1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
24 * Copyright (c) 2016 by Delphix. All rights reserved.
25 */
26
27 #include <unistd.h>
28 #include <strings.h>
29 #include <pwd.h>
30 #include <grp.h>
31 #include <time.h>
32 #include <syslog.h>
33 #include <assert.h>
34 #include <synch.h>
35
36 #include <smbsrv/libsmb.h>
37 #include <smbsrv/libmlsvc.h>
38
39 #include <smbsrv/smbinfo.h>
40 #include <smbsrv/smb_token.h>
41 #include <lsalib.h>
42
43 static smb_account_t smb_guest;
44 static smb_account_t smb_domusers;
45 static rwlock_t smb_logoninit_rwl;
46
47 typedef void (*smb_logonop_t)(smb_logon_t *, smb_token_t *);
48
49 static void smb_logon_local(smb_logon_t *, smb_token_t *);
50 static void smb_logon_guest(smb_logon_t *, smb_token_t *);
51 static void smb_logon_anon(smb_logon_t *, smb_token_t *);
52
53 static uint32_t smb_token_auth_local(smb_logon_t *, smb_token_t *,
54 smb_passwd_t *);
55
56 static uint32_t smb_token_setup_local(smb_passwd_t *, smb_token_t *);
57 static uint32_t smb_token_setup_guest(smb_logon_t *, smb_token_t *);
58 static uint32_t smb_token_setup_anon(smb_token_t *token);
59
60 static boolean_t smb_token_is_member(smb_token_t *, smb_sid_t *);
61 static uint32_t smb_token_setup_wingrps(smb_token_t *);
62 static smb_posix_grps_t *smb_token_create_pxgrps(uid_t);
63
64 static void smb_guest_account(char *, size_t);
65
66 /* Consolidation private function from Network Repository */
67 extern int _getgroupsbymember(const char *, gid_t[], int, int);
68
69 static idmap_stat
70 smb_token_idmap(smb_token_t *token, smb_idmap_batch_t *sib)
71 {
72 idmap_stat stat;
73 smb_idmap_t *sim;
74 smb_id_t *id;
75 int i;
76
77 if (!token || !sib)
78 return (IDMAP_ERR_ARG);
79
80 sim = sib->sib_maps;
81
82 if (token->tkn_flags & SMB_ATF_ANON) {
83 token->tkn_user.i_id = UID_NOBODY;
84 token->tkn_owner.i_id = UID_NOBODY;
85 } else {
86 /* User SID */
87 id = &token->tkn_user;
88 sim->sim_id = &id->i_id;
89 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim++,
90 id->i_sid, SMB_IDMAP_USER);
91
92 if (stat != IDMAP_SUCCESS)
93 return (stat);
94
95 /* Owner SID */
96 id = &token->tkn_owner;
97 sim->sim_id = &id->i_id;
98 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim++,
99 id->i_sid, SMB_IDMAP_USER);
100
101 if (stat != IDMAP_SUCCESS)
102 return (stat);
103 }
104
105 /* Primary Group SID */
106 id = &token->tkn_primary_grp;
107 sim->sim_id = &id->i_id;
108 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim++, id->i_sid,
109 SMB_IDMAP_GROUP);
110
111 if (stat != IDMAP_SUCCESS)
112 return (stat);
113
114 /* Other Windows Group SIDs */
115 for (i = 0; i < token->tkn_win_grps.i_cnt; i++, sim++) {
116 id = &token->tkn_win_grps.i_ids[i];
117 sim->sim_id = &id->i_id;
118 stat = smb_idmap_batch_getid(sib->sib_idmaph, sim,
119 id->i_sid, SMB_IDMAP_GROUP);
120
121 if (stat != IDMAP_SUCCESS)
122 break;
123 }
124
125 return (stat);
126 }
127
128 /*
129 * smb_token_sids2ids
130 *
131 * This will map all the SIDs of the access token to UIDs/GIDs.
132 *
133 * Returns 0 upon success. Otherwise, returns -1.
134 */
135 static int
136 smb_token_sids2ids(smb_token_t *token)
137 {
138 idmap_stat stat;
139 int nmaps;
140 smb_idmap_batch_t sib;
141
142 /*
143 * Number of idmap lookups: user SID, owner SID, primary group SID,
144 * and all Windows group SIDs. Skip user/owner SID for Anonymous.
