1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
24 */
25
26 #include <unistd.h>
27 #include <strings.h>
28 #include <pwd.h>
29 #include <grp.h>
30 #include <time.h>
31 #include <syslog.h>
32 #include <assert.h>
33 #include <synch.h>
34
35 #include <smbsrv/libsmb.h>
36 #include <smbsrv/libmlsvc.h>
37
38 #include <smbsrv/smbinfo.h>
39 #include <smbsrv/smb_token.h>
40 #include <lsalib.h>
41
42 static smb_account_t smb_guest;
43 static smb_account_t smb_domusers;
44 static rwlock_t smb_logoninit_rwl;
45
46 typedef void (*smb_logonop_t)(smb_logon_t *, smb_token_t *);
47
48 static void smb_logon_local(smb_logon_t *, smb_token_t *);
49 static void smb_logon_guest(smb_logon_t *, smb_token_t *);
50 static void smb_logon_anon(smb_logon_t *, smb_token_t *);
51
52 static uint32_t smb_token_auth_local(smb_logon_t *, smb_token_t *,
53 smb_passwd_t *);
54
55 static uint32_t smb_token_setup_local(smb_passwd_t *, smb_token_t *);
56 static uint32_t smb_token_setup_guest(smb_logon_t *, smb_token_t *);
57 static uint32_t smb_token_setup_anon(smb_token_t *token);
58
59 static boolean_t smb_token_is_member(smb_token_t *, smb_sid_t *);
60 static uint32_t smb_token_setup_wingrps(smb_token_t *);
61 static smb_posix_grps_t *smb_token_create_pxgrps(uid_t);
62
63 static void smb_guest_account(char *, size_t);
64
65 /* Consolidation private function from Network Repository */
66 extern int _getgroupsbymember(const char *, gid_t[], int, int);
67
68 static idmap_stat
smb_token_idmap(smb_token_t * token,smb_idmap_batch_t * sib)69 smb_token_idmap(smb_token_t *token, smb_idmap_batch_t *sib)
70 {
71 idmap_stat stat;
72 smb_idmap_t *sim;
73 smb_id_t *id;
74 int i;
75
76 if (!token || !sib)
77 return (IDMAP_ERR_ARG);
78
79 sim = sib->sib_maps;
80
81 if (token->tkn_flags & SMB_ATF_ANON) {
82 token->tkn_user.i_id = UID_NOBODY;
83 token->tkn_owner.i_id = UID_NOBODY;
84 } else {
85 /* User SID */
86 id = &token->tkn_user;
87 sim->sim_id = &id->i_id;
88 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim++,
89 id->i_sid, SMB_IDMAP_USER);
90
91 if (stat != IDMAP_SUCCESS)
92 return (stat);
93
94 /* Owner SID */
95 id = &token->tkn_owner;
96 sim->sim_id = &id->i_id;
97 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim++,
98 id->i_sid, SMB_IDMAP_USER);
99
100 if (stat != IDMAP_SUCCESS)
101 return (stat);
102 }
103
104 /* Primary Group SID */
105 id = &token->tkn_primary_grp;
106 sim->sim_id = &id->i_id;
107 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim++, id->i_sid,
108 SMB_IDMAP_GROUP);
109
110 if (stat != IDMAP_SUCCESS)
111 return (stat);
112
113 /* Other Windows Group SIDs */
114 for (i = 0; i < token->tkn_win_grps.i_cnt; i++, sim++) {
115 id = &token->tkn_win_grps.i_ids[i];
116 sim->sim_id = &id->i_id;
117 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim,
118 id->i_sid, SMB_IDMAP_GROUP);
119
120 if (stat != IDMAP_SUCCESS)
121 break;
122 }
123
124 return (stat);
125 }
126
127 /*
128 * smb_token_sids2ids
129 *
130 * This will map all the SIDs of the access token to UIDs/GIDs.
131 *
132 * Returns 0 upon success. Otherwise, returns -1.
133 */
134 static int
smb_token_sids2ids(smb_token_t * token)135 smb_token_sids2ids(smb_token_t *token)
136 {
137 idmap_stat stat;
138 int nmaps;
139 smb_idmap_batch_t sib;
140
141 /*
142 * Number of idmap lookups: user SID, owner SID, primary group SID,
143 * and all Windows group SIDs. Skip user/owner SID for Anonymous.
