source3/auth/auth_generic.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 3.0
   4    handle GENSEC authentication, server side
   5
   6    Copyright (C) Andrew Tridgell      2001
   7    Copyright (C) Andrew Bartlett 2001-2003,2011
   8    Copyright (C) Simo Sorce 2010.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "auth.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "auth/gensec/gensec.h"
  28 #include "lib/param/param.h"
  29 #ifdef HAVE_KRB5
  30 #include "auth/kerberos/pac_utils.h"
  31 #include "nsswitch/libwbclient/wbclient.h"
  32 #endif
  33 #include "librpc/crypto/gse.h"
  34 #include "auth/credentials/credentials.h"
  35 #include "lib/param/loadparm.h"
  36 #include "librpc/gen_ndr/dcerpc.h"
  37
  38 static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx,
  39                                                 TALLOC_CTX *mem_ctx,
  40                                                 struct smb_krb5_context *smb_krb5_context,
  41                                                 DATA_BLOB *pac_blob,
  42                                                 const char *princ_name,
  43                                                 const struct tsocket_address *remote_address,
  44                                                 uint32_t session_info_flags,
  45                                                 struct auth_session_info **session_info)
  46 {
  47         TALLOC_CTX *tmp_ctx;
  48         struct PAC_LOGON_INFO *logon_info = NULL;
  49         struct netr_SamInfo3 *info3_copy = NULL;
  50         bool is_mapped;
  51         bool is_guest;
  52         char *ntuser;
  53         char *ntdomain;
  54         char *username;
  55         char *rhost;
  56         struct passwd *pw;
  57         NTSTATUS status;
  58         int rc;
  59
  60         tmp_ctx = talloc_new(mem_ctx);
  61         if (!tmp_ctx) {
  62                 return NT_STATUS_NO_MEMORY;
  63         }
  64
  65         if (pac_blob) {
  66 #ifdef HAVE_KRB5
  67                 struct wbcAuthUserParams params = {};
  68                 struct wbcAuthUserInfo *info = NULL;
  69                 struct wbcAuthErrorInfo *err = NULL;
  70                 wbcErr wbc_err;
  71
  72                 /*
  73                  * Let winbind decode the PAC.
  74                  * This will also store the user
  75                  * data in the netsamlogon cache.
  76                  *
  77                  * We need to do this *before* we
  78                  * call get_user_from_kerberos_info()
  79                  * as that does a user lookup that
  80                  * expects info in the netsamlogon cache.
  81                  *
  82                  * See BUG: https://bugzilla.samba.org/show_bug.cgi?id=11259
  83                  */
  84                 params.level = WBC_AUTH_USER_LEVEL_PAC;
  85                 params.password.pac.data = pac_blob->data;
  86                 params.password.pac.length = pac_blob->length;
  87
  88                 become_root();
  89                 wbc_err = wbcAuthenticateUserEx(&params, &info, &err);
  90                 unbecome_root();
  91
  92                 /*
  93                  * As this is merely a cache prime
  94                  * WBC_ERR_WINBIND_NOT_AVAILABLE
  95                  * is not a fatal error, treat it
  96                  * as success.
