1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved. 23 */ 24 25 #include <unistd.h> 26 #include <strings.h> 27 #include <pwd.h> 28 #include <grp.h> 29 #include <time.h> 30 #include <syslog.h> 31 #include <assert.h> 32 #include <synch.h> 33 34 #include <smbsrv/libsmb.h> 35 #include <smbsrv/libmlsvc.h> 36 37 #include <smbsrv/smbinfo.h> 38 #include <smbsrv/smb_token.h> 39 #include <lsalib.h> 40 41 static smb_account_t smb_guest; 42 static smb_account_t smb_domusers; 43 static rwlock_t smb_logoninit_rwl; 44 45 typedef void (*smb_logonop_t)(smb_logon_t *, smb_token_t *); 46 47 extern void smb_logon_domain(smb_logon_t *, smb_token_t *); 48 static void smb_logon_local(smb_logon_t *, smb_token_t *); 49 static void smb_logon_guest(smb_logon_t *, smb_token_t *); 50 static void smb_logon_anon(smb_logon_t *, smb_token_t *); 51 52 static uint32_t smb_token_auth_local(smb_logon_t *, smb_token_t *, 53 smb_passwd_t *); 54 55 static uint32_t smb_token_setup_local(smb_passwd_t *, smb_token_t *); 56 static uint32_t smb_token_setup_guest(smb_logon_t *, smb_token_t *); 57 static uint32_t smb_token_setup_anon(smb_token_t *token); 58 59 static boolean_t smb_token_is_member(smb_token_t *, smb_sid_t *); 60 static uint32_t smb_token_setup_wingrps(smb_token_t *); 61 static smb_posix_grps_t *smb_token_create_pxgrps(uid_t); 62 63 static void smb_guest_account(char *, size_t); 64 65 /* Consolidation private function from Network Repository */ 66 extern int _getgroupsbymember(const char *, gid_t[], int, int); 67 68 static idmap_stat 69 smb_token_idmap(smb_token_t *token, smb_idmap_batch_t *sib) 70 { 71 idmap_stat stat; 72 smb_idmap_t *sim; 73 smb_id_t *id; 74 int i; 75 76 if (!token || !sib) 77 return (IDMAP_ERR_ARG); 78 79 sim = sib->sib_maps; 80 81 if (token->tkn_flags & SMB_ATF_ANON) { 82 token->tkn_user.i_id = UID_NOBODY; 83 token->tkn_owner.i_id = UID_NOBODY; 84 } else { 85 /* User SID */ 86 id = &token->tkn_user; 87 sim->sim_id = &id->i_id; 88 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim++, 89 id->i_sid, SMB_IDMAP_USER); 90 91 if (stat != IDMAP_SUCCESS) 92 return (stat); 93 94 /* Owner SID */ 95 id = &token->tkn_owner; 96 sim->sim_id = &id->i_id; 97 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim++, 98 id->i_sid, SMB_IDMAP_USER); 99 100 if (stat != IDMAP_SUCCESS) 101 return (stat); 102 } 103 104 /* Primary Group SID */ 105 id = &token->tkn_primary_grp; 106 sim->sim_id = &id->i_id; 107 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim++, id->i_sid, 108 SMB_IDMAP_GROUP); 109 110 if (stat != IDMAP_SUCCESS) 111 return (stat); 112 113 /* Other Windows Group SIDs */ 114 for (i = 0; i < token->tkn_win_grps.i_cnt; i++, sim++) { 115 id = &token->tkn_win_grps.i_ids[i]; 116 sim->sim_id = &id->i_id; 117 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim, 118 id->i_sid, SMB_IDMAP_GROUP); 119 120 if (stat != IDMAP_SUCCESS) 121 break; 122 } 123 124 return (stat); 125 } 126 127 /* 128 * smb_token_sids2ids 129 * 130 * This will map all the SIDs of the access token to UIDs/GIDs. 131 * 132 * Returns 0 upon success. Otherwise, returns -1. 