144 */
145 if (token->tkn_flags & SMB_ATF_ANON)
146 nmaps = token->tkn_win_grps.i_cnt + 1;
147 else
148 nmaps = token->tkn_win_grps.i_cnt + 3;
149
150 stat = smb_idmap_batch_create(&sib, nmaps, SMB_IDMAP_SID2ID);
151 if (stat != IDMAP_SUCCESS)
152 return (-1);
153
154 stat = smb_token_idmap(token, &sib);
155 if (stat != IDMAP_SUCCESS) {
156 smb_idmap_batch_destroy(&sib);
157 return (-1);
158 }
159
160 stat = smb_idmap_batch_getmappings(&sib);
161 smb_idmap_check("smb_idmap_batch_getmappings", stat);
162 smb_idmap_batch_destroy(&sib);
163
164 return (stat == IDMAP_SUCCESS ? 0 : -1);
165 }
166
167 /*
168 * smb_token_create_pxgrps
169 *
170 * Setup the POSIX group membership of the access token if the given UID is
171 * a POSIX UID (non-ephemeral). Both the user's primary group and
172 * supplementary groups will be added to the POSIX group array of the access
173 * token.
174 */
175 static smb_posix_grps_t *
smb_token_create_pxgrps(uid_t uid)176 smb_token_create_pxgrps(uid_t uid)
177 {
178 struct passwd *pwd;
179 smb_posix_grps_t *pgrps;
180 int ngroups_max, num;
181 gid_t *gids;
182
183 if ((ngroups_max = sysconf(_SC_NGROUPS_MAX)) < 0) {
184 syslog(LOG_ERR, "smb_logon: failed to get _SC_NGROUPS_MAX");
185 return (NULL);
186 }
187
188 pwd = getpwuid(uid);
189 if (pwd == NULL) {
190 pgrps = malloc(sizeof (smb_posix_grps_t));
191 if (pgrps == NULL)
192 return (NULL);
193
194 pgrps->pg_ngrps = 0;
195 return (pgrps);
196 }
197
198 if (pwd->pw_name == NULL) {
199 pgrps = malloc(sizeof (smb_posix_grps_t));
200 if (pgrps == NULL)
201 return (NULL);
202
203 pgrps->pg_ngrps = 1;
204 pgrps->pg_grps[0] = pwd->pw_gid;
205 return (pgrps);
206 }
207
208 gids = (gid_t *)malloc(ngroups_max * sizeof (gid_t));
209 if (gids == NULL) {
210 return (NULL);
211 }
212 bzero(gids, ngroups_max * sizeof (gid_t));
213
214 gids[0] = pwd->pw_gid;
215
216 /*
217 * Setup the groups starting at index 1 (the last arg)
218 * of gids array.
219 */
220 num = _getgroupsbymember(pwd->pw_name, gids, ngroups_max, 1);
221
222 if (num == -1) {
223 syslog(LOG_ERR, "smb_logon: unable "
224 "to get user's supplementary groups");
225 num = 1;
226 }
227
228 pgrps = (smb_posix_grps_t *)malloc(SMB_POSIX_GRPS_SIZE(num));
229 if (pgrps) {
230 pgrps->pg_ngrps = num;
231 bcopy(gids, pgrps->pg_grps, num * sizeof (gid_t));
232 }
233
234 free(gids);
235 return (pgrps);
236 }
237
238 /*
239 * smb_token_destroy
240 *
241 * Release all of the memory associated with a token structure. Ensure
242 * that the token has been unlinked before calling.
