Line data    Source code

       1             : /*
       2             :    Unix SMB/CIFS implementation.
       3             : 
       4             :    Winbind daemon - cached credentials functions
       5             : 
       6             :    Copyright (C) Guenther Deschner 2005
       7             : 
       8             :    This program is free software; you can redistribute it and/or modify
       9             :    it under the terms of the GNU General Public License as published by
      10             :    the Free Software Foundation; either version 3 of the License, or
      11             :    (at your option) any later version.
      12             : 
      13             :    This program is distributed in the hope that it will be useful,
      14             :    but WITHOUT ANY WARRANTY; without even the implied warranty of
      15             :    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      16             :    GNU General Public License for more details.
      17             : 
      18             :    You should have received a copy of the GNU General Public License
      19             :    along with this program.  If not, see <http://www.gnu.org/licenses/>.
      20             : */
      21             : 
      22             : #include "includes.h"
      23             : #include "winbindd.h"
      24             : #include "../libcli/auth/libcli_auth.h"
      25             : #include "../libcli/security/security.h"
      26             : #include "libsmb/samlogon_cache.h"
      27             : #undef DBGC_CLASS
      28             : #define DBGC_CLASS DBGC_WINBIND
      29             : 
      30             : #define MAX_CACHED_LOGINS 10
      31             : 
      32           0 : NTSTATUS winbindd_get_creds(struct winbindd_domain *domain,
      33             :                             TALLOC_CTX *mem_ctx,
      34             :                             const struct dom_sid *sid,
      35             :                             struct netr_SamInfo3 **info3,
      36             :                             const uint8_t **cached_nt_pass,
      37             :                             const uint8_t **cred_salt)
      38             : {
      39           0 :         struct netr_SamInfo3 *info;
      40           0 :         NTSTATUS status;
      41             : 
      42           0 :         status = wcache_get_creds(domain, mem_ctx, sid, cached_nt_pass, cred_salt);
      43           0 :         if (!NT_STATUS_IS_OK(status)) {
      44           0 :                 return status;
      45             :         }
      46             : 
      47           0 :         info = netsamlogon_cache_get(mem_ctx, sid);
      48           0 :         if (info == NULL) {
      49           0 :                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
      50             :         }
      51             : 
      52           0 :         *info3 = info;
      53             : 
      54           0 :         return NT_STATUS_OK;
      55             : }
      56             : 
      57             : 
      58           0 : NTSTATUS winbindd_store_creds(struct winbindd_domain *domain,
      59             :                               const char *user, 
      60             :                               const char *pass, 
      61             :                               struct netr_SamInfo3 *info3)
      62             : {
      63           0 :         NTSTATUS status;
      64           0 :         uchar nt_pass[NT_HASH_LEN];
      65           0 :         struct dom_sid cred_sid;
      66             : 
      67           0 :         if (info3 != NULL) {
      68             : 
      69           0 :                 sid_compose(&cred_sid, info3->base.domain_sid,
      70             :                             info3->base.rid);
      71           0 :                 info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
      72             : 
      73           0 :         } else if (user != NULL) {
      74             : 
      75             :                 /* do lookup ourself */
      76             : 
      77           0 :                 enum lsa_SidType type;
      78             : 
      79           0 :                 if (!lookup_cached_name(domain->name, /* namespace */
      80           0 :                                         domain->name,
      81             :                                         user,
      82             :                                         &cred_sid,
      83             :                                         &type)) {
      84           0 :                         return NT_STATUS_NO_SUCH_USER;
      85             :                 }
      86             :         } else {
      87           0 :                 return NT_STATUS_INVALID_PARAMETER;
      88             :         }
      89             : 
      90           0 :         if (pass) {
      91             : 
      92           0 :                 int count = 0;
      93             : 
      94           0 :                 status = wcache_count_cached_creds(domain, &count);
      95           0 :                 if (!NT_STATUS_IS_OK(status)) {
      96           0 :                         return status;
      97             :                 }
      98             : 
      99           0 :                 DEBUG(11,("we have %d cached creds\n", count));
     100             : 
     101           0 :                 if (count + 1 > MAX_CACHED_LOGINS) {
     102             : 
     103           0 :                         DEBUG(10,("need to delete the oldest cached login\n"));
     104             : 
     105           0 :                         status = wcache_remove_oldest_cached_creds(domain, &cred_sid);
     106           0 :                         if (!NT_STATUS_IS_OK(status)) {
     107           0 :                                 DEBUG(10,("failed to remove oldest cached cred: %s\n", 
     108             :                                         nt_errstr(status)));
     109           0 :                                 return status;
     110             :                         }
     111             :                 }
     112             : 
     113           0 :                 E_md4hash(pass, nt_pass);
     114             : 
     115           0 :                 dump_data_pw("nt_pass", nt_pass, NT_HASH_LEN);
     116             : 
     117           0 :                 status = wcache_save_creds(domain, &cred_sid, nt_pass);
     118           0 :                 if (!NT_STATUS_IS_OK(status)) {
     119           0 :                         return status;
     120             :                 }
     121             :         }
     122             : 
     123           0 :         if (info3 != NULL && user != NULL) {
     124           0 :                 if (!netsamlogon_cache_store(user, info3)) {
     125           0 :                         return NT_STATUS_ACCESS_DENIED;
     126             :                 }
     127             :         }
     128             : 
     129           0 :         return NT_STATUS_OK;
     130             : }
     131             : 
     132           0 : NTSTATUS winbindd_update_creds_by_info3(struct winbindd_domain *domain,
     133             :                                         const char *user,
     134             :                                         const char *pass,
     135             :                                         struct netr_SamInfo3 *info3)
     136             : {
     137           0 :         return winbindd_store_creds(domain, user, pass, info3);
     138             : }
     139             : 
     140           0 : NTSTATUS winbindd_update_creds_by_name(struct winbindd_domain *domain,
     141             :                                        const char *user,
     142             :                                        const char *pass)
     143             : {
     144           0 :         return winbindd_store_creds(domain, user, pass, NULL);
     145             : }
     146             : 
     147             :