/src/samba/source4/auth/system_session.c

Source
/* 
   Unix SMB/CIFS implementation.
   Authentication utility functions
   Copyright (C) Andrew Tridgell 1992-1998
   Copyright (C) Andrew Bartlett 2001-2010
   Copyright (C) Jeremy Allison 2000-2001
   Copyright (C) Rafal Szczesniak 2002
   Copyright (C) Stefan Metzmacher 2005

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.
   
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
   
   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "includes.h"
#include "libcli/security/security.h"
#include "auth/credentials/credentials.h"
#include "param/param.h"
#include "auth/auth.h" /* for auth_user_info_dc */
#include "auth/session.h"
#include "auth/system_session_proto.h"

#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH

/*
  prevent the static system session being freed
 */
static int system_session_destructor(struct auth_session_info *info)
{
  return -1;
}

/* Create a security token for a session SYSTEM (the most
 * trusted/privileged account), including the local machine account as
 * the off-host credentials
 */ 
_PUBLIC_ struct auth_session_info *system_session(struct loadparm_context *lp_ctx)
{
  static struct auth_session_info *static_session;
  NTSTATUS nt_status;

  if (static_session) {
    return static_session;
  }

  /*
   * Use NULL here, not the autofree context for this
   * static pointer. The destructor prevents freeing this
   * memory anyway.
   */
  nt_status = auth_system_session_info(NULL,
               lp_ctx,
               &static_session);
  if (!NT_STATUS_IS_OK(nt_status)) {
    TALLOC_FREE(static_session);
    return NULL;
  }
  talloc_set_destructor(static_session, system_session_destructor);
  return static_session;
}

NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx, 
          struct loadparm_context *lp_ctx,
          struct auth_session_info **_session_info) 
{
  NTSTATUS nt_status;
  struct auth_user_info_dc *user_info_dc = NULL;
  struct auth_session_info *session_info = NULL;
  TALLOC_CTX *mem_ctx = NULL;
  bool ok;

  mem_ctx = talloc_new(parent_ctx);
  if (mem_ctx == NULL) {
    return NT_STATUS_NO_MEMORY;
  }
  
  nt_status = auth_system_user_info_dc(mem_ctx, lpcfg_netbios_name(lp_ctx),
              &user_info_dc);
  if (!NT_STATUS_IS_OK(nt_status)) {
    talloc_free(mem_ctx);
    return nt_status;
  }

  /* references the user_info_dc into the session_info */
  nt_status = auth_generate_session_info(parent_ctx,
                 lp_ctx,
                 NULL /* sam_ctx */,
                 user_info_dc,
                 AUTH_SESSION_INFO_SIMPLE_PRIVILEGES,
                 &session_info);
  talloc_free(mem_ctx);

  NT_STATUS_NOT_OK_RETURN(nt_status);

  session_info->credentials = cli_credentials_init(session_info);
  if (!session_info->credentials) {
    talloc_free(session_info);
    return NT_STATUS_NO_MEMORY;
  }

  ok = cli_credentials_set_conf(session_info->credentials, lp_ctx);
  if (!ok) {
    talloc_free(session_info);
    return NT_STATUS_INTERNAL_ERROR;
  }

  cli_credentials_set_machine_account_pending(session_info->credentials, lp_ctx);
  *_session_info = session_info;

  return NT_STATUS_OK;
}

NTSTATUS auth_system_user_info_dc(TALLOC_CTX *mem_ctx, const char *netbios_name,
         struct auth_user_info_dc **_user_info_dc)
{
  struct auth_user_info_dc *user_info_dc;
  struct auth_user_info *info;

  user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
  NT_STATUS_HAVE_NO_MEMORY(user_info_dc);

  /* This returns a pointer to a struct dom_sid, which is the
   * same as a 1 element list of struct dom_sid */
  user_info_dc->num_sids = 1;
  user_info_dc->sids = talloc(user_info_dc, struct auth_SidAttr);
  if (user_info_dc->sids == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  }

  user_info_dc->sids[0] = (struct auth_SidAttr) {
    .sid = global_sid_System,
    .attrs = SE_GROUP_DEFAULT_FLAGS,
  };

  /* annoying, but the Anonymous really does have a session key, 
     and it is all zeros! */
  user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
  if (user_info_dc->user_session_key.data == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  }

  user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
  if (user_info_dc->lm_session_key.data == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  }

  data_blob_clear(&user_info_dc->user_session_key);
  data_blob_clear(&user_info_dc->lm_session_key);

  user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
  if (user_info_dc->info == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->account_name = talloc_strdup(info, "SYSTEM");
  if (info->account_name == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->domain_name = talloc_strdup(info, "NT AUTHORITY");
  if (info->domain_name == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->full_name = talloc_strdup(info, "System");
  if (info->full_name == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->logon_script = talloc_strdup(info, "");
  if (info->logon_script == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->profile_path = talloc_strdup(info, "");
  if (info->profile_path == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->home_directory = talloc_strdup(info, "");
  if (info->home_directory == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->home_drive = talloc_strdup(info, "");
  if (info->home_drive == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->logon_server = talloc_strdup(info, netbios_name);
  if (info->logon_server == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->last_logon = 0;
  info->last_logoff = 0;
  info->acct_expiry = 0;
  info->last_password_change = 0;
  info->allow_password_change = 0;
  info->force_password_change = 0;

  info->logon_count = 0;
  info->bad_password_count = 0;

  info->acct_flags = ACB_NORMAL;

  info->user_flags = 0;

