1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2018 Nexenta Systems, Inc. All rights reserved.
25 */
26
27 /*
28 * This module provides the high level interface to the SAM RPC
29 * functions.
30 */
31
32 #include <sys/types.h>
33 #include <sys/isa_defs.h>
34 #include <sys/byteorder.h>
35
36 #include <alloca.h>
37
38 #include <smbsrv/libsmb.h>
39 #include <smbsrv/libmlsvc.h>
40 #include <smb/ntaccess.h>
41 #include <lsalib.h>
42 #include <samlib.h>
43
44 #ifdef _LITTLE_ENDIAN
45 /* little-endian values on little-endian */
46 #define htolel(x) ((uint32_t)(x))
47 #define letohl(x) ((uint32_t)(x))
48 #else /* (BYTE_ORDER == LITTLE_ENDIAN) */
49 /* little-endian values on big-endian (swap) */
50 #define letohl(x) BSWAP_32(x)
51 #define htolel(x) BSWAP_32(x)
52 #endif /* (BYTE_ORDER == LITTLE_ENDIAN) */
53
54 /*
55 * Valid values for the OEM OWF password encryption.
56 */
57 #define SAM_KEYLEN 16
58
59 static void samr_fill_userpw(struct samr_user_password *, const char *);
60 static void samr_make_encrypted_password(
61 struct samr_encr_passwd *epw,
62 char *new_pw_clear,
63 uint8_t *crypt_key);
64
65
66 /*
67 * Todo: Implement "unjoin" domain, which would use the
68 * sam_remove_trust_account code below.
69 */
70
71 /*
72 * sam_remove_trust_account
73 *
74 * Attempt to remove the workstation trust account for this system.
75 * Administrator access is required to perform this operation.
76 *
77 * Returns NT status codes.
78 */
79 DWORD
80 sam_remove_trust_account(char *server, char *domain)
81 {
82 char account_name[SMB_SAMACCT_MAXLEN];
83
84 if (smb_getsamaccount(account_name, SMB_SAMACCT_MAXLEN) != 0)
85 return (NT_STATUS_INTERNAL_ERROR);
86
87 return (sam_delete_account(server, domain, account_name));
88 }
89
90
91 /*
92 * sam_delete_account
93 *
94 * Attempt to remove an account from the SAM database on the specified
95 * server.
96 *
97 * Returns NT status codes.
98 */
99 DWORD
100 sam_delete_account(char *server, char *domain_name, char *account_name)
101 {
102 mlsvc_handle_t samr_handle;
103 mlsvc_handle_t domain_handle;
104 mlsvc_handle_t user_handle;
105 smb_account_t ainfo;
106 smb_sid_t *sid;
107 DWORD access_mask;
108 DWORD status;
109 int rc;
110 char user[SMB_USERNAME_MAXLEN];
111
112 smb_ipc_get_user(user, SMB_USERNAME_MAXLEN);
113
114 rc = samr_open(server, domain_name, user, SAM_LOOKUP_INFORMATION,
115 &samr_handle);
116 if (rc != 0)
117 return (NT_STATUS_CANT_ACCESS_DOMAIN_INFO);
118
119 sid = samr_lookup_domain(&samr_handle, domain_name);
120 if (sid == NULL) {
121 status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
122 goto out_samr_hdl;
123 }
124
125 status = samr_open_domain(&samr_handle, SAM_LOOKUP_INFORMATION,
126 (struct samr_sid *)sid, &domain_handle);
127 if (status != NT_STATUS_SUCCESS)
128 goto out_sid_ptr;
129
130 status = samr_lookup_domain_names(&domain_handle, account_name, &ainfo);
131 if (status != NT_STATUS_SUCCESS)
132 goto out_dom_hdl;
133
134 access_mask = STANDARD_RIGHTS_EXECUTE | DELETE;
135 status = samr_open_user(&domain_handle, access_mask,
136 ainfo.a_rid, &user_handle);
137 if (status != NT_STATUS_SUCCESS)
138 goto out_dom_hdl;
139
140 status = samr_delete_user(&user_handle);
141
142 (void) samr_close_handle(&user_handle);
143 out_dom_hdl:
144 (void) samr_close_handle(&domain_handle);
145 out_sid_ptr:
146 free(sid);
147 out_samr_hdl:
148 (void) samr_close_handle(&samr_handle);
149
150 return (status);
151 }
152
153
154 /*
155 * sam_lookup_name
156 *
157 * Lookup an account name in the SAM database on the specified domain
158 * controller. Provides the account RID on success.
