2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Volker Lendecke 2010
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "../lib/crypto/arcfour.h"
23 #include "../librpc/gen_ndr/netlogon.h"
24 #include "../libcli/security/security.h"
25 #include "rpc_client/util_netlogon.h"
26 #include "nsswitch/libwbclient/wbclient.h"
30 #define DBGC_CLASS DBGC_AUTH
32 /***************************************************************************
33 Make a server_info struct. Free with TALLOC_FREE().
34 ***************************************************************************/
36 struct auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx)
38 struct auth_serversupplied_info *result;
40 result = talloc_zero(mem_ctx, struct auth_serversupplied_info);
42 DEBUG(0, ("talloc failed\n"));
46 /* Initialise the uid and gid values to something non-zero
47 which may save us from giving away root access if there
48 is a bug in allocating these fields. */
50 result->utok.uid = -1;
51 result->utok.gid = -1;
56 /****************************************************************************
57 inits a netr_SamInfo2 structure from an auth_serversupplied_info. sam2 must
58 already be initialized and is used as the talloc parent for its members.
59 *****************************************************************************/
61 NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
62 struct netr_SamInfo2 *sam2)
64 struct netr_SamInfo3 *info3;
66 info3 = copy_netr_SamInfo3(sam2, server_info->info3);
68 return NT_STATUS_NO_MEMORY;
71 if (server_info->session_key.length) {
72 memcpy(info3->base.key.key,
73 server_info->session_key.data,
74 MIN(sizeof(info3->base.key.key),
75 server_info->session_key.length));
77 if (server_info->lm_session_key.length) {
78 memcpy(info3->base.LMSessKey.key,
79 server_info->lm_session_key.data,
80 MIN(sizeof(info3->base.LMSessKey.key),
81 server_info->lm_session_key.length));
84 sam2->base = info3->base;
89 /****************************************************************************
90 inits a netr_SamInfo3 structure from an auth_serversupplied_info. sam3 must
91 already be initialized and is used as the talloc parent for its members.
92 *****************************************************************************/
94 NTSTATUS serverinfo_to_SamInfo3(const struct auth_serversupplied_info *server_info,
95 struct netr_SamInfo3 *sam3)
97 struct netr_SamInfo3 *info3;
99 info3 = copy_netr_SamInfo3(sam3, server_info->info3);
101 return NT_STATUS_NO_MEMORY;
104 if (server_info->session_key.length) {
105 memcpy(info3->base.key.key,
106 server_info->session_key.data,
107 MIN(sizeof(info3->base.key.key),
108 server_info->session_key.length));
110 if (server_info->lm_session_key.length) {
111 memcpy(info3->base.LMSessKey.key,
112 server_info->lm_session_key.data,
113 MIN(sizeof(info3->base.LMSessKey.key),
114 server_info->lm_session_key.length));
117 sam3->base = info3->base;
125 /****************************************************************************
126 inits a netr_SamInfo6 structure from an auth_serversupplied_info. sam6 must
127 already be initialized and is used as the talloc parent for its members.
128 *****************************************************************************/
130 NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
131 struct netr_SamInfo6 *sam6)
133 struct pdb_domain_info *dominfo;
134 struct netr_SamInfo3 *info3;
136 if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
137 DEBUG(10,("Not adding validation info level 6 "
138 "without ADS passdb backend\n"));
139 return NT_STATUS_INVALID_INFO_CLASS;
142 dominfo = pdb_get_domain_info(sam6);
143 if (dominfo == NULL) {
144 return NT_STATUS_NO_MEMORY;
147 info3 = copy_netr_SamInfo3(sam6, server_info->info3);
149 return NT_STATUS_NO_MEMORY;
152 if (server_info->session_key.length) {
153 memcpy(info3->base.key.key,
154 server_info->session_key.data,
155 MIN(sizeof(info3->base.key.key),
156 server_info->session_key.length));
158 if (server_info->lm_session_key.length) {
159 memcpy(info3->base.LMSessKey.key,
160 server_info->lm_session_key.data,
161 MIN(sizeof(info3->base.LMSessKey.key),
162 server_info->lm_session_key.length));
165 sam6->base = info3->base;
170 sam6->dns_domainname.string = talloc_strdup(sam6, dominfo->dns_domain);
171 if (sam6->dns_domainname.string == NULL) {
172 return NT_STATUS_NO_MEMORY;
175 sam6->principle.string = talloc_asprintf(sam6, "%s@%s",
176 sam6->base.account_name.string,
177 sam6->dns_domainname.string);
178 if (sam6->principle.string == NULL) {
179 return NT_STATUS_NO_MEMORY;
185 static NTSTATUS append_netr_SidAttr(TALLOC_CTX *mem_ctx,
186 struct netr_SidAttr **sids,
188 const struct dom_sid2 *asid,
193 *sids = talloc_realloc(mem_ctx, *sids, struct netr_SidAttr, t + 1);
195 return NT_STATUS_NO_MEMORY;
197 (*sids)[t].sid = dom_sid_dup(*sids, asid);
198 if ((*sids)[t].sid == NULL) {
199 return NT_STATUS_NO_MEMORY;
201 (*sids)[t].attributes = attributes;
207 /* Fills the samr_RidWithAttributeArray with the provided sids.