  *_user_info_dc = user_info_dc;

  return NT_STATUS_OK;
}


static NTSTATUS auth_domain_admin_user_info_dc(TALLOC_CTX *mem_ctx,
                const char *netbios_name,
                const char *domain_name,
                struct dom_sid *domain_sid,
                struct auth_user_info_dc **_user_info_dc)
{
  struct auth_user_info_dc *user_info_dc;
  struct auth_user_info *info;

  user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
  NT_STATUS_HAVE_NO_MEMORY(user_info_dc);

  user_info_dc->num_sids = 8;
  user_info_dc->sids = talloc_zero_array(user_info_dc,
                 struct auth_SidAttr,
                 user_info_dc->num_sids);
  if (user_info_dc->sids == NULL) {
    TALLOC_FREE(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  }

  user_info_dc->sids[PRIMARY_USER_SID_INDEX].sid = *domain_sid;
  sid_append_rid(&user_info_dc->sids[PRIMARY_USER_SID_INDEX].sid, DOMAIN_RID_ADMINISTRATOR);
  user_info_dc->sids[PRIMARY_USER_SID_INDEX].attrs = SE_GROUP_DEFAULT_FLAGS;

  user_info_dc->sids[PRIMARY_GROUP_SID_INDEX].sid = *domain_sid;
  sid_append_rid(&user_info_dc->sids[PRIMARY_GROUP_SID_INDEX].sid, DOMAIN_RID_USERS);
  user_info_dc->sids[PRIMARY_GROUP_SID_INDEX].attrs = SE_GROUP_DEFAULT_FLAGS;

  /* Add the primary group again. */
  user_info_dc->sids[2] = user_info_dc->sids[PRIMARY_GROUP_SID_INDEX];

  user_info_dc->sids[3].sid = global_sid_Builtin_Administrators;
  user_info_dc->sids[3].attrs = SE_GROUP_DEFAULT_FLAGS;

  user_info_dc->sids[4].sid = *domain_sid;
  sid_append_rid(&user_info_dc->sids[4].sid, DOMAIN_RID_ADMINS);
  user_info_dc->sids[4].attrs = SE_GROUP_DEFAULT_FLAGS;
  user_info_dc->sids[5].sid = *domain_sid;
  sid_append_rid(&user_info_dc->sids[5].sid, DOMAIN_RID_ENTERPRISE_ADMINS);
  user_info_dc->sids[5].attrs = SE_GROUP_DEFAULT_FLAGS;
  user_info_dc->sids[6].sid = *domain_sid;
  sid_append_rid(&user_info_dc->sids[6].sid, DOMAIN_RID_POLICY_ADMINS);
  user_info_dc->sids[6].attrs = SE_GROUP_DEFAULT_FLAGS;
  user_info_dc->sids[7].sid = *domain_sid;
  sid_append_rid(&user_info_dc->sids[7].sid, DOMAIN_RID_SCHEMA_ADMINS);
  user_info_dc->sids[7].attrs = SE_GROUP_DEFAULT_FLAGS;

  /* What should the session key be?*/
  user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
  if (user_info_dc->user_session_key.data == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
  if (user_info_dc->lm_session_key.data == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  data_blob_clear(&user_info_dc->user_session_key);
  data_blob_clear(&user_info_dc->lm_session_key);

  user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
  if (user_info_dc->info == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->account_name = talloc_strdup(info, "Administrator");
  if (info->account_name == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->domain_name = talloc_strdup(info, domain_name);
  if (info->domain_name == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->full_name = talloc_strdup(info, "Administrator");
  if (info->full_name == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->logon_script = talloc_strdup(info, "");
  if (info->logon_script == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->profile_path = talloc_strdup(info, "");
  if (info->profile_path == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->home_directory = talloc_strdup(info, "");
  if (info->home_directory == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->home_drive = talloc_strdup(info, "");
  if (info->home_drive == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->logon_server = talloc_strdup(info, netbios_name);
  if (info->logon_server == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->last_logon = 0;
  info->last_logoff = 0;
  info->acct_expiry = 0;
  info->last_password_change = 0;
  info->allow_password_change = 0;
  info->force_password_change = 0;

  info->logon_count = 0;
  info->bad_password_count = 0;

  info->acct_flags = ACB_NORMAL;

  info->user_flags = 0;

