diff options
Diffstat (limited to 'source4/kdc')
44 files changed, 16191 insertions, 0 deletions
diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c new file mode 100644 index 0000000..83d5c90 --- /dev/null +++ b/source4/kdc/db-glue.c @@ -0,0 +1,3668 @@ +/* + Unix SMB/CIFS implementation. + + Database Glue between Samba and the KDC + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009 + Copyright (C) Simo Sorce <idra@samba.org> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libcli/security/security.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "auth/auth.h" +#include "auth/auth_sam.h" +#include "dsdb/samdb/samdb.h" +#include "dsdb/common/util.h" +#include "librpc/gen_ndr/ndr_drsblobs.h" +#include "param/param.h" +#include "param/secrets.h" +#include "../lib/crypto/md4.h" +#include "system/kerberos.h" +#include "auth/kerberos/kerberos.h" +#include "kdc/sdb.h" +#include "kdc/samba_kdc.h" +#include "kdc/db-glue.h" +#include "kdc/pac-glue.h" +#include "librpc/gen_ndr/ndr_irpc_c.h" +#include "lib/messaging/irpc.h" + +#undef strcasecmp +#undef strncasecmp + +#define SAMBA_KVNO_GET_KRBTGT(kvno) \ + ((uint16_t)(((uint32_t)kvno) >> 16)) + +#define SAMBA_KVNO_GET_VALUE(kvno) \ + ((uint16_t)(((uint32_t)kvno) & 0xFFFF)) + +#define SAMBA_KVNO_AND_KRBTGT(kvno, krbtgt) \ + ((krb5_kvno)((((uint32_t)kvno) & 0xFFFF) | \ + ((((uint32_t)krbtgt) << 16) & 0xFFFF0000))) + +enum trust_direction { + UNKNOWN = 0, + INBOUND = LSA_TRUST_DIRECTION_INBOUND, + OUTBOUND = LSA_TRUST_DIRECTION_OUTBOUND +}; + +static const char *trust_attrs[] = { + "securityIdentifier", + "flatName", + "trustPartner", + "trustAttributes", + "trustDirection", + "trustType", + "msDS-TrustForestTrustInfo", + "trustAuthIncoming", + "trustAuthOutgoing", + "whenCreated", + "msDS-SupportedEncryptionTypes", + NULL +}; + +/* + send a message to the drepl server telling it to initiate a + REPL_SECRET getncchanges extended op to fetch the users secrets + */ +static void auth_sam_trigger_repl_secret(TALLOC_CTX *mem_ctx, + struct imessaging_context *msg_ctx, + struct tevent_context *event_ctx, + struct ldb_dn *user_dn) +{ + struct dcerpc_binding_handle *irpc_handle; + struct drepl_trigger_repl_secret r; + struct tevent_req *req; + TALLOC_CTX *tmp_ctx; + + tmp_ctx = talloc_new(mem_ctx); + if (tmp_ctx == NULL) { + return; + } + + irpc_handle = irpc_binding_handle_by_name(tmp_ctx, msg_ctx, + "dreplsrv", + &ndr_table_irpc); + if (irpc_handle == NULL) { + DEBUG(1,(__location__ ": Unable to get binding handle for dreplsrv\n")); + TALLOC_FREE(tmp_ctx); + return; + } + + r.in.user_dn = ldb_dn_get_linearized(user_dn); + + /* + * This seem to rely on the current IRPC implementation, + * which delivers the message in the _send function. + * + * TODO: we need a ONE_WAY IRPC handle and register + * a callback and wait for it to be triggered! + */ + req = dcerpc_drepl_trigger_repl_secret_r_send(tmp_ctx, + event_ctx, + irpc_handle, + &r); + + /* we aren't interested in a reply */ + talloc_free(req); + TALLOC_FREE(tmp_ctx); +} + +static time_t ldb_msg_find_krb5time_ldap_time(struct ldb_message *msg, const char *attr, time_t default_val) +{ + const char *tmp; + const char *gentime; + struct tm tm; + + gentime = ldb_msg_find_attr_as_string(msg, attr, NULL); + if (!gentime) + return default_val; + + tmp = strptime(gentime, "%Y%m%d%H%M%SZ", &tm); + if (tmp == NULL) { + return default_val; + } + + return timegm(&tm); +} + +static struct SDBFlags uf2SDBFlags(krb5_context context, uint32_t userAccountControl, enum samba_kdc_ent_type ent_type) +{ + struct SDBFlags flags = int2SDBFlags(0); + + /* we don't allow kadmin deletes */ + flags.immutable = 1; + + /* mark the principal as invalid to start with */ + flags.invalid = 1; + + flags.renewable = 1; + + /* All accounts are servers, but this may be disabled again in the caller */ + flags.server = 1; + + /* Account types - clear the invalid bit if it turns out to be valid */ + if (userAccountControl & UF_NORMAL_ACCOUNT) { + if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT || ent_type == SAMBA_KDC_ENT_TYPE_ANY) { + flags.client = 1; + } + flags.invalid = 0; + } + + if (userAccountControl & UF_INTERDOMAIN_TRUST_ACCOUNT) { + if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT || ent_type == SAMBA_KDC_ENT_TYPE_ANY) { + flags.client = 1; + } + flags.invalid = 0; + } + if (userAccountControl & UF_WORKSTATION_TRUST_ACCOUNT) { + if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT || ent_type == SAMBA_KDC_ENT_TYPE_ANY) { + flags.client = 1; + } + flags.invalid = 0; + } + if (userAccountControl & UF_SERVER_TRUST_ACCOUNT) { + if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT || ent_type == SAMBA_KDC_ENT_TYPE_ANY) { + flags.client = 1; + } + flags.invalid = 0; + } + + /* Not permitted to act as a client if disabled */ + if (userAccountControl & UF_ACCOUNTDISABLE) { + flags.client = 0; + } + if (userAccountControl & UF_LOCKOUT) { + flags.locked_out = 1; + } +/* + if (userAccountControl & UF_PASSWORD_NOTREQD) { + flags.invalid = 1; + } +*/ +/* + UF_PASSWORD_CANT_CHANGE and UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED are irrelevent +*/ + if (userAccountControl & UF_TEMP_DUPLICATE_ACCOUNT) { + flags.invalid = 1; + } + +/* UF_DONT_EXPIRE_PASSWD and UF_USE_DES_KEY_ONLY handled in samba_kdc_message2entry() */ + +/* + if (userAccountControl & UF_MNS_LOGON_ACCOUNT) { + flags.invalid = 1; + } +*/ + if (userAccountControl & UF_SMARTCARD_REQUIRED) { + flags.require_hwauth = 1; + } + if (userAccountControl & UF_TRUSTED_FOR_DELEGATION) { + flags.ok_as_delegate = 1; + } + if (userAccountControl & UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION) { + /* + * this is confusing... + * + * UF_TRUSTED_FOR_DELEGATION + * => ok_as_delegate + * + * and + * + * UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION + * => trusted_for_delegation + */ + flags.trusted_for_delegation = 1; + } + if (!(userAccountControl & UF_NOT_DELEGATED)) { + flags.forwardable = 1; + flags.proxiable = 1; + } + + if (userAccountControl & UF_DONT_REQUIRE_PREAUTH) { + flags.require_preauth = 0; + } else { + flags.require_preauth = 1; + } + + if (userAccountControl & UF_NO_AUTH_DATA_REQUIRED) { + flags.no_auth_data_reqd = 1; + } + + return flags; +} + +static int samba_kdc_entry_destructor(struct samba_kdc_entry *p) +{ + if (p->db_entry != NULL) { + /* + * A sdb_entry still has a reference + */ + return -1; + } + + if (p->kdc_entry != NULL) { + /* + * hdb_entry or krb5_db_entry still + * have a reference... + */ + return -1; + } + + return 0; +} + +/* + * Sort keys in descending order of strength. + * + * Explanaton from Greg Hudson: + * + * To encrypt tickets only the first returned key is used by the MIT KDC. The + * other keys just communicate support for session key enctypes, and aren't + * really used. The encryption key for the ticket enc part doesn't have + * to be of a type requested by the client. The session key enctype is chosen + * based on the client preference order, limited by the set of enctypes present + * in the server keys (unless the string attribute is set on the server + * principal overriding that set). + */ + +static int sdb_key_strength_priority(krb5_enctype etype) +{ + static const krb5_enctype etype_list[] = { + ENCTYPE_AES256_CTS_HMAC_SHA1_96, + ENCTYPE_AES128_CTS_HMAC_SHA1_96, + ENCTYPE_DES3_CBC_SHA1, + ENCTYPE_ARCFOUR_HMAC, + ENCTYPE_DES_CBC_MD5, + ENCTYPE_DES_CBC_MD4, + ENCTYPE_DES_CBC_CRC, + ENCTYPE_NULL + }; + int i; + + for (i = 0; i < ARRAY_SIZE(etype_list); i++) { + if (etype == etype_list[i]) { + break; + } + } + + return ARRAY_SIZE(etype_list) - i; +} + +static int sdb_key_strength_cmp(const struct sdb_key *k1, const struct sdb_key *k2) +{ + int p1 = sdb_key_strength_priority(KRB5_KEY_TYPE(&k1->key)); + int p2 = sdb_key_strength_priority(KRB5_KEY_TYPE(&k2->key)); + + if (p1 == p2) { + return 0; + } + + if (p1 > p2) { + /* + * Higher priority comes first + */ + return -1; + } else { + return 1; + } +} + +static void samba_kdc_sort_keys(struct sdb_keys *keys) +{ + if (keys == NULL) { + return; + } + + TYPESAFE_QSORT(keys->val, keys->len, sdb_key_strength_cmp); +} + +int samba_kdc_set_fixed_keys(krb5_context context, + const struct ldb_val *secretbuffer, + uint32_t supported_enctypes, + struct sdb_keys *keys) +{ + uint16_t allocated_keys = 0; + int ret; + + allocated_keys = 3; + keys->len = 0; + keys->val = calloc(allocated_keys, sizeof(struct sdb_key)); + if (keys->val == NULL) { + memset(secretbuffer->data, 0, secretbuffer->length); + ret = ENOMEM; + goto out; + } + + if (supported_enctypes & ENC_HMAC_SHA1_96_AES256) { + struct sdb_key key = {}; + + ret = smb_krb5_keyblock_init_contents(context, + ENCTYPE_AES256_CTS_HMAC_SHA1_96, + secretbuffer->data, + MIN(secretbuffer->length, 32), + &key.key); + if (ret) { + memset(secretbuffer->data, 0, secretbuffer->length); + goto out; + } + + keys->val[keys->len] = key; + keys->len++; + } + + if (supported_enctypes & ENC_HMAC_SHA1_96_AES128) { + struct sdb_key key = {}; + + ret = smb_krb5_keyblock_init_contents(context, + ENCTYPE_AES128_CTS_HMAC_SHA1_96, + secretbuffer->data, + MIN(secretbuffer->length, 16), + &key.key); + if (ret) { + memset(secretbuffer->data, 0, secretbuffer->length); + goto out; + } + + keys->val[keys->len] = key; + keys->len++; + } + + if (supported_enctypes & ENC_RC4_HMAC_MD5) { + struct sdb_key key = {}; + + ret = smb_krb5_keyblock_init_contents(context, + ENCTYPE_ARCFOUR_HMAC, + secretbuffer->data, + MIN(secretbuffer->length, 16), + &key.key); + if (ret) { + memset(secretbuffer->data, 0, secretbuffer->length); + goto out; + } + + keys->val[keys->len] = key; + keys->len++; + } + ret = 0; +out: + return ret; +} + + +static int samba_kdc_set_random_keys(krb5_context context, + uint32_t supported_enctypes, + struct sdb_keys *keys) +{ + struct ldb_val secret_val; + uint8_t secretbuffer[32]; + + /* + * Fake keys until we have a better way to reject + * non-pkinit requests. + * + * We just need to indicate which encryption types are + * supported. + */ + generate_secret_buffer(secretbuffer, sizeof(secretbuffer)); + + secret_val = data_blob_const(secretbuffer, + sizeof(secretbuffer)); + return samba_kdc_set_fixed_keys(context, + &secret_val, + supported_enctypes, + keys); +} + +struct samba_kdc_user_keys { + struct sdb_keys *skeys; + uint32_t kvno; + uint32_t *returned_kvno; + uint32_t supported_enctypes; + uint32_t *available_enctypes; + const struct samr_Password *nthash; + const char *salt_string; + uint16_t num_pkeys; + const struct package_PrimaryKerberosKey4 *pkeys; +}; + +static krb5_error_code samba_kdc_fill_user_keys(krb5_context context, + struct samba_kdc_user_keys *p) +{ + /* + * Make sure we'll never reveal DES keys + */ + uint32_t supported_enctypes = p->supported_enctypes &= ~(ENC_CRC32 | ENC_RSA_MD5); + uint32_t _available_enctypes = 0; + uint32_t *available_enctypes = p->available_enctypes; + uint32_t _returned_kvno = 0; + uint32_t *returned_kvno = p->returned_kvno; + uint32_t num_pkeys = p->num_pkeys; + uint32_t allocated_keys = num_pkeys; + uint32_t i; + int ret; + + if (available_enctypes == NULL) { + available_enctypes = &_available_enctypes; + } + + *available_enctypes = 0; + + if (returned_kvno == NULL) { + returned_kvno = &_returned_kvno; + } + + *returned_kvno = p->kvno; + + if (p->nthash != NULL) { + allocated_keys += 1; + } + + allocated_keys = MAX(1, allocated_keys); + + /* allocate space to decode into */ + p->skeys->len = 0; + p->skeys->val = calloc(allocated_keys, sizeof(struct sdb_key)); + if (p->skeys->val == NULL) { + return ENOMEM; + } + + for (i=0; i < num_pkeys; i++) { + struct sdb_key key = {}; + uint32_t enctype_bit; + + if (p->pkeys[i].value == NULL) { + continue; + } + + enctype_bit = kerberos_enctype_to_bitmap(p->pkeys[i].keytype); + if (!(enctype_bit & supported_enctypes)) { + continue; + } + + if (p->salt_string != NULL) { + DATA_BLOB salt; + + salt = data_blob_string_const(p->salt_string); + + key.salt = calloc(1, sizeof(*key.salt)); + if (key.salt == NULL) { + ret = ENOMEM; + goto fail; + } + + key.salt->type = KRB5_PW_SALT; + + ret = smb_krb5_copy_data_contents(&key.salt->salt, + salt.data, + salt.length); + if (ret) { + ZERO_STRUCTP(key.salt); + sdb_key_free(&key); + goto fail; + } + } + + ret = smb_krb5_keyblock_init_contents(context, + p->pkeys[i].keytype, + p->pkeys[i].value->data, + p->pkeys[i].value->length, + &key.key); + if (ret == 0) { + p->skeys->val[p->skeys->len++] = key; + *available_enctypes |= enctype_bit; + continue; + } + ZERO_STRUCT(key.key); + sdb_key_free(&key); + if (ret == KRB5_PROG_ETYPE_NOSUPP) { + DEBUG(2,("Unsupported keytype ignored - type %u\n", + p->pkeys[i].keytype)); + ret = 0; + continue; + } + + goto fail; + } + + if (p->nthash != NULL && (supported_enctypes & ENC_RC4_HMAC_MD5)) { + struct sdb_key key = {}; + + ret = smb_krb5_keyblock_init_contents(context, + ENCTYPE_ARCFOUR_HMAC, + p->nthash->hash, + sizeof(p->nthash->hash), + &key.key); + if (ret == 0) { + p->skeys->val[p->skeys->len++] = key; + + *available_enctypes |= ENC_RC4_HMAC_MD5; + } else if (ret == KRB5_PROG_ETYPE_NOSUPP) { + DEBUG(2,("Unsupported keytype ignored - type %u\n", + ENCTYPE_ARCFOUR_HMAC)); + ret = 0; + } + if (ret != 0) { + goto fail; + } + } + + samba_kdc_sort_keys(p->skeys); + + return 0; +fail: + sdb_keys_free(p->skeys); + return ret; +} + +krb5_error_code samba_kdc_message2entry_keys(krb5_context context, + TALLOC_CTX *mem_ctx, + const struct ldb_message *msg, + bool is_krbtgt, + bool is_rodc, + uint32_t userAccountControl, + enum samba_kdc_ent_type ent_type, + unsigned flags, + krb5_kvno requested_kvno, + struct sdb_entry *entry, + const uint32_t supported_enctypes_in, + uint32_t *supported_enctypes_out) +{ + krb5_error_code ret = 0; + enum ndr_err_code ndr_err; + struct samr_Password *hash; + unsigned int num_ntPwdHistory = 0; + struct samr_Password *ntPwdHistory = NULL; + struct samr_Password *old_hash = NULL; + struct samr_Password *older_hash = NULL; + const struct ldb_val *sc_val; + struct supplementalCredentialsBlob scb; + struct supplementalCredentialsPackage *scpk = NULL; + struct package_PrimaryKerberosBlob _pkb; + struct package_PrimaryKerberosCtr4 *pkb4 = NULL; + int krbtgt_number = 0; + uint32_t current_kvno; + uint32_t old_kvno = 0; + uint32_t older_kvno = 0; + uint32_t returned_kvno = 0; + uint16_t i; + struct samba_kdc_user_keys keys = { .num_pkeys = 0, }; + struct samba_kdc_user_keys old_keys = { .num_pkeys = 0, }; + struct samba_kdc_user_keys older_keys = { .num_pkeys = 0, }; + uint32_t available_enctypes = 0; + uint32_t supported_enctypes = supported_enctypes_in; + + *supported_enctypes_out = 0; + + /* Is this the krbtgt or a RODC krbtgt */ + if (is_rodc) { + krbtgt_number = ldb_msg_find_attr_as_int(msg, "msDS-SecondaryKrbTgtNumber", -1); + + if (krbtgt_number == -1) { + return EINVAL; + } + if (krbtgt_number == 0) { + return EINVAL; + } + } + + if ((ent_type == SAMBA_KDC_ENT_TYPE_CLIENT) + && (userAccountControl & UF_SMARTCARD_REQUIRED)) { + ret = samba_kdc_set_random_keys(context, + supported_enctypes, + &entry->keys); + + *supported_enctypes_out = supported_enctypes & ENC_ALL_TYPES; + + goto out; + } + + current_kvno = ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0); + if (current_kvno > 1) { + old_kvno = current_kvno - 1; + } + if (current_kvno > 2) { + older_kvno = current_kvno - 2; + } + if (is_krbtgt) { + /* + * Even for the main krbtgt account + * we have to strictly split the kvno into + * two 16-bit parts and the upper 16-bit + * need to be all zero, even if + * the msDS-KeyVersionNumber has a value + * larger than 65535. + * + * See https://bugzilla.samba.org/show_bug.cgi?id=14951 + */ + current_kvno = SAMBA_KVNO_GET_VALUE(current_kvno); + old_kvno = SAMBA_KVNO_GET_VALUE(old_kvno); + older_kvno = SAMBA_KVNO_GET_VALUE(older_kvno); + requested_kvno = SAMBA_KVNO_GET_VALUE(requested_kvno); + } + + /* Get keys from the db */ + + hash = samdb_result_hash(mem_ctx, msg, "unicodePwd"); + num_ntPwdHistory = samdb_result_hashes(mem_ctx, msg, + "ntPwdHistory", + &ntPwdHistory); + if (num_ntPwdHistory > 1) { + old_hash = &ntPwdHistory[1]; + } + if (num_ntPwdHistory > 2) { + older_hash = &ntPwdHistory[1]; + } + sc_val = ldb_msg_find_ldb_val(msg, "supplementalCredentials"); + + /* supplementalCredentials if present */ + if (sc_val) { + ndr_err = ndr_pull_struct_blob_all(sc_val, mem_ctx, &scb, + (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + dump_data(0, sc_val->data, sc_val->length); + ret = EINVAL; + goto out; + } + + if (scb.sub.signature != SUPPLEMENTAL_CREDENTIALS_SIGNATURE) { + if (scb.sub.num_packages != 0) { + NDR_PRINT_DEBUG(supplementalCredentialsBlob, &scb); + ret = EINVAL; + goto out; + } + } + + for (i=0; i < scb.sub.num_packages; i++) { + if (strcmp("Primary:Kerberos-Newer-Keys", scb.sub.packages[i].name) == 0) { + scpk = &scb.sub.packages[i]; + if (!scpk->data || !scpk->data[0]) { + scpk = NULL; + continue; + } + break; + } + } + } + /* + * Primary:Kerberos-Newer-Keys element + * of supplementalCredentials + * + * The legacy Primary:Kerberos only contains + * single DES keys, which are completely ignored + * now. + */ + if (scpk) { + DATA_BLOB blob; + + blob = strhex_to_data_blob(mem_ctx, scpk->data); + if (!blob.data) { + ret = ENOMEM; + goto out; + } + + /* we cannot use ndr_pull_struct_blob_all() here, as w2k and w2k3 add padding bytes */ + ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, &_pkb, + (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + ret = EINVAL; + krb5_set_error_message(context, ret, "samba_kdc_message2entry_keys: could not parse package_PrimaryKerberosBlob"); + krb5_warnx(context, "samba_kdc_message2entry_keys: could not parse package_PrimaryKerberosBlob"); + goto out; + } + + if (_pkb.version != 4) { + ret = EINVAL; + krb5_set_error_message(context, ret, "samba_kdc_message2entry_keys: Primary:Kerberos-Newer-Keys not version 4"); + krb5_warnx(context, "samba_kdc_message2entry_keys: Primary:Kerberos-Newer-Keys not version 4"); + goto out; + } + + pkb4 = &_pkb.ctr.ctr4; + } + + keys = (struct samba_kdc_user_keys) { + .kvno = current_kvno, + .supported_enctypes = supported_enctypes, + .nthash = hash, + .salt_string = pkb4 != NULL ? pkb4->salt.string : NULL, + .num_pkeys = pkb4 != NULL ? pkb4->num_keys : 0, + .pkeys = pkb4 != NULL ? pkb4->keys : NULL, + }; + + old_keys = (struct samba_kdc_user_keys) { + .kvno = old_kvno, + .supported_enctypes = supported_enctypes, + .nthash = old_hash, + .salt_string = pkb4 != NULL ? pkb4->salt.string : NULL, + .num_pkeys = pkb4 != NULL ? pkb4->num_old_keys : 0, + .pkeys = pkb4 != NULL ? pkb4->old_keys : NULL, + }; + older_keys = (struct samba_kdc_user_keys) { + .kvno = older_kvno, + .supported_enctypes = supported_enctypes, + .nthash = older_hash, + .salt_string = pkb4 != NULL ? pkb4->salt.string : NULL, + .num_pkeys = pkb4 != NULL ? pkb4->num_older_keys : 0, + .pkeys = pkb4 != NULL ? pkb4->older_keys : NULL, + }; + + if (flags & SDB_F_KVNO_SPECIFIED) { + if (requested_kvno == keys.kvno) { + /* + * The current kvno was requested, + * so we return it. + */ + keys.skeys = &entry->keys; + keys.available_enctypes = &available_enctypes; + keys.returned_kvno = &returned_kvno; + } else if (requested_kvno == 0) { + /* + * don't return any keys + */ + } else if (requested_kvno == old_keys.kvno) { + /* + * return the old keys as default keys + * with the requested kvno. + */ + old_keys.skeys = &entry->keys; + old_keys.available_enctypes = &available_enctypes; + old_keys.returned_kvno = &returned_kvno; + } else if (requested_kvno == older_keys.kvno) { + /* + * return the older keys as default keys + * with the requested kvno. + */ + older_keys.skeys = &entry->keys; + older_keys.available_enctypes = &available_enctypes; + older_keys.returned_kvno = &returned_kvno; + } else { + /* + * don't return any keys + */ + } + } else { + bool include_history = false; + + if ((flags & SDB_F_GET_CLIENT) && (flags & SDB_F_FOR_AS_REQ)) { + include_history = true; + } else if (flags & SDB_F_ADMIN_DATA) { + include_history = true; + } + + keys.skeys = &entry->keys; + keys.available_enctypes = &available_enctypes; + keys.returned_kvno = &returned_kvno; + + if (include_history && old_keys.kvno != 0) { + old_keys.skeys = &entry->old_keys; + } + if (include_history && older_keys.kvno != 0) { + older_keys.skeys = &entry->older_keys; + } + } + + if (keys.skeys != NULL) { + ret = samba_kdc_fill_user_keys(context, &keys); + if (ret != 0) { + goto out; + } + } + + if (old_keys.skeys != NULL) { + ret = samba_kdc_fill_user_keys(context, &old_keys); + if (ret != 0) { + goto out; + } + } + + if (older_keys.skeys != NULL) { + ret = samba_kdc_fill_user_keys(context, &older_keys); + if (ret != 0) { + goto out; + } + } + + *supported_enctypes_out |= available_enctypes; + + if (is_krbtgt) { + /* + * Even for the main krbtgt account + * we have to strictly split the kvno into + * two 16-bit parts and the upper 16-bit + * need to be all zero, even if + * the msDS-KeyVersionNumber has a value + * larger than 65535. + * + * See https://bugzilla.samba.org/show_bug.cgi?id=14951 + */ + returned_kvno = SAMBA_KVNO_AND_KRBTGT(returned_kvno, krbtgt_number); + } + entry->kvno = returned_kvno; + +out: + return ret; +} + +static int principal_comp_strcmp_int(krb5_context context, + krb5_const_principal principal, + unsigned int component, + const char *string, + bool do_strcasecmp) +{ + const char *p; + +#if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) + p = krb5_principal_get_comp_string(context, principal, component); + if (p == NULL) { + return -1; + } + if (do_strcasecmp) { + return strcasecmp(p, string); + } else { + return strcmp(p, string); + } +#else + size_t len; + krb5_data *d; + if (component >= krb5_princ_size(context, principal)) { + return -1; + } + + d = krb5_princ_component(context, principal, component); + if (d == NULL) { + return -1; + } + + p = d->data; + + len = strlen(string); + + /* + * We explicitly return -1 or 1. Subtracting of the two lengths might + * give the wrong result if the result overflows or loses data when + * narrowed to int. + */ + if (d->length < len) { + return -1; + } else if (d->length > len) { + return 1; + } + + if (do_strcasecmp) { + return strncasecmp(p, string, len); + } else { + return memcmp(p, string, len); + } +#endif +} + +static int principal_comp_strcasecmp(krb5_context context, + krb5_const_principal principal, + unsigned int component, + const char *string) +{ + return principal_comp_strcmp_int(context, principal, + component, string, true); +} + +static int principal_comp_strcmp(krb5_context context, + krb5_const_principal principal, + unsigned int component, + const char *string) +{ + return principal_comp_strcmp_int(context, principal, + component, string, false); +} + +static bool is_kadmin_changepw(krb5_context context, + krb5_const_principal principal) +{ + return krb5_princ_size(context, principal) == 2 && + (principal_comp_strcmp(context, principal, 0, "kadmin") == 0) && + (principal_comp_strcmp(context, principal, 1, "changepw") == 0); +} + +static krb5_error_code samba_kdc_get_entry_principal( + krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + const char *samAccountName, + enum samba_kdc_ent_type ent_type, + unsigned flags, + bool is_kadmin_changepw, + krb5_const_principal in_princ, + krb5_principal *out_princ) +{ + struct loadparm_context *lp_ctx = kdc_db_ctx->lp_ctx; + krb5_error_code code = 0; + bool canon = flags & (SDB_F_CANON|SDB_F_FORCE_CANON); + + /* + * If we are set to canonicalize, we get back the fixed UPPER + * case realm, and the real username (ie matching LDAP + * samAccountName) + * + * Otherwise, if we are set to enterprise, we + * get back the whole principal as-sent + * + * Finally, if we are not set to canonicalize, we get back the + * fixed UPPER case realm, but the as-sent username + */ + + /* + * We need to ensure that the kadmin/changepw principal isn't able to + * issue krbtgt tickets, even if canonicalization is turned on. + */ + if (!is_kadmin_changepw) { + if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT && canon) { + /* + * When requested to do so, ensure that the + * both realm values in the principal are set + * to the upper case, canonical realm + */ + code = smb_krb5_make_principal(context, + out_princ, + lpcfg_realm(lp_ctx), + "krbtgt", + lpcfg_realm(lp_ctx), + NULL); + if (code != 0) { + return code; + } + smb_krb5_principal_set_type(context, + *out_princ, + KRB5_NT_SRV_INST); + + return 0; + } + + if ((canon && flags & (SDB_F_FORCE_CANON|SDB_F_FOR_AS_REQ)) || + (ent_type == SAMBA_KDC_ENT_TYPE_ANY && in_princ == NULL)) { + /* + * SDB_F_CANON maps from the canonicalize flag in the + * packet, and has a different meaning between AS-REQ + * and TGS-REQ. We only change the principal in the + * AS-REQ case. + * + * The SDB_F_FORCE_CANON if for new MIT KDC code that + * wants the canonical name in all lookups, and takes + * care to canonicalize only when appropriate. + */ + code = smb_krb5_make_principal(context, + out_princ, + lpcfg_realm(lp_ctx), + samAccountName, + NULL); + return code; + } + } + + /* + * For a krbtgt entry, this appears to be required regardless of the + * canonicalize flag from the client. + */ + code = krb5_copy_principal(context, in_princ, out_princ); + if (code != 0) { + return code; + } + + /* + * While we have copied the client principal, tests show that Win2k3 + * returns the 'corrected' realm, not the client-specified realm. This + * code attempts to replace the client principal's realm with the one + * we determine from our records + */ + code = smb_krb5_principal_set_realm(context, + *out_princ, + lpcfg_realm(lp_ctx)); + + return code; +} + +/* + * Construct an hdb_entry from a directory entry. + */ +static krb5_error_code samba_kdc_message2entry(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + TALLOC_CTX *mem_ctx, + krb5_const_principal principal, + enum samba_kdc_ent_type ent_type, + unsigned flags, + krb5_kvno kvno, + struct ldb_dn *realm_dn, + struct ldb_message *msg, + struct sdb_entry *entry) +{ + struct loadparm_context *lp_ctx = kdc_db_ctx->lp_ctx; + uint32_t userAccountControl; + uint32_t msDS_User_Account_Control_Computed; + krb5_error_code ret = 0; + krb5_boolean is_computer = FALSE; + struct samba_kdc_entry *p; + NTTIME acct_expiry; + NTSTATUS status; + bool protected_user = false; + uint32_t rid; + bool is_krbtgt = false; + bool is_rodc = false; + bool force_rc4 = lpcfg_kdc_force_enable_rc4_weak_session_keys(lp_ctx); + struct ldb_message_element *objectclasses; + struct ldb_val computer_val = data_blob_string_const("computer"); + uint32_t config_default_supported_enctypes = lpcfg_kdc_default_domain_supported_enctypes(lp_ctx); + uint32_t default_supported_enctypes = + config_default_supported_enctypes != 0 ? + config_default_supported_enctypes : + ENC_RC4_HMAC_MD5 | ENC_HMAC_SHA1_96_AES256_SK; + uint32_t supported_enctypes + = ldb_msg_find_attr_as_uint(msg, + "msDS-SupportedEncryptionTypes", + default_supported_enctypes); + uint32_t pa_supported_enctypes; + uint32_t supported_session_etypes; + uint32_t available_enctypes = 0; + /* + * also lagacy enctypes are announced, + * but effectively restricted by kdc_enctypes + */ + uint32_t domain_enctypes = ENC_RC4_HMAC_MD5 | ENC_RSA_MD5 | ENC_CRC32; + uint32_t config_kdc_enctypes = lpcfg_kdc_supported_enctypes(lp_ctx); + uint32_t kdc_enctypes = + config_kdc_enctypes != 0 ? + config_kdc_enctypes : + ENC_ALL_TYPES; + const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL); + + ZERO_STRUCTP(entry); + + if (supported_enctypes == 0) { + supported_enctypes = default_supported_enctypes; + } + + if (dsdb_functional_level(kdc_db_ctx->samdb) >= DS_DOMAIN_FUNCTION_2008) { + domain_enctypes |= ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256; + } + + if (ldb_msg_find_element(msg, "msDS-SecondaryKrbTgtNumber")) { + is_rodc = true; + } + + if (!samAccountName) { + ret = ENOENT; + krb5_set_error_message(context, ret, "samba_kdc_message2entry: no samAccountName present"); + goto out; + } + + objectclasses = ldb_msg_find_element(msg, "objectClass"); + + if (objectclasses && ldb_msg_find_val(objectclasses, &computer_val)) { + is_computer = TRUE; + } + + p = talloc_zero(mem_ctx, struct samba_kdc_entry); + if (!p) { + ret = ENOMEM; + goto out; + } + + p->is_rodc = is_rodc; + p->kdc_db_ctx = kdc_db_ctx; + p->realm_dn = talloc_reference(p, realm_dn); + if (!p->realm_dn) { + ret = ENOMEM; + goto out; + } + + talloc_set_destructor(p, samba_kdc_entry_destructor); + + entry->skdc_entry = p; + + userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0); + + msDS_User_Account_Control_Computed + = ldb_msg_find_attr_as_uint(msg, + "msDS-User-Account-Control-Computed", + UF_ACCOUNTDISABLE); + + /* + * This brings in the lockout flag, block the account if not + * found. We need the weird UF_ACCOUNTDISABLE check because + * we do not want to fail open if the value is not returned, + * but 0 is a valid value (all OK) + */ + if (msDS_User_Account_Control_Computed == UF_ACCOUNTDISABLE) { + ret = EINVAL; + krb5_set_error_message(context, ret, "samba_kdc_message2entry: " + "no msDS-User-Account-Control-Computed present"); + goto out; + } else { + userAccountControl |= msDS_User_Account_Control_Computed; + } + + if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) { + p->is_krbtgt = true; + } + + /* First try and figure out the flags based on the userAccountControl */ + entry->flags = uf2SDBFlags(context, userAccountControl, ent_type); + + /* + * Take control of the returned principal here, rather than + * allowing the Heimdal code to do it as we have specific + * behaviour around the forced realm to honour + */ + entry->flags.force_canonicalize = true; + + /* Windows 2008 seems to enforce this (very sensible) rule by + * default - don't allow offline attacks on a user's password + * by asking for a ticket to them as a service (encrypted with + * their probably patheticly insecure password) */ + + if (entry->flags.server + && lpcfg_parm_bool(lp_ctx, NULL, "kdc", "require spn for service", true)) { + if (!is_computer && !ldb_msg_find_attr_as_string(msg, "servicePrincipalName", NULL)) { + entry->flags.server = 0; + } + } + + /* + * We restrict a 3-part SPN ending in my domain/realm to full + * domain controllers. + * + * This avoids any cases where (eg) a demoted DC still has + * these more restricted SPNs. + */ + if (krb5_princ_size(context, principal) > 2) { + char *third_part + = smb_krb5_principal_get_comp_string(mem_ctx, + context, + principal, + 2); + bool is_our_realm = + lpcfg_is_my_domain_or_realm(lp_ctx, + third_part); + bool is_dc = userAccountControl & + (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT); + if (is_our_realm && !is_dc) { + entry->flags.server = 0; + } + } + /* + * To give the correct type of error to the client, we must + * not just return the entry without .server set, we must + * pretend the principal