source3/auth/auth_generic.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle GENSEC authentication, server side
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett 2001-2003,2011
   8    Copyright (C) Simo Sorce 2010.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "auth/gensec/gensec.h"
  28 #include "lib/param/param.h"
  29 #ifdef HAVE_KRB5
  30 #include "auth/kerberos/pac_utils.h"
  31 #endif
  32 #include "librpc/crypto/gse.h"
  33 #include "auth/credentials/credentials.h"
  34 #include "lib/param/loadparm.h"
  35 #include "librpc/gen_ndr/dcerpc.h"
  36
  37 static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx,
  38                                                 TALLOC_CTX *mem_ctx,
  39                                                 struct smb_krb5_context *smb_krb5_context,
  40                                                 DATA_BLOB *pac_blob,
  41                                                 const char *princ_name,
  42                                                 const struct tsocket_address *remote_address,
  43                                                 uint32_t session_info_flags,
  44                                                 struct auth_session_info **session_info)
  45 {
  46         TALLOC_CTX *tmp_ctx;
  47         struct PAC_LOGON_INFO *logon_info = NULL;
  48         struct netr_SamInfo3 *info3_copy = NULL;
  49         bool is_mapped;
  50         bool is_guest;
  51         char *ntuser;
  52         char *ntdomain;
  53         char *username;
  54         char *rhost;
  55         struct passwd *pw;
  56         NTSTATUS status;
  57         int rc;
  58
  59         tmp_ctx = talloc_new(mem_ctx);
  60         if (!tmp_ctx) {
  61                 return NT_STATUS_NO_MEMORY;
  62         }
  63
  64         if (pac_blob) {
  65 #ifdef HAVE_KRB5
  66                 status = kerberos_pac_logon_info(tmp_ctx, *pac_blob, NULL, NULL,
  67                                                  NULL, NULL, 0, &logon_info);
  68 #else
  69                 status = NT_STATUS_ACCESS_DENIED;
  70 #endif
  71                 if (!NT_STATUS_IS_OK(status)) {
  72                         goto done;
  73                 }
  74         }
  75
  76         rc = get_remote_hostname(remote_address,
  77                                  &rhost,
  78                                  tmp_ctx);
  79         if (rc < 0) {
  80                 status = NT_STATUS_NO_MEMORY;
  81                 goto done;
  82         }
  83         if (strequal(rhost, "UNKNOWN")) {
  84                 rhost = tsocket_address_inet_addr_string(remote_address,
  85                                                          tmp_ctx);
  86                 if (rhost == NULL) {
  87                         status = NT_STATUS_NO_MEMORY;
  88                         goto done;
  89                 }
  90         }
  91
  92         status = get_user_from_kerberos_info(tmp_ctx, rhost,
  93                                              princ_name, logon_info,
  94                                              &is_mapped, &is_guest,
  95                                              &ntuser, &ntdomain,
  96                                              &username, &pw);
  97         if (!NT_STATUS_IS_OK(status)) {
  98                 DBG_NOTICE("Failed to map kerberos principal to system user "
  99                           "(%s)\n", nt_errstr(status));
 100                 status = NT_STATUS_ACCESS_DENIED;
 101                 goto done;
 102         }
 103
 104         /* save the PAC data if we have it */
 105         if (logon_info) {
 106                 status = create_info3_from_pac_logon_info(tmp_ctx,
 107                                         logon_info,
 108                                         &info3_copy);
 109                 if (!NT_STATUS_IS_OK(status)) {
 110                         goto done;
 111                 }
 112                 netsamlogon_cache_store(ntuser, info3_copy);
 113         }
 114
 115         /* setup the string used by %U */
 116         sub_set_smb_name(username);
 117
 118         /* reload services so that the new %U is taken into account */
 119         lp_load_with_shares(get_dyn_CONFIGFILE());
 120
 121         status = make_session_info_krb5(mem_ctx,
 122                                         ntuser, ntdomain, username, pw,
 123                                         info3_copy, is_guest, is_mapped, NULL /* No session key for now, caller will sort it out */,
 124                                         session_info);
 125         if (!NT_STATUS_IS_OK(status)) {
 126                 DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
 127                           nt_errstr(status)));
 128                 status = NT_STATUS_ACCESS_DENIED;
 129                 goto done;
 130         }
 131
 132         DEBUG(5, (__location__ "OK: user: %s domain: %s client: %s\n",
 133                   ntuser, ntdomain, rhost));
 134