208 * If it happens that we have additional groups that do not belong
209 * to the domain, add their sids as extra sids */
210 static NTSTATUS group_sids_to_info3(struct netr_SamInfo3 *info3,
211 const struct dom_sid *sids,
214 uint32_t attributes = SE_GROUP_MANDATORY |
215 SE_GROUP_ENABLED_BY_DEFAULT |
217 struct samr_RidWithAttributeArray *groups;
218 struct dom_sid *domain_sid;
224 domain_sid = info3->base.domain_sid;
225 groups = &info3->base.groups;
227 groups->rids = talloc_array(info3,
228 struct samr_RidWithAttribute, num_sids);
230 return NT_STATUS_NO_MEMORY;
233 for (i = 0; i < num_sids; i++) {
234 ok = sid_peek_check_rid(domain_sid, &sids[i], &rid);
236 /* store domain group rid */
237 groups->rids[groups->count].rid = rid;
238 groups->rids[groups->count].attributes = attributes;
243 /* if this wasn't a domain sid, add it as extra sid */
244 status = append_netr_SidAttr(info3, &info3->sids,
246 &sids[i], attributes);
247 if (!NT_STATUS_IS_OK(status)) {
256 * Merge resource SIDs, if any, into the passed in info3 structure.
259 static NTSTATUS merge_resource_sids(const struct PAC_LOGON_INFO *logon_info,
260 struct netr_SamInfo3 *info3)
264 if (!(logon_info->info3.base.user_flags & NETLOGON_RESOURCE_GROUPS)) {
269 * If there are any resource groups (SID Compression) add
270 * them to the extra sids portion of the info3 in the PAC.
272 * This makes the info3 look like it would if we got the info
273 * from the DC rather than the PAC.
277 * Construct a SID for each RID in the list and then append it
280 for (i = 0; i < logon_info->res_groups.count; i++) {
282 struct dom_sid new_sid;
283 uint32_t attributes = logon_info->res_groups.rids[i].attributes;
285 sid_compose(&new_sid,
286 logon_info->res_group_dom_sid,
287 logon_info->res_groups.rids[i].rid);
289 DEBUG(10, ("Adding SID %s to extra SIDS\n",
290 sid_string_dbg(&new_sid)));
292 status = append_netr_SidAttr(info3, &info3->sids,
296 if (!NT_STATUS_IS_OK(status)) {
297 DEBUG(1, ("failed to append SID %s to extra SIDS: %s\n",
298 sid_string_dbg(&new_sid),
308 * Create a copy of an info3 struct from the struct PAC_LOGON_INFO,
309 * then merge resource SIDs, if any, into it. If successful return
310 * the created info3 struct.
