sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

s3:auth: remove unused auth_server.c

Browse Source 
metze
This commit is contained in:
Stefan Metzmacher 2012-05-12 12:01:03 +02:00
parent 0239f680a7
commit 413e1be773
6 changed files with 1 additions and 508 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
source3/Makefile.in
View File

@ -906,7 +906,6 @@ DCUTIL_OBJ = libsmb/namequery_dc.o libsmb/trustdom_cache.o libsmb/trusts_util.o
AUTH_BUILTIN_OBJ = auth/auth_builtin.o
AUTH_DOMAIN_OBJ = auth/auth_domain.o
AUTH_SAM_OBJ = auth/auth_sam.o auth/check_samsec.o
AUTH_SERVER_OBJ = auth/auth_server.o
AUTH_UNIX_OBJ = auth/auth_unix.o
AUTH_WINBIND_OBJ = auth/auth_winbind.o
AUTH_WBC_OBJ = auth/auth_wbc.o
@ -2859,10 +2858,6 @@ bin/netlogond.@SHLIBEXT@: $(BINARY_PREREQS) $(AUTH_NETLOGOND_OBJ)
@echo "Building plugin $@"
@$(SHLD_MODULE) $(AUTH_NETLOGOND_OBJ)
bin/smbserver.@SHLIBEXT@: $(BINARY_PREREQS) $(AUTH_SERVER_OBJ)
@echo "Building plugin $@"
@$(SHLD_MODULE) $(AUTH_SERVER_OBJ)
bin/winbind.@SHLIBEXT@: $(BINARY_PREREQS) $(AUTH_WINBIND_OBJ)
@echo "Building plugin $@"
@$(SHLD_MODULE) $(AUTH_WINBIND_OBJ)

