user_info)->nt_resp = data_blob(nt_pwd.data, nt_pwd.length);
 147         (*user_info)->plaintext_password = data_blob(plaintext.data, plaintext.length);
 148
 149         (*user_info)->encrypted = encrypted;
 150         (*user_info)->auth_flags = auth_flags;
 151
 152         DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
 153
 154         return True;
 155 }
 156
 157 /****************************************************************************
 158  Create an auth_usersupplied_data structure after appropriate mapping.
 159 ****************************************************************************/
 160
 161 BOOL make_user_info_map(auth_usersupplied_info **user_info,
 162                         const char *smb_name,
 163                         const char *client_domain,
 164                         const char *wksta_name,
 165                         DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
 166                         DATA_BLOB plaintext,
 167                         uint32 ntlmssp_flags, BOOL encrypted)
 168 {
 169         const char *domain;
 170         fstring internal_username;
 171         fstrcpy(internal_username, smb_name);
 172         map_username(internal_username);
 173
 174         DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
 175               client_domain, smb_name, wksta_name));
 176
 177         if (lp_allow_trusted_domains() && *client_domain) {
 178
 179                 /* the client could have given us a workstation name
 180                    or other crap for the workgroup - we really need a
 181                    way of telling if this domain name is one of our
 182                    trusted domain names
 183
 184                    Also don't allow "" as a domain, fixes a Win9X bug
 185                    where it doens't supply a domain for logon script
 186                    'net use' commands.
 187
 188                    The way I do it here is by checking if the fully
 189                    qualified username exists. This is rather reliant
 190                    on winbind, but until we have a better method this
 191                    will have to do
 192                 */
 193
 194                 domain = client_domain;
 195
 196                 if ((smb_name) && (*smb_name)) { /* Don't do this for guests */
 197                         char *user = NULL;
 198                         if (asprintf(&user, "%s%s%s",
 199                                  client_domain, lp_winbind_separator(),
 200                                  smb_name) < 0) {
 201                                 DEBUG(0, ("make_user_info_map: asprintf() failed!\n"));
 202                                 return False;
 203                         }
 204
 205                         DEBUG(5, ("make_user_info_map: testing for user %s\n", user));
 206
 207                         if (Get_Pwnam(user) == NULL) {
 208                                 DEBUG(5, ("make_user_info_map: test for user %s failed\n", user));
 209                                 domain = lp_workgroup();
 210                                 DEBUG(5, ("make_user_info_map: trusted domain %s doesn't appear to exist, using %s\n",
 211                                           client_domain, domain));
 212                         } else {
 213                                 DEBUG(5, ("make_user_info_map: using trusted domain %s\n", domain));
 214                         }
 215                         SAFE_FREE(user);
 216                 }
 217         } else {
 218                 domain = lp_workgroup();
 219         }
 220
 221         return make_user_info(user_info,
 222                               smb_name, internal_username,
 223                               client_domain, domain,
 224                               wksta_name,
 225                               lm_pwd, nt_pwd,
 226                               plaintext,
 227                               ntlmssp_flags, encrypted);
 228
 229 }
 230
 231 /****************************************************************************
 232  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 233  Decrypt and encrypt the passwords.
 234 ****************************************************************************/
 235
 236 BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
 237                                      const char *smb_name,
 238                                      const char *client_domain,
 239                                      const char *wksta_name,
 240                                      const uchar *lm_network_pwd, int lm_pwd_len,
 241                                      const uchar *nt_network_pwd, int nt_pwd_len)
 242 {
 243         BOOL ret;
 244         DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
 245         DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
 246         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 247         uint32 auth_flags = AUTH_FLAG_NONE;
 248
 249         if (lm_pwd_len)
 250                 auth_flags |= AUTH_FLAG_LM_RESP;
 251         if (nt_pwd_len == 24) {
 252                 auth_flags |= AUTH_FLAG_NTLM_RESP;
 253         } else if (nt_pwd_len != 0) {
 254                 auth_flags |= AUTH_FLAG_NTLMv2_RESP;
 255         }
 256
 257         ret = make_user_info_map(user_info,
 258                                  smb_name, client_domain,
 259                                  wksta_name,
 260                                  lm_blob, nt_blob,
 261                                  plaintext_blob,
 262                                  auth_flags, True);
 263
 264         data_blob_free(&lm_blob);
 265         data_blob_free(&nt_blob);
 266         return ret;
 267 }
 268
 269 /****************************************************************************
 270  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 271  Decrypt and encrypt the passwords.