145 */
146 if (token->tkn_flags & SMB_ATF_ANON)
147 nmaps = token->tkn_win_grps.i_cnt + 1;
148 else
149 nmaps = token->tkn_win_grps.i_cnt + 3;
150
151 stat = smb_idmap_batch_create(&sib, nmaps, SMB_IDMAP_SID2ID);
152 if (stat != IDMAP_SUCCESS)
153 return (-1);
154
155 stat = smb_token_idmap(token, &sib);
156 if (stat != IDMAP_SUCCESS) {
157 smb_idmap_batch_destroy(&sib);
158 return (-1);
159 }
160
161 stat = smb_idmap_batch_getmappings(&sib);
162 smb_idmap_check("smb_idmap_batch_getmappings", stat);
163 smb_idmap_batch_destroy(&sib);
164
165 return (stat == IDMAP_SUCCESS ? 0 : -1);
166 }
167
168 /*
169 * smb_token_create_pxgrps
170 *
171 * Setup the POSIX group membership of the access token if the given UID is
172 * a POSIX UID (non-ephemeral). Both the user's primary group and
173 * supplementary groups will be added to the POSIX group array of the access
174 * token.
175 */
176 static smb_posix_grps_t *
177 smb_token_create_pxgrps(uid_t uid)
178 {
179 struct passwd *pwd;
180 smb_posix_grps_t *pgrps;
181 int ngroups_max, num;
182 gid_t *gids;
183
184 if ((ngroups_max = sysconf(_SC_NGROUPS_MAX)) < 0) {
185 syslog(LOG_ERR, "smb_logon: failed to get _SC_NGROUPS_MAX");
186 return (NULL);
187 }
188
189 pwd = getpwuid(uid);
190 if (pwd == NULL) {
191 pgrps = malloc(sizeof (smb_posix_grps_t));
192 if (pgrps == NULL)
193 return (NULL);
194
195 pgrps->pg_ngrps = 0;
196 return (pgrps);
197 }
198
199 if (pwd->pw_name == NULL) {
200 pgrps = malloc(sizeof (smb_posix_grps_t));
201 if (pgrps == NULL)
202 return (NULL);
203
204 pgrps->pg_ngrps = 1;
205 pgrps->pg_grps[0] = pwd->pw_gid;
206 return (pgrps);
207 }
208
209 gids = (gid_t *)malloc(ngroups_max * sizeof (gid_t));
210 if (gids == NULL) {
211 return (NULL);
212 }
213 bzero(gids, ngroups_max * sizeof (gid_t));
214
215 gids[0] = pwd->pw_gid;
216
217 /*
218 * Setup the groups starting at index 1 (the last arg)
219 * of gids array.
220 */
221 num = _getgroupsbymember(pwd->pw_name, gids, ngroups_max, 1);
222
223 if (num == -1) {
224 syslog(LOG_ERR, "smb_logon: unable "
225 "to get user's supplementary groups");
226 num = 1;
227 }
228
229 pgrps = (smb_posix_grps_t *)malloc(SMB_POSIX_GRPS_SIZE(num));
230 if (pgrps) {
231 pgrps->pg_ngrps = num;
232 bcopy(gids, pgrps->pg_grps, num * sizeof (gid_t));
233 }
234
235 free(gids);
236 return (pgrps);
237 }
238
239 /*
240 * smb_token_destroy
241 *
242 * Release all of the memory associated with a token structure. Ensure
243 * that the token has been unlinked before calling.