487
source3/auth/auth_server.c
View File

@ -1,487 +0,0 @@
/*
Unix SMB/CIFS implementation.
Authenticate to a remote server
Copyright (C) Andrew Tridgell 1992-1998
Copyright (C) Andrew Bartlett 2001
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "auth.h"
#include "system/passwd.h"
#include "smbd/smbd.h"
#include "libsmb/libsmb.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
extern userdom_struct current_user_info;
/****************************************************************************
Support for server level security.
****************************************************************************/
static struct cli_state *server_cryptkey(TALLOC_CTX *mem_ctx)
{
struct cli_state *cli = NULL;
char *desthost = NULL;
struct sockaddr_storage dest_ss;
const char *p;
char *pserver = NULL;
bool connected_ok = False;
struct named_mutex *mutex = NULL;
NTSTATUS status;
/* security = server just can't function with spnego */
int flags = CLI_FULL_CONNECTION_DONT_SPNEGO;
uint16_t sec_mode = 0;
pserver = talloc_strdup(mem_ctx, lp_passwordserver());
p = pserver;
while(next_token_talloc(mem_ctx, &p, &desthost, LIST_SEP)) {
desthost = talloc_sub_basic(mem_ctx,
current_user_info.smb_name,
current_user_info.domain,
desthost);
if (!desthost) {
return NULL;
}
strupper_m(desthost);
if (strequal(desthost, myhostname())) {
DEBUG(1,("Password server loop - disabling "
"password server %s\n", desthost));
continue;
}
if(!resolve_name( desthost, &dest_ss, 0x20, false)) {
DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost));
continue;
}
if (ismyaddr((struct sockaddr *)(void *)&dest_ss)) {
DEBUG(1,("Password server loop - disabling password server %s\n",desthost));
continue;
}
/* we use a mutex to prevent two connections at once - when a
Win2k PDC get two connections where one hasn't completed a
session setup yet it will send a TCP reset to the first
connection (tridge) */
mutex = grab_named_mutex(talloc_tos(), desthost, 10);
if (mutex == NULL) {
return NULL;
}
status = cli_connect_nb(desthost, &dest_ss, 0, 0x20,
lp_netbios_name(), SMB_SIGNING_DEFAULT,
flags, &cli);
if (NT_STATUS_IS_OK(status)) {
DEBUG(3,("connected to password server %s\n",desthost));
connected_ok = True;
break;
}
DEBUG(10,("server_cryptkey: failed to connect to server %s. Error %s\n",
desthost, nt_errstr(status) ));
TALLOC_FREE(mutex);
}
if (!connected_ok) {
DEBUG(0,("password server not available\n"));
return NULL;
}
DEBUG(3,("got session\n"));
status = cli_negprot(cli, PROTOCOL_NT1);
if (!NT_STATUS_IS_OK(status)) {
TALLOC_FREE(mutex);
DEBUG(1, ("%s rejected the negprot: %s\n",
desthost, nt_errstr(status)));
cli_shutdown(cli);
return NULL;
}
sec_mode = cli_state_security_mode(cli);
if (cli_state_protocol(cli) < PROTOCOL_LANMAN2 ||
!(sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
TALLOC_FREE(mutex);
DEBUG(1,("%s isn't in user level security mode\n",desthost));
cli_shutdown(cli);
return NULL;
}
/* Get the first session setup done quickly, to avoid silly
Win2k bugs. (The next connection to the server will kill
this one...
*/
status = cli_session_setup(cli, "", "", 0, "", 0, "");
if (!NT_STATUS_IS_OK(status)) {
TALLOC_FREE(mutex);
DEBUG(0,("%s rejected the initial session setup (%s)\n",
desthost, nt_errstr(status)));
cli_shutdown(cli);
return NULL;
}
TALLOC_FREE(mutex);
DEBUG(3,("password server OK\n"));
return cli;
}
struct server_security_state {
struct cli_state *cli;
};
/****************************************************************************
Send a 'keepalive' packet down the cli pipe.
****************************************************************************/
static bool send_server_keepalive(const struct timeval *now,
void *private_data)
{
struct server_security_state *state = talloc_get_type_abort(
private_data, struct server_security_state);
NTSTATUS status;
unsigned char garbage[16];
if (!cli_state_is_connected(state->cli)) {
return false;
}
/* Ping the server to keep the connection alive using SMBecho. */
memset(garbage, 0xf0, sizeof(garbage));
status = cli_echo(state->cli, 1, data_blob_const(garbage, sizeof(garbage)));
if (NT_STATUS_IS_OK(status)) {
return true;
}
DEBUG(2,("send_server_keepalive: password server SMBecho failed: %s\n",
nt_errstr(status)));
cli_shutdown(state->cli);