  97                  */
  98
  99                 switch (wbc_err) {
 100                         case WBC_ERR_WINBIND_NOT_AVAILABLE:
 101                         case WBC_ERR_SUCCESS:
 102                                 break;
 103                         case WBC_ERR_AUTH_ERROR:
 104                                 status = NT_STATUS(err->nt_status);
 105                                 wbcFreeMemory(err);
 106                                 goto done;
 107                         default:
 108                                 status = NT_STATUS_LOGON_FAILURE;
 109                                 goto done;
 110                 }
 111
 112                 status = kerberos_pac_logon_info(tmp_ctx, *pac_blob, NULL, NULL,
 113                                                  NULL, NULL, 0, &logon_info);
 114 #else
 115                 status = NT_STATUS_ACCESS_DENIED;
 116 #endif
 117                 if (!NT_STATUS_IS_OK(status)) {
 118                         goto done;
 119                 }
 120         }
 121
 122         rc = get_remote_hostname(remote_address,
 123                                  &rhost,
 124                                  tmp_ctx);
 125         if (rc < 0) {
 126                 status = NT_STATUS_NO_MEMORY;
 127                 goto done;
 128         }
 129         if (strequal(rhost, "UNKNOWN")) {
 130                 rhost = tsocket_address_inet_addr_string(remote_address,
 131                                                          tmp_ctx);
 132                 if (rhost == NULL) {
 133                         status = NT_STATUS_NO_MEMORY;
 134                         goto done;
 135                 }
 136         }
 137
 138         status = get_user_from_kerberos_info(tmp_ctx, rhost,
 139                                              princ_name, logon_info,
 140                                              &is_mapped, &is_guest,
 141                                              &ntuser, &ntdomain,
 142                                              &username, &pw);
 143         if (!NT_STATUS_IS_OK(status)) {
 144                 DBG_NOTICE("Failed to map kerberos principal to system user "
 145                           "(%s)\n", nt_errstr(status));
 146                 status = NT_STATUS_ACCESS_DENIED;
 147                 goto done;
 148         }
 149
 150         /* Get the info3 from the PAC data if we have it */
 151         if (logon_info) {
 152                 status = create_info3_from_pac_logon_info(tmp_ctx,
 153                                         logon_info,
 154                                         &info3_copy);
 155                 if (!NT_STATUS_IS_OK(status)) {
 156                         goto done;
 157                 }
 158         }
 159
 160         /* setup the string used by %U */
 161         sub_set_smb_name(username);
 162
 163         /* reload services so that the new %U is taken into account */
 164         lp_load_with_shares(get_dyn_CONFIGFILE());
 165
 166         status = make_session_info_krb5(mem_ctx,
 167                                         ntuser, ntdomain, username, pw,
 168                                         info3_copy, is_guest, is_mapped, NULL /* No session key for now, caller will sort it out */,
 169                                         session_info);
 170         if (!NT_STATUS_IS_OK(status)) {
 171                 DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
 172                           nt_errstr(status)));
 173                 status = NT_STATUS_ACCESS_DENIED;
 174                 goto done;
 175         }
 176
 177         DEBUG(5, (__location__ "OK: user: %s domain: %s client: %s\n",
 178                   ntuser, ntdomain, rhost));
 179
 180         status = NT_STATUS_OK;
 181
 182 done:
 183         TALLOC_FREE(tmp_ctx);
 184         return status;
 185 }
 186
 187 static struct auth4_context *make_auth4_context_s3(TALLOC_CTX *mem_ctx, struct auth_context *auth_context)
 188 {
 189         struct auth4_context *auth4_context = talloc_zero(mem_ctx, struct auth4_context);
 190         if (auth4_context == NULL) {
 191                 DEBUG(10, ("failed to allocate auth4_context failed\n"));
 192                 return NULL;
 193         }
 194         auth4_context->generate_session_info_pac = auth3_generate_session_info_pac;