244 */
245 void
246 smb_token_destroy(smb_token_t *token)
247 {
248 if (token != NULL) {
249 smb_sid_free(token->tkn_user.i_sid);
250 smb_sid_free(token->tkn_owner.i_sid);
251 smb_sid_free(token->tkn_primary_grp.i_sid);
252 smb_ids_free(&token->tkn_win_grps);
253 smb_privset_free(token->tkn_privileges);
254 free(token->tkn_posix_grps);
255 free(token->tkn_account_name);
256 free(token->tkn_domain_name);
257 free(token->tkn_ssnkey.val);
258 bzero(token, sizeof (smb_token_t));
259 free(token);
260 }
261 }
262
263 /*
264 * Token owner should be set to local Administrators group
265 * in two cases:
266 * 1. The logged on user is a member of Domain Admins group
267 * 2. They are a member of local Administrators group
268 */
269 static void
270 smb_token_set_owner(smb_token_t *token)
271 {
272 #ifdef SMB_SUPPORT_GROUP_OWNER
273 smb_sid_t *owner_sid;
274
275 if (token->tkn_flags & SMB_ATF_ADMIN) {
276 owner_sid = smb_wka_get_sid("Administrators");
277 assert(owner_sid);
278 } else {
279 owner_sid = token->tkn_user->i_sid;
280 }
281
282 token->tkn_owner.i_sid = smb_sid_dup(owner_sid);
283 #endif
284 token->tkn_owner.i_sid = smb_sid_dup(token->tkn_user.i_sid);
285 }
286
287 static smb_privset_t *
288 smb_token_create_privs(smb_token_t *token)
289 {
290 smb_privset_t *privs;
291 smb_giter_t gi;
292 smb_group_t grp;
293 int rc;
294
295 privs = smb_privset_new();
296 if (privs == NULL)
297 return (NULL);
298
299 if (smb_lgrp_iteropen(&gi) != SMB_LGRP_SUCCESS) {
300 smb_privset_free(privs);
301 return (NULL);
302 }
303
304 while (smb_lgrp_iterate(&gi, &grp) == SMB_LGRP_SUCCESS) {
305 if (smb_lgrp_is_member(&grp, token->tkn_user.i_sid))
306 smb_privset_merge(privs, grp.sg_privs);
307 smb_lgrp_free(&grp);
308 }
309 smb_lgrp_iterclose(&gi);
310
311 if (token->tkn_flags & SMB_ATF_ADMIN) {
312 char admgrp[] = "Administrators";
313
314 rc = smb_lgrp_getbyname(admgrp, &grp);
315 if (rc == SMB_LGRP_SUCCESS) {
316 smb_privset_merge(privs, grp.sg_privs);
317 smb_lgrp_free(&grp);
318 }
319
320 /*
321 * This privilege is required to view/edit SACL
322 */
323 smb_privset_enable(privs, SE_SECURITY_LUID);
324 }
325
326 return (privs);
327 }
328
329 static void
330 smb_token_set_flags(smb_token_t *token)
331 {
332 if (smb_token_is_member(token, smb_wka_get_sid("Administrators")))
333 token->tkn_flags |= SMB_ATF_ADMIN;
334
335 if (smb_token_is_member(token, smb_wka_get_sid("Power Users")))
336 token->tkn_flags |= SMB_ATF_POWERUSER;
337
338 if (smb_token_is_member(token, smb_wka_get_sid("Backup Operators")))
339 token->tkn_flags |= SMB_ATF_BACKUPOP;
340 }
341
342 /*
343 * Common token setup for both local and domain users.
344 * This function must be called after the initial setup
345 * has been done.
346 *
347 * Note that the order of calls in this function are important.
348 *
349 * Returns B_TRUE for success.
350 */
351 boolean_t
352 smb_token_setup_common(smb_token_t *token)
353 {
354 smb_token_set_flags(token);
355
356 smb_token_set_owner(token);
357 if (token->tkn_owner.i_sid == NULL)
358 return (B_FALSE);
359
360 /* Privileges */
361 token->tkn_privileges = smb_token_create_privs(token);
362 if (token->tkn_privileges == NULL)
363 return (B_FALSE);
364
365 if (smb_token_sids2ids(token) != 0) {
366 syslog(LOG_ERR, "%s\\%s: idmap failed",
367 token->tkn_domain_name, token->tkn_account_name);
368 return (B_FALSE);
369 }
370
371 /* Solaris Groups */
372 token->tkn_posix_grps = smb_token_create_pxgrps(token->tkn_user.i_id);
373
374 return (smb_token_valid(token));
375 }
376
377 uint32_t
378 smb_logon_init(void)
379 {
380 uint32_t status;
381
382 (void) rw_wrlock(&smb_logoninit_rwl);
383 status = smb_sam_lookup_name(NULL, "guest", SidTypeUser, &smb_guest);
384 if (status != NT_STATUS_SUCCESS) {
385 (void) rw_unlock(&smb_logoninit_rwl);
386 return (status);
387 }
388
389 status = smb_sam_lookup_name(NULL, "domain users", SidTypeGroup,
390 &smb_domusers);
391 if (status != NT_STATUS_SUCCESS) {
392 smb_account_free(&smb_guest);
393 bzero(&smb_guest, sizeof (smb_account_t));
394 (void) rw_unlock(&smb_logoninit_rwl);
395 return (status);
396 }
397
398 (void) rw_unlock(&smb_logoninit_rwl);
399 return (status);
400 }
401
402 void
403 smb_logon_fini(void)
404 {
405 (void) rw_wrlock(&smb_logoninit_rwl);
406 smb_account_free(&smb_guest);
407 smb_account_free(&smb_domusers);
408 bzero(&smb_guest, sizeof (smb_account_t));
409 bzero(&smb_domusers, sizeof (smb_account_t));
410 (void) rw_unlock(&smb_logoninit_rwl);
411 }
412
413 /*
414 * Perform user authentication.