does not exist. Otherwise we may + * return ERR_POLICY instead of + * KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN + */ + if (ent_type == SAMBA_KDC_ENT_TYPE_SERVER && entry->flags.server == 0) { + ret = SDB_ERR_NOENTRY; + krb5_set_error_message(context, ret, "samba_kdc_message2entry: no servicePrincipalName present for this server, refusing with no-such-entry"); + goto out; + } + if (flags & SDB_F_ADMIN_DATA) { + /* These (created_by, modified_by) parts of the entry are not relevant for Samba4's use + * of the Heimdal KDC. They are stored in a the traditional + * DB for audit purposes, and still form part of the structure + * we must return */ + + /* use 'whenCreated' */ + entry->created_by.time = ldb_msg_find_krb5time_ldap_time(msg, "whenCreated", 0); + /* use 'kadmin' for now (needed by mit_samba) */ + + ret = smb_krb5_make_principal(context, + &entry->created_by.principal, + lpcfg_realm(lp_ctx), "kadmin", NULL); + if (ret) { + krb5_clear_error_message(context); + goto out; + } + + entry->modified_by = (struct sdb_event *) malloc(sizeof(struct sdb_event)); + if (entry->modified_by == NULL) { + ret = ENOMEM; + krb5_set_error_message(context, ret, "malloc: out of memory"); + goto out; + } + + /* use 'whenChanged' */ + entry->modified_by->time = ldb_msg_find_krb5time_ldap_time(msg, "whenChanged", 0); + /* use 'kadmin' for now (needed by mit_samba) */ + ret = smb_krb5_make_principal(context, + &entry->modified_by->principal, + lpcfg_realm(lp_ctx), "kadmin", NULL); + if (ret) { + krb5_clear_error_message(context); + goto out; + } + } + + + /* The lack of password controls etc applies to krbtgt by + * virtue of being that particular RID */ + status = dom_sid_split_rid(NULL, samdb_result_dom_sid(mem_ctx, msg, "objectSid"), NULL, &rid); + + if (!NT_STATUS_IS_OK(status)) { + ret = EINVAL; + goto out; + } + + if (rid == DOMAIN_RID_KRBTGT) { + char *realm = NULL; + + entry->valid_end = NULL; + entry->pw_end = NULL; + + entry->flags.invalid = 0; + entry->flags.server = 1; + + realm = smb_krb5_principal_get_realm( + mem_ctx, context, principal); + if (realm == NULL) { + ret = ENOMEM; + goto out; + } + + /* Don't mark all requests for the krbtgt/realm as + * 'change password', as otherwise we could get into + * trouble, and not enforce the password expirty. + * Instead, only do it when request is for the kpasswd service */ + if (ent_type == SAMBA_KDC_ENT_TYPE_SERVER && + is_kadmin_changepw(context, principal) && + lpcfg_is_my_domain_or_realm(lp_ctx, realm)) { + entry->flags.change_pw = 1; + } + + TALLOC_FREE(realm); + + entry->flags.client = 0; + entry->flags.forwardable = 1; + entry->flags.ok_as_delegate = 1; + } else if (is_rodc) { + /* The RODC krbtgt account is like the main krbtgt, + * but it does not have a changepw or kadmin + * service */ + + entry->valid_end = NULL; + entry->pw_end = NULL; + + /* Also don't allow the RODC krbtgt to be a client (it should not be needed) */ + entry->flags.client = 0; + entry->flags.invalid = 0; + entry->flags.server = 1; + + entry->flags.client = 0; + entry->flags.forwardable = 1; + entry->flags.ok_as_delegate = 0; + } else if (entry->flags.server && ent_type == SAMBA_KDC_ENT_TYPE_SERVER) { + /* The account/password expiry only applies when the account is used as a + * client (ie password login), not when used as a server */ + + /* Make very well sure we don't use this for a client, + * it could bypass the password restrictions */ + entry->flags.client = 0; + + entry->valid_end = NULL; + entry->pw_end = NULL; + + } else { + NTTIME must_change_time + = samdb_result_nttime(msg, + "msDS-UserPasswordExpiryTimeComputed", + 0); + if (must_change_time == 0x7FFFFFFFFFFFFFFFULL) { + entry->pw_end = NULL; + } else { + entry->pw_end = malloc(sizeof(*entry->pw_end)); + if (entry->pw_end == NULL) { + ret = ENOMEM; + goto out; + } + *entry->pw_end = nt_time_to_unix(must_change_time); + } + + acct_expiry = samdb_result_account_expires(msg); + if (acct_expiry == 0x7FFFFFFFFFFFFFFFULL) { + entry->valid_end = NULL; + } else { + entry->valid_end = malloc(sizeof(*entry->valid_end)); + if (entry->valid_end == NULL) { + ret = ENOMEM; + goto out; + } + *entry->valid_end = nt_time_to_unix(acct_expiry); + } + } + + ret = samba_kdc_get_entry_principal(context, + kdc_db_ctx, + samAccountName, + ent_type, + flags, + entry->flags.change_pw, + principal, + &entry->principal); + if (ret != 0) { + krb5_clear_error_message(context); + goto out; + } + + entry->valid_start = NULL; + + entry->max_life = malloc(sizeof(*entry->max_life)); + if (entry->max_life == NULL) { + ret = ENOMEM; + goto out; + } + + if (ent_type == SAMBA_KDC_ENT_TYPE_SERVER) { + *entry->max_life = kdc_db_ctx->policy.svc_tkt_lifetime; + } else if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT || ent_type == SAMBA_KDC_ENT_TYPE_CLIENT) { + *entry->max_life = kdc_db_ctx->policy.usr_tkt_lifetime; + } else { + *entry->max_life = MIN(kdc_db_ctx->policy.svc_tkt_lifetime, + kdc_db_ctx->policy.usr_tkt_lifetime); + } + + if (entry->flags.change_pw) { + /* Limit lifetime of kpasswd tickets to two minutes or less. */ + *entry->max_life = MIN(*entry->max_life, CHANGEPW_LIFETIME); + } + + entry->max_renew = malloc(sizeof(*entry->max_renew)); + if (entry->max_renew == NULL) { + ret = ENOMEM; + goto out; + } + + *entry->max_renew = kdc_db_ctx->policy.renewal_lifetime; + + if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT && (flags & SDB_F_FOR_AS_REQ)) { + int result; + struct auth_user_info_dc *user_info_dc = NULL; + /* + * These protections only apply to clients, so servers in the + * Protected Users group may still have service tickets to them + * encrypted with RC4. For accounts looked up as servers, note + * that 'msg' does not contain the 'memberOf' attribute for + * determining whether the account is a member of Protected + * Users. + * + * Additionally, Microsoft advises that accounts for services + * and computers should never be members of Protected Users, or + * they may fail to authenticate. + */ + status = samba_kdc_get_user_info_from_db(p, msg, &user_info_dc); + if (!NT_STATUS_IS_OK(status)) { + ret = EINVAL; + goto out; + } + + result = dsdb_is_protected_user(kdc_db_ctx->samdb, + user_info_dc->sids, + user_info_dc->num_sids); + if (result == -1) { + ret = EINVAL; + goto out; + } + + protected_user = result; + + if (protected_user) { + *entry->max_life = MIN(*entry->max_life, 4 * 60 * 60); + *entry->max_renew = MIN(*entry->max_renew, 4 * 60 * 60); + + entry->flags.forwardable = 0; + entry->flags.proxiable = 0; + } + } + + if (rid == DOMAIN_RID_KRBTGT || is_rodc) { + bool enable_fast; + + is_krbtgt = true; + + /* + * KDCs (and KDCs on RODCs) + * ignore msDS-SupportedEncryptionTypes completely + * but support all supported enctypes by the domain. + */ + supported_enctypes = domain_enctypes; + + enable_fast = lpcfg_kdc_enable_fast(kdc_db_ctx->lp_ctx); + if (enable_fast) { + supported_enctypes |= ENC_FAST_SUPPORTED; + } + } else if (userAccountControl & (UF_PARTIAL_SECRETS_ACCOUNT|UF_SERVER_TRUST_ACCOUNT)) { + /* + * DCs and RODCs computer accounts take + * msDS-SupportedEncryptionTypes unmodified, but + * force all enctypes supported by the domain. + */ + supported_enctypes |= domain_enctypes; + + } else if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT || + (ent_type == SAMBA_KDC_ENT_TYPE_ANY)) { + /* + * for AS-REQ the client chooses the enc types it + * supports, and this will vary between computers a + * user logs in from. Therefore, so that we accept any + * of the client's keys for decrypting padata, + * supported_enctypes should not restrict etype usage. + * + * likewise for 'any' return as much as is supported, + * to export into a keytab. + */ + supported_enctypes |= ENC_ALL_TYPES; + } + + /* If UF_USE_DES_KEY_ONLY has been set, then don't allow use of the newer enc types */ + if (userAccountControl & UF_USE_DES_KEY_ONLY) { + supported_enctypes &= ~ENC_ALL_TYPES; + } + + if (protected_user) { + supported_enctypes &= ~ENC_RC4_HMAC_MD5; + } + + pa_supported_enctypes = supported_enctypes; + supported_session_etypes = supported_enctypes; + if (supported_session_etypes & ENC_HMAC_SHA1_96_AES256_SK) { + supported_session_etypes |= ENC_HMAC_SHA1_96_AES256; + supported_session_etypes |= ENC_HMAC_SHA1_96_AES128; + } + if (force_rc4) { + supported_session_etypes |= ENC_RC4_HMAC_MD5; + } + /* + * now that we remembered what to announce in pa_supported_enctypes + * and normalized ENC_HMAC_SHA1_96_AES256_SK, we restrict the + * rest to the enc types the local kdc supports. + */ + supported_enctypes &= kdc_enctypes; + supported_session_etypes &= kdc_enctypes; + + /* Get keys from the db */ + ret = samba_kdc_message2entry_keys(context, p, msg, + is_krbtgt, is_rodc, + userAccountControl, + ent_type, flags, kvno, entry, + supported_enctypes, + &available_enctypes); + if (ret) { + /* Could be bogus data in the entry, or out of memory */ + goto out; + } + + /* + * If we only have a nthash stored, + * but a better session key would be + * available, we fallback to fetching the + * RC4_HMAC_MD5, which implicitly also + * would allow an RC4_HMAC_MD5 session key. + * But only if the kdc actually supports + * RC4_HMAC_MD5. + */ + if (available_enctypes == 0 && + (supported_enctypes & ENC_RC4_HMAC_MD5) == 0 && + (supported_enctypes & ~ENC_RC4_HMAC_MD5) != 0 && + (kdc_enctypes & ENC_RC4_HMAC_MD5) != 0) + { + supported_enctypes = ENC_RC4_HMAC_MD5; + ret = samba_kdc_message2entry_keys(context, p, msg, + is_krbtgt, is_rodc, + userAccountControl, + ent_type, flags, kvno, entry, + supported_enctypes, + &available_enctypes); + if (ret) { + /* Could be bogus data in the entry, or out of memory */ + goto out; + } + } + + /* + * We need to support all session keys enctypes for + * all keys we provide + */ + supported_session_etypes |= available_enctypes; + + ret = sdb_entry_set_etypes(entry); + if (ret) { + goto out; + } + + if (entry->flags.server) { + bool add_aes256 = + supported_session_etypes & KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96; + bool add_aes128 = + supported_session_etypes & KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96; + bool add_rc4 = + supported_session_etypes & ENC_RC4_HMAC_MD5; + ret = sdb_entry_set_session_etypes(entry, + add_aes256, + add_aes128, + add_rc4); + if (ret) { + goto out; + } + } + + if (entry->keys.len != 0) { + /* + * FIXME: Currently limited to Heimdal so as not to + * break MIT KDCs, for which no fix is available. + */ +#ifdef SAMBA4_USES_HEIMDAL + if (is_krbtgt) { + /* + * The krbtgt account, having no reason to + * issue tickets encrypted in weaker keys, + * shall only make available its strongest + * key. All weaker keys are stripped out. This + * makes it impossible for an RC4-encrypted + * TGT to be accepted when AES KDC keys exist. + * + * This controls the ticket key and so the PAC + * signature algorithms indirectly, preventing + * a weak KDC checksum from being accepted + * when we verify the signatures for an + * S4U2Proxy evidence ticket. As such, this is + * indispensable for addressing + * CVE-2022-37966. + * + * Being strict here also provides protection + * against possible future attacks on weak + * keys. + */ + entry->keys.len = 1; + if (entry->etypes != NULL) { + entry->etypes->len = 1; + } + entry->old_keys.len = MIN(entry->old_keys.len, 1); + entry->older_keys.len = MIN(entry->older_keys.len, 1); + } +#endif + } else if (kdc_db_ctx->rodc) { + /* + * We are on an RODC, but don't have keys for this + * account. Signal this to the caller + */ + auth_sam_trigger_repl_secret(kdc_db_ctx, + kdc_db_ctx->msg_ctx, + kdc_db_ctx->ev_ctx, + msg->dn); + return SDB_ERR_NOT_FOUND_HERE; + } else { + /* + * oh, no password. Apparently (comment in + * hdb-ldap.c) this violates the ASN.1, but this + * allows an entry with no keys (yet). + */ + } + + p->msg = talloc_steal(p, msg); + p->supported_enctypes = pa_supported_enctypes; + +out: + if (ret != 0) { + /* This doesn't free ent itself, that is for the eventual caller to do */ + sdb_entry_free(entry); + } else { + talloc_steal(kdc_db_ctx, p); + } + + return ret; +} + +/* + * Construct an hdb_entry from a directory entry. + * The kvno is what the remote client asked for + */ +static krb5_error_code samba_kdc_trust_message2entry(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + TALLOC_CTX *mem_ctx, + enum trust_direction direction, + struct ldb_dn *realm_dn, + unsigned flags, + uint32_t kvno, + struct ldb_message *msg, + struct sdb_entry *entry) +{ + struct loadparm_context *lp_ctx = kdc_db_ctx->lp_ctx; + const char *our_realm = lpcfg_realm(lp_ctx); + char *partner_realm = NULL; + const char *realm = NULL; + const char *krbtgt_realm = NULL; + DATA_BLOB password_utf16 = data_blob_null; + DATA_BLOB password_utf8 = data_blob_null; + struct samr_Password _password_hash; + const struct samr_Password *password_hash = NULL; + const struct ldb_val *password_val; + struct trustAuthInOutBlob password_blob; + struct samba_kdc_entry *p; + bool use_previous = false; + uint32_t current_kvno; + uint32_t previous_kvno; + uint32_t num_keys = 0; + enum ndr_err_code ndr_err; + int ret; + unsigned int i; + struct AuthenticationInformationArray *auth_array; + struct timeval tv; + NTTIME an_hour_ago; + uint32_t *auth_kvno; + bool preferr_current = false; + bool force_rc4 = lpcfg_kdc_force_enable_rc4_weak_session_keys(lp_ctx); + uint32_t supported_enctypes = ENC_RC4_HMAC_MD5; + uint32_t pa_supported_enctypes; + uint32_t supported_session_etypes; + uint32_t config_kdc_enctypes = lpcfg_kdc_supported_enctypes(lp_ctx); + uint32_t kdc_enctypes = + config_kdc_enctypes != 0 ? + config_kdc_enctypes : + ENC_ALL_TYPES; + struct lsa_TrustDomainInfoInfoEx *tdo = NULL; + NTSTATUS status; + + ZERO_STRUCTP(entry); + + if (dsdb_functional_level(kdc_db_ctx->samdb) >= DS_DOMAIN_FUNCTION_2008) { + /* If not told otherwise, Windows now assumes that trusts support AES. */ + supported_enctypes = ldb_msg_find_attr_as_uint(msg, + "msDS-SupportedEncryptionTypes", + ENC_HMAC_SHA1_96_AES256); + } + + pa_supported_enctypes = supported_enctypes; + supported_session_etypes = supported_enctypes; + if (supported_session_etypes & ENC_HMAC_SHA1_96_AES256_SK) { + supported_session_etypes |= ENC_HMAC_SHA1_96_AES256; + supported_session_etypes |= ENC_HMAC_SHA1_96_AES128; + } + if (force_rc4) { + supported_session_etypes |= ENC_RC4_HMAC_MD5; + } + /* + * now that we remembered what to announce in pa_supported_enctypes + * and normalized ENC_HMAC_SHA1_96_AES256_SK, we restrict the + * rest to the enc types the local kdc supports. + */ + supported_enctypes &= kdc_enctypes; + supported_session_etypes &= kdc_enctypes; + + status = dsdb_trust_parse_tdo_info(mem_ctx, msg, &tdo); + if (!NT_STATUS_IS_OK(status)) { + krb5_clear_error_message(context); + ret = ENOMEM; + goto out; + } + + if (!(tdo->trust_direction & direction)) { + krb5_clear_error_message(context); + ret = SDB_ERR_NOENTRY; + goto out; + } + + if (tdo->trust_type != LSA_TRUST_TYPE_UPLEVEL) { + /* + * Only UPLEVEL domains support kerberos here, + * as we don't support LSA_TRUST_TYPE_MIT. + */ + krb5_clear_error_message(context); + ret = SDB_ERR_NOENTRY; + goto out; + } + + if (tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION) { + /* + * We don't support selective authentication yet. + */ + krb5_clear_error_message(context); + ret = SDB_ERR_NOENTRY; + goto out; + } + + if (tdo->domain_name.string == NULL) { + krb5_clear_error_message(context); + ret = SDB_ERR_NOENTRY; + goto out; + } + partner_realm = strupper_talloc(mem_ctx, tdo->domain_name.string); + if (partner_realm == NULL) { + krb5_clear_error_message(context); + ret = ENOMEM; + goto out; + } + + if (direction == INBOUND) { + realm = our_realm; + krbtgt_realm = partner_realm; + + password_val = ldb_msg_find_ldb_val(msg, "trustAuthIncoming"); + } else { /* OUTBOUND */ + realm = partner_realm; + krbtgt_realm = our_realm; + + password_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing"); + } + + if (password_val == NULL) { + krb5_clear_error_message(context); + ret = SDB_ERR_NOENTRY; + goto out; + } + + ndr_err = ndr_pull_struct_blob(password_val, mem_ctx, &password_blob, + (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + krb5_clear_error_message(context); + ret = EINVAL; + goto out; + } + + p = talloc_zero(mem_ctx, struct samba_kdc_entry); + if (!p) { + ret = ENOMEM; + goto out; + } + + p->is_trust = true; + p->kdc_db_ctx = kdc_db_ctx; + p->realm_dn = realm_dn; + p->supported_enctypes = pa_supported_enctypes; + + talloc_set_destructor(p, samba_kdc_entry_destructor); + + entry->skdc_entry = p; + + /* use 'whenCreated' */ + entry->created_by.time = ldb_msg_find_krb5time_ldap_time(msg, "whenCreated", 0); + /* use 'kadmin' for now (needed by mit_samba) */ + ret = smb_krb5_make_principal(context, + &entry->created_by.principal, + realm, "kadmin", NULL); + if (ret) { + krb5_clear_error_message(context); + goto out; + } + + /* + * We always need to generate the canonicalized principal + * with the values of our database. + */ + ret = smb_krb5_make_principal(context, &entry->principal, realm, + "krbtgt", krbtgt_realm, NULL); + if (ret) { + krb5_clear_error_message(context); + goto out; + } + smb_krb5_principal_set_type(context, entry->principal, + KRB5_NT_SRV_INST); + + entry->valid_start = NULL; + + /* we need to work out if we are going to use the current or + * the previous password hash. + * We base this on the kvno the client passes in. If the kvno + * passed in is equal to the current kvno in our database then + * we use the current structure. If it is the current kvno-1, + * then we use the previous substrucure. + */ + + /* + * Windows preferrs the previous key for one hour. + */ + tv = timeval_current(); + if (tv.tv_sec > 3600) { + tv.tv_sec -= 3600; + } + an_hour_ago = timeval_to_nttime(&tv); + + /* first work out the current kvno */ + current_kvno = 0; + for (i=0; i < password_blob.count; i++) { + struct AuthenticationInformation *a = + &password_blob.current.array[i]; + + if (a->LastUpdateTime <= an_hour_ago) { + preferr_current = true; + } + + if (a->AuthType == TRUST_AUTH_TYPE_VERSION) { + current_kvno = a->AuthInfo.version.version; + } + } + if (current_kvno == 0) { + previous_kvno = 255; + } else { + previous_kvno = current_kvno - 1; + } + for (i=0; i < password_blob.count; i++) { + struct AuthenticationInformation *a = + &password_blob.previous.array[i]; + + if (a->AuthType == TRUST_AUTH_TYPE_VERSION) { + previous_kvno = a->AuthInfo.version.version; + } + } + + /* work out whether we will use the previous or current + password */ + if (password_blob.previous.count == 0) { + /* there is no previous password */ + use_previous = false; + } else if (!(flags & SDB_F_KVNO_SPECIFIED)) { + /* + * If not specified we use the lowest kvno + * for the first hour after an update. + */ + if (preferr_current) { + use_previous = false; + } else if (previous_kvno < current_kvno) { + use_previous = true; + } else { + use_previous = false; + } + } else if (kvno == current_kvno) { + /* + * Exact match ... + */ + use_previous = false; + } else if (kvno == previous_kvno) { + /* + * Exact match ... + */ + use_previous = true; + } else { + /* + * Fallback to the current one for anything else + */ + use_previous = false; + } + + if (use_previous) { + auth_array = &password_blob.previous; + auth_kvno = &previous_kvno; + } else { + auth_array = &password_blob.current; + auth_kvno = ¤t_kvno; + } + + /* use the kvno the client specified, if available */ + if (flags & SDB_F_KVNO_SPECIFIED) { + entry->kvno = kvno; + } else { + entry->kvno = *auth_kvno; + } + + for (i=0; i < auth_array->count; i++) { + if (auth_array->array[i].AuthType == TRUST_AUTH_TYPE_CLEAR) { + bool ok; + + password_utf16 = data_blob_const(auth_array->array[i].AuthInfo.clear.password, + auth_array->array[i].AuthInfo.clear.size); + if (password_utf16.length == 0) { + break; + } + + if (supported_enctypes & ENC_RC4_HMAC_MD5) { + mdfour(_password_hash.hash, password_utf16.data, password_utf16.length); + if (password_hash == NULL) { + num_keys += 1; + } + password_hash = &_password_hash; + } + + if (!(supported_enctypes & (ENC_HMAC_SHA1_96_AES128|ENC_HMAC_SHA1_96_AES256))) { + break; + } + + ok = convert_string_talloc(mem_ctx, + CH_UTF16MUNGED, CH_UTF8, + password_utf16.data, + password_utf16.length, + (void *)&password_utf8.data, + &password_utf8.length); + if (!ok) { + krb5_clear_error_message(context); + ret = ENOMEM; + goto out; + } + + if (supported_enctypes & ENC_HMAC_SHA1_96_AES128) { + num_keys += 1; + } + if (supported_enctypes & ENC_HMAC_SHA1_96_AES256) { + num_keys += 1; + } + break; + } else if (auth_array->array[i].AuthType == TRUST_AUTH_TYPE_NT4OWF) { + if (supported_enctypes & ENC_RC4_HMAC_MD5) { + password_hash = &auth_array->array[i].AuthInfo.nt4owf.password; + num_keys += 1; + } + } + } + + /* Must have found a cleartext or MD4 password */ + if (num_keys == 0) { + DEBUG(1,(__location__ ": no usable key found\n")); + krb5_clear_error_message(context); + ret = SDB_ERR_NOENTRY; + goto out; + } + + entry->keys.val = calloc(num_keys, sizeof(struct sdb_key)); + if (entry->keys.val == NULL) { + krb5_clear_error_message(context); + ret = ENOMEM; + goto out; + } + + if (password_utf8.length != 0) { + struct sdb_key key = {}; + krb5_const_principal salt_principal = entry->principal; + krb5_data salt; + krb5_data cleartext_data; + + cleartext_data.data = discard_const_p(char, password_utf8.data); + cleartext_data.length = password_utf8.length; + + ret = smb_krb5_get_pw_salt(context, + salt_principal, + &salt); + if (ret != 0) { + goto out; + } + + if (supported_enctypes & ENC_HMAC_SHA1_96_AES256) { + ret = smb_krb5_create_key_from_string(context, + salt_principal, + &salt, + &cleartext_data, + ENCTYPE_AES256_CTS_HMAC_SHA1_96, + &key.key); + if (ret != 0) { + smb_krb5_free_data_contents(context, &salt); + goto out; + } + + entry->keys.val[entry->keys.len] = key; + entry->keys.len++; + } + + if (supported_enctypes & ENC_HMAC_SHA1_96_AES128) { + ret = smb_krb5_create_key_from_string(context, + salt_principal, + &salt, + &cleartext_data, + ENCTYPE_AES128_CTS_HMAC_SHA1_96, + &key.key); + if (ret != 0) { + smb_krb5_free_data_contents(context, &salt); + goto out; + } + + entry->keys.val[entry->keys.len] = key; + entry->keys.len++; + } + + smb_krb5_free_data_contents(context, &salt); + } + + if (password_hash != NULL) { + struct sdb_key key = {}; + + ret = smb_krb5_keyblock_init_contents(context, + ENCTYPE_ARCFOUR_HMAC, + password_hash->hash, + sizeof(password_hash->hash), + &key.key); + if (ret != 0) { + goto out; + } + + entry->keys.val[entry->keys.len] = key; + entry->keys.len++; + } + + entry->flags = int2SDBFlags(0); + entry->flags.immutable = 1; + entry->flags.invalid = 0; + entry->flags.server = 1; + entry->flags.require_preauth = 1; + + entry->pw_end = NULL; + + entry->max_life = NULL; + + entry->max_renew = NULL; + + /* Match Windows behavior and allow forwardable flag in cross-realm. */ + entry->flags.forwardable = 1; + + samba_kdc_sort_keys(&entry->keys); + + ret = sdb_entry_set_etypes(entry); + if (ret) { + goto out; + } + + { + bool add_aes256 = + supported_session_etypes & KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96; + bool add_aes128 = + supported_session_etypes & KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96; + bool add_rc4 = + supported_session_etypes & ENC_RC4_HMAC_MD5; + ret = sdb_entry_set_session_etypes(entry, + add_aes256, + add_aes128, + add_rc4); + if (ret) { + goto out; + } + } + + p->msg = talloc_steal(p, msg); + +out: + TALLOC_FREE(partner_realm); + + if (ret != 0) { + /* This doesn't free ent itself, that is for the eventual caller to do */ + sdb_entry_free(entry); + } else { + talloc_steal(kdc_db_ctx, p); + } + + return ret; + +} + +static krb5_error_code samba_kdc_lookup_trust(krb5_context context, struct ldb_context *ldb_ctx, + TALLOC_CTX *mem_ctx, + const char *realm, + struct ldb_dn *realm_dn, + struct ldb_message **pmsg) +{ + NTSTATUS status; + const char * const *attrs = trust_attrs; + + status = dsdb_trust_search_tdo(ldb_ctx, realm, realm, + attrs, mem_ctx, pmsg); + if (NT_STATUS_IS_OK(status)) { + return 0; + } else if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) { + return SDB_ERR_NOENTRY; + } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_MEMORY)) { + int ret = ENOMEM; + krb5_set_error_message(context, ret, "get_sam_result_trust: out of memory"); + return ret; + } else { + int ret = EINVAL; + krb5_set_error_message(context, ret, "get_sam_result_trust: %s", nt_errstr(status)); + return ret; + } +} + +static krb5_error_code samba_kdc_lookup_client(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + TALLOC_CTX *mem_ctx, + krb5_const_principal principal, + const char **attrs, + struct ldb_dn **realm_dn, + struct ldb_message **msg) +{ + NTSTATUS nt_status; + char *principal_string = NULL; + + if (smb_krb5_principal_get_type(context, principal) == KRB5_NT_ENTERPRISE_PRINCIPAL) { + principal_string = smb_krb5_principal_get_comp_string(mem_ctx, context, + principal, 0); + if (principal_string == NULL) { + return ENOMEM; + } + } else { + char *principal_string_m = NULL; + krb5_error_code ret; + + ret = krb5_unparse_name(context, principal, &principal_string_m); + if (ret != 0) { + return ret; + } + + principal_string = talloc_strdup(mem_ctx, principal_string_m); + SAFE_FREE(principal_string_m); + if (principal_string == NULL) { + return ENOMEM; + } + } + + nt_status = sam_get_results_principal(kdc_db_ctx->samdb, + mem_ctx, principal_string, attrs, + realm_dn, msg); + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) { + krb5_principal fallback_principal = NULL; + unsigned int num_comp; + char *fallback_realm = NULL; + char *fallback_account = NULL; + krb5_error_code ret; + + ret = krb5_parse_name(context, principal_string, + &fallback_principal); + TALLOC_FREE(principal_string); + if (ret != 0) { + return ret; + } + + num_comp = krb5_princ_size(context, fallback_principal); + fallback_realm = smb_krb5_principal_get_realm( + mem_ctx, context, fallback_principal); + if (fallback_realm == NULL) { + krb5_free_principal(context, fallback_principal); + return ENOMEM; + } + + if (num_comp == 1) { + size_t len; + + fallback_account = smb_krb5_principal_get_comp_string(mem_ctx, + context, fallback_principal, 0); + if (fallback_account == NULL) { + krb5_free_principal(context, fallback_principal); + TALLOC_FREE(fallback_realm); + return ENOMEM; + } + + len = strlen(fallback_account); + if (len >= 2 && fallback_account[len - 1] == '$') { + TALLOC_FREE(fallback_account); + } + } + krb5_free_principal(context, fallback_principal); + fallback_principal = NULL; + + if (fallback_account != NULL) { + char *with_dollar; + + with_dollar = talloc_asprintf(mem_ctx, "%s$", + fallback_account); + if (with_dollar == NULL) { + TALLOC_FREE(fallback_realm); + return ENOMEM; + } + TALLOC_FREE(fallback_account); + + ret = smb_krb5_make_principal(context, + &fallback_principal, + fallback_realm, + with_dollar, NULL); + TALLOC_FREE(with_dollar); + if (ret != 0) { + TALLOC_FREE(fallback_realm); + return ret; + } + } + TALLOC_FREE(fallback_realm); + + if (fallback_principal != NULL) { + char *fallback_string = NULL; + + ret = krb5_unparse_name(context, + fallback_principal, + &fallback_string); + if (ret != 0) { + krb5_free_principal(context, fallback_principal); + return ret; + } + + nt_status = sam_get_results_principal(kdc_db_ctx->samdb, + mem_ctx, + fallback_string, + attrs, + realm_dn, msg); + SAFE_FREE(fallback_string); + } + krb5_free_principal(context, fallback_principal); + fallback_principal = NULL; + } + TALLOC_FREE(principal_string); + + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) { + return SDB_ERR_NOENTRY; + } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) { + return ENOMEM; + } else if (!NT_STATUS_IS_OK(nt_status)) { + return EINVAL; + } + + return 0; +} + +static krb5_error_code samba_kdc_fetch_client(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + TALLOC_CTX *mem_ctx, + krb5_const_principal principal, + unsigned flags, + krb5_kvno kvno, + struct sdb_entry *entry) +{ + struct ldb_dn *realm_dn; + krb5_error_code ret; + struct ldb_message *msg = NULL; + + ret = samba_kdc_lookup_client(context, kdc_db_ctx, + mem_ctx, principal, user_attrs, + &realm_dn, &msg); + if (ret != 0) { + return ret; + } + + ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx, + principal, SAMBA_KDC_ENT_TYPE_CLIENT, + flags, kvno, + realm_dn, msg, entry); + return ret; +} + +static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + TALLOC_CTX *mem_ctx, + krb5_const_principal principal, + unsigned flags, + uint32_t kvno, + struct sdb_entry *entry) +{ + struct loadparm_context *lp_ctx = kdc_db_ctx->lp_ctx; + krb5_error_code ret; + struct ldb_message *msg = NULL; + struct ldb_dn *realm_dn = ldb_get_default_basedn(kdc_db_ctx->samdb); + char *realm_from_princ; + char *realm_princ_comp = smb_krb5_principal_get_comp_string(mem_ctx, context, principal, 1); + + realm_from_princ = smb_krb5_principal_get_realm( + mem_ctx, context, principal); + if (realm_from_princ == NULL) { + /* can't happen */ + return SDB_ERR_NOENTRY; + } + + if (krb5_princ_size(context, principal) != 2 + || (principal_comp_strcmp(context, principal, 0, KRB5_TGS_NAME) != 0)) { + /* Not a krbtgt */ + return SDB_ERR_NOENTRY; + } + + /* krbtgt case. Either us or a trusted realm */ + + if (lpcfg_is_my_domain_or_realm(lp_ctx, realm_from_princ) + && lpcfg_is_my_domain_or_realm(lp_ctx, realm_princ_comp)) { + /* us, or someone quite like us */ + /* Cludge, cludge cludge. If the realm part of krbtgt/realm, + * is in our db, then direct the caller at our primary + * krbtgt */ + + int lret; + unsigned int krbtgt_number; + /* w2k8r2 sometimes gives us a kvno of 255 for inter-domain + trust tickets. We don't yet know what this means, but we do + seem to need to treat it as unspecified */ + if (flags & SDB_F_KVNO_SPECIFIED) { + krbtgt_number = SAMBA_KVNO_GET_KRBTGT(kvno); + if (kdc_db_ctx->rodc) { + if (krbtgt_number != kdc_db_ctx->my_krbtgt_number) { + return SDB_ERR_NOT_FOUND_HERE; + } + } + } else { + krbtgt_number = kdc_db_ctx->my_krbtgt_number; + } + + if (krbtgt_number == kdc_db_ctx->my_krbtgt_number) { + lret = dsdb_search_one(kdc_db_ctx->samdb, mem_ctx, + &msg, kdc_db_ctx->krbtgt_dn, LDB_SCOPE_BASE, + krbtgt_attrs, DSDB_SEARCH_NO_GLOBAL_CATALOG, + "(objectClass=user)"); + } else { + /* We need to look up an RODC krbtgt (perhaps + * ours, if we are an RODC, perhaps another + * RODC if we are a read-write DC */ + lret = dsdb_search_one(kdc_db_ctx->samdb, mem_ctx, + &msg, realm_dn, LDB_SCOPE_SUBTREE, + krbtgt_attrs, + DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG, + "(&(objectClass=user)(msDS-SecondaryKrbTgtNumber=%u))", (unsigned)(krbtgt_number)); + } + + if (lret == LDB_ERR_NO_SUCH_OBJECT) { + krb5_warnx(context, "samba_kdc_fetch: could not find KRBTGT number %u in DB!", + (unsigned)(krbtgt_number)); + krb5_set_error_message(context, SDB_ERR_NOENTRY, + "samba_kdc_fetch: could not find KRBTGT number %u in DB!", + (unsigned)(krbtgt_number)); + return SDB_ERR_NOENTRY; + } else if (lret != LDB_SUCCESS) { + krb5_warnx(context, "samba_kdc_fetch: could not find KRBTGT number %u in DB!", + (unsigned)(krbtgt_number)); + krb5_set_error_message(context, SDB_ERR_NOENTRY, + "samba_kdc_fetch: could not find KRBTGT number %u in DB!", + (unsigned)(krbtgt_number)); + return SDB_ERR_NOENTRY; + } + + ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx, + principal, SAMBA_KDC_ENT_TYPE_KRBTGT, + flags, kvno, realm_dn, msg, entry); + if (ret != 0) { + krb5_warnx(context, "samba_kdc_fetch: self krbtgt message2entry failed"); + } + return ret; + + } else { + enum trust_direction direction = UNKNOWN; + const char *realm = NULL; + + /* Either an inbound or outbound trust */ + + if (strcasecmp(lpcfg_realm(lp_ctx), realm_from_princ) == 0) { + /* look for inbound trust */ + direction = INBOUND; + realm = realm_princ_comp; + } else if (principal_comp_strcasecmp(context, principal, 1, lpcfg_realm(lp_ctx)) == 0) { + /* look for outbound trust */ + direction = OUTBOUND; + realm = realm_from_princ; + } else { + krb5_warnx(context, "samba_kdc_fetch: not our realm for trusts ('%s', '%s')", + realm_from_princ, + realm_princ_comp); + krb5_set_error_message(context, SDB_ERR_NOENTRY, "samba_kdc_fetch: not our realm for trusts ('%s', '%s')", + realm_from_princ, + realm_princ_comp); + return SDB_ERR_NOENTRY; + } + + /* Trusted domains are under CN=system */ + + ret = samba_kdc_lookup_trust(context, kdc_db_ctx->samdb, + mem_ctx, + realm, realm_dn, &msg); + + if (ret != 0) { + krb5_warnx(context, "samba_kdc_fetch: could not find principal in DB"); + krb5_set_error_message(context, ret, "samba_kdc_fetch: could not find principal in DB"); + return ret; + } + + ret = samba_kdc_trust_message2entry(context, kdc_db_ctx, mem_ctx, + direction, + realm_dn, flags, kvno, msg, entry); + if (ret != 0) { + krb5_warnx(context, "samba_kdc_fetch: trust_message2entry failed for %s", + ldb_dn_get_linearized(msg->dn)); + krb5_set_error_message(context, ret, "samba_kdc_fetch: " + "trust_message2entry failed for %s", + ldb_dn_get_linearized(msg->dn)); + } + return ret; + } + +} + +static krb5_error_code samba_kdc_lookup_server(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + TALLOC_CTX *mem_ctx, + krb5_const_principal principal, + unsigned flags, + const char **attrs, + struct ldb_dn **realm_dn, + struct ldb_message **msg) +{ + krb5_error_code ret; + if ((smb_krb5_principal_get_type(context, principal) != KRB5_NT_ENTERPRISE_PRINCIPAL) + && krb5_princ_size(context, principal) >= 2) { + /* 'normal server' case */ + int ldb_ret; + NTSTATUS nt_status; + struct ldb_dn *user_dn; + char *principal_string; + + ret = krb5_unparse_name_flags(context, principal, + KRB5_PRINCIPAL_UNPARSE_NO_REALM, + &principal_string); + if (ret != 0) { + return ret; + } + + /* At this point we may find the host is known to be + * in a different realm, so we should generate a + * referral instead */ + nt_status = crack_service_principal_name(kdc_db_ctx->samdb, + mem_ctx, principal_string, + &user_dn, realm_dn); + free(principal_string); + + if (!NT_STATUS_IS_OK(nt_status)) { + return SDB_ERR_NOENTRY; + } + + ldb_ret = dsdb_search_one(kdc_db_ctx->samdb, + mem_ctx, + msg, user_dn, LDB_SCOPE_BASE, + attrs, + DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG, + "(objectClass=*)"); + if (ldb_ret != LDB_SUCCESS) { + return SDB_ERR_NOENTRY; + } + return 0; + } else if (!