133 */ 134 static int 135 smb_token_sids2ids(smb_token_t *token) 136 { 137 idmap_stat stat; 138 int nmaps; 139 smb_idmap_batch_t sib; 140 141 /* 142 * Number of idmap lookups: user SID, owner SID, primary group SID, 143 * and all Windows group SIDs. Skip user/owner SID for Anonymous. 144 */ 145 if (token->tkn_flags & SMB_ATF_ANON) 146 nmaps = token->tkn_win_grps.i_cnt + 1; 147 else 148 nmaps = token->tkn_win_grps.i_cnt + 3; 149 150 stat = smb_idmap_batch_create(&sib, nmaps, SMB_IDMAP_SID2ID); 151 if (stat != IDMAP_SUCCESS) 152 return (-1); 153 154 stat = smb_token_idmap(token, &sib); 155 if (stat != IDMAP_SUCCESS) { 156 smb_idmap_batch_destroy(&sib); 157 return (-1); 158 } 159 160 stat = smb_idmap_batch_getmappings(&sib); 161 smb_idmap_batch_destroy(&sib); 162 smb_idmap_check("smb_idmap_batch_getmappings", stat); 163 164 return (stat == IDMAP_SUCCESS ? 0 : -1); 165 } 166 167 /* 168 * smb_token_create_pxgrps 169 * 170 * Setup the POSIX group membership of the access token if the given UID is 171 * a POSIX UID (non-ephemeral). Both the user's primary group and 172 * supplementary groups will be added to the POSIX group array of the access 173 * token. 174 */ 175 static smb_posix_grps_t * 176 smb_token_create_pxgrps(uid_t uid) 177 { 178 struct passwd *pwd; 179 smb_posix_grps_t *pgrps; 180 int ngroups_max, num; 181 gid_t *gids; 182 183 if ((ngroups_max = sysconf(_SC_NGROUPS_MAX)) < 0) { 184 syslog(LOG_ERR, "smb_logon: failed to get _SC_NGROUPS_MAX"); 185 return (NULL); 186 } 187 188 pwd = getpwuid(uid); 189 if (pwd == NULL) { 190 pgrps = malloc(sizeof (smb_posix_grps_t)); 191 if (pgrps == NULL) 192 return (NULL); 193 194 pgrps->pg_ngrps = 0; 195 return (pgrps); 196 } 197 198 if (pwd->pw_name == NULL) { 199 pgrps = malloc(sizeof (smb_posix_grps_t)); 200 if (pgrps == NULL) 201 return (NULL); 202 203 pgrps->pg_ngrps = 1; 204 pgrps->pg_grps[0] = pwd->pw_gid; 205 return (pgrps); 206 } 207 208 gids = (gid_t *)malloc(ngroups_max * sizeof (gid_t)); 209 if (gids == NULL) { 210 return (NULL); 211 } 212 bzero(gids, ngroups_max * sizeof (gid_t)); 213 214 gids[0] = pwd->pw_gid; 215 216 /* 217 * Setup the groups starting at index 1 (the last arg) 218 * of gids array. 219 */ 220 num = _getgroupsbymember(pwd->pw_name, gids, ngroups_max, 1); 221 222 if (num == -1) { 223 syslog(LOG_ERR, "smb_logon: unable " 224 "to get user's supplementary groups"); 225 num = 1; 226 } 227 228 pgrps = (smb_posix_grps_t *)malloc(SMB_POSIX_GRPS_SIZE(num)); 229 if (pgrps) { 230 pgrps->pg_ngrps = num; 231 bcopy(gids, pgrps->pg_grps, num * sizeof (gid_t)); 232 } 233 234 free(gids); 235 return (pgrps); 236 } 237 238 /* 239 * smb_token_destroy 240 * 241 * Release all of the memory associated with a token structure. Ensure 242 * that the token has been unlinked before calling. 243 */ 244 void 245 smb_token_destroy(smb_token_t *token) 246 { 247 if (token != NULL) { 248 smb_sid_free(token->tkn_user.i_sid); 249 smb_sid_free(token->tkn_owner.i_sid); 250 smb_sid_free(token->tkn_primary_grp.i_sid); 251 smb_ids_free(&token->tkn_win_grps); 252 smb_privset_free(token->tkn_privileges); 253 free(token->tkn_posix_grps); 254 free(token->tkn_account_name); 255 free(token->tkn_domain_name); 256 free(token->tkn_session_key); 257 bzero(token, sizeof (smb_token_t)); 258 free(token); 