  *_user_info_dc = user_info_dc;

  return NT_STATUS_OK;
}

static NTSTATUS auth_domain_admin_session_info(TALLOC_CTX *parent_ctx,
                 struct loadparm_context *lp_ctx,
                 struct dom_sid *domain_sid,
                 struct auth_session_info **session_info)
{
  NTSTATUS nt_status;
  struct auth_user_info_dc *user_info_dc = NULL;
  TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);

  NT_STATUS_HAVE_NO_MEMORY(mem_ctx);

  nt_status = auth_domain_admin_user_info_dc(mem_ctx,
               lpcfg_netbios_name(lp_ctx),
               lpcfg_workgroup(lp_ctx),
               domain_sid,
               &user_info_dc);
  if (!NT_STATUS_IS_OK(nt_status)) {
    talloc_free(mem_ctx);
    return nt_status;
  }

  nt_status = auth_generate_session_info(mem_ctx,
                 lp_ctx,
                 NULL /* sam_ctx */,
                 user_info_dc,
                 AUTH_SESSION_INFO_SIMPLE_PRIVILEGES|AUTH_SESSION_INFO_AUTHENTICATED|AUTH_SESSION_INFO_DEFAULT_GROUPS,
                 session_info);
  /* There is already a reference between the session_info and user_info_dc */
  if (NT_STATUS_IS_OK(nt_status)) {
    talloc_steal(parent_ctx, *session_info);
  }
  talloc_free(mem_ctx);
  return nt_status;
}

_PUBLIC_ struct auth_session_info *admin_session(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, struct dom_sid *domain_sid)
{
  NTSTATUS nt_status;
  struct auth_session_info *session_info = NULL;
  nt_status = auth_domain_admin_session_info(mem_ctx,
               lp_ctx,
               domain_sid,
               &session_info);
  if (!NT_STATUS_IS_OK(nt_status)) {
    return NULL;
  }
  return session_info;
}

_PUBLIC_ NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx, 
                struct loadparm_context *lp_ctx,
                struct auth_session_info **_session_info) 
{
  NTSTATUS nt_status;
  struct auth_user_info_dc *user_info_dc = NULL;
  struct auth_session_info *session_info = NULL;
  TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
  bool ok;

  if (mem_ctx == NULL) {
    return NT_STATUS_NO_MEMORY;
  }
  
  nt_status = auth_anonymous_user_info_dc(mem_ctx,
            lpcfg_netbios_name(lp_ctx),
            &user_info_dc);
  if (!NT_STATUS_IS_OK(nt_status)) {
    talloc_free(mem_ctx);
    return nt_status;
  }

  /* references the user_info_dc into the session_info */
  nt_status = auth_generate_session_info(parent_ctx,
                 lp_ctx,
                 NULL /* sam_ctx */,
                 user_info_dc,
                 AUTH_SESSION_INFO_SIMPLE_PRIVILEGES,
                 &session_info);
  talloc_free(mem_ctx);

  NT_STATUS_NOT_OK_RETURN(nt_status);

  session_info->credentials = cli_credentials_init(session_info);
  if (!session_info->credentials) {
    talloc_free(session_info);
    return NT_STATUS_NO_MEMORY;
  }

  ok = cli_credentials_set_conf(session_info->credentials, lp_ctx);
  if (!ok) {
    talloc_free(session_info);
    return NT_STATUS_INTERNAL_ERROR;
  }
  cli_credentials_set_anonymous(session_info->credentials);
  
  *_session_info = session_info;

  return NT_STATUS_OK;
}

_PUBLIC_ NTSTATUS auth_anonymous_user_info_dc(TALLOC_CTX *mem_ctx,
            const char *netbios_name,
            struct auth_user_info_dc **_user_info_dc)
{
  struct auth_user_info_dc *user_info_dc;
  struct auth_user_info *info;
  user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
  NT_STATUS_HAVE_NO_MEMORY(user_info_dc);

  /* This returns a pointer to a struct dom_sid, which is the
   * same as a 1 element list of struct dom_sid */
  user_info_dc->num_sids = 1;
  user_info_dc->sids = talloc(user_info_dc, struct auth_SidAttr);
  if (user_info_dc->sids == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  user_info_dc->sids[0] = (struct auth_SidAttr) {
    .sid = global_sid_Anonymous,
    .attrs = SE_GROUP_DEFAULT_FLAGS,
  };