243 */
244 void
smb_token_destroy(smb_token_t * token)245 smb_token_destroy(smb_token_t *token)
246 {
247 if (token != NULL) {
248 smb_sid_free(token->tkn_user.i_sid);
249 smb_sid_free(token->tkn_owner.i_sid);
250 smb_sid_free(token->tkn_primary_grp.i_sid);
251 smb_ids_free(&token->tkn_win_grps);
252 smb_privset_free(token->tkn_privileges);
253 free(token->tkn_posix_grps);
254 free(token->tkn_account_name);
255 free(token->tkn_domain_name);
256 free(token->tkn_ssnkey.val);
257 bzero(token, sizeof (smb_token_t));
258 free(token);
259 }
260 }
261
262 /*
263 * Token owner should be set to local Administrators group
264 * in two cases:
265 * 1. The logged on user is a member of Domain Admins group
266 * 2. he/she is a member of local Administrators group
267 */
268 static void
smb_token_set_owner(smb_token_t * token)269 smb_token_set_owner(smb_token_t *token)
270 {
271 #ifdef SMB_SUPPORT_GROUP_OWNER
272 smb_sid_t *owner_sid;
273
274 if (token->tkn_flags & SMB_ATF_ADMIN) {
275 owner_sid = smb_wka_get_sid("Administrators");
276 assert(owner_sid);
277 } else {
278 owner_sid = token->tkn_user->i_sid;
279 }
280
281 token->tkn_owner.i_sid = smb_sid_dup(owner_sid);
282 #endif
283 token->tkn_owner.i_sid = smb_sid_dup(token->tkn_user.i_sid);
284 }
285
286 static smb_privset_t *
smb_token_create_privs(smb_token_t * token)287 smb_token_create_privs(smb_token_t *token)
288 {
289 smb_privset_t *privs;
290 smb_giter_t gi;
291 smb_group_t grp;
292 int rc;
293
294 privs = smb_privset_new();
295 if (privs == NULL)
296 return (NULL);
297
298 if (smb_lgrp_iteropen(&gi) != SMB_LGRP_SUCCESS) {
299 smb_privset_free(privs);
300 return (NULL);
301 }
302
303 while (smb_lgrp_iterate(&gi, &grp) == SMB_LGRP_SUCCESS) {
304 if (smb_lgrp_is_member(&grp, token->tkn_user.i_sid))
305 smb_privset_merge(privs, grp.sg_privs);
306 smb_lgrp_free(&grp);
307 }
308 smb_lgrp_iterclose(&gi);
309
310 if (token->tkn_flags & SMB_ATF_ADMIN) {
311 char admgrp[] = "Administrators";
312
313 rc = smb_lgrp_getbyname(admgrp, &grp);
314 if (rc == SMB_LGRP_SUCCESS) {
315 smb_privset_merge(privs, grp.sg_privs);
316 smb_lgrp_free(&grp);
317 }
318
319 /*
320 * This privilege is required to view/edit SACL
321 */
322 smb_privset_enable(privs, SE_SECURITY_LUID);
323 }
324
325 return (privs);
326 }
327
328 static void
smb_token_set_flags(smb_token_t * token)329 smb_token_set_flags(smb_token_t *token)
330 {
331 if (smb_token_is_member(token, smb_wka_get_sid("Administrators")))
332 token->tkn_flags |= SMB_ATF_ADMIN;
333
334 if (smb_token_is_member(token, smb_wka_get_sid("Power Users")))
335 token->tkn_flags |= SMB_ATF_POWERUSER;
336
337 if (smb_token_is_member(token, smb_wka_get_sid("Backup Operators")))
338 token->tkn_flags |= SMB_ATF_BACKUPOP;
339 }
340
341 /*
342 * Common token setup for both local and domain users.
343 * This function must be called after the initial setup
344 * has been done.
345 *
346 * Note that the order of calls in this function are important.
347 *
348 * Returns B_TRUE for success.
349 */
350 boolean_t
smb_token_setup_common(smb_token_t * token)351 smb_token_setup_common(smb_token_t *token)
352 {
353 smb_token_set_flags(token);
354
355 smb_token_set_owner(token);
356 if (token->tkn_owner.i_sid == NULL)
357 return (B_FALSE);
358
359 /* Privileges */
360 token->tkn_privileges = smb_token_create_privs(token);
361 if (token->tkn_privileges == NULL)
362 return (B_FALSE);
363
364 if (smb_token_sids2ids(token) != 0) {
365 syslog(LOG_ERR, "%s\\%s: idmap failed",
366 token->tkn_domain_name, token->tkn_account_name);
367 return (B_FALSE);
368 }
369
370 /* Solaris Groups */
371 token->tkn_posix_grps = smb_token_create_pxgrps(token->tkn_user.i_id);
372
373 return (smb_token_valid(token));
374 }
375
376 uint32_t
smb_logon_init(void)377 smb_logon_init(void)
378 {
379 uint32_t status;
380
381 (void) rw_wrlock(&smb_logoninit_rwl);
382 status = smb_sam_lookup_name(NULL, "guest", SidTypeUser, &smb_guest);
383 if (status != NT_STATUS_SUCCESS) {
384 (void) rw_unlock(&smb_logoninit_rwl);
385 return (status);
386 }
387
388 status = smb_sam_lookup_name(NULL, "domain users", SidTypeGroup,
389 &smb_domusers);
390 if (status != NT_STATUS_SUCCESS) {
391 smb_account_free(&smb_guest);
392 bzero(&smb_guest, sizeof (smb_account_t));
393 (void) rw_unlock(&smb_logoninit_rwl);
394 return (status);
395 }
396
397 (void) rw_unlock(&smb_logoninit_rwl);
398 return (status);
399 }
400
401 void
smb_logon_fini(void)402 smb_logon_fini(void)
403 {
404 (void) rw_wrlock(&smb_logoninit_rwl);
405 smb_account_free(&smb_guest);
406 smb_account_free(&smb_domusers);
407 bzero(&smb_guest, sizeof (smb_account_t));
408 bzero(&smb_domusers, sizeof (smb_account_t));
409 (void) rw_unlock(&smb_logoninit_rwl);
410 }
411
412 /*
413 * Perform user authentication.