415 *
416 * The dispatched functions must only update the user_info status if they
417 * attempt to authenticate the user.
418 *
419 * On success, a pointer to a new access token is returned.
420 */
421 smb_token_t *
422 smb_logon(smb_logon_t *user_info)
423 {
424 static smb_logonop_t ops[] = {
425 smb_logon_anon,
426 smb_logon_local,
427 smb_logon_domain,
428 smb_logon_guest
429 };
430 smb_token_t *token = NULL;
431 smb_domain_t domain;
432 int n_op = (sizeof (ops) / sizeof (ops[0]));
433 int i;
434
435 user_info->lg_secmode = smb_config_get_secmode();
436 user_info->lg_status = NT_STATUS_NO_SUCH_USER;
437
438 if (smb_domain_lookup_name(user_info->lg_e_domain, &domain))
439 user_info->lg_domain_type = domain.di_type;
440 else
441 user_info->lg_domain_type = SMB_DOMAIN_NULL;
442
443 if ((token = calloc(1, sizeof (smb_token_t))) == NULL) {
444 syslog(LOG_ERR, "logon[%s\\%s]: %m",
445 user_info->lg_e_domain, user_info->lg_e_username);
446 return (NULL);
447 }
448
449 for (i = 0; i < n_op; ++i) {
450 (*ops[i])(user_info, token);
451
452 if (user_info->lg_status == NT_STATUS_SUCCESS)
453 break;
454 }
455
456 if (user_info->lg_status == NT_STATUS_SUCCESS) {
457 if (smb_token_setup_common(token))
458 return (token);
459 }
460
461 smb_token_destroy(token);
462 return (NULL);
463 }
464
465 /*
466 * If the user has an entry in the local database, attempt local authentication.
467 *
468 * In domain mode, we try to exclude domain accounts, which we do by only
469 * accepting local or null (blank) domain names here. Some clients (Mac OS)
470 * don't always send the domain name.
471 *
472 * If we are not going to attempt authentication, this function must return
473 * without updating the status.
474 */
475 static void
476 smb_logon_local(smb_logon_t *user_info, smb_token_t *token)
477 {
478 char guest[SMB_USERNAME_MAXLEN];
479 smb_passwd_t smbpw;
480 uint32_t status;
481
482 if (user_info->lg_secmode == SMB_SECMODE_DOMAIN) {
483 if ((user_info->lg_domain_type != SMB_DOMAIN_LOCAL) &&
484 (user_info->lg_domain_type != SMB_DOMAIN_NULL))
485 return;
486 }
487
488 /*
489 * If the requested account name is "guest" (or whatever
490 * our guest account is named) then don't handle it here.
491 * Let this request fall through to smb_logon_guest().
492 */
493 smb_guest_account(guest, SMB_USERNAME_MAXLEN);
494 if (smb_strcasecmp(guest, user_info->lg_e_username, 0) == 0)
495 return;
496
497 status = smb_token_auth_local(user_info, token, &smbpw);
498 if (status == NT_STATUS_SUCCESS)
499 status = smb_token_setup_local(&smbpw, token);
500
501 user_info->lg_status = status;
502 }
503
504 /*
505 * Guest authentication. This may be a local guest account or the guest
506 * account may be mapped to a local account. These accounts are regular
507 * accounts with normal password protection.