  /* annoying, but the Anonymous really does have a session key... */
  user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
  if (user_info_dc->user_session_key.data == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
  if (user_info_dc->lm_session_key.data == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  /*  and it is all zeros! */
  data_blob_clear(&user_info_dc->user_session_key);
  data_blob_clear(&user_info_dc->lm_session_key);

  user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
  if (user_info_dc->info == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->account_name = talloc_strdup(info, "ANONYMOUS LOGON");
  if (info->account_name == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->domain_name = talloc_strdup(info, "NT AUTHORITY");
  if (info->domain_name == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->full_name = talloc_strdup(info, "Anonymous Logon");
  if (info->full_name == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->logon_script = talloc_strdup(info, "");
  if (info->logon_script == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->profile_path = talloc_strdup(info, "");
  if (info->profile_path == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->home_directory = talloc_strdup(info, "");
  if (info->home_directory == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->home_drive = talloc_strdup(info, "");
  if (info->home_drive == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->logon_server = talloc_strdup(info, netbios_name);
  if (info->logon_server == NULL) {
    talloc_free(user_info_dc);
    return NT_STATUS_NO_MEMORY;
  };

  info->last_logon = 0;
  info->last_logoff = 0;
  info->acct_expiry = 0;
  info->last_password_change = 0;
  info->allow_password_change = 0;
  info->force_password_change = 0;

  info->logon_count = 0;
  info->bad_password_count = 0;

  info->acct_flags = ACB_NORMAL;

  /* The user is not authenticated. */
  info->user_flags = NETLOGON_GUEST;

  *_user_info_dc = user_info_dc;