414 *
415 * The dispatched functions must only update the user_info status if they
416 * attempt to authenticate the user.
417 *
418 * On success, a pointer to a new access token is returned.
419 */
420 smb_token_t *
smb_logon(smb_logon_t * user_info)421 smb_logon(smb_logon_t *user_info)
422 {
423 static smb_logonop_t ops[] = {
424 smb_logon_anon,
425 smb_logon_local,
426 smb_logon_domain,
427 smb_logon_guest
428 };
429 smb_token_t *token = NULL;
430 smb_domain_t domain;
431 int n_op = (sizeof (ops) / sizeof (ops[0]));
432 int i;
433
434 user_info->lg_secmode = smb_config_get_secmode();
435 user_info->lg_status = NT_STATUS_NO_SUCH_USER;
436
437 if (smb_domain_lookup_name(user_info->lg_e_domain, &domain))
438 user_info->lg_domain_type = domain.di_type;
439 else
440 user_info->lg_domain_type = SMB_DOMAIN_NULL;
441
442 if ((token = calloc(1, sizeof (smb_token_t))) == NULL) {
443 syslog(LOG_ERR, "logon[%s\\%s]: %m",
444 user_info->lg_e_domain, user_info->lg_e_username);
445 return (NULL);
446 }
447
448 for (i = 0; i < n_op; ++i) {
449 (*ops[i])(user_info, token);
450
451 if (user_info->lg_status == NT_STATUS_SUCCESS)
452 break;
453 }
454
455 if (user_info->lg_status == NT_STATUS_SUCCESS) {
456 if (smb_token_setup_common(token))
457 return (token);
458 }
459
460 smb_token_destroy(token);
461 return (NULL);
462 }
463
464 /*
465 * If the user has an entry in the local database, attempt local authentication.
466 *
467 * In domain mode, we try to exclude domain accounts, which we do by only
468 * accepting local or null (blank) domain names here. Some clients (Mac OS)
469 * don't always send the domain name.
470 *
471 * If we are not going to attempt authentication, this function must return
472 * without updating the status.
473 */
474 static void
smb_logon_local(smb_logon_t * user_info,smb_token_t * token)475 smb_logon_local(smb_logon_t *user_info, smb_token_t *token)
476 {
477 char guest[SMB_USERNAME_MAXLEN];
478 smb_passwd_t smbpw;
479 uint32_t status;
480
481 if (user_info->lg_secmode == SMB_SECMODE_DOMAIN) {
482 if ((user_info->lg_domain_type != SMB_DOMAIN_LOCAL) &&
483 (user_info->lg_domain_type != SMB_DOMAIN_NULL))
484 return;
485 }
486
487 /*
488 * If the requested account name is "guest" (or whatever
489 * our guest account is named) then don't handle it here.
490 * Let this request fall through to smb_logon_guest().
491 */
492 smb_guest_account(guest, SMB_USERNAME_MAXLEN);
493 if (smb_strcasecmp(guest, user_info->lg_e_username, 0) == 0)
494 return;
495
496 status = smb_token_auth_local(user_info, token, &smbpw);
497 if (status == NT_STATUS_SUCCESS)
498 status = smb_token_setup_local(&smbpw, token);
499
500 user_info->lg_status = status;
501 }
502
503 /*
504 * Guest authentication. This may be a local guest account or the guest
505 * account may be mapped to a local account. These accounts are regular
506 * accounts with normal password protection.
507 *
508 * Only proceed with a guest logon if previous logon options have resulted
509 * in NO_SUCH_USER.