159 *
160 * Returns NT status codes.
161 */
162 DWORD
163 sam_lookup_name(char *server, char *domain_name, char *account_name,
164 DWORD *rid_ret)
165 {
166 mlsvc_handle_t samr_handle;
167 mlsvc_handle_t domain_handle;
168 smb_account_t ainfo;
169 struct samr_sid *domain_sid;
170 int rc;
171 DWORD status;
172 char user[SMB_USERNAME_MAXLEN];
173
174 smb_ipc_get_user(user, SMB_USERNAME_MAXLEN);
175
176 *rid_ret = 0;
177
178 rc = samr_open(server, domain_name, user, SAM_LOOKUP_INFORMATION,
179 &samr_handle);
180
181 if (rc != 0)
182 return (NT_STATUS_OPEN_FAILED);
183
184 domain_sid = (struct samr_sid *)samr_lookup_domain(&samr_handle,
185 domain_name);
186 if (domain_sid == NULL) {
187 (void) samr_close_handle(&samr_handle);
188 return (NT_STATUS_NO_SUCH_DOMAIN);
189 }
190
191 status = samr_open_domain(&samr_handle, SAM_LOOKUP_INFORMATION,
192 domain_sid, &domain_handle);
193 if (status == NT_STATUS_SUCCESS) {
194 status = samr_lookup_domain_names(&domain_handle,
195 account_name, &ainfo);
196 if (status == NT_STATUS_SUCCESS)
197 *rid_ret = ainfo.a_rid;
198
199 (void) samr_close_handle(&domain_handle);
200 }
201
202 (void) samr_close_handle(&samr_handle);
203 return (status);
204 }
205
206 /*
207 * sam_get_local_domains
208 *
209 * Query a remote server to get the list of local domains that it
210 * supports.
211 *
212 * Returns NT status codes.
213 */
214 DWORD
215 sam_get_local_domains(char *server, char *domain_name)
216 {
217 mlsvc_handle_t samr_handle;
218 DWORD status;
219 int rc;
220 char user[SMB_USERNAME_MAXLEN];
221
222 smb_ipc_get_user(user, SMB_USERNAME_MAXLEN);
223
224 rc = samr_open(server, domain_name, user, SAM_ENUM_LOCAL_DOMAIN,
225 &samr_handle);
226 if (rc != 0)
227 return (NT_STATUS_OPEN_FAILED);
228
229 status = samr_enum_local_domains(&samr_handle);
230 (void) samr_close_handle(&samr_handle);
231 return (status);
232 }
233
234 /*
235 * Set the account control flags on some account for which we
236 * have already opened a SAM handle with appropriate rights,
237 * passed in here as sam_handle, along with the new flags.
238 */
239 DWORD
240 netr_set_user_control(
241 mlsvc_handle_t *user_handle,
242 DWORD UserAccountControl)
243 {
244 struct samr_SetUserInfo16 info;
245
246 info.UserAccountControl = UserAccountControl;
247 return (samr_set_user_info(user_handle, 16, &info));
248 }
249
250 /*
251 * Set the password on some account, for which we have already
252 * opened a SAM handle with appropriate rights, passed in here
253 * as sam_handle, along with the new password as cleartext.
254 *
255 * This builds a struct SAMPR_USER_INTERNAL5_INFORMATION [MS-SAMR]
256 * containing the new password, encrypted with our session key.
257 */
258 DWORD
259 netr_set_user_password(
260 mlsvc_handle_t *user_handle,
261 char *new_pw_clear)
262 {
263 unsigned char ssn_key[SMBAUTH_HASH_SZ];
264 struct samr_SetUserInfo24 info;
265
266 if (ndr_rpc_get_ssnkey(user_handle, ssn_key, SMBAUTH_HASH_SZ))
267 return (NT_STATUS_INTERNAL_ERROR);
268
269 (void) memset(&info, 0, sizeof (info));
270 samr_make_encrypted_password(&info.encr_pw, new_pw_clear, ssn_key);
271
272 /* Rather not leave the session key around. */
273 (void) memset(ssn_key, 0, sizeof (ssn_key));
274
275 return (samr_set_user_info(user_handle, 24, &info));
276 }
277
278 /*
279 * Change a password like NetUserChangePassword(),
280 * but where we already know which AD server to use,
281 * so we don't request the domain name or search for
282 * an AD server for that domain here.
