#include "includes.h"
extern int Protocol;
extern struct in_addr ipzero;
static pstring session_users="";
extern pstring global_myname;
extern fstring global_myworkgroup;
BOOL global_machine_password_needs_changing = False;
static unsigned char saved_challenge[8];
static BOOL challenge_sent=False;
void generate_next_challenge(char *challenge)
{
unsigned char buf[8];
generate_random_buffer(buf,8,False);
memcpy(saved_challenge, buf, 8);
memcpy(challenge,buf,8);
challenge_sent = True;
}
BOOL set_challenge(unsigned char *challenge)
{
memcpy(saved_challenge,challenge,8);
challenge_sent = True;
return(True);
}
static BOOL last_challenge(unsigned char *challenge)
{
if (!challenge_sent)
return(False);
memcpy(challenge,saved_challenge,8);
return(True);
}
static user_struct *validated_users;
static int next_vuid = VUID_OFFSET;
static int num_validated_vuids;
user_struct *get_valid_user_struct(uint16 vuid)
{
user_struct *usp;
int count=0;
if (vuid == UID_FIELD_INVALID)
return NULL;
for (usp=validated_users;usp;usp=usp->next,count++) {
if (vuid == usp->vuid) {
if (count > 10) {
DLIST_PROMOTE(validated_users, usp);
}
return usp;
}
}
return NULL;
}
void invalidate_vuid(uint16 vuid)
{
user_struct *vuser = get_valid_user_struct(vuid);
if (vuser == NULL)
return;
session_yield(vuid);
DLIST_REMOVE(validated_users, vuser);
SAFE_FREE(vuser->groups);
delete_nt_token(&vuser->nt_user_token);
safe_free(vuser);
num_validated_vuids--;
}
void invalidate_all_vuids(void)
{
user_struct *usp, *next=NULL;
for (usp=validated_users;usp;usp=next) {
next = usp->next;
invalidate_vuid(usp->vuid);
}
}
char *validated_username(uint16 vuid)
{
user_struct *vuser = get_valid_user_struct(vuid);
if (vuser == NULL)
return 0;
return(vuser->user.unix_name);
}
char *validated_domain(uint16 vuid)
{
user_struct *vuser = get_valid_user_struct(vuid);
if (vuser == NULL)
return 0;
return(vuser->user.domain);
}
NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups, BOOL is_guest, NT_USER_TOKEN *sup_tok)
{
extern DOM_SID global_sid_World;
extern DOM_SID global_sid_Network;
extern DOM_SID global_sid_Builtin_Guests;
extern DOM_SID global_sid_Authenticated_Users;
NT_USER_TOKEN *token;
DOM_SID *psids;
int i, psid_ndx = 0;
size_t num_sids = 0;
fstring sid_str;
if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
return NULL;
ZERO_STRUCTP(token);
num_sids = 5 + ngroups;
if (sup_tok && sup_tok->num_sids)
num_sids += sup_tok->num_sids;
if ((token->user_sids = (DOM_SID *)malloc( num_sids*sizeof(DOM_SID))) == NULL) {
SAFE_FREE(token);
return NULL;
}
psids = token->user_sids;
uid_to_sid( &psids[PRIMARY_USER_SID_INDEX], uid);
psid_ndx++;
gid_to_sid( &psids[PRIMARY_GROUP_SID_INDEX], gid);
psid_ndx++;
for (i = 0; i < ngroups; i++) {
if (groups[i] != gid) {
gid_to_sid( &psids[psid_ndx++], groups[i]);
}
}
if (sup_tok) {
for (i = 0; i < sup_tok->num_sids; i++)
sid_copy( &psids[psid_ndx++], &sup_tok->user_sids[i] );
}
sid_copy( &psids[psid_ndx++], &global_sid_World);
sid_copy( &psids[psid_ndx++], &global_sid_Network);
if (is_guest)
sid_copy( &psids[psid_ndx++], &global_sid_Builtin_Guests);
else
sid_copy( &psids[psid_ndx++], &global_sid_Authenticated_Users);
token->num_sids = psid_ndx;
for (i = 0; i < token->num_sids; i++) {
DEBUG(5, ("user token sid %s\n",
sid_to_string(sid_str, &token->user_sids[i])));
}
return token;
}
int register_vuid(uid_t uid,gid_t gid, char *unix_name, char *requested_name,
char *domain,BOOL guest, NT_USER_TOKEN **pptok)
{
user_struct *vuser = NULL;
struct passwd *pwfile;
if(lp_security() == SEC_SHARE)
return UID_FIELD_INVALID;
if (num_validated_vuids >= 0xFFFF-VUID_OFFSET)
return UID_FIELD_INVALID;
if((vuser = (user_struct *)malloc( sizeof(user_struct) )) == NULL) {
DEBUG(0,("Failed to malloc users struct!\n"));
return UID_FIELD_INVALID;
}
ZERO_STRUCTP(vuser);
DEBUG(10,("register_vuid: (%u,%u) %s %s %s guest=%d\n", (unsigned int)uid, (unsigned int)gid,
unix_name, requested_name, domain, guest ));
while( get_valid_user_struct(next_vuid) != NULL ) {
next_vuid++;
if (next_vuid == UID_FIELD_INVALID)
next_vuid = VUID_OFFSET;
}
DEBUG(10,("register_vuid: allocated vuid = %u\n", (unsigned int)next_vuid ));
vuser->vuid = next_vuid;
vuser->uid = uid;
vuser->gid = gid;
vuser->guest = guest;
fstrcpy(vuser->user.unix_name,unix_name);
fstrcpy(vuser->user.smb_name,requested_name);
fstrcpy(vuser->user.domain,domain);
vuser->n_groups = 0;
vuser->groups = NULL;
initialise_groups(unix_name, uid, gid);
get_current_groups( &vuser->n_groups, &vuser->groups);
