source3/auth/auth_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6    Copyright (C) Jeremy Allison 2000-2001
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_AUTH
  27
  28 extern fstring remote_machine;
  29 extern pstring global_myname;
  30
  31 /****************************************************************************
  32  Create a UNIX user on demand.
  33 ****************************************************************************/
  34
  35 static int smb_create_user(const char *unix_user, const char *homedir)
  36 {
  37         pstring add_script;
  38         int ret;
  39
  40         pstrcpy(add_script, lp_adduser_script());
  41         if (! *add_script)
  42                 return -1;
  43         all_string_sub(add_script, "%u", unix_user, sizeof(pstring));
  44         if (homedir)
  45                 all_string_sub(add_script, "%H", homedir, sizeof(pstring));
  46         ret = smbrun(add_script,NULL);
  47         DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
  48         return ret;
  49 }
  50
  51 /****************************************************************************
  52  Delete a UNIX user on demand.
  53 ****************************************************************************/
  54
  55 int smb_delete_user(const char *unix_user)
  56 {
  57         pstring del_script;
  58         int ret;
  59
  60         pstrcpy(del_script, lp_deluser_script());
  61         if (! *del_script)
  62                 return -1;
  63         all_string_sub(del_script, "%u", unix_user, sizeof(pstring));
  64         ret = smbrun(del_script,NULL);
  65         DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
  66         return ret;
  67 }
  68
  69 /****************************************************************************
  70  Add and Delete UNIX users on demand, based on NTSTATUS codes.
  71 ****************************************************************************/
  72
  73 void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status)
  74 {
  75         struct passwd *pwd=NULL;
  76
  77         if (NT_STATUS_IS_OK(nt_status)) {
  78
  79                 if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
  80
  81                         /*
  82                          * User validated ok against Domain controller.
  83                          * If the admin wants us to try and create a UNIX
  84                          * user on the fly, do so.
  85                          */
  86
  87                         if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
  88                                 smb_create_user(user_info->internal_username.str, NULL);
  89                         }
  90                 }
  91         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
  92                 /*
  93                  * User failed to validate ok against Domain controller.
  94                  * If the failure was "user doesn't exist" and admin
  95                  * wants us to try and delete that UNIX user on the fly,
  96                  * do so.
  97                  */
  98                 if (lp_deluser_script()) {
  99                         smb_delete_user(user_info->internal_username.str);
 100                 }
 101         }
 102 }
 103
 104 /****************************************************************************
 105  Create an auth_usersupplied_data structure
 106 ****************************************************************************/
 107
 108 static BOOL make_user_info(auth_usersupplied_info **user_info,
 109                            const char *smb_name,
 110                            const char *internal_username,
 111                            const char *client_domain,
 112                            const char *domain,
 113                            const char *wksta_name,
 114                            DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
 115                            DATA_BLOB plaintext,
 116                            uint32 auth_flags, BOOL encrypted)
 117 {
 118
 119         DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
 120
 121         *user_info = malloc(sizeof(**user_info));
 122         if (!user_info) {
 123                 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info)));
 124                 return False;
 125         }
 126
 127         ZERO_STRUCTP(*user_info);
 128
 129         DEBUG(5,("making strings for %s's user_info struct\n", internal_username));
 130
 131         (*user_info)->smb_name.str = strdup(smb_name);
 132         if ((*user_info)->smb_name.str) {
 133                 (*user_info)->smb_name.len = strlen(smb_name);
 134         } else {
 135                 free_user_info(user_info);
 136                 return False;
 137         }
 138
 139         (*user_info)->internal_username.str = strdup(internal_username);
 140         if ((*user_info)->internal_username.str) {
 141                 (*user_info)->internal_username.len = strlen(internal_username);
 142         } else {
 143                 free_user_info(user_info);
 144                 return False;
 145         }
 146
 147         (*user_info)->domain.str = strdup(domain);
 148         if ((*user_info)->domain.str) {
 149                 (*user_info)->domain.len = strlen(domain);
 150         } else {
 151                 free_user_info(user_info);
 152                 return False;
 153         }
 154
 155         (*user_info)->client_domain.str = strdup(client_domain);
 156         if ((*user_info)->client_domain.str) {
 157                 (*user_info)->client_domain.len = strlen(client_domain);
 158         } else {
 159                 free_user_info(user_info);
 160                 return False;
 161         }
 162
 163         (*user_info)->wksta_name.str = strdup(wksta_name);
 164         if ((*user_info)->wksta_name.str) {
 165                 (*user_info)->wksta_name.len = strlen(wksta_name);
 166         } else {
 167                 free_user_info(user_info);
 168                 return False;
 169         }
 170
 171         DEBUG(5,("makeing blobs for %s's user_info struct\n", internal_username));
 172
 173         (*user_info)->lm_resp = data_blob(lm_pwd.data, lm_pwd.length);
 174         (*user_info)->nt_resp = data_blob(nt_pwd.data, nt_pwd.length);
 175         (*user_info)->plaintext_password = data_blob(plaintext.data, plaintext.length);
 176
 177         (*user_info)->encrypted = encrypted;
 178         (*user_info)->auth_flags = auth_flags;
 179
 180         DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
 181
 182         return True;
 183 }
 184
 185 /****************************************************************************