 272 ****************************************************************************/
 273
 274 BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
 275                                          const char *smb_name,
 276                                          const char *client_domain,
 277                                          const char *wksta_name,
 278                                          const uchar chal[8],
 279                                          const uchar lm_interactive_pwd[16],
 280                                          const uchar nt_interactive_pwd[16],
 281                                          const uchar *dc_sess_key)
 282 {
 283         char lm_pwd[16];
 284         char nt_pwd[16];
 285         unsigned char local_lm_response[24];
 286         unsigned char local_nt_response[24];
 287         unsigned char key[16];
 288         uint32 auth_flags = AUTH_FLAG_NONE;
 289
 290         ZERO_STRUCT(key);
 291         memcpy(key, dc_sess_key, 8);
 292
 293         if (lm_interactive_pwd) memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
 294         if (nt_interactive_pwd) memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
 295
 296 #ifdef DEBUG_PASSWORD
 297         DEBUG(100,("key:"));
 298         dump_data(100, (char *)key, sizeof(key));
 299
 300         DEBUG(100,("lm owf password:"));
 301         dump_data(100, lm_pwd, sizeof(lm_pwd));
 302
 303         DEBUG(100,("nt owf password:"));
 304         dump_data(100, nt_pwd, sizeof(nt_pwd));
 305 #endif
 306
 307         SamOEMhash((uchar *)lm_pwd, key, sizeof(lm_pwd));
 308         SamOEMhash((uchar *)nt_pwd, key, sizeof(nt_pwd));
 309
 310 #ifdef DEBUG_PASSWORD
 311         DEBUG(100,("decrypt of lm owf password:"));
 312         dump_data(100, lm_pwd, sizeof(lm_pwd));
 313
 314         DEBUG(100,("decrypt of nt owf password:"));
 315         dump_data(100, nt_pwd, sizeof(nt_pwd));
 316 #endif
 317
 318         SMBOWFencrypt((const unsigned char *)lm_pwd, chal, local_lm_response);
 319         SMBOWFencrypt((const unsigned char *)nt_pwd, chal, local_nt_response);
 320
 321         /* Password info paranoia */
 322         ZERO_STRUCT(lm_pwd);
 323         ZERO_STRUCT(nt_pwd);
 324         ZERO_STRUCT(key);
 325
 326         {
 327                 BOOL ret;
 328                 DATA_BLOB local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
 329                 DATA_BLOB local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
 330                 DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 331
 332                 if (lm_interactive_pwd)
 333                         auth_flags |= AUTH_FLAG_LM_RESP;
 334                 if (nt_interactive_pwd)
 335                         auth_flags |= AUTH_FLAG_NTLM_RESP;
 336
 337                 ret = make_user_info_map(user_info,
 338                                          smb_name, client_domain,
 339                                          wksta_name,
 340                                          local_lm_blob,
 341                                          local_nt_blob,
 342                                          plaintext_blob,
 343                                          auth_flags, True);
 344
 345                 data_blob_free(&local_lm_blob);
 346                 data_blob_free(&local_nt_blob);
 347                 return ret;
 348         }
 349 }
 350
 351
 352 /****************************************************************************
 353  Create an auth_usersupplied_data structure
 354 ****************************************************************************/
 355
 356 BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
 357                               const char *smb_name,
 358                               const char *client_domain,
 359                               const uint8 chal[8],
 360                               DATA_BLOB plaintext_password)
 361 {
 362
 363         DATA_BLOB local_lm_blob;
 364         DATA_BLOB local_nt_blob;
 365         BOOL ret = False;
 366         uint32 auth_flags = AUTH_FLAG_NONE;
 367
 368         /*
 369          * Not encrypted - do so.