259 } 260 } 261 262 /* 263 * Token owner should be set to local Administrators group 264 * in two cases: 265 * 1. The logged on user is a member of Domain Admins group 266 * 2. he/she is a member of local Administrators group 267 */ 268 static void 269 smb_token_set_owner(smb_token_t *token) 270 { 271 #ifdef SMB_SUPPORT_GROUP_OWNER 272 smb_sid_t *owner_sid; 273 274 if (token->tkn_flags & SMB_ATF_ADMIN) { 275 owner_sid = smb_wka_get_sid("Administrators"); 276 assert(owner_sid); 277 } else { 278 owner_sid = token->tkn_user->i_sid; 279 } 280 281 token->tkn_owner.i_sid = smb_sid_dup(owner_sid); 282 #endif 283 token->tkn_owner.i_sid = smb_sid_dup(token->tkn_user.i_sid); 284 } 285 286 static smb_privset_t * 287 smb_token_create_privs(smb_token_t *token) 288 { 289 smb_privset_t *privs; 290 smb_giter_t gi; 291 smb_group_t grp; 292 int rc; 293 294 privs = smb_privset_new(); 295 if (privs == NULL) 296 return (NULL); 297 298 if (smb_lgrp_iteropen(&gi) != SMB_LGRP_SUCCESS) { 299 smb_privset_free(privs); 300 return (NULL); 301 } 302 303 while (smb_lgrp_iterate(&gi, &grp) == SMB_LGRP_SUCCESS) { 304 if (smb_lgrp_is_member(&grp, token->tkn_user.i_sid)) 305 smb_privset_merge(privs, grp.sg_privs); 306 smb_lgrp_free(&grp); 307 } 308 smb_lgrp_iterclose(&gi); 309 310 if (token->tkn_flags & SMB_ATF_ADMIN) { 311 rc = smb_lgrp_getbyname("Administrators", &grp); 312 if (rc == SMB_LGRP_SUCCESS) { 313 smb_privset_merge(privs, grp.sg_privs); 314 smb_lgrp_free(&grp); 315 } 316 317 /* 318 * This privilege is required to view/edit SACL 319 */ 320 smb_privset_enable(privs, SE_SECURITY_LUID); 321 } 322 323 return (privs); 324 } 325 326 static void 327 smb_token_set_flags(smb_token_t *token) 328 { 329 if (smb_token_is_member(token, smb_wka_get_sid("Administrators"))) 330 token->tkn_flags |= SMB_ATF_ADMIN; 331 332 if (smb_token_is_member(token, smb_wka_get_sid("Power Users"))) 333 token->tkn_flags |= SMB_ATF_POWERUSER; 334 335 if (smb_token_is_member(token, smb_wka_get_sid("Backup Operators"))) 336 token->tkn_flags |= SMB_ATF_BACKUPOP; 337 } 338 339 /* 340 * Common token setup for both local and domain users. 341 * This function must be called after the initial setup 342 * has been done. 343 * 344 * Note that the order of calls in this function are important. 345 */ 346 static boolean_t 347 smb_token_setup_common(smb_token_t *token) 348 { 349 smb_token_set_flags(token); 350 351 smb_token_set_owner(token); 352 if (token->tkn_owner.i_sid == NULL) 353 return (B_FALSE); 354 355 /* Privileges */ 356 token->tkn_privileges = smb_token_create_privs(token); 357 if (token->tkn_privileges == NULL) 358 return (B_FALSE); 359 360 if (smb_token_sids2ids(token) != 0) { 361 syslog(LOG_ERR, "%s\\%s: idmap failed", 362 token->tkn_domain_name, token->tkn_account_name); 363 return (B_FALSE); 364 } 365 366 /* Solaris Groups */ 367 token->tkn_posix_grps = smb_token_create_pxgrps(token->tkn_user.i_id); 368 369 return (smb_token_valid(token)); 370 } 371 372 uint32_t 373 smb_logon_init(void) 374 { 375 uint32_t status; 376 377 (void) rw_wrlock(&smb_logoninit_rwl); 378 status = smb_sam_lookup_name(NULL, "guest", SidTypeUser, &smb_guest); 379 if (status != NT_STATUS_SUCCESS) { 380 (void) rw_unlock(&smb_logoninit_rwl); 381 return (status); 382 } 383 384 status = smb_sam_lookup_name(NULL, "domain users", SidTypeGroup, 385 &smb_domusers); 386 if (status != NT_STATUS_SUCCESS) { 387 smb_account_free(&smb_guest); 388 bzero(&smb_guest, sizeof (smb_account_t)); 389 (void) rw_unlock(&smb_logoninit_rwl); 390 return (status); 391 } 392 393 (void) rw_unlock(&smb_logoninit_rwl); 394 return (status); 395 } 396 397 void 398 smb_logon_fini(void) 399 { 400 (void) rw_wrlock(&smb_logoninit_rwl); 401 smb_account_free(&smb_guest); 402 smb_account_free(&smb_domusers); 403 bzero(&smb_guest, sizeof (smb_account_t)); 404 bzero(&smb_domusers, sizeof (smb_account_t)); 405 (void) rw_unlock(&smb_logoninit_rwl); 406 } 407 408 /* 409 * Perform user authentication. 410 * 411 * The dispatched functions must only update the user_info status if they 412 * attempt to authenticate the user. 413 * 414 * On success, a pointer to a new access token is returned. 415 */ 416 smb_token_t * 417 smb_logon(smb_logon_t *user_info) 418 { 419 static smb_logonop_t ops[] = { 420 smb_logon_anon, 421 smb_logon_local, 422 smb_logon_domain, 423 smb_logon_guest 424 }; 425 smb_token_t *token = NULL; 426 smb_domain_t domain; 427 int n_op = (sizeof (ops) / sizeof (ops[0])); 428 int i; 429 430 user_info->lg_secmode = smb_config_get_secmode(); 431 user_info->lg_status = NT_STATUS_NO_SUCH_USER; 432 433 if (smb_domain_lookup_name(user_info->lg_e_domain, &domain)) 434 user_info->lg_domain_type = domain.di_type; 435 else 436 user_info->lg_domain_type = SMB_DOMAIN_NULL; 437 438 if ((token = calloc(1, sizeof (smb_token_t))) == NULL) { 439 syslog(LOG_ERR, "logon[%s\\%s]: %m", 440 user_info->lg_e_domain, user_info->lg_e_username); 441 return (NULL); 442 } 443 444 for (i = 0; i < n_op; ++i) { 445 (*ops[i])(user_info, token); 446 447 if (user_info->lg_status == NT_STATUS_SUCCESS) 448 break; 449 } 450 451 if (user_info->lg_status == NT_STATUS_SUCCESS) { 452 if (smb_token_setup_common(token)) 453 return (token); 454 } 455 456 smb_token_destroy(token); 457 return (NULL); 458 } 459 460 /* 461 * If the user has an entry in the local database, attempt local authentication. 462 * 463 * In domain mode, we try to exclude domain accounts, which we do by only 464 * accepting local or null (blank) domain names here. Some clients (Mac OS) 465 * don't always send the domain name. 466 * 467 * If we are not going to attempt authentication, this function must return 468 * without updating the status. 469 */ 470 static void 471 smb_logon_local(smb_logon_t *user_info, smb_token_t *token) 472 { 473 char guest[SMB_USERNAME_MAXLEN]; 474 smb_passwd_t smbpw; 475 uint32_t status; 476 boolean_t isguest; 477 478 if (user_info->lg_secmode == SMB_SECMODE_DOMAIN) { 479 if ((user_info->lg_domain_type != SMB_DOMAIN_LOCAL) && 480 (user_info->lg_domain_type != SMB_DOMAIN_NULL)) 481 return; 482 } 483 484 smb_guest_account(guest, SMB_USERNAME_MAXLEN); 485 isguest = (smb_strcasecmp(guest, user_info->lg_e_username, 0) == 0); 486 487 status = smb_token_auth_local(user_info, token, &smbpw); 488 if (status == NT_STATUS_SUCCESS) { 489 if (isguest) 490 status = smb_token_setup_guest(user_info, token); 491 else 492 status = smb_token_setup_local(&smbpw, token); 493 } 494 495 user_info->lg_status = status; 496 } 497 498 /* 499 * Guest authentication. This may be a local guest account or the guest 500 * account may be mapped to a local account. These accounts are regular 501 * accounts with normal password protection. 