state->cli = NULL;
return false;
}
static int destroy_server_security(struct server_security_state *state)
{
if (state->cli) {
cli_shutdown(state->cli);
}
return 0;
}
static struct server_security_state *make_server_security_state(struct cli_state *cli)
{
struct server_security_state *result;
if (!(result = talloc(NULL, struct server_security_state))) {
DEBUG(0, ("talloc failed\n"));
cli_shutdown(cli);
return NULL;
}
result->cli = cli;
talloc_set_destructor(result, destroy_server_security);
if (lp_keepalive() != 0) {
struct timeval interval;
interval.tv_sec = lp_keepalive();
interval.tv_usec = 0;
if (event_add_idle(server_event_context(), result, interval,
"server_security_keepalive",
send_server_keepalive,
result) == NULL) {
DEBUG(0, ("event_add_idle failed\n"));
TALLOC_FREE(result);
return NULL;
}
}
return result;
}
/****************************************************************************
Get the challenge out of a password server.
****************************************************************************/
static DATA_BLOB auth_get_challenge_server(const struct auth_context *auth_context,
void **my_private_data,
TALLOC_CTX *mem_ctx)
{
struct cli_state *cli = server_cryptkey(mem_ctx);
if (cli) {
uint16_t sec_mode = cli_state_security_mode(cli);
const uint8_t *server_challenge = cli_state_server_challenge(cli);
DEBUG(3,("using password server validation\n"));
if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
/* We can't work with unencrypted password servers
unless 'encrypt passwords = no' */
DEBUG(5,("make_auth_info_server: Server is unencrypted, no challenge available..\n"));
/* However, it is still a perfectly fine connection
to pass that unencrypted password over */
*my_private_data =
(void *)make_server_security_state(cli);
return data_blob_null;
}
if (!(*my_private_data = (void *)make_server_security_state(cli))) {
return data_blob(NULL,0);
}
/* The return must be allocated on the caller's mem_ctx, as our own will be
destoyed just after the call. */
return data_blob_talloc(discard_const_p(TALLOC_CTX, auth_context), server_challenge ,8);
} else {
return data_blob_null;
}
}
/****************************************************************************
Check for a valid username and password in security=server mode.
- Validate a password with the password server.
****************************************************************************/
static NTSTATUS check_smbserver_security(const struct auth_context *auth_context,
void *my_private_data,
TALLOC_CTX *mem_ctx,
const struct auth_usersupplied_info *user_info,
struct auth_serversupplied_info **server_info)
{
struct server_security_state *state = NULL;
struct cli_state *cli = NULL;
static bool tested_password_server = False;
static bool bad_password_server = False;
NTSTATUS nt_status = NT_STATUS_NOT_IMPLEMENTED;
bool locally_made_cli = False;
uint16_t sec_mode = 0;
DEBUG(10, ("check_smbserver_security: Check auth for: [%s]\n",
user_info->mapped.account_name));
if (my_private_data == NULL) {
DEBUG(10,("check_smbserver_security: "
"password server is not connected\n"));
return NT_STATUS_LOGON_FAILURE;
}
state = talloc_get_type_abort(my_private_data, struct server_security_state);
cli = state->cli;
if (cli) {
} else {
cli = server_cryptkey(mem_ctx);
locally_made_cli = True;
}
if (!cli_state_is_connected(cli)) {
DEBUG(1,("password server is not connected (cli not initialised)\n"));
return NT_STATUS_LOGON_FAILURE;
}
sec_mode = cli_state_security_mode(cli);
if ((sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
if (user_info->password_state != AUTH_PASSWORD_PLAIN) {
DEBUG(1,("password server %s is plaintext, but we are encrypted. This just can't work :-(\n", cli_state_remote_name(cli)));
return NT_STATUS_LOGON_FAILURE;
}
} else {
const uint8_t *server_challenge = cli_state_server_challenge(cli);
if (memcmp(server_challenge, auth_context->challenge.data, 8) != 0) {
DEBUG(1,("the challenge that the password server (%s) supplied us is not the one we gave our client. This just can't work :-(\n", cli_state_remote_name(cli)));
return NT_STATUS_LOGON_FAILURE;
}
}
/*
* Attempt a session setup with a totally incorrect password.
* If this succeeds with the guest bit *NOT* set then the password
