1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
samba-mirror/source3/auth/auth_generic.c
Andreas Schneider bc2a2399e5 s3:gse: Implement gensec_gse_security_by_oid()
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-05-14 10:18:31 +00:00

649 lines
17 KiB
C

/*
Unix SMB/Netbios implementation.
Version 3.0
handle GENSEC authentication, server side
Copyright (C) Andrew Tridgell 2001
Copyright (C) Andrew Bartlett 2001-2003,2011
Copyright (C) Simo Sorce 2010.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include <tevent.h>
#include "../lib/util/tevent_ntstatus.h"
#include "auth.h"
#include "../lib/tsocket/tsocket.h"
#include "auth/gensec/gensec.h"
#include "lib/param/param.h"
#ifdef HAVE_KRB5
#include "librpc/gen_ndr/ndr_krb5pac.h"
#include "auth/kerberos/pac_utils.h"
#include "nsswitch/libwbclient/wbclient.h"
#endif
#include "librpc/crypto/gse.h"
#include "auth/credentials/credentials.h"
#include "lib/param/loadparm.h"
#include "librpc/gen_ndr/dcerpc.h"
#include "source3/lib/substitute.h"
static NTSTATUS generate_pac_session_info(
TALLOC_CTX *mem_ctx,
const char *princ_name,
const char *rhost,
DATA_BLOB *pac_blob,
struct auth_session_info **psession_info)
{
NTSTATUS status;
struct wbcAuthUserParams params = {0};
struct wbcAuthUserInfo *info = NULL;
struct wbcAuthErrorInfo *err = NULL;
struct auth_serversupplied_info *server_info = NULL;
char *original_user_name = NULL;
char *p = NULL;
wbcErr wbc_err;
/*
* Let winbind decode the PAC.
* This will also store the user
* data in the netsamlogon cache.
*
* This used to be a cache prime
* optimization, but now we delegate
* all logic to winbindd, as we require
* winbindd as domain member anyway.
*/
params.level = WBC_AUTH_USER_LEVEL_PAC;
params.password.pac.data = pac_blob->data;
params.password.pac.length = pac_blob->length;
/* we are contacting the privileged pipe */
become_root();
wbc_err = wbcAuthenticateUserEx(&params, &info, &err);
unbecome_root();
/*
* As this is merely a cache prime
* WBC_ERR_WINBIND_NOT_AVAILABLE
* is not a fatal error, treat it
* as success.
*/
switch (wbc_err) {
case WBC_ERR_SUCCESS:
break;
case WBC_ERR_WINBIND_NOT_AVAILABLE:
status = NT_STATUS_NO_LOGON_SERVERS;
DBG_ERR("winbindd not running - "
"but required as domain member: %s\n",
nt_errstr(status));
return status;
case WBC_ERR_AUTH_ERROR:
wbcFreeMemory(err);
return NT_STATUS(err->nt_status);
case WBC_ERR_NO_MEMORY:
return NT_STATUS_NO_MEMORY;
default:
return NT_STATUS_LOGON_FAILURE;
}
status = make_server_info_wbcAuthUserInfo(mem_ctx,
info->account_name,
info->domain_name,
info,
&server_info);
wbcFreeMemory(info);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("make_server_info_wbcAuthUserInfo failed: %s\n",
nt_errstr(status)));
return status;
}
/* We skip doing this step if the caller asked us not to */
if (!(server_info->guest)) {
const char *unix_username = server_info->unix_name;
/* We might not be root if we are an RPC call */
become_root();
status = smb_pam_accountcheck(unix_username, rhost);
unbecome_root();
if (!NT_STATUS_IS_OK(status)) {
DEBUG(3, ("check_ntlm_password: PAM Account for user [%s] "
"FAILED with error %s\n",
unix_username, nt_errstr(status)));
return status;
}
DEBUG(5, ("check_ntlm_password: PAM Account for user [%s] "
"succeeded\n", unix_username));
}
DEBUG(3, ("Kerberos ticket principal name is [%s]\n", princ_name));
p = strchr_m(princ_name, '@');
if (!p) {
DEBUG(3, ("[%s] Doesn't look like a valid principal\n",
princ_name));
return NT_STATUS_LOGON_FAILURE;
}
original_user_name = talloc_strndup(mem_ctx,
princ_name,
p - princ_name);
if (original_user_name == NULL) {
return NT_STATUS_NO_MEMORY;
}
status = create_local_token(