502 * 503 * Only proceed with a guest logon if previous logon options have resulted 504 * in NO_SUCH_USER. 505 * 506 * If we are not going to attempt authentication, this function must return 507 * without updating the status. 508 */ 509 static void 510 smb_logon_guest(smb_logon_t *user_info, smb_token_t *token) 511 { 512 char guest[SMB_USERNAME_MAXLEN]; 513 smb_passwd_t smbpw; 514 char *temp; 515 uint32_t status; 516 517 if (user_info->lg_status != NT_STATUS_NO_SUCH_USER) 518 return; 519 520 smb_guest_account(guest, SMB_USERNAME_MAXLEN); 521 temp = user_info->lg_e_username; 522 user_info->lg_e_username = guest; 523 524 status = smb_token_auth_local(user_info, token, &smbpw); 525 if ((status == NT_STATUS_SUCCESS) || 526 (status == NT_STATUS_NO_SUCH_USER)) { 527 status = smb_token_setup_guest(user_info, token); 528 } 529 530 user_info->lg_e_username = temp; 531 user_info->lg_status = status; 532 } 533 534 /* 535 * If user_info represents an anonymous user then setup the token. 536 * Otherwise return without updating the status. 537 */ 538 static void 539 smb_logon_anon(smb_logon_t *user_info, smb_token_t *token) 540 { 541 if (user_info->lg_flags & SMB_ATF_ANON) 542 user_info->lg_status = smb_token_setup_anon(token); 543 } 544 545 /* 546 * Try both LM hash and NT hashes with user's password(s) to authenticate 547 * the user. 548 */ 549 static uint32_t 550 smb_token_auth_local(smb_logon_t *user_info, smb_token_t *token, 551 smb_passwd_t *smbpw) 552 { 553 boolean_t lm_ok, nt_ok; 554 uint32_t status = NT_STATUS_SUCCESS; 555 556 if (smb_pwd_getpwnam(user_info->lg_e_username, smbpw) == NULL) 557 return (NT_STATUS_NO_SUCH_USER); 558 559 if (smbpw->pw_flags & SMB_PWF_DISABLE) 560 return (NT_STATUS_ACCOUNT_DISABLED); 561 562 nt_ok = lm_ok = B_FALSE; 563 if ((smbpw->pw_flags & SMB_PWF_LM) && 564 (user_info->lg_lm_password.len != 0)) { 565 lm_ok = smb_auth_validate_lm( 566 user_info->lg_challenge_key.val, 567 user_info->lg_challenge_key.len, 568 smbpw, 569 user_info->lg_lm_password.val, 570 user_info->lg_lm_password.len, 571 user_info->lg_domain, 572 user_info->lg_username); 573 token->tkn_session_key = NULL; 574 } 575 576 if (!lm_ok && (user_info->lg_nt_password.len != 0)) { 577 token->tkn_session_key = malloc(SMBAUTH_SESSION_KEY_SZ); 578 if (token->tkn_session_key == NULL) 579 return (NT_STATUS_NO_MEMORY); 580 nt_ok = smb_auth_validate_nt( 581 user_info->lg_challenge_key.val, 582 user_info->lg_challenge_key.len, 583 smbpw, 584 user_info->lg_nt_password.val, 585 user_info->lg_nt_password.len, 586 user_info->lg_domain, 587 user_info->lg_username, 588 (uchar_t *)token->tkn_session_key); 589 } 590 591 if (!nt_ok && !lm_ok) { 592 status = NT_STATUS_WRONG_PASSWORD; 593 syslog(LOG_NOTICE, "logon[%s\\%s]: %s", 594 user_info->lg_e_domain, user_info->lg_e_username, 595 xlate_nt_status(status)); 596 } 597 598 return (status); 599 } 600 601 /* 602 * Setup an access token for the specified local user. 603 */ 604 static uint32_t 605 smb_token_setup_local(smb_passwd_t *smbpw, smb_token_t *token) 606 { 607 idmap_stat stat; 608 smb_idmap_batch_t sib; 609 smb_idmap_t *umap, *gmap; 610 struct passwd pw; 611 char pwbuf[1024]; 612 char nbname[NETBIOS_NAME_SZ]; 613 614 (void) smb_getnetbiosname(nbname, sizeof (nbname)); 615 token->tkn_account_name = strdup(smbpw->pw_name); 616 token->tkn_domain_name = strdup(nbname); 617 618 if (token->tkn_account_name == NULL || 619 token->tkn_domain_name == NULL) 620 return (NT_STATUS_NO_MEMORY); 621 622 if (getpwuid_r(smbpw->pw_uid, &pw, pwbuf, sizeof (pwbuf)) == NULL) 623 return (NT_STATUS_NO_SUCH_USER); 624 625 /* Get the SID for user's uid & gid */ 626 stat = smb_idmap_batch_create(&sib, 2, SMB_IDMAP_ID2SID); 627 if (stat != IDMAP_SUCCESS) 628 return (NT_STATUS_INTERNAL_ERROR); 629 630 umap = &sib.sib_maps[0]; 631 stat = smb_idmap_batch_getsid(sib.sib_idmaph, umap, pw.pw_uid, 632 SMB_IDMAP_USER); 633 634 if (stat != IDMAP_SUCCESS) { 635 smb_idmap_batch_destroy(&sib); 636 return (NT_STATUS_INTERNAL_ERROR); 637 } 638 639 gmap = &sib.sib_maps[1]; 640 stat = smb_idmap_batch_getsid(sib.sib_idmaph, gmap, pw.pw_gid, 641 SMB_IDMAP_GROUP); 642 643 if (stat != IDMAP_SUCCESS) { 644 smb_idmap_batch_destroy(&sib); 645 return (NT_STATUS_INTERNAL_ERROR); 646 } 647 648 if (smb_idmap_batch_getmappings(&sib) != IDMAP_SUCCESS) 649 return (NT_STATUS_INTERNAL_ERROR); 650 651 token->tkn_user.i_sid = smb_sid_dup(umap->sim_sid); 652 token->tkn_primary_grp.i_sid = smb_sid_dup(gmap->sim_sid); 653 654 smb_idmap_batch_destroy(&sib); 655 656 if (token->tkn_user.i_sid == NULL || 657 token->tkn_primary_grp.i_sid == NULL) 658 return (NT_STATUS_NO_MEMORY); 659 660 return (smb_token_setup_wingrps(token)); 661 } 662 663 /* 664 * Setup access token for guest connections 665 */ 666 static uint32_t 667 smb_token_setup_guest(smb_logon_t *user_info, smb_token_t *token) 668 { 669 token->tkn_account_name = strdup(user_info->lg_e_username); 670 671 (void) rw_rdlock(&smb_logoninit_rwl); 672 token->tkn_domain_name = strdup(smb_guest.a_domain); 673 token->tkn_user.i_sid = smb_sid_dup(smb_guest.a_sid); 674 token->tkn_primary_grp.i_sid = smb_sid_dup(smb_domusers.a_sid); 675 (void) rw_unlock(&smb_logoninit_rwl); 676 token->tkn_flags = SMB_ATF_GUEST; 677 678 if (token->tkn_account_name == NULL || 679 token->tkn_domain_name == NULL || 680 token->tkn_user.i_sid == NULL || 681 token->tkn_primary_grp.i_sid == NULL) 682 return (NT_STATUS_NO_MEMORY); 683 684 return (smb_token_setup_wingrps(token)); 685 } 686 687 /* 688 * Setup access token for anonymous connections 689 */ 690 static uint32_t 691 smb_token_setup_anon(smb_token_t *token) 692 { 693 smb_sid_t *user_sid; 694 695 token->tkn_account_name = strdup("Anonymous"); 696 token->tkn_domain_name = strdup("NT Authority"); 697 user_sid = smb_wka_get_sid("Anonymous"); 698 token->tkn_user.i_sid = smb_sid_dup(user_sid); 699 token->tkn_primary_grp.i_sid = smb_sid_dup(user_sid); 700 token->tkn_flags = SMB_ATF_ANON; 701 702 if (token->tkn_account_name == NULL || 703 token->tkn_domain_name == NULL || 704 token->tkn_user.i_sid == NULL || 705 token->tkn_primary_grp.i_sid == NULL) 706 return (NT_STATUS_NO_MEMORY); 707 708 return (smb_token_setup_wingrps(token)); 709 } 710 711 /* 712 * smb_token_user_sid 713 * 714 * Return a pointer to the user SID in the specified token. A null 715 * pointer indicates an error. 