winbindd_pam.c

samba-3.0.22.tar.gz 编译smb服务器的源码

	state->response.data.auth.pam_error = nt_status_to_pam(result);

	DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n", 
	      state->request.data.auth.user, 
	      state->response.data.auth.nt_status_string,
	      state->response.data.auth.pam_error));	      

	if ( NT_STATUS_IS_OK(result) &&
	     (state->request.flags & WBFLAG_PAM_AFS_TOKEN) ) {

		char *afsname = talloc_strdup(state->mem_ctx,
					      lp_afs_username_map());
		char *cell;

		if (afsname == NULL) {
			goto no_token;
		}

		afsname = talloc_string_sub(state->mem_ctx,
					    lp_afs_username_map(),
					    "%D", name_domain);
		afsname = talloc_string_sub(state->mem_ctx, afsname,
					    "%u", name_user);
		afsname = talloc_string_sub(state->mem_ctx, afsname,
					    "%U", name_user);

		{
			DOM_SID user_sid;
			fstring sidstr;

			sid_copy(&user_sid, &info3.dom_sid.sid);
			sid_append_rid(&user_sid, info3.user_rid);
			sid_to_string(sidstr, &user_sid);
			afsname = talloc_string_sub(state->mem_ctx, afsname,
						    "%s", sidstr);
		}

		if (afsname == NULL) {
			goto no_token;
		}

		strlower_m(afsname);

		DEBUG(10, ("Generating token for user %s\n", afsname));

		cell = strchr(afsname, '@');

		if (cell == NULL) {
			goto no_token;
		}

		*cell = '\0';
		cell += 1;

		/* Append an AFS token string */
		state->response.extra_data =
			afs_createtoken_str(afsname, cell);

		if (state->response.extra_data != NULL)
			state->response.length +=
				strlen(state->response.extra_data)+1;

	no_token:
		talloc_free(afsname);
	}
		
	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
}

/**********************************************************************
 Challenge Response Authentication Protocol 
**********************************************************************/

void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
{
	struct winbindd_domain *domain = NULL;
	const char *domain_name = NULL;
	NTSTATUS result;

	if (!state->privileged) {
		char *error_string = NULL;
		DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
			  "denied.  !\n"));
		DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
			     "on %s are set correctly.\n",
			     get_winbind_priv_pipe_dir()));
		/* send a better message than ACCESS_DENIED */
		error_string = talloc_asprintf(state->mem_ctx,
					       "winbind client not authorized "
					       "to use winbindd_pam_auth_crap."
					       " Ensure permissions on %s "
					       "are set correctly.",
					       get_winbind_priv_pipe_dir());
		fstrcpy(state->response.data.auth.error_string, error_string);
		result = NT_STATUS_ACCESS_DENIED;
		goto done;
	}

	/* Ensure null termination */
	state->request.data.auth_crap.user
		[sizeof(state->request.data.auth_crap.user)-1]=0;
	state->request.data.auth_crap.domain
		[sizeof(state->request.data.auth_crap.domain)-1]=0;

	DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
		  (unsigned long)state->pid,
		  state->request.data.auth_crap.domain,
		  state->request.data.auth_crap.user));

	if (*state->request.data.auth_crap.domain != '\0') {
		domain_name = state->request.data.auth_crap.domain;
	} else if (lp_winbind_use_default_domain()) {
		domain_name = lp_workgroup();
	}

	if (domain_name != NULL)
		domain = find_auth_domain(domain_name);

	if (domain != NULL) {
		sendto_domain(state, domain);
		return;
	}

	result = NT_STATUS_NO_SUCH_USER;

 done:
	set_auth_errors(&state->response, result);
	DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
		  state->request.data.auth_crap.domain,
		  state->request.data.auth_crap.user, 
		  state->response.data.auth.nt_status_string,
		  state->response.data.auth.pam_error));
	request_error(state);
	return;
}


enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
						 struct winbindd_cli_state *state) 
{
	NTSTATUS result;
        NET_USER_INFO_3 info3;
	struct rpc_pipe_client *netlogon_pipe;
	const char *name_user = NULL;
	const char *name_domain = NULL;
	const char *workstation;
	struct winbindd_domain *contact_domain;
	int attempts = 0;
	BOOL retry;