if (*pptok)
add_supplementary_nt_login_groups(&vuser->n_groups, &vuser->groups, pptok);
vuser->nt_user_token = create_nt_token(uid,gid, vuser->n_groups, vuser->groups, guest, *pptok);
next_vuid++;
num_validated_vuids++;
DLIST_ADD(validated_users, vuser);
DEBUG(3,("uid %d registered to name %s\n",(int)uid,unix_name));
DEBUG(3, ("Clearing default real name\n"));
if ((pwfile=sys_getpwnam(vuser->user.unix_name))!= NULL) {
DEBUG(3, ("User name: %s\tReal name: %s\n",vuser->user.unix_name,pwfile->pw_gecos));
fstrcpy(vuser->user.full_name, pwfile->pw_gecos);
}
if (!session_claim(vuser->vuid)) {
DEBUG(1,("Failed to claim session for vuid=%d\n", vuser->vuid));
invalidate_vuid(vuser->vuid);
return -1;
}
return vuser->vuid;
}
void add_session_user(char *user)
{
fstring suser;
StrnCpy(suser,user,sizeof(suser)-1);
if (!Get_Pwnam(suser,True))
return;
if (suser && *suser && !in_list(suser,session_users,False)) {
if (strlen(suser) + strlen(session_users) + 2 >= sizeof(pstring))
DEBUG(1,("Too many session users??\n"));
else {
pstrcat(session_users," ");
pstrcat(session_users,suser);
}
}
}
static BOOL update_smbpassword_file(char *user, char *password)
{
SAM_ACCOUNT *sampass = NULL;
BOOL ret;
pdb_init_sam(&sampass);
become_root();
ret = pdb_getsampwnam(sampass, user);
unbecome_root();
if(!ret) {
DEBUG(0,("update_smbpassword_file: pdb_getsampwnam failed to locate %s\n", user));
return False;
}
pdb_set_acct_ctrl(sampass, pdb_get_acct_ctrl(sampass) & ~ACB_DISABLED);
ret = change_oem_password( sampass, password, True);
if (ret == False) {
DEBUG(3,("change_oem_password returned False\n"));
}
if (sampass)
pdb_free_sam(sampass);
return ret;
}
BOOL smb_password_check(char *password, unsigned char *part_passwd, unsigned char *c8)
{
unsigned char p21[21];
unsigned char p24[24];
if (part_passwd == NULL)
DEBUG(10,("No password set - allowing access\n"));
if (part_passwd == NULL)
return True;
memset(p21,'\0',21);
memcpy(p21,part_passwd,16);
E_P24(p21, c8, p24);
#if DEBUG_PASSWORD
{
int i;
DEBUG(100,("Part password (P16) was |"));
for(i = 0; i < 16; i++)
DEBUG(100,("%X ", (unsigned char)part_passwd[i]));
DEBUG(100,("|\n"));
DEBUG(100,("Password from client was |"));
for(i = 0; i < 24; i++)
DEBUG(100,("%X ", (unsigned char)password[i]));
DEBUG(100,("|\n"));
DEBUG(100,("Given challenge was |"));
for(i = 0; i < 8; i++)
DEBUG(100,("%X ", (unsigned char)c8[i]));
DEBUG(100,("|\n"));
DEBUG(100,("Value from encryption was |"));
for(i = 0; i < 24; i++)
DEBUG(100,("%X ", (unsigned char)p24[i]));
DEBUG(100,("|\n"));
}
#endif
return (memcmp(p24, password, 24) == 0);
}
BOOL smb_password_ok(SAM_ACCOUNT *sampass, uchar chal[8],
uchar lm_pass[24], uchar nt_pass[24])
{
uchar challenge[8];
char* user_name;
uint8 *nt_pw, *lm_pw;
if (!lm_pass || !sampass)
return(False);
user_name = pdb_get_username(sampass);
DEBUG(4,("smb_password_ok: Checking SMB password for user %s\n",user_name));
if(pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
DEBUG(1,("smb_password_ok: account for user %s was disabled.\n", user_name));
return(False);
}
if (chal == NULL) {
DEBUG(5,("smb_password_ok: use last SMBnegprot challenge\n"));
if (!last_challenge(challenge)) {
DEBUG(1,("smb_password_ok: no challenge done - password failed\n"));
return False;
}
} else {
DEBUG(5,("smb_password_ok: challenge received\n"));
memcpy(challenge, chal, 8);
}
nt_pw = pdb_get_nt_passwd(sampass);
if ((Protocol >= PROTOCOL_NT1) && (nt_pw != NULL)) {
DEBUG(4,("smb_password_ok: Checking NT MD4 password\n"));
if (smb_password_check((char *)nt_pass, (uchar *)nt_pw, challenge)) {
DEBUG(4,("smb_password_ok: NT MD4 password check succeeded\n"));
return(True);
}
DEBUG(4,("smb_password_ok: NT MD4 password check failed\n"));
}
lm_pw = pdb_get_lanman_passwd(sampass);
if((lm_pw == NULL) && (pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ)) {
DEBUG(4,("smb_password_ok: no password required for user %s\n",user_name));
return True;
}
if(lp_lanman_auth() && (lm_pw != NULL)) {
DEBUG(4,("smb_password_ok: Checking LM password\n"));
if(smb_password_check((char *)lm_pass,(uchar *)lm_pw, challenge)) {
DEBUG(4,("smb_password_ok: LM password check succeeded\n"));
return(True);
}
DEBUG(4,("smb_password_ok: LM password check failed\n"));
}
return False;
}
BOOL pass_check_smb(char *user, char *domain, uchar *chal,
uchar *lm_pwd, uchar *nt_pwd, struct passwd *pwd)
{
SAM_ACCOUNT *sampass = NULL;
if (!lm_pwd || !nt_pwd)
return(False);
#if 0
if (pwd != NULL && user == NULL) {