283 */
284 DWORD
285 netr_change_password(
286 char *server,
287 char *account,
288 char *old_pw_clear,
289 char *new_pw_clear)
290 {
291 struct samr_encr_passwd epw;
292 struct samr_encr_hash old_hash;
293 uint8_t old_nt_hash[SAMR_PWHASH_LEN];
294 uint8_t new_nt_hash[SAMR_PWHASH_LEN];
295 mlsvc_handle_t handle;
296 DWORD status;
297
298 /*
299 * Create an RPC handle to this server, bound to SAMR.
300 */
301 status = ndr_rpc_bind(&handle, server, "", "", "SAMR");
302 if (status != NT_STATUS_SUCCESS)
303 return (status);
304
305 /*
306 * Encrypt the new p/w (plus random filler) with the
307 * old password, and send the old p/w encrypted with
308 * the new p/w hash to prove we know the old p/w.
309 * Details: [MS-SAMR 3.1.5.10.3]
310 */
311 (void) smb_auth_ntlm_hash(old_pw_clear, old_nt_hash);
312 (void) smb_auth_ntlm_hash(new_pw_clear, new_nt_hash);
313 samr_make_encrypted_password(&epw, new_pw_clear, old_nt_hash);
314
315 (void) smb_auth_DES(old_hash.data, SAMR_PWHASH_LEN,
316 new_nt_hash, 14, /* key */
317 old_nt_hash, SAMR_PWHASH_LEN);
318
319 /*
320 * Finally, ready to try the OtW call.
321 */
322 status = samr_change_password(
323 &handle, server, account,
324 &epw, &old_hash);
325
326 /* Avoid leaving cleartext (or equivalent) around. */
327 (void) memset(old_nt_hash, 0, sizeof (old_nt_hash));
328 (void) memset(new_nt_hash, 0, sizeof (new_nt_hash));
329
330 ndr_rpc_unbind(&handle);
331 return (status);
332 }
333
334 /*
335 * Build an encrypted password, as used by samr_set_user_info
336 * and samr_change_password. Note: This builds the unencrypted
337 * form in one union arm, and encrypts it in the other union arm.
338 */
339 void
340 samr_make_encrypted_password(
341 struct samr_encr_passwd *epw,
342 char *new_pw_clear,
343 uint8_t *crypt_key)
344 {
345 union {
346 struct samr_user_password u;
347 struct samr_encr_passwd e;
348 } pwu;
349
350 samr_fill_userpw(&pwu.u, new_pw_clear);
351
352 (void) smb_auth_RC4(pwu.e.data, sizeof (pwu.e.data),
353 crypt_key, SAMR_PWHASH_LEN,
354 pwu.e.data, sizeof (pwu.e.data));
355
356 (void) memcpy(epw->data, pwu.e.data, sizeof (pwu.e.data));
357 (void) memset(pwu.e.data, 0, sizeof (pwu.e.data));
358 }
359
360 /*
361 * This fills in a samr_user_password (a.k.a. SAMPR_USER_PASSWORD
362 * in the MS Net API) which has the new password "right justified"
363 * in the buffer, and any space on the left filled with random junk
364 * to improve the quality of the encryption that is subsequently
365 * applied to this buffer before it goes over the wire.
366 */
367 static void
368 samr_fill_userpw(struct samr_user_password *upw, const char *new_pw)
369 {
370 smb_wchar_t *pbuf;
371 uint32_t pwlen_bytes;
372 size_t pwlen_wchars;
373
374 /*
375 * First fill the whole buffer with the random junk.
376 * (Slightly less random when debugging:)
377 */
378 #ifdef DEBUG
379 (void) memset(upw->Buffer, '*', sizeof (upw->Buffer));
380 #else
381 randomize((char *)upw->Buffer, sizeof (upw->Buffer));
382 #endif
383
384 /*
385 * Now overwrite the last pwlen characters of
386 * that buffer with the password, and set the
387 * length field so the receiving end knows where
388 * the junk ends and the real password starts.
389 */
390 pwlen_wchars = smb_wcequiv_strlen(new_pw) / 2;
391 if (pwlen_wchars > SAMR_USER_PWLEN)
392 pwlen_wchars = SAMR_USER_PWLEN;
393 pwlen_bytes = pwlen_wchars * 2;
394
395 pbuf = &upw->Buffer[SAMR_USER_PWLEN - pwlen_wchars];
396 (void) smb_mbstowcs(pbuf, new_pw, pwlen_wchars);
397
398 /* Yes, this is in Bytes, not wchars. */
399 upw->Length = htolel(pwlen_bytes);
400 }