 186  Create an auth_usersupplied_data structure after appropriate mapping.
 187 ****************************************************************************/
 188
 189 BOOL make_user_info_map(auth_usersupplied_info **user_info,
 190                         const char *smb_name,
 191                         const char *client_domain,
 192                         const char *wksta_name,
 193                         DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
 194                         DATA_BLOB plaintext,
 195                         uint32 ntlmssp_flags, BOOL encrypted)
 196 {
 197         const char *domain;
 198         fstring internal_username;
 199         fstrcpy(internal_username, smb_name);
 200         map_username(internal_username);
 201
 202         DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
 203               client_domain, smb_name, wksta_name));
 204
 205         if (lp_allow_trusted_domains() && *client_domain) {
 206
 207                 /* the client could have given us a workstation name
 208                    or other crap for the workgroup - we really need a
 209                    way of telling if this domain name is one of our
 210                    trusted domain names
 211
 212                    Also don't allow "" as a domain, fixes a Win9X bug
 213                    where it doens't supply a domain for logon script
 214                    'net use' commands.
 215
 216                    The way I do it here is by checking if the fully
 217                    qualified username exists. This is rather reliant
 218                    on winbind, but until we have a better method this
 219                    will have to do
 220                 */
 221
 222                 domain = client_domain;
 223
 224                 if ((smb_name) && (*smb_name)) { /* Don't do this for guests */
 225                         char *user = NULL;
 226                         if (asprintf(&user, "%s%s%s",
 227                                  client_domain, lp_winbind_separator(),
 228                                  smb_name) < 0) {
 229                                 DEBUG(0, ("make_user_info_map: asprintf() failed!\n"));
 230                                 return False;
 231                         }
 232
 233                         DEBUG(5, ("make_user_info_map: testing for user %s\n", user));
 234
 235                         if (Get_Pwnam(user) == NULL) {
 236                                 DEBUG(5, ("make_user_info_map: test for user %s failed\n", user));
 237                                 domain = lp_workgroup();
 238                                 DEBUG(5, ("make_user_info_map: trusted domain %s doesn't appear to exist, using %s\n",
 239                                           client_domain, domain));
 240                         } else {
 241                                 DEBUG(5, ("make_user_info_map: using trusted domain %s\n", domain));
 242                         }
 243                         SAFE_FREE(user);
 244                 }
 245         } else {
 246                 domain = lp_workgroup();
 247         }
 248
 249         return make_user_info(user_info,
 250                               smb_name, internal_username,
 251                               client_domain, domain,
 252                               wksta_name,
 253                               lm_pwd, nt_pwd,
 254                               plaintext,
 255                               ntlmssp_flags, encrypted);
 256
 257 }
 258
 259 /****************************************************************************
 260  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 261  Decrypt and encrypt the passwords.
 262 ****************************************************************************/
 263
 264 BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
 265                                      const char *smb_name,
 266                                      const char *client_domain,
 267                                      const char *wksta_name,
 268                                      const uchar *lm_network_pwd, int lm_pwd_len,
 269                                      const uchar *nt_network_pwd, int nt_pwd_len)
 270 {
 271         BOOL ret;
 272         DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
 273         DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
 274         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 275         uint32 auth_flags = AUTH_FLAG_NONE;
 276
 277         if (lm_pwd_len)
 278                 auth_flags |= AUTH_FLAG_LM_RESP;
 279         if (nt_pwd_len == 24) {
 280                 auth_flags |= AUTH_FLAG_NTLM_RESP;
 281         } else if (nt_pwd_len != 0) {
 282                 auth_flags |= AUTH_FLAG_NTLMv2_RESP;
 283         }
 284
 285         ret = make_user_info_map(user_info,
 286                                  smb_name, client_domain,
 287                                  wksta_name,
 288                                  lm_blob, nt_blob,
 289                                  plaintext_blob,
 290                                  auth_flags, True);
 291
 292         data_blob_free(&lm_blob);
 293         data_blob_free(&nt_blob);
 294         return ret;
 295 }
 296
 297 /****************************************************************************
 298  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 299  Decrypt and encrypt the passwords.