pass = (struct passwd *) pwd;
user = pass->pw_name;
} else {
pass = smb_getpwnam(user,True);
}
if (pass == NULL) {
DEBUG(1,("Couldn't find user '%s' in UNIX password database.\n",user));
return(False);
}
#endif
pdb_init_sam(&sampass);
if (!pdb_getsampwnam(sampass, user)) {
DEBUG(1,("Couldn't find user '%s' in passdb.\n", user));
return(False);
}
if(pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
DEBUG(1,("Account for user '%s' was disabled.\n", user));
pdb_free_sam(sampass);
return(False);
}
if (pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ) {
if (lp_null_passwords()) {
DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", user));
pdb_free_sam(sampass);
return(True);
} else {
DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", user));
pdb_free_sam(sampass);
return(False);
}
}
if (smb_password_ok(sampass, chal, lm_pwd, nt_pwd)) {
pdb_free_sam(sampass);
return(True);
}
DEBUG(2,("pass_check_smb failed - invalid password for user [%s]\n", user));
pdb_free_sam(sampass);
return False;
}
BOOL password_ok(char *user, char *password, int pwlen, struct passwd *pwd)
{
BOOL ret;
if ((pwlen == 0) && !lp_null_passwords()) {
DEBUG(4,("Null passwords not allowed.\n"));
return False;
}
if (pwlen == 24 || (lp_encrypted_passwords() && (pwlen == 0) && lp_null_passwords())) {
uchar challenge[8];
if (!last_challenge(challenge)) {
DEBUG(0,("Error: challenge not done for user=%s\n", user));
return False;
}
#ifdef DIRECTORY_SERVICE_X
ret = pass_check_directoryservice(user, challenge, password);
#else
ret = pass_check_smb(user, global_myworkgroup,
challenge, (uchar *)password, (uchar *)password, pwd);
#endif
if (ret)
return (NT_STATUS_V(smb_pam_accountcheck(user)) == NT_STATUS_V(NT_STATUS_OK));
return ret;
}
return (pass_check(user, password, pwlen, pwd,
lp_update_encrypted() ?
update_smbpassword_file : NULL));
}
BOOL user_ok(char *user,int snum)
{
pstring valid, invalid;
BOOL ret;
StrnCpy(valid, lp_valid_users(snum), sizeof(pstring)-1);
StrnCpy(invalid, lp_invalid_users(snum), sizeof(pstring)-1);
pstring_sub(valid,"%S",lp_servicename(snum));
pstring_sub(invalid,"%S",lp_servicename(snum));
ret = !user_in_list(user,invalid);
if (ret && valid && *valid)
ret = user_in_list(user,valid);
if (ret && lp_onlyuser(snum)) {
char *user_list = lp_username(snum);
pstring_sub(user_list,"%S",lp_servicename(snum));
ret = user_in_list(user,user_list);
}
return(ret);
}
static char *validate_group(const char *group,char *password,int pwlen,int snum)
{
#ifdef HAVE_NETGROUP
{
char *host, *user, *domain;
setnetgrent(group);
while (getnetgrent(&host, &user, &domain)) {
if (user) {
if (user_ok(user, snum) &&
password_ok(user,password,pwlen,NULL)) {
endnetgrent();
return(user);
}
}
}
endnetgrent();
}
#endif
{
struct sys_userlist *user_list = get_users_in_group(group);
struct sys_userlist *member;
for (member = user_list; member; member = member->next) {
static fstring name;
fstrcpy(name,member->unix_name);
if (user_ok(name,snum) &&
password_ok(name,password,pwlen,NULL)) {
free_userlist(user_list);
return(&name[0]);
}
DEBUG(10,("validate_group = member = %s\n", member->unix_name));
}
free_userlist(user_list);
}
return(NULL);
}
BOOL authorise_login(int snum,char *user,char *password, int pwlen,
BOOL *guest,BOOL *force,uint16 vuid)
{
BOOL ok = False;
user_struct *vuser = get_valid_user_struct(vuid);
#if DEBUG_PASSWORD
DEBUG(100,("authorise_login: checking authorisation on user=%s pass=%s\n",
user,password));
#endif
*guest = False;
if (GUEST_ONLY(snum))
*force = True;
if (!GUEST_ONLY(snum) && (lp_security() > SEC_SHARE)) {
if (!vuser) {
DEBUG(1,("authorise_login: refusing user %s with no session setup\n",
user));
return False;
}
if (!vuser->guest && user_ok(vuser->user.unix_name,snum)) {
fstrcpy(user,vuser->user.unix_name);
*guest = False;
DEBUG(3,("authorise_login: ACCEPTED: validated uid ok as non-guest \
(user=%s)\n", user));
return True;
}
}
if (!(GUEST_ONLY(snum) && GUEST_OK(snum))) {
if (!ok && (*user) && user_ok(user,snum)) {
ok = password_ok(user,password, pwlen, NULL);
if (ok)
DEBUG(3,("authorise_login: ACCEPTED: given username (%s) password ok\n",
user ));
}
if (!ok && (vuser != 0) && vuser->guest) {
if (user_ok(vuser->user.unix_name,snum) &&
password_ok(vuser->user.unix_name, password, pwlen, NULL)) {
fstrcpy(user, vuser->user.unix_name);
vuser->guest = False;
DEBUG(3,("authorise_login: ACCEPTED: given password with registered user %s\n", user));
ok = True;
}
}
if (!ok) {
char *auser;
char *user_list = strdup(session_users);