 135         status = NT_STATUS_OK;
 136
 137 done:
 138         TALLOC_FREE(tmp_ctx);
 139         return status;
 140 }
 141
 142 static struct auth4_context *make_auth4_context_s3(TALLOC_CTX *mem_ctx, struct auth_context *auth_context)
 143 {
 144         struct auth4_context *auth4_context = talloc_zero(mem_ctx, struct auth4_context);
 145         if (auth4_context == NULL) {
 146                 DEBUG(10, ("failed to allocate auth4_context failed\n"));
 147                 return NULL;
 148         }
 149         auth4_context->generate_session_info_pac = auth3_generate_session_info_pac;
 150         auth4_context->generate_session_info = auth3_generate_session_info;
 151         auth4_context->get_ntlm_challenge = auth3_get_challenge;
 152         auth4_context->set_ntlm_challenge = auth3_set_challenge;
 153         auth4_context->check_ntlm_password = auth3_check_password;
 154         auth4_context->private_data = talloc_steal(auth4_context, auth_context);
 155         return auth4_context;
 156 }
 157
 158 NTSTATUS make_auth4_context(TALLOC_CTX *mem_ctx, struct auth4_context **auth4_context_out)
 159 {
 160         struct auth_context *auth_context;
 161         NTSTATUS nt_status;
 162
 163         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 164         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 165
 166         nt_status = make_auth_context_subsystem(tmp_ctx, &auth_context);
 167         if (!NT_STATUS_IS_OK(nt_status)) {
 168                 TALLOC_FREE(tmp_ctx);
 169                 return nt_status;
 170         }
 171
 172         if (auth_context->make_auth4_context) {
 173                 nt_status = auth_context->make_auth4_context(auth_context, mem_ctx, auth4_context_out);
 174                 TALLOC_FREE(tmp_ctx);
 175                 return nt_status;
 176
 177         } else {
 178                 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
 179                 if (auth4_context == NULL) {
 180                         TALLOC_FREE(tmp_ctx);
 181                         return NT_STATUS_NO_MEMORY;
 182                 }
 183                 *auth4_context_out = talloc_steal(mem_ctx, auth4_context);
 184                 TALLOC_FREE(tmp_ctx);
 185                 return NT_STATUS_OK;
 186         }
 187 }
 188
 189 NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
 190                               const struct tsocket_address *remote_address,
 191                               struct gensec_security **gensec_security_out)
 192 {
 193         struct gensec_security *gensec_security;
 194         struct auth_context *auth_context;
 195         NTSTATUS nt_status;
 196
 197         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 198         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 199
 200         nt_status = make_auth_context_subsystem(tmp_ctx, &auth_context);
 201         if (!NT_STATUS_IS_OK(nt_status)) {
 202                 TALLOC_FREE(tmp_ctx);
 203                 return nt_status;
 204         }
 205
 206         if (auth_context->prepare_gensec) {
 207                 nt_status = auth_context->prepare_gensec(auth_context, tmp_ctx,
 208                                                          &gensec_security);
 209                 if (!NT_STATUS_IS_OK(nt_status)) {
 210                         TALLOC_FREE(tmp_ctx);
 211                         return nt_status;
 212                 }
 213         } else {
 214                 const struct gensec_security_ops **backends = NULL;
 215                 struct gensec_settings *gensec_settings;
 216                 struct loadparm_context *lp_ctx;
 217                 size_t idx = 0;
 218                 struct cli_credentials *server_credentials;
 219                 const char *dns_name;
 220                 const char *dns_domain;
 221                 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
 222                 if (auth4_context == NULL) {
 223                         TALLOC_FREE(tmp_ctx);
 224                         return NT_STATUS_NO_MEMORY;
 225                 }
 226
 227                 lp_ctx = loadparm_init_s3(tmp_ctx, loadparm_s3_helpers());
 228                 if (lp_ctx == NULL) {
 229                         DEBUG(10, ("loadparm_init_s3 failed\n"));
 230                         TALLOC_FREE(tmp_ctx);
 231                         return NT_STATUS_INVALID_SERVER_STATE;
 232                 }
 233
 234                 gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
 235                 if (lp_ctx == NULL) {
 236                         DEBUG(10, ("lpcfg_gensec_settings failed\n"));
 237                         TALLOC_FREE(tmp_ctx);
 238                         return NT_STATUS_NO_MEMORY;
 239                 }
 240
 241                 /*
 242                  * This should be a 'netbios domain -> DNS domain'
 243                  * mapping, and can currently validly return NULL on
 244                  * poorly configured systems.