313 NTSTATUS create_info3_from_pac_logon_info(TALLOC_CTX *mem_ctx,
314 const struct PAC_LOGON_INFO *logon_info,
315 struct netr_SamInfo3 **pp_info3)
318 struct netr_SamInfo3 *info3 = copy_netr_SamInfo3(mem_ctx,
321 return NT_STATUS_NO_MEMORY;
323 status = merge_resource_sids(logon_info, info3);
324 if (!NT_STATUS_IS_OK(status)) {
332 #define RET_NOMEM(ptr) do { \
334 TALLOC_FREE(info3); \
335 return NT_STATUS_NO_MEMORY; \
338 NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
340 const char *login_server,
341 struct netr_SamInfo3 **_info3,
342 struct extra_auth_info *extra)
344 struct netr_SamInfo3 *info3;
345 const struct dom_sid *user_sid;
346 const struct dom_sid *group_sid;
347 struct dom_sid domain_sid;
348 struct dom_sid *group_sids;
349 uint32_t num_group_sids = 0;
355 user_sid = pdb_get_user_sid(samu);
356 group_sid = pdb_get_group_sid(samu);
358 if (!user_sid || !group_sid) {
359 DEBUG(1, ("Sam account is missing sids!\n"));
360 return NT_STATUS_UNSUCCESSFUL;
363 info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
365 return NT_STATUS_NO_MEMORY;
368 ZERO_STRUCT(domain_sid);
370 /* check if this is a "Unix Users" domain user,
371 * we need to handle it in a special way if that's the case */
372 if (sid_check_is_in_unix_users(user_sid)) {
373 /* in info3 you can only set rids for the user and the
374 * primary group, and the domain sid must be that of
377 * Store a completely bogus value here.
378 * The real SID is stored in the extra sids.
379 * Other code will know to look there if (-1) is found
381 info3->base.rid = (uint32_t)(-1);
382 sid_copy(&extra->user_sid, user_sid);
384 DEBUG(10, ("Unix User found in struct samu. Rid marked as "
385 "special and sid (%s) saved as extra sid\n",
386 sid_string_dbg(user_sid)));
388 sid_copy(&domain_sid, user_sid);
389 sid_split_rid(&domain_sid, &info3->base.rid);
392 if (is_null_sid(&domain_sid)) {
393 sid_copy(&domain_sid, get_global_sam_sid());
396 /* check if this is a "Unix Groups" domain group,
397 * if so we need special handling */
398 if (sid_check_is_in_unix_groups(group_sid)) {
399 /* in info3 you can only set rids for the user and the
400 * primary group, and the domain sid must be that of
403 * Store a completely bogus value here.
404 * The real SID is stored in the extra sids.
405 * Other code will know to look there if (-1) is found
407 info3->base.primary_gid = (uint32_t)(-1);
408 sid_copy(&extra->pgid_sid, group_sid);
410 DEBUG(10, ("Unix Group found in struct samu. Rid marked as "
411 "special and sid (%s) saved as extra sid\n",
412 sid_string_dbg(group_sid)));
415 ok = sid_peek_check_rid(&domain_sid, group_sid,
416 &info3->base.primary_gid);
418 DEBUG(1, ("The primary group domain sid(%s) does not "
419 "match the domain sid(%s) for %s(%s)\n",
420 sid_string_dbg(group_sid),
421 sid_string_dbg(&domain_sid),
422 pdb_get_username(samu),
423 sid_string_dbg(user_sid)));
425 return NT_STATUS_UNSUCCESSFUL;
429 unix_to_nt_time(&info3->base.logon_time, pdb_get_logon_time(samu));
430 unix_to_nt_time(&info3->base.logoff_time, get_time_t_max());
431 unix_to_nt_time(&info3->base.kickoff_time, get_time_t_max());
432 unix_to_nt_time(&info3->base.last_password_change,
433 pdb_get_pass_last_set_time(samu));
434 unix_to_nt_time(&info3->base.allow_password_change,
435 pdb_get_pass_can_change_time(samu));
436 unix_to_nt_time(&info3->base.force_password_change,
437 pdb_get_pass_must_change_time(samu));
439 tmp = pdb_get_username(samu);
441 info3->base.account_name.string = talloc_strdup(info3, tmp);
442 RET_NOMEM(info3->base.account_name.string);