508 *
509 * Only proceed with a guest logon if previous logon options have resulted
510 * in NO_SUCH_USER.
511 *
512 * If we are not going to attempt authentication, this function must return
513 * without updating the status.
514 */
515 static void
516 smb_logon_guest(smb_logon_t *user_info, smb_token_t *token)
517 {
518 char guest[SMB_USERNAME_MAXLEN];
519 smb_passwd_t smbpw;
520 char *temp;
521
522 if (user_info->lg_status != NT_STATUS_NO_SUCH_USER)
523 return;
524
525 /* Get the name of the guest account. */
526 smb_guest_account(guest, SMB_USERNAME_MAXLEN);
527
528 /* Does the guest account exist? */
529 if (smb_pwd_getpwnam(guest, &smbpw) == NULL)
530 return;
531
532 /* Is it enabled? (empty p/w is OK) */
533 if (smbpw.pw_flags & SMB_PWF_DISABLE)
534 return;
535
536 /*
537 * OK, give the client a guest logon. Note that on entry,
538 * lg_e_username is typically something other than "guest"
539 * so we need to set the effective username when createing
540 * the guest token.
541 */
542 temp = user_info->lg_e_username;
543 user_info->lg_e_username = guest;
544 user_info->lg_status = smb_token_setup_guest(user_info, token);
545 user_info->lg_e_username = temp;
546 }
547
548 /*
549 * If user_info represents an anonymous user then setup the token.
550 * Otherwise return without updating the status.
551 */
552 static void
553 smb_logon_anon(smb_logon_t *user_info, smb_token_t *token)
554 {
555 if (user_info->lg_flags & SMB_ATF_ANON)
556 user_info->lg_status = smb_token_setup_anon(token);
557 }
558
559 /*
560 * Try both LM hash and NT hashes with user's password(s) to authenticate
561 * the user.
562 */
563 static uint32_t
564 smb_token_auth_local(smb_logon_t *user_info, smb_token_t *token,
565 smb_passwd_t *smbpw)
566 {
567 boolean_t ok;
568 uint32_t status = NT_STATUS_SUCCESS;
569
570 if (smb_pwd_getpwnam(user_info->lg_e_username, smbpw) == NULL)
571 return (NT_STATUS_NO_SUCH_USER);
572
573 if (smbpw->pw_flags & SMB_PWF_DISABLE)
574 return (NT_STATUS_ACCOUNT_DISABLED);
575
576 if ((smbpw->pw_flags & (SMB_PWF_LM | SMB_PWF_NT)) == 0) {
577 /*
578 * The SMB passwords have not been set.
579 * Return an error that suggests the
580 * password needs to be set.
581 */
582 return (NT_STATUS_PASSWORD_EXPIRED);
583 }
584
585 token->tkn_ssnkey.val = malloc(SMBAUTH_SESSION_KEY_SZ);
586 if (token->tkn_ssnkey.val == NULL)
587 return (NT_STATUS_NO_MEMORY);
588 token->tkn_ssnkey.len = SMBAUTH_SESSION_KEY_SZ;
589
590 ok = smb_auth_validate(
591 smbpw,
592 user_info->lg_domain,
593 user_info->lg_username,
594 user_info->lg_challenge_key.val,
595 user_info->lg_challenge_key.len,
596 user_info->lg_nt_password.val,
597 user_info->lg_nt_password.len,
598 user_info->lg_lm_password.val,
599 user_info->lg_lm_password.len,
600 token->tkn_ssnkey.val);
601 if (ok)
602 return (NT_STATUS_SUCCESS);
603
604 free(token->tkn_ssnkey.val);
605 token->tkn_ssnkey.val = NULL;
606 token->tkn_ssnkey.len = 0;
607
608 status = NT_STATUS_WRONG_PASSWORD;
609 syslog(LOG_NOTICE, "logon[%s\\%s]: %s",
610 user_info->lg_e_domain, user_info->lg_e_username,
611 xlate_nt_status(status));
612
613 return (status);
614 }
615
616 /*
617 * Setup an access token for the specified local user.