mem_ctx, server_info, NULL, original_user_name, psession_info);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("create_local_token failed: %s\n",
nt_errstr(status)));
return status;
}
return NT_STATUS_OK;
}
static NTSTATUS generate_krb5_session_info(
TALLOC_CTX *mem_ctx,
const char *princ_name,
const char *rhost,
DATA_BLOB *pac_blob,
struct auth_session_info **psession_info)
{
bool is_mapped = false;
bool is_guest = false;
char *ntuser = NULL;
char *ntdomain = NULL;
char *username = NULL;
struct passwd *pw = NULL;
NTSTATUS status;
if (pac_blob != NULL) {
struct PAC_LOGON_NAME *logon_name = NULL;
struct PAC_LOGON_INFO *logon_info = NULL;
struct PAC_DATA *pac_data = NULL;
enum ndr_err_code ndr_err;
size_t i;
pac_data = talloc_zero(mem_ctx, struct PAC_DATA);
if (pac_data == NULL) {
return NT_STATUS_NO_MEMORY;
}
ndr_err = ndr_pull_struct_blob(pac_blob,
pac_data,
pac_data,
(ndr_pull_flags_fn_t)
ndr_pull_PAC_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DBG_ERR("Can't parse the PAC: %s\n", nt_errstr(status));
return status;
}
if (pac_data->num_buffers < 4) {
DBG_ERR("We expect at least 4 PAC buffers.\n");
return NT_STATUS_INVALID_PARAMETER;
}
for (i = 0; i < pac_data->num_buffers; i++) {
struct PAC_BUFFER *data_buf = &pac_data->buffers[i];
switch (data_buf->type) {
case PAC_TYPE_LOGON_NAME:
logon_name = &data_buf->info->logon_name;
break;
case PAC_TYPE_LOGON_INFO:
if (!data_buf->info) {
break;
}
logon_info = data_buf->info->logon_info.info;
break;
default:
break;
}
}
if (logon_name == NULL) {
TALLOC_FREE(pac_data);
DBG_ERR("PAC without logon_name\n");
return NT_STATUS_INVALID_PARAMETER;
}
if (logon_info != NULL) {
/*
* In standalone mode we don't expect a MS-PAC!
* we only support MIT realms
*/
TALLOC_FREE(pac_data);
status = NT_STATUS_BAD_TOKEN_TYPE;
DBG_WARNING("Unexpected PAC for [%s] in standalone mode - %s\n",
princ_name, nt_errstr(status));
return status;
}
TALLOC_FREE(pac_data);
}
status = get_user_from_kerberos_info(mem_ctx,
rhost,
princ_name,
&is_mapped,
&is_guest,
&ntuser,
&ntdomain,
&username,
&pw);
if (!NT_STATUS_IS_OK(status)) {
DBG_NOTICE("Failed to map kerberos principal to system user "
"(%s)\n", nt_errstr(status));
return NT_STATUS_ACCESS_DENIED;
}
status = make_session_info_krb5(mem_ctx,
ntuser,
ntdomain,
username,
pw,
is_guest,
is_mapped,
psession_info);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
nt_errstr(status)));
status = nt_status_squash(status);
return status;
}
return NT_STATUS_OK;
}
static NTSTATUS auth3_generate_session_info_pac(
struct auth4_context *auth_ctx,
TALLOC_CTX *mem_ctx,
struct smb_krb5_context *smb_krb5_context,
DATA_BLOB *pac_blob,
const char *princ_name,
const struct tsocket_address *remote_address,
uint32_t session_info_flags,
struct auth_session_info **psession_info)
{
enum server_role server_role = lp_server_role();
struct auth_session_info *session_info = NULL;
const char *rhost;
NTSTATUS status;
TALLOC_CTX *tmp_ctx = NULL;
tmp_ctx = talloc_new(mem_ctx);
if (tmp_ctx == NULL) {
return NT_STATUS_NO_MEMORY;
}
if (tsocket_address_is_inet(remote_address, "ip")) {
rhost = tsocket_address_inet_addr_string(remote_address,
tmp_ctx);
if (rhost == NULL) {
status = NT_STATUS_NO_MEMORY;
goto done;
}
} else {
rhost = "127.0.0.1";
}
switch (server_role) {
case ROLE_DOMAIN_MEMBER:
case ROLE_DOMAIN_BDC:
case ROLE_DOMAIN_PDC:
case ROLE_ACTIVE_DIRECTORY_DC:
case ROLE_IPA_DC:
/* This requires a complete MS-PAC including logon_info */
status = generate_pac_session_info(
tmp_ctx, princ_name, rhost, pac_blob, &session_info);
break;
case ROLE_STANDALONE:
/* This requires no PAC or a minimal PAC */
status = generate_krb5_session_info(
tmp_ctx, princ_name, rhost, pac_blob, &session_info);
break;
default:
status = NT_STATUS_INVALID_PARAMETER;
goto done;
}
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
/* setup the string used by %U */
set_current_user_info(session_info->unix_info->sanitized_username,
session_info->unix_info->unix_name,
session_info->info->domain_name);
/* reload services so that the new %U is taken into account */
lp_load_with_shares(get_dyn_CONFIGFILE());
DEBUG(5, (__location__ "OK: user: %s domain: %s client: %s\n",
session_info->info->account_name,
session_info->info->domain_name,
rhost));
*psession_info = talloc_move(mem_ctx, &session_info);
status = NT_STATUS_OK;
done:
TALLOC_FREE(tmp_ctx);
return status;
}
static struct auth4_context *make_auth4_context_s3(TALLOC_CTX *mem_ctx, struct auth_context *auth_context)
{
struct auth4_context *auth4_context = talloc_zero(mem_ctx, struct auth4_context);
if (auth4_context == NULL) {
DEBUG(10, ("failed to allocate auth4_context failed\n"));
return NULL;
}
auth4_context->generate_session_info_pac = auth3_generate_session_info_pac;
auth4_context->generate_session_info = auth3_generate_session_info;
auth4_context->get_ntlm_challenge = auth3_get_challenge;
auth4_context->set_ntlm_challenge = auth3_set_challenge;
auth4_context->check_ntlm_password_send = auth3_check_password_send;
auth4_context->check_ntlm_password_recv = auth3_check_password_recv;
auth4_context->private_data = talloc_steal(auth4_context, auth_context);
return auth4_context;
}
NTSTATUS make_auth4_context(TALLOC_CTX *mem_ctx, struct auth4_context **auth4_context_out)
{
struct auth_context *auth_context;
NTSTATUS nt_status;
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
nt_status = make_auth3_context_for_ntlm(tmp_ctx, &auth_context);
if (!NT_STATUS_IS_OK(nt_status)) {
TALLOC_FREE(tmp_ctx);
return nt_status;
}
if (auth_context->make_auth4_context) {
nt_status = auth_context->make_auth4_context(auth_context, mem_ctx, auth4_context_out);
TALLOC_FREE(tmp_ctx);
return nt_status;
} else {
struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
if (auth4_context == NULL) {
TALLOC_FREE(tmp_ctx);
return NT_STATUS_NO_MEMORY;
}
*auth4_context_out = talloc_steal(mem_ctx, auth4_context);
TALLOC_FREE(tmp_ctx);
return NT_STATUS_OK;
}
}
NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
const struct tsocket_address *remote_address,
const struct tsocket_address *local_address,
const char *service_description,
struct gensec_security **gensec_security_out)
{
struct gensec_security *gensec_security;
struct auth_context *auth_context = NULL;
NTSTATUS nt_status;
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
nt_status = make_auth3_context_for_ntlm(tmp_ctx, &auth_context);
if (!NT_STATUS_IS_OK(nt_status)) {
goto done;
}
if (auth_context->prepare_gensec) {
nt_status = auth_context->prepare_gensec(auth_context, tmp_ctx,
&gensec_security);
if (!NT_STATUS_IS_OK(nt_status)) {
goto done;
}
} else {
const struct gensec_security_ops **backends = NULL;
struct gensec_settings *gensec_settings;
struct loadparm_context *lp_ctx;
size_t idx = 0;
struct cli_credentials *server_credentials;
const char *dns_name;
const char *dns_domain;
bool ok;
struct auth4_context *auth4_context = make_auth4_context_s3(tmp_ctx, auth_context);
if (auth4_context == NULL) {
goto nomem;
}
lp_ctx = loadparm_init_s3(tmp_ctx, loadparm_s3_helpers());
if (lp_ctx == NULL) {
DEBUG(10, ("loadparm_init_s3 failed\n"));
nt_status = NT_STATUS_INVALID_SERVER_STATE;
goto done;
}
gensec_settings = lpcfg_gensec_settings(tmp_ctx, lp_ctx);
if (lp_ctx == NULL) {
DEBUG(10, ("lpcfg_gensec_settings failed\n"));
goto nomem;
}
/*
* This should be a 'netbios domain -> DNS domain'
* mapping, and can currently validly return NULL on
* poorly configured systems.
*
* This is used for the NTLMSSP server
*
*/
dns_name = get_mydnsfullname();
if (dns_name == NULL) {
dns_name = "";
}
dns_domain = get_mydnsdomname(tmp_ctx);
if (dns_domain == NULL) {
dns_domain = "";
}
gensec_settings->server_dns_name = strlower_talloc(gensec_settings, dns_name);
if (gensec_settings->server_dns_name == NULL) {
goto nomem;
}
gensec_settings->server_dns_domain = strlower_talloc(gensec_settings, dns_domain);
if (gensec_settings->server_dns_domain == NULL) {
goto nomem;
}
backends = talloc_zero_array(gensec_settings,
const struct gensec_security_ops *, 6);
if (backends == NULL) {
goto nomem;
}
gensec_settings->backends = backends;
gensec_init();
/* These need to be in priority order, krb5 before NTLMSSP */
#if defined(HAVE_KRB5)
backends[idx++] = gensec_gse_security_by_oid(
GENSEC_OID_KERBEROS5);
#endif
backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_SPNEGO);
backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_SCHANNEL);
backends[idx++] = gensec_security_by_auth_type(NULL, DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM);
/*
* This is anonymous for now, because we just use it
* to set the kerberos state at the moment
*/
server_credentials = cli_credentials_init_anon(tmp_ctx);
if (!server_credentials) {
DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
goto nomem;
}
ok = cli_credentials_set_conf(server_credentials, lp_ctx);
if (!ok) {
DBG_ERR("Failed to set server credentials defaults "
"from smb.conf.\n");
goto nomem;
}
if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
cli_credentials_set_kerberos_state(server_credentials,
CRED_USE_KERBEROS_DESIRED,
CRED_SPECIFIED);
} else {
cli_credentials_set_kerberos_state(server_credentials,
CRED_USE_KERBEROS_DISABLED,
CRED_SPECIFIED);
}
nt_status = gensec_server_start(tmp_ctx, gensec_settings,
auth4_context, &gensec_security);
if (!NT_STATUS_IS_OK(nt_status)) {
goto done;
}
nt_status = gensec_set_credentials(
gensec_security, server_credentials);
if (!NT_STATUS_IS_OK(nt_status)) {
goto done;
}
}
nt_status = gensec_set_remote_address(gensec_security,
remote_address);
if (!NT_STATUS_IS_OK(nt_status)) {
goto done;
}
nt_status = gensec_set_local_address(gensec_security,
local_address);
if (!NT_STATUS_IS_OK(nt_status)) {
goto done;
}
nt_status = gensec_set_target_service_description(gensec_security,
service_description);
if (!NT_STATUS_IS_OK(nt_status)) {
goto done;
}
*gensec_security_out = talloc_move(mem_ctx, &gensec_security);
nt_status = NT_STATUS_OK;
goto done;
nomem:
nt_status = NT_STATUS_NO_MEMORY;
done:
TALLOC_FREE(tmp_ctx);
return nt_status;
}
/*
* Check a username and password, and return the final session_info.
* We also log the authorization of the session here, just as
* gensec_session_info() does.
*/
NTSTATUS auth_check_password_session_info(struct auth4_context *auth_context,
TALLOC_CTX *mem_ctx,
struct auth_usersupplied_info *user_info,
struct auth_session_info **session_info)
{
NTSTATUS nt_status;
void *server_info;
uint8_t authoritative = 1;
struct tevent_context *ev = NULL;
struct tevent_req *subreq = NULL;
bool ok;
ev = samba_tevent_context_init(talloc_tos());
if (ev == NULL) {
return NT_STATUS_NO_MEMORY;
}
subreq = auth_context->check_ntlm_password_send(ev, ev,
auth_context,
user_info);
if (subreq == NULL) {
TALLOC_FREE(ev);
return NT_STATUS_NO_MEMORY;
}
ok = tevent_req_poll_ntstatus(subreq, ev, &nt_status);
if (!ok) {
TALLOC_FREE(ev);
return nt_status;
}
nt_status = auth_context->check_ntlm_password_recv(subreq,
talloc_tos(),
&authoritative,
&server_info,
NULL, NULL);
TALLOC_FREE(ev);
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
}
nt_status = auth_context->generate_session_info(auth_context,
mem_ctx,
server_info,
user_info->client.account_name,
AUTH_SESSION_INFO_UNIX_TOKEN |
AUTH_SESSION_INFO_DEFAULT_GROUPS |
AUTH_SESSION_INFO_NTLM,
session_info);
TALLOC_FREE(server_info);
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
}
/*
* This is rather redundant (the authentication has just been
* logged, with much the same details), but because we want to
* log all authorizations consistently (be they NLTM, NTLMSSP
* or krb5) we log this info again as an authorization.
*/
log_successful_authz_event(auth_context->msg_ctx,
auth_context->lp_ctx,
user_info->remote_host,
user_info->local_host,
user_info->service_description,
user_info->auth_description,
AUTHZ_TRANSPORT_PROTECTION_SMB,
*session_info,
NULL /* client_audit_info */,
NULL /* server_audit_info */);
return nt_status;
}