 195         auth4_context->generate_session_info = auth3_generate_session_info;
 196         auth4_context->get_ntlm_challenge = auth3_get_challenge;
 197         auth4_context->set_ntlm_challenge = auth3_set_challenge;
 198         auth4_context->check_ntlm_password = auth3_check_password;
 199         auth4_context->private_data = talloc_steal(auth4_context, auth_context);
 200         return auth4_context;
 201 }
 202
 203 NTSTATUS make_auth4_context(TALLOC_CTX *mem_ctx, struct auth4_context **auth4_context_out)
 204 {
 205         struct auth_context *auth_context;
 206         NTSTATUS nt_status;
 207
 208         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 209         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 210
 211         nt_status = make_auth_context_subsystem(tmp_ctx, &auth_context);
 212         if (!NT_STATUS_IS_OK(nt_status)) {
 213                 TALLOC_FREE(tmp_ctx);
 214                 return nt_status;
 215         }
 216
 217         if (auth_context->make_auth4_context) {
 218                 nt_status = auth_context->make_auth4_context(auth_context, mem_ctx, auth4_context_out);
 219                 TALLOC_FREE(tmp_ctx);
 220                 return nt_status;
 221
 222         } else {
 223                 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
 224                 if (auth4_context == NULL) {
 225                         TALLOC_FREE(tmp_ctx);
 226                         return NT_STATUS_NO_MEMORY;
 227                 }
 228                 *auth4_context_out = talloc_steal(mem_ctx, auth4_context);
 229                 TALLOC_FREE(tmp_ctx);
 230                 return NT_STATUS_OK;
 231         }
 232 }
 233
 234 NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
 235                               const struct tsocket_address *remote_address,
 236                               struct gensec_security **gensec_security_out)
 237 {
 238         struct gensec_security *gensec_security;
 239         struct auth_context *auth_context;
 240         NTSTATUS nt_status;
 241
 242         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 243         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 244
 245         nt_status = make_auth_context_subsystem(tmp_ctx, &auth_context);
 246         if (!NT_STATUS_IS_OK(nt_status)) {
 247                 TALLOC_FREE(tmp_ctx);
 248                 return nt_status;
 249         }
 250
 251         if (auth_context->prepare_gensec) {
 252                 nt_status = auth_context->prepare_gensec(auth_context, tmp_ctx,
 253                                                          &gensec_security);
 254                 if (!NT_STATUS_IS_OK(nt_status)) {
 255                         TALLOC_FREE(tmp_ctx);
 256                         return nt_status;
 257                 }
 258         } else {
 259                 const struct gensec_security_ops **backends = NULL;
 260                 struct gensec_settings *gensec_settings;
 261                 struct loadparm_context *lp_ctx;
 262                 size_t idx = 0;
 263                 struct cli_credentials *server_credentials;
 264                 const char *dns_name;
 265                 const char *dns_domain;
 266                 struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
 267                 if (auth4_context == NULL) {
 268                         TALLOC_FREE(tmp_ctx);
 269                         return NT_STATUS_NO_MEMORY;
 270                 }
 271
 272                 lp_ctx = loadparm_init_s3(tmp_ctx, loadparm_s3_helpers());
 273                 if (lp_ctx == NULL) {
 274                         DEBUG(10, ("loadparm_init_s3 failed\n"));
 275                         TALLOC_FREE(tmp_ctx);
 276                         return NT_STATUS_INVALID_SERVER_STATE;
 277                 }
 278
 279                 gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
 280                 if (lp_ctx == NULL) {
 281                         DEBUG(10, ("lpcfg_gensec_settings failed\n"));
 282                         TALLOC_FREE(tmp_ctx);
 283                         return NT_STATUS_NO_MEMORY;
 284                 }
 285
 286                 /*
 287                  * This should be a 'netbios domain -> DNS domain'
 288                  * mapping, and can currently validly return NULL on
 289                  * poorly configured systems.