444 tmp = pdb_get_fullname(samu);
446 info3->base.full_name.string = talloc_strdup(info3, tmp);
447 RET_NOMEM(info3->base.full_name.string);
449 tmp = pdb_get_logon_script(samu);
451 info3->base.logon_script.string = talloc_strdup(info3, tmp);
452 RET_NOMEM(info3->base.logon_script.string);
454 tmp = pdb_get_profile_path(samu);
456 info3->base.profile_path.string = talloc_strdup(info3, tmp);
457 RET_NOMEM(info3->base.profile_path.string);
459 tmp = pdb_get_homedir(samu);
461 info3->base.home_directory.string = talloc_strdup(info3, tmp);
462 RET_NOMEM(info3->base.home_directory.string);
464 tmp = pdb_get_dir_drive(samu);
466 info3->base.home_drive.string = talloc_strdup(info3, tmp);
467 RET_NOMEM(info3->base.home_drive.string);
470 info3->base.logon_count = pdb_get_logon_count(samu);
471 info3->base.bad_password_count = pdb_get_bad_password_count(samu);
473 info3->base.logon_domain.string = talloc_strdup(info3,
474 pdb_get_domain(samu));
475 RET_NOMEM(info3->base.logon_domain.string);
477 info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
478 RET_NOMEM(info3->base.domain_sid);
480 status = pdb_enum_group_memberships(mem_ctx, samu,
483 if (!NT_STATUS_IS_OK(status)) {
484 DEBUG(1, ("Failed to get groups from sam account.\n"));
489 if (num_group_sids) {
490 status = group_sids_to_info3(info3, group_sids, num_group_sids);
491 if (!NT_STATUS_IS_OK(status)) {
497 /* We don't need sids and gids after the conversion */
498 TALLOC_FREE(group_sids);
502 /* FIXME: should we add other flags ? */
503 info3->base.user_flags = NETLOGON_EXTRA_SIDS;
506 info3->base.logon_server.string = talloc_strdup(info3, login_server);
507 RET_NOMEM(info3->base.logon_server.string);
510 info3->base.acct_flags = pdb_get_acct_ctrl(samu);
518 #define RET_NOMEM(ptr) do { \
520 TALLOC_FREE(info3); \
524 struct netr_SamInfo3 *copy_netr_SamInfo3(TALLOC_CTX *mem_ctx,
525 const struct netr_SamInfo3 *orig)
527 struct netr_SamInfo3 *info3;
531 info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
532 if (!info3) return NULL;
534 status = copy_netr_SamBaseInfo(info3, &orig->base, &info3->base);
535 if (!NT_STATUS_IS_OK(status)) {
540 if (orig->sidcount) {
541 info3->sidcount = orig->sidcount;
542 info3->sids = talloc_array(info3, struct netr_SidAttr,
544 RET_NOMEM(info3->sids);
545 for (i = 0; i < orig->sidcount; i++) {
546 info3->sids[i].sid = dom_sid_dup(info3->sids,
548 RET_NOMEM(info3->sids[i].sid);
549 info3->sids[i].attributes =
550 orig->sids[i].attributes;
557 static NTSTATUS wbcsids_to_samr_RidWithAttributeArray(
559 struct samr_RidWithAttributeArray *groups,
560 const struct dom_sid *domain_sid,
561 const struct wbcSidWithAttr *sids,
564 unsigned int i, j = 0;
567 groups->rids = talloc_array(mem_ctx,
568 struct samr_RidWithAttribute, num_sids);
570 return NT_STATUS_NO_MEMORY;
573 /* a wbcDomainSid is the same as a dom_sid */
574 for (i = 0; i < num_sids; i++) {
575 ok = sid_peek_check_rid(domain_sid,
576 (const struct dom_sid *)&sids[i].sid,
577 &groups->rids[j].rid);
580 groups->rids[j].attributes = SE_GROUP_MANDATORY |
581 SE_GROUP_ENABLED_BY_DEFAULT |
590 static NTSTATUS wbcsids_to_netr_SidAttrArray(
591 const struct dom_sid *domain_sid,
592 const struct wbcSidWithAttr *sids,
595 struct netr_SidAttr **_info3_sids,
596 uint32_t *info3_num_sids)
598 unsigned int i, j = 0;
599 struct netr_SidAttr *info3_sids;
601 info3_sids = talloc_array(mem_ctx, struct netr_SidAttr, num_sids);
602 if (info3_sids == NULL) {
603 return NT_STATUS_NO_MEMORY;
606 /* a wbcDomainSid is the same as a dom_sid */