  return NT_STATUS_OK;
}


Coverage Report

Created: 2026-07-25 07:00

Line	Count	Source
1		/*
2		Unix SMB/CIFS implementation.
3		Authentication utility functions
4		Copyright (C) Andrew Tridgell 1992-1998
5		Copyright (C) Andrew Bartlett 2001-2010
6		Copyright (C) Jeremy Allison 2000-2001
7		Copyright (C) Rafal Szczesniak 2002
8		Copyright (C) Stefan Metzmacher 2005
9
10		This program is free software; you can redistribute it and/or modify
11		it under the terms of the GNU General Public License as published by
12		the Free Software Foundation; either version 3 of the License, or
13		(at your option) any later version.
14
15		This program is distributed in the hope that it will be useful,
16		but WITHOUT ANY WARRANTY; without even the implied warranty of
17		MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18		GNU General Public License for more details.
19
20		You should have received a copy of the GNU General Public License
21		along with this program. If not, see <http://www.gnu.org/licenses/>.
22		*/
23
24		#include "includes.h"
25		#include "libcli/security/security.h"
26		#include "auth/credentials/credentials.h"
27		#include "param/param.h"
28		#include "auth/auth.h" /* for auth_user_info_dc */
29		#include "auth/session.h"
30		#include "auth/system_session_proto.h"
31
32		#undef DBGC_CLASS
33		#define DBGC_CLASS DBGC_AUTH
34
35		/*
36		prevent the static system session being freed
37		*/
38		static int system_session_destructor(struct auth_session_info *info)
39	0	{
40	0	return -1;
41	0	}
42
43		/* Create a security token for a session SYSTEM (the most
44		* trusted/privileged account), including the local machine account as
45		* the off-host credentials
46		*/
47		_PUBLIC_ struct auth_session_info system_session(struct loadparm_context lp_ctx)
48	0	{
49	0	static struct auth_session_info *static_session;
50	0	NTSTATUS nt_status;
51
52	0	if (static_session) {
53	0	return static_session;
54	0	}
55
56		/*
57		* Use NULL here, not the autofree context for this
58		* static pointer. The destructor prevents freeing this
59		* memory anyway.
60		*/
61	0	nt_status = auth_system_session_info(NULL,
62	0	lp_ctx,
63	0	&static_session);
64	0	if (!NT_STATUS_IS_OK(nt_status)) {
65	0	TALLOC_FREE(static_session);
66	0	return NULL;
67	0	}
68	0	talloc_set_destructor(static_session, system_session_destructor);
69	0	return static_session;
70	0	}
71
72		NTSTATUS auth_system_session_info(TALLOC_CTX *parent_ctx,
73		struct loadparm_context *lp_ctx,
74		struct auth_session_info **_session_info)
75	0	{
76	0	NTSTATUS nt_status;
77	0	struct auth_user_info_dc *user_info_dc = NULL;
78	0	struct auth_session_info *session_info = NULL;
79	0	TALLOC_CTX *mem_ctx = NULL;
80	0	bool ok;
81
82	0	mem_ctx = talloc_new(parent_ctx);
83	0	if (mem_ctx == NULL) {
84	0	return NT_STATUS_NO_MEMORY;
85	0	}
86
87	0	nt_status = auth_system_user_info_dc(mem_ctx, lpcfg_netbios_name(lp_ctx),
88	0	&user_info_dc);
89	0	if (!NT_STATUS_IS_OK(nt_status)) {
90	0	talloc_free(mem_ctx);
91	0	return nt_status;
92	0	}
93
94		/* references the user_info_dc into the session_info */
95	0	nt_status = auth_generate_session_info(parent_ctx,
96	0	lp_ctx,
97	0	NULL /* sam_ctx */,
98	0	user_info_dc,
99	0	AUTH_SESSION_INFO_SIMPLE_PRIVILEGES,
100	0	&session_info);
101	0	talloc_free(mem_ctx);
102
103	0	NT_STATUS_NOT_OK_RETURN(nt_status);
104
105	0	session_info->credentials = cli_credentials_init(session_info);
106	0	if (!session_info->credentials) {
107	0	talloc_free(session_info);
108	0	return NT_STATUS_NO_MEMORY;
109	0	}
110
111	0	ok = cli_credentials_set_conf(session_info->credentials, lp_ctx);
112	0	if (!ok) {
113	0	talloc_free(session_info);
114	0	return NT_STATUS_INTERNAL_ERROR;
115	0	}
116
117	0	cli_credentials_set_machine_account_pending(session_info->credentials, lp_ctx);
118	0	*_session_info = session_info;
119
120	0	return NT_STATUS_OK;
121	0	}
122
123		NTSTATUS auth_system_user_info_dc(TALLOC_CTX mem_ctx, const char netbios_name,
124		struct auth_user_info_dc **_user_info_dc)
125	0	{
126	0	struct auth_user_info_dc *user_info_dc;
127	0	struct auth_user_info *info;
128
129	0	user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
130	0	NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
131
132		/* This returns a pointer to a struct dom_sid, which is the
133		* same as a 1 element list of struct dom_sid */
134	0	user_info_dc->num_sids = 1;
135	0	user_info_dc->sids = talloc(user_info_dc, struct auth_SidAttr);
136	0	if (user_info_dc->sids == NULL) {
137	0	talloc_free(user_info_dc);
138	0	return NT_STATUS_NO_MEMORY;
139	0	}
140
141	0	user_info_dc->sids[0] = (struct auth_SidAttr) {
142	0	.sid = global_sid_System,
143	0	.attrs = SE_GROUP_DEFAULT_FLAGS,