 370          */
 371
 372         DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
 373
 374         if (plaintext_password.data) {
 375                 unsigned char local_lm_response[24];
 376
 377 #ifdef DEBUG_PASSWORD
 378                 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password.length));
 379                 dump_data(100, plaintext_password.data, plaintext_password.length);
 380 #endif
 381
 382                 SMBencrypt( (const uchar *)plaintext_password.data, (const uchar*)chal, local_lm_response);
 383                 local_lm_blob = data_blob(local_lm_response, 24);
 384
 385                 /* We can't do an NT hash here, as the password needs to be
 386                    case insensitive */
 387                 local_nt_blob = data_blob(NULL, 0);
 388
 389                 auth_flags = (AUTH_FLAG_PLAINTEXT | AUTH_FLAG_LM_RESP);
 390         } else {
 391                 local_lm_blob = data_blob(NULL, 0);
 392                 local_nt_blob = data_blob(NULL, 0);
 393         }
 394
 395         ret = make_user_info_map(user_info, smb_name,
 396                                  client_domain,
 397                                  remote_machine,
 398                                  local_lm_blob,
 399                                  local_nt_blob,
 400                                  plaintext_password,
 401                                  auth_flags, False);
 402
 403         data_blob_free(&local_lm_blob);
 404         return ret;
 405 }
 406
 407 /****************************************************************************
 408  Create an auth_usersupplied_data structure
 409 ****************************************************************************/
 410
 411 BOOL make_user_info_for_reply_enc(auth_usersupplied_info **user_info,
 412                                   const char *smb_name,
 413                                   const char *client_domain,
 414                                   DATA_BLOB lm_resp, DATA_BLOB nt_resp)
 415 {
 416         uint32 auth_flags = AUTH_FLAG_NONE;
 417
 418         DATA_BLOB no_plaintext_blob = data_blob(NULL, 0);
 419
 420         if (lm_resp.length == 24) {
 421                 auth_flags |= AUTH_FLAG_LM_RESP;
 422         }
 423         if (nt_resp.length == 0) {
 424         } else if (nt_resp.length == 24) {
 425                 auth_flags |= AUTH_FLAG_NTLM_RESP;
 426         } else {
 427                 auth_flags |= AUTH_FLAG_NTLMv2_RESP;
 428         }
 429
 430         return make_user_info_map(user_info, smb_name,
 431                                  client_domain,
 432                                  remote_machine,
 433                                  lm_resp,
 434                                  nt_resp,
 435                                  no_plaintext_blob,
 436                                  auth_flags, True);
 437 }
 438
 439 /****************************************************************************
 440  Create a guest user_info blob, for anonymous authenticaion.
 441 ****************************************************************************/
 442
 443 BOOL make_user_info_guest(auth_usersupplied_info **user_info)
 444 {
 445         DATA_BLOB lm_blob = data_blob(NULL, 0);
 446         DATA_BLOB nt_blob = data_blob(NULL, 0);
 447         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 448         uint32 auth_flags = AUTH_FLAG_NONE;
 449
 450         return make_user_info(user_info,
 451                               "","",
 452                               "","",
 453                               "",
 454                               nt_blob, lm_blob,
 455                               plaintext_blob,
 456                               auth_flags, True);
 457 }
 458
 459 /***************************************************************************
 460  Make a user_info struct
 461 ***************************************************************************/
 462
 463 static BOOL make_server_info(auth_serversupplied_info **server_info)
 464 {
 465         *server_info = malloc(sizeof(**server_info));
 466         if (!*server_info) {
 467                 DEBUG(0,("make_server_info: malloc failed!\n"));
 468                 return False;
 469         }
 470         ZERO_STRUCTP(*server_info);
 471         return True;
 472 }
 473
 474 /***************************************************************************
 475  Make (and fill) a user_info struct from a SAM_ACCOUNT
 476 ***************************************************************************/
 477
 478 BOOL make_server_info_sam(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
 479 {
 480         if (!make_server_info(server_info)) {
 481                 return False;
 482         }
 483
 484         (*server_info)->sam_fill_level = SAM_FILL_ALL;