510 *
511 * If we are not going to attempt authentication, this function must return
512 * without updating the status.
513 */
514 static void
smb_logon_guest(smb_logon_t * user_info,smb_token_t * token)515 smb_logon_guest(smb_logon_t *user_info, smb_token_t *token)
516 {
517 char guest[SMB_USERNAME_MAXLEN];
518 smb_passwd_t smbpw;
519 char *temp;
520
521 if (user_info->lg_status != NT_STATUS_NO_SUCH_USER)
522 return;
523
524 /* Get the name of the guest account. */
525 smb_guest_account(guest, SMB_USERNAME_MAXLEN);
526
527 /* Does the guest account exist? */
528 if (smb_pwd_getpwnam(guest, &smbpw) == NULL)
529 return;
530
531 /* Is it enabled? (empty p/w is OK) */
532 if (smbpw.pw_flags & SMB_PWF_DISABLE)
533 return;
534
535 /*
536 * OK, give the client a guest logon. Note that on entry,
537 * lg_e_username is typically something other than "guest"
538 * so we need to set the effective username when createing
539 * the guest token.
540 */
541 temp = user_info->lg_e_username;
542 user_info->lg_e_username = guest;
543 user_info->lg_status = smb_token_setup_guest(user_info, token);
544 user_info->lg_e_username = temp;
545 }
546
547 /*
548 * If user_info represents an anonymous user then setup the token.
549 * Otherwise return without updating the status.
550 */
551 static void
smb_logon_anon(smb_logon_t * user_info,smb_token_t * token)552 smb_logon_anon(smb_logon_t *user_info, smb_token_t *token)
553 {
554 if (user_info->lg_flags & SMB_ATF_ANON)
555 user_info->lg_status = smb_token_setup_anon(token);
556 }
557
558 /*
559 * Try both LM hash and NT hashes with user's password(s) to authenticate
560 * the user.
561 */
562 static uint32_t
smb_token_auth_local(smb_logon_t * user_info,smb_token_t * token,smb_passwd_t * smbpw)563 smb_token_auth_local(smb_logon_t *user_info, smb_token_t *token,
564 smb_passwd_t *smbpw)
565 {
566 boolean_t ok;
567 uint32_t status = NT_STATUS_SUCCESS;
568
569 if (smb_pwd_getpwnam(user_info->lg_e_username, smbpw) == NULL)
570 return (NT_STATUS_NO_SUCH_USER);
571
572 if (smbpw->pw_flags & SMB_PWF_DISABLE)
573 return (NT_STATUS_ACCOUNT_DISABLED);
574
575 if ((smbpw->pw_flags & (SMB_PWF_LM | SMB_PWF_NT)) == 0) {
576 /*
577 * The SMB passwords have not been set.
578 * Return an error that suggests the
579 * password needs to be set.
580 */
581 return (NT_STATUS_PASSWORD_EXPIRED);
582 }
583
584 token->tkn_ssnkey.val = malloc(SMBAUTH_SESSION_KEY_SZ);
585 if (token->tkn_ssnkey.val == NULL)
586 return (NT_STATUS_NO_MEMORY);
587 token->tkn_ssnkey.len = SMBAUTH_SESSION_KEY_SZ;
588
589 ok = smb_auth_validate(
590 smbpw,
591 user_info->lg_domain,
592 user_info->lg_username,
593 user_info->lg_challenge_key.val,
594 user_info->lg_challenge_key.len,
595 user_info->lg_nt_password.val,
596 user_info->lg_nt_password.len,
597 user_info->lg_lm_password.val,
598 user_info->lg_lm_password.len,
599 token->tkn_ssnkey.val);
600 if (ok)
601 return (NT_STATUS_SUCCESS);
602
603 free(token->tkn_ssnkey.val);
604 token->tkn_ssnkey.val = NULL;
605 token->tkn_ssnkey.len = 0;
606
607 status = NT_STATUS_WRONG_PASSWORD;
608 syslog(LOG_NOTICE, "logon[%s\\%s]: %s",
609 user_info->lg_e_domain, user_info->lg_e_username,
610 xlate_nt_status(status));
611
612 return (status);
613 }
614
615 /*
616 * Setup an access token for the specified local user.