(flags & SDB_F_FOR_AS_REQ) + && smb_krb5_principal_get_type(context, principal) == KRB5_NT_ENTERPRISE_PRINCIPAL) { + /* + * The behaviour of accepting an + * KRB5_NT_ENTERPRISE_PRINCIPAL server principal + * containing a UPN only applies to TGS-REQ packets, + * not AS-REQ packets. + */ + return samba_kdc_lookup_client(context, kdc_db_ctx, + mem_ctx, principal, attrs, + realm_dn, msg); + } else { + /* + * This case is for: + * - the AS-REQ, where we only accept + * samAccountName based lookups for the server, no + * matter if the name is an + * KRB5_NT_ENTERPRISE_PRINCIPAL or not + * - for the TGS-REQ when we are not given an + * KRB5_NT_ENTERPRISE_PRINCIPAL, which also must + * only lookup samAccountName based names. + */ + int lret; + char *short_princ; + krb5_principal enterprise_principal = NULL; + krb5_const_principal used_principal = NULL; + char *name1 = NULL; + size_t len1 = 0; + char *filter = NULL; + + if (smb_krb5_principal_get_type(context, principal) == KRB5_NT_ENTERPRISE_PRINCIPAL) { + char *str = NULL; + /* Need to reparse the enterprise principal to find the real target */ + if (krb5_princ_size(context, principal) != 1) { + ret = KRB5_PARSE_MALFORMED; + krb5_set_error_message(context, ret, "samba_kdc_lookup_server: request for an " + "enterprise principal with wrong (%d) number of components", + krb5_princ_size(context, principal)); + return ret; + } + str = smb_krb5_principal_get_comp_string(mem_ctx, context, principal, 0); + if (str == NULL) { + return KRB5_PARSE_MALFORMED; + } + ret = krb5_parse_name(context, str, + &enterprise_principal); + talloc_free(str); + if (ret) { + return ret; + } + used_principal = enterprise_principal; + } else { + used_principal = principal; + } + + /* server as client principal case, but we must not lookup userPrincipalNames */ + *realm_dn = ldb_get_default_basedn(kdc_db_ctx->samdb); + + /* TODO: Check if it is our realm, otherwise give referral */ + + ret = krb5_unparse_name_flags(context, used_principal, + KRB5_PRINCIPAL_UNPARSE_NO_REALM | + KRB5_PRINCIPAL_UNPARSE_DISPLAY, + &short_princ); + used_principal = NULL; + krb5_free_principal(context, enterprise_principal); + enterprise_principal = NULL; + + if (ret != 0) { + krb5_set_error_message(context, ret, "samba_kdc_lookup_principal: could not parse principal"); + krb5_warnx(context, "samba_kdc_lookup_principal: could not parse principal"); + return ret; + } + + name1 = ldb_binary_encode_string(mem_ctx, short_princ); + SAFE_FREE(short_princ); + if (name1 == NULL) { + return ENOMEM; + } + len1 = strlen(name1); + if (len1 >= 1 && name1[len1 - 1] != '$') { + filter = talloc_asprintf(mem_ctx, + "(&(objectClass=user)(|(samAccountName=%s)(samAccountName=%s$)))", + name1, name1); + if (filter == NULL) { + return ENOMEM; + } + } else { + filter = talloc_asprintf(mem_ctx, + "(&(objectClass=user)(samAccountName=%s))", + name1); + if (filter == NULL) { + return ENOMEM; + } + } + + lret = dsdb_search_one(kdc_db_ctx->samdb, mem_ctx, msg, + *realm_dn, LDB_SCOPE_SUBTREE, + attrs, + DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG, + "%s", filter); + if (lret == LDB_ERR_NO_SUCH_OBJECT) { + DEBUG(10, ("Failed to find an entry for %s filter:%s\n", + name1, filter)); + return SDB_ERR_NOENTRY; + } + if (lret == LDB_ERR_CONSTRAINT_VIOLATION) { + DEBUG(10, ("Failed to find unique entry for %s filter:%s\n", + name1, filter)); + return SDB_ERR_NOENTRY; + } + if (lret != LDB_SUCCESS) { + DEBUG(0, ("Failed single search for %s - %s\n", + name1, ldb_errstring(kdc_db_ctx->samdb))); + return SDB_ERR_NOENTRY; + } + return 0; + } + return SDB_ERR_NOENTRY; +} + + + +static krb5_error_code samba_kdc_fetch_server(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + TALLOC_CTX *mem_ctx, + krb5_const_principal principal, + unsigned flags, + krb5_kvno kvno, + struct sdb_entry *entry) +{ + krb5_error_code ret; + struct ldb_dn *realm_dn; + struct ldb_message *msg; + + ret = samba_kdc_lookup_server(context, kdc_db_ctx, mem_ctx, principal, + flags, server_attrs, &realm_dn, &msg); + if (ret != 0) { + return ret; + } + + ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx, + principal, SAMBA_KDC_ENT_TYPE_SERVER, + flags, kvno, + realm_dn, msg, entry); + if (ret != 0) { + char *client_name = NULL; + krb5_error_code code; + + code = krb5_unparse_name(context, principal, &client_name); + if (code == 0) { + krb5_warnx(context, + "samba_kdc_fetch: message2entry failed for " + "%s", + client_name); + } else { + krb5_warnx(context, + "samba_kdc_fetch: message2entry and " + "krb5_unparse_name failed"); + } + SAFE_FREE(client_name); + } + + return ret; +} + +static krb5_error_code samba_kdc_lookup_realm(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + TALLOC_CTX *mem_ctx, + krb5_const_principal principal, + unsigned flags, + struct sdb_entry *entry) +{ + TALLOC_CTX *frame = talloc_stackframe(); + NTSTATUS status; + krb5_error_code ret; + bool check_realm = false; + const char *realm = NULL; + struct dsdb_trust_routing_table *trt = NULL; + const struct lsa_TrustDomainInfoInfoEx *tdo = NULL; + unsigned int num_comp; + bool ok; + char *upper = NULL; + + num_comp = krb5_princ_size(context, principal); + + if (flags & SDB_F_GET_CLIENT) { + if (flags & SDB_F_FOR_AS_REQ) { + check_realm = true; + } + } + if (flags & SDB_F_GET_SERVER) { + if (flags & SDB_F_FOR_TGS_REQ) { + check_realm = true; + } + } + + if (!check_realm) { + TALLOC_FREE(frame); + return 0; + } + + realm = smb_krb5_principal_get_realm(frame, context, principal); + if (realm == NULL) { + TALLOC_FREE(frame); + return ENOMEM; + } + + /* + * The requested realm needs to be our own + */ + ok = lpcfg_is_my_domain_or_realm(kdc_db_ctx->lp_ctx, realm); + if (!ok) { + /* + * The request is not for us... + */ + TALLOC_FREE(frame); + return SDB_ERR_NOENTRY; + } + + if (smb_krb5_principal_get_type(context, principal) == KRB5_NT_ENTERPRISE_PRINCIPAL) { + char *principal_string = NULL; + krb5_principal enterprise_principal = NULL; + char *enterprise_realm = NULL; + + if (num_comp != 1) { + TALLOC_FREE(frame); + return SDB_ERR_NOENTRY; + } + + principal_string = smb_krb5_principal_get_comp_string(frame, context, + principal, 0); + if (principal_string == NULL) { + TALLOC_FREE(frame); + return ENOMEM; + } + + ret = krb5_parse_name(context, principal_string, + &enterprise_principal); + TALLOC_FREE(principal_string); + if (ret) { + TALLOC_FREE(frame); + return ret; + } + + enterprise_realm = smb_krb5_principal_get_realm( + frame, context, enterprise_principal); + krb5_free_principal(context, enterprise_principal); + if (enterprise_realm != NULL) { + realm = enterprise_realm; + } + } + + if (flags & SDB_F_GET_SERVER) { + char *service_realm = NULL; + + ret = principal_comp_strcmp(context, principal, 0, KRB5_TGS_NAME); + if (ret == 0) { + /* + * we need to search krbtgt/ locally + */ + TALLOC_FREE(frame); + return 0; + } + + /* + * We need to check the last component against the routing table. + * + * Note this works only with 2 or 3 component principals, e.g: + * + * servicePrincipalName: ldap/W2K8R2-219.bla.base + * servicePrincipalName: ldap/W2K8R2-219.bla.base/bla.base + * servicePrincipalName: ldap/W2K8R2-219.bla.base/ForestDnsZones.bla.base + * servicePrincipalName: ldap/W2K8R2-219.bla.base/DomainDnsZones.bla.base + */ + + if (num_comp == 2 || num_comp == 3) { + service_realm = smb_krb5_principal_get_comp_string(frame, + context, + principal, + num_comp - 1); + } + + if (service_realm != NULL) { + realm = service_realm; + } + } + + ok = lpcfg_is_my_domain_or_realm(kdc_db_ctx->lp_ctx, realm); + if (ok) { + /* + * skip the expensive routing lookup + */ + TALLOC_FREE(frame); + return 0; + } + + status = dsdb_trust_routing_table_load(kdc_db_ctx->samdb, + frame, &trt); + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(frame); + return EINVAL; + } + + tdo = dsdb_trust_routing_by_name(trt, realm); + if (tdo == NULL) { + /* + * This principal has to be local + */ + TALLOC_FREE(frame); + return 0; + } + + if (tdo->trust_attributes & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST) { + /* + * TODO: handle the routing within the forest + * + * This should likely be handled in + * samba_kdc_message2entry() in case we're + * a global catalog. We'd need to check + * if realm_dn is our own domain and derive + * the dns domain name from realm_dn and check that + * against the routing table or fallback to + * the tdo we found here. + * + * But for now we don't support multiple domains + * in our forest correctly anyway. + * + * Just search in our local database. + */ + TALLOC_FREE(frame); + return 0; + } + + ZERO_STRUCTP(entry); + + ret = krb5_copy_principal(context, principal, + &entry->principal); + if (ret) { + TALLOC_FREE(frame); + return ret; + } + + upper = strupper_talloc(frame, tdo->domain_name.string); + if (upper == NULL) { + TALLOC_FREE(frame); + return ENOMEM; + } + + ret = smb_krb5_principal_set_realm(context, + entry->principal, + upper); + if (ret) { + TALLOC_FREE(frame); + return ret; + } + + TALLOC_FREE(frame); + return SDB_ERR_WRONG_REALM; +} + +krb5_error_code samba_kdc_fetch(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + krb5_const_principal principal, + unsigned flags, + krb5_kvno kvno, + struct sdb_entry *entry) +{ + krb5_error_code ret = SDB_ERR_NOENTRY; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_named(kdc_db_ctx, 0, "samba_kdc_fetch context"); + if (!mem_ctx) { + ret = ENOMEM; + krb5_set_error_message(context, ret, "samba_kdc_fetch: talloc_named() failed!"); + return ret; + } + + ret = samba_kdc_lookup_realm(context, kdc_db_ctx, mem_ctx, + principal, flags, entry); + if (ret != 0) { + goto done; + } + + ret = SDB_ERR_NOENTRY; + + if (flags & SDB_F_GET_CLIENT) { + ret = samba_kdc_fetch_client(context, kdc_db_ctx, mem_ctx, principal, flags, kvno, entry); + if (ret != SDB_ERR_NOENTRY) goto done; + } + if (flags & SDB_F_GET_SERVER) { + /* krbtgt fits into this situation for trusted realms, and for resolving different versions of our own realm name */ + ret = samba_kdc_fetch_krbtgt(context, kdc_db_ctx, mem_ctx, principal, flags, kvno, entry); + if (ret != SDB_ERR_NOENTRY) goto done; + + /* We return 'no entry' if it does not start with krbtgt/, so move to the common case quickly */ + ret = samba_kdc_fetch_server(context, kdc_db_ctx, mem_ctx, principal, flags, kvno, entry); + if (ret != SDB_ERR_NOENTRY) goto done; + } + if (flags & SDB_F_GET_KRBTGT) { + ret = samba_kdc_fetch_krbtgt(context, kdc_db_ctx, mem_ctx, principal, flags, kvno, entry); + if (ret != SDB_ERR_NOENTRY) goto done; + } + +done: + talloc_free(mem_ctx); + return ret; +} + +struct samba_kdc_seq { + unsigned int index; + unsigned int count; + struct ldb_message **msgs; + struct ldb_dn *realm_dn; +}; + +static krb5_error_code samba_kdc_seq(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + struct sdb_entry *entry) +{ + krb5_error_code ret; + struct samba_kdc_seq *priv = kdc_db_ctx->seq_ctx; + const char *realm = lpcfg_realm(kdc_db_ctx->lp_ctx); + struct ldb_message *msg = NULL; + const char *sAMAccountName = NULL; + krb5_principal principal = NULL; + TALLOC_CTX *mem_ctx; + + if (!priv) { + return SDB_ERR_NOENTRY; + } + + mem_ctx = talloc_named(priv, 0, "samba_kdc_seq context"); + + if (!mem_ctx) { + ret = ENOMEM; + krb5_set_error_message(context, ret, "samba_kdc_seq: talloc_named() failed!"); + return ret; + } + + while (priv->index < priv->count) { + msg = priv->msgs[priv->index++]; + + sAMAccountName = ldb_msg_find_attr_as_string(msg, "sAMAccountName", NULL); + if (sAMAccountName != NULL) { + break; + } + } + + if (sAMAccountName == NULL) { + ret = SDB_ERR_NOENTRY; + goto out; + } + + ret = smb_krb5_make_principal(context, &principal, + realm, sAMAccountName, NULL); + if (ret != 0) { + goto out; + } + + ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx, + principal, SAMBA_KDC_ENT_TYPE_ANY, + SDB_F_ADMIN_DATA|SDB_F_GET_ANY, + 0 /* kvno */, + priv->realm_dn, msg, entry); + +out: + if (principal != NULL) { + krb5_free_principal(context, principal); + } + + if (ret != 0) { + TALLOC_FREE(priv); + kdc_db_ctx->seq_ctx = NULL; + } else { + talloc_free(mem_ctx); + } + + return ret; +} + +krb5_error_code samba_kdc_firstkey(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + struct sdb_entry *entry) +{ + struct ldb_context *ldb_ctx = kdc_db_ctx->samdb; + struct samba_kdc_seq *priv = kdc_db_ctx->seq_ctx; + char *realm; + struct ldb_result *res = NULL; + krb5_error_code ret; + TALLOC_CTX *mem_ctx; + int lret; + + if (priv) { + TALLOC_FREE(priv); + kdc_db_ctx->seq_ctx = NULL; + } + + priv = (struct samba_kdc_seq *) talloc(kdc_db_ctx, struct samba_kdc_seq); + if (!priv) { + ret = ENOMEM; + krb5_set_error_message(context, ret, "talloc: out of memory"); + return ret; + } + + priv->index = 0; + priv->msgs = NULL; + priv->realm_dn = ldb_get_default_basedn(ldb_ctx); + priv->count = 0; + + mem_ctx = talloc_named(priv, 0, "samba_kdc_firstkey context"); + + if (!mem_ctx) { + ret = ENOMEM; + krb5_set_error_message(context, ret, "samba_kdc_firstkey: talloc_named() failed!"); + return ret; + } + + ret = krb5_get_default_realm(context, &realm); + if (ret != 0) { + TALLOC_FREE(priv); + return ret; + } + krb5_free_default_realm(context, realm); + + lret = dsdb_search(ldb_ctx, priv, &res, + priv->realm_dn, LDB_SCOPE_SUBTREE, user_attrs, + DSDB_SEARCH_NO_GLOBAL_CATALOG, + "(objectClass=user)"); + + if (lret != LDB_SUCCESS) { + TALLOC_FREE(priv); + return SDB_ERR_NOENTRY; + } + + priv->count = res->count; + priv->msgs = talloc_steal(priv, res->msgs); + talloc_free(res); + + kdc_db_ctx->seq_ctx = priv; + + ret = samba_kdc_seq(context, kdc_db_ctx, entry); + + if (ret != 0) { + TALLOC_FREE(priv); + kdc_db_ctx->seq_ctx = NULL; + } else { + talloc_free(mem_ctx); + } + return ret; +} + +krb5_error_code samba_kdc_nextkey(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + struct sdb_entry *entry) +{ + return samba_kdc_seq(context, kdc_db_ctx, entry); +} + +/* Check if a given entry may delegate or do s4u2self to this target principal + * + * The safest way to determine 'self' is to check the DB record made at + * the time the principal was presented to the KDC. + */ +krb5_error_code +samba_kdc_check_client_matches_target_service(krb5_context context, + struct samba_kdc_entry *skdc_entry_client, + struct samba_kdc_entry *skdc_entry_server_target) +{ + struct dom_sid *orig_sid; + struct dom_sid *target_sid; + TALLOC_CTX *frame = talloc_stackframe(); + + orig_sid = samdb_result_dom_sid(frame, + skdc_entry_client->msg, + "objectSid"); + target_sid = samdb_result_dom_sid(frame, + skdc_entry_server_target->msg, + "objectSid"); + + /* + * Allow delegation to the same record (representing a + * principal), even if by a different name. The easy and safe + * way to prove this is by SID comparison + */ + if (!(orig_sid && target_sid && dom_sid_equal(orig_sid, target_sid))) { + talloc_free(frame); + return KRB5KRB_AP_ERR_BADMATCH; + } + + talloc_free(frame); + return 0; +} + +/* Certificates printed by a the Certificate Authority might have a + * slightly different form of the user principal name to that in the + * database. Allow a mismatch where they both refer to the same + * SID */ + +krb5_error_code +samba_kdc_check_pkinit_ms_upn_match(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + struct samba_kdc_entry *skdc_entry, + krb5_const_principal certificate_principal) +{ + krb5_error_code ret; + struct ldb_dn *realm_dn; + struct ldb_message *msg; + struct dom_sid *orig_sid; + struct dom_sid *target_sid; + const char *ms_upn_check_attrs[] = { + "objectSid", NULL + }; + + TALLOC_CTX *mem_ctx = talloc_named(kdc_db_ctx, 0, "samba_kdc_check_pkinit_ms_upn_match"); + + if (!mem_ctx) { + ret = ENOMEM; + krb5_set_error_message(context, ret, "samba_kdc_fetch: talloc_named() failed!"); + return ret; + } + + ret = samba_kdc_lookup_client(context, kdc_db_ctx, + mem_ctx, certificate_principal, + ms_upn_check_attrs, &realm_dn, &msg); + + if (ret != 0) { + talloc_free(mem_ctx); + return ret; + } + + orig_sid = samdb_result_dom_sid(mem_ctx, skdc_entry->msg, "objectSid"); + target_sid = samdb_result_dom_sid(mem_ctx, msg, "objectSid"); + + /* Consider these to be the same principal, even if by a different + * name. The easy and safe way to prove this is by SID + * comparison */ + if (!(orig_sid && target_sid && dom_sid_equal(orig_sid, target_sid))) { + talloc_free(mem_ctx); +#if defined(KRB5KDC_ERR_CLIENT_NAME_MISMATCH) /* MIT */ + return KRB5KDC_ERR_CLIENT_NAME_MISMATCH; +#else /* Heimdal (where this is an enum) */ + return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH; +#endif + } + + talloc_free(mem_ctx); + return ret; +} + +/* + * Check if a given entry may delegate to this target principal + * with S4U2Proxy. + */ +krb5_error_code +samba_kdc_check_s4u2proxy(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + struct samba_kdc_entry *skdc_entry, + krb5_const_principal target_principal) +{ + krb5_error_code ret; + char *tmp = NULL; + const char *client_dn = NULL; + const char *target_principal_name = NULL; + struct ldb_message_element *el; + struct ldb_val val; + unsigned int i; + bool found = false; + + TALLOC_CTX *mem_ctx = talloc_named(kdc_db_ctx, 0, "samba_kdc_check_s4u2proxy"); + + if (!mem_ctx) { + ret = ENOMEM; + krb5_set_error_message(context, ret, + "samba_kdc_check_s4u2proxy:" + " talloc_named() failed!"); + return ret; + } + + client_dn = ldb_dn_get_linearized(skdc_entry->msg->dn); + if (!client_dn) { + if (errno == 0) { + errno = ENOMEM; + } + ret = errno; + krb5_set_error_message(context, ret, + "samba_kdc_check_s4u2proxy:" + " ldb_dn_get_linearized() failed!"); + return ret; + } + + el = ldb_msg_find_element(skdc_entry->msg, "msDS-AllowedToDelegateTo"); + if (el == NULL) { + ret = ENOENT; + goto bad_option; + } + SMB_ASSERT(el->num_values != 0); + + /* + * This is the Microsoft forwardable flag behavior. + * + * If the proxy (target) principal is NULL, and we have any authorized + * delegation target, allow to forward. + */ + if (target_principal == NULL) { + return 0; + } + + + /* + * The main heimdal code already checked that the target_principal + * belongs to the same realm as the client. + * + * So we just need the principal without the realm, + * as that is what is configured in the "msDS-AllowedToDelegateTo" + * attribute. + */ + ret = krb5_unparse_name_flags(context, target_principal, + KRB5_PRINCIPAL_UNPARSE_NO_REALM, &tmp); + if (ret) { + talloc_free(mem_ctx); + krb5_set_error_message(context, ret, + "samba_kdc_check_s4u2proxy:" + " krb5_unparse_name() failed!"); + return ret; + } + DEBUG(10,("samba_kdc_check_s4u2proxy: client[%s] for target[%s]\n", + client_dn, tmp)); + + target_principal_name = talloc_strdup(mem_ctx, tmp); + SAFE_FREE(tmp); + if (target_principal_name == NULL) { + ret = ENOMEM; + krb5_set_error_message(context, ret, + "samba_kdc_check_s4u2proxy:" + " talloc_strdup() failed!"); + return ret; + } + + val = data_blob_string_const(target_principal_name); + + for (i=0; i<el->num_values; i++) { + struct ldb_val *val1 = &val; + struct ldb_val *val2 = &el->values[i]; + int cmp; + + if (val1->length != val2->length) { + continue; + } + + cmp = strncasecmp((const char *)val1->data, + (const char *)val2->data, + val1->length); + if (cmp != 0) { + continue; + } + + found = true; + break; + } + + if (!found) { + ret = ENOENT; + goto bad_option; + } + + DEBUG(10,("samba_kdc_check_s4u2proxy: client[%s] allowed target[%s]\n", + client_dn, tmp)); + talloc_free(mem_ctx); + return 0; + +bad_option: + krb5_set_error_message(context, ret, + "samba_kdc_check_s4u2proxy: client[%s] " + "not allowed for delegation to target[%s]", + client_dn, + target_principal_name); + talloc_free(mem_ctx); + return KRB5KDC_ERR_BADOPTION; +} + +/* + * This method is called for S4U2Proxy requests and implements the + * resource-based constrained delegation variant, which can support + * cross-realm delegation. + */ +krb5_error_code samba_kdc_check_s4u2proxy_rbcd( + krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + krb5_const_principal client_principal, + krb5_const_principal server_principal, + krb5_pac header_pac, + struct samba_kdc_entry *proxy_skdc_entry) +{ + krb5_error_code code; + enum ndr_err_code ndr_err; + char *client_name = NULL; + char *server_name = NULL; + const char *proxy_dn = NULL; + const DATA_BLOB *data = NULL; + struct security_descriptor *rbcd_security_descriptor = NULL; + struct auth_user_info_dc *user_info_dc = NULL; + struct auth_session_info *session_info = NULL; + uint32_t session_info_flags = AUTH_SESSION_INFO_SIMPLE_PRIVILEGES; + /* + * Testing shows that although Windows grants SEC_ADS_GENERIC_ALL access + * in security descriptors it creates for RBCD, its KDC only requires + * SEC_ADS_CONTROL_ACCESS for the access check to succeed. + */ + uint32_t access_desired = SEC_ADS_CONTROL_ACCESS; + uint32_t access_granted = 0; + NTSTATUS nt_status; + TALLOC_CTX *mem_ctx = NULL; + + mem_ctx = talloc_named(kdc_db_ctx, + 0, + "samba_kdc_check_s4u2proxy_rbcd"); + if (mem_ctx == NULL) { + errno = ENOMEM; + code = errno; + + return code; + } + + proxy_dn = ldb_dn_get_linearized(proxy_skdc_entry->msg->dn); + if (proxy_dn == NULL) { + DBG_ERR("ldb_dn_get_linearized failed for proxy_dn!\n"); + TALLOC_FREE(mem_ctx); + if (errno == 0) { + errno = ENOMEM; + } + code = errno; + + goto out; + } + + rbcd_security_descriptor = talloc_zero(mem_ctx, + struct security_descriptor); + if (rbcd_security_descriptor == NULL) { + errno = ENOMEM; + code = errno; + + goto out; + } + + code = krb5_unparse_name_flags(context, + client_principal, + KRB5_PRINCIPAL_UNPARSE_DISPLAY, + &client_name); + if (code != 0) { + DBG_ERR("Unable to parse client_principal!\n"); + goto out; + } + + code = krb5_unparse_name_flags(context, + server_principal, + KRB5_PRINCIPAL_UNPARSE_DISPLAY, + &server_name); + if (code != 0) { + DBG_ERR("Unable to parse server_principal!\n"); + SAFE_FREE(client_name); + goto out; + } + + DBG_INFO("Check delegation from client[%s] to server[%s] via " + "proxy[%s]\n", + client_name, + server_name, + proxy_dn); + + code = kerberos_pac_to_user_info_dc(mem_ctx, + header_pac, + context, + &user_info_dc, + NULL, + NULL); + if (code != 0) { + goto out; + } + + if (user_info_dc->info->authenticated) { + session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED; + } + + nt_status = auth_generate_session_info(mem_ctx, + kdc_db_ctx->lp_ctx, + kdc_db_ctx->samdb, + user_info_dc, + session_info_flags, + &session_info); + if (!NT_STATUS_IS_OK(nt_status)) { + code = map_errno_from_nt_status(nt_status); + goto out; + } + + data = ldb_msg_find_ldb_val(proxy_skdc_entry->msg, + "msDS-AllowedToActOnBehalfOfOtherIdentity"); + if (data == NULL) { + DBG_ERR("Could not find security descriptor " + "msDS-AllowedToActOnBehalfOfOtherIdentity in " + "proxy[%s]\n", + proxy_dn); + code = KRB5KDC_ERR_BADOPTION; + goto out; + } + + ndr_err = ndr_pull_struct_blob( + data, + mem_ctx, + rbcd_security_descriptor, + (ndr_pull_flags_fn_t)ndr_pull_security_descriptor); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + errno = ndr_map_error2errno(ndr_err); + DBG_ERR("Failed to unmarshall " + "msDS-AllowedToActOnBehalfOfOtherIdentity " + "security descriptor of proxy[%s]\n", + proxy_dn); + code = KRB5KDC_ERR_BADOPTION; + goto out; + } + + if (DEBUGLEVEL >= 10) { + NDR_PRINT_DEBUG(security_token, session_info->security_token); + NDR_PRINT_DEBUG(security_descriptor, rbcd_security_descriptor); + } + + nt_status = sec_access_check_ds(rbcd_security_descriptor, + session_info->security_token, + access_desired, + &access_granted, + NULL, + NULL); + + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_WARNING("RBCD: sec_access_check_ds(access_desired=%#08x, " + "access_granted:%#08x) failed with: %s\n", + access_desired, + access_granted, + nt_errstr(nt_status)); + + code = KRB5KDC_ERR_BADOPTION; + goto out; + } + + DBG_NOTICE("RBCD: Access granted for client[%s]\n", client_name); + + code = 0; +out: + SAFE_FREE(client_name); + SAFE_FREE(server_name); + + TALLOC_FREE(mem_ctx); + return code; +} + +NTSTATUS samba_kdc_setup_db_ctx(TALLOC_CTX *mem_ctx, struct samba_kdc_base_context *base_ctx, + struct samba_kdc_db_context **kdc_db_ctx_out) +{ + int ldb_ret; + struct ldb_message *msg; + struct auth_session_info *session_info; + struct samba_kdc_db_context *kdc_db_ctx; + /* The idea here is very simple. Using Kerberos to + * authenticate the KDC to the LDAP server is higly likely to + * be circular. + * + * In future we may set this up to use EXERNAL and SSL + * certificates, for now it will almost certainly be NTLMSSP_SET_USERNAME + */ + + kdc_db_ctx = talloc_zero(mem_ctx, struct samba_kdc_db_context); + if (kdc_db_ctx == NULL) { + return NT_STATUS_NO_MEMORY; + } + kdc_db_ctx->ev_ctx = base_ctx->ev_ctx; + kdc_db_ctx->lp_ctx = base_ctx->lp_ctx; + kdc_db_ctx->msg_ctx = base_ctx->msg_ctx; + + /* get default kdc policy */ + lpcfg_default_kdc_policy(mem_ctx, + base_ctx->lp_ctx, + &kdc_db_ctx->policy.svc_tkt_lifetime, + &kdc_db_ctx->policy.usr_tkt_lifetime, + &kdc_db_ctx->policy.renewal_lifetime); + + session_info = system_session(kdc_db_ctx->lp_ctx); + if (session_info == NULL) { + return NT_STATUS_INTERNAL_ERROR; + } + + /* Setup the link to secrets.ldb */ + + kdc_db_ctx->secrets_db = secrets_db_connect(kdc_db_ctx, + base_ctx->lp_ctx); + if (kdc_db_ctx->secrets_db == NULL) { + DEBUG(1, ("samba_kdc_setup_db_ctx: " + "Cannot open secrets.ldb for KDC backend!")); + talloc_free(kdc_db_ctx); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + } + + kdc_db_ctx->fx_cookie_dn = ldb_dn_new(kdc_db_ctx, + kdc_db_ctx->secrets_db, + "CN=FX Cookie"); + + /* Setup the link to LDB */ + kdc_db_ctx->samdb = samdb_connect(kdc_db_ctx, + base_ctx->ev_ctx, + base_ctx->lp_ctx, + session_info, + NULL, + 0); + if (kdc_db_ctx->samdb == NULL) { + DEBUG(1, ("samba_kdc_setup_db_ctx: Cannot open samdb for KDC backend!")); + talloc_free(kdc_db_ctx); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + } + + /* Find out our own krbtgt kvno */ + ldb_ret = samdb_rodc(kdc_db_ctx->samdb, &kdc_db_ctx->rodc); + if (ldb_ret != LDB_SUCCESS) { + DEBUG(1, ("samba_kdc_setup_db_ctx: Cannot determine if we are an RODC in KDC backend: %s\n", + ldb_errstring(kdc_db_ctx->samdb))); + talloc_free(kdc_db_ctx); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + } + if (kdc_db_ctx->rodc) { + int my_krbtgt_number; + const char *secondary_keytab[] = { "msDS-SecondaryKrbTgtNumber", NULL }; + struct ldb_dn *account_dn; + struct ldb_dn *server_dn = samdb_server_dn(kdc_db_ctx->samdb, kdc_db_ctx); + if (!server_dn) { + DEBUG(1, ("samba_kdc_setup_db_ctx: Cannot determine server DN in KDC backend: %s\n", + ldb_errstring(kdc_db_ctx->samdb))); + talloc_free(kdc_db_ctx); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + } + + ldb_ret = samdb_reference_dn(kdc_db_ctx->samdb, kdc_db_ctx, server_dn, + "serverReference", &account_dn); + if (ldb_ret != LDB_SUCCESS) { + DEBUG(1, ("samba_kdc_setup_db_ctx: Cannot determine server account in KDC backend: %s\n", + ldb_errstring(kdc_db_ctx->samdb))); + talloc_free(kdc_db_ctx); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + } + + ldb_ret = samdb_reference_dn(kdc_db_ctx->samdb, kdc_db_ctx, account_dn, + "msDS-KrbTgtLink", &kdc_db_ctx->krbtgt_dn); + talloc_free(account_dn); + if (ldb_ret != LDB_SUCCESS) { + DEBUG(1, ("samba_kdc_setup_db_ctx: Cannot