if (!user_list)
return(False);
for (auser=strtok(user_list,LIST_SEP); !ok && auser;
auser = strtok(NULL,LIST_SEP)) {
fstring user2;
fstrcpy(user2,auser);
if (!user_ok(user2,snum))
continue;
if (password_ok(user2,password, pwlen, NULL)) {
ok = True;
fstrcpy(user,user2);
DEBUG(3,("authorise_login: ACCEPTED: session list username (%s) \
and given password ok\n", user));
}
}
SAFE_FREE(user_list);
}
if (!ok && (lp_security() > SEC_SHARE) && (vuser != 0) && !vuser->guest &&
user_ok(vuser->user.unix_name,snum)) {
fstrcpy(user,vuser->user.unix_name);
*guest = False;
DEBUG(3,("authorise_login: ACCEPTED: validated uid (%s) as non-guest\n",
user));
ok = True;
}
if (!ok && user_ok(user,snum) && check_hosts_equiv(user)) {
ok = True;
DEBUG(3,("authorise_login: ACCEPTED: hosts equiv or rhosts entry for %s\n",
user));
}
if (!ok && lp_username(snum)) {
char *auser;
pstring user_list;
StrnCpy(user_list,lp_username(snum),sizeof(pstring));
pstring_sub(user_list,"%S",lp_servicename(snum));
for (auser=strtok(user_list,LIST_SEP); auser && !ok;
auser = strtok(NULL,LIST_SEP)) {
if (*auser == '@') {
auser = validate_group(auser+1,password,pwlen,snum);
if (auser) {
ok = True;
fstrcpy(user,auser);
DEBUG(3,("authorise_login: ACCEPTED: group username \
and given password ok (%s)\n", user));
}
} else {
fstring user2;
fstrcpy(user2,auser);
if (user_ok(user2,snum) && password_ok(user2,password,pwlen,NULL)) {
ok = True;
fstrcpy(user,user2);
DEBUG(3,("authorise_login: ACCEPTED: user list username \
and given password ok (%s)\n", user));
}
}
}
}
}
if (!ok && GUEST_OK(snum)) {
fstring guestname;
StrnCpy(guestname,lp_guestaccount(snum),sizeof(guestname)-1);
if (Get_Pwnam(guestname,True)) {
fstrcpy(user,guestname);
ok = True;
DEBUG(3,("authorise_login: ACCEPTED: guest account and guest ok (%s)\n",
user));
} else {
DEBUG(0,("authorise_login: Invalid guest account %s??\n",guestname));
}
*guest = True;
}
if (ok && !user_ok(user,snum)) {
DEBUG(0,("authorise_login: rejected invalid user %s\n",user));
ok = False;
}
return(ok);
}
static BOOL check_user_equiv(char *user, char *remote, char *equiv_file)
{
int plus_allowed = 1;
char *file_host;
char *file_user;
char **lines = file_lines_load(equiv_file, NULL, False);
int i;
DEBUG(5, ("check_user_equiv %s %s %s\n", user, remote, equiv_file));
if (! lines) return False;
for (i=0; lines[i]; i++) {
char *buf = lines[i];
trim_string(buf," "," ");
if (buf[0] != '#' && buf[0] != '\n')
{
BOOL is_group = False;
int plus = 1;
char *bp = buf;
if (strcmp(buf, "NO_PLUS\n") == 0)
{
DEBUG(6, ("check_user_equiv NO_PLUS\n"));
plus_allowed = 0;
}
else {
if (buf[0] == '+')
{
bp++;
if (*bp == '\n' && plus_allowed)
{
DEBUG(6, ("check_user_equiv everybody allowed\n"));
file_lines_free(lines);
return True;
}
}
else if (buf[0] == '-')
{
bp++;
plus = 0;
}
if (*bp == '@')
{
is_group = True;
bp++;
}
file_host = strtok(bp, " \t\n");
file_user = strtok(NULL, " \t\n");
DEBUG(7, ("check_user_equiv %s %s\n", file_host ? file_host : "(null)",
file_user ? file_user : "(null)" ));
if (file_host && *file_host)
{
BOOL host_ok = False;
#if defined(HAVE_NETGROUP) && defined(HAVE_YP_GET_DEFAULT_DOMAIN)
if (is_group)
{
static char *mydomain = NULL;
if (!mydomain)
yp_get_default_domain(&mydomain);
if (mydomain && innetgr(file_host,remote,user,mydomain))
host_ok = True;
}
#else
if (is_group)
{
DEBUG(1,("Netgroups not configured\n"));
continue;
}
#endif
if (!host_ok && !is_group && strequal(remote, file_host))
host_ok = True;
if (!host_ok)
continue;
if (file_user == 0 || strequal(user, file_user))
{
DEBUG(5, ("check_user_equiv matched %s%s %s\n",
(plus ? "+" : "-"), file_host,
(file_user ? file_user : "")));
file_lines_free(lines);
return (plus ? True : False);
}
}
}
}
}
file_lines_free(lines);
return False;
}
BOOL check_hosts_equiv(char *user)
{
char *fname = NULL;
pstring rhostsfile;
struct passwd *pass = Get_Pwnam(user,True);
if (!pass)
return(False);
fname = lp_hosts_equiv();
if (fname && *fname && (pass->pw_uid != 0)) {
if (check_user_equiv(user,client_name(),fname))
return(True);
}
if (lp_use_rhosts()) {
char *home = get_user_service_home_dir(user);
if (home) {
slprintf(rhostsfile, sizeof(rhostsfile)-1, "%s/.rhosts", home);
if (check_user_equiv(user,client_name(),rhostsfile))
return(True);
}
}
return(False);
}
struct cli_state *server_client(void)
{
static struct cli_state pw_cli;
return &pw_cli;
}
struct cli_state *server_cryptkey(void)
{
struct cli_state *cli;
fstring desthost;
struct in_addr dest_ip;