 300 ****************************************************************************/
 301
 302 BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
 303                                          const char *smb_name,
 304                                          const char *client_domain,
 305                                          const char *wksta_name,
 306                                          const uchar chal[8],
 307                                          const uchar lm_interactive_pwd[16],
 308                                          const uchar nt_interactive_pwd[16],
 309                                          const uchar *dc_sess_key)
 310 {
 311         char lm_pwd[16];
 312         char nt_pwd[16];
 313         unsigned char local_lm_response[24];
 314         unsigned char local_nt_response[24];
 315         unsigned char key[16];
 316         uint32 auth_flags = AUTH_FLAG_NONE;
 317
 318         ZERO_STRUCT(key);
 319         memcpy(key, dc_sess_key, 8);
 320
 321         if (lm_interactive_pwd) memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
 322         if (nt_interactive_pwd) memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
 323
 324 #ifdef DEBUG_PASSWORD
 325         DEBUG(100,("key:"));
 326         dump_data(100, (char *)key, sizeof(key));
 327
 328         DEBUG(100,("lm owf password:"));
 329         dump_data(100, lm_pwd, sizeof(lm_pwd));
 330
 331         DEBUG(100,("nt owf password:"));
 332         dump_data(100, nt_pwd, sizeof(nt_pwd));
 333 #endif
 334
 335         SamOEMhash((uchar *)lm_pwd, key, sizeof(lm_pwd));
 336         SamOEMhash((uchar *)nt_pwd, key, sizeof(nt_pwd));
 337
 338 #ifdef DEBUG_PASSWORD
 339         DEBUG(100,("decrypt of lm owf password:"));
 340         dump_data(100, lm_pwd, sizeof(lm_pwd));
 341
 342         DEBUG(100,("decrypt of nt owf password:"));
 343         dump_data(100, nt_pwd, sizeof(nt_pwd));
 344 #endif
 345
 346         SMBOWFencrypt((const unsigned char *)lm_pwd, chal, local_lm_response);
 347         SMBOWFencrypt((const unsigned char *)nt_pwd, chal, local_nt_response);
 348
 349         /* Password info paranoia */
 350         ZERO_STRUCT(lm_pwd);
 351         ZERO_STRUCT(nt_pwd);
 352         ZERO_STRUCT(key);
 353
 354         {
 355                 BOOL ret;
 356                 DATA_BLOB local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
 357                 DATA_BLOB local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
 358                 DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 359
 360                 if (lm_interactive_pwd)
 361                         auth_flags |= AUTH_FLAG_LM_RESP;
 362                 if (nt_interactive_pwd)
 363                         auth_flags |= AUTH_FLAG_NTLM_RESP;
 364
 365                 ret = make_user_info_map(user_info,
 366                                          smb_name, client_domain,
 367                                          wksta_name,
 368                                          local_lm_blob,
 369                                          local_nt_blob,
 370                                          plaintext_blob,
 371                                          auth_flags, True);
 372
 373                 data_blob_free(&local_lm_blob);
 374                 data_blob_free(&local_nt_blob);
 375                 return ret;
 376         }
 377 }
 378
 379
 380 /****************************************************************************
 381  Create an auth_usersupplied_data structure
 382 ****************************************************************************/
 383
 384 BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
 385                               const char *smb_name,
 386                               const char *client_domain,
 387                               const uint8 chal[8],
 388                               DATA_BLOB plaintext_password)
 389 {
 390
 391         DATA_BLOB local_lm_blob;
 392         DATA_BLOB local_nt_blob;
 393         BOOL ret = False;
 394         uint32 auth_flags = AUTH_FLAG_NONE;
 395
 396         /*
 397          * Not encrypted - do so.