 245                  *
 246                  * This is used for the NTLMSSP server
 247                  *
 248                  */
 249                 dns_name = get_mydnsfullname();
 250                 if (dns_name == NULL) {
 251                         dns_name = "";
 252                 }
 253
 254                 dns_domain = get_mydnsdomname(tmp_ctx);
 255                 if (dns_domain == NULL) {
 256                         dns_domain = "";
 257                 }
 258
 259                 gensec_settings->server_dns_name = strlower_talloc(gensec_settings, dns_name);
 260                 if (gensec_settings->server_dns_name == NULL) {
 261                         TALLOC_FREE(tmp_ctx);
 262                         return NT_STATUS_NO_MEMORY;
 263                 }
 264
 265                 gensec_settings->server_dns_domain = strlower_talloc(gensec_settings, dns_domain);
 266                 if (gensec_settings->server_dns_domain == NULL) {
 267                         TALLOC_FREE(tmp_ctx);
 268                         return NT_STATUS_NO_MEMORY;
 269                 }
 270
 271                 backends = talloc_zero_array(gensec_settings,
 272                                              const struct gensec_security_ops *, 6);
 273                 if (backends == NULL) {
 274                         TALLOC_FREE(tmp_ctx);
 275                         return NT_STATUS_NO_MEMORY;
 276                 }
 277                 gensec_settings->backends = backends;
 278
 279                 gensec_init();
 280
 281                 /* These need to be in priority order, krb5 before NTLMSSP */
 282 #if defined(HAVE_KRB5)
 283                 backends[idx++] = &gensec_gse_krb5_security_ops;
 284 #endif
 285
 286                 backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
 287
 288                 backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO);
 289
 290                 backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_SCHANNEL);
 291
 292                 backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM);
 293
 294                 /*
 295                  * This is anonymous for now, because we just use it
 296                  * to set the kerberos state at the moment
 297                  */
 298                 server_credentials = cli_credentials_init_anon(tmp_ctx);
 299                 if (!server_credentials) {
 300                         DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
 301                         return NT_STATUS_NO_MEMORY;
 302                 }
 303
 304                 cli_credentials_set_conf(server_credentials, lp_ctx);
 305
 306                 if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
 307                         cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS);
 308                 } else {
 309                         cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS);
 310                 }
 311
 312                 nt_status = gensec_server_start(tmp_ctx, gensec_settings,
 313                                                 auth4_context, &gensec_security);
 314
 315                 if (!NT_STATUS_IS_OK(nt_status)) {
 316                         TALLOC_FREE(tmp_ctx);
 317                         return nt_status;
 318                 }
 319
 320                 gensec_set_credentials(gensec_security, server_credentials);
 321
 322                 talloc_unlink(tmp_ctx, lp_ctx);
 323                 talloc_unlink(tmp_ctx, server_credentials);
 324                 talloc_unlink(tmp_ctx, gensec_settings);
 325                 talloc_unlink(tmp_ctx, auth4_context);
 326         }
 327
 328         nt_status = gensec_set_remote_address(gensec_security,
 329                                               remote_address);
 330         if (!NT_STATUS_IS_OK(nt_status)) {
 331                 TALLOC_FREE(tmp_ctx);
 332                 return nt_status;
 333         }
 334
 335         *gensec_security_out = talloc_steal(mem_ctx, gensec_security);
 336         TALLOC_FREE(tmp_ctx);
 337         return NT_STATUS_OK;
 338 }
 339
 340 NTSTATUS auth_check_password_session_info(struct auth4_context *auth_context,
 341                                           TALLOC_CTX *mem_ctx,
 342                                           struct auth_usersupplied_info *user_info,
 343                                           struct auth_session_info **session_info)
 344 {
 345         NTSTATUS nt_status;
 346         void *server_info;
 347
 348         nt_status = auth_context->check_ntlm_password(auth_context,
 349                                                       talloc_tos(),
 350                                                       user_info,
 351                                                       &server_info, NULL, NULL);
 352
 353         if (NT_STATUS_IS_OK(nt_status)) {
 354                 nt_status = auth_context->generate_session_info(auth_context,
 355                                                                 mem_ctx,
 356                                                                 server_info,
 357                                                                 user_info->client.account_name,
 358                                                                 AUTH_SESSION_INFO_UNIX_TOKEN |
 359                                                                 AUTH_SESSION_INFO_DEFAULT_GROUPS,
 360                                                                 session_info);
 361                 TALLOC_FREE(server_info);
 362         }
 363         return nt_status;
 364 }