char *p, *pserver;
BOOL connected_ok = False;
cli = server_client();
if (!cli_initialise(cli))
return NULL;
pserver = strdup(lp_passwordserver());
p = pserver;
while(next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
standard_sub_basic(desthost);
strupper(desthost);
if(!resolve_name( desthost, &dest_ip, 0x20)) {
DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost));
continue;
}
if (ismyip(dest_ip)) {
DEBUG(1,("Password server loop - disabling password server %s\n",desthost));
continue;
}
if (cli_connect(cli, desthost, &dest_ip)) {
DEBUG(3,("connected to password server %s\n",desthost));
connected_ok = True;
break;
}
}
SAFE_FREE(pserver);
if (!connected_ok) {
DEBUG(0,("password server not available\n"));
cli_shutdown(cli);
return NULL;
}
if (!attempt_netbios_session_request(cli, global_myname, desthost, &dest_ip))
return NULL;
DEBUG(3,("got session\n"));
if (!cli_negprot(cli)) {
DEBUG(1,("%s rejected the negprot\n",desthost));
cli_shutdown(cli);
return NULL;
}
if (cli->protocol < PROTOCOL_LANMAN2 ||
!(cli->sec_mode & 1)) {
DEBUG(1,("%s isn't in user level security mode\n",desthost));
cli_shutdown(cli);
return NULL;
}
DEBUG(3,("password server OK\n"));
return cli;
}
BOOL server_validate(char *user, char *domain,
char *pass, int passlen,
char *ntpass, int ntpasslen)
{
struct cli_state *cli;
static unsigned char badpass[24];
static fstring baduser;
static BOOL tested_password_server = False;
static BOOL bad_password_server = False;
cli = server_client();
if (!cli->initialised) {
DEBUG(1,("password server %s is not connected\n", cli->desthost));
return(False);
}
if(badpass[0] == 0)
memset(badpass, 0x1f, sizeof(badpass));
if((passlen == sizeof(badpass)) && !memcmp(badpass, pass, passlen)) {
memset(badpass, badpass[0]+1, sizeof(badpass));
}
if(baduser[0] == 0) {
fstrcpy(baduser, INVALID_USER_PREFIX);
fstrcat(baduser, global_myname);
}
if(!tested_password_server) {
if (cli_session_setup(cli, baduser, (char *)badpass, sizeof(badpass),
(char *)badpass, sizeof(badpass), domain)) {
tested_password_server = True;
if ((SVAL(cli->inbuf,smb_vwv2) & 1) == 0) {
DEBUG(0,("server_validate: password server %s allows users as non-guest \
with a bad password.\n", cli->desthost));
DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
use this machine as the password server.\n"));
cli_ulogoff(cli);
bad_password_server = True;
return False;
}
cli_ulogoff(cli);
}
} else {
if(bad_password_server) {
DEBUG(0,("server_validate: [1] password server %s allows users as non-guest \
with a bad password.\n", cli->desthost));
DEBUG(0,("server_validate: [1] This is broken (and insecure) behaviour. Please do not \
use this machine as the password server.\n"));
return False;
}
}
if (!cli_session_setup(cli, user, pass, passlen, ntpass, ntpasslen, domain)) {
DEBUG(1,("password server %s rejected the password\n", cli->desthost));
return False;
}
if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
cli_ulogoff(cli);
return(False);
}
cli_ulogoff(cli);
return(True);
}
static BOOL connect_to_domain_password_server(struct cli_state *pcli,
char *server, unsigned char *trust_passwd)
{
struct in_addr dest_ip;
fstring remote_machine;
if(!cli_initialise(pcli)) {
DEBUG(0,("connect_to_domain_password_server: unable to initialize client connection.\n"));
return False;
}
if (is_ipaddress(server)) {
struct in_addr to_ip;
if ((to_ip.s_addr=inet_addr(server)) == 0xFFFFFFFF) {
DEBUG (0,("connect_to_domain_password_server: inet_addr(%s) returned 0xFFFFFFFF!\n", server));
return False;
}
if (!name_status_find("*", 0, 0x20, to_ip, remote_machine)) {
DEBUG(1, ("connect_to_domain_password_server: Can't "
"resolve name for IP %s\n", server));
return False;
}
} else {
fstrcpy(remote_machine, server);
}
standard_sub_basic(remote_machine);
strupper(remote_machine);
if(!resolve_name( remote_machine, &dest_ip, 0x20)) {
DEBUG(1,("connect_to_domain_password_server: Can't resolve address for %s\n", remote_machine));
cli_shutdown(pcli);
return False;
}
if (ismyip(dest_ip)) {
DEBUG(1,("connect_to_domain_password_server: Password server loop - not using password server %s\n",
remote_machine));
cli_shutdown(pcli);
return False;
}
if (!cli_connect(pcli, remote_machine, &dest_ip)) {
DEBUG(0,("connect_to_domain_password_server: unable to connect to SMB server on \
machine %s. Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
cli_shutdown(pcli);
return False;
}
if (!attempt_netbios_session_request(pcli, global_myname, remote_machine, &dest_ip)) {