 485         (*server_info)->sam_account = sampass;
 486
 487         DEBUG(5,("make_server_info_sam: made server info for user %s\n",
 488                  pdb_get_username((*server_info)->sam_account)));
 489         return True;
 490 }
 491
 492 /***************************************************************************
 493  Make (and fill) a user_info struct from a 'struct passwd' by conversion
 494  to a SAM_ACCOUNT
 495 ***************************************************************************/
 496
 497 BOOL make_server_info_pw(auth_serversupplied_info **server_info, const struct passwd *pwd)
 498 {
 499         SAM_ACCOUNT *sampass = NULL;
 500         if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sampass, pwd))) {
 501                 return False;
 502         }
 503         return make_server_info_sam(server_info, sampass);
 504 }
 505
 506 /***************************************************************************
 507  Free a user_info struct
 508 ***************************************************************************/
 509
 510 void free_user_info(auth_usersupplied_info **user_info)
 511 {
 512         DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
 513         if (*user_info != NULL) {
 514                 if ((*user_info)->smb_name.str) {
 515                         DEBUG(10,("structure was created for %s\n", (*user_info)->smb_name.str));
 516                 }
 517                 SAFE_FREE((*user_info)->smb_name.str);
 518                 SAFE_FREE((*user_info)->internal_username.str);
 519                 SAFE_FREE((*user_info)->client_domain.str);
 520                 SAFE_FREE((*user_info)->domain.str);
 521                 SAFE_FREE((*user_info)->wksta_name.str);
 522                 data_blob_free(&(*user_info)->lm_resp);
 523                 data_blob_free(&(*user_info)->nt_resp);
 524                 SAFE_FREE((*user_info)->interactive_password);
 525                 data_blob_clear_free(&(*user_info)->plaintext_password);
 526                 ZERO_STRUCT(**user_info);
 527         }
 528         SAFE_FREE(*user_info);
 529 }
 530
 531 /***************************************************************************
 532  Clear out a server_info struct that has been allocated
 533 ***************************************************************************/
 534
 535 void free_server_info(auth_serversupplied_info **server_info)
 536 {
 537         if (*server_info != NULL) {
 538                 pdb_free_sam(&(*server_info)->sam_account);
 539
 540                 /* call pam_end here, unless we know we are keeping it */
 541                 delete_nt_token( &(*server_info)->ptok );
 542                 ZERO_STRUCT(**server_info);
 543         }
 544         SAFE_FREE(*server_info);
 545 }
 546
 547 /***************************************************************************
 548  Make a server_info struct for a guest user
 549 ***************************************************************************/
 550
 551 BOOL make_server_info_guest(auth_serversupplied_info **server_info)
 552 {
 553         struct passwd *pass = getpwnam_alloc(lp_guestaccount());
 554
 555         if (pass) {
 556                 if (!make_server_info_pw(server_info, pass)) {
 557                         passwd_free(&pass);
 558                         return False;
 559                 }
 560                 (*server_info)->guest = True;
 561                 passwd_free(&pass);
 562                 return True;
 563         }
 564         DEBUG(0,("make_server_info_guest: getpwnam_alloc() failed on guest account!\n"));
 565         return False;
 566 }
 567
 568 /***************************************************************************
 569  Make a server_info struct from the info3 returned by a domain logon
 570 ***************************************************************************/
 571
 572 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
 573                                 const char *internal_username,
 574                                 const char *sent_nt_username,
 575                                 const char *domain,
 576                                 auth_serversupplied_info **server_info,
 577                                 NET_USER_INFO_3 *info3)
 578 {
 579         NTSTATUS nt_status = NT_STATUS_OK;
 580
 581         const char *nt_domain;
 582         const char *nt_username;
 583
 584         SAM_ACCOUNT *sam_account = NULL;
 585         DOM_SID user_sid;
 586         DOM_SID group_sid;
 587
 588         struct passwd *passwd;
 589
 590         uid_t uid;
 591         gid_t gid;
 592
 593         /*
 594            Here is where we should check the list of
 595            trusted domains, and verify that the SID
 596            matches.