607 for (i = 0; i < num_sids; i++) {
608 const struct dom_sid *sid;
610 sid = (const struct dom_sid *)&sids[i].sid;
612 if (dom_sid_in_domain(domain_sid, sid)) {
616 info3_sids[j].sid = dom_sid_dup(info3_sids, sid);
617 if (info3_sids[j].sid == NULL) {
618 talloc_free(info3_sids);
619 return NT_STATUS_NO_MEMORY;
621 info3_sids[j].attributes = SE_GROUP_MANDATORY |
622 SE_GROUP_ENABLED_BY_DEFAULT |
628 *_info3_sids = info3_sids;
632 struct netr_SamInfo3 *wbcAuthUserInfo_to_netr_SamInfo3(TALLOC_CTX *mem_ctx,
633 const struct wbcAuthUserInfo *info)
635 struct netr_SamInfo3 *info3;
636 struct dom_sid user_sid;
637 struct dom_sid group_sid;
638 struct dom_sid domain_sid;
642 memcpy(&user_sid, &info->sids[0].sid, sizeof(user_sid));
643 memcpy(&group_sid, &info->sids[1].sid, sizeof(group_sid));
645 info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
646 if (!info3) return NULL;
648 unix_to_nt_time(&info3->base.logon_time, info->logon_time);
649 unix_to_nt_time(&info3->base.logoff_time, info->logoff_time);
650 unix_to_nt_time(&info3->base.kickoff_time, info->kickoff_time);
651 unix_to_nt_time(&info3->base.last_password_change, info->pass_last_set_time);
652 unix_to_nt_time(&info3->base.allow_password_change,
653 info->pass_can_change_time);
654 unix_to_nt_time(&info3->base.force_password_change,
655 info->pass_must_change_time);
657 if (info->account_name) {
658 info3->base.account_name.string =
659 talloc_strdup(info3, info->account_name);
660 RET_NOMEM(info3->base.account_name.string);
662 if (info->full_name) {
663 info3->base.full_name.string =
664 talloc_strdup(info3, info->full_name);
665 RET_NOMEM(info3->base.full_name.string);
667 if (info->logon_script) {
668 info3->base.logon_script.string =
669 talloc_strdup(info3, info->logon_script);
670 RET_NOMEM(info3->base.logon_script.string);
672 if (info->profile_path) {
673 info3->base.profile_path.string =
674 talloc_strdup(info3, info->profile_path);
675 RET_NOMEM(info3->base.profile_path.string);
677 if (info->home_directory) {
678 info3->base.home_directory.string =
679 talloc_strdup(info3, info->home_directory);
680 RET_NOMEM(info3->base.home_directory.string);
682 if (info->home_drive) {
683 info3->base.home_drive.string =
684 talloc_strdup(info3, info->home_drive);
685 RET_NOMEM(info3->base.home_drive.string);
688 info3->base.logon_count = info->logon_count;
689 info3->base.bad_password_count = info->bad_password_count;
691 sid_copy(&domain_sid, &user_sid);
692 sid_split_rid(&domain_sid, &info3->base.rid);
694 ok = sid_peek_check_rid(&domain_sid, &group_sid,
695 &info3->base.primary_gid);
697 DEBUG(1, ("The primary group sid domain does not"
698 "match user sid domain for user: %s\n",
699 info->account_name));
704 status = wbcsids_to_samr_RidWithAttributeArray(info3,
709 if (!NT_STATUS_IS_OK(status)) {
714 status = wbcsids_to_netr_SidAttrArray(&domain_sid,
720 if (!NT_STATUS_IS_OK(status)) {
725 info3->base.user_flags = info->user_flags;
726 memcpy(info3->base.key.key, info->user_session_key, 16);
728 if (info->logon_server) {
729 info3->base.logon_server.string =
730 talloc_strdup(info3, info->logon_server);
731 RET_NOMEM(info3->base.logon_server.string);
733 if (info->domain_name) {
734 info3->base.logon_domain.string =
735 talloc_strdup(info3, info->domain_name);
736 RET_NOMEM(info3->base.logon_domain.string);
739 info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
740 RET_NOMEM(info3->base.domain_sid);
742 memcpy(info3->base.LMSessKey.key, info->lm_session_key, 8);
743 info3->base.acct_flags = info->acct_flags;