617 */
618 static uint32_t
smb_token_setup_local(smb_passwd_t * smbpw,smb_token_t * token)619 smb_token_setup_local(smb_passwd_t *smbpw, smb_token_t *token)
620 {
621 idmap_stat stat;
622 smb_idmap_batch_t sib;
623 smb_idmap_t *umap, *gmap;
624 struct passwd pw;
625 char pwbuf[1024];
626 char nbname[NETBIOS_NAME_SZ];
627
628 (void) smb_getnetbiosname(nbname, sizeof (nbname));
629 token->tkn_account_name = strdup(smbpw->pw_name);
630 token->tkn_domain_name = strdup(nbname);
631
632 if (token->tkn_account_name == NULL ||
633 token->tkn_domain_name == NULL)
634 return (NT_STATUS_NO_MEMORY);
635
636 if (getpwuid_r(smbpw->pw_uid, &pw, pwbuf, sizeof (pwbuf)) == NULL)
637 return (NT_STATUS_NO_SUCH_USER);
638
639 /* Get the SID for user's uid & gid */
640 stat = smb_idmap_batch_create(&sib, 2, SMB_IDMAP_ID2SID);
641 if (stat != IDMAP_SUCCESS)
642 return (NT_STATUS_INTERNAL_ERROR);
643
644 umap = &sib.sib_maps[0];
645 stat = smb_idmap_batch_getsid(sib.sib_idmaph, umap, pw.pw_uid,
646 SMB_IDMAP_USER);
647
648 if (stat != IDMAP_SUCCESS) {
649 smb_idmap_batch_destroy(&sib);
650 return (NT_STATUS_INTERNAL_ERROR);
651 }
652
653 gmap = &sib.sib_maps[1];
654 stat = smb_idmap_batch_getsid(sib.sib_idmaph, gmap, pw.pw_gid,
655 SMB_IDMAP_GROUP);
656
657 if (stat != IDMAP_SUCCESS) {
658 smb_idmap_batch_destroy(&sib);
659 return (NT_STATUS_INTERNAL_ERROR);
660 }
661
662 if (smb_idmap_batch_getmappings(&sib) != IDMAP_SUCCESS)
663 return (NT_STATUS_INTERNAL_ERROR);
664
665 token->tkn_user.i_sid = smb_sid_dup(umap->sim_sid);
666 token->tkn_primary_grp.i_sid = smb_sid_dup(gmap->sim_sid);
667
668 smb_idmap_batch_destroy(&sib);
669
670 if (token->tkn_user.i_sid == NULL ||
671 token->tkn_primary_grp.i_sid == NULL)
672 return (NT_STATUS_NO_MEMORY);
673
674 return (smb_token_setup_wingrps(token));
675 }
676
677 /*
678 * Setup access token for guest connections
679 */
680 static uint32_t
smb_token_setup_guest(smb_logon_t * user_info,smb_token_t * token)681 smb_token_setup_guest(smb_logon_t *user_info, smb_token_t *token)
682 {
683 token->tkn_account_name = strdup(user_info->lg_e_username);
684
685 (void) rw_rdlock(&smb_logoninit_rwl);
686 token->tkn_domain_name = strdup(smb_guest.a_domain);
687 token->tkn_user.i_sid = smb_sid_dup(smb_guest.a_sid);
688 token->tkn_primary_grp.i_sid = smb_sid_dup(smb_domusers.a_sid);
689 (void) rw_unlock(&smb_logoninit_rwl);
690 token->tkn_flags = SMB_ATF_GUEST;
691
692 if (token->tkn_account_name == NULL ||
693 token->tkn_domain_name == NULL ||
694 token->tkn_user.i_sid == NULL ||
695 token->tkn_primary_grp.i_sid == NULL)
696 return (NT_STATUS_NO_MEMORY);
697
698 return (smb_token_setup_wingrps(token));
699 }
700
701 /*
702 * Setup access token for anonymous connections
703 */
704 static uint32_t
smb_token_setup_anon(smb_token_t * token)705 smb_token_setup_anon(smb_token_t *token)
706 {
707 smb_sid_t *user_sid;
708
709 token->tkn_account_name = strdup("Anonymous");
710 token->tkn_domain_name = strdup("NT Authority");
711 user_sid = smb_wka_get_sid("Anonymous");
712 token->tkn_user.i_sid = smb_sid_dup(user_sid);
713 token->tkn_primary_grp.i_sid = smb_sid_dup(user_sid);
714 token->tkn_flags = SMB_ATF_ANON;
715
716 if (token->tkn_account_name == NULL ||
717 token->tkn_domain_name == NULL ||
718 token->tkn_user.i_sid == NULL ||
719 token->tkn_primary_grp.i_sid == NULL)
720 return (NT_STATUS_NO_MEMORY);
721
722 return (smb_token_setup_wingrps(token));
723 }
724
725 /*
726 * smb_token_user_sid
727 *
728 * Return a pointer to the user SID in the specified token. A null
729 * pointer indicates an error.