* server is broken and is not correctly setting the guest bit. We
* need to detect this as some versions of NT4.x are broken. JRA.
*/
/* I sure as hell hope that there aren't servers out there that take
* NTLMv2 and have this bug, as we don't test for that...
* - abartlet@samba.org
*/
if ((!tested_password_server) && (lp_paranoid_server_security())) {
unsigned char badpass[24];
char *baduser = NULL;
memset(badpass, 0x1f, sizeof(badpass));
if((user_info->password.response.nt.length == sizeof(badpass)) &&
!memcmp(badpass, user_info->password.response.nt.data, sizeof(badpass))) {
/*
* Very unlikely, our random bad password is the same as the users
* password.
*/
memset(badpass, badpass[0]+1, sizeof(badpass));
}
baduser = talloc_asprintf(mem_ctx,
"%s%s",
INVALID_USER_PREFIX,
lp_netbios_name());
if (!baduser) {
return NT_STATUS_NO_MEMORY;
}
if (NT_STATUS_IS_OK(cli_session_setup(cli, baduser,
(char *)badpass,
sizeof(badpass),
(char *)badpass,
sizeof(badpass),
user_info->mapped.domain_name))) {
/*
* We connected to the password server so we
* can say we've tested it.
*/
tested_password_server = True;
if (!cli->is_guestlogin) {
DEBUG(0,("server_validate: password server %s allows users as non-guest \
with a bad password.\n", cli_state_remote_name(cli)));
DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
use this machine as the password server.\n"));
cli_ulogoff(cli);
/*
* Password server has the bug.
*/
bad_password_server = True;
return NT_STATUS_LOGON_FAILURE;
}
cli_ulogoff(cli);
}
} else {
/*
* We have already tested the password server.
* Fail immediately if it has the bug.
*/
if(bad_password_server) {
DEBUG(0,("server_validate: [1] password server %s allows users as non-guest \
with a bad password.\n", cli_state_remote_name(cli)));
DEBUG(0,("server_validate: [1] This is broken (and insecure) behaviour. Please do not \
use this machine as the password server.\n"));
return NT_STATUS_LOGON_FAILURE;
}
}
/*
* Now we know the password server will correctly set the guest bit, or is
* not guest enabled, we can try with the real password.
*/
switch (user_info->password_state) {
case AUTH_PASSWORD_PLAIN:
/* Plaintext available */
nt_status = cli_session_setup(
cli, user_info->client.account_name,
user_info->password.plaintext,
strlen(user_info->password.plaintext),
NULL, 0, user_info->mapped.domain_name);
break;
/* currently the hash values include a challenge-response as well */
case AUTH_PASSWORD_HASH:
case AUTH_PASSWORD_RESPONSE:
nt_status = cli_session_setup(
cli, user_info->client.account_name,
(char *)user_info->password.response.lanman.data,
user_info->password.response.lanman.length,
(char *)user_info->password.response.nt.data,
user_info->password.response.nt.length,
user_info->mapped.domain_name);
break;
default:
DEBUG(0,("user_info constructed for user '%s' was invalid - password_state=%u invalid.\n",user_info->mapped.account_name, user_info->password_state));
nt_status = NT_STATUS_INTERNAL_ERROR;
}
if (!NT_STATUS_IS_OK(nt_status)) {
DEBUG(1,("password server %s rejected the password: %s\n",
cli_state_remote_name(cli), nt_errstr(nt_status)));
}
/* if logged in as guest then reject */
if (cli->is_guestlogin) {
DEBUG(1,("password server %s gave us guest only\n",
cli_state_remote_name(cli)));
nt_status = NT_STATUS_LOGON_FAILURE;
}
cli_ulogoff(cli);
if (NT_STATUS_IS_OK(nt_status)) {
char *real_username = NULL;
struct passwd *pass = NULL;
if ( (pass = smb_getpwnam(talloc_tos(), user_info->mapped.account_name,
&real_username, True )) != NULL )
{
nt_status = make_server_info_pw(server_info, pass->pw_name, pass);
TALLOC_FREE(pass);
TALLOC_FREE(real_username);
}
else
{
nt_status = NT_STATUS_NO_SUCH_USER;
}
}
if (locally_made_cli) {
cli_shutdown(cli);
}
return(nt_status);
}
static NTSTATUS auth_init_smbserver(struct auth_context *auth_context, const char* param, auth_methods **auth_method)
{
struct auth_methods *result;
result = talloc_zero(auth_context, struct auth_methods);
if (result == NULL) {
return NT_STATUS_NO_MEMORY;
}
result->name = "smbserver";
result->auth = check_smbserver_security;
result->get_chal = auth_get_challenge_server;
*auth_method = result;
return NT_STATUS_OK;
}
NTSTATUS auth_server_init(void)
{
return smb_register_auth(AUTH_INTERFACE_VERSION, "smbserver", auth_init_smbserver);
}