 597         */
 598
 599         sid_copy(&user_sid, &info3->dom_sid.sid);
 600         if (!sid_append_rid(&user_sid, info3->user_rid)) {
 601                 return NT_STATUS_INVALID_PARAMETER;
 602         }
 603
 604         sid_copy(&group_sid, &info3->dom_sid.sid);
 605         if (!sid_append_rid(&group_sid, info3->group_rid)) {
 606                 return NT_STATUS_INVALID_PARAMETER;
 607         }
 608
 609         if (!(nt_username = unistr2_tdup(mem_ctx, &(info3->uni_user_name)))) {
 610                 /* If the server didn't give us one, just use the one we sent them */
 611                 nt_username = sent_nt_username;
 612         }
 613
 614         if (!(nt_domain = unistr2_tdup(mem_ctx, &(info3->uni_logon_dom)))) {
 615                 /* If the server didn't give us one, just use the one we sent them */
 616                 domain = domain;
 617         }
 618
 619         if (winbind_sid_to_uid(&uid, &user_sid)
 620             && winbind_sid_to_gid(&gid, &group_sid)
 621             && ((passwd = getpwuid_alloc(uid)))) {
 622                 nt_status = pdb_init_sam_pw(&sam_account, passwd);
 623                 passwd_free(&passwd);
 624         } else {
 625                 char *dom_user;
 626                 dom_user = talloc_asprintf(mem_ctx, "%s%s%s",
 627                                            nt_domain,
 628                                            lp_winbind_separator(),
 629                                            internal_username);
 630
 631                 if (!dom_user) {
 632                         DEBUG(0, ("talloc_asprintf failed!\n"));
 633                         return NT_STATUS_NO_MEMORY;
 634                 } else {
 635
 636                         if (!(passwd = Get_Pwnam(dom_user))
 637                                 /* Only lookup local for the local
 638                                    domain, we don't want this for
 639                                    trusted domains */
 640                             && strequal(nt_domain, lp_workgroup())) {
 641                                 passwd = Get_Pwnam(internal_username);
 642                         }
 643
 644                         if (!passwd) {
 645                                 return NT_STATUS_NO_SUCH_USER;
 646                         } else {
 647                                 nt_status = pdb_init_sam_pw(&sam_account, passwd);
 648                         }
 649                 }
 650         }
 651
 652         if (!NT_STATUS_IS_OK(nt_status)) {
 653                 DEBUG(0, ("make_server_info_info3: pdb_init_sam failed!\n"));
 654                 return nt_status;
 655         }
 656
 657         if (!pdb_set_user_sid(sam_account, &user_sid)) {
 658                 pdb_free_sam(&sam_account);
 659                 return NT_STATUS_UNSUCCESSFUL;
 660         }
 661
 662         if (!pdb_set_group_sid(sam_account, &group_sid)) {
 663                 pdb_free_sam(&sam_account);
 664                 return NT_STATUS_UNSUCCESSFUL;
 665         }
 666
 667         if (!pdb_set_nt_username(sam_account, nt_username)) {
 668                 pdb_free_sam(&sam_account);
 669                 return NT_STATUS_NO_MEMORY;
 670         }
 671
 672         if (!pdb_set_domain(sam_account, nt_domain)) {
 673                 pdb_free_sam(&sam_account);
 674                 return NT_STATUS_NO_MEMORY;
 675         }
 676
 677         if (!pdb_set_fullname(sam_account, pdb_unistr2_convert(&(info3->uni_full_name)))) {
 678                 pdb_free_sam(&sam_account);
 679                 return NT_STATUS_NO_MEMORY;
 680         }
 681
 682         if (!pdb_set_logon_script(sam_account, pdb_unistr2_convert(&(info3->uni_logon_script)), True)) {
 683                 pdb_free_sam(&sam_account);
 684                 return NT_STATUS_NO_MEMORY;
 685         }
 686
 687         if (!pdb_set_profile_path(sam_account, pdb_unistr2_convert(&(info3->uni_profile_path)), True)) {
 688                 pdb_free_sam(&sam_account);
 689                 return NT_STATUS_NO_MEMORY;
 690         }
 691
 692         if (!pdb_set_homedir(sam_account, pdb_unistr2_convert(&(info3->uni_home_dir)), True)) {
 693                 pdb_free_sam(&sam_account);
 694                 return NT_STATUS_NO_MEMORY;
 695         }
 696
 697         if (!pdb_set_dir_drive(sam_account, pdb_unistr2_convert(&(info3->uni_dir_drive)), True)) {
 698                 pdb_free_sam(&sam_account);
 699                 return NT_STATUS_NO_MEMORY;
 700         }
 701
 702         if (!make_server_info_sam(server_info, sam_account)) {
 703                 DEBUG(0, ("make_server_info_info3: make_server_info_sam failed!\n"));
 704                 pdb_free_sam(&sam_account);
 705                 return NT_STATUS_NO_MEMORY;
 706         }
 707
 708         /* Store the user group information in the server_info
 709            returned to the caller. */