DEBUG(0,("connect_to_password_server: machine %s rejected the NetBIOS \
session request. Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
return False;
}
pcli->protocol = PROTOCOL_NT1;
if (!cli_negprot(pcli)) {
DEBUG(0,("connect_to_domain_password_server: machine %s rejected the negotiate protocol. \
Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
cli_shutdown(pcli);
return False;
}
if (pcli->protocol != PROTOCOL_NT1) {
DEBUG(0,("connect_to_domain_password_server: machine %s didn't negotiate NT protocol.\n",
remote_machine));
cli_shutdown(pcli);
return False;
}
if (!cli_session_setup(pcli, "", "", 0, "", 0, "")) {
DEBUG(0,("connect_to_domain_password_server: machine %s rejected the session setup. \
Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
cli_shutdown(pcli);
return False;
}
if (!(pcli->sec_mode & 1)) {
DEBUG(1,("connect_to_domain_password_server: machine %s isn't in user level security mode\n",
remote_machine));
cli_shutdown(pcli);
return False;
}
if (!cli_send_tconX(pcli, "IPC$", "IPC", "", 1)) {
DEBUG(0,("connect_to_domain_password_server: machine %s rejected the tconX on the IPC$ share. \
Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
cli_shutdown(pcli);
return False;
}
if(cli_nt_session_open(pcli, PIPE_NETLOGON) == False) {
DEBUG(0,("connect_to_domain_password_server: unable to open the domain client session to \
machine %s. Error was : %s.\n", remote_machine, cli_errstr(pcli)));
cli_nt_session_close(pcli);
cli_ulogoff(pcli);
cli_shutdown(pcli);
return False;
}
if (!NT_STATUS_IS_OK(cli_nt_setup_creds(pcli, trust_passwd))) {
DEBUG(0,("connect_to_domain_password_server: unable to setup the PDC credentials to machine \
%s. Error was : %s.\n", remote_machine, cli_errstr(pcli)));
cli_nt_session_close(pcli);
cli_ulogoff(pcli);
cli_shutdown(pcli);
return(False);
}
return True;
}
static BOOL attempt_connect_to_dc(struct cli_state *pcli, struct in_addr *ip, unsigned char *trust_passwd)
{
fstring dc_name;
if (ip_equal(ipzero, *ip))
return False;
if (!lookup_dc_name(global_myname, lp_workgroup(), ip, dc_name))
return False;
return connect_to_domain_password_server(pcli, dc_name, trust_passwd);
}
static BOOL find_connect_pdc(struct cli_state *pcli, unsigned char *trust_passwd, time_t last_change_time)
{
struct in_addr *ip_list = NULL;
int count = 0;
int i;
BOOL connected_ok = False;
time_t time_now = time(NULL);
BOOL use_pdc_only = False;
if (time_now - last_change_time < 3600)
use_pdc_only = True;
if (!get_dc_list(use_pdc_only, lp_workgroup(), &ip_list, &count))
return False;
for(i = 0; i < count; i++) {
if(!is_local_net(ip_list[i]))
continue;
if((connected_ok = attempt_connect_to_dc(pcli, &ip_list[i], trust_passwd)))
break;
ip_list[i] = ipzero;
}
if(!connected_ok) {
i = (sys_random() % count);
if (!(connected_ok = attempt_connect_to_dc(pcli, &ip_list[i], trust_passwd)))
ip_list[i] = ipzero;
}
if(!connected_ok) {
for(i = 0; i < count; i++) {
if((connected_ok = attempt_connect_to_dc(pcli, &ip_list[i], trust_passwd)))
break;
}
}
SAFE_FREE(ip_list);
return connected_ok;
}
BOOL domain_client_validate( char *user, char *domain,
char *smb_apasswd, int smb_apasslen,
char *smb_ntpasswd, int smb_ntpasslen,
BOOL *user_exists, NT_USER_TOKEN **pptoken)
{
unsigned char local_challenge[8];
unsigned char local_lm_response[24];
unsigned char local_nt_response[24];
unsigned char trust_passwd[16];
fstring remote_machine;
char *p, *pserver;
NET_ID_INFO_CTR ctr;
NET_USER_INFO_3 info3;
struct cli_state cli;
uint32 smb_uid_low;
BOOL connected_ok = False;
time_t last_change_time;
NTSTATUS status;
if (pptoken)
*pptoken = NULL;
if(user_exists != NULL)
*user_exists = True;
if(strequal( domain, global_myname)) {
DEBUG(3,("domain_client_validate: Requested domain was for this machine.\n"));
return False;
}
if(((smb_apasslen != 24) && (smb_apasslen != 0)) ||
((smb_ntpasslen != 24) && (smb_ntpasslen != 0))) {
DEBUG(3,("domain_client_validate: User passwords not in encrypted format.\n"));
generate_random_buffer( local_challenge, 8, False);
SMBencrypt( (uchar *)smb_apasswd, local_challenge, local_lm_response);
SMBNTencrypt((uchar *)smb_ntpasswd, local_challenge, local_nt_response);
smb_apasslen = 24;
smb_ntpasslen = 24;
smb_apasswd = (char *)local_lm_response;
smb_ntpasswd = (char *)local_nt_response;
} else {
if (!last_challenge(local_challenge)) {
DEBUG(0,("domain_client_validate: no challenge done - password failed\n"));
return False;
}
}
if (!secrets_fetch_trust_account_password(global_myworkgroup, trust_passwd, &last_change_time))