144	0	};
145
146		/* annoying, but the Anonymous really does have a session key,
147		and it is all zeros! */
148	0	user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
149	0	if (user_info_dc->user_session_key.data == NULL) {
150	0	talloc_free(user_info_dc);
151	0	return NT_STATUS_NO_MEMORY;
152	0	}
153
154	0	user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
155	0	if (user_info_dc->lm_session_key.data == NULL) {
156	0	talloc_free(user_info_dc);
157	0	return NT_STATUS_NO_MEMORY;
158	0	}
159
160	0	data_blob_clear(&user_info_dc->user_session_key);
161	0	data_blob_clear(&user_info_dc->lm_session_key);
162
163	0	user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
164	0	if (user_info_dc->info == NULL) {
165	0	talloc_free(user_info_dc);
166	0	return NT_STATUS_NO_MEMORY;
167	0	};
168
169	0	info->account_name = talloc_strdup(info, "SYSTEM");
170	0	if (info->account_name == NULL) {
171	0	talloc_free(user_info_dc);
172	0	return NT_STATUS_NO_MEMORY;
173	0	};
174
175	0	info->domain_name = talloc_strdup(info, "NT AUTHORITY");
176	0	if (info->domain_name == NULL) {
177	0	talloc_free(user_info_dc);
178	0	return NT_STATUS_NO_MEMORY;
179	0	};
180
181	0	info->full_name = talloc_strdup(info, "System");
182	0	if (info->full_name == NULL) {
183	0	talloc_free(user_info_dc);
184	0	return NT_STATUS_NO_MEMORY;
185	0	};
186
187	0	info->logon_script = talloc_strdup(info, "");
188	0	if (info->logon_script == NULL) {
189	0	talloc_free(user_info_dc);
190	0	return NT_STATUS_NO_MEMORY;
191	0	};
192
193	0	info->profile_path = talloc_strdup(info, "");
194	0	if (info->profile_path == NULL) {
195	0	talloc_free(user_info_dc);
196	0	return NT_STATUS_NO_MEMORY;
197	0	};
198
199	0	info->home_directory = talloc_strdup(info, "");
200	0	if (info->home_directory == NULL) {
201	0	talloc_free(user_info_dc);
202	0	return NT_STATUS_NO_MEMORY;
203	0	};
204
205	0	info->home_drive = talloc_strdup(info, "");
206	0	if (info->home_drive == NULL) {
207	0	talloc_free(user_info_dc);
208	0	return NT_STATUS_NO_MEMORY;
209	0	};
210
211	0	info->logon_server = talloc_strdup(info, netbios_name);
212	0	if (info->logon_server == NULL) {
213	0	talloc_free(user_info_dc);
214	0	return NT_STATUS_NO_MEMORY;
215	0	};
216
217	0	info->last_logon = 0;
218	0	info->last_logoff = 0;
219	0	info->acct_expiry = 0;
220	0	info->last_password_change = 0;
221	0	info->allow_password_change = 0;
222	0	info->force_password_change = 0;
223
224	0	info->logon_count = 0;
225	0	info->bad_password_count = 0;
226
227	0	info->acct_flags = ACB_NORMAL;
228
229	0	info->user_flags = 0;
230
231	0	*_user_info_dc = user_info_dc;
232
233	0	return NT_STATUS_OK;
234	0	}
235
236
237		static NTSTATUS auth_domain_admin_user_info_dc(TALLOC_CTX *mem_ctx,
238		const char *netbios_name,
239		const char *domain_name,
240		struct dom_sid *domain_sid,
241		struct auth_user_info_dc **_user_info_dc)
242	0	{
243	0	struct auth_user_info_dc *user_info_dc;
244	0	struct auth_user_info *info;
245
246	0	user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
247	0	NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
248
249	0	user_info_dc->num_sids = 8;
250	0	user_info_dc->sids = talloc_zero_array(user_info_dc,
251	0	struct auth_SidAttr,
252	0	user_info_dc->num_sids);
253	0	if (user_info_dc->sids == NULL) {
254	0	TALLOC_FREE(user_info_dc);
255	0	return NT_STATUS_NO_MEMORY;
256	0	}
257
258	0	user_info_dc->sids[PRIMARY_USER_SID_INDEX].sid = *domain_sid;
259	0	sid_append_rid(&user_info_dc->sids[PRIMARY_USER_SID_INDEX].sid, DOMAIN_RID_ADMINISTRATOR);
260	0	user_info_dc->sids[PRIMARY_USER_SID_INDEX].attrs = SE_GROUP_DEFAULT_FLAGS;
261
262	0	user_info_dc->sids[PRIMARY_GROUP_SID_INDEX].sid = *domain_sid;
263	0	sid_append_rid(&user_info_dc->sids[PRIMARY_GROUP_SID_INDEX].sid, DOMAIN_RID_USERS);
264	0	user_info_dc->sids[PRIMARY_GROUP_SID_INDEX].attrs = SE_GROUP_DEFAULT_FLAGS;
265
266		/* Add the primary group again. */
267	0	user_info_dc->sids[2] = user_info_dc->sids[PRIMARY_GROUP_SID_INDEX];
268
269	0	user_info_dc->sids[3].sid = global_sid_Builtin_Administrators;
270	0	user_info_dc->sids[3].attrs = SE_GROUP_DEFAULT_FLAGS;
271
272	0	user_info_dc->sids[4].sid = *domain_sid;
273	0	sid_append_rid(&user_info_dc->sids[4].sid, DOMAIN_RID_ADMINS);
274	0	user_info_dc->sids[4].attrs = SE_GROUP_DEFAULT_FLAGS;
275	0	user_info_dc->sids[5].sid = *domain_sid;
276	0	sid_append_rid(&user_info_dc->sids[5].sid, DOMAIN_RID_ENTERPRISE_ADMINS);
277	0	user_info_dc->sids[5].attrs = SE_GROUP_DEFAULT_FLAGS;
278	0	user_info_dc->sids[6].sid = *domain_sid;
279	0	sid_append_rid(&user_info_dc->sids[6].sid, DOMAIN_RID_POLICY_ADMINS);
280	0	user_info_dc->sids[6].attrs = SE_GROUP_DEFAULT_FLAGS;
281	0	user_info_dc->sids[7].sid = *domain_sid;