716 */ 717 static smb_sid_t * 718 smb_token_user_sid(smb_token_t *token) 719 { 720 return ((token) ? token->tkn_user.i_sid : NULL); 721 } 722 723 /* 724 * smb_token_group_sid 725 * 726 * Return a pointer to the group SID as indicated by the iterator. 727 * Setting the iterator to 0 before calling this function will return 728 * the first group, which will always be the primary group. The 729 * iterator will be incremented before returning the SID so that this 730 * function can be used to cycle through the groups. The caller can 731 * adjust the iterator as required between calls to obtain any specific 732 * group. 733 * 734 * On success a pointer to the appropriate group SID will be returned. 735 * Otherwise a null pointer will be returned. 736 */ 737 static smb_sid_t * 738 smb_token_group_sid(smb_token_t *token, int *iterator) 739 { 740 int index; 741 742 if (token == NULL || iterator == NULL) 743 return (NULL); 744 745 if (token->tkn_win_grps.i_ids == NULL) 746 return (NULL); 747 748 index = *iterator; 749 750 if (index < 0 || index >= token->tkn_win_grps.i_cnt) 751 return (NULL); 752 753 ++(*iterator); 754 return (token->tkn_win_grps.i_ids[index].i_sid); 755 } 756 757 /* 758 * smb_token_is_member 759 * 760 * This function will determine whether or not the specified SID is a 761 * member of a token. The user SID and all group SIDs are tested. 762 * Returns 1 if the SID is a member of the token. Otherwise returns 0. 763 */ 764 static boolean_t 765 smb_token_is_member(smb_token_t *token, smb_sid_t *sid) 766 { 767 smb_sid_t *tsid; 768 int iterator = 0; 769 770 if (token == NULL || sid == NULL) 771 return (B_FALSE); 772 773 tsid = smb_token_user_sid(token); 774 while (tsid) { 775 if (smb_sid_cmp(tsid, sid)) 776 return (B_TRUE); 777 778 tsid = smb_token_group_sid(token, &iterator); 779 } 780 781 return (B_FALSE); 782 } 783 784 /* 785 * smb_token_log 786 * 787 * Diagnostic routine to write the contents of a token to the log. 788 */ 789 void 790 smb_token_log(smb_token_t *token) 791 { 792 smb_ids_t *w_grps; 793 smb_id_t *grp; 794 smb_posix_grps_t *x_grps; 795 char sidstr[SMB_SID_STRSZ]; 796 int i; 797 798 if (token == NULL) 799 return; 800 801 syslog(LOG_DEBUG, "Token for %s\\%s", 802 (token->tkn_domain_name) ? token->tkn_domain_name : "-NULL-", 803 (token->tkn_account_name) ? token->tkn_account_name : "-NULL-"); 804 805 syslog(LOG_DEBUG, " User->Attr: %d", token->tkn_user.i_attrs); 806 smb_sid_tostr((smb_sid_t *)token->tkn_user.i_sid, sidstr); 807 syslog(LOG_DEBUG, " User->Sid: %s (id=%u)", sidstr, 808 token->tkn_user.i_id); 809 810 smb_sid_tostr((smb_sid_t *)token->tkn_owner.i_sid, sidstr); 811 syslog(LOG_DEBUG, " Ownr->Sid: %s (id=%u)", 812 sidstr, token->tkn_owner.i_id); 813 814 smb_sid_tostr((smb_sid_t *)token->tkn_primary_grp.i_sid, sidstr); 815 syslog(LOG_DEBUG, " PGrp->Sid: %s (id=%u)", 816 sidstr, token->tkn_primary_grp.i_id); 817 818 w_grps = &token->tkn_win_grps; 