{
DEBUG(0, ("domain_client_validate: could not fetch trust account password for domain %s\n", global_myworkgroup));
return False;
}
if (time(NULL) > last_change_time + lp_machine_password_timeout())
global_machine_password_needs_changing = True;
ZERO_STRUCT(cli);
pserver = lp_passwordserver();
if (! *pserver) pserver = "*";
p = pserver;
while (!connected_ok &&
next_token(&p,remote_machine,LIST_SEP,sizeof(remote_machine))) {
if(strequal(remote_machine, "*")) {
connected_ok = find_connect_pdc(&cli, trust_passwd, last_change_time);
} else {
connected_ok = connect_to_domain_password_server(&cli, remote_machine, trust_passwd);
}
}
if (!connected_ok) {
DEBUG(0,("domain_client_validate: Domain password server not available.\n"));
cli_shutdown(&cli);
return False;
}
generate_random_buffer( (unsigned char *)&smb_uid_low, 4, False);
ZERO_STRUCT(info3);
status = cli_nt_login_network(&cli, domain, user, smb_uid_low, (char *)local_challenge,
((smb_apasslen != 0) ? smb_apasswd : NULL),
((smb_ntpasslen != 0) ? smb_ntpasswd : NULL),
&ctr, &info3);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(0,("domain_client_validate: unable to validate password for user %s in domain \
%s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, get_nt_error_msg(status) ));
cli_nt_session_close(&cli);
cli_ulogoff(&cli);
cli_shutdown(&cli);
if((NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NO_SUCH_USER)) && (user_exists != NULL))
*user_exists = False;
return False;
}
if (pptoken && (info3.num_groups2 != 0)) {
NT_USER_TOKEN *ptok;
int i;
DOM_SID domain_sid;
*pptoken = NULL;
if ((ptok = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL) {
DEBUG(0, ("domain_client_validate: Out of memory allocating NT_USER_TOKEN\n"));
return False;
}
ptok->num_sids = (size_t)info3.num_groups2;
if ((ptok->user_sids = (DOM_SID *)malloc( sizeof(DOM_SID) * ptok->num_sids )) == NULL) {
DEBUG(0, ("domain_client_validate: Out of memory allocating group SIDS\n"));
SAFE_FREE(ptok);
return False;
}
if (!secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
DEBUG(0, ("domain_client_validate: unable to fetch domain sid.\n"));
delete_nt_token(&ptok);
return False;
}
for (i = 0; i < ptok->num_sids; i++) {
sid_copy(&ptok->user_sids[i], &domain_sid);
sid_append_rid(&ptok->user_sids[i], info3.gids[i].g_rid);
}
*pptoken = ptok;
}
#if 0
if(cli_nt_logoff(&cli, &ctr) == False) {
DEBUG(0,("domain_client_validate: unable to log off user %s in domain \
%s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, cli_errstr(&cli)));
cli_nt_session_close(&cli);
cli_ulogoff(&cli);
cli_shutdown(&cli);
return False;
}
#endif
cli_nt_session_close(&cli);
cli_ulogoff(&cli);
cli_shutdown(&cli);
return True;
}
#ifdef DIRECTORY_SERVICE_X
BOOL pass_check_directoryservice(char *user, char *challenge, char *password)
{
tDirStatus status = eDSNoErr;
tDirReference dirRef = NULL;
tDirNodeReference userNodeRef = NULL;
BOOL result = False;
status = dsOpenDirService(&dirRef);
if (status != eDSNoErr) return False;
userNodeRef = getusernode(dirRef, user);
if (userNodeRef != NULL)
{
result =DirServicesAuthUser(dirRef, userNodeRef, user, challenge, password, kDSStdAuthSMB_NT_Key) ||
DirServicesAuthUser(dirRef, userNodeRef, user, challenge, password, kDSStdAuthSMB_LM_Key);
dsCloseDirNode( userNodeRef );
}
dsCloseDirService(dirRef);
return result;
}
tDirNodeReference getusernode(tDirReference dirRef, char *userName)
{
tDirStatus status = eDSNoErr;
long bufferSize = 2048;
long returnCount = 0;
tDataBufferPtr nodeBuffer = NULL;
tDirNodeReference searchNodeRef = NULL;
tDataListPtr searchNodeName = NULL;
tDirNodeReference userNodeRef = NULL;
tDataListPtr userNodePath = NULL;
char userNodePathStr[256] = {0};
char recUserName[128] = {0};
tDataListPtr recName = NULL;
tDataListPtr recType = NULL;
tDataListPtr attrType = NULL;
tAttributeListRef attributeListRef = 0;
tRecordEntryPtr outRecordEntryPtr = NULL;
tAttributeEntryPtr attributeInfo = NULL;
tAttributeValueListRef attributeValueListRef = 0;
tAttributeValueEntryPtr attrValue = NULL;
long i = 0;
nodeBuffer = dsDataBufferAllocate(dirRef, bufferSize);
if (nodeBuffer == NULL) goto cleanup;
status = dsFindDirNodes(dirRef, nodeBuffer, NULL, eDSSearchNodeName, &returnCount, NULL);
if ((status != eDSNoErr) || (returnCount <= 0)) goto cleanup;
searchNodeName = dsDataListAllocate(dirRef);
status = dsGetDirNodeName(dirRef, nodeBuffer, 1, &searchNodeName);
if (status != eDSNoErr) goto cleanup;