618 */
619 static uint32_t
620 smb_token_setup_local(smb_passwd_t *smbpw, smb_token_t *token)
621 {
622 idmap_stat stat;
623 smb_idmap_batch_t sib;
624 smb_idmap_t *umap, *gmap;
625 struct passwd pw;
626 char pwbuf[1024];
627 char nbname[NETBIOS_NAME_SZ];
628
629 (void) smb_getnetbiosname(nbname, sizeof (nbname));
630 token->tkn_account_name = strdup(smbpw->pw_name);
631 token->tkn_domain_name = strdup(nbname);
632
633 if (token->tkn_account_name == NULL ||
634 token->tkn_domain_name == NULL)
635 return (NT_STATUS_NO_MEMORY);
636
637 if (getpwuid_r(smbpw->pw_uid, &pw, pwbuf, sizeof (pwbuf)) == NULL)
638 return (NT_STATUS_NO_SUCH_USER);
639
640 /* Get the SID for user's uid & gid */
641 stat = smb_idmap_batch_create(&sib, 2, SMB_IDMAP_ID2SID);
642 if (stat != IDMAP_SUCCESS)
643 return (NT_STATUS_INTERNAL_ERROR);
644
645 umap = &sib.sib_maps[0];
646 stat = smb_idmap_batch_getsid(sib.sib_idmaph, umap, pw.pw_uid,
647 SMB_IDMAP_USER);
648
649 if (stat != IDMAP_SUCCESS) {
650 smb_idmap_batch_destroy(&sib);
651 return (NT_STATUS_INTERNAL_ERROR);
652 }
653
654 gmap = &sib.sib_maps[1];
655 stat = smb_idmap_batch_getsid(sib.sib_idmaph, gmap, pw.pw_gid,
656 SMB_IDMAP_GROUP);
657
658 if (stat != IDMAP_SUCCESS) {
659 smb_idmap_batch_destroy(&sib);
660 return (NT_STATUS_INTERNAL_ERROR);
661 }
662
663 if (smb_idmap_batch_getmappings(&sib) != IDMAP_SUCCESS)
664 return (NT_STATUS_INTERNAL_ERROR);
665
666 token->tkn_user.i_sid = smb_sid_dup(umap->sim_sid);
667 token->tkn_primary_grp.i_sid = smb_sid_dup(gmap->sim_sid);
668
669 smb_idmap_batch_destroy(&sib);
670
671 if (token->tkn_user.i_sid == NULL ||
672 token->tkn_primary_grp.i_sid == NULL)
673 return (NT_STATUS_NO_MEMORY);
674
675 return (smb_token_setup_wingrps(token));
676 }
677
678 /*
679 * Setup access token for guest connections
680 */
681 static uint32_t
682 smb_token_setup_guest(smb_logon_t *user_info, smb_token_t *token)
683 {
684 token->tkn_account_name = strdup(user_info->lg_e_username);
685
686 (void) rw_rdlock(&smb_logoninit_rwl);
687 token->tkn_domain_name = strdup(smb_guest.a_domain);
688 token->tkn_user.i_sid = smb_sid_dup(smb_guest.a_sid);
689 token->tkn_primary_grp.i_sid = smb_sid_dup(smb_domusers.a_sid);
690 (void) rw_unlock(&smb_logoninit_rwl);
691 token->tkn_flags = SMB_ATF_GUEST;
692
693 if (token->tkn_account_name == NULL ||
694 token->tkn_domain_name == NULL ||
695 token->tkn_user.i_sid == NULL ||
696 token->tkn_primary_grp.i_sid == NULL)
697 return (NT_STATUS_NO_MEMORY);
698
699 return (smb_token_setup_wingrps(token));
700 }
701
702 /*
703 * Setup access token for anonymous connections
704 */
705 static uint32_t
706 smb_token_setup_anon(smb_token_t *token)
707 {
708 smb_sid_t *user_sid;
709
710 token->tkn_account_name = strdup("Anonymous");
711 token->tkn_domain_name = strdup("NT Authority");
712 user_sid = smb_wka_get_sid("Anonymous");
713 token->tkn_user.i_sid = smb_sid_dup(user_sid);
714 token->tkn_primary_grp.i_sid = smb_sid_dup(user_sid);
715 token->tkn_flags = SMB_ATF_ANON;
716
717 if (token->tkn_account_name == NULL ||
718 token->tkn_domain_name == NULL ||
719 token->tkn_user.i_sid == NULL ||
720 token->tkn_primary_grp.i_sid == NULL)
721 return (NT_STATUS_NO_MEMORY);
722
723 return (smb_token_setup_wingrps(token));
724 }
725
726 /*
727 * smb_token_user_sid
728 *
729 * Return a pointer to the user SID in the specified token. A null
730 * pointer indicates an error.