282	0	sid_append_rid(&user_info_dc->sids[7].sid, DOMAIN_RID_SCHEMA_ADMINS);
283	0	user_info_dc->sids[7].attrs = SE_GROUP_DEFAULT_FLAGS;
284
285		/* What should the session key be?*/
286	0	user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
287	0	if (user_info_dc->user_session_key.data == NULL) {
288	0	talloc_free(user_info_dc);
289	0	return NT_STATUS_NO_MEMORY;
290	0	};
291
292	0	user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
293	0	if (user_info_dc->lm_session_key.data == NULL) {
294	0	talloc_free(user_info_dc);
295	0	return NT_STATUS_NO_MEMORY;
296	0	};
297
298	0	data_blob_clear(&user_info_dc->user_session_key);
299	0	data_blob_clear(&user_info_dc->lm_session_key);
300
301	0	user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
302	0	if (user_info_dc->info == NULL) {
303	0	talloc_free(user_info_dc);
304	0	return NT_STATUS_NO_MEMORY;
305	0	};
306
307	0	info->account_name = talloc_strdup(info, "Administrator");
308	0	if (info->account_name == NULL) {
309	0	talloc_free(user_info_dc);
310	0	return NT_STATUS_NO_MEMORY;
311	0	};
312
313	0	info->domain_name = talloc_strdup(info, domain_name);
314	0	if (info->domain_name == NULL) {
315	0	talloc_free(user_info_dc);
316	0	return NT_STATUS_NO_MEMORY;
317	0	};
318
319	0	info->full_name = talloc_strdup(info, "Administrator");
320	0	if (info->full_name == NULL) {
321	0	talloc_free(user_info_dc);
322	0	return NT_STATUS_NO_MEMORY;
323	0	};
324
325	0	info->logon_script = talloc_strdup(info, "");
326	0	if (info->logon_script == NULL) {
327	0	talloc_free(user_info_dc);
328	0	return NT_STATUS_NO_MEMORY;
329	0	};
330
331	0	info->profile_path = talloc_strdup(info, "");
332	0	if (info->profile_path == NULL) {
333	0	talloc_free(user_info_dc);
334	0	return NT_STATUS_NO_MEMORY;
335	0	};
336
337	0	info->home_directory = talloc_strdup(info, "");
338	0	if (info->home_directory == NULL) {
339	0	talloc_free(user_info_dc);
340	0	return NT_STATUS_NO_MEMORY;
341	0	};
342
343	0	info->home_drive = talloc_strdup(info, "");
344	0	if (info->home_drive == NULL) {
345	0	talloc_free(user_info_dc);
346	0	return NT_STATUS_NO_MEMORY;
347	0	};
348
349	0	info->logon_server = talloc_strdup(info, netbios_name);
350	0	if (info->logon_server == NULL) {
351	0	talloc_free(user_info_dc);
352	0	return NT_STATUS_NO_MEMORY;
353	0	};
354
355	0	info->last_logon = 0;
356	0	info->last_logoff = 0;
357	0	info->acct_expiry = 0;
358	0	info->last_password_change = 0;
359	0	info->allow_password_change = 0;
360	0	info->force_password_change = 0;
361
362	0	info->logon_count = 0;
363	0	info->bad_password_count = 0;
364
365	0	info->acct_flags = ACB_NORMAL;
366
367	0	info->user_flags = 0;
368
369	0	*_user_info_dc = user_info_dc;
370
371	0	return NT_STATUS_OK;
372	0	}
373
374		static NTSTATUS auth_domain_admin_session_info(TALLOC_CTX *parent_ctx,
375		struct loadparm_context *lp_ctx,
376		struct dom_sid *domain_sid,
377		struct auth_session_info **session_info)
378	0	{
379	0	NTSTATUS nt_status;
380	0	struct auth_user_info_dc *user_info_dc = NULL;
381	0	TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
382
383	0	NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
384
385	0	nt_status = auth_domain_admin_user_info_dc(mem_ctx,
386	0	lpcfg_netbios_name(lp_ctx),
387	0	lpcfg_workgroup(lp_ctx),
388	0	domain_sid,
389	0	&user_info_dc);
390	0	if (!NT_STATUS_IS_OK(nt_status)) {
391	0	talloc_free(mem_ctx);
392	0	return nt_status;
393	0	}
394
395	0	nt_status = auth_generate_session_info(mem_ctx,
396	0	lp_ctx,
397	0	NULL /* sam_ctx */,
398	0	user_info_dc,
399	0	AUTH_SESSION_INFO_SIMPLE_PRIVILEGES\|AUTH_SESSION_INFO_AUTHENTICATED\|AUTH_SESSION_INFO_DEFAULT_GROUPS,
400	0	session_info);
401		/* There is already a reference between the session_info and user_info_dc */
402	0	if (NT_STATUS_IS_OK(nt_status)) {
403	0	talloc_steal(parent_ctx, *session_info);
404	0	}
405	0	talloc_free(mem_ctx);
406	0	return nt_status;
407	0	}
408
409		_PUBLIC_ struct auth_session_info admin_session(TALLOC_CTX mem_ctx, struct loadparm_context lp_ctx, struct dom_sid domain_sid)
410	0	{
411	0	NTSTATUS nt_status;
412	0	struct auth_session_info *session_info = NULL;
413	0	nt_status = auth_domain_admin_session_info(mem_ctx,
414	0	lp_ctx,
415	0	domain_sid,
416	0	&session_info);
417	0	if (!NT_STATUS_IS_OK(nt_status)) {
418	0	return NULL;
419	0	}
420	0	return session_info;
421	0	}
422
423		_PUBLIC_ NTSTATUS auth_anonymous_session_info(TALLOC_CTX *parent_ctx,
424		struct loadparm_context *lp_ctx,
425		struct auth_session_info **_session_info)
426	0	{
427	0	NTSTATUS nt_status;
428	0	struct auth_user_info_dc *user_info_dc = NULL;
429	0	struct auth_session_info *session_info = NULL;
430	0	TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
431	0	bool ok;