 710
 711         if (info3->num_groups2 != 0) {
 712                 int i;
 713                 NT_USER_TOKEN *ptok;
 714                 auth_serversupplied_info *pserver_info = *server_info;
 715
 716                 if ((pserver_info->ptok = malloc( sizeof(NT_USER_TOKEN) ) ) == NULL) {
 717                         DEBUG(0, ("domain_client_validate: out of memory allocating rid group membership\n"));
 718                         nt_status = NT_STATUS_NO_MEMORY;
 719                         free_server_info(server_info);
 720                         return nt_status;
 721                 }
 722
 723                 ptok = pserver_info->ptok;
 724                 ptok->num_sids = (size_t)info3->num_groups2;
 725
 726                 if ((ptok->user_sids = (DOM_SID *)malloc( sizeof(DOM_SID) * ptok->num_sids )) == NULL) {
 727                         DEBUG(0, ("domain_client_validate: Out of memory allocating group SIDS\n"));
 728                         nt_status = NT_STATUS_NO_MEMORY;
 729                         free_server_info(server_info);
 730                         return nt_status;
 731                 }
 732
 733                 for (i = 0; i < ptok->num_sids; i++) {
 734                         sid_copy(&ptok->user_sids[i], &(info3->dom_sid.sid));
 735                         if (!sid_append_rid(&ptok->user_sids[i], info3->gids[i].g_rid)) {
 736                                 nt_status = NT_STATUS_INVALID_PARAMETER;
 737                                 free_server_info(server_info);
 738                                 return nt_status;
 739                         }
 740                 }
 741         }
 742         return NT_STATUS_OK;
 743 }
 744
 745 /***************************************************************************
 746  Make an auth_methods struct
 747 ***************************************************************************/
 748
 749 BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method)
 750 {
 751         if (!auth_context) {
 752                 smb_panic("no auth_context supplied to make_auth_methods()!\n");
 753         }
 754
 755         if (!auth_method) {
 756                 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
 757         }
 758
 759         *auth_method = talloc(auth_context->mem_ctx, sizeof(**auth_method));
 760         if (!*auth_method) {
 761                 DEBUG(0,("make_auth_method: malloc failed!\n"));
 762                 return False;
 763         }
 764         ZERO_STRUCTP(*auth_method);
 765
 766         return True;
 767 }
 768
 769 /****************************************************************************
 770  Delete a SID token.
 771 ****************************************************************************/
 772
 773 void delete_nt_token(NT_USER_TOKEN **pptoken)
 774 {
 775     if (*pptoken) {
 776             NT_USER_TOKEN *ptoken = *pptoken;
 777             SAFE_FREE( ptoken->user_sids );
 778             ZERO_STRUCTP(ptoken);
 779     }
 780     SAFE_FREE(*pptoken);
 781 }
 782
 783 /****************************************************************************
 784  Duplicate a SID token.
 785 ****************************************************************************/
 786
 787 NT_USER_TOKEN *dup_nt_token(NT_USER_TOKEN *ptoken)
 788 {
 789         NT_USER_TOKEN *token;
 790
 791         if (!ptoken)
 792                 return NULL;
 793
 794     if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
 795         return NULL;
 796
 797     ZERO_STRUCTP(token);
 798
 799     if ((token->user_sids = (DOM_SID *)memdup( ptoken->user_sids, sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
 800         SAFE_FREE(token);
 801         return NULL;
 802     }
 803
 804     token->num_sids = ptoken->num_sids;
 805
 806         return token;
 807 }
 808
 809 /**
 810  * Squash an NT_STATUS in line with security requirements.
 811  * In an attempt to avoid giving the whole game away when users
 812  * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
 813  * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
 814  * (session setups in particular).
 815  *
 816  * @param nt_status NTSTATUS input for squashing.
 817  * @return the 'squashed' nt_status
 818  **/
 819
 820 NTSTATUS nt_status_squash(NTSTATUS nt_status)
 821 {
 822         if NT_STATUS_IS_OK(nt_status) {
 823                 return nt_status;
 824         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
 825                 /* Match WinXP and don't give the game away */
 826                 return NT_STATUS_LOGON_FAILURE;
 827
 828         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
 829                 /* Match WinXP and don't give the game away */
 830                 return NT_STATUS_LOGON_FAILURE;
 831         } else {
 832                 return nt_status;
 833         }
 834 }
 835
 836
 837