731 */
732 static smb_sid_t *
733 smb_token_user_sid(smb_token_t *token)
734 {
735 return ((token) ? token->tkn_user.i_sid : NULL);
736 }
737
738 /*
739 * smb_token_group_sid
740 *
741 * Return a pointer to the group SID as indicated by the iterator.
742 * Setting the iterator to 0 before calling this function will return
743 * the first group, which will always be the primary group. The
744 * iterator will be incremented before returning the SID so that this
745 * function can be used to cycle through the groups. The caller can
746 * adjust the iterator as required between calls to obtain any specific
747 * group.
748 *
749 * On success a pointer to the appropriate group SID will be returned.
750 * Otherwise a null pointer will be returned.
751 */
752 static smb_sid_t *
753 smb_token_group_sid(smb_token_t *token, int *iterator)
754 {
755 int index;
756
757 if (token == NULL || iterator == NULL)
758 return (NULL);
759
760 if (token->tkn_win_grps.i_ids == NULL)
761 return (NULL);
762
763 index = *iterator;
764
765 if (index < 0 || index >= token->tkn_win_grps.i_cnt)
766 return (NULL);
767
768 ++(*iterator);
769 return (token->tkn_win_grps.i_ids[index].i_sid);
770 }
771
772 /*
773 * smb_token_is_member
774 *
775 * This function will determine whether or not the specified SID is a
776 * member of a token. The user SID and all group SIDs are tested.
777 * Returns 1 if the SID is a member of the token. Otherwise returns 0.
778 */
779 static boolean_t
780 smb_token_is_member(smb_token_t *token, smb_sid_t *sid)
781 {
782 smb_sid_t *tsid;
783 int iterator = 0;
784
785 if (token == NULL || sid == NULL)
786 return (B_FALSE);
787
788 tsid = smb_token_user_sid(token);
789 while (tsid) {
790 if (smb_sid_cmp(tsid, sid))
791 return (B_TRUE);
792
793 tsid = smb_token_group_sid(token, &iterator);
794 }
795
796 return (B_FALSE);
797 }
798
799 /*
800 * smb_token_log
801 *
802 * Diagnostic routine to write the contents of a token to the log.
803 */
804 void
805 smb_token_log(smb_token_t *token)
806 {
807 smb_ids_t *w_grps;
808 smb_id_t *grp;
809 smb_posix_grps_t *x_grps;
810 char sidstr[SMB_SID_STRSZ];
811 int i;
812
813 if (token == NULL)
814 return;
815
816 syslog(LOG_DEBUG, "Token for %s\\%s",
817 (token->tkn_domain_name) ? token->tkn_domain_name : "-NULL-",
818 (token->tkn_account_name) ? token->tkn_account_name : "-NULL-");
819
820 syslog(LOG_DEBUG, " User->Attr: %d", token->tkn_user.i_attrs);
821 smb_sid_tostr((smb_sid_t *)token->tkn_user.i_sid, sidstr);
822 syslog(LOG_DEBUG, " User->Sid: %s (id=%u)", sidstr,
823 token->tkn_user.i_id);
824
825 smb_sid_tostr((smb_sid_t *)token->tkn_owner.i_sid, sidstr);
826 syslog(LOG_DEBUG, " Ownr->Sid: %s (id=%u)",
827 sidstr, token->tkn_owner.i_id);
828
829 smb_sid_tostr((smb_sid_t *)token->tkn_primary_grp.i_sid, sidstr);
830 syslog(LOG_DEBUG, " PGrp->Sid: %s (id=%u)",
831 sidstr, token->tkn_primary_grp.i_id);
832
833 w_grps = &token->tkn_win_grps;
834 if (w_grps->i_ids) {
835 syslog(LOG_DEBUG, " Windows groups: %d", w_grps->i_cnt);
836 grp = w_grps->i_ids;