730 */
731 static smb_sid_t *
smb_token_user_sid(smb_token_t * token)732 smb_token_user_sid(smb_token_t *token)
733 {
734 return ((token) ? token->tkn_user.i_sid : NULL);
735 }
736
737 /*
738 * smb_token_group_sid
739 *
740 * Return a pointer to the group SID as indicated by the iterator.
741 * Setting the iterator to 0 before calling this function will return
742 * the first group, which will always be the primary group. The
743 * iterator will be incremented before returning the SID so that this
744 * function can be used to cycle through the groups. The caller can
745 * adjust the iterator as required between calls to obtain any specific
746 * group.
747 *
748 * On success a pointer to the appropriate group SID will be returned.
749 * Otherwise a null pointer will be returned.
750 */
751 static smb_sid_t *
smb_token_group_sid(smb_token_t * token,int * iterator)752 smb_token_group_sid(smb_token_t *token, int *iterator)
753 {
754 int index;
755
756 if (token == NULL || iterator == NULL)
757 return (NULL);
758
759 if (token->tkn_win_grps.i_ids == NULL)
760 return (NULL);
761
762 index = *iterator;
763
764 if (index < 0 || index >= token->tkn_win_grps.i_cnt)
765 return (NULL);
766
767 ++(*iterator);
768 return (token->tkn_win_grps.i_ids[index].i_sid);
769 }
770
771 /*
772 * smb_token_is_member
773 *
774 * This function will determine whether or not the specified SID is a
775 * member of a token. The user SID and all group SIDs are tested.
776 * Returns 1 if the SID is a member of the token. Otherwise returns 0.
777 */
778 static boolean_t
smb_token_is_member(smb_token_t * token,smb_sid_t * sid)779 smb_token_is_member(smb_token_t *token, smb_sid_t *sid)
780 {
781 smb_sid_t *tsid;
782 int iterator = 0;
783
784 if (token == NULL || sid == NULL)
785 return (B_FALSE);
786
787 tsid = smb_token_user_sid(token);
788 while (tsid) {
789 if (smb_sid_cmp(tsid, sid))
790 return (B_TRUE);
791
792 tsid = smb_token_group_sid(token, &iterator);
793 }
794
795 return (B_FALSE);
796 }
797
798 /*
799 * smb_token_log
800 *
801 * Diagnostic routine to write the contents of a token to the log.
802 */
803 void
smb_token_log(smb_token_t * token)804 smb_token_log(smb_token_t *token)
805 {
806 smb_ids_t *w_grps;
807 smb_id_t *grp;
808 smb_posix_grps_t *x_grps;
809 char sidstr[SMB_SID_STRSZ];
810 int i;
811
812 if (token == NULL)
813 return;
814
815 syslog(LOG_DEBUG, "Token for %s\\%s",
816 (token->tkn_domain_name) ? token->tkn_domain_name : "-NULL-",
817 (token->tkn_account_name) ? token->tkn_account_name : "-NULL-");
818
819 syslog(LOG_DEBUG, " User->Attr: %d", token->tkn_user.i_attrs);
820 smb_sid_tostr((smb_sid_t *)token->tkn_user.i_sid, sidstr);
821 syslog(LOG_DEBUG, " User->Sid: %s (id=%u)", sidstr,
822 token->tkn_user.i_id);
823
824 smb_sid_tostr((smb_sid_t *)token->tkn_owner.i_sid, sidstr);
825 syslog(LOG_DEBUG, " Ownr->Sid: %s (id=%u)",
826 sidstr, token->tkn_owner.i_id);
827
828 smb_sid_tostr((smb_sid_t *)token->tkn_primary_grp.i_sid, sidstr);
829 syslog(LOG_DEBUG, " PGrp->Sid: %s (id=%u)",
830 sidstr, token->tkn_primary_grp.i_id);
831
832 w_grps = &token->tkn_win_grps;
833 if (w_grps->i_ids) {
834 syslog(LOG_DEBUG, " Windows groups: %d", w_grps->i_cnt);
