This is another rather major change to the samba authenticaion

subystem.

The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.

This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality.  While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.

This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists.  It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.

Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.

While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.

The following parameters have changed:
 - use rhosts =

  This has been replaced by the 'rhosts' authentication method,
 and can be specified like 'auth methods = guest rhosts'

 - hosts equiv =

  This needs both this parameter and an 'auth methods' entry
  to be effective.  (auth methods = guest hostsequiv ....)

 - plaintext to smbpasswd =

  This is replaced by specifying 'sam' rather than 'local'
  in the auth methods.

The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.

The available auth methods are:

guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)


Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.

Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)

1 files changed, 279 insertions, 0 deletions

diff --git a/source3/auth/auth_info.c b/source3/auth/auth_info.c
new file mode 100644
index 0000000000..12b843d781
--- /dev/null
+++ b/source3/auth/auth_info.c
@@ -0,0 +1,279 @@
+/* 
+   Unix SMB/Netbios implementation.
+   Version 3.0.
+   Authentication utility functions
+   Copyright (C) Andrew Bartlett 2001
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+
+const struct auth_init_function builtin_auth_init_functions[] = {
+	{ "guest", auth_init_guest },
+	{ "rhosts", auth_init_rhosts },
+	{ "hostsequiv", auth_init_hostsequiv },
+	{ "sam", auth_init_sam },
+	{ "unix", auth_init_unix },
+	{ "local", auth_init_local },
+	{ "smbserver", auth_init_smbserver },
+	{ "ntdomain", auth_init_ntdomain },
+	{ "winbind", auth_init_winbind },
+	{ NULL, NULL}
+};
+
+/***************************************************************************
+ Make a auth_info struct
+***************************************************************************/
+
+static BOOL make_auth_info(auth_authsupplied_info **auth_info) 
+{
+	*auth_info = malloc(sizeof(**auth_info));
+	if (!*auth_info) {
+		DEBUG(0,("make_auth_info: malloc failed!\n"));
+		return False;
+	}
+	ZERO_STRUCTP(*auth_info);
+	
+	return True;
+}
+
+/***************************************************************************
+ Make a auth_info struct with a specified list.
+***************************************************************************/
+
+BOOL make_auth_info_list(auth_authsupplied_info **auth_info, auth_methods *list) 
+{
+	if (!make_auth_info(auth_info)) {
+		return False;
+	}
+	
+	(*auth_info)->auth_method_list = list;
+	
+	return True;
+}
+
+/***************************************************************************
+ Make a auth_info struct for the auth subsystem
+***************************************************************************/
+
+static BOOL make_auth_info_text_list(auth_authsupplied_info **auth_info, char **text_list) 
+{
+	auth_methods *list = NULL;
+	auth_methods *t = NULL;
+	auth_methods *tmp;
+	int i;
+	
+	for (;*text_list; text_list++)
+	{ 
+		DEBUG(5,("Attempting to find an auth method to match %s\n", *text_list));
+		for (i = 0; builtin_auth_init_functions[i].name; i++)
+		{
+			if (strequal(builtin_auth_init_functions[i].name, *text_list))
+			{
+				DEBUG(5,("Found auth method %s (at pos %d)\n", *text_list, i));
+				/* Malloc entry,  fill it,  link it */
+				t = (auth_methods *)malloc(sizeof(*t));
+				if (!t) {
+					DEBUG(0,("make_pw_chat: malloc failed!\n"));
+					return False;
+				}
+				
+				ZERO_STRUCTP(t);
+				
+				if (builtin_auth_init_functions[i].init(&t)) {
+					DEBUG(5,("auth method %s has a valid init\n", *text_list));
+					t->name = builtin_auth_init_functions[i].name;
+					DLIST_ADD_END(list, t, tmp);
+				} else {
+					DEBUG(5,("auth method %s DOES NOT have a valid init\n", *text_list));
+				}
+				break;
+			}
+		}
+	}
+	
+	make_auth_info_list(auth_info, list);
+	
+	return True;
+}
+
+/***************************************************************************
+ Make a auth_info struct for the auth subsystem
+***************************************************************************/
+
+BOOL make_auth_info_subsystem(auth_authsupplied_info **auth_info) 
+{
+	char **auth_method_list = NULL; 
+	
+	if (!make_auth_info(auth_info)) {
+		return False;
+	}
+	
+	if (lp_auth_methods() && !lp_list_copy(&auth_method_list, lp_auth_methods())) {
+		return False;
+	}
+
+	if (auth_method_list == NULL) {
+		switch (lp_security()) 
+		{
+		case SEC_DOMAIN:
+			DEBUG(5,("Making default auth method list for security=domain\n"));
+			auth_method_list = lp_list_make("guest ntdomain local");
+			break;
+		case SEC_SERVER:
+			DEBUG(5,("Making default auth method list for security=server\n"));
+			auth_method_list = lp_list_make("guest smbserver local");
+			break;
+		case SEC_USER:
+			DEBUG(5,("Making default auth method list for security=user\n"));
+			auth_method_list = lp_list_make("guest local");
+			break;
+		case SEC_SHARE:
+			DEBUG(5,("Making default auth method list for security=share\n"));
+			auth_method_list = lp_list_make("guest local");
+			break;
+		}
+	} else {
+		DEBUG(5,("Using specified auth order\n"));
+	}
+	
+	if (!make_auth_info_text_list(auth_info, auth_method_list)) {
+		lp_list_free(&auth_method_list);
+		return False;
+	}
+	
+	lp_list_free(&auth_method_list);
+	return True;
+}
+
+/***************************************************************************
+ Make a auth_info struct with a random challange
+***************************************************************************/
+
+BOOL make_auth_info_random(auth_authsupplied_info **auth_info) 
+{
+	uchar chal[8];
+	if (!make_auth_info_subsystem(auth_info)) {
+		return False;
+	}
+	
+	generate_random_buffer(chal, sizeof(chal), False);
+	(*auth_info)->challange = data_blob(chal, sizeof(chal));
+
+	(*auth_info)->challange_set_by = "random";
+
+	return True;
+}
+
+/***************************************************************************
+ Make a auth_info struct with a fixed challange
+***************************************************************************/
+
+BOOL make_auth_info_fixed(auth_authsupplied_info **auth_info, uchar chal[8]) 
+{
+	if (!make_auth_info_subsystem(auth_info)) {
+		return False;
+	}
+	
+	(*auth_info)->challange = data_blob(chal, 8);
+	return True;
+}
+
+/***************************************************************************
+ Clear out a auth_info struct that has been allocated
+***************************************************************************/
+
+void free_auth_info(auth_authsupplied_info **auth_info)
+{
+	auth_methods *list;
+	if (*auth_info != NULL) {
+		list = (*auth_info)->auth_method_list;	
+		while (list) {
+			auth_methods *old_head = list;
+			if (list->free_private_data) {
+				list->free_private_data(&(list->private_data));
+			}
+			DLIST_REMOVE(list, list);			
+			SAFE_FREE(old_head);
+		}
+		
+		data_blob_free(&(*auth_info)->challange);
+		ZERO_STRUCT(**auth_info);
+	}
+	SAFE_FREE(*auth_info);
+}
+
+/****************************************************************************
+ Try to get a challange out of the various authenticaion modules.
+ It is up to the caller to free it.
+****************************************************************************/
+
+DATA_BLOB auth_get_challange(auth_authsupplied_info *auth_info) 
+{
+	DATA_BLOB challange = data_blob(NULL, 0);
+	char *challange_set_by = NULL;
+	auth_methods *auth_method;
+
+	if (auth_info->challange.length) {
+		DEBUG(5, ("auth_get_challange: returning previous challange (normal)\n"));
+		return data_blob(auth_info->challange.data, auth_info->challange.length);
+	}
+
+	for (auth_method = auth_info->auth_method_list; auth_method; auth_method = auth_method->next)
+	{
+		if (auth_method->get_chal) {
+			DEBUG(5, ("auth_get_challange: getting challange from module %s\n", auth_method->name));
+			if (challange_set_by) {
+				DEBUG(1, ("auth_get_challange: CONFIGURATION ERROR: authenticaion method %s has already specified a challange.  Challange by %s ignored.\n", 
+					  challange_set_by, auth_method->name));
+			} else {
+				challange = auth_method->get_chal(&auth_method->private_data, auth_info);
+				if (challange.length) {
+					DEBUG(5, ("auth_get_challange: sucessfully got challange from module %s\n", auth_method->name));
+					auth_info->challange = challange;
+					challange_set_by = auth_method->name;
+					auth_info->challange_set_method = auth_method;
+				} else {
+					DEBUG(3, ("auth_get_challange: getting challange from authenticaion method %s FAILED.\n", 
+						  auth_method->name));
+				}
+			}
+		} else {
+			DEBUG(5, ("auth_get_challange: module %s did not want to specify a challange\n", auth_method->name));
+		}
+	}
+	
+	if (!challange_set_by) {
+		uchar chal[8];
+		
+		generate_random_buffer(chal, sizeof(chal), False);
+		auth_info->challange = data_blob(chal, sizeof(chal));
+		
+		challange_set_by = "random";
+	} 
+	
+	DEBUG(5, ("auth_info challange created by %s\n", challange_set_by));
+	DEBUG(5, ("challange is: \n"));
+	dump_data(5, auth_info->challange.data, (auth_info)->challange.length);
+	
+	SMB_ASSERT(auth_info->challange.length == 8);
+
+	auth_info->challange_set_by=challange_set_by;
+
+	return data_blob(auth_info->challange.data, auth_info->challange.length);
+}
+
+