432
433	0	if (mem_ctx == NULL) {
434	0	return NT_STATUS_NO_MEMORY;
435	0	}
436
437	0	nt_status = auth_anonymous_user_info_dc(mem_ctx,
438	0	lpcfg_netbios_name(lp_ctx),
439	0	&user_info_dc);
440	0	if (!NT_STATUS_IS_OK(nt_status)) {
441	0	talloc_free(mem_ctx);
442	0	return nt_status;
443	0	}
444
445		/* references the user_info_dc into the session_info */
446	0	nt_status = auth_generate_session_info(parent_ctx,
447	0	lp_ctx,
448	0	NULL /* sam_ctx */,
449	0	user_info_dc,
450	0	AUTH_SESSION_INFO_SIMPLE_PRIVILEGES,
451	0	&session_info);
452	0	talloc_free(mem_ctx);
453
454	0	NT_STATUS_NOT_OK_RETURN(nt_status);
455
456	0	session_info->credentials = cli_credentials_init(session_info);
457	0	if (!session_info->credentials) {
458	0	talloc_free(session_info);
459	0	return NT_STATUS_NO_MEMORY;
460	0	}
461
462	0	ok = cli_credentials_set_conf(session_info->credentials, lp_ctx);
463	0	if (!ok) {
464	0	talloc_free(session_info);
465	0	return NT_STATUS_INTERNAL_ERROR;
466	0	}
467	0	cli_credentials_set_anonymous(session_info->credentials);
468
469	0	*_session_info = session_info;
470
471	0	return NT_STATUS_OK;
472	0	}
473
474		_PUBLIC_ NTSTATUS auth_anonymous_user_info_dc(TALLOC_CTX *mem_ctx,
475		const char *netbios_name,
476		struct auth_user_info_dc **_user_info_dc)
477	0	{
478	0	struct auth_user_info_dc *user_info_dc;
479	0	struct auth_user_info *info;
480	0	user_info_dc = talloc_zero(mem_ctx, struct auth_user_info_dc);
481	0	NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
482
483		/* This returns a pointer to a struct dom_sid, which is the
484		* same as a 1 element list of struct dom_sid */
485	0	user_info_dc->num_sids = 1;
486	0	user_info_dc->sids = talloc(user_info_dc, struct auth_SidAttr);
487	0	if (user_info_dc->sids == NULL) {
488	0	talloc_free(user_info_dc);
489	0	return NT_STATUS_NO_MEMORY;
490	0	};
491
492	0	user_info_dc->sids[0] = (struct auth_SidAttr) {
493	0	.sid = global_sid_Anonymous,
494	0	.attrs = SE_GROUP_DEFAULT_FLAGS,
495	0	};
496
497		/* annoying, but the Anonymous really does have a session key... */
498	0	user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
499	0	if (user_info_dc->user_session_key.data == NULL) {
500	0	talloc_free(user_info_dc);
501	0	return NT_STATUS_NO_MEMORY;
502	0	};
503
504	0	user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
505	0	if (user_info_dc->lm_session_key.data == NULL) {
506	0	talloc_free(user_info_dc);
507	0	return NT_STATUS_NO_MEMORY;
508	0	};
509
510		/* and it is all zeros! */
511	0	data_blob_clear(&user_info_dc->user_session_key);
512	0	data_blob_clear(&user_info_dc->lm_session_key);
513
514	0	user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
515	0	if (user_info_dc->info == NULL) {
516	0	talloc_free(user_info_dc);
517	0	return NT_STATUS_NO_MEMORY;
518	0	};
519
520	0	info->account_name = talloc_strdup(info, "ANONYMOUS LOGON");
521	0	if (info->account_name == NULL) {
522	0	talloc_free(user_info_dc);
523	0	return NT_STATUS_NO_MEMORY;
524	0	};
525
526	0	info->domain_name = talloc_strdup(info, "NT AUTHORITY");
527	0	if (info->domain_name == NULL) {
528	0	talloc_free(user_info_dc);
529	0	return NT_STATUS_NO_MEMORY;
530	0	};
531
532	0	info->full_name = talloc_strdup(info, "Anonymous Logon");
533	0	if (info->full_name == NULL) {
534	0	talloc_free(user_info_dc);
535	0	return NT_STATUS_NO_MEMORY;
536	0	};
537
538	0	info->logon_script = talloc_strdup(info, "");
539	0	if (info->logon_script == NULL) {
540	0	talloc_free(user_info_dc);
541	0	return NT_STATUS_NO_MEMORY;
542	0	};
543
544	0	info->profile_path = talloc_strdup(info, "");
545	0	if (info->profile_path == NULL) {
546	0	talloc_free(user_info_dc);
547	0	return NT_STATUS_NO_MEMORY;
548	0	};
549
550	0	info->home_directory = talloc_strdup(info, "");
551	0	if (info->home_directory == NULL) {
552	0	talloc_free(user_info_dc);
553	0	return NT_STATUS_NO_MEMORY;
554	0	};
555
556	0	info->home_drive = talloc_strdup(info, "");
557	0	if (info->home_drive == NULL) {
558	0	talloc_free(user_info_dc);
559	0	return NT_STATUS_NO_MEMORY;
560	0	};
561
562	0	info->logon_server = talloc_strdup(info, netbios_name);
563	0	if (info->logon_server == NULL) {
564	0	talloc_free(user_info_dc);
565	0	return NT_STATUS_NO_MEMORY;
566	0	};
567
568	0	info->last_logon = 0;
569	0	info->last_logoff = 0;
570	0	info->acct_expiry = 0;
571	0	info->last_password_change = 0;
572	0	info->allow_password_change = 0;
573	0	info->force_password_change = 0;
574
575	0	info->logon_count = 0;
576	0	info->bad_password_count = 0;
577
578	0	info->acct_flags = ACB_NORMAL;
579
580		/* The user is not authenticated. */
581	0	info->user_flags = NETLOGON_GUEST;
582
583	0	*_user_info_dc = user_info_dc;
584
585	0	return NT_STATUS_OK;
586	0	}
587