837 for (i = 0; i < w_grps->i_cnt; ++i, grp++) {
838 syslog(LOG_DEBUG,
839 " Grp[%d].Attr:%d", i, grp->i_attrs);
840 if (grp->i_sid != NULL) {
841 smb_sid_tostr((smb_sid_t *)grp->i_sid, sidstr);
842 syslog(LOG_DEBUG,
843 " Grp[%d].Sid: %s (id=%u)", i, sidstr,
844 grp->i_id);
845 }
846 }
847 } else {
848 syslog(LOG_DEBUG, " No Windows groups");
849 }
850
851 x_grps = token->tkn_posix_grps;
852 if (x_grps) {
853 syslog(LOG_DEBUG, " Solaris groups: %d", x_grps->pg_ngrps);
854 for (i = 0; i < x_grps->pg_ngrps; i++)
855 syslog(LOG_DEBUG, " %u", x_grps->pg_grps[i]);
856 } else {
857 syslog(LOG_DEBUG, " No Solaris groups");
858 }
859
860 if (token->tkn_privileges)
861 smb_privset_log(token->tkn_privileges);
862 else
863 syslog(LOG_DEBUG, " No privileges");
864 }
865
866 /*
867 * Sets up local and well-known group membership for the given
868 * token. Two assumptions have been made here:
869 *
870 * a) token already contains a valid user SID so that group
871 * memberships can be established
872 *
873 * b) token belongs to a local or anonymous user
874 */
875 static uint32_t
876 smb_token_setup_wingrps(smb_token_t *token)
877 {
878 smb_ids_t tkn_grps;
879 uint32_t status;
880
881
882 /*
883 * We always want the user's primary group in the list
884 * of groups.
885 */
886 tkn_grps.i_cnt = 1;
887 if ((tkn_grps.i_ids = malloc(sizeof (smb_id_t))) == NULL)
888 return (NT_STATUS_NO_MEMORY);
889
890 tkn_grps.i_ids->i_sid = smb_sid_dup(token->tkn_primary_grp.i_sid);
891 tkn_grps.i_ids->i_attrs = token->tkn_primary_grp.i_attrs;
892 if (tkn_grps.i_ids->i_sid == NULL) {
893 smb_ids_free(&tkn_grps);
894 return (NT_STATUS_NO_MEMORY);
895 }
896
897 status = smb_sam_usr_groups(token->tkn_user.i_sid, &tkn_grps);
898 if (status != NT_STATUS_SUCCESS) {
899 smb_ids_free(&tkn_grps);
900 return (status);
901 }
902
903 status = smb_wka_token_groups(token->tkn_flags, &tkn_grps);
904 if (status != NT_STATUS_SUCCESS) {
905 smb_ids_free(&tkn_grps);
906 return (status);
907 }
908
909 token->tkn_win_grps = tkn_grps;
910 return (status);
911 }
912
913 /*
914 * Returns the guest account name in the provided buffer.
915 *
916 * By default the name would be "guest" unless there's
917 * a idmap name-based rule which maps the guest to a local
918 * Solaris user in which case the name of that user is
919 * returned.
920 */
921 static void
922 smb_guest_account(char *guest, size_t buflen)
923 {
924 idmap_stat stat;
925 uid_t guest_uid;
926 struct passwd pw;
927 char pwbuf[1024];
928 int idtype;
929
930 /* default Guest account name */
931 (void) rw_rdlock(&smb_logoninit_rwl);
932 (void) strlcpy(guest, smb_guest.a_name, buflen);
933
934 idtype = SMB_IDMAP_USER;
935 stat = smb_idmap_getid(smb_guest.a_sid, &guest_uid, &idtype);
936 (void) rw_unlock(&smb_logoninit_rwl);
937
938 if (stat != IDMAP_SUCCESS)
939 return;
940
941 /* If Ephemeral ID return the default name */
942 if (IDMAP_ID_IS_EPHEMERAL(guest_uid))
943 return;
944
945 if (getpwuid_r(guest_uid, &pw, pwbuf, sizeof (pwbuf)) == NULL)
946 return;
947
948 (void) strlcpy(guest, pw.pw_name, buflen);
949 }