 290                  *
 291                  * This is used for the NTLMSSP server
 292                  *
 293                  */
 294                 dns_name = get_mydnsfullname();
 295                 if (dns_name == NULL) {
 296                         dns_name = "";
 297                 }
 298
 299                 dns_domain = get_mydnsdomname(tmp_ctx);
 300                 if (dns_domain == NULL) {
 301                         dns_domain = "";
 302                 }
 303
 304                 gensec_settings->server_dns_name = strlower_talloc(gensec_settings, dns_name);
 305                 if (gensec_settings->server_dns_name == NULL) {
 306                         TALLOC_FREE(tmp_ctx);
 307                         return NT_STATUS_NO_MEMORY;
 308                 }
 309
 310                 gensec_settings->server_dns_domain = strlower_talloc(gensec_settings, dns_domain);
 311                 if (gensec_settings->server_dns_domain == NULL) {
 312                         TALLOC_FREE(tmp_ctx);
 313                         return NT_STATUS_NO_MEMORY;
 314                 }
 315
 316                 backends = talloc_zero_array(gensec_settings,
 317                                              const struct gensec_security_ops *, 6);
 318                 if (backends == NULL) {
 319                         TALLOC_FREE(tmp_ctx);
 320                         return NT_STATUS_NO_MEMORY;
 321                 }
 322                 gensec_settings->backends = backends;
 323
 324                 gensec_init();
 325
 326                 /* These need to be in priority order, krb5 before NTLMSSP */
 327 #if defined(HAVE_KRB5)
 328                 backends[idx++] = &gensec_gse_krb5_security_ops;
 329 #endif
 330
 331                 backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
 332
 333                 backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO);
 334
 335                 backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_SCHANNEL);
 336
 337                 backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM);
 338
 339                 /*
 340                  * This is anonymous for now, because we just use it
 341                  * to set the kerberos state at the moment
 342                  */
 343                 server_credentials = cli_credentials_init_anon(tmp_ctx);
 344                 if (!server_credentials) {
 345                         DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
 346                         return NT_STATUS_NO_MEMORY;
 347                 }
 348
 349                 cli_credentials_set_conf(server_credentials, lp_ctx);
 350
 351                 if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
 352                         cli_credentials_set_kerberos_state(server_credentials, CRED_AUTO_USE_KERBEROS);
 353                 } else {
 354                         cli_credentials_set_kerberos_state(server_credentials, CRED_DONT_USE_KERBEROS);
 355                 }
 356
 357                 nt_status = gensec_server_start(tmp_ctx, gensec_settings,
 358                                                 auth4_context, &gensec_security);
 359
 360                 if (!NT_STATUS_IS_OK(nt_status)) {
 361                         TALLOC_FREE(tmp_ctx);
 362                         return nt_status;
 363                 }
 364
 365                 gensec_set_credentials(gensec_security, server_credentials);
 366
 367                 talloc_unlink(tmp_ctx, lp_ctx);
 368                 talloc_unlink(tmp_ctx, server_credentials);
 369                 talloc_unlink(tmp_ctx, gensec_settings);
 370                 talloc_unlink(tmp_ctx, auth4_context);
 371         }
 372
 373         nt_status = gensec_set_remote_address(gensec_security,
 374                                               remote_address);
 375         if (!NT_STATUS_IS_OK(nt_status)) {
 376                 TALLOC_FREE(tmp_ctx);
 377                 return nt_status;
 378         }
 379
 380         *gensec_security_out = talloc_steal(mem_ctx, gensec_security);
 381         TALLOC_FREE(tmp_ctx);
 382         return NT_STATUS_OK;
 383 }
 384
 385 NTSTATUS auth_check_password_session_info(struct auth4_context *auth_context,
 386                                           TALLOC_CTX *mem_ctx,
 387                                           struct auth_usersupplied_info *user_info,
 388                                           struct auth_session_info **session_info)
 389 {
 390         NTSTATUS nt_status;
 391         void *server_info;
 392
 393         nt_status = auth_context->check_ntlm_password(auth_context,
 394                                                       talloc_tos(),
 395                                                       user_info,
 396                                                       &server_info, NULL, NULL);
 397
 398         if (NT_STATUS_IS_OK(nt_status)) {
 399                 nt_status = auth_context->generate_session_info(auth_context,
 400                                                                 mem_ctx,
 401                                                                 server_info,
 402                                                                 user_info->client.account_name,
 403                                                                 AUTH_SESSION_INFO_UNIX_TOKEN |
 404                                                                 AUTH_SESSION_INFO_DEFAULT_GROUPS,
 405                                                                 session_info);
 406                 TALLOC_FREE(server_info);
 407         }
 408         return nt_status;
 409 }