	DATA_BLOB lm_resp, nt_resp;

	/* This is child-only, so no check for privileged access is needed
	   anymore */

	/* Ensure null termination */
	state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
	state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;

	name_user = state->request.data.auth_crap.user;

	if (*state->request.data.auth_crap.domain) {
		name_domain = state->request.data.auth_crap.domain;
	} else if (lp_winbind_use_default_domain()) {
		name_domain = lp_workgroup();
	} else {
		DEBUG(5,("no domain specified with username (%s) - failing auth\n", 
			 name_user));
		result = NT_STATUS_NO_SUCH_USER;
		goto done;
	}

	DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
		  name_domain, name_user));
	   
	if (*state->request.data.auth_crap.workstation) {
		workstation = state->request.data.auth_crap.workstation;
	} else {
		workstation = global_myname();
	}

	if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
		|| state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
		DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n", 
			  state->request.data.auth_crap.lm_resp_len, 
			  state->request.data.auth_crap.nt_resp_len));
		result = NT_STATUS_INVALID_PARAMETER;
		goto done;
	}

	lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
					state->request.data.auth_crap.lm_resp_len);
	nt_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.nt_resp,
					state->request.data.auth_crap.nt_resp_len);

	/* what domain should we contact? */
	
	if ( IS_DC ) {
		if (!(contact_domain = find_domain_from_name(name_domain))) {
			DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n", 
				  state->request.data.auth_crap.user, name_domain, name_user, name_domain)); 
			result = NT_STATUS_NO_SUCH_USER;
			goto done;
		}
	} else {
		if (is_myname(name_domain)) {
			DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
			result =  NT_STATUS_NO_SUCH_USER;
			goto done;
		}
		contact_domain = find_our_domain();
	}

	do {
		ZERO_STRUCT(info3);
		retry = False;

		result = cm_connect_netlogon(contact_domain, &netlogon_pipe);

		if (!NT_STATUS_IS_OK(result)) {
			DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
				  nt_errstr(result)));
			goto done;
		}

		result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
							   state->mem_ctx,
							   state->request.data.auth_crap.logon_parameters,
							   contact_domain->dcname,
							   name_user,
							   name_domain, 
									/* Bug #3248 - found by Stefan Burkei. */
							   workstation, /* We carefully set this above so use it... */
							   state->request.data.auth_crap.chal,
							   lm_resp,
							   nt_resp,
							   &info3);

		attempts += 1;

		/* We have to try a second time as cm_connect_netlogon
		   might not yet have noticed that the DC has killed
		   our connection. */

		if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
			retry = True;
			continue;
		}

		/* if we get access denied, a possible cause was that we had and open
		   connection to the DC, but someone changed our machine account password
		   out from underneath us using 'net rpc changetrustpw' */
		   
		if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
			DEBUG(3,("winbindd_pam_auth: sam_logon returned "
				 "ACCESS_DENIED.  Maybe the trust account "
				"password was changed and we didn't know it. "
				 "Killing connections to domain %s\n",
				name_domain));
			invalidate_cm_connection(&contact_domain->conn);
			retry = True;
		} 

	} while ( (attempts < 2) && retry );

	if (NT_STATUS_IS_OK(result)) {
		netsamlogon_cache_store(name_user, &info3);
		wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3);