 398          */
 399
 400         DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
 401
 402         if (plaintext_password.data) {
 403                 unsigned char local_lm_response[24];
 404
 405 #ifdef DEBUG_PASSWORD
 406                 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password.length));
 407                 dump_data(100, plaintext_password.data, plaintext_password.length);
 408 #endif
 409
 410                 SMBencrypt( (const uchar *)plaintext_password.data, (const uchar*)chal, local_lm_response);
 411                 local_lm_blob = data_blob(local_lm_response, 24);
 412
 413                 /* We can't do an NT hash here, as the password needs to be
 414                    case insensitive */
 415                 local_nt_blob = data_blob(NULL, 0);
 416
 417                 auth_flags = (AUTH_FLAG_PLAINTEXT | AUTH_FLAG_LM_RESP);
 418         } else {
 419                 local_lm_blob = data_blob(NULL, 0);
 420                 local_nt_blob = data_blob(NULL, 0);
 421         }
 422
 423         ret = make_user_info_map(user_info, smb_name,
 424                                  client_domain,
 425                                  remote_machine,
 426                                  local_lm_blob,
 427                                  local_nt_blob,
 428                                  plaintext_password,
 429                                  auth_flags, False);
 430
 431         data_blob_free(&local_lm_blob);
 432         return ret;
 433 }
 434
 435 /****************************************************************************
 436  Create an auth_usersupplied_data structure
 437 ****************************************************************************/
 438
 439 BOOL make_user_info_for_reply_enc(auth_usersupplied_info **user_info,
 440                                   const char *smb_name,
 441                                   const char *client_domain,
 442                                   DATA_BLOB lm_resp, DATA_BLOB nt_resp)
 443 {
 444         uint32 auth_flags = AUTH_FLAG_NONE;
 445
 446         DATA_BLOB no_plaintext_blob = data_blob(NULL, 0);
 447
 448         if (lm_resp.length == 24) {
 449                 auth_flags |= AUTH_FLAG_LM_RESP;
 450         }
 451         if (nt_resp.length == 0) {
 452         } else if (nt_resp.length == 24) {
 453                 auth_flags |= AUTH_FLAG_NTLM_RESP;
 454         } else {
 455                 auth_flags |= AUTH_FLAG_NTLMv2_RESP;
 456         }
 457
 458         return make_user_info_map(user_info, smb_name,
 459                                  client_domain,
 460                                  remote_machine,
 461                                  lm_resp,
 462                                  nt_resp,
 463                                  no_plaintext_blob,
 464                                  auth_flags, True);
 465 }
 466
 467 /****************************************************************************
 468  Create a guest user_info blob, for anonymous authenticaion.
 469 ****************************************************************************/
 470
 471 BOOL make_user_info_guest(auth_usersupplied_info **user_info)
 472 {
 473         DATA_BLOB lm_blob = data_blob(NULL, 0);
 474         DATA_BLOB nt_blob = data_blob(NULL, 0);
 475         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 476         uint32 auth_flags = AUTH_FLAG_NONE;
 477
 478         return make_user_info(user_info,
 479                               "","",
 480                               "","",
 481                               "",
 482                               nt_blob, lm_blob,
 483                               plaintext_blob,
 484                               auth_flags, True);
 485 }
 486
 487 /***************************************************************************
 488  Make a user_info struct
 489 ***************************************************************************/
 490
 491 BOOL make_server_info(auth_serversupplied_info **server_info)
 492 {
 493         *server_info = malloc(sizeof(**server_info));
 494         if (!*server_info) {
 495                 DEBUG(0,("make_server_info: malloc failed!\n"));
 496                 return False;
 497         }
 498         ZERO_STRUCTP(*server_info);
 499         return True;
 500 }
 501
 502 /***************************************************************************
 503  Make (and fill) a user_info struct from a SAM_ACCOUNT
 504 ***************************************************************************/
 505
 506 BOOL make_server_info_sam(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
 507 {
 508         if (!make_server_info(server_info)) {
 509                 return False;
 510         }
 511
 512         (*server_info)->sam_fill_level = SAM_FILL_ALL;
 513         (*server_info)->sam_account = sampass;
 514
 515         DEBUG(5,("make_server_info_sam: made server info for user %s\n",
 516                  pdb_get_username((*server_info)->sam_account)));
 517         return True;
 518 }
 519
 520 /***************************************************************************
 521  Make (and fill) a user_info struct from a 'struct passwd' by conversion
 522  to a SAM_ACCOUNT
 523 ***************************************************************************/
 524
 525 BOOL make_server_info_pw(auth_serversupplied_info **server_info, const struct passwd *pwd)
 526 {
 527         SAM_ACCOUNT *sampass = NULL;
 528         if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sampass, pwd))) {
 529                 return False;
 530         }
 531         return make_server_info_sam(server_info, sampass);
 532 }
 533
 534 /***************************************************************************
 535  Free a user_info struct