4
source3/auth/proto.h
View File

@ -140,10 +140,6 @@ NTSTATUS check_sam_security_info3(const DATA_BLOB *challenge,
struct netr_SamInfo3 **pinfo3);
NTSTATUS auth_sam_init(void);
/* The following definitions come from auth/auth_server.c */
NTSTATUS auth_server_init(void);
/* The following definitions come from auth/auth_unix.c */
NTSTATUS auth_unix_init(void);

9
source3/auth/wscript_build
View File

@ -3,7 +3,6 @@
AUTH_BUILTIN_SRC = 'auth_builtin.c'
AUTH_DOMAIN_SRC = 'auth_domain.c'
AUTH_SAM_SRC = 'auth_sam.c'
AUTH_SERVER_SRC = 'auth_server.c'
AUTH_UNIX_SRC = 'auth_unix.c'
AUTH_WINBIND_SRC = 'auth_winbind.c'
AUTH_WBC_SRC = 'auth_wbc.c'
@ -69,14 +68,6 @@ bld.SAMBA3_MODULE('auth_wbc',
internal_module=bld.SAMBA3_IS_STATIC_MODULE('auth_wbc'),
enabled=bld.SAMBA3_IS_ENABLED_MODULE('auth_wbc'))
bld.SAMBA3_MODULE('auth_server',
subsystem='auth',
source=AUTH_SERVER_SRC,
deps='samba-util',
init_function='',
internal_module=bld.SAMBA3_IS_STATIC_MODULE('auth_server'),
enabled=bld.SAMBA3_IS_ENABLED_MODULE('auth_server'))
bld.SAMBA3_MODULE('auth_domain',
subsystem='auth',
source=AUTH_DOMAIN_SRC,

2
source3/configure.in
View File

@ -433,7 +433,6 @@ default_static_modules="$default_static_modules auth_sam"
default_static_modules="$default_static_modules auth_unix"
default_static_modules="$default_static_modules auth_winbind"
default_static_modules="$default_static_modules auth_wbc"
default_static_modules="$default_static_modules auth_server"
default_static_modules="$default_static_modules auth_domain"
default_static_modules="$default_static_modules auth_builtin"
default_static_modules="$default_static_modules vfs_default"
@ -6496,7 +6495,6 @@ SMB_MODULE(auth_sam, \$(AUTH_SAM_OBJ), "bin/sam.$SHLIBEXT", AUTH)
SMB_MODULE(auth_unix, \$(AUTH_UNIX_OBJ), "bin/unix.$SHLIBEXT", AUTH)
SMB_MODULE(auth_winbind, \$(AUTH_WINBIND_OBJ), "bin/winbind.$SHLIBEXT", AUTH)
SMB_MODULE(auth_wbc, \$(AUTH_WBC_OBJ), "bin/wbc.$SHLIBEXT", AUTH)
SMB_MODULE(auth_server, \$(AUTH_SERVER_OBJ), "bin/smbserver.$SHLIBEXT", AUTH)
SMB_MODULE(auth_domain, \$(AUTH_DOMAIN_OBJ), "bin/domain.$SHLIBEXT", AUTH)
SMB_MODULE(auth_builtin, \$(AUTH_BUILTIN_OBJ), "bin/builtin.$SHLIBEXT", AUTH)
SMB_MODULE(auth_script, \$(AUTH_SCRIPT_OBJ), "bin/script.$SHLIBEXT", AUTH)

2
source3/wscript
View File

@ -1376,7 +1376,7 @@ main() {
# if we include the module loader in iconv
default_static_modules=TO_LIST('''pdb_smbpasswd pdb_tdbsam pdb_wbc_sam
auth_sam auth_unix auth_winbind auth_wbc auth_server
auth_sam auth_unix auth_winbind auth_wbc
auth_domain auth_builtin vfs_default
nss_info_template idmap_tdb idmap_passdb
idmap_nss''')