		/* Check if the user is in the right group */

		if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3,
							state->request.data.auth_crap.require_membership_of_sid))) {
			DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
				  state->request.data.auth_crap.user, 
				  state->request.data.auth_crap.require_membership_of_sid));
			goto done;
		}

		if (state->request.flags & WBFLAG_PAM_INFO3_NDR) {
			result = append_info3_as_ndr(state->mem_ctx, state, &info3);
		} else if (state->request.flags & WBFLAG_PAM_UNIX_NAME) {
			/* ntlm_auth should return the unix username, per 
			   'winbind use default domain' settings and the like */

			fstring username_out;
			const char *nt_username, *nt_domain;
			if (!(nt_username = unistr2_tdup(state->mem_ctx, &(info3.uni_user_name)))) {
				/* If the server didn't give us one, just use the one we sent them */
				nt_username = name_user;
			}

			if (!(nt_domain = unistr2_tdup(state->mem_ctx, &(info3.uni_logon_dom)))) {
				/* If the server didn't give us one, just use the one we sent them */
				nt_domain = name_domain;
			}

			fill_domain_username(username_out, nt_domain, nt_username);

			DEBUG(5, ("Setting unix username to [%s]\n", username_out));

			state->response.extra_data = SMB_STRDUP(username_out);
			if (!state->response.extra_data) {
				result = NT_STATUS_NO_MEMORY;
				goto done;
			}
			state->response.length +=  strlen(state->response.extra_data)+1;
		}
		
		if (state->request.flags & WBFLAG_PAM_USER_SESSION_KEY) {
			memcpy(state->response.data.auth.user_session_key, info3.user_sess_key,
					sizeof(state->response.data.auth.user_session_key) /* 16 */);
		}
		if (state->request.flags & WBFLAG_PAM_LMKEY) {
			memcpy(state->response.data.auth.first_8_lm_hash, info3.lm_sess_key,
					sizeof(state->response.data.auth.first_8_lm_hash) /* 8 */);
		}
	}

done:

	/* give us a more useful (more correct?) error code */
	if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
				(NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
		result = NT_STATUS_NO_LOGON_SERVERS;
	}

	if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
		result = nt_status_squash(result);
	}

	state->response.data.auth.nt_status = NT_STATUS_V(result);
	fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));

	/* we might have given a more useful error above */
	if (!*state->response.data.auth.error_string) {
		fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
	}
	state->response.data.auth.pam_error = nt_status_to_pam(result);

	DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, 
	      ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n", 
	       name_domain,
	       name_user,
	       state->response.data.auth.nt_status_string,
	       state->response.data.auth.pam_error));	      

	return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
}

/* Change a user password */

void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
{
	NTSTATUS result;
	char *oldpass, *newpass;
	fstring domain, user;
	POLICY_HND dom_pol;
	struct winbindd_domain *contact_domain;
	struct rpc_pipe_client *cli;

	DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
		state->request.data.chauthtok.user));

	/* Setup crap */

	parse_domain_user(state->request.data.chauthtok.user, domain, user);

	if (!(contact_domain = find_domain_from_name(domain))) {
		DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n", 
			  state->request.data.chauthtok.user, domain, user, domain)); 
		result = NT_STATUS_NO_SUCH_USER;
		goto done;
	}

	/* Change password */

	oldpass = state->request.data.chauthtok.oldpass;
	newpass = state->request.data.chauthtok.newpass;

	/* Get sam handle */

	result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
				&dom_pol);
	if (!NT_STATUS_IS_OK(result)) {
		DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
		goto done;
	}

	result = rpccli_samr_chgpasswd_user(cli, state->mem_ctx, user, newpass,
					    oldpass);

done:    
	state->response.data.auth.nt_status = NT_STATUS_V(result);
	fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
	fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
	state->response.data.auth.pam_error = nt_status_to_pam(result);

	DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, 
	      ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n", 
	       domain,
	       user,
	       state->response.data.auth.nt_status_string,
	       state->response.data.auth.pam_error));	      

	if (NT_STATUS_IS_OK(result))
		request_ok(state);
	else
		request_error(state);
}