819 if (w_grps->i_ids) { 820 syslog(LOG_DEBUG, " Windows groups: %d", w_grps->i_cnt); 821 grp = w_grps->i_ids; 822 for (i = 0; i < w_grps->i_cnt; ++i, grp++) { 823 syslog(LOG_DEBUG, 824 " Grp[%d].Attr:%d", i, grp->i_attrs); 825 if (grp->i_sid != NULL) { 826 smb_sid_tostr((smb_sid_t *)grp->i_sid, sidstr); 827 syslog(LOG_DEBUG, 828 " Grp[%d].Sid: %s (id=%u)", i, sidstr, 829 grp->i_id); 830 } 831 } 832 } else { 833 syslog(LOG_DEBUG, " No Windows groups"); 834 } 835 836 x_grps = token->tkn_posix_grps; 837 if (x_grps) { 838 syslog(LOG_DEBUG, " Solaris groups: %d", x_grps->pg_ngrps); 839 for (i = 0; i < x_grps->pg_ngrps; i++) 840 syslog(LOG_DEBUG, " %u", x_grps->pg_grps[i]); 841 } else { 842 syslog(LOG_DEBUG, " No Solaris groups"); 843 } 844 845 if (token->tkn_privileges) 846 smb_privset_log(token->tkn_privileges); 847 else 848 syslog(LOG_DEBUG, " No privileges"); 849 } 850 851 /* 852 * Sets up local and well-known group membership for the given 853 * token. Two assumptions have been made here: 854 * 855 * a) token already contains a valid user SID so that group 856 * memberships can be established 857 * 858 * b) token belongs to a local or anonymous user 859 */ 860 static uint32_t 861 smb_token_setup_wingrps(smb_token_t *token) 862 { 863 smb_ids_t tkn_grps; 864 uint32_t status; 865 866 867 /* 868 * We always want the user's primary group in the list 869 * of groups. 870 */ 871 tkn_grps.i_cnt = 1; 872 if ((tkn_grps.i_ids = malloc(sizeof (smb_id_t))) == NULL) 873 return (NT_STATUS_NO_MEMORY); 874 875 tkn_grps.i_ids->i_sid = smb_sid_dup(token->tkn_primary_grp.i_sid); 876 tkn_grps.i_ids->i_attrs = token->tkn_primary_grp.i_attrs; 877 if (tkn_grps.i_ids->i_sid == NULL) { 878 smb_ids_free(&tkn_grps); 879 return (NT_STATUS_NO_MEMORY); 880 } 881 882 status = smb_sam_usr_groups(token->tkn_user.i_sid, &tkn_grps); 883 if (status != NT_STATUS_SUCCESS) { 884 smb_ids_free(&tkn_grps); 885 return (status); 886 } 887 888 status = smb_wka_token_groups(token->tkn_flags, &tkn_grps); 889 if (status != NT_STATUS_SUCCESS) { 890 smb_ids_free(&tkn_grps); 891 return (status); 892 } 893 894 token->tkn_win_grps = tkn_grps; 895 return (status); 896 } 897 898 /* 899 * Returns the guest account name in the provided buffer. 900 * 901 * By default the name would be "guest" unless there's 902 * a idmap name-based rule which maps the guest to a local 903 * Solaris user in which case the name of that user is 904 * returned. 905 */ 906 static void 907 smb_guest_account(char *guest, size_t buflen) 908 { 909 idmap_stat stat; 910 uid_t guest_uid; 911 struct passwd pw; 912 char pwbuf[1024]; 913 int idtype; 914 915 /* default Guest account name */ 916 (void) rw_rdlock(&smb_logoninit_rwl); 917 (void) strlcpy(guest, smb_guest.a_name, buflen); 918 919 idtype = SMB_IDMAP_USER; 920 stat = smb_idmap_getid(smb_guest.a_sid, &guest_uid, &idtype); 921 (void) rw_unlock(&smb_logoninit_rwl); 922 923 if (stat != IDMAP_SUCCESS) 924 return; 925 926 /* If Ephemeral ID return the default name */ 927 if (IDMAP_ID_IS_EPHEMERAL(guest_uid)) 928 return; 929 930 if (getpwuid_r(guest_uid, &pw, pwbuf, sizeof (pwbuf)) == NULL) 931 return; 932 933 (void) strlcpy(guest, pw.pw_name, buflen); 934 } 935