 536 ***************************************************************************/
 537
 538 void free_user_info(auth_usersupplied_info **user_info)
 539 {
 540         DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
 541         if (*user_info != NULL) {
 542                 if ((*user_info)->smb_name.str) {
 543                         DEBUG(10,("structure was created for %s\n", (*user_info)->smb_name.str));
 544                 }
 545                 SAFE_FREE((*user_info)->smb_name.str);
 546                 SAFE_FREE((*user_info)->internal_username.str);
 547                 SAFE_FREE((*user_info)->client_domain.str);
 548                 SAFE_FREE((*user_info)->domain.str);
 549                 SAFE_FREE((*user_info)->wksta_name.str);
 550                 data_blob_free(&(*user_info)->lm_resp);
 551                 data_blob_free(&(*user_info)->nt_resp);
 552                 SAFE_FREE((*user_info)->interactive_password);
 553                 data_blob_clear_free(&(*user_info)->plaintext_password);
 554                 ZERO_STRUCT(**user_info);
 555         }
 556         SAFE_FREE(*user_info);
 557 }
 558
 559 /***************************************************************************
 560  Clear out a server_info struct that has been allocated
 561 ***************************************************************************/
 562
 563 void free_server_info(auth_serversupplied_info **server_info)
 564 {
 565         if (*server_info != NULL) {
 566                 pdb_free_sam(&(*server_info)->sam_account);
 567
 568                 /* call pam_end here, unless we know we are keeping it */
 569                 delete_nt_token( &(*server_info)->ptok );
 570                 ZERO_STRUCT(**server_info);
 571         }
 572         SAFE_FREE(*server_info);
 573 }
 574
 575 /***************************************************************************
 576  Make a server_info struct for a guest user
 577 ***************************************************************************/
 578
 579 BOOL make_server_info_guest(auth_serversupplied_info **server_info)
 580 {
 581         struct passwd *pass = getpwnam_alloc(lp_guestaccount());
 582
 583         if (pass) {
 584                 if (!make_server_info_pw(server_info, pass)) {
 585                         passwd_free(&pass);
 586                         return False;
 587                 }
 588                 (*server_info)->guest = True;
 589                 passwd_free(&pass);
 590                 return True;
 591         }
 592         DEBUG(0,("make_server_info_guest: getpwnam_alloc() failed on guest account!\n"));
 593         return False;
 594 }
 595
 596 /***************************************************************************
 597  Make an auth_methods struct
 598 ***************************************************************************/
 599
 600 BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method)
 601 {
 602         if (!auth_context) {
 603                 smb_panic("no auth_context supplied to make_auth_methods()!\n");
 604         }
 605
 606         if (!auth_method) {
 607                 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
 608         }
 609
 610         *auth_method = talloc(auth_context->mem_ctx, sizeof(**auth_method));
 611         if (!*auth_method) {
 612                 DEBUG(0,("make_auth_method: malloc failed!\n"));
 613                 return False;
 614         }
 615         ZERO_STRUCTP(*auth_method);
 616
 617         return True;
 618 }
 619
 620 /****************************************************************************
 621  Delete a SID token.
 622 ****************************************************************************/
 623
 624 void delete_nt_token(NT_USER_TOKEN **pptoken)
 625 {
 626     if (*pptoken) {
 627                 NT_USER_TOKEN *ptoken = *pptoken;
 628         SAFE_FREE( ptoken->user_sids );
 629         ZERO_STRUCTP(ptoken);
 630     }
 631     SAFE_FREE(*pptoken);
 632 }
 633
 634 /****************************************************************************
 635  Duplicate a SID token.
 636 ****************************************************************************/
 637
 638 NT_USER_TOKEN *dup_nt_token(NT_USER_TOKEN *ptoken)
 639 {
 640         NT_USER_TOKEN *token;
 641
 642         if (!ptoken)
 643                 return NULL;
 644
 645     if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
 646         return NULL;
 647
 648     ZERO_STRUCTP(token);
 649
 650     if ((token->user_sids = (DOM_SID *)memdup( ptoken->user_sids, sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
 651         SAFE_FREE(token);
 652         return NULL;
 653     }
 654
 655     token->num_sids = ptoken->num_sids;
 656
 657         return token;
 658 }
 659
 660 /**
 661  * Squash an NT_STATUS in line with security requirements.
 662  * In an attempt to avoid giving the whole game away when users
 663  * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
 664  * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
 665  * (session setups in particular).
 666  *
 667  * @param nt_status NTSTATUS input for squashing.
 668  * @return the 'squashed' nt_status
 669  **/
 670
 671 NTSTATUS nt_status_squash(NTSTATUS nt_status)
 672 {
 673         if NT_STATUS_IS_OK(nt_status) {
 674                 return nt_status;
 675         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
 676                 /* Match WinXP and don't give the game away */
 677                 return NT_STATUS_LOGON_FAILURE;
 678
 679         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
 680                 /* Match WinXP and don't give the game away */
 681                 return NT_STATUS_LOGON_FAILURE;
 682         } else {
 683                 return nt_status;
 684         }
 685 }
 686
 687
 688