835 grp = w_grps->i_ids;
836 for (i = 0; i < w_grps->i_cnt; ++i, grp++) {
837 syslog(LOG_DEBUG,
838 " Grp[%d].Attr:%d", i, grp->i_attrs);
839 if (grp->i_sid != NULL) {
840 smb_sid_tostr((smb_sid_t *)grp->i_sid, sidstr);
841 syslog(LOG_DEBUG,
842 " Grp[%d].Sid: %s (id=%u)", i, sidstr,
843 grp->i_id);
844 }
845 }
846 } else {
847 syslog(LOG_DEBUG, " No Windows groups");
848 }
849
850 x_grps = token->tkn_posix_grps;
851 if (x_grps) {
852 syslog(LOG_DEBUG, " Solaris groups: %d", x_grps->pg_ngrps);
853 for (i = 0; i < x_grps->pg_ngrps; i++)
854 syslog(LOG_DEBUG, " %u", x_grps->pg_grps[i]);
855 } else {
856 syslog(LOG_DEBUG, " No Solaris groups");
857 }
858
859 if (token->tkn_privileges)
860 smb_privset_log(token->tkn_privileges);
861 else
862 syslog(LOG_DEBUG, " No privileges");
863 }
864
865 /*
866 * Sets up local and well-known group membership for the given
867 * token. Two assumptions have been made here:
868 *
869 * a) token already contains a valid user SID so that group
870 * memberships can be established
871 *
872 * b) token belongs to a local or anonymous user
873 */
874 static uint32_t
smb_token_setup_wingrps(smb_token_t * token)875 smb_token_setup_wingrps(smb_token_t *token)
876 {
877 smb_ids_t tkn_grps;
878 uint32_t status;
879
880
881 /*
882 * We always want the user's primary group in the list
883 * of groups.
884 */
885 tkn_grps.i_cnt = 1;
886 if ((tkn_grps.i_ids = malloc(sizeof (smb_id_t))) == NULL)
887 return (NT_STATUS_NO_MEMORY);
888
889 tkn_grps.i_ids->i_sid = smb_sid_dup(token->tkn_primary_grp.i_sid);
890 tkn_grps.i_ids->i_attrs = token->tkn_primary_grp.i_attrs;
891 if (tkn_grps.i_ids->i_sid == NULL) {
892 smb_ids_free(&tkn_grps);
893 return (NT_STATUS_NO_MEMORY);
894 }
895
896 status = smb_sam_usr_groups(token->tkn_user.i_sid, &tkn_grps);
897 if (status != NT_STATUS_SUCCESS) {
898 smb_ids_free(&tkn_grps);
899 return (status);
900 }
901
902 status = smb_wka_token_groups(token->tkn_flags, &tkn_grps);
903 if (status != NT_STATUS_SUCCESS) {
904 smb_ids_free(&tkn_grps);
905 return (status);
906 }
907
908 token->tkn_win_grps = tkn_grps;
909 return (status);
910 }
911
912 /*
913 * Returns the guest account name in the provided buffer.
914 *
915 * By default the name would be "guest" unless there's
916 * a idmap name-based rule which maps the guest to a local
917 * Solaris user in which case the name of that user is
918 * returned.
919 */
920 static void
smb_guest_account(char * guest,size_t buflen)921 smb_guest_account(char *guest, size_t buflen)
922 {
923 idmap_stat stat;
924 uid_t guest_uid;
925 struct passwd pw;
926 char pwbuf[1024];
927 int idtype;
928
929 /* default Guest account name */
930 (void) rw_rdlock(&smb_logoninit_rwl);
931 (void) strlcpy(guest, smb_guest.a_name, buflen);
932
933 idtype = SMB_IDMAP_USER;
934 stat = smb_idmap_getid(smb_guest.a_sid, &guest_uid, &idtype);
935 (void) rw_unlock(&smb_logoninit_rwl);
936
937 if (stat != IDMAP_SUCCESS)
938 return;
939
940 /* If Ephemeral ID return the default name */
941 if (IDMAP_ID_IS_EPHEMERAL(guest_uid))
942 return;
943
944 if (getpwuid_r(guest_uid, &pw, pwbuf, sizeof (pwbuf)) == NULL)
945 return;
946
947 (void) strlcpy(guest, pw.pw_name, buflen);
948 }
949