determine RODC krbtgt account in KDC backend: %s\n", + ldb_errstring(kdc_db_ctx->samdb))); + talloc_free(kdc_db_ctx); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + } + + ldb_ret = dsdb_search_one(kdc_db_ctx->samdb, kdc_db_ctx, + &msg, kdc_db_ctx->krbtgt_dn, LDB_SCOPE_BASE, + secondary_keytab, + DSDB_SEARCH_NO_GLOBAL_CATALOG, + "(&(objectClass=user)(msDS-SecondaryKrbTgtNumber=*))"); + if (ldb_ret != LDB_SUCCESS) { + DEBUG(1, ("samba_kdc_setup_db_ctx: Cannot read krbtgt account %s in KDC backend to get msDS-SecondaryKrbTgtNumber: %s: %s\n", + ldb_dn_get_linearized(kdc_db_ctx->krbtgt_dn), + ldb_errstring(kdc_db_ctx->samdb), + ldb_strerror(ldb_ret))); + talloc_free(kdc_db_ctx); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + } + my_krbtgt_number = ldb_msg_find_attr_as_int(msg, "msDS-SecondaryKrbTgtNumber", -1); + if (my_krbtgt_number == -1) { + DEBUG(1, ("samba_kdc_setup_db_ctx: Cannot read msDS-SecondaryKrbTgtNumber from krbtgt account %s in KDC backend: got %d\n", + ldb_dn_get_linearized(kdc_db_ctx->krbtgt_dn), + my_krbtgt_number)); + talloc_free(kdc_db_ctx); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + } + kdc_db_ctx->my_krbtgt_number = my_krbtgt_number; + + } else { + kdc_db_ctx->my_krbtgt_number = 0; + ldb_ret = dsdb_search_one(kdc_db_ctx->samdb, kdc_db_ctx, + &msg, + ldb_get_default_basedn(kdc_db_ctx->samdb), + LDB_SCOPE_SUBTREE, + krbtgt_attrs, + DSDB_SEARCH_NO_GLOBAL_CATALOG, + "(&(objectClass=user)(samAccountName=krbtgt))"); + + if (ldb_ret != LDB_SUCCESS) { + DEBUG(1, ("samba_kdc_fetch: could not find own KRBTGT in DB: %s\n", ldb_errstring(kdc_db_ctx->samdb))); + talloc_free(kdc_db_ctx); + return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + } + kdc_db_ctx->krbtgt_dn = talloc_steal(kdc_db_ctx, msg->dn); + kdc_db_ctx->my_krbtgt_number = 0; + talloc_free(msg); + } + *kdc_db_ctx_out = kdc_db_ctx; + return NT_STATUS_OK; +} + +krb5_error_code dsdb_extract_aes_256_key(krb5_context context, + TALLOC_CTX *mem_ctx, + const struct ldb_message *msg, + uint32_t user_account_control, + const uint32_t *kvno, + uint32_t *kvno_out, + DATA_BLOB *aes_256_key, + DATA_BLOB *salt) +{ + krb5_error_code krb5_ret; + uint32_t supported_enctypes; + unsigned flags = SDB_F_GET_CLIENT; + struct sdb_entry sentry = {}; + + if (kvno != NULL) { + flags |= SDB_F_KVNO_SPECIFIED; + } + + krb5_ret = samba_kdc_message2entry_keys(context, + mem_ctx, + msg, + false, /* is_krbtgt */ + false, /* is_rodc */ + user_account_control, + SAMBA_KDC_ENT_TYPE_CLIENT, + flags, + (kvno != NULL) ? *kvno : 0, + &sentry, + ENC_HMAC_SHA1_96_AES256, + &supported_enctypes); + if (krb5_ret != 0) { + DBG_ERR("Failed to parse supplementalCredentials " + "of %s with %s kvno using " + "ENCTYPE_HMAC_SHA1_96_AES256 " + "Kerberos Key: %s\n", + ldb_dn_get_linearized(msg->dn), + (kvno != NULL) ? "previous" : "current", + krb5_get_error_message(context, + krb5_ret)); + return krb5_ret; + } + + if ((supported_enctypes & ENC_HMAC_SHA1_96_AES256) == 0 || + sentry.keys.len != 1) { + DBG_INFO("Failed to find a ENCTYPE_HMAC_SHA1_96_AES256 " + "key in supplementalCredentials " + "of %s at KVNO %u (got %u keys, expected 1)\n", + ldb_dn_get_linearized(msg->dn), + sentry.kvno, + sentry.keys.len); + sdb_entry_free(&sentry); + return ENOENT; + } + + if (sentry.keys.val[0].salt == NULL) { + DBG_INFO("Failed to find a salt in " + "supplementalCredentials " + "of %s at KVNO %u\n", + ldb_dn_get_linearized(msg->dn), + sentry.kvno); + sdb_entry_free(&sentry); + return ENOENT; + } + + if (aes_256_key != NULL) { + *aes_256_key = data_blob_talloc(mem_ctx, + KRB5_KEY_DATA(&sentry.keys.val[0].key), + KRB5_KEY_LENGTH(&sentry.keys.val[0].key)); + if (aes_256_key->data == NULL) { + sdb_entry_free(&sentry); + return ENOMEM; + } + talloc_keep_secret(aes_256_key->data); + } + + if (salt != NULL) { + *salt = data_blob_talloc(mem_ctx, + sentry.keys.val[0].salt->salt.data, + sentry.keys.val[0].salt->salt.length); + if (salt->data == NULL) { + sdb_entry_free(&sentry); + return ENOMEM; + } + } + + if (kvno_out != NULL) { + *kvno_out = sentry.kvno; + } + + sdb_entry_free(&sentry); + + return 0; +} diff --git a/source4/kdc/db-glue.h b/source4/kdc/db-glue.h new file mode 100644 index 0000000..3a59d6a --- /dev/null +++ b/source4/kdc/db-glue.h @@ -0,0 +1,111 @@ +/* + Unix SMB/CIFS implementation. + + Database Glue between Samba and the KDC + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009 + Copyright (C) Simo Sorce <idra@samba.org> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +struct sdb_keys; +struct sdb_entry; + +struct samba_kdc_base_context; +struct samba_kdc_db_context; +struct samba_kdc_entry; + +enum samba_kdc_ent_type { + SAMBA_KDC_ENT_TYPE_CLIENT, + SAMBA_KDC_ENT_TYPE_SERVER, + SAMBA_KDC_ENT_TYPE_KRBTGT, + SAMBA_KDC_ENT_TYPE_TRUST, + SAMBA_KDC_ENT_TYPE_ANY +}; + +/* + * This allows DSDB to parse Kerberos keys without duplicating this + * difficulty + */ +krb5_error_code samba_kdc_message2entry_keys(krb5_context context, + TALLOC_CTX *mem_ctx, + const struct ldb_message *msg, + bool is_krbtgt, + bool is_rodc, + uint32_t userAccountControl, + enum samba_kdc_ent_type ent_type, + unsigned flags, + krb5_kvno requested_kvno, + struct sdb_entry *entry, + const uint32_t supported_enctypes_in, + uint32_t *supported_enctypes_out); + +int samba_kdc_set_fixed_keys(krb5_context context, + const struct ldb_val *secretbuffer, + uint32_t supported_enctypes, + struct sdb_keys *keys); + +krb5_error_code samba_kdc_fetch(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + krb5_const_principal principal, + unsigned flags, + krb5_kvno kvno, + struct sdb_entry *entry); + +krb5_error_code samba_kdc_firstkey(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + struct sdb_entry *entry); + +krb5_error_code samba_kdc_nextkey(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + struct sdb_entry *entry); + +krb5_error_code +samba_kdc_check_client_matches_target_service(krb5_context context, + struct samba_kdc_entry *skdc_entry_client, + struct samba_kdc_entry *skdc_entry_server_target); + +krb5_error_code +samba_kdc_check_pkinit_ms_upn_match(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + struct samba_kdc_entry *skdc_entry, + krb5_const_principal certificate_principal); + +krb5_error_code +samba_kdc_check_s4u2proxy(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + struct samba_kdc_entry *skdc_entry, + krb5_const_principal target_principal); + +krb5_error_code samba_kdc_check_s4u2proxy_rbcd( + krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + krb5_const_principal client_principal, + krb5_const_principal server_principal, + krb5_pac header_pac, + struct samba_kdc_entry *proxy_skdc_entry); + +NTSTATUS samba_kdc_setup_db_ctx(TALLOC_CTX *mem_ctx, struct samba_kdc_base_context *base_ctx, + struct samba_kdc_db_context **kdc_db_ctx_out); + +krb5_error_code dsdb_extract_aes_256_key(krb5_context context, + TALLOC_CTX *mem_ctx, + const struct ldb_message *msg, + uint32_t user_account_control, + const uint32_t *kvno, + uint32_t *kvno_out, + DATA_BLOB *aes_256_key, + DATA_BLOB *salt); diff --git a/source4/kdc/hdb-samba4-plugin.c b/source4/kdc/hdb-samba4-plugin.c new file mode 100644 index 0000000..be6d243 --- /dev/null +++ b/source4/kdc/hdb-samba4-plugin.c @@ -0,0 +1,85 @@ +/* + Unix SMB/CIFS implementation. + + KDC Server startup + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-20011 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "kdc/kdc-glue.h" +#include "lib/param/param.h" + +static krb5_error_code hdb_samba4_create(krb5_context context, struct HDB **db, const char *arg) +{ + NTSTATUS nt_status; + void *ptr = NULL; + struct samba_kdc_base_context *base_ctx = NULL; + + if (sscanf(arg, "&%p", &ptr) != 1) { + return EINVAL; + } + + base_ctx = talloc_get_type_abort(ptr, struct samba_kdc_base_context); + + /* The global kdc_mem_ctx and kdc_lp_ctx, Disgusting, ugly hack, but it means one less private hook */ + nt_status = hdb_samba4_kpasswd_create_kdc(base_ctx, context, db); + + if (NT_STATUS_IS_OK(nt_status)) { + return 0; + } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ERROR_DS_INCOMPATIBLE_VERSION)) { + return EINVAL; + } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) { + + krb5_set_error_message(context, EINVAL, "Failed to open Samba4 LDB at %s", lpcfg_private_path(base_ctx, base_ctx->lp_ctx, "sam.ldb")); + } else { + krb5_set_error_message(context, EINVAL, "Failed to connect to Samba4 DB: %s (%s)", get_friendly_nt_error_msg(nt_status), nt_errstr(nt_status)); + } + + return EINVAL; +} + +#if (HDB_INTERFACE_VERSION != 11) +#error "Unsupported Heimdal HDB version" +#endif + +#if HDB_INTERFACE_VERSION >= 8 +static krb5_error_code hdb_samba4_init(krb5_context context, void **ctx) +{ + *ctx = NULL; + return 0; +} + +static void hdb_samba4_fini(void *ctx) +{ +} +#endif + +/* Only used in the hdb-backed keytab code + * for a keytab of 'samba4&<address>' or samba4, to find + * kpasswd's key in the main DB + * + * The <address> is the string form of a pointer to a talloced struct hdb_samba_context + */ +struct hdb_method hdb_samba4_interface = { + HDB_INTERFACE_VERSION, +#if HDB_INTERFACE_VERSION >= 8 + .init = hdb_samba4_init, + .fini = hdb_samba4_fini, +#endif + .prefix = "samba4", + .create = hdb_samba4_create +}; diff --git a/source4/kdc/hdb-samba4.c b/source4/kdc/hdb-samba4.c new file mode 100644 index 0000000..e465a28 --- /dev/null +++ b/source4/kdc/hdb-samba4.c @@ -0,0 +1,886 @@ +/* + * Copyright (c) 1999-2001, 2003, PADL Software Pty Ltd. + * Copyright (c) 2004-2009, Andrew Bartlett <abartlet@samba.org>. + * Copyright (c) 2004, Stefan Metzmacher <metze@samba.org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of PADL Software nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "includes.h" +#include "kdc/kdc-glue.h" +#include "kdc/db-glue.h" +#include "auth/auth_sam.h" +#include "auth/common_auth.h" +#include <ldb.h> +#include "sdb.h" +#include "sdb_hdb.h" +#include "dsdb/samdb/samdb.h" +#include "param/param.h" +#include "../lib/tsocket/tsocket.h" +#include "librpc/gen_ndr/ndr_winbind_c.h" +#include "lib/messaging/irpc.h" +#include "hdb.h" +#include <kdc-audit.h> + +static krb5_error_code hdb_samba4_open(krb5_context context, HDB *db, int flags, mode_t mode) +{ + if (db->hdb_master_key_set) { + krb5_error_code ret = HDB_ERR_NOENTRY; + krb5_warnx(context, "hdb_samba4_open: use of a master key incompatible with LDB\n"); + krb5_set_error_message(context, ret, "hdb_samba4_open: use of a master key incompatible with LDB\n"); + return ret; + } + + return 0; +} + +static krb5_error_code hdb_samba4_close(krb5_context context, HDB *db) +{ + return 0; +} + +static krb5_error_code hdb_samba4_lock(krb5_context context, HDB *db, int operation) +{ + return 0; +} + +static krb5_error_code hdb_samba4_unlock(krb5_context context, HDB *db) +{ + return 0; +} + +static krb5_error_code hdb_samba4_rename(krb5_context context, HDB *db, const char *new_name) +{ + return HDB_ERR_DB_INUSE; +} + +static krb5_error_code hdb_samba4_store(krb5_context context, HDB *db, unsigned flags, hdb_entry *entry) +{ + return HDB_ERR_DB_INUSE; +} + +/* + * If we ever want kadmin to work fast, we might try and reopen the + * ldb with LDB_NOSYNC + */ +static krb5_error_code hdb_samba4_set_sync(krb5_context context, struct HDB *db, int set_sync) +{ + return 0; +} + +static void hdb_samba4_free_entry_context(krb5_context context, struct HDB *db, hdb_entry *entry) +{ + /* + * This function is now called for every HDB entry, not just those with + * 'context' set, so we have to check that the context is not NULL. + */ + if (entry->context != NULL) { + struct samba_kdc_entry *skdc_entry = + talloc_get_type_abort(entry->context, + struct samba_kdc_entry); + + /* this function is called only from hdb_free_entry(). + * Make sure we neutralize the destructor or we will + * get a double free later when hdb_free_entry() will + * try to call free_hdb_entry() */ + entry->context = NULL; + skdc_entry->kdc_entry = NULL; + TALLOC_FREE(skdc_entry); + } +} + +static int hdb_samba4_fill_fast_cookie(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx) +{ + struct ldb_message *msg = ldb_msg_new(kdc_db_ctx); + int ldb_ret; + + uint8_t secretbuffer[32]; + struct ldb_val val = data_blob_const(secretbuffer, + sizeof(secretbuffer)); + + if (msg == NULL) { + DBG_ERR("Failed to allocate msg for new fast cookie\n"); + return LDB_ERR_OPERATIONS_ERROR; + } + + /* Fill in all the keys with the same secret */ + generate_secret_buffer(secretbuffer, + sizeof(secretbuffer)); + + msg->dn = kdc_db_ctx->fx_cookie_dn; + + ldb_ret = ldb_msg_add_value(msg, "secret", &val, NULL); + + if (ldb_ret != LDB_SUCCESS) { + return ldb_ret; + } + + ldb_ret = ldb_add(kdc_db_ctx->secrets_db, + msg); + if (ldb_ret != LDB_SUCCESS) { + DBG_ERR("Failed to add fast cookie to ldb: %s\n", + ldb_errstring(kdc_db_ctx->secrets_db)); + } + return ldb_ret; +} + +static krb5_error_code hdb_samba4_fetch_fast_cookie(krb5_context context, + struct samba_kdc_db_context *kdc_db_ctx, + hdb_entry *entry) +{ + krb5_error_code ret = SDB_ERR_NOENTRY; + TALLOC_CTX *mem_ctx; + struct ldb_result *res; + int ldb_ret; + struct sdb_entry sentry = {}; + const char *attrs[] = { + "secret", + NULL + }; + const struct ldb_val *val; + + mem_ctx = talloc_named(kdc_db_ctx, 0, "samba_kdc_fetch context"); + if (!mem_ctx) { + ret = ENOMEM; + krb5_set_error_message(context, ret, "samba_kdc_fetch: talloc_named() failed!"); + return ret; + } + + /* search for CN=FX-COOKIE */ + ldb_ret = ldb_search(kdc_db_ctx->secrets_db, + mem_ctx, + &res, + kdc_db_ctx->fx_cookie_dn, + LDB_SCOPE_BASE, + attrs, NULL); + + if (ldb_ret == LDB_ERR_NO_SUCH_OBJECT || res->count == 0) { + + ldb_ret = hdb_samba4_fill_fast_cookie(context, + kdc_db_ctx); + + if (ldb_ret != LDB_SUCCESS) { + TALLOC_FREE(mem_ctx); + return HDB_ERR_NO_WRITE_SUPPORT; + } + + /* search for CN=FX-COOKIE */ + ldb_ret = ldb_search(kdc_db_ctx->secrets_db, + mem_ctx, + &res, + kdc_db_ctx->fx_cookie_dn, + LDB_SCOPE_BASE, + attrs, NULL); + + if (ldb_ret != LDB_SUCCESS || res->count != 1) { + TALLOC_FREE(mem_ctx); + return HDB_ERR_NOENTRY; + } + } + + val = ldb_msg_find_ldb_val(res->msgs[0], + "secret"); + if (val == NULL || val->length != 32) { + TALLOC_FREE(mem_ctx); + return HDB_ERR_NOENTRY; + } + + + ret = krb5_make_principal(context, + &sentry.principal, + KRB5_WELLKNOWN_ORG_H5L_REALM, + KRB5_WELLKNOWN_NAME, "org.h5l.fast-cookie", + NULL); + if (ret) { + TALLOC_FREE(mem_ctx); + return ret; + } + + ret = samba_kdc_set_fixed_keys(context, val, ENC_ALL_TYPES, + &sentry.keys); + if (ret != 0) { + return ret; + } + + ret = sdb_entry_to_hdb_entry(context, &sentry, entry); + sdb_entry_free(&sentry); + TALLOC_FREE(mem_ctx); + + return ret; +} + +static krb5_error_code hdb_samba4_fetch_kvno(krb5_context context, HDB *db, + krb5_const_principal principal, + unsigned flags, + krb5_kvno kvno, + hdb_entry *entry) +{ + struct samba_kdc_db_context *kdc_db_ctx; + struct sdb_entry sentry = {}; + krb5_error_code code, ret; + uint32_t sflags; + + kdc_db_ctx = talloc_get_type_abort(db->hdb_db, + struct samba_kdc_db_context); + + if (flags & HDB_F_GET_FAST_COOKIE) { + return hdb_samba4_fetch_fast_cookie(context, + kdc_db_ctx, + entry); + } + + sflags = (flags & SDB_F_HDB_MASK); + + ret = samba_kdc_fetch(context, + kdc_db_ctx, + principal, + sflags, + kvno, + &sentry); + switch (ret) { + case 0: + code = 0; + break; + case SDB_ERR_WRONG_REALM: + /* + * If SDB_ERR_WRONG_REALM is returned we need to process the + * sdb_entry to fill the principal in the HDB entry. + */ + code = HDB_ERR_WRONG_REALM; + break; + case SDB_ERR_NOENTRY: + return HDB_ERR_NOENTRY; + case SDB_ERR_NOT_FOUND_HERE: + return HDB_ERR_NOT_FOUND_HERE; + default: + return ret; + } + + ret = sdb_entry_to_hdb_entry(context, &sentry, entry); + sdb_entry_free(&sentry); + + if (code != 0 && ret != 0) { + code = ret; + } + + return code; +} + +static krb5_error_code hdb_samba4_kpasswd_fetch_kvno(krb5_context context, HDB *db, + krb5_const_principal _principal, + unsigned flags, + krb5_kvno _kvno, + hdb_entry *entry) +{ + struct samba_kdc_db_context *kdc_db_ctx = NULL; + krb5_error_code ret; + krb5_principal kpasswd_principal = NULL; + + kdc_db_ctx = talloc_get_type_abort(db->hdb_db, + struct samba_kdc_db_context); + + ret = smb_krb5_make_principal(context, &kpasswd_principal, + lpcfg_realm(kdc_db_ctx->lp_ctx), + "kadmin", "changepw", + NULL); + if (ret) { + return ret; + } + smb_krb5_principal_set_type(context, kpasswd_principal, KRB5_NT_SRV_INST); + + /* + * For the kpasswd service, always ensure we get the latest kvno. This + * also means we (correctly) refuse RODC-issued tickets. + */ + flags &= ~HDB_F_KVNO_SPECIFIED; + + /* Don't bother looking up a client or krbtgt. */ + flags &= ~(SDB_F_GET_CLIENT|SDB_F_GET_KRBTGT); + + ret = hdb_samba4_fetch_kvno(context, db, + kpasswd_principal, + flags, + 0, + entry); + + krb5_free_principal(context, kpasswd_principal); + return ret; +} + +static krb5_error_code hdb_samba4_firstkey(krb5_context context, HDB *db, unsigned flags, + hdb_entry *entry) +{ + struct samba_kdc_db_context *kdc_db_ctx; + struct sdb_entry sentry = {}; + krb5_error_code ret; + + kdc_db_ctx = talloc_get_type_abort(db->hdb_db, + struct samba_kdc_db_context); + + ret = samba_kdc_firstkey(context, kdc_db_ctx, &sentry); + switch (ret) { + case 0: + break; + case SDB_ERR_WRONG_REALM: + return HDB_ERR_WRONG_REALM; + case SDB_ERR_NOENTRY: + return HDB_ERR_NOENTRY; + case SDB_ERR_NOT_FOUND_HERE: + return HDB_ERR_NOT_FOUND_HERE; + default: + return ret; + } + + ret = sdb_entry_to_hdb_entry(context, &sentry, entry); + sdb_entry_free(&sentry); + return ret; +} + +static krb5_error_code hdb_samba4_nextkey(krb5_context context, HDB *db, unsigned flags, + hdb_entry *entry) +{ + struct samba_kdc_db_context *kdc_db_ctx; + struct sdb_entry sentry = {}; + krb5_error_code ret; + + kdc_db_ctx = talloc_get_type_abort(db->hdb_db, + struct samba_kdc_db_context); + + ret = samba_kdc_nextkey(context, kdc_db_ctx, &sentry); + switch (ret) { + case 0: + break; + case SDB_ERR_WRONG_REALM: + return HDB_ERR_WRONG_REALM; + case SDB_ERR_NOENTRY: + return HDB_ERR_NOENTRY; + case SDB_ERR_NOT_FOUND_HERE: + return HDB_ERR_NOT_FOUND_HERE; + default: + return ret; + } + + ret = sdb_entry_to_hdb_entry(context, &sentry, entry); + sdb_entry_free(&sentry); + return ret; +} + +static krb5_error_code hdb_samba4_nextkey_panic(krb5_context context, HDB *db, + unsigned flags, + hdb_entry *entry) +{ + DBG_ERR("Attempt to iterate kpasswd keytab => PANIC\n"); + smb_panic("hdb_samba4_nextkey_panic: Attempt to iterate kpasswd keytab"); +} + +static krb5_error_code hdb_samba4_destroy(krb5_context context, HDB *db) +{ + talloc_free(db); + return 0; +} + +static krb5_error_code +hdb_samba4_check_constrained_delegation(krb5_context context, HDB *db, + hdb_entry *entry, + krb5_const_principal target_principal) +{ + struct samba_kdc_db_context *kdc_db_ctx; + struct samba_kdc_entry *skdc_entry; + krb5_error_code ret; + + kdc_db_ctx = talloc_get_type_abort(db->hdb_db, + struct samba_kdc_db_context); + skdc_entry = talloc_get_type_abort(entry->context, + struct samba_kdc_entry); + + ret = samba_kdc_check_s4u2proxy(context, kdc_db_ctx, + skdc_entry, + target_principal); + switch (ret) { + case 0: + break; + case SDB_ERR_WRONG_REALM: + ret = HDB_ERR_WRONG_REALM; + break; + case SDB_ERR_NOENTRY: + ret = HDB_ERR_NOENTRY; + break; + case SDB_ERR_NOT_FOUND_HERE: + ret = HDB_ERR_NOT_FOUND_HERE; + break; + default: + break; + } + + return ret; +} + +static krb5_error_code +hdb_samba4_check_pkinit_ms_upn_match(krb5_context context, HDB *db, + hdb_entry *entry, + krb5_const_principal certificate_principal) +{ + struct samba_kdc_db_context *kdc_db_ctx; + struct samba_kdc_entry *skdc_entry; + krb5_error_code ret; + + kdc_db_ctx = talloc_get_type_abort(db->hdb_db, + struct samba_kdc_db_context); + skdc_entry = talloc_get_type_abort(entry->context, + struct samba_kdc_entry); + + ret = samba_kdc_check_pkinit_ms_upn_match(context, kdc_db_ctx, + skdc_entry, + certificate_principal); + switch (ret) { + case 0: + break; + case SDB_ERR_WRONG_REALM: + ret = HDB_ERR_WRONG_REALM; + break; + case SDB_ERR_NOENTRY: + ret = HDB_ERR_NOENTRY; + break; + case SDB_ERR_NOT_FOUND_HERE: + ret = HDB_ERR_NOT_FOUND_HERE; + break; + default: + break; + } + + return ret; +} + +static krb5_error_code +hdb_samba4_check_client_matches_target_service(krb5_context context, HDB *db, + hdb_entry *client_entry, + hdb_entry *server_target_entry) +{ + struct samba_kdc_entry *skdc_client_entry + = talloc_get_type_abort(client_entry->context, + struct samba_kdc_entry); + struct samba_kdc_entry *skdc_server_target_entry + = talloc_get_type_abort(server_target_entry->context, + struct samba_kdc_entry); + + return samba_kdc_check_client_matches_target_service(context, + skdc_client_entry, + skdc_server_target_entry); +} + +static void reset_bad_password_netlogon(TALLOC_CTX *mem_ctx, + struct samba_kdc_db_context *kdc_db_ctx, + struct netr_SendToSamBase *send_to_sam) +{ + struct dcerpc_binding_handle *irpc_handle; + struct winbind_SendToSam req; + + irpc_handle = irpc_binding_handle_by_name(mem_ctx, kdc_db_ctx->msg_ctx, + "winbind_server", + &ndr_table_winbind); + + if (irpc_handle == NULL) { + DEBUG(0, ("No winbind_server running!\n")); + return; + } + + req.in.message = *send_to_sam; + + dcerpc_winbind_SendToSam_r_send(mem_ctx, kdc_db_ctx->ev_ctx, + irpc_handle, &req); +} + +static krb5_error_code hdb_samba4_audit(krb5_context context, + HDB *db, + hdb_entry *entry, + hdb_request_t r) +{ + struct samba_kdc_db_context *kdc_db_ctx = talloc_get_type_abort(db->hdb_db, + struct samba_kdc_db_context); + struct ldb_dn *domain_dn = ldb_get_default_basedn(kdc_db_ctx->samdb); + uint64_t logon_id = generate_random_u64(); + heim_object_t auth_details_obj = NULL; + const char *auth_details = NULL; + char *etype_str = NULL; + heim_object_t hdb_auth_status_obj = NULL; + int hdb_auth_status; + heim_object_t pa_type_obj = NULL; + const char *pa_type = NULL; + struct auth_usersupplied_info ui; + size_t sa_socklen = 0; + int final_ret = 0; + + hdb_auth_status_obj = heim_audit_getkv((heim_svc_req_desc)r, KDC_REQUEST_KV_AUTH_EVENT); + if (hdb_auth_status_obj == NULL) { + /* No status code found, so just return. */ + return 0; + } + + hdb_auth_status = heim_number_get_int(hdb_auth_status_obj); + + pa_type_obj = heim_audit_getkv((heim_svc_req_desc)r, "pa"); + if (pa_type_obj != NULL) { + pa_type = heim_string_get_utf8(pa_type_obj); + } + + auth_details_obj = heim_audit_getkv((heim_svc_req_desc)r, KDC_REQUEST_KV_PKINIT_CLIENT_CERT); + if (auth_details_obj != NULL) { + auth_details = heim_string_get_utf8(auth_details_obj); + } else { + auth_details_obj = heim_audit_getkv((heim_svc_req_desc)r, KDC_REQUEST_KV_GSS_INITIATOR); + if (auth_details_obj != NULL) { + auth_details = heim_string_get_utf8(auth_details_obj); + } else { + heim_object_t etype_obj = heim_audit_getkv((heim_svc_req_desc)r, KDC_REQUEST_KV_PA_ETYPE); + if (etype_obj != NULL) { + int etype = heim_number_get_int(etype_obj); + + krb5_error_code ret = krb5_enctype_to_string(r->context, etype, &etype_str); + if (ret == 0) { + auth_details = etype_str; + } else { + auth_details = "unknown enctype"; + } + } + } + } + + /* + * Forcing this via the NTLM auth structure is not ideal, but + * it is the most practical option right now, and ensures the + * logs are consistent, even if some elements are always NULL. + */ + ui = (struct auth_usersupplied_info) { + .was_mapped = true, + .client = { + .account_name = r->cname, + .domain_name = NULL, + }, + .service_description = "Kerberos KDC", + .auth_description = "Unknown Auth Description", + .password_type = auth_details, + .logon_id = logon_id + }; + + switch (r->addr->sa_family) { + case AF_INET: + sa_socklen = sizeof(struct sockaddr_in); + break; +#ifdef HAVE_IPV6 + case AF_INET6: + sa_socklen = sizeof(struct sockaddr_in6); + break; +#endif + } + + switch (hdb_auth_status) { + default: + { + TALLOC_CTX *frame = talloc_stackframe(); + struct samba_kdc_entry *p = talloc_get_type(entry->context, + struct samba_kdc_entry); + struct dom_sid *sid + = samdb_result_dom_sid(frame, p->msg, "objectSid"); + const char *account_name + = ldb_msg_find_attr_as_string(p->msg, "sAMAccountName", NULL); + const char *domain_name = lpcfg_sam_name(p->kdc_db_ctx->lp_ctx); + struct tsocket_address *remote_host; + const char *auth_description = NULL; + NTSTATUS status; + int ret; + bool rwdc_fallback = false; + + ret = tsocket_address_bsd_from_sockaddr(frame, r->addr, + sa_socklen, + &remote_host); + if (ret != 0) { + ui.remote_host = NULL; + } else { + ui.remote_host = remote_host; + } + + ui.mapped.account_name = account_name; + ui.mapped.domain_name = domain_name; + + if (pa_type != NULL) { + auth_description = talloc_asprintf(frame, + "%s Pre-authentication", + pa_type); + if (auth_description == NULL) { + auth_description = pa_type; + } + } else { + auth_description = "Unknown Pre-authentication"; + } + ui.auth_description = auth_description; + + if (hdb_auth_status == KDC_AUTH_EVENT_CLIENT_AUTHORIZED) { + struct netr_SendToSamBase *send_to_sam = NULL; + + /* + * TODO: We could log the AS-REQ authorization success here as + * well. However before we do that, we need to pass + * in the PAC here or re-calculate it. + */ + status = authsam_logon_success_accounting(kdc_db_ctx->samdb, p->msg, + domain_dn, true, frame, &send_to_sam); + if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) { + final_ret = KRB5KDC_ERR_CLIENT_REVOKED; + r->error_code = final_ret; + rwdc_fallback = kdc_db_ctx->rodc; + } else if (!NT_STATUS_IS_OK(status)) { + final_ret = KRB5KRB_ERR_GENERIC; + r->error_code = final_ret; + rwdc_fallback = kdc_db_ctx->rodc; + } else if (kdc_db_ctx->rodc && send_to_sam != NULL) { + reset_bad_password_netlogon(frame, kdc_db_ctx, send_to_sam); + } + + /* This is the final sucess */ + } else if (hdb_auth_status == KDC_AUTH_EVENT_VALIDATED_LONG_TERM_KEY) { + /* + * This was only a pre-authentication success, + * but we didn't reach the final + * KDC_AUTH_EVENT_CLIENT_AUTHORIZED, + * so consult the error code. + */ + if (r->error_code == 0) { + DBG_ERR("ERROR: VALIDATED_LONG_TERM_KEY " + "with error=0 => INTERNAL_ERROR\n"); + status = NT_STATUS_INTERNAL_ERROR; + final_ret = KRB5KRB_ERR_GENERIC; + r->error_code = final_ret; + } else if (!NT_STATUS_IS_OK(p->reject_status)) { + status = p->reject_status; + } else { + status = krb5_to_nt_status(r->error_code); + } + } else if (hdb_auth_status == KDC_AUTH_EVENT_PREAUTH_SUCCEEDED) { + /* + * This was only a pre-authentication success, + * but we didn't reach the final + * KDC_AUTH_EVENT_CLIENT_AUTHORIZED, + * so consult the error code. + */ + if (r->error_code == 0) { + DBG_ERR("ERROR: PREAUTH_SUCCEEDED " + "with error=0 => INTERNAL_ERROR\n"); + status = NT_STATUS_INTERNAL_ERROR; + final_ret = KRB5KRB_ERR_GENERIC; + r->error_code = final_ret; + } else if (!NT_STATUS_IS_OK(p->reject_status)) { + status = p->reject_status; + } else { + status = krb5_to_nt_status(r->error_code); + } + } else if (hdb_auth_status == KDC_AUTH_EVENT_CLIENT_TIME_SKEW) { + status = NT_STATUS_TIME_DIFFERENCE_AT_DC; + } else if (hdb_auth_status == KDC_AUTH_EVENT_WRONG_LONG_TERM_KEY) { + status = authsam_update_bad_pwd_count(kdc_db_ctx->samdb, p->msg, domain_dn); + if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) { + final_ret = KRB5KDC_ERR_CLIENT_REVOKED; + r->error_code = final_ret; + } else { + status = NT_STATUS_WRONG_PASSWORD; + } + rwdc_fallback = kdc_db_ctx->rodc; + } else if (hdb_auth_status == KDC_AUTH_EVENT_CLIENT_LOCKED_OUT) { + status = NT_STATUS_ACCOUNT_LOCKED_OUT; + rwdc_fallback = kdc_db_ctx->rodc; + } else if (hdb_auth_status == KDC_AUTH_EVENT_CLIENT_NAME_UNAUTHORIZED) { + if (pa_type != NULL && strncmp(pa_type, "PK-INIT", strlen("PK-INIT")) == 0) { + status = NT_STATUS_PKINIT_NAME_MISMATCH; + } else { + status = NT_STATUS_ACCOUNT_RESTRICTION; + } + rwdc_fallback = kdc_db_ctx->rodc; + } else if (hdb_auth_status == KDC_AUTH_EVENT_PREAUTH_FAILED) { + if (pa_type != NULL && strncmp(pa_type, "PK-INIT", strlen("PK-INIT")) == 0) { + status = NT_STATUS_PKINIT_FAILURE; + } else { + status = NT_STATUS_GENERIC_COMMAND_FAILED; + } + rwdc_fallback = kdc_db_ctx->rodc; + } else { + DBG_ERR("Unhandled hdb_auth_status=%d => INTERNAL_ERROR\n", + hdb_auth_status); + status = NT_STATUS_INTERNAL_ERROR; + final_ret = KRB5KRB_ERR_GENERIC; + r->error_code = final_ret; + } + + if (rwdc_fallback) { + /* + * Forward the request to an RWDC in order + * to give an authoritative answer to the client. + */ + auth_description = talloc_asprintf(frame, + "%s,Forward-To-RWDC", + ui.auth_description); + if (auth_description != NULL) { + ui.auth_description = auth_description; + } + final_ret = HDB_ERR_NOT_FOUND_HERE; + } + + log_authentication_event(kdc_db_ctx->msg_ctx, + kdc_db_ctx->lp_ctx, + &r->tv_start, + &ui, + status, + domain_name, + account_name, + sid); + if (final_ret == KRB5KRB_ERR_GENERIC && socket_wrapper_enabled()) { + /* + * If we're running under make test + * just panic + */ + DBG_ERR("Unexpected situation => PANIC\n"); + smb_panic("hdb_samba4_audit: Unexpected situation"); + } + TALLOC_FREE(frame); + break; + } + case KDC_AUTH_EVENT_CLIENT_UNKNOWN: + { + struct tsocket_address *remote_host; + int ret; + TALLOC_CTX *frame = talloc_stackframe(); + ret = tsocket_address_bsd_from_sockaddr(frame, r->addr, + sa_socklen, + &remote_host); + if (ret != 0) { + ui.remote_host = NULL; + } else { + ui.remote_host = remote_host; + } + + if (pa_type == NULL) { + pa_type = "AS-REQ"; + } + + ui.auth_description = pa_type; + + /* Note this is not forwarded to an RWDC */ + + log_authentication_event(kdc_db_ctx->msg_ctx, + kdc_db_ctx->lp_ctx, + &r->tv_start, + &ui, + NT_STATUS_NO_SUCH_USER, + NULL, NULL, + NULL); + TALLOC_FREE(frame); + break; + } + } + + free(etype_str); + + return final_ret; +} + +/* This interface is to be called by the KDC and libnet_keytab_dump, + * which is expecting Samba calling conventions. + * It is also called by a wrapper (hdb_samba4_create) from the + * kpasswdd -> krb5 -> keytab_hdb -> hdb code */ + +NTSTATUS hdb_samba4_create_kdc(struct samba_kdc_base_context *base_ctx, + krb5_context context, struct HDB **db) +{ + struct samba_kdc_db_context *kdc_db_ctx; + NTSTATUS nt_status; + + if (hdb_interface_version != HDB_INTERFACE_VERSION) { + krb5_set_error_message(context, EINVAL, "Heimdal HDB interface version mismatch between build-time and run-time libraries!"); + return NT_STATUS_ERROR_DS_INCOMPATIBLE_VERSION; + } + + *db = talloc_zero(base_ctx, HDB); + if (!*db) { + krb5_set_error_message(context, ENOMEM, "malloc: out of memory"); + return NT_STATUS_NO_MEMORY; + } + + (*db)->hdb_master_key_set = 0; + (*db)->hdb_db = NULL; + (*db)->hdb_capability_flags = HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL; + + nt_status = samba_kdc_setup_db_ctx(*db, base_ctx, &kdc_db_ctx); + if (!NT_STATUS_IS_OK(nt_status)) { + talloc_free(*db); + return nt_status; + } + (*db)->hdb_db = kdc_db_ctx; + + (*db)->hdb_dbc = NULL; + (*db)->hdb_open = hdb_samba4_open; + (*db)->hdb_close = hdb_samba4_close; + (*db)->hdb_free_entry_context = hdb_samba4_free_entry_context; + (*db)->hdb_fetch_kvno = hdb_samba4_fetch_kvno; + (*db)->hdb_store = hdb_samba4_store; + (*db)->hdb_firstkey = hdb_samba4_firstkey; + (*db)->hdb_nextkey = hdb_samba4_nextkey; + (*db)->hdb_lock = hdb_samba4_lock; + (*db)->hdb_unlock = hdb_samba4_unlock; + (*db)->hdb_set_sync = hdb_samba4_set_sync; + (*db)->hdb_rename = hdb_samba4_rename; + /* we don't implement these, as we are not a lockable database */ + (*db)->hdb__get = NULL; + (*db)->hdb__put = NULL; + /* kadmin should not be used for deletes - use other tools instead */ + (*db)->hdb__del = NULL; + (*db)->hdb_destroy = hdb_samba4_destroy; + + (*db)->hdb_audit = hdb_samba4_audit; + (*db)->hdb_check_constrained_delegation = hdb_samba4_check_constrained_delegation; + (*db)->hdb_check_pkinit_ms_upn_match = hdb_samba4_check_pkinit_ms_upn_match; + (*db)->hdb_check_client_matches_target_service = hdb_samba4_check_client_matches_target_service; + + return NT_STATUS_OK; +} + +NTSTATUS hdb_samba4_kpasswd_create_kdc(struct samba_kdc_base_context *base_ctx, + krb5_context context, struct HDB **db) +{ + NTSTATUS nt_status; + + nt_status = hdb_samba4_create_kdc(base_ctx, context, db); + if (!NT_STATUS_IS_OK(nt_status)) { + return nt_status; + } + + (*db)->hdb_fetch_kvno = hdb_samba4_kpasswd_fetch_kvno; + (*db)->hdb_firstkey = hdb_samba4_nextkey_panic; + (*db)->hdb_nextkey = hdb_samba4_nextkey_panic; + + return NT_STATUS_OK; +} diff --git a/source4/kdc/kdc-glue.c b/source4/kdc/kdc-glue.c new file mode 100644 index 0000000..671e506 --- /dev/null +++ b/source4/kdc/kdc-glue.c @@ -0,0 +1,65 @@ +/* + Unix SMB/CIFS implementation. + + PAC Glue between Samba and the KDC + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009 + Copyright (C) Simo Sorce <idra@samba.org> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "system/kerberos.h" +#include "auth/kerberos/kerberos.h" +#include <hdb.h> +#include "kdc/samba_kdc.h" +#include "kdc/pac-glue.h" +#include "librpc/gen_ndr/ndr_krb5pac.h" +#include "auth/kerberos/pac_utils.h" +#include "kdc/kdc-glue.h" + +int kdc_check_pac(krb5_context context, + DATA_BLOB srv_sig, + struct PAC_SIGNATURE_DATA *kdc_sig, + hdb_entry *ent) +{ + krb5_enctype etype; + int ret; + krb5_keyblock keyblock; + Key *key; + + if (kdc_sig->type == CKSUMTYPE_HMAC_MD5) { + etype = ENCTYPE_ARCFOUR_HMAC; + } else { + ret = krb5_cksumtype_to_enctype(context, + kdc_sig->type, + &etype); + if (ret != 0) { + return ret; + } + } + + ret = hdb_enctype2key(context, ent, NULL, etype, &key); + + if (ret != 0) { + return ret; + } + + keyblock = key->key; + + return check_pac_checksum(srv_sig, kdc_sig, + context, &keyblock); +} diff --git a/source4/kdc/kdc-glue.h b/source4/kdc/kdc-glue.h new file mode 100644 index 0000000..7a0184c --- /dev/null +++ b/source4/kdc/kdc-glue.h @@ -0,0 +1,57 @@ +/* + Unix SMB/CIFS implementation. + + KDC structures + + Copyright (C) Andrew Tridgell 2005 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _KDC_KDC_H +#define _KDC_KDC_H + +#include "system/kerberos.h" +#include "auth/kerberos/kerberos.h" +#include <hdb.h> +#include <heimbase.h> +#include <kdc.h> +#include <krb5/kdc-plugin.h> +#include "kdc/samba_kdc.h" +#include "kdc/kdc-server.h" + +struct tsocket_address; + +kdc_code kpasswdd_process(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + DATA_BLOB *input, + DATA_BLOB *reply, + struct tsocket_address *peer_addr, + struct tsocket_address *my_addr, + int datagram_reply); + +/* from hdb-samba4.c */ +NTSTATUS hdb_samba4_create_kdc(struct samba_kdc_base_context *base_ctx, + krb5_context context, struct HDB **db); + +NTSTATUS hdb_samba4_kpasswd_create_kdc(struct samba_kdc_base_context *base_ctx, + krb5_context context, struct HDB **db); + +/* from kdc-glue.c */ +int kdc_check_pac(krb5_context krb5_context, + DATA_BLOB server_sig, + struct PAC_SIGNATURE_DATA *kdc_sig, + hdb_entry *ent); +#endif diff --git a/source4/kdc/kdc-heimdal.c b/source4/kdc/kdc-heimdal.c new file mode 100644 index 0000000..e936d4b --- /dev/null +++ b/source4/kdc/kdc-heimdal.c @@ -0,0 +1,518 @@ +/* + Unix SMB/CIFS implementation. + + KDC Server startup + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008 + Copyright (C) Andrew Tridgell 2005 + Copyright (C) Stefan Metzmacher 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "samba/process_model.h" +#include "lib/tsocket/tsocket.h" +#include "lib/messaging/irpc.h" +#include "librpc/gen_ndr/ndr_irpc.h" +#include "librpc/gen_ndr/ndr_krb5pac.h" +#include "lib/socket/netif.h" +#include "param/param.h" +#include "kdc/kdc-server.h" +#include "kdc/kdc-proxy.h" +#include "kdc/kdc-glue.h" +#include "kdc/pac-glue.h" +#include "kdc/kpasswd-service.h" +#include "dsdb/samdb/samdb.h" +#include "auth/session.h" +#include "libds/common/roles.h" +#include <kdc.h> +#include <hdb.h> + +NTSTATUS server_service_kdc_init(TALLOC_CTX *); + +extern struct krb5plugin_kdc_ftable kdc_plugin_table; + +/** + Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba + calling conventions +*/ + +static kdc_code kdc_process(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + DATA_BLOB *input, + DATA_BLOB *reply, + struct tsocket_address *peer_addr, + struct tsocket_address *my_addr, + int datagram_reply) +{ + int ret; + char *pa; + struct sockaddr_storage ss; + krb5_data k5_reply; + krb5_kdc_configuration *kdc_config = + (krb5_kdc_configuration *)kdc->private_data; + + krb5_data_zero(&k5_reply); + + krb5_kdc_update_time(NULL); + + ret = tsocket_address_bsd_sockaddr(peer_addr, (struct sockaddr *) &ss, + sizeof(struct sockaddr_storage)); + if (ret < 0) { + return KDC_ERROR; + } + pa = tsocket_address_string(peer_addr, mem_ctx); + if (pa == NULL) { + return KDC_ERROR; + } + + DBG_DEBUG("Received KDC packet of length %lu from %s\n", + (long)input->length - 4, pa); + + ret = krb5_kdc_process_krb5_request(kdc->smb_krb5_context->krb5_context, + kdc_config, + input->data, input->length, + &k5_reply, + pa, + (struct sockaddr *) &ss, + datagram_reply); + if (ret == -1) { + *reply = data_blob(NULL, 0); + return KDC_ERROR; + } + + if (ret == HDB_ERR_NOT_FOUND_HERE) { + *reply = data_blob(NULL, 0); + return KDC_PROXY_REQUEST; + } + + if (k5_reply.length) { + *reply = data_blob_talloc(mem_ctx, k5_reply.data, k5_reply.length); + krb5_data_free(&k5_reply); + } else { + *reply = data_blob(NULL, 0); + } + return KDC_OK; +} + +/* + setup our listening sockets on the configured network interfaces +*/ +static NTSTATUS kdc_startup_interfaces(struct kdc_server *kdc, + struct loadparm_context *lp_ctx, + struct interface *ifaces, + const struct model_ops *model_ops) +{ + int num_interfaces; + TALLOC_CTX *tmp_ctx = talloc_new(kdc); + NTSTATUS status; + int i; + uint16_t kdc_port = lpcfg_krb5_port(lp_ctx); + uint16_t kpasswd_port = lpcfg_kpasswd_port(lp_ctx); + bool done_wildcard = false; + + num_interfaces = iface_list_count(ifaces); + + /* if we are allowing incoming packets from any address, then + we need to bind to the wildcard address */ + if (!lpcfg_bind_interfaces_only(lp_ctx)) { + size_t num_binds = 0; + char **wcard = iface_list_wildcard(kdc); + NT_STATUS_HAVE_NO_MEMORY(wcard); + for (i=0; wcard[i]; i++) { + if (kdc_port) { + status = kdc_add_socket(kdc, model_ops, + "kdc", wcard[i], kdc_port, + kdc_process, false); + if (NT_STATUS_IS_OK(status)) { + num_binds++; + } + } + + if (kpasswd_port) { + status = kdc_add_socket(kdc, model_ops, + "kpasswd", wcard[i], kpasswd_port, + kpasswd_process, false); + if (NT_STATUS_IS_OK(status)) { + num_binds++; + } + } + } + talloc_free(wcard); + if (num_binds == 0) { + return NT_STATUS_INVALID_PARAMETER_MIX; + } + done_wildcard = true; + } + + for (i=0; i<num_interfaces; i++) { + const char *address = talloc_strdup(tmp_ctx, iface_list_n_ip(ifaces, i)); + + if (kdc_port) { + status = kdc_add_socket(kdc, model_ops, + "kdc", address, kdc_port, + kdc_process, done_wildcard); + NT_STATUS_NOT_OK_RETURN(status); + } + + if (kpasswd_port) { + status = kdc_add_socket(kdc, model_ops, + "kpasswd", address, kpasswd_port, + kpasswd_process, done_wildcard); + NT_STATUS_NOT_OK_RETURN(status); + } + } + + talloc_free(tmp_ctx); + + return NT_STATUS_OK; +} + +static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg, + struct kdc_check_generic_kerberos *r) +{ + struct PAC_Validate pac_validate; + DATA_BLOB srv_sig; + struct PAC_SIGNATURE_DATA kdc_sig; + struct kdc_server *kdc = talloc_get_type(msg->private_data, struct kdc_server); + krb5_kdc_configuration *kdc_config = + (krb5_kdc_configuration *)kdc->private_data; + enum ndr_err_code ndr_err; + int ret; + hdb_entry ent; + krb5_principal principal; + + + /* There is no reply to this request */ + r->out.generic_reply = data_blob(NULL, 0); + + ndr_err = ndr_pull_struct_blob(&r->in.generic_request, msg, &pac_validate, + (ndr_pull_flags_fn_t)ndr_pull_PAC_Validate); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + return NT_STATUS_INVALID_PARAMETER; + } + + if (pac_validate.MessageType != NETLOGON_GENERIC_KRB5_PAC_VALIDATE) { + /* We don't implement any other message types - such as certificate validation - yet */ + return NT_STATUS_INVALID_PARAMETER; + } + + if (pac_validate.ChecksumAndSignature.length != (pac_validate.ChecksumLength + pac_validate.SignatureLength) + || pac_validate.ChecksumAndSignature.length < pac_validate.ChecksumLength + || pac_validate.ChecksumAndSignature.length < pac_validate.SignatureLength ) { + return NT_STATUS_INVALID_PARAMETER; + } + + srv_sig = data_blob_const(pac_validate.ChecksumAndSignature.data, + pac_validate.ChecksumLength); + + ret = krb5_make_principal(kdc->smb_krb5_context->krb5_context, &principal, + lpcfg_realm(kdc->task->lp_ctx), + "krbtgt", lpcfg_realm(kdc->task->lp_ctx), + NULL); + + if (ret != 0) { + return NT_STATUS_NO_MEMORY; + } + + ret = kdc_config->db[0]->hdb_fetch_kvno(kdc->smb_krb5_context->krb5_context, + kdc_config->db[0], + principal, + HDB_F_GET_KRBTGT | HDB_F_DECRYPT, + 0, + &ent); + + if (ret != 0) { + hdb_free_entry(kdc->smb_krb5_context->krb5_context, kdc_config->db[0], &ent); + krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal); + + return NT_STATUS_LOGON_FAILURE; + } + + kdc_sig.type = pac_validate.SignatureType; + kdc_sig.signature = data_blob_const(&pac_validate.ChecksumAndSignature.data[pac_validate.ChecksumLength], + pac_validate.SignatureLength); + + ret = kdc_check_pac(kdc->smb_krb5_context->krb5_context, srv_sig, &kdc_sig, &ent); + + hdb_free_entry(kdc->smb_krb5_context->krb5_context, kdc_config->db[0], &ent); + krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal); + + if (ret != 0) { + return NT_STATUS_LOGON_FAILURE; + } + + return NT_STATUS_OK; +} + + +/* + startup the kdc task +*/ +static NTSTATUS kdc_task_init(struct task_server *task) +{ + struct kdc_server *kdc; + NTSTATUS status; + struct interface *ifaces; + + switch (lpcfg_server_role(task->lp_ctx)) { + case ROLE_STANDALONE: + task_server_terminate(task, "kdc: no KDC required in standalone configuration", false); + return NT_STATUS_INVALID_DOMAIN_ROLE; + case ROLE_DOMAIN_MEMBER: + task_server_terminate(task, "kdc: no KDC required in member server configuration", false); + return NT_STATUS_INVALID_DOMAIN_ROLE; + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: + case ROLE_IPA_DC: + task_server_terminate( + task, "Cannot start KDC as a 'classic Samba' DC", false); + return NT_STATUS_INVALID_DOMAIN_ROLE; + case ROLE_ACTIVE_DIRECTORY_DC: + /* Yes, we want a KDC */ + break; + } + + load_interface_list(task, task->lp_ctx, &ifaces); + + if (iface_list_count(ifaces) == 0) { + task_server_terminate(task, "kdc: no network interfaces configured", false); + return NT_STATUS_UNSUCCESSFUL; + } + + task_server_set_title(task, "task[kdc]"); + + kdc = talloc_zero(task, struct kdc_server); + if (kdc == NULL) { + task_server_terminate(task, "kdc: out of memory", true); + return NT_STATUS_NO_MEMORY; + } + + kdc->task = task; + task->private_data = kdc; + + /* start listening on the configured network interfaces */ + status = kdc_startup_interfaces(kdc, task->lp_ctx, ifaces, + task->model_ops); + if (!NT_STATUS_IS_OK(status)) { + task_server_terminate(task, "kdc failed to setup interfaces", true); + return status; + } + + + return NT_STATUS_OK; +} + +/* + initialise the kdc task after a fork +*/ +static void kdc_post_fork(struct task_server *task, struct process_details *pd) +{ + struct kdc_server *kdc; + krb5_kdc_configuration *kdc_config = NULL; + NTSTATUS status; + krb5_error_code ret; + int ldb_ret; + + if (task == NULL) { + task_server_terminate(task, "kdc: Null task", true); + return; + } + if (task->private_data == NULL) { + task_server_terminate(task, "kdc: No kdc_server info", true); + return; + } + kdc = talloc_get_type_abort(task->private_data, struct kdc_server); + + /* get a samdb connection */ + kdc->samdb = samdb_connect(kdc, + kdc->task->event_ctx, + kdc->task->lp_ctx, + system_session(kdc->task->lp_ctx), + NULL, + 0); + if (!kdc->samdb) { + DBG_WARNING("kdc_task_init: unable to connect to samdb\n"); + task_server_terminate(task, "kdc: krb5_init_context samdb connect failed", true); + return; + } + + ldb_ret = samdb_rodc(kdc->samdb, &kdc->am_rodc); + if (ldb_ret != LDB_SUCCESS) { + DBG_WARNING("kdc_task_init: " + "Cannot determine if we are an RODC: %s\n", + ldb_errstring(kdc->samdb)); + task_server_terminate(task, "kdc: krb5_init_context samdb RODC connect failed", true); + return; + } + + kdc->proxy_timeout = lpcfg_parm_int(kdc->task->lp_ctx, NULL, "kdc", "proxy timeout", 5); + + initialize_krb5_error_table(); + + ret = smb_krb5_init_context(kdc, task->lp_ctx, &kdc->smb_krb5_context); + if (ret) { + DBG_WARNING("kdc_task_init: krb5_init_context failed (%s)\n", + error_message(ret)); + task_server_terminate(task, "kdc: krb5_init_context failed", true); + return; + } + + krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r); + + ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context, + &kdc_config); + if(ret) { + task_server_terminate(task, "kdc: failed to get KDC configuration", true); + return; + } + + kdc_config->logf = (krb5_log_facility *)kdc->smb_krb5_context->pvt_log_data; + kdc_config->db = talloc(kdc, struct HDB *); + if (!kdc_config->db) { + task_server_terminate(task, "kdc: out of memory", true); + return; + } + kdc_config->num_db = 1; + + /* + * Note with the CVE-2022-37966 patches, + * see https://bugzilla.samba.org/show_bug.cgi?id=15219 + * and https://bugzilla.samba.org/show_bug.cgi?id=15237 + * we want to use the strongest keys for everything. + * + * Some of these don't have any real effect anymore, + * but it is better to have them as true... + */ + kdc_config->tgt_use_strongest_session_key = true; + kdc_config->preauth_use_strongest_session_key = true; + kdc_config->svc_use_strongest_session_key = true; + kdc_config->use_strongest_server_key = true; + + kdc_config->force_include_pa_etype_salt = true; + + /* + * For Samba CVE-2020-25719 Require PAC to be present + * This instructs Heimdal to match AD behaviour, + * as seen after Microsoft's CVE-2021-42287 when + * PacRequestorEnforcement is set to 2. + * + * Samba BUG: https://bugzilla.samba.org/show_bug.cgi?id=14686 + * REF: https://support.microsoft.com/en-au/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041 + */ + + kdc_config->require_pac = true; + + /* + * By default we enable RFC6113/FAST support, + * but we have an option to disable in order to + * test against a KDC with FAST support. + */ + kdc_config->enable_fast = lpcfg_kdc_enable_fast(task->lp_ctx); + + /* + * Match Windows and RFC6113 and Windows but break older + * Heimdal clients. + */ + kdc_config->enable_armored_pa_enc_timestamp = false; + + /* Register hdb-samba4 hooks for use as a keytab */ + + kdc->base_ctx = talloc_zero(kdc, struct samba_kdc_base_context); + if (!kdc->base_ctx) { + task_server_terminate(task, "kdc: out of memory", true); + return; + } + + kdc->base_ctx->ev_ctx = task->event_ctx; + kdc->base_ctx->lp_ctx = task->lp_ctx; + kdc->base_ctx->msg_ctx = task->msg_ctx; + + status = hdb_samba4_create_kdc(kdc->base_ctx, + kdc->smb_krb5_context->krb5_context, + &kdc_config->db[0]); + if (!NT_STATUS_IS_OK(status)) { + task_server_terminate(task, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true); + return; + } + + ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context, + PLUGIN_TYPE_DATA, "hdb_samba4_interface", + &hdb_samba4_interface); + if(ret) { + task_server_terminate(task, "kdc: failed to register hdb plugin", true); + return; + } + + kdc->kpasswd_keytab_name = talloc_asprintf(kdc, "HDBGET:samba4:&%p", kdc->base_ctx); + if (kdc->kpasswd_keytab_name == NULL) { + task_server_terminate(task, + "kdc: Failed to set keytab name", + true); + return; + } + + ret = krb5_kt_register(kdc->smb_krb5_context->krb5_context, &hdb_get_kt_ops); + if(ret) { + task_server_terminate(task, "kdc: failed to register keytab plugin", true); + return; + } + + /* Register KDC hooks */ + ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context, + PLUGIN_TYPE_DATA, "kdc", + &kdc_plugin_table); + if(ret) { + task_server_terminate(task, "kdc: failed to register kdc plugin", true); + return; + } + + ret = krb5_kdc_plugin_init(kdc->smb_krb5_context->krb5_context); + + if(ret) { + task_server_terminate(task, "kdc: failed to init kdc plugin", true); + return; + } + + ret = krb5_kdc_pkinit_config(kdc->smb_krb5_context->krb5_context, kdc_config); + + if(ret) { + task_server_terminate(task, "kdc: failed to init kdc pkinit subsystem", true); + return; + } + kdc->private_data = kdc_config; + + status = IRPC_REGISTER(task->msg_ctx, irpc, KDC_CHECK_GENERIC_KERBEROS, + kdc_check_generic_kerberos, kdc); + if (!NT_STATUS_IS_OK(status)) { + task_server_terminate(task, "kdc failed to setup monitoring", true); + return; + } + + irpc_add_name(task->msg_ctx, "kdc_server"); +} + + +/* called at smbd startup - register ourselves as a server service */ +NTSTATUS server_service_kdc_init(TALLOC_CTX *ctx) +{ + static const struct service_details details = { + .inhibit_fork_on_accept = true, + .inhibit_pre_fork = false, + .task_init = kdc_task_init, + .post_fork = kdc_post_fork + }; + return register_server_service(ctx, "kdc", &details); +} diff --git a/source4/kdc/kdc-proxy.c b/source4/kdc/kdc-proxy.c new file mode 100644 index 0000000..64160b3 --- /dev/null +++ b/source4/kdc/kdc-proxy.c @@ -0,0 +1,594 @@ +/* + Unix SMB/CIFS implementation. + + KDC Server request proxying + + Copyright (C) Andrew Tridgell 2010 + Copyright (C) Andrew Bartlett 2010 + Copyright (C) Stefan Metzmacher 2011 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "samba/process_model.h" +#include "lib/tsocket/tsocket.h" +#include "libcli/util/tstream.h" +#include "lib/util/tevent_ntstatus.h" +#include "lib/stream/packet.h" +#include "kdc/kdc-server.h" +#include "kdc/kdc-proxy.h" +#include "dsdb/samdb/samdb.h" +#include "libcli/composite/composite.h" +#include "libcli/resolve/resolve.h" + + +/* + get a list of our replication partners from repsFrom, returning it in *proxy_list + */ +static WERROR kdc_proxy_get_writeable_dcs(struct kdc_server *kdc, TALLOC_CTX *mem_ctx, char ***proxy_list) +{ + WERROR werr; + uint32_t count, i; + struct repsFromToBlob *reps; + + werr = dsdb_loadreps(kdc->samdb, mem_ctx, ldb_get_default_basedn(kdc->samdb), "repsFrom", &reps, &count); + W_ERROR_NOT_OK_RETURN(werr); + + if (count == 0) { + /* we don't have any DCs to replicate with. Very + strange for a RODC */ + DEBUG(1,(__location__ ": No replication sources for RODC in KDC proxy\n")); + talloc_free(reps); + return WERR_DS_DRA_NO_REPLICA; + } + + (*proxy_list) = talloc_array(mem_ctx, char *, count+1); + W_ERROR_HAVE_NO_MEMORY_AND_FREE(*proxy_list, reps); + + talloc_steal(*proxy_list, reps); + + for (i=0; i<count; i++) { + const char *dns_name = NULL; + if (reps->version == 1) { + dns_name = reps->ctr.ctr1.other_info->dns_name; + } else if (reps->version == 2) { + dns_name = reps->ctr.ctr2.other_info->dns_name1; + } + (*proxy_list)[i] = talloc_strdup(*proxy_list, dns_name); + W_ERROR_HAVE_NO_MEMORY_AND_FREE((*proxy_list)[i], *proxy_list); + } + (*proxy_list)[i] = NULL; + + talloc_free(reps); + + return WERR_OK; +} + + +struct kdc_udp_proxy_state { + struct tevent_context *ev; + struct kdc_server *kdc; + uint16_t port; + DATA_BLOB in; + DATA_BLOB out; + char **proxy_list; + uint32_t next_proxy; + struct { + struct nbt_name name; + const char *ip; + struct tdgram_context *dgram; + } proxy; +}; + + +static void kdc_udp_next_proxy(struct tevent_req *req); + +struct tevent_req *kdc_udp_proxy_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct kdc_server *kdc, + uint16_t port, + DATA_BLOB in) +{ + struct tevent_req *req; + struct kdc_udp_proxy_state *state; + WERROR werr; + + req = tevent_req_create(mem_ctx, &state, + struct kdc_udp_proxy_state); + if (req == NULL) { + return NULL; + } + state->ev = ev; + state->kdc = kdc; + state->port = port; + state->in = in; + + werr = kdc_proxy_get_writeable_dcs(kdc, state, &state->proxy_list); + if (!W_ERROR_IS_OK(werr)) { + NTSTATUS status = werror_to_ntstatus(werr); + tevent_req_nterror(req, status); + return tevent_req_post(req, ev); + } + + kdc_udp_next_proxy(req); + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); + } + + return req; +} + +static void kdc_udp_proxy_resolve_done(struct composite_context *csubreq); + +/* + try the next proxy in the list + */ +static void kdc_udp_next_proxy(struct tevent_req *req) +{ + struct kdc_udp_proxy_state *state = + tevent_req_data(req, + struct kdc_udp_proxy_state); + const char *proxy_dnsname = state->proxy_list[state->next_proxy]; + struct composite_context *csubreq; + + if (proxy_dnsname == NULL) { + tevent_req_nterror(req, NT_STATUS_NO_LOGON_SERVERS); + return; + } + + state->next_proxy++; + + /* make sure we close the socket of the last try */ + TALLOC_FREE(state->proxy.dgram); + ZERO_STRUCT(state->proxy); + + make_nbt_name(&state->proxy.name, proxy_dnsname, 0); + + csubreq = resolve_name_ex_send(lpcfg_resolve_context(state->kdc->task->lp_ctx), + state, + RESOLVE_NAME_FLAG_FORCE_DNS, + 0, + &state->proxy.name, + state->ev); + if (tevent_req_nomem(csubreq, req)) { + return; + } + csubreq->async.fn = kdc_udp_proxy_resolve_done; + csubreq->async.private_data = req; +} + +static void kdc_udp_proxy_sendto_done(struct tevent_req *subreq); +static void kdc_udp_proxy_recvfrom_done(struct tevent_req *subreq); + +static void kdc_udp_proxy_resolve_done(struct composite_context *csubreq) +{ + struct tevent_req *req = + talloc_get_type_abort(csubreq->async.private_data, + struct tevent_req); + struct kdc_udp_proxy_state *state = + tevent_req_data(req, + struct kdc_udp_proxy_state); + NTSTATUS status; + struct tevent_req *subreq; + struct tsocket_address *local_addr, *proxy_addr; + int ret; + bool ok; + + status = resolve_name_recv(csubreq, state, &state->proxy.ip); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("Unable to resolve proxy[%s] - %s\n", + state->proxy.name.name, nt_errstr(status))); + kdc_udp_next_proxy(req); + return; + } + + /* get an address for us to use locally */ + ret = tsocket_address_inet_from_strings(state, "ip", NULL, 0, &local_addr); + if (ret != 0) { + kdc_udp_next_proxy(req); + return; + } + + ret = tsocket_address_inet_from_strings(state, "ip", + state->proxy.ip, + state->port, + &proxy_addr); + if (ret != 0) { + kdc_udp_next_proxy(req); + return; + } + + /* create a socket for us to work on */ + ret = tdgram_inet_udp_socket(local_addr, proxy_addr, + state, &state->proxy.dgram); + if (ret != 0) { + kdc_udp_next_proxy(req); + return; + } + + subreq = tdgram_sendto_send(state, + state->ev, + state->proxy.dgram, + state->in.data, + state->in.length, + NULL); + if (tevent_req_nomem(subreq, req)) { + return; + } + tevent_req_set_callback(subreq, kdc_udp_proxy_sendto_done, req); + + /* setup to receive the reply from the proxy */ + subreq = tdgram_recvfrom_send(state, state->ev, state->proxy.dgram); + if (tevent_req_nomem(subreq, req)) { + return; + } + tevent_req_set_callback(subreq, kdc_udp_proxy_recvfrom_done, req); + + ok = tevent_req_set_endtime( + subreq, + state->ev, + timeval_current_ofs(state->kdc->proxy_timeout, 0)); + if (!ok) { + DBG_DEBUG("tevent_req_set_endtime failed\n"); + return; + } + + DEBUG(4,("kdc_udp_proxy: proxying request to %s[%s]\n", + state->proxy.name.name, state->proxy.ip)); +} + +/* + called when the send of the call to the proxy is complete + this is used to get an errors from the sendto() + */ +static void kdc_udp_proxy_sendto_done(struct tevent_req *subreq) +{ + struct tevent_req *req = + tevent_req_callback_data(subreq, + struct tevent_req); + struct kdc_udp_proxy_state *state = + tevent_req_data(req, + struct kdc_udp_proxy_state); + ssize_t ret; + int sys_errno; + + ret = tdgram_sendto_recv(subreq, &sys_errno); + TALLOC_FREE(subreq); + if (ret == -1) { + DEBUG(4,("kdc_udp_proxy: sendto for %s[%s] gave %d : %s\n", + state->proxy.name.name, state->proxy.ip, + sys_errno, strerror(sys_errno))); + kdc_udp_next_proxy(req); + } +} + +/* + called when the proxy replies + */ +static void kdc_udp_proxy_recvfrom_done(struct tevent_req *subreq) +{ + struct tevent_req *req = + tevent_req_callback_data(subreq, + struct tevent_req); + struct kdc_udp_proxy_state *state = + tevent_req_data(req, + struct kdc_udp_proxy_state); + int sys_errno; + uint8_t *buf; + ssize_t len; + + len = tdgram_recvfrom_recv(subreq, &sys_errno, + state, &buf, NULL); + TALLOC_FREE(subreq); + if (len == -1) { + DEBUG(4,("kdc_udp_proxy: reply from %s[%s] gave %d : %s\n", + state->proxy.name.name, state->proxy.ip, + sys_errno, strerror(sys_errno))); + kdc_udp_next_proxy(req); + return; + } + + /* + * Check the reply came from the right IP? + * As we use connected udp sockets, that should not be needed... + */ + + state->out.length = len; + state->out.data = buf; + + tevent_req_done(req); +} + +NTSTATUS kdc_udp_proxy_recv(struct tevent_req *req, + TALLOC_CTX *mem_ctx, + DATA_BLOB *out) +{ + struct kdc_udp_proxy_state *state = + tevent_req_data(req, + struct kdc_udp_proxy_state); + NTSTATUS status; + + if (tevent_req_is_nterror(req, &status)) { + tevent_req_received(req); + return status; + } + + out->data = talloc_move(mem_ctx, &state->out.data); + out->length = state->out.length; + + tevent_req_received(req); + return NT_STATUS_OK; +} + +struct kdc_tcp_proxy_state { + struct tevent_context *ev; + struct kdc_server *kdc; + uint16_t port; + DATA_BLOB in; + uint8_t in_hdr[4]; + struct iovec in_iov[2]; + DATA_BLOB out; + char **proxy_list; + uint32_t next_proxy; + struct { + struct nbt_name name; + const char *ip; + struct tstream_context *stream; + } proxy; +}; + +static void kdc_tcp_next_proxy(struct tevent_req *req); + +struct tevent_req *kdc_tcp_proxy_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct kdc_server *kdc, + uint16_t port, + DATA_BLOB in) +{ + struct tevent_req *req; + struct kdc_tcp_proxy_state *state; + WERROR werr; + + req = tevent_req_create(mem_ctx, &state, + struct kdc_tcp_proxy_state); + if (req == NULL) { + return NULL; + } + state->ev = ev; + state->kdc = kdc; + state->port = port; + state->in = in; + + werr = kdc_proxy_get_writeable_dcs(kdc, state, &state->proxy_list); + if (!W_ERROR_IS_OK(werr)) { + NTSTATUS status = werror_to_ntstatus(werr); + tevent_req_nterror(req, status); + return tevent_req_post(req, ev); + } + + RSIVAL(state->in_hdr, 0, state->in.length); + state->in_iov[0].iov_base = (char *)state->in_hdr; + state->in_iov[0].iov_len = 4; + state->in_iov[1].iov_base = (char *)state->in.data; + state->in_iov[1].iov_len = state->in.length; + + kdc_tcp_next_proxy(req); + if (!tevent_req_is_in_progress(req)) { + return tevent_req_post(req, ev); + } + + return req; +} + +static void kdc_tcp_proxy_resolve_done(struct composite_context *csubreq); + +/* + try the next proxy in the list + */ +static void kdc_tcp_next_proxy(struct tevent_req *req) +{ + struct kdc_tcp_proxy_state *state = + tevent_req_data(req, + struct kdc_tcp_proxy_state); + const char *proxy_dnsname = state->proxy_list[state->next_proxy]; + struct composite_context *csubreq; + + if (proxy_dnsname == NULL) { + tevent_req_nterror(req, NT_STATUS_NO_LOGON_SERVERS); + return; + } + + state->next_proxy++; + + /* make sure we close the socket of the last try */ + TALLOC_FREE(state->proxy.stream); + ZERO_STRUCT(state->proxy); + + make_nbt_name(&state->proxy.name, proxy_dnsname, 0); + + csubreq = resolve_name_ex_send(lpcfg_resolve_context(state->kdc->task->lp_ctx), + state, + RESOLVE_NAME_FLAG_FORCE_DNS, + 0, + &state->proxy.name, + state->ev); + if (tevent_req_nomem(csubreq, req)) { + return; + } + csubreq->async.fn = kdc_tcp_proxy_resolve_done; + csubreq->async.private_data = req; +} + +static void kdc_tcp_proxy_connect_done(struct tevent_req *subreq); + +static void kdc_tcp_proxy_resolve_done(struct composite_context *csubreq) +{ + struct tevent_req *req = + talloc_get_type_abort(csubreq->async.private_data, + struct tevent_req); + struct kdc_tcp_proxy_state *state = + tevent_req_data(req, + struct kdc_tcp_proxy_state); + NTSTATUS status; + struct tevent_req *subreq; + struct tsocket_address *local_addr, *proxy_addr; + int ret; + + status = resolve_name_recv(csubreq, state, &state->proxy.ip); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("Unable to resolve proxy[%s] - %s\n", + state->proxy.name.name, nt_errstr(status))); + kdc_tcp_next_proxy(req); + return; + } + + /* get an address for us to use locally */ + ret = tsocket_address_inet_from_strings(state, "ip", NULL, 0, &local_addr); + if (ret != 0) { + kdc_tcp_next_proxy(req); + return; + } + + ret = tsocket_address_inet_from_strings(state, "ip", + state->proxy.ip, + state->port, + &proxy_addr); + if (ret != 0) { + kdc_tcp_next_proxy(req); + return; + } + + subreq = tstream_inet_tcp_connect_send(state, state->ev, + local_addr, proxy_addr); + if (tevent_req_nomem(subreq, req)) { + return; + } + tevent_req_set_callback(subreq, kdc_tcp_proxy_connect_done, req); + tevent_req_set_endtime(subreq, state->ev, + timeval_current_ofs(state->kdc->proxy_timeout, 0)); +} + +static void kdc_tcp_proxy_writev_done(struct tevent_req *subreq); +static void kdc_tcp_proxy_read_pdu_done(struct tevent_req *subreq); + +static void kdc_tcp_proxy_connect_done(struct tevent_req *subreq) +{ + struct tevent_req *req = + tevent_req_callback_data(subreq, + struct tevent_req); + struct kdc_tcp_proxy_state *state = + tevent_req_data(req, + struct kdc_tcp_proxy_state); + int ret, sys_errno; + + ret = tstream_inet_tcp_connect_recv(subreq, &sys_errno, + state, &state->proxy.stream, NULL); + TALLOC_FREE(subreq); + if (ret != 0) { + kdc_tcp_next_proxy(req); + return; + } + + subreq = tstream_writev_send(state, + state->ev, + state->proxy.stream, + state->in_iov, 2); + if (tevent_req_nomem(subreq, req)) { + return; + } + tevent_req_set_callback(subreq, kdc_tcp_proxy_writev_done, req); + + subreq = tstream_read_pdu_blob_send(state, + state->ev, + state->proxy.stream, + 4, /* initial_read_size */ + packet_full_request_u32, + req); + if (tevent_req_nomem(subreq, req)) { + return; + } + tevent_req_set_callback(subreq, kdc_tcp_proxy_read_pdu_done, req); + tevent_req_set_endtime(subreq, state->kdc->task->event_ctx, + timeval_current_ofs(state->kdc->proxy_timeout, 0)); + + DEBUG(4,("kdc_tcp_proxy: proxying request to %s[%s]\n", + state->proxy.name.name, state->proxy.ip)); +} + +static void kdc_tcp_proxy_writev_done(struct tevent_req *subreq) +{ + struct tevent_req *req = + tevent_req_callback_data(subreq, + struct tevent_req); + int ret, sys_errno; + + ret = tstream_writev_recv(subreq, &sys_errno); + TALLOC_FREE(subreq); + if (ret == -1) { + kdc_tcp_next_proxy(req); + } +} + +static void kdc_tcp_proxy_read_pdu_done(struct tevent_req *subreq) +{ + struct tevent_req *req = + tevent_req_callback_data(subreq, + struct tevent_req); + struct kdc_tcp_proxy_state *state = + tevent_req_data(req, + struct kdc_tcp_proxy_state); + NTSTATUS status; + DATA_BLOB raw; + + status = tstream_read_pdu_blob_recv(subreq, state, &raw); + TALLOC_FREE(subreq); + if (!NT_STATUS_IS_OK(status)) { + kdc_tcp_next_proxy(req); + return; + } + + /* + * raw blob has the length in the first 4 bytes, + * which we do not need here. + */ + state->out = data_blob_talloc(state, raw.data + 4, raw.length - 4); + if (state->out.length != raw.length - 4) { + tevent_req_oom(req); + return; + } + + tevent_req_done(req); +} + +NTSTATUS kdc_tcp_proxy_recv(struct tevent_req *req, + TALLOC_CTX *mem_ctx, + DATA_BLOB *out) +{ + struct kdc_tcp_proxy_state *state = + tevent_req_data(req, + struct kdc_tcp_proxy_state); + NTSTATUS status; + + if (tevent_req_is_nterror(req, &status)) { + tevent_req_received(req); + return status; + } + + out->data = talloc_move(mem_ctx, &state->out.data); + out->length = state->out.length; + + tevent_req_received(req); + return NT_STATUS_OK; +} diff --git a/source4/kdc/kdc-proxy.h b/source4/kdc/kdc-proxy.h new file mode 100644 index 0000000..1ebe8da --- /dev/null +++ b/source4/kdc/kdc-proxy.h @@ -0,0 +1,45 @@ +/* + Unix SMB/CIFS implementation. + + KDC related functions + + Copyright (c) 2005-2008 Andrew Bartlett <abartlet@samba.org> + Copyright (c) 2005 Andrew Tridgell <tridge@samba.org> + Copyright (c) 2005 Stefan Metzmacher <metze@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _KDC_PROXY_H +#define _KDC_PROXY_H + +struct tevent_req *kdc_udp_proxy_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct kdc_server *kdc, + uint16_t port, + DATA_BLOB in); +NTSTATUS kdc_udp_proxy_recv(struct tevent_req *req, + TALLOC_CTX *mem_ctx, + DATA_BLOB *out); + +struct tevent_req *kdc_tcp_proxy_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct kdc_server *kdc, + uint16_t port, + DATA_BLOB in); +NTSTATUS kdc_tcp_proxy_recv(struct tevent_req *req, + TALLOC_CTX *mem_ctx, + DATA_BLOB *out); + +#endif /* _KDC_PROXY_H */ diff --git a/source4/kdc/kdc-server.c b/source4/kdc/kdc-server.c new file mode 100644 index 0000000..de0ae8d --- /dev/null +++ b/source4/kdc/kdc-server.c @@ -0,0 +1,618 @@ +/* + Unix SMB/CIFS implementation. + + KDC related functions + + Copyright (c) 2005-2008 Andrew Bartlett <abartlet@samba.org> + Copyright (c) 2005 Andrew Tridgell <tridge@samba.org> + Copyright (c) 2005 Stefan Metzmacher <metze@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "param/param.h" +#include "samba/process_model.h" +#include "lib/tsocket/tsocket.h" +#include "libcli/util/tstream.h" +#include "kdc/kdc-server.h" +#include "kdc/kdc-proxy.h" +#include "lib/stream/packet.h" + +/* + * State of an open tcp connection + */ +struct kdc_tcp_connection { + /* stream connection we belong to */ + struct stream_connection *conn; + + /* the kdc_server the connection belongs to */ + struct kdc_socket *kdc_socket; + + struct tstream_context *tstream; + + struct tevent_queue *send_queue; +}; + +struct kdc_tcp_call { + struct kdc_tcp_connection *kdc_conn; + DATA_BLOB in; + DATA_BLOB out; + uint8_t out_hdr[4]; + struct iovec out_iov[2]; +}; + +struct kdc_udp_call { + struct kdc_udp_socket *sock; + struct tsocket_address *src; + DATA_BLOB in; + DATA_BLOB out; +}; + +static void kdc_udp_call_proxy_done(struct tevent_req *subreq); +static void kdc_udp_call_sendto_done(struct tevent_req *subreq); + +static void kdc_tcp_call_writev_done(struct tevent_req *subreq); +static void kdc_tcp_call_proxy_done(struct tevent_req *subreq); + +static void kdc_tcp_terminate_connection(struct kdc_tcp_connection *kdc_conn, + const char *reason) +{ + stream_terminate_connection(kdc_conn->conn, reason); +} + +static NTSTATUS kdc_proxy_unavailable_error(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + DATA_BLOB *out) +{ + krb5_error_code code; + krb5_data enc_error; + + code = smb_krb5_mk_error(kdc->smb_krb5_context->krb5_context, + KRB5KDC_ERR_SVC_UNAVAILABLE, + NULL, + NULL, + NULL, + NULL, + &enc_error); + if (code != 0) { + DBG_WARNING("Unable to form krb5 error reply\n"); + return NT_STATUS_INTERNAL_ERROR; + } + + *out = data_blob_talloc(mem_ctx, enc_error.data, enc_error.length); + smb_krb5_free_data_contents(kdc->smb_krb5_context->krb5_context, + &enc_error); + if (!out->data) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +static void kdc_udp_call_loop(struct tevent_req *subreq) +{ + struct kdc_udp_socket *sock = tevent_req_callback_data(subreq, + struct kdc_udp_socket); + struct kdc_udp_call *call; + uint8_t *buf; + ssize_t len; + int sys_errno; + kdc_code ret; + + call = talloc(sock, struct kdc_udp_call); + if (call == NULL) { + talloc_free(call); + goto done; + } + call->sock = sock; + + len = tdgram_recvfrom_recv(subreq, &sys_errno, + call, &buf, &call->src); + TALLOC_FREE(subreq); + if (len == -1) { + talloc_free(call); + goto done; + } + + call->in.data = buf; + call->in.length = len; + + DEBUG(10,("Received krb5 UDP packet of length %lu from %s\n", + (long)call->in.length, + tsocket_address_string(call->src, call))); + + /* Call krb5 */ + ret = sock->kdc_socket->process(sock->kdc_socket->kdc, + call, + &call->in, + &call->out, + call->src, + sock->kdc_socket->local_address, + 1 /* Datagram */); + if (ret == KDC_ERROR) { + talloc_free(call); + goto done; + } + + if (ret == KDC_PROXY_REQUEST) { + uint16_t port; + + if (!sock->kdc_socket->kdc->am_rodc) { + DEBUG(0,("kdc_udp_call_loop: proxying requested when not RODC")); + talloc_free(call); + goto done; + } + + port = tsocket_address_inet_port(sock->kdc_socket->local_address); + + subreq = kdc_udp_proxy_send(call, + sock->kdc_socket->kdc->task->event_ctx, + sock->kdc_socket->kdc, + port, + call->in); + if (subreq == NULL) { + talloc_free(call); + goto done; + } + tevent_req_set_callback(subreq, kdc_udp_call_proxy_done, call); + goto done; + } + + subreq = tdgram_sendto_queue_send(call, + sock->kdc_socket->kdc->task->event_ctx, + sock->dgram, + sock->send_queue, + call->out.data, + call->out.length, + call->src); + if (subreq == NULL) { + talloc_free(call); + goto done; + } + tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call); + +done: + subreq = tdgram_recvfrom_send(sock, + sock->kdc_socket->kdc->task->event_ctx, + sock->dgram); + if (subreq == NULL) { + task_server_terminate(sock->kdc_socket->kdc->task, + "no memory for tdgram_recvfrom_send", + true); + return; + } + tevent_req_set_callback(subreq, kdc_udp_call_loop, sock); +} + +static void kdc_udp_call_proxy_done(struct tevent_req *subreq) +{ + struct kdc_udp_call *call = + tevent_req_callback_data(subreq, + struct kdc_udp_call); + NTSTATUS status; + + status = kdc_udp_proxy_recv(subreq, call, &call->out); + TALLOC_FREE(subreq); + if (!NT_STATUS_IS_OK(status)) { + /* generate an error packet */ + status = kdc_proxy_unavailable_error(call->sock->kdc_socket->kdc, + call, &call->out); + } + + if (!NT_STATUS_IS_OK(status)) { + talloc_free(call); + return; + } + + subreq = tdgram_sendto_queue_send(call, + call->sock->kdc_socket->kdc->task->event_ctx, + call->sock->dgram, + call->sock->send_queue, + call->out.data, + call->out.length, + call->src); + if (subreq == NULL) { + talloc_free(call); + return; + } + + tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call); +} + +static void kdc_udp_call_sendto_done(struct tevent_req *subreq) +{ + struct kdc_udp_call *call = tevent_req_callback_data(subreq, + struct kdc_udp_call); + int sys_errno; + + tdgram_sendto_queue_recv(subreq, &sys_errno); + + /* We don't care about errors */ + + talloc_free(call); +} + +static void kdc_tcp_call_loop(struct tevent_req *subreq) +{ + struct kdc_tcp_connection *kdc_conn = tevent_req_callback_data(subreq, + struct kdc_tcp_connection); + struct kdc_tcp_call *call; + NTSTATUS status; + kdc_code ret; + + call = talloc(kdc_conn, struct kdc_tcp_call); + if (call == NULL) { + kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: " + "no memory for kdc_tcp_call"); + return; + } + call->kdc_conn = kdc_conn; + + status = tstream_read_pdu_blob_recv(subreq, + call, + &call->in); + TALLOC_FREE(subreq); + if (!NT_STATUS_IS_OK(status)) { + const char *reason; + + reason = talloc_asprintf(call, "kdc_tcp_call_loop: " + "tstream_read_pdu_blob_recv() - %s", + nt_errstr(status)); + if (!reason) { + reason = nt_errstr(status); + } + + kdc_tcp_terminate_connection(kdc_conn, reason); + return; + } + + DEBUG(10,("Received krb5 TCP packet of length %lu from %s\n", + (long) call->in.length, + tsocket_address_string(kdc_conn->conn->remote_address, call))); + + /* skip length header */ + call->in.data +=4; + call->in.length -= 4; + + /* Call krb5 */ + ret = kdc_conn->kdc_socket->process(kdc_conn->kdc_socket->kdc, + call, + &call->in, + &call->out, + kdc_conn->conn->remote_address, + kdc_conn->conn->local_address, + 0 /* Stream */); + if (ret == KDC_ERROR) { + kdc_tcp_terminate_connection(kdc_conn, + "kdc_tcp_call_loop: process function failed"); + return; + } + + if (ret == KDC_PROXY_REQUEST) { + uint16_t port; + + if (!kdc_conn->kdc_socket->kdc->am_rodc) { + kdc_tcp_terminate_connection(kdc_conn, + "kdc_tcp_call_loop: proxying requested when not RODC"); + return; + } + port = tsocket_address_inet_port(kdc_conn->conn->local_address); + + subreq = kdc_tcp_proxy_send(call, + kdc_conn->conn->event.ctx, + kdc_conn->kdc_socket->kdc, + port, + call->in); + if (subreq == NULL) { + kdc_tcp_terminate_connection(kdc_conn, + "kdc_tcp_call_loop: kdc_tcp_proxy_send failed"); + return; + } + tevent_req_set_callback(subreq, kdc_tcp_call_proxy_done, call); + return; + } + + /* First add the length of the out buffer */ + RSIVAL(call->out_hdr, 0, call->out.length); + call->out_iov[0].iov_base = (char *) call->out_hdr; + call->out_iov[0].iov_len = 4; + + call->out_iov[1].iov_base = (char *) call->out.data; + call->out_iov[1].iov_len = call->out.length; + + subreq = tstream_writev_queue_send(call, + kdc_conn->conn->event.ctx, + kdc_conn->tstream, + kdc_conn->send_queue, + call->out_iov, 2); + if (subreq == NULL) { + kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: " + "no memory for tstream_writev_queue_send"); + return; + } + tevent_req_set_callback(subreq, kdc_tcp_call_writev_done, call); + + /* + * The krb5 tcp pdu's has the length as 4 byte (initial_read_size), + * packet_full_request_u32 provides the pdu length then. + */ + subreq = tstream_read_pdu_blob_send(kdc_conn, + kdc_conn->conn->event.ctx, + kdc_conn->tstream, + 4, /* initial_read_size */ + packet_full_request_u32, + kdc_conn); + if (subreq == NULL) { + kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: " + "no memory for tstream_read_pdu_blob_send"); + return; + } + tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn); +} + +static void kdc_tcp_call_proxy_done(struct tevent_req *subreq) +{ + struct kdc_tcp_call *call = tevent_req_callback_data(subreq, + struct kdc_tcp_call); + struct kdc_tcp_connection *kdc_conn = call->kdc_conn; + NTSTATUS status; + + status = kdc_tcp_proxy_recv(subreq, call, &call->out); + TALLOC_FREE(subreq); + if (!NT_STATUS_IS_OK(status)) { + /* generate an error packet */ + status = kdc_proxy_unavailable_error(kdc_conn->kdc_socket->kdc, + call, &call->out); + } + + if (!NT_STATUS_IS_OK(status)) { + const char *reason; + + reason = talloc_asprintf(call, "kdc_tcp_call_proxy_done: " + "kdc_proxy_unavailable_error - %s", + nt_errstr(status)); + if (!reason) { + reason = "kdc_tcp_call_proxy_done: kdc_proxy_unavailable_error() failed"; + } + + kdc_tcp_terminate_connection(call->kdc_conn, reason); + return; + } + + /* First add the length of the out buffer */ + RSIVAL(call->out_hdr, 0, call->out.length); + call->out_iov[0].iov_base = (char *) call->out_hdr; + call->out_iov[0].iov_len = 4; + + call->out_iov[1].iov_base = (char *) call->out.data; + call->out_iov[1].iov_len = call->out.length; + + subreq = tstream_writev_queue_send(call, + kdc_conn->conn->event.ctx, + kdc_conn->tstream, + kdc_conn->send_queue, + call->out_iov, 2); + if (subreq == NULL) { + kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: " + "no memory for tstream_writev_queue_send"); + return; + } + tevent_req_set_callback(subreq, kdc_tcp_call_writev_done, call); + + /* + * The krb5 tcp pdu's has the length as 4 byte (initial_read_size), + * packet_full_request_u32 provides the pdu length then. + */ + subreq = tstream_read_pdu_blob_send(kdc_conn, + kdc_conn->conn->event.ctx, + kdc_conn->tstream, + 4, /* initial_read_size */ + packet_full_request_u32, + kdc_conn); + if (subreq == NULL) { + kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: " + "no memory for tstream_read_pdu_blob_send"); + return; + } + tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn); +} + +static void kdc_tcp_call_writev_done(struct tevent_req *subreq) +{ + struct kdc_tcp_call *call = tevent_req_callback_data(subreq, + struct kdc_tcp_call); + int sys_errno; + int rc; + + rc = tstream_writev_queue_recv(subreq, &sys_errno); + TALLOC_FREE(subreq); + if (rc == -1) { + const char *reason; + + reason = talloc_asprintf(call, "kdc_tcp_call_writev_done: " + "tstream_writev_queue_recv() - %d:%s", + sys_errno, strerror(sys_errno)); + if (!reason) { + reason = "kdc_tcp_call_writev_done: tstream_writev_queue_recv() failed"; + } + + kdc_tcp_terminate_connection(call->kdc_conn, reason); + return; + } + + /* We don't care about errors */ + + talloc_free(call); +} + +/* + called when we get a new connection +*/ +static void kdc_tcp_accept(struct stream_connection *conn) +{ + struct kdc_socket *kdc_socket; + struct kdc_tcp_connection *kdc_conn; + struct tevent_req *subreq; + int rc; + + kdc_conn = talloc_zero(conn, struct kdc_tcp_connection); + if (kdc_conn == NULL) { + stream_terminate_connection(conn, + "kdc_tcp_accept: out of memory"); + return; + } + + kdc_conn->send_queue = tevent_queue_create(conn, "kdc_tcp_accept"); + if (kdc_conn->send_queue == NULL) { + stream_terminate_connection(conn, + "kdc_tcp_accept: out of memory"); + return; + } + + kdc_socket = talloc_get_type(conn->private_data, struct kdc_socket); + + TALLOC_FREE(conn->event.fde); + + rc = tstream_bsd_existing_socket(kdc_conn, + socket_get_fd(conn->socket), + &kdc_conn->tstream); + if (rc < 0) { + stream_terminate_connection(conn, + "kdc_tcp_accept: out of memory"); + return; + } + + kdc_conn->conn = conn; + kdc_conn->kdc_socket = kdc_socket; + conn->private_data = kdc_conn; + + /* + * The krb5 tcp pdu's has the length as 4 byte (initial_read_size), + * packet_full_request_u32 provides the pdu length then. + */ + subreq = tstream_read_pdu_blob_send(kdc_conn, + kdc_conn->conn->event.ctx, + kdc_conn->tstream, + 4, /* initial_read_size */ + packet_full_request_u32, + kdc_conn); + if (subreq == NULL) { + kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_accept: " + "no memory for tstream_read_pdu_blob_send"); + return; + } + tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn); +} + +static void kdc_tcp_recv(struct stream_connection *conn, uint16_t flags) +{ + struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data, + struct kdc_tcp_connection); + /* this should never be triggered! */ + kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_recv: called"); +} + +static void kdc_tcp_send(struct stream_connection *conn, uint16_t flags) +{ + struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data, + struct kdc_tcp_connection); + /* this should never be triggered! */ + kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_send: called"); +} + +static const struct stream_server_ops kdc_tcp_stream_ops = { + .name = "kdc_tcp", + .accept_connection = kdc_tcp_accept, + .recv_handler = kdc_tcp_recv, + .send_handler = kdc_tcp_send +}; + +/* + * Start listening on the given address + */ +NTSTATUS kdc_add_socket(struct kdc_server *kdc, + const struct model_ops *model_ops, + const char *name, + const char *address, + uint16_t port, + kdc_process_fn_t process, + bool udp_only) +{ + struct kdc_socket *kdc_socket; + struct kdc_udp_socket *kdc_udp_socket; + struct tevent_req *udpsubreq; + NTSTATUS status; + int ret; + + kdc_socket = talloc(kdc, struct kdc_socket); + NT_STATUS_HAVE_NO_MEMORY(kdc_socket); + + kdc_socket->kdc = kdc; + kdc_socket->process = process; + + ret = tsocket_address_inet_from_strings(kdc_socket, "ip", + address, port, + &kdc_socket->local_address); + if (ret != 0) { + status = map_nt_error_from_unix_common(errno); + return status; + } + + if (!udp_only) { + status = stream_setup_socket(kdc->task, + kdc->task->event_ctx, + kdc->task->lp_ctx, + model_ops, + &kdc_tcp_stream_ops, + "ip", address, &port, + lpcfg_socket_options(kdc->task->lp_ctx), + kdc_socket, + kdc->task->process_context); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("Failed to bind to %s:%u TCP - %s\n", + address, port, nt_errstr(status))); + talloc_free(kdc_socket); + return status; + } + } + + kdc_udp_socket = talloc(kdc_socket, struct kdc_udp_socket); + NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket); + + kdc_udp_socket->kdc_socket = kdc_socket; + + ret = tdgram_inet_udp_socket(kdc_socket->local_address, + NULL, + kdc_udp_socket, + &kdc_udp_socket->dgram); + if (ret != 0) { + status = map_nt_error_from_unix_common(errno); + DEBUG(0,("Failed to bind to %s:%u UDP - %s\n", + address, port, nt_errstr(status))); + return status; + } + + kdc_udp_socket->send_queue = tevent_queue_create(kdc_udp_socket, + "kdc_udp_send_queue"); + NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket->send_queue); + + udpsubreq = tdgram_recvfrom_send(kdc_udp_socket, + kdc->task->event_ctx, + kdc_udp_socket->dgram); + NT_STATUS_HAVE_NO_MEMORY(udpsubreq); + tevent_req_set_callback(udpsubreq, kdc_udp_call_loop, kdc_udp_socket); + + return NT_STATUS_OK; +} diff --git a/source4/kdc/kdc-server.h b/source4/kdc/kdc-server.h new file mode 100644 index 0000000..89b30f1 --- /dev/null +++ b/source4/kdc/kdc-server.h @@ -0,0 +1,83 @@ +/* + Unix SMB/CIFS implementation. + + KDC related functions + + Copyright (c) 2005-2008 Andrew Bartlett <abartlet@samba.org> + Copyright (c) 2005 Andrew Tridgell <tridge@samba.org> + Copyright (c) 2005 Stefan Metzmacher <metze@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _KDC_SERVER_H +#define _KDC_SERVER_H + +#include "system/kerberos.h" +#include "auth/kerberos/kerberos.h" + +struct tsocket_address; +struct model_ops; + +/* + * Context structure for the kdc server + */ +struct kdc_server { + struct task_server *task; + struct smb_krb5_context *smb_krb5_context; + struct samba_kdc_base_context *base_ctx; + struct ldb_context *samdb; + bool am_rodc; + uint32_t proxy_timeout; + const char *kpasswd_keytab_name; + void *private_data; +}; + +typedef enum kdc_code_e { + KDC_OK = 0, + KDC_ERROR, + KDC_PROXY_REQUEST +} kdc_code; + +typedef kdc_code (*kdc_process_fn_t)(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + DATA_BLOB *request, + DATA_BLOB *reply, + struct tsocket_address *remote_address, + struct tsocket_address *local_address, + int datagram); + +/* Information about one kdc socket */ +struct kdc_socket { + struct kdc_server *kdc; + struct tsocket_address *local_address; + kdc_process_fn_t process; +}; + +/* Information about one kdc/kpasswd udp socket */ +struct kdc_udp_socket { + struct kdc_socket *kdc_socket; + struct tdgram_context *dgram; + struct tevent_queue *send_queue; +}; + +NTSTATUS kdc_add_socket(struct kdc_server *kdc, + const struct model_ops *model_ops, + const char *name, + const char *address, + uint16_t port, + kdc_process_fn_t process, + bool udp_only); + +#endif /* _KDC_SERVER_H */ diff --git a/source4/kdc/kdc-service-mit.c b/source4/kdc/kdc-service-mit.c new file mode 100644 index 0000000..31cfef2 --- /dev/null +++ b/source4/kdc/kdc-service-mit.c @@ -0,0 +1,392 @@ +/* + Unix SMB/CIFS implementation. + + Start MIT krb5kdc server within Samba AD + + Copyright (c) 2014-2016 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "talloc.h" +#include "tevent.h" +#include "system/filesys.h" +#include "lib/param/param.h" +#include "lib/util/samba_util.h" +#include "source4/samba/service.h" +#include "source4/samba/process_model.h" +#include "kdc/kdc-service-mit.h" +#include "dynconfig.h" +#include "libds/common/roles.h" +#include "lib/socket/netif.h" +#include "samba/session.h" +#include "dsdb/samdb/samdb.h" +#include "kdc/samba_kdc.h" +#include "kdc/kdc-server.h" +#include "kdc/kpasswd-service.h" +#include <kadm5/admin.h> +#include <kdb.h> + +#include "source4/kdc/mit_kdc_irpc.h" + +/* PROTOTYPES */ +static void mitkdc_server_done(struct tevent_req *subreq); + +static int kdc_server_destroy(struct kdc_server *kdc) +{ + if (kdc->private_data != NULL) { + kadm5_destroy(kdc->private_data); + } + + return 0; +} + +static NTSTATUS startup_kpasswd_server(TALLOC_CTX *mem_ctx, + struct kdc_server *kdc, + struct loadparm_context *lp_ctx, + struct interface *ifaces) +{ + int num_interfaces; + int i; + TALLOC_CTX *tmp_ctx; + NTSTATUS status = NT_STATUS_UNSUCCESSFUL; + uint16_t kpasswd_port; + bool done_wildcard = false; + bool ok; + + kpasswd_port = lpcfg_kpasswd_port(lp_ctx); + if (kpasswd_port == 0) { + return NT_STATUS_OK; + } + + tmp_ctx = talloc_named_const(mem_ctx, 0, "kpasswd"); + if (tmp_ctx == NULL) { + return NT_STATUS_NO_MEMORY; + } + + num_interfaces = iface_list_count(ifaces); + + ok = lpcfg_bind_interfaces_only(lp_ctx); + if (!ok) { + int num_binds = 0; + char **wcard; + + wcard = iface_list_wildcard(tmp_ctx); + if (wcard == NULL) { + status = NT_STATUS_NO_MEMORY; + goto out; + } + + for (i = 0; wcard[i] != NULL; i++) { + status = kdc_add_socket(kdc, + kdc->task->model_ops, + "kpasswd", + wcard[i], + kpasswd_port, + kpasswd_process, + false); + if (NT_STATUS_IS_OK(status)) { + num_binds++; + } + } + talloc_free(wcard); + + if (num_binds == 0) { + status = NT_STATUS_INVALID_PARAMETER_MIX; + goto out; + } + + done_wildcard = true; + } + + for (i = 0; i < num_interfaces; i++) { + const char *address = talloc_strdup(tmp_ctx, iface_list_n_ip(ifaces, i)); + + status = kdc_add_socket(kdc, + kdc->task->model_ops, + "kpasswd", + address, + kpasswd_port, + kpasswd_process, + done_wildcard); + if (NT_STATUS_IS_OK(status)) { + goto out; + } + } + +out: + talloc_free(tmp_ctx); + return status; +} + +/* + * Startup a copy of the krb5kdc as a child daemon + */ +NTSTATUS mitkdc_task_init(struct task_server *task) +{ + struct tevent_req *subreq; + const char * const *kdc_cmd; + struct interface *ifaces; + char *kdc_config = NULL; + struct kdc_server *kdc; + krb5_error_code code; + NTSTATUS status; + kadm5_ret_t ret; + kadm5_config_params config; + void *server_handle; + int dbglvl = 0; + + task_server_set_title(task, "task[mitkdc_parent]"); + + switch (lpcfg_server_role(task->lp_ctx)) { + case ROLE_STANDALONE: + task_server_terminate(task, + "The KDC is not required in standalone " + "server configuration, terminate!", + false); + return NT_STATUS_INVALID_DOMAIN_ROLE; + case ROLE_DOMAIN_MEMBER: + task_server_terminate(task, + "The KDC is not required in member " + "server configuration", + false); + return NT_STATUS_INVALID_DOMAIN_ROLE; + case ROLE_ACTIVE_DIRECTORY_DC: + /* Yes, we want to start the KDC */ + break; + } + + /* Load interfaces for kpasswd */ + load_interface_list(task, task->lp_ctx, &ifaces); + if (iface_list_count(ifaces) == 0) { + task_server_terminate(task, + "KDC: no network interfaces configured", + false); + return NT_STATUS_UNSUCCESSFUL; + } + + kdc_config = talloc_asprintf(task, + "%s/kdc.conf", + lpcfg_private_dir(task->lp_ctx)); + if (kdc_config == NULL) { + task_server_terminate(task, + "KDC: no memory", + false); + return NT_STATUS_NO_MEMORY; + } + setenv("KRB5_KDC_PROFILE", kdc_config, 0); + TALLOC_FREE(kdc_config); + + dbglvl = debuglevel_get_class(DBGC_KERBEROS); + if (dbglvl >= 10) { + char *kdc_trace_file = talloc_asprintf(task, + "%s/mit_kdc_trace.log", + get_dyn_LOGFILEBASE()); + if (kdc_trace_file == NULL) { + task_server_terminate(task, + "KDC: no memory", + false); + return NT_STATUS_NO_MEMORY; + } + + setenv("KRB5_TRACE", kdc_trace_file, 1); + } + + /* start it as a child process */ + kdc_cmd = lpcfg_mit_kdc_command(task->lp_ctx); + + subreq = samba_runcmd_send(task, + task->event_ctx, + timeval_zero(), + 1, /* stdout log level */ + 0, /* stderr log level */ + kdc_cmd, + "-n", /* Don't go into background */ +#if 0 + "-w 2", /* Start two workers */ +#endif + NULL); + if (subreq == NULL) { + DEBUG(0, ("Failed to start MIT KDC as child daemon\n")); + + task_server_terminate(task, + "Failed to startup mitkdc task", + true); + return NT_STATUS_INTERNAL_ERROR; + } + + tevent_req_set_callback(subreq, mitkdc_server_done, task); + + DEBUG(5,("Started krb5kdc process\n")); + + status = samba_setup_mit_kdc_irpc(task); + if (!NT_STATUS_IS_OK(status)) { + task_server_terminate(task, + "Failed to setup kdc irpc service", + true); + } + + DEBUG(5,("Started irpc service for kdc_server\n")); + + kdc = talloc_zero(task, struct kdc_server); + if (kdc == NULL) { + task_server_terminate(task, "KDC: Out of memory", true); + return NT_STATUS_NO_MEMORY; + } + talloc_set_destructor(kdc, kdc_server_destroy); + + kdc->task = task; + + kdc->base_ctx = talloc_zero(kdc, struct samba_kdc_base_context); + if (kdc->base_ctx == NULL) { + task_server_terminate(task, "KDC: Out of memory", true); + return NT_STATUS_NO_MEMORY; + } + + kdc->base_ctx->ev_ctx = task->event_ctx; + kdc->base_ctx->lp_ctx = task->lp_ctx; + + initialize_krb5_error_table(); + + code = smb_krb5_init_context(kdc, + kdc->task->lp_ctx, + &kdc->smb_krb5_context); + if (code != 0) { + task_server_terminate(task, + "KDC: Unable to initialize krb5 context", + true); + return NT_STATUS_INTERNAL_ERROR; + } + + code = kadm5_init_krb5_context(&kdc->smb_krb5_context->krb5_context); + if (code != 0) { + task_server_terminate(task, + "KDC: Unable to init kadm5 krb5_context", + true); + return NT_STATUS_INTERNAL_ERROR; + } + + ZERO_STRUCT(config); + config.mask = KADM5_CONFIG_REALM; + config.realm = discard_const_p(char, lpcfg_realm(kdc->task->lp_ctx)); + + ret = kadm5_init(kdc->smb_krb5_context->krb5_context, + discard_const_p(char, "kpasswd"), + NULL, /* pass */ + discard_const_p(char, "kpasswd"), + &config, + KADM5_STRUCT_VERSION, + KADM5_API_VERSION_4, + NULL, + &server_handle); + if (ret != 0) { + task_server_terminate(task, + "KDC: Initialize kadm5", + true); + return NT_STATUS_INTERNAL_ERROR; + } + kdc->private_data = server_handle; + + code = krb5_db_register_keytab(kdc->smb_krb5_context->krb5_context); + if (code != 0) { + task_server_terminate(task, + "KDC: Unable to KDB", + true); + return NT_STATUS_INTERNAL_ERROR; + } + + kdc->kpasswd_keytab_name = talloc_asprintf(kdc, "KDB:"); + if (kdc->kpasswd_keytab_name == NULL) { + task_server_terminate(task, + "KDC: Out of memory", + true); + return NT_STATUS_NO_MEMORY; + } + + kdc->samdb = samdb_connect(kdc, + kdc->task->event_ctx, + kdc->task->lp_ctx, + system_session(kdc->task->lp_ctx), + NULL, + 0); + if (kdc->samdb == NULL) { + task_server_terminate(task, + "KDC: Unable to connect to samdb", + true); + return NT_STATUS_CONNECTION_INVALID; + } + + status = startup_kpasswd_server(kdc, + kdc, + task->lp_ctx, + ifaces); + if (!NT_STATUS_IS_OK(status)) { + task_server_terminate(task, + "KDC: Unable to start kpasswd server", + true); + return status; + } + + DEBUG(5,("Started kpasswd service for kdc_server\n")); + + return NT_STATUS_OK; +} + +/* + * This gets called the kdc exits. + */ +static void mitkdc_server_done(struct tevent_req *subreq) +{ + struct task_server *task = + tevent_req_callback_data(subreq, + struct task_server); + int sys_errno; + int ret; + + ret = samba_runcmd_recv(subreq, &sys_errno); + if (ret != 0) { + DEBUG(0, ("The MIT KDC daemon died with exit status %d\n", + sys_errno)); + } else { + DEBUG(0,("The MIT KDC daemon exited normally\n")); + } + + task_server_terminate(task, "mitkdc child process exited", true); +} + +/* Called at MIT KRB5 startup - register ourselves as a server service */ +NTSTATUS server_service_mitkdc_init(TALLOC_CTX *mem_ctx); + +NTSTATUS server_service_mitkdc_init(TALLOC_CTX *mem_ctx) +{ + static const struct service_details details = { + .inhibit_fork_on_accept = true, + /* + * Need to prevent pre-forking on kdc. + * The task_init function is run on the master process only + * and the irpc process name is registered in it's event loop. + * The child worker processes initialise their event loops on + * fork, so are not listening for the irpc event. + * + * The master process does not wait on that event context + * the master process is responsible for managing the worker + * processes not performing work. + */ + .inhibit_pre_fork = true, + .task_init = mitkdc_task_init, + .post_fork = NULL + }; + return register_server_service(mem_ctx, "kdc", &details); +} diff --git a/source4/kdc/kdc-service-mit.h b/source4/kdc/kdc-service-mit.h new file mode 100644 index 0000000..7943933 --- /dev/null +++ b/source4/kdc/kdc-service-mit.h @@ -0,0 +1,27 @@ +/* + Unix SMB/CIFS implementation. + + Start MIT krb5kdc server within Samba AD + + Copyright (c) 2014 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _KDC_SERVICE_MIT_H +#define _KDC_SERVICE_MIT_H + +NTSTATUS mitkdc_task_init(struct task_server *task); + +#endif /* _KDC_SERVICE_MIT_H */ diff --git a/source4/kdc/kpasswd-helper.c b/source4/kdc/kpasswd-helper.c new file mode 100644 index 0000000..645f9c9 --- /dev/null +++ b/source4/kdc/kpasswd-helper.c @@ -0,0 +1,261 @@ +/* + Unix SMB/CIFS implementation. + + Samba kpasswd implementation + + Copyright (c) 2005 Andrew Bartlett <abartlet@samba.org> + Copyright (c) 2016 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "system/kerberos.h" +#include "librpc/gen_ndr/samr.h" +#include "dsdb/samdb/samdb.h" +#include "auth/auth.h" +#include "kdc/kpasswd-helper.h" + +bool kpasswd_make_error_reply(TALLOC_CTX *mem_ctx, + krb5_error_code error_code, + const char *error_string, + DATA_BLOB *error_data) +{ + bool ok; + char *s; + size_t slen; + + if (error_code == 0) { + DBG_DEBUG("kpasswd reply - %s\n", error_string); + } else { + DBG_INFO("kpasswd reply - %s\n", error_string); + } + + ok = push_utf8_talloc(mem_ctx, &s, error_string, &slen); + if (!ok) { + return false; + } + + /* + * The string 's' has one terminating nul-byte which is also + * reflected by 'slen'. We subtract it from the length. + */ + if (slen < 1) { + talloc_free(s); + return false; + } + slen--; + + /* Two bytes are added to the length to account for the error code. */ + if (2 + slen < slen) { + talloc_free(s); + return false; + } + error_data->length = 2 + slen; + error_data->data = talloc_size(mem_ctx, error_data->length); + if (error_data->data == NULL) { + talloc_free(s); + return false; + } + + RSSVAL(error_data->data, 0, error_code); + memcpy(error_data->data + 2, s, slen); + + talloc_free(s); + + return true; +} + +bool kpasswd_make_pwchange_reply(TALLOC_CTX *mem_ctx, + NTSTATUS status, + enum samPwdChangeReason reject_reason, + struct samr_DomInfo1 *dominfo, + DATA_BLOB *error_blob) +{ + const char *reject_string = NULL; + + if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) { + return kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_ACCESSDENIED, + "No such user when changing password", + error_blob); + } else if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) { + return kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_ACCESSDENIED, + "Not permitted to change password", + error_blob); + } + if (dominfo != NULL && + NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) { + switch (reject_reason) { + case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT: + reject_string = + talloc_asprintf(mem_ctx, + "Password too short, password " + "must be at least %d characters " + "long.", + dominfo->min_password_length); + if (reject_string == NULL) { + reject_string = "Password too short"; + } + break; + case SAM_PWD_CHANGE_NOT_COMPLEX: + reject_string = "Password does not meet complexity " + "requirements"; + break; + case SAM_PWD_CHANGE_PWD_IN_HISTORY: + reject_string = + talloc_asprintf(mem_ctx, + "Password is already in password " + "history. New password must not " + "match any of your %d previous " + "passwords.", + dominfo->password_history_length); + if (reject_string == NULL) { + reject_string = "Password is already in password " + "history"; + } + break; + default: + reject_string = "Password change rejected, password " + "changes may not be permitted on this " + "account, or the minimum password age " + "may not have elapsed."; + break; + } + + return kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_SOFTERROR, + reject_string, + error_blob); + } + + if (!NT_STATUS_IS_OK(status)) { + reject_string = talloc_asprintf(mem_ctx, + "Failed to set password: %s", + nt_errstr(status)); + if (reject_string == NULL) { + reject_string = "Failed to set password"; + } + return kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_HARDERROR, + reject_string, + error_blob); + } + + return kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_SUCCESS, + "Password changed", + error_blob); +} + +NTSTATUS kpasswd_samdb_set_password(TALLOC_CTX *mem_ctx, + struct tevent_context *event_ctx, + struct loadparm_context *lp_ctx, + struct auth_session_info *session_info, + bool is_service_principal, + const char *target_principal_name, + DATA_BLOB *password, + enum samPwdChangeReason *reject_reason, + struct samr_DomInfo1 **dominfo) +{ + NTSTATUS status; + struct ldb_context *samdb; + struct ldb_dn *target_dn = NULL; + int rc; + + samdb = samdb_connect(mem_ctx, + event_ctx, + lp_ctx, + session_info, + NULL, + 0); + if (samdb == NULL) { + return NT_STATUS_INTERNAL_DB_CORRUPTION; + } + + DBG_INFO("%s\\%s (%s) is changing password of %s\n", + session_info->info->domain_name, + session_info->info->account_name, + dom_sid_string(mem_ctx, + &session_info->security_token->sids[PRIMARY_USER_SID_INDEX]), + target_principal_name); + + rc = ldb_transaction_start(samdb); + if (rc != LDB_SUCCESS) { + return NT_STATUS_TRANSACTION_ABORTED; + } + + if (is_service_principal) { + status = crack_service_principal_name(samdb, + mem_ctx, + target_principal_name, + &target_dn, + NULL); + } else { + status = crack_user_principal_name(samdb, + mem_ctx, + target_principal_name, + &target_dn, + NULL); + } + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(samdb); + return status; + } + + status = samdb_set_password(samdb, + mem_ctx, + target_dn, + NULL, /* domain_dn */ + password, + NULL, /* ntNewHash */ + DSDB_PASSWORD_RESET, + reject_reason, + dominfo); + if (NT_STATUS_IS_OK(status)) { + rc = ldb_transaction_commit(samdb); + if (rc != LDB_SUCCESS) { + DBG_WARNING("Failed to commit transaction to " + "set password on %s: %s\n", + ldb_dn_get_linearized(target_dn), + ldb_errstring(samdb)); + return NT_STATUS_TRANSACTION_ABORTED; + } + } else { + ldb_transaction_cancel(samdb); + } + + return status; +} + +krb5_error_code kpasswd_check_non_tgt(struct auth_session_info *session_info, + const char **error_string) +{ + switch(session_info->ticket_type) { + case TICKET_TYPE_TGT: + /* TGTs are disallowed here. */ + *error_string = "A TGT may not be used as a ticket to kpasswd"; + return KRB5_KPASSWD_AUTHERROR; + case TICKET_TYPE_NON_TGT: + /* Non-TGTs are permitted, and expected. */ + break; + default: + /* In case we forgot to set the type. */ + *error_string = "Failed to ascertain that ticket to kpasswd is not a TGT"; + return KRB5_KPASSWD_HARDERROR; + } + + return 0; +} diff --git a/source4/kdc/kpasswd-helper.h b/source4/kdc/kpasswd-helper.h new file mode 100644 index 0000000..94a6e2a --- /dev/null +++ b/source4/kdc/kpasswd-helper.h @@ -0,0 +1,48 @@ +/* + Unix SMB/CIFS implementation. + + Samba kpasswd implementation + + Copyright (c) 2016 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _KPASSWD_HELPER_H +#define _KPASSWD_HELPER_H + +bool kpasswd_make_error_reply(TALLOC_CTX *mem_ctx, + krb5_error_code error_code, + const char *error_string, + DATA_BLOB *error_data); + +bool kpasswd_make_pwchange_reply(TALLOC_CTX *mem_ctx, + NTSTATUS status, + enum samPwdChangeReason reject_reason, + struct samr_DomInfo1 *dominfo, + DATA_BLOB *error_blob); + +NTSTATUS kpasswd_samdb_set_password(TALLOC_CTX *mem_ctx, + struct tevent_context *event_ctx, + struct loadparm_context *lp_ctx, + struct auth_session_info *session_info, + bool is_service_principal, + const char *target_principal_name, + DATA_BLOB *password, + enum samPwdChangeReason *reject_reason, + struct samr_DomInfo1 **dominfo); + +krb5_error_code kpasswd_check_non_tgt(struct auth_session_info *session_info, + const char **error_string); +#endif /* _KPASSWD_HELPER_H */ diff --git a/source4/kdc/kpasswd-service-heimdal.c b/source4/kdc/kpasswd-service-heimdal.c new file mode 100644 index 0000000..c92b13d --- /dev/null +++ b/source4/kdc/kpasswd-service-heimdal.c @@ -0,0 +1,323 @@ +/* + Unix SMB/CIFS implementation. + + Samba kpasswd implementation + + Copyright (c) 2016 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "samba/service_task.h" +#include "param/param.h" +#include "auth/auth.h" +#include "auth/gensec/gensec.h" +#include "gensec_krb5_helpers.h" +#include "kdc/kdc-server.h" +#include "kdc/kpasswd_glue.h" +#include "kdc/kpasswd-service.h" +#include "kdc/kpasswd-helper.h" + +static krb5_error_code kpasswd_change_password(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + const struct gensec_security *gensec_security, + struct auth_session_info *session_info, + DATA_BLOB *password, + DATA_BLOB *kpasswd_reply, + const char **error_string) +{ + NTSTATUS status; + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + enum samPwdChangeReason reject_reason; + const char *reject_string = NULL; + struct samr_DomInfo1 *dominfo; + bool ok; + int ret; + + /* + * We're doing a password change (rather than a password set), so check + * that we were given an initial ticket. + */ + ret = gensec_krb5_initial_ticket(gensec_security); + if (ret != 1) { + *error_string = "Expected an initial ticket"; + return KRB5_KPASSWD_INITIAL_FLAG_NEEDED; + } + + status = samdb_kpasswd_change_password(mem_ctx, + kdc->task->lp_ctx, + kdc->task->event_ctx, + session_info, + password, + &reject_reason, + &dominfo, + &reject_string, + &result); + if (!NT_STATUS_IS_OK(status)) { + ok = kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_ACCESSDENIED, + reject_string, + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + /* We want to send an an authenticated packet. */ + return 0; + } + + ok = kpasswd_make_pwchange_reply(mem_ctx, + result, + reject_reason, + dominfo, + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + + return 0; +} + +static krb5_error_code kpasswd_set_password(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + const struct gensec_security *gensec_security, + struct auth_session_info *session_info, + DATA_BLOB *decoded_data, + DATA_BLOB *kpasswd_reply, + const char **error_string) +{ + krb5_context context = kdc->smb_krb5_context->krb5_context; + krb5_error_code code; + krb5_principal target_principal; + ChangePasswdDataMS chpw = {}; + size_t chpw_len = 0; + DATA_BLOB password = data_blob_null; + enum samPwdChangeReason reject_reason = SAM_PWD_CHANGE_NO_ERROR; + struct samr_DomInfo1 *dominfo = NULL; + char *target_principal_string = NULL; + bool is_service_principal = false; + NTSTATUS status; + bool ok; + + code = decode_ChangePasswdDataMS(decoded_data->data, + decoded_data->length, + &chpw, + &chpw_len); + if (code != 0) { + DBG_WARNING("decode_ChangePasswdDataMS failed\n"); + ok = kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_MALFORMED, + "Failed to decode packet", + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + return 0; + } + + ok = convert_string_talloc_handle(mem_ctx, + lpcfg_iconv_handle(kdc->task->lp_ctx), + CH_UTF8, + CH_UTF16, + (const char *)chpw.newpasswd.data, + chpw.newpasswd.length, + (void **)&password.data, + &password.length); + if (!ok) { + free_ChangePasswdDataMS(&chpw); + DBG_WARNING("String conversion failed\n"); + *error_string = "String conversion failed"; + return KRB5_KPASSWD_HARDERROR; + } + + if ((chpw.targname != NULL && chpw.targrealm == NULL) || + (chpw.targname == NULL && chpw.targrealm != NULL)) { + free_ChangePasswdDataMS(&chpw); + ok = kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_MALFORMED, + "Realm and principal must be " + "both present, or neither present", + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + return 0; + } + + if (chpw.targname == NULL || chpw.targrealm == NULL) { + free_ChangePasswdDataMS(&chpw); + return kpasswd_change_password(kdc, + mem_ctx, + gensec_security, + session_info, + &password, + kpasswd_reply, + error_string); + } + code = krb5_build_principal_ext(context, + &target_principal, + strlen(*chpw.targrealm), + *chpw.targrealm, + 0); + if (code != 0) { + free_ChangePasswdDataMS(&chpw); + return kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_MALFORMED, + "Failed to parse principal", + kpasswd_reply); + } + code = copy_PrincipalName(chpw.targname, + &target_principal->name); + free_ChangePasswdDataMS(&chpw); + if (code != 0) { + krb5_free_principal(context, target_principal); + return kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_MALFORMED, + "Failed to parse principal", + kpasswd_reply); + } + + if (target_principal->name.name_string.len >= 2) { + is_service_principal = true; + + code = krb5_unparse_name_short(context, + target_principal, + &target_principal_string); + } else { + code = krb5_unparse_name(context, + target_principal, + &target_principal_string); + } + krb5_free_principal(context, target_principal); + if (code != 0) { + ok = kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_MALFORMED, + "Failed to parse principal", + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + } + + status = kpasswd_samdb_set_password(mem_ctx, + kdc->task->event_ctx, + kdc->task->lp_ctx, + session_info, + is_service_principal, + target_principal_string, + &password, + &reject_reason, + &dominfo); + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("kpasswd_samdb_set_password failed - %s\n", + nt_errstr(status)); + } + + ok = kpasswd_make_pwchange_reply(mem_ctx, + status, + reject_reason, + dominfo, + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + + return 0; +} + +krb5_error_code kpasswd_handle_request(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + struct gensec_security *gensec_security, + uint16_t verno, + DATA_BLOB *decoded_data, + DATA_BLOB *kpasswd_reply, + const char **error_string) +{ + struct auth_session_info *session_info; + NTSTATUS status; + krb5_error_code code; + + status = gensec_session_info(gensec_security, + mem_ctx, + &session_info); + if (!NT_STATUS_IS_OK(status)) { + *error_string = talloc_asprintf(mem_ctx, + "gensec_session_info failed - %s", + nt_errstr(status)); + return KRB5_KPASSWD_HARDERROR; + } + + /* + * Since the kpasswd service shares its keys with the krbtgt, we might + * have received a TGT rather than a kpasswd ticket. We need to check + * the ticket type to ensure that TGTs cannot be misused in this manner. + */ + code = kpasswd_check_non_tgt(session_info, + error_string); + if (code != 0) { + DBG_WARNING("%s\n", *error_string); + return code; + } + + switch(verno) { + case KRB5_KPASSWD_VERS_CHANGEPW: { + DATA_BLOB password = data_blob_null; + bool ok; + + ok = convert_string_talloc_handle(mem_ctx, + lpcfg_iconv_handle(kdc->task->lp_ctx), + CH_UTF8, + CH_UTF16, + (const char *)decoded_data->data, + decoded_data->length, + (void **)&password.data, + &password.length); + if (!ok) { + *error_string = "String conversion failed!"; + DBG_WARNING("%s\n", *error_string); + return KRB5_KPASSWD_HARDERROR; + } + + return kpasswd_change_password(kdc, + mem_ctx, + gensec_security, + session_info, + &password, + kpasswd_reply, + error_string); + } + case KRB5_KPASSWD_VERS_SETPW: { + return kpasswd_set_password(kdc, + mem_ctx, + gensec_security, + session_info, + decoded_data, + kpasswd_reply, + error_string); + } + default: + *error_string = talloc_asprintf(mem_ctx, + "Protocol version %u not supported", + verno); + return KRB5_KPASSWD_BAD_VERSION; + } + + return 0; +} diff --git a/source4/kdc/kpasswd-service-mit.c b/source4/kdc/kpasswd-service-mit.c new file mode 100644 index 0000000..053b1f2 --- /dev/null +++ b/source4/kdc/kpasswd-service-mit.c @@ -0,0 +1,400 @@ +/* + Unix SMB/CIFS implementation. + + Samba kpasswd implementation + + Copyright (c) 2016 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "samba/service_task.h" +#include "param/param.h" +#include "auth/auth.h" +#include "auth/gensec/gensec.h" +#include "gensec_krb5_helpers.h" +#include "kdc/kdc-server.h" +#include "kdc/kpasswd_glue.h" +#include "kdc/kpasswd-service.h" +#include "kdc/kpasswd-helper.h" +#include "../lib/util/asn1.h" + +#define RFC3244_VERSION 0xff80 + +krb5_error_code decode_krb5_setpw_req(const krb5_data *code, + krb5_data **password_out, + krb5_principal *target_out); + +/* + * A fallback for when MIT refuses to parse a setpw structure without the + * (optional) target principal and realm + */ +static bool decode_krb5_setpw_req_simple(TALLOC_CTX *mem_ctx, + const DATA_BLOB *decoded_data, + DATA_BLOB *clear_data) +{ + struct asn1_data *asn1 = NULL; + bool ret; + + asn1 = asn1_init(mem_ctx, 3); + if (asn1 == NULL) { + return false; + } + + ret = asn1_load(asn1, *decoded_data); + if (!ret) { + goto out; + } + + ret = asn1_start_tag(asn1, ASN1_SEQUENCE(0)); + if (!ret) { + goto out; + } + ret = asn1_start_tag(asn1, ASN1_CONTEXT(0)); + if (!ret) { + goto out; + } + ret = asn1_read_OctetString(asn1, mem_ctx, clear_data); + if (!ret) { + goto out; + } + + ret = asn1_end_tag(asn1); + if (!ret) { + goto out; + } + ret = asn1_end_tag(asn1); + +out: + asn1_free(asn1); + + return ret; +} + +static krb5_error_code kpasswd_change_password(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + const struct gensec_security *gensec_security, + struct auth_session_info *session_info, + DATA_BLOB *password, + DATA_BLOB *kpasswd_reply, + const char **error_string) +{ + NTSTATUS status; + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + enum samPwdChangeReason reject_reason; + const char *reject_string = NULL; + struct samr_DomInfo1 *dominfo; + bool ok; + int ret; + + /* + * We're doing a password change (rather than a password set), so check + * that we were given an initial ticket. + */ + ret = gensec_krb5_initial_ticket(gensec_security); + if (ret != 1) { + *error_string = "Expected an initial ticket"; + return KRB5_KPASSWD_INITIAL_FLAG_NEEDED; + } + + status = samdb_kpasswd_change_password(mem_ctx, + kdc->task->lp_ctx, + kdc->task->event_ctx, + session_info, + password, + &reject_reason, + &dominfo, + &reject_string, + &result); + if (!NT_STATUS_IS_OK(status)) { + ok = kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_ACCESSDENIED, + reject_string, + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + /* We want to send an an authenticated packet. */ + return 0; + } + + ok = kpasswd_make_pwchange_reply(mem_ctx, + result, + reject_reason, + dominfo, + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + + return 0; +} + +static krb5_error_code kpasswd_set_password(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + const struct gensec_security *gensec_security, + struct auth_session_info *session_info, + DATA_BLOB *decoded_data, + DATA_BLOB *kpasswd_reply, + const char **error_string) +{ + krb5_context context = kdc->smb_krb5_context->krb5_context; + DATA_BLOB clear_data; + krb5_data k_dec_data; + krb5_data *k_clear_data = NULL; + krb5_principal target_principal = NULL; + krb5_error_code code; + DATA_BLOB password; + char *target_realm = NULL; + char *target_name = NULL; + char *target_principal_string = NULL; + bool is_service_principal = false; + bool ok; + size_t num_components; + enum samPwdChangeReason reject_reason = SAM_PWD_CHANGE_NO_ERROR; + struct samr_DomInfo1 *dominfo = NULL; + NTSTATUS status; + + k_dec_data.length = decoded_data->length; + k_dec_data.data = (char *)decoded_data->data; + + code = decode_krb5_setpw_req(&k_dec_data, + &k_clear_data, + &target_principal); + if (code == 0) { + clear_data.data = (uint8_t *)k_clear_data->data; + clear_data.length = k_clear_data->length; + } else { + target_principal = NULL; + + /* + * The MIT decode failed, so fall back to trying the simple + * case, without target_principal. + */ + ok = decode_krb5_setpw_req_simple(mem_ctx, + decoded_data, + &clear_data); + if (!ok) { + DBG_WARNING("decode_krb5_setpw_req failed: %s\n", + error_message(code)); + ok = kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_MALFORMED, + "Failed to decode packet", + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + return 0; + } + } + + ok = convert_string_talloc_handle(mem_ctx, + lpcfg_iconv_handle(kdc->task->lp_ctx), + CH_UTF8, + CH_UTF16, + clear_data.data, + clear_data.length, + (void **)&password.data, + &password.length); + if (k_clear_data != NULL) { + krb5_free_data(context, k_clear_data); + } + if (!ok) { + DBG_WARNING("String conversion failed\n"); + *error_string = "String conversion failed"; + return KRB5_KPASSWD_HARDERROR; + } + + if (target_principal != NULL) { + target_realm = smb_krb5_principal_get_realm( + mem_ctx, context, target_principal); + code = krb5_unparse_name_flags(context, + target_principal, + KRB5_PRINCIPAL_UNPARSE_NO_REALM, + &target_name); + if (code != 0) { + DBG_WARNING("Failed to parse principal\n"); + *error_string = "String conversion failed"; + return KRB5_KPASSWD_HARDERROR; + } + } + + if ((target_name != NULL && target_realm == NULL) || + (target_name == NULL && target_realm != NULL)) { + krb5_free_principal(context, target_principal); + TALLOC_FREE(target_realm); + SAFE_FREE(target_name); + + ok = kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_MALFORMED, + "Realm and principal must be " + "both present, or neither " + "present", + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + return 0; + } + + if (target_name != NULL && target_realm != NULL) { + TALLOC_FREE(target_realm); + SAFE_FREE(target_name); + } else { + krb5_free_principal(context, target_principal); + TALLOC_FREE(target_realm); + SAFE_FREE(target_name); + + return kpasswd_change_password(kdc, + mem_ctx, + gensec_security, + session_info, + &password, + kpasswd_reply, + error_string); + } + + num_components = krb5_princ_size(context, target_principal); + if (num_components >= 2) { + is_service_principal = true; + code = krb5_unparse_name_flags(context, + target_principal, + KRB5_PRINCIPAL_UNPARSE_SHORT, + &target_principal_string); + } else { + code = krb5_unparse_name(context, + target_principal, + &target_principal_string); + } + krb5_free_principal(context, target_principal); + if (code != 0) { + ok = kpasswd_make_error_reply(mem_ctx, + KRB5_KPASSWD_MALFORMED, + "Failed to parse principal", + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + } + + status = kpasswd_samdb_set_password(mem_ctx, + kdc->task->event_ctx, + kdc->task->lp_ctx, + session_info, + is_service_principal, + target_principal_string, + &password, + &reject_reason, + &dominfo); + if (!NT_STATUS_IS_OK(status)) { + DBG_ERR("kpasswd_samdb_set_password failed - %s\n", + nt_errstr(status)); + } + + ok = kpasswd_make_pwchange_reply(mem_ctx, + status, + reject_reason, + dominfo, + kpasswd_reply); + if (!ok) { + *error_string = "Failed to create reply"; + return KRB5_KPASSWD_HARDERROR; + } + + return 0; +} + +krb5_error_code kpasswd_handle_request(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + struct gensec_security *gensec_security, + uint16_t verno, + DATA_BLOB *decoded_data, + DATA_BLOB *kpasswd_reply, + const char **error_string) +{ + struct auth_session_info *session_info; + NTSTATUS status; + krb5_error_code code; + + status = gensec_session_info(gensec_security, + mem_ctx, + &session_info); + if (!NT_STATUS_IS_OK(status)) { + *error_string = talloc_asprintf(mem_ctx, + "gensec_session_info failed - " + "%s", + nt_errstr(status)); + return KRB5_KPASSWD_HARDERROR; + } + + /* + * Since the kpasswd service shares its keys with the krbtgt, we might + * have received a TGT rather than a kpasswd ticket. We need to check + * the ticket type to ensure that TGTs cannot be misused in this manner. + */ + code = kpasswd_check_non_tgt(session_info, + error_string); + if (code != 0) { + DBG_WARNING("%s\n", *error_string); + return code; + } + + switch(verno) { + case 1: { + DATA_BLOB password; + bool ok; + + ok = convert_string_talloc_handle(mem_ctx, + lpcfg_iconv_handle(kdc->task->lp_ctx), + CH_UTF8, + CH_UTF16, + (const char *)decoded_data->data, + decoded_data->length, + (void **)&password.data, + &password.length); + if (!ok) { + *error_string = "String conversion failed!"; + DBG_WARNING("%s\n", *error_string); + return KRB5_KPASSWD_HARDERROR; + } + + return kpasswd_change_password(kdc, + mem_ctx, + gensec_security, + session_info, + &password, + kpasswd_reply, + error_string); + } + case RFC3244_VERSION: { + return kpasswd_set_password(kdc, + mem_ctx, + gensec_security, + session_info, + decoded_data, + kpasswd_reply, + error_string); + } + default: + return KRB5_KPASSWD_BAD_VERSION; + } + + return 0; +} diff --git a/source4/kdc/kpasswd-service.c b/source4/kdc/kpasswd-service.c new file mode 100644 index 0000000..d2f1bb0 --- /dev/null +++ b/source4/kdc/kpasswd-service.c @@ -0,0 +1,391 @@ +/* + Unix SMB/CIFS implementation. + + Samba kpasswd implementation + + Copyright (c) 2005 Andrew Bartlett <abartlet@samba.org> + Copyright (c) 2016 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "samba/service_task.h" +#include "tsocket/tsocket.h" +#include "auth/credentials/credentials.h" +#include "auth/auth.h" +#include "auth/gensec/gensec.h" +#include "kdc/kdc-server.h" +#include "kdc/kpasswd-service.h" +#include "kdc/kpasswd-helper.h" +#include "param/param.h" + +#define HEADER_LEN 6 +#ifndef RFC3244_VERSION +#define RFC3244_VERSION 0xff80 +#endif + +kdc_code kpasswd_process(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + DATA_BLOB *request, + DATA_BLOB *reply, + struct tsocket_address *remote_addr, + struct tsocket_address *local_addr, + int datagram) +{ + uint16_t len; + uint16_t verno; + uint16_t ap_req_len; + uint16_t enc_data_len; + DATA_BLOB ap_req_blob = data_blob_null; + DATA_BLOB ap_rep_blob = data_blob_null; + DATA_BLOB enc_data_blob = data_blob_null; + DATA_BLOB dec_data_blob = data_blob_null; + DATA_BLOB kpasswd_dec_reply = data_blob_null; + const char *error_string = NULL; + krb5_error_code error_code = 0; + struct cli_credentials *server_credentials; + struct gensec_security *gensec_security; +#ifndef SAMBA4_USES_HEIMDAL + struct sockaddr_storage remote_ss; +#endif + struct sockaddr_storage local_ss; + ssize_t socklen; + TALLOC_CTX *tmp_ctx; + kdc_code rc = KDC_ERROR; + krb5_error_code code = 0; + NTSTATUS status; + int rv; + bool is_inet; + bool ok; + + if (kdc->am_rodc) { + return KDC_PROXY_REQUEST; + } + + tmp_ctx = talloc_new(mem_ctx); + if (tmp_ctx == NULL) { + return KDC_ERROR; + } + + is_inet = tsocket_address_is_inet(remote_addr, "ip"); + if (!is_inet) { + DBG_WARNING("Invalid remote IP address"); + goto done; + } + +#ifndef SAMBA4_USES_HEIMDAL + /* + * FIXME: Heimdal fails to to do a krb5_rd_req() in gensec_krb5 if we + * set the remote address. + */ + + /* remote_addr */ + socklen = tsocket_address_bsd_sockaddr(remote_addr, + (struct sockaddr *)&remote_ss, + sizeof(struct sockaddr_storage)); + if (socklen < 0) { + DBG_WARNING("Invalid remote IP address"); + goto done; + } +#endif + + /* local_addr */ + socklen = tsocket_address_bsd_sockaddr(local_addr, + (struct sockaddr *)&local_ss, + sizeof(struct sockaddr_storage)); + if (socklen < 0) { + DBG_WARNING("Invalid local IP address"); + goto done; + } + + if (request->length <= HEADER_LEN) { + DBG_WARNING("Request truncated\n"); + goto done; + } + + len = RSVAL(request->data, 0); + if (request->length != len) { + DBG_WARNING("Request length does not match\n"); + goto done; + } + + verno = RSVAL(request->data, 2); + if (verno != 1 && verno != RFC3244_VERSION) { + DBG_WARNING("Unsupported version: 0x%04x\n", verno); + } + + ap_req_len = RSVAL(request->data, 4); + if ((ap_req_len >= len) || ((ap_req_len + HEADER_LEN) >= len)) { + DBG_WARNING("AP_REQ truncated\n"); + goto done; + } + + ap_req_blob = data_blob_const(&request->data[HEADER_LEN], ap_req_len); + + enc_data_len = len - ap_req_len; + enc_data_blob = data_blob_const(&request->data[HEADER_LEN + ap_req_len], + enc_data_len); + + server_credentials = cli_credentials_init(tmp_ctx); + if (server_credentials == NULL) { + DBG_ERR("Failed to initialize server credentials!\n"); + goto done; + } + + /* + * We want the credentials subsystem to use the krb5 context we already + * have, rather than a new context. + * + * On this context the KDB plugin has been loaded, so we can access + * dsdb. + */ + status = cli_credentials_set_krb5_context(server_credentials, + kdc->smb_krb5_context); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + ok = cli_credentials_set_conf(server_credentials, kdc->task->lp_ctx); + if (!ok) { + goto done; + } + + /* + * After calling cli_credentials_set_conf(), explicitly set the realm + * with CRED_SPECIFIED. We need to do this so the result of + * principal_from_credentials() called from the gensec layer is + * CRED_SPECIFIED rather than CRED_SMB_CONF, avoiding a fallback to + * match-by-key (very undesirable in this case). + */ + ok = cli_credentials_set_realm(server_credentials, + lpcfg_realm(kdc->task->lp_ctx), + CRED_SPECIFIED); + if (!ok) { + goto done; + } + + ok = cli_credentials_set_username(server_credentials, + "kadmin/changepw", + CRED_SPECIFIED); + if (!ok) { + goto done; + } + + /* Check that the server principal is indeed CRED_SPECIFIED. */ + { + char *principal = NULL; + enum credentials_obtained obtained; + + principal = cli_credentials_get_principal_and_obtained(server_credentials, + tmp_ctx, + &obtained); + if (obtained < CRED_SPECIFIED) { + goto done; + } + + TALLOC_FREE(principal); + } + + rv = cli_credentials_set_keytab_name(server_credentials, + kdc->task->lp_ctx, + kdc->kpasswd_keytab_name, + CRED_SPECIFIED); + if (rv != 0) { + DBG_ERR("Failed to set credentials keytab name\n"); + goto done; + } + + status = samba_server_gensec_start(tmp_ctx, + kdc->task->event_ctx, + kdc->task->msg_ctx, + kdc->task->lp_ctx, + server_credentials, + "kpasswd", + &gensec_security); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + status = gensec_set_local_address(gensec_security, local_addr); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + +#ifndef SAMBA4_USES_HEIMDAL + status = gensec_set_remote_address(gensec_security, remote_addr); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } +#endif + + /* We want the GENSEC wrap calls to generate PRIV tokens */ + gensec_want_feature(gensec_security, GENSEC_FEATURE_SEAL); + + /* Use the krb5 gesec mechanism so we can load DB modules */ + status = gensec_start_mech_by_name(gensec_security, "krb5"); + if (!NT_STATUS_IS_OK(status)) { + goto done; + } + + /* + * Accept the AP-REQ and generate the AP-REP we need for the reply + * + * We only allow KRB5 and make sure the backend to is RPC/IPC free. + * + * See gensec_krb5_update_internal() as GENSEC_SERVER. + * + * It allows gensec_update() not to block. + * + * If that changes in future we need to use + * gensec_update_send/recv here! + */ + status = gensec_update(gensec_security, tmp_ctx, + ap_req_blob, &ap_rep_blob); + if (!NT_STATUS_IS_OK(status) && + !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + ap_rep_blob = data_blob_null; + error_code = KRB5_KPASSWD_HARDERROR; + error_string = talloc_asprintf(tmp_ctx, + "gensec_update failed - %s\n", + nt_errstr(status)); + DBG_ERR("%s", error_string); + goto reply; + } + + status = gensec_unwrap(gensec_security, + tmp_ctx, + &enc_data_blob, + &dec_data_blob); + if (!NT_STATUS_IS_OK(status)) { + ap_rep_blob = data_blob_null; + error_code = KRB5_KPASSWD_HARDERROR; + error_string = talloc_asprintf(tmp_ctx, + "gensec_unwrap failed - %s\n", + nt_errstr(status)); + DBG_ERR("%s", error_string); + goto reply; + } + + code = kpasswd_handle_request(kdc, + tmp_ctx, + gensec_security, + verno, + &dec_data_blob, + &kpasswd_dec_reply, + &error_string); + if (code != 0) { + ap_rep_blob = data_blob_null; + error_code = code; + goto reply; + } + + status = gensec_wrap(gensec_security, + tmp_ctx, + &kpasswd_dec_reply, + &enc_data_blob); + if (!NT_STATUS_IS_OK(status)) { + ap_rep_blob = data_blob_null; + error_code = KRB5_KPASSWD_HARDERROR; + error_string = talloc_asprintf(tmp_ctx, + "gensec_wrap failed - %s\n", + nt_errstr(status)); + DBG_ERR("%s", error_string); + goto reply; + } + +reply: + if (error_code != 0) { + krb5_data k_enc_data; + krb5_data k_dec_data; + const char *principal_string; + krb5_principal server_principal; + + if (error_string == NULL) { + DBG_ERR("Invalid error string! This should not happen\n"); + goto done; + } + + ok = kpasswd_make_error_reply(tmp_ctx, + error_code, + error_string, + &dec_data_blob); + if (!ok) { + DBG_ERR("Failed to create error reply\n"); + goto done; + } + + k_dec_data.length = dec_data_blob.length; + k_dec_data.data = (char *)dec_data_blob.data; + + principal_string = cli_credentials_get_principal(server_credentials, + tmp_ctx); + if (principal_string == NULL) { + goto done; + } + + code = smb_krb5_parse_name(kdc->smb_krb5_context->krb5_context, + principal_string, + &server_principal); + if (code != 0) { + DBG_ERR("Failed to create principal: %s\n", + error_message(code)); + goto done; + } + + code = smb_krb5_mk_error(kdc->smb_krb5_context->krb5_context, + KRB5KDC_ERR_NONE + error_code, + NULL, /* e_text */ + &k_dec_data, + NULL, /* client */ + server_principal, + &k_enc_data); + krb5_free_principal(kdc->smb_krb5_context->krb5_context, + server_principal); + if (code != 0) { + DBG_ERR("Failed to create krb5 error reply: %s\n", + error_message(code)); + goto done; + } + + enc_data_blob = data_blob_talloc(tmp_ctx, + k_enc_data.data, + k_enc_data.length); + if (enc_data_blob.data == NULL) { + DBG_ERR("Failed to allocate memory for error reply\n"); + goto done; + } + } + + *reply = data_blob_talloc(mem_ctx, + NULL, + HEADER_LEN + ap_rep_blob.length + enc_data_blob.length); + if (reply->data == NULL) { + goto done; + } + RSSVAL(reply->data, 0, reply->length); + RSSVAL(reply->data, 2, 1); + RSSVAL(reply->data, 4, ap_rep_blob.length); + memcpy(reply->data + HEADER_LEN, + ap_rep_blob.data, + ap_rep_blob.length); + memcpy(reply->data + HEADER_LEN + ap_rep_blob.length, + enc_data_blob.data, + enc_data_blob.length); + + rc = KDC_OK; +done: + talloc_free(tmp_ctx); + return rc; +} diff --git a/source4/kdc/kpasswd-service.h b/source4/kdc/kpasswd-service.h new file mode 100644 index 0000000..845d680 --- /dev/null +++ b/source4/kdc/kpasswd-service.h @@ -0,0 +1,43 @@ +/* + Unix SMB/CIFS implementation. + + Samba kpasswd implementation + + Copyright (c) 2016 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _KPASSWD_SERVICE_H +#define _KPASSWD_SERVICE_H + +struct gensec_security; + +krb5_error_code kpasswd_handle_request(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + struct gensec_security *gensec_security, + uint16_t verno, + DATA_BLOB *decoded_data, + DATA_BLOB *kpasswd_reply, + const char **error_string); + +kdc_code kpasswd_process(struct kdc_server *kdc, + TALLOC_CTX *mem_ctx, + DATA_BLOB *request, + DATA_BLOB *reply, + struct tsocket_address *remote_addr, + struct tsocket_address *local_addr, + int datagram); + +#endif /* _KPASSWD_SERVICE_H */ diff --git a/source4/kdc/kpasswd_glue.c b/source4/kdc/kpasswd_glue.c new file mode 100644 index 0000000..68f347c --- /dev/null +++ b/source4/kdc/kpasswd_glue.c @@ -0,0 +1,85 @@ +/* + Unix SMB/CIFS implementation. + + kpasswd Server implementation + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "dsdb/samdb/samdb.h" +#include "../lib/util/util_ldb.h" +#include "libcli/security/security.h" +#include "dsdb/common/util.h" +#include "auth/auth.h" +#include "kdc/kpasswd_glue.h" + +/* + A user password change + + Return true if there is a valid error packet (or success) formed in + the error_blob +*/ +NTSTATUS samdb_kpasswd_change_password(TALLOC_CTX *mem_ctx, + struct loadparm_context *lp_ctx, + struct tevent_context *event_ctx, + struct auth_session_info *session_info, + const DATA_BLOB *password, + enum samPwdChangeReason *reject_reason, + struct samr_DomInfo1 **dominfo, + const char **error_string, + NTSTATUS *result) +{ + NTSTATUS status; + struct ldb_context *samdb = NULL; + + /* Start a SAM with user privileges for the password change */ + samdb = samdb_connect(mem_ctx, + event_ctx, + lp_ctx, + session_info, + NULL, + 0); + if (!samdb) { + *error_string = "Failed to open samdb"; + return NT_STATUS_ACCESS_DENIED; + } + + DEBUG(3, ("Changing password of %s\\%s (%s)\n", + session_info->info->domain_name, + session_info->info->account_name, + dom_sid_string(mem_ctx, &session_info->security_token->sids[PRIMARY_USER_SID_INDEX]))); + + /* Performs the password change */ + status = samdb_set_password_sid(samdb, + mem_ctx, + &session_info->security_token->sids[PRIMARY_USER_SID_INDEX], + NULL, + password, + NULL, + DSDB_PASSWORD_CHECKED_AND_CORRECT, + reject_reason, + dominfo); + if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) { + *error_string = "No such user when changing password"; + } else if (!NT_STATUS_IS_OK(status)) { + *error_string = nt_errstr(status); + } + *result = status; + + return NT_STATUS_OK; +} diff --git a/source4/kdc/kpasswd_glue.h b/source4/kdc/kpasswd_glue.h new file mode 100644 index 0000000..49246af --- /dev/null +++ b/source4/kdc/kpasswd_glue.h @@ -0,0 +1,31 @@ +/* + Unix SMB/CIFS implementation. + + kpasswd Server implementation + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +NTSTATUS samdb_kpasswd_change_password(TALLOC_CTX *mem_ctx, + struct loadparm_context *lp_ctx, + struct tevent_context *event_ctx, + struct auth_session_info *session_info, + const DATA_BLOB *password, + enum samPwdChangeReason *reject_reason, + struct samr_DomInfo1 **dominfo, + const char **error_string, + NTSTATUS *result); diff --git a/source4/kdc/ktutil.c b/source4/kdc/ktutil.c new file mode 100644 index 0000000..732d247 --- /dev/null +++ b/source4/kdc/ktutil.c @@ -0,0 +1,122 @@ +/* + Unix SMB/CIFS implementation. + + Minimal ktutil for selftest + + Copyright (C) Ralph Boehme <slow@samba.org> 2016 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "krb5_wrap/krb5_samba.h" + +static void smb_krb5_err(TALLOC_CTX *mem_ctx, + krb5_context context, + int exit_code, + krb5_error_code code, + const char *msg) +{ + char *krb5_err_str = smb_get_krb5_error_message(context, + code, + mem_ctx); + printf("%s: %s\n", msg, krb5_err_str ? krb5_err_str : "UNKOWN"); + + talloc_free(mem_ctx); + exit(exit_code); +} + +int main (int argc, char **argv) +{ + TALLOC_CTX *mem_ctx = talloc_init("ktutil"); + krb5_context context; + krb5_keytab keytab; + krb5_kt_cursor cursor; + krb5_keytab_entry entry; + krb5_error_code ret; + char *keytab_name = NULL; + + if (mem_ctx == NULL) { + printf("talloc_init() failed\n"); + exit(1); + } + + if (argc != 2) { + printf("Usage: %s KEYTAB\n", argv[0]); + exit(1); + } + + keytab_name = argv[1]; + + ret = smb_krb5_init_context_common(&context); + if (ret) { + DBG_ERR("kerberos init context failed (%s)\n", + error_message(ret)); + smb_krb5_err(mem_ctx, context, 1, ret, "krb5_context"); + } + + ret = smb_krb5_kt_open_relative(context, keytab_name, false, &keytab); + if (ret) { + smb_krb5_err(mem_ctx, context, 1, ret, "open keytab"); + } + + ret = krb5_kt_start_seq_get(context, keytab, &cursor); + if (ret) { + smb_krb5_err(mem_ctx, context, 1, ret, "krb5_kt_start_seq_get"); + } + + for (ret = krb5_kt_next_entry(context, keytab, &entry, &cursor); + ret == 0; + ret = krb5_kt_next_entry(context, keytab, &entry, &cursor)) + { + char *principal = NULL; + char *enctype_str = NULL; + krb5_enctype enctype = smb_krb5_kt_get_enctype_from_entry(&entry); + + ret = smb_krb5_unparse_name(mem_ctx, + context, + entry.principal, + &principal); + if (ret) { + smb_krb5_err(mem_ctx, context, 1, ret, "krb5_enctype_to_string"); + } + + ret = smb_krb5_enctype_to_string(context, + enctype, + &enctype_str); + if (ret) { + printf("%s (%d)\n", principal, (int)enctype); + } else { + printf("%s (%s)\n", principal, enctype_str); + } + + TALLOC_FREE(principal); + SAFE_FREE(enctype_str); + smb_krb5_kt_free_entry(context, &entry); + } + + ret = krb5_kt_end_seq_get(context, keytab, &cursor); + if (ret) { + smb_krb5_err(mem_ctx, context, 1, ret, "krb5_kt_end_seq_get"); + } + + ret = krb5_kt_close(context, keytab); + if (ret) { + smb_krb5_err(mem_ctx, context, 1, ret, "krb5_kt_close"); + } + + krb5_free_context(context); + talloc_free(mem_ctx); + return 0; +} diff --git a/source4/kdc/mit-kdb/kdb_samba.c b/source4/kdc/mit-kdb/kdb_samba.c new file mode 100644 index 0000000..0ff1bfe --- /dev/null +++ b/source4/kdc/mit-kdb/kdb_samba.c @@ -0,0 +1,182 @@ +/* + Unix SMB/CIFS implementation. + + Samba KDB plugin for MIT Kerberos + + Copyright (c) 2010 Simo Sorce <idra@samba.org>. + Copyright (c) 2014 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" + +#include "system/kerberos.h" + +#include <profile.h> +#include <kdb.h> + +#include "kdc/samba_kdc.h" +#include "kdc/mit_samba.h" +#include "kdb_samba.h" + +static krb5_error_code kdb_samba_init_library(void) +{ + return 0; +} + +static krb5_error_code kdb_samba_fini_library(void) +{ + return 0; +} + +static krb5_error_code kdb_samba_init_module(krb5_context context, + char *conf_section, + char **db_args, + int mode) +{ + /* TODO mit_samba_context_init */ + struct mit_samba_context *mit_ctx; + krb5_error_code code; + int rc; + + rc = mit_samba_context_init(&mit_ctx); + if (rc != 0) { + return ENOMEM; + } + + + code = krb5_db_set_context(context, mit_ctx); + + return code; +} +static krb5_error_code kdb_samba_fini_module(krb5_context context) +{ + struct mit_samba_context *mit_ctx; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return 0; + } + + mit_samba_context_free(mit_ctx); + + return 0; +} + +static krb5_error_code kdb_samba_db_create(krb5_context context, + char *conf_section, + char **db_args) +{ + /* NOTE: used only by kadmin */ + return KRB5_KDB_DBTYPE_NOSUP; +} + +static krb5_error_code kdb_samba_db_destroy(krb5_context context, + char *conf_section, + char **db_args) +{ + /* NOTE: used only by kadmin */ + return KRB5_KDB_DBTYPE_NOSUP; +} + +static krb5_error_code kdb_samba_db_get_age(krb5_context context, + char *db_name, + time_t *age) +{ + /* TODO: returns last modification time of the db */ + + /* NOTE: used by and affects only lookaside cache, + * defer implementation until needed as samba doesn't keep this + * specific value readily available and it would require a full + * database search to get it. */ + + *age = time(NULL); + + return 0; +} + +static krb5_error_code kdb_samba_db_lock(krb5_context context, int kmode) +{ + + /* NOTE: important only for kadmin */ + /* NOTE: deferred as samba's DB cannot be easily locked and doesn't + * really make sense to do so anyway as the db is shared and support + * transactions */ + return 0; +} + +static krb5_error_code kdb_samba_db_unlock(krb5_context context) +{ + + /* NOTE: important only for kadmin */ + /* NOTE: deferred as samba's DB cannot be easily locked and doesn't + * really make sense to do so anyway as the db is shared and support + * transactions */ + return 0; +} + +static void kdb_samba_db_free_principal_e_data(krb5_context context, + krb5_octet *e_data) +{ + struct samba_kdc_entry *skdc_entry; + + skdc_entry = talloc_get_type_abort(e_data, + struct samba_kdc_entry); + skdc_entry->kdc_entry = NULL; + TALLOC_FREE(skdc_entry); +} + +kdb_vftabl kdb_function_table = { + .maj_ver = KRB5_KDB_DAL_MAJOR_VERSION, + .min_ver = KRB5_KDB_DAL_MAJOR_VERSION == 6 ? 1 : 0, + + .init_library = kdb_samba_init_library, + .fini_library = kdb_samba_fini_library, + .init_module = kdb_samba_init_module, + .fini_module = kdb_samba_fini_module, + + .create = kdb_samba_db_create, + .destroy = kdb_samba_db_destroy, + .get_age = kdb_samba_db_get_age, + .lock = kdb_samba_db_lock, + .unlock = kdb_samba_db_unlock, + + .get_principal = kdb_samba_db_get_principal, + .put_principal = kdb_samba_db_put_principal, + .delete_principal = kdb_samba_db_delete_principal, + + .iterate = kdb_samba_db_iterate, + + .fetch_master_key = kdb_samba_fetch_master_key, + .fetch_master_key_list = kdb_samba_fetch_master_key_list, + + .change_pwd = kdb_samba_change_pwd, + + .decrypt_key_data = kdb_samba_dbekd_decrypt_key_data, + .encrypt_key_data = kdb_samba_dbekd_encrypt_key_data, + + .check_policy_as = kdb_samba_db_check_policy_as, + .audit_as_req = kdb_samba_db_audit_as_req, + .check_allowed_to_delegate = kdb_samba_db_check_allowed_to_delegate, + + .free_principal_e_data = kdb_samba_db_free_principal_e_data, + +#if KRB5_KDB_DAL_MAJOR_VERSION >= 9 + .allowed_to_delegate_from = kdb_samba_db_allowed_to_delegate_from, + .issue_pac = kdb_samba_db_issue_pac, +#else + .sign_authdata = kdb_samba_db_sign_auth_data, +#endif +}; diff --git a/source4/kdc/mit-kdb/kdb_samba.h b/source4/kdc/mit-kdb/kdb_samba.h new file mode 100644 index 0000000..138105e --- /dev/null +++ b/source4/kdc/mit-kdb/kdb_samba.h @@ -0,0 +1,184 @@ +/* + Unix SMB/CIFS implementation. + + Samba KDB plugin for MIT Kerberos + + Copyright (c) 2009 Simo Sorce <idra@samba.org>. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _KDB_SAMBA_H_ +#define _KDB_SAMBA_H_ + +#include <stdbool.h> + +#include <krb5/krb5.h> +#include <krb5/plugin.h> + +#define PAC_LOGON_INFO 1 + +#ifndef discard_const_p +#if defined(__intptr_t_defined) || defined(HAVE_INTPTR_T) +# define discard_const_p(type, ptr) ((type *)((intptr_t)(ptr))) +#else +# define discard_const_p(type, ptr) ((type *)(ptr)) +#endif +#endif + +/* from kdb_samba_common.c */ + +struct mit_samba_context *ks_get_context(krb5_context kcontext); + +krb5_error_code ks_get_principal(krb5_context context, + krb5_const_principal principal, + unsigned int kflags, + krb5_db_entry **kentry); + +void ks_free_principal(krb5_context context, krb5_db_entry *entry); + +bool ks_data_eq_string(krb5_data d, const char *s); + +krb5_data ks_make_data(void *data, unsigned int len); + +krb5_boolean ks_is_kadmin(krb5_context context, + krb5_const_principal princ); + +krb5_boolean ks_is_kadmin_history(krb5_context context, + krb5_const_principal princ); + +krb5_boolean ks_is_kadmin_changepw(krb5_context context, + krb5_const_principal princ); + +krb5_boolean ks_is_kadmin_admin(krb5_context context, + krb5_const_principal princ); + +/* from kdb_samba_principals.c */ + +krb5_error_code kdb_samba_db_get_principal(krb5_context context, + krb5_const_principal princ, + unsigned int kflags, + krb5_db_entry **kentry); + +krb5_error_code kdb_samba_db_put_principal(krb5_context context, + krb5_db_entry *entry, + char **db_args); + +krb5_error_code kdb_samba_db_delete_principal(krb5_context context, + krb5_const_principal princ); + +krb5_error_code kdb_samba_db_iterate(krb5_context context, + char *match_entry, + int (*func)(krb5_pointer, krb5_db_entry *), + krb5_pointer func_arg, + krb5_flags iterflags); + +/* from kdb_samba_masterkey.c */ + +krb5_error_code kdb_samba_fetch_master_key(krb5_context context, + krb5_principal name, + krb5_keyblock *key, + krb5_kvno *kvno, + char *db_args); + +krb5_error_code kdb_samba_fetch_master_key_list(krb5_context context, + krb5_principal mname, + const krb5_keyblock *key, + krb5_keylist_node **mkeys_list); + +/* from kdb_samba_pac.c */ + +krb5_error_code kdb_samba_dbekd_decrypt_key_data(krb5_context context, + const krb5_keyblock *mkey, + const krb5_key_data *key_data, + krb5_keyblock *kkey, + krb5_keysalt *keysalt); + +krb5_error_code kdb_samba_dbekd_encrypt_key_data(krb5_context context, + const krb5_keyblock *mkey, + const krb5_keyblock *kkey, + const krb5_keysalt *keysalt, + int keyver, + krb5_key_data *key_data); + +/* from kdb_samba_policies.c */ +krb5_error_code kdb_samba_db_issue_pac(krb5_context context, + unsigned int flags, + krb5_db_entry *client, + krb5_keyblock *replaced_reply_key, + krb5_db_entry *server, + krb5_db_entry *signing_krbtgt, + krb5_timestamp authtime, + krb5_pac old_pac, + krb5_pac new_pac, + krb5_data ***auth_indicators); + +krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + unsigned int flags, + krb5_const_principal client_princ, + krb5_const_principal server_princ, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, + krb5_db_entry *local_krbtgt, + krb5_keyblock *client_key, + krb5_keyblock *server_key, + krb5_keyblock *krbtgt_key, + krb5_keyblock *local_krbtgt_key, + krb5_keyblock *session_key, + krb5_timestamp authtime, + krb5_authdata **tgt_auth_data, + void *authdata_info, + krb5_data ***auth_indicators, + krb5_authdata ***signed_auth_data); + +krb5_error_code kdb_samba_db_check_policy_as(krb5_context context, + krb5_kdc_req *kdcreq, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_timestamp kdc_time, + const char **status, + krb5_pa_data ***e_data_out); + +krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + krb5_const_principal client, + const krb5_db_entry *server, + krb5_const_principal proxy); + +krb5_error_code kdb_samba_db_allowed_to_delegate_from( + krb5_context context, + krb5_const_principal client, + krb5_const_principal server, + krb5_pac header_pac, + const krb5_db_entry *proxy); + +void kdb_samba_db_audit_as_req(krb5_context kcontext, + krb5_kdc_req *request, + const krb5_address *local_addr, + const krb5_address *remote_addr, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_timestamp authtime, + krb5_error_code error_code); + +/* from kdb_samba_change_pwd.c */ + +krb5_error_code kdb_samba_change_pwd(krb5_context context, + krb5_keyblock *master_key, + krb5_key_salt_tuple *ks_tuple, + int ks_tuple_count, char *passwd, + int new_kvno, krb5_boolean keepold, + krb5_db_entry *db_entry); + +#endif /* _KDB_SAMBA_H_ */ diff --git a/source4/kdc/mit-kdb/kdb_samba_change_pwd.c b/source4/kdc/mit-kdb/kdb_samba_change_pwd.c new file mode 100644 index 0000000..ad7bb5d --- /dev/null +++ b/source4/kdc/mit-kdb/kdb_samba_change_pwd.c @@ -0,0 +1,59 @@ +/* + Unix SMB/CIFS implementation. + + Samba KDB plugin for MIT Kerberos + + Copyright (c) 2010 Simo Sorce <idra@samba.org>. + Copyright (c) 2014 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" + +#include "system/kerberos.h" + +#include <profile.h> +#include <kdb.h> + +#include "kdc/mit_samba.h" +#include "kdb_samba.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_KERBEROS + +krb5_error_code kdb_samba_change_pwd(krb5_context context, + krb5_keyblock *master_key, + krb5_key_salt_tuple *ks_tuple, + int ks_tuple_count, char *passwd, + int new_kvno, krb5_boolean keepold, + krb5_db_entry *db_entry) +{ + struct mit_samba_context *mit_ctx; + krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + code = mit_samba_kpasswd_change_password(mit_ctx, passwd, db_entry); + if (code != 0) { + goto cleanup; + } + +cleanup: + + return code; +} diff --git a/source4/kdc/mit-kdb/kdb_samba_common.c b/source4/kdc/mit-kdb/kdb_samba_common.c new file mode 100644 index 0000000..1ad1c14 --- /dev/null +++ b/source4/kdc/mit-kdb/kdb_samba_common.c @@ -0,0 +1,114 @@ +/* + Unix SMB/CIFS implementation. + + Samba KDB plugin for MIT Kerberos + + Copyright (c) 2010 Simo Sorce <idra@samba.org>. + Copyright (c) 2014 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" + +#include "system/kerberos.h" + +#include <profile.h> +#include <kdb.h> + +#include "kdc/mit_samba.h" +#include "kdb_samba.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_KERBEROS + +struct mit_samba_context *ks_get_context(krb5_context kcontext) +{ + struct mit_samba_context *mit_ctx = NULL; + void *db_ctx = NULL; + krb5_error_code code; + + code = krb5_db_get_context(kcontext, &db_ctx); + if (code != 0) { + return NULL; + } + + mit_ctx = talloc_get_type_abort(db_ctx, struct mit_samba_context); + + /* + * This is nomrally the starting point for Kerberos operations in + * MIT KRB5, so reset errno to 0 for possible com_err debug messages. + */ + errno = 0; + + return mit_ctx; +} + +bool ks_data_eq_string(krb5_data d, const char *s) +{ + int rc; + + if (d.length != strlen(s) || d.length == 0) { + return false; + } + + rc = memcmp(d.data, s, d.length); + if (rc != 0) { + return false; + } + + return true; +} + +krb5_data ks_make_data(void *data, unsigned int len) +{ + krb5_data d; + + d.magic = KV5M_DATA; + d.data = data; + d.length = len; + + return d; +} + +krb5_boolean ks_is_kadmin(krb5_context context, + krb5_const_principal princ) +{ + return krb5_princ_size(context, princ) >= 1 && + ks_data_eq_string(princ->data[0], "kadmin"); +} + +krb5_boolean ks_is_kadmin_history(krb5_context context, + krb5_const_principal princ) +{ + return krb5_princ_size(context, princ) == 2 && + ks_data_eq_string(princ->data[0], "kadmin") && + ks_data_eq_string(princ->data[1], "history"); +} + +krb5_boolean ks_is_kadmin_changepw(krb5_context context, + krb5_const_principal princ) +{ + return krb5_princ_size(context, princ) == 2 && + ks_data_eq_string(princ->data[0], "kadmin") && + ks_data_eq_string(princ->data[1], "changepw"); +} + +krb5_boolean ks_is_kadmin_admin(krb5_context context, + krb5_const_principal princ) +{ + return krb5_princ_size(context, princ) == 2 && + ks_data_eq_string(princ->data[0], "kadmin") && + ks_data_eq_string(princ->data[1], "admin"); +} diff --git a/source4/kdc/mit-kdb/kdb_samba_masterkey.c b/source4/kdc/mit-kdb/kdb_samba_masterkey.c new file mode 100644 index 0000000..b068d96 --- /dev/null +++ b/source4/kdc/mit-kdb/kdb_samba_masterkey.c @@ -0,0 +1,69 @@ +/* + Unix SMB/CIFS implementation. + + Samba KDB plugin for MIT Kerberos + + Copyright (c) 2010 Simo Sorce <idra@samba.org>. + Copyright (c) 2014 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + + +#include "includes.h" + +#include "system/kerberos.h" + +#include <profile.h> +#include <kdb.h> + +#include "kdc/mit_samba.h" +#include "kdb_samba.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_KERBEROS + +krb5_error_code kdb_samba_fetch_master_key(krb5_context context, + krb5_principal name, + krb5_keyblock *key, + krb5_kvno *kvno, + char *db_args) +{ + return 0; +} + +krb5_error_code kdb_samba_fetch_master_key_list(krb5_context context, + krb5_principal mname, + const krb5_keyblock *key, + krb5_keylist_node **mkeys_list) +{ + krb5_keylist_node *mkey; + + /* + * NOTE: samba does not support master keys + * so just return a dummy key + */ + mkey = calloc(1, sizeof(krb5_keylist_node)); + if (mkey == NULL) { + return ENOMEM; + } + + mkey->keyblock.magic = KV5M_KEYBLOCK; + mkey->keyblock.enctype = ENCTYPE_UNKNOWN; + mkey->kvno = 1; + + *mkeys_list = mkey; + + return 0; +} diff --git a/source4/kdc/mit-kdb/kdb_samba_pac.c b/source4/kdc/mit-kdb/kdb_samba_pac.c new file mode 100644 index 0000000..75b05a6 --- /dev/null +++ b/source4/kdc/mit-kdb/kdb_samba_pac.c @@ -0,0 +1,115 @@ +/* + Unix SMB/CIFS implementation. + + Samba KDB plugin for MIT Kerberos + + Copyright (c) 2010 Simo Sorce <idra@samba.org>. + Copyright (c) 2014 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" + +#include "system/kerberos.h" + +#include <profile.h> +#include <kdb.h> + +#include "kdc/mit_samba.h" +#include "kdb_samba.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_KERBEROS + +krb5_error_code kdb_samba_dbekd_decrypt_key_data(krb5_context context, + const krb5_keyblock *mkey, + const krb5_key_data *key_data, + krb5_keyblock *kkey, + krb5_keysalt *keysalt) +{ + /* + * NOTE: Samba doesn't use a master key, so we will just copy + * the contents around untouched. + */ + ZERO_STRUCTP(kkey); + + kkey->magic = KV5M_KEYBLOCK; + kkey->enctype = key_data->key_data_type[0]; + kkey->contents = malloc(key_data->key_data_length[0]); + if (kkey->contents == NULL) { + return ENOMEM; + } + memcpy(kkey->contents, + key_data->key_data_contents[0], + key_data->key_data_length[0]); + kkey->length = key_data->key_data_length[0]; + + if (keysalt != NULL) { + keysalt->type = key_data->key_data_type[1]; + keysalt->data.data = malloc(key_data->key_data_length[1]); + if (keysalt->data.data == NULL) { + free(kkey->contents); + return ENOMEM; + } + memcpy(keysalt->data.data, + key_data->key_data_contents[1], + key_data->key_data_length[1]); + keysalt->data.length = key_data->key_data_length[1]; + } + + return 0; +} + +krb5_error_code kdb_samba_dbekd_encrypt_key_data(krb5_context context, + const krb5_keyblock *mkey, + const krb5_keyblock *kkey, + const krb5_keysalt *keysalt, + int keyver, + krb5_key_data *key_data) +{ + /* + * NOTE: samba doesn't use a master key, so we will just copy + * the contents around untouched. + */ + + ZERO_STRUCTP(key_data); + + key_data->key_data_ver = KRB5_KDB_V1_KEY_DATA_ARRAY; + key_data->key_data_kvno = keyver; + key_data->key_data_type[0] = kkey->enctype; + key_data->key_data_contents[0] = malloc(kkey->length); + if (key_data->key_data_contents[0] == NULL) { + return ENOMEM; + } + memcpy(key_data->key_data_contents[0], + kkey->contents, + kkey->length); + key_data->key_data_length[0] = kkey->length; + + if (keysalt != NULL) { + key_data->key_data_type[1] = keysalt->type; + key_data->key_data_contents[1] = malloc(keysalt->data.length); + if (key_data->key_data_contents[1] == NULL) { + free(key_data->key_data_contents[0]); + return ENOMEM; + } + memcpy(key_data->key_data_contents[1], + keysalt->data.data, + keysalt->data.length); + key_data->key_data_length[1] = keysalt->data.length; + } + + return 0; +} diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c new file mode 100644 index 0000000..0004854 --- /dev/null +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c @@ -0,0 +1,769 @@ +/* + Unix SMB/CIFS implementation. + + Samba KDB plugin for MIT Kerberos + + Copyright (c) 2010 Simo Sorce <idra@samba.org>. + Copyright (c) 2014-2021 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "lib/replace/replace.h" +#include "lib/replace/system/kerberos.h" +#include "lib/util/data_blob.h" +#include "lib/util/debug.h" +#include "lib/util/fault.h" +#include "lib/util/memory.h" + +#include <profile.h> +#include <kdb.h> + +#include "kdc/mit_samba.h" +#include "kdb_samba.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_KERBEROS + +/* FIXME: This is a krb5 function which is exported, but in no header */ +extern krb5_error_code decode_krb5_padata_sequence(const krb5_data *output, + krb5_pa_data ***rep); + +static krb5_error_code ks_get_netbios_name(krb5_address **addrs, char **name) +{ + char *nb_name = NULL; + int len, i; + + for (i = 0; addrs[i]; i++) { + if (addrs[i]->addrtype != ADDRTYPE_NETBIOS) { + continue; + } + len = MIN(addrs[i]->length, 15); + nb_name = strndup((const char *)addrs[i]->contents, len); + if (!nb_name) { + return ENOMEM; + } + break; + } + + if (nb_name) { + /* Strip space padding */ + i = strlen(nb_name) - 1; + for (i = strlen(nb_name) - 1; + i > 0 && nb_name[i] == ' '; + i--) { + nb_name[i] = '\0'; + } + } + + *name = nb_name; + + return 0; +} + +krb5_error_code kdb_samba_db_check_policy_as(krb5_context context, + krb5_kdc_req *kdcreq, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_timestamp kdc_time, + const char **status, + krb5_pa_data ***e_data_out) +{ + struct mit_samba_context *mit_ctx; + krb5_error_code code; + char *client_name = NULL; + char *server_name = NULL; + char *netbios_name = NULL; + char *realm = NULL; + bool password_change = false; + krb5_const_principal client_princ; + DATA_BLOB int_data = { NULL, 0 }; + krb5_data d; + krb5_pa_data **e_data; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + /* Prefer canonicalised name from client entry */ + client_princ = client ? client->princ : kdcreq->client; + + if (client_princ == NULL || ks_is_kadmin(context, client_princ)) { + return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; + } + + if (krb5_princ_size(context, kdcreq->server) == 2 && + ks_is_kadmin_changepw(context, kdcreq->server)) { + code = krb5_get_default_realm(context, &realm); + if (code) { + goto done; + } + + if (ks_data_eq_string(kdcreq->server->realm, realm)) { + password_change = true; + } + } + + code = krb5_unparse_name(context, kdcreq->server, &server_name); + if (code) { + goto done; + } + + code = krb5_unparse_name(context, client_princ, &client_name); + if (code) { + goto done; + } + + if (kdcreq->addresses) { + code = ks_get_netbios_name(kdcreq->addresses, &netbios_name); + if (code) { + goto done; + } + } + + code = mit_samba_check_client_access(mit_ctx, + client, + client_name, + server, + server_name, + netbios_name, + password_change, + &int_data); + + if (int_data.length && int_data.data) { + + /* make sure the mapped return code is returned - gd */ + int code_tmp; + + d = ks_make_data(int_data.data, int_data.length); + + code_tmp = decode_krb5_padata_sequence(&d, &e_data); + if (code_tmp == 0) { + *e_data_out = e_data; + } + } +done: + free(realm); + free(server_name); + free(client_name); + free(netbios_name); + + return code; +} + +static krb5_error_code ks_get_pac(krb5_context context, + uint32_t flags, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_keyblock *client_key, + krb5_pac *pac) +{ + struct mit_samba_context *mit_ctx; + krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + code = mit_samba_get_pac(mit_ctx, + context, + flags, + client, + server, + client_key, + pac); + if (code != 0) { + return code; + } + + return code; +} + +#if KRB5_KDB_DAL_MAJOR_VERSION < 9 +static krb5_error_code ks_verify_pac(krb5_context context, + unsigned int flags, + krb5_const_principal client_princ, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, + krb5_keyblock *server_key, + krb5_keyblock *krbtgt_key, + krb5_timestamp authtime, + krb5_authdata **tgt_auth_data, + krb5_pac *pac) +{ + struct mit_samba_context *mit_ctx; + krb5_authdata **authdata = NULL; + krb5_pac ipac = NULL; + DATA_BLOB logon_data = { NULL, 0 }; + krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + /* find the existing PAC, if present */ + code = krb5_find_authdata(context, + tgt_auth_data, + NULL, + KRB5_AUTHDATA_WIN2K_PAC, + &authdata); + if (code != 0) { + return code; + } + + /* no pac data */ + if (authdata == NULL) { + return 0; + } + + SMB_ASSERT(authdata[0] != NULL); + + if (authdata[1] != NULL) { + code = KRB5KDC_ERR_BADOPTION; /* XXX */ + goto done; + } + + code = krb5_pac_parse(context, + authdata[0]->contents, + authdata[0]->length, + &ipac); + if (code != 0) { + goto done; + } + + /* TODO: verify this is correct + * + * In the constrained delegation case, the PAC is from a service + * ticket rather than a TGT; we must verify the server and KDC + * signatures to assert that the server did not forge the PAC. + */ + if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { + code = krb5_pac_verify(context, + ipac, + authtime, + client_princ, + server_key, + krbtgt_key); + } else { + code = krb5_pac_verify(context, + ipac, + authtime, + client_princ, + krbtgt_key, + NULL); + } + if (code != 0) { + goto done; + } + + /* check and update PAC */ + code = krb5_pac_parse(context, + authdata[0]->contents, + authdata[0]->length, + pac); + if (code != 0) { + goto done; + } + + code = mit_samba_reget_pac(mit_ctx, + context, + flags, + client_princ, + client, + server, + krbtgt, + krbtgt_key, + pac); + +done: + krb5_free_authdata(context, authdata); + krb5_pac_free(context, ipac); + free(logon_data.data); + + return code; +} + +krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + unsigned int flags, + krb5_const_principal client_princ, + krb5_const_principal server_princ, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, + krb5_db_entry *local_krbtgt, + krb5_keyblock *client_key, + krb5_keyblock *server_key, + krb5_keyblock *krbtgt_key, + krb5