status = dsOpenDirNode(dirRef, searchNodeName, &searchNodeRef);
if (status != eDSNoErr) goto cleanup;
recName = dsBuildListFromStrings(dirRef, userName, NULL);
recType = dsBuildListFromStrings(dirRef, kDSStdRecordTypeUsers, NULL);
attrType = dsBuildListFromStrings(dirRef, kDSNAttrMetaNodeLocation, kDSNAttrRecordName, NULL);
status = dsGetRecordList(searchNodeRef, nodeBuffer, recName, eDSiExact, recType, attrType, 0, &returnCount, NULL);
if (status != eDSNoErr) goto cleanup;
status = dsGetRecordEntry(searchNodeRef, nodeBuffer, 1, &attributeListRef, &outRecordEntryPtr);
if (status == eDSNoErr)
{
for (i = 1 ; i <= outRecordEntryPtr->fRecordAttributeCount; i++)
{
status = dsGetAttributeEntry(searchNodeRef, nodeBuffer, attributeListRef, i, &attributeValueListRef, &attributeInfo);
status = dsGetAttributeValue(searchNodeRef, nodeBuffer, 1, attributeValueListRef, &attrValue);
if (attributeValueListRef != 0)
{
dsCloseAttributeValueList(attributeValueListRef);
attributeValueListRef = 0;
}
if (status == eDSNoErr)
{
if (strncmp(attributeInfo->fAttributeSignature.fBufferData, kDSNAttrMetaNodeLocation, strlen(kDSNAttrMetaNodeLocation)) == 0)
strncpy(userNodePathStr, attrValue->fAttributeValueData.fBufferData, attrValue->fAttributeValueData.fBufferSize);
else if (strncmp(attributeInfo->fAttributeSignature.fBufferData, kDSNAttrRecordName, strlen(kDSNAttrRecordName)) == 0)
strncpy(recUserName, attrValue->fAttributeValueData.fBufferData, attrValue->fAttributeValueData.fBufferSize);
}
if (attrValue != NULL) {
dsDeallocAttributeValueEntry(dirRef, attrValue);
attrValue = NULL;
}
if (attributeInfo != NULL) {
dsDeallocAttributeEntry(dirRef, attributeInfo);
attributeInfo = NULL;
}
}
if (outRecordEntryPtr != NULL) {
dsDeallocRecordEntry(dirRef, outRecordEntryPtr);
outRecordEntryPtr = NULL;
}
if (strlen(userNodePathStr) != 0 && strlen(recUserName) != 0)
{
userNodePath = dsBuildFromPath(dirRef, userNodePathStr, "/");
status = dsOpenDirNode(dirRef, userNodePath, &userNodeRef);
dsDataListDeAllocate( dirRef, userNodePath, true );
free(userNodePath);
}
}
cleanup:
if (nodeBuffer != NULL)
dsDataBufferDeAllocate(dirRef, nodeBuffer);
if (searchNodeName != NULL)
{
dsDataListDeAllocate(dirRef, searchNodeName, 0);
free(searchNodeName);
}
if (searchNodeRef != NULL)
dsCloseDirNode(searchNodeRef);
if (recName != NULL)
{
dsDataListDeAllocate(dirRef, recName, 0);
free(recName);
}
if (recType != NULL)
{
dsDataListDeAllocate(dirRef, recType, 0);
free(recType);
}
if (attrType != NULL)
{
dsDataListDeAllocate(dirRef, attrType, 0);
free(attrType);
}
return userNodeRef;
}
BOOL DirServicesAuthUser(tDirReference dirRef, tDirNodeReference userNode, char* user, char *challenge, char *password, char *inAuthMethod)
{
tDirStatus status = eDSNoErr;
unsigned long curr = 0;
unsigned long len = 0;
tDataBufferPtr authBuff = NULL;
tDataBufferPtr stepBuff = NULL;
tDataNodePtr authType = NULL;
BOOL result = False;
authBuff = dsDataBufferAllocate( dirRef, 2048 );
if ( authBuff != NULL )
{
stepBuff = dsDataBufferAllocate( dirRef, 2048 );
if ( stepBuff != NULL )
{
authType = dsDataNodeAllocateString( dirRef, inAuthMethod);
if ( authType != NULL )
{
len = strlen( user );
memcpy( &(authBuff->fBufferData[ curr ]), &len, 4 );
curr += sizeof( long );
memcpy( &(authBuff->fBufferData[ curr ]), user, len );
curr += len;
len = 8;
memcpy( &(authBuff->fBufferData[ curr ]), &len, 4 );
curr += sizeof (long );
memcpy( &(authBuff->fBufferData[ curr ]), challenge, len );
curr += len;
len = 24;
memcpy( &(authBuff->fBufferData[ curr ]), &len, 4 );
curr += sizeof (long );
memcpy( &(authBuff->fBufferData[ curr ]), password, len );
curr += len;
authBuff->fBufferLength = curr;
status = dsDoDirNodeAuth( userNode, authType, True, authBuff, stepBuff, NULL );
if ( status == eDSNoErr )
{
result = True;
DEBUG(1,("User \"%s\" authenticated successfully with \"%s\" :)\n", user, inAuthMethod ));
}
else
{
DEBUG(1,("User \"%s\" failed to authenticate with \"%s\" (%d) :(\n", user, inAuthMethod,status) );
}
}
status = dsDataBufferDeAllocate( dirRef, stepBuff );
if ( status != eDSNoErr )
{
DEBUG(1,("*** dsDataBufferDeAllocate(2) faild with error = %ld: \n", status) );
}
}
else
{
DEBUG(1,("*** dsDataBufferAllocate(2) faild with \n" ));
}
status = dsDataBufferDeAllocate( dirRef, authBuff );
if ( status != eDSNoErr )
{
DEBUG(1,( "*** dsDataBufferDeAllocate(2) faild with error = %ld: \n", status ));
}
}
else
{
DEBUG(1,("*** dsDataBufferAllocate(1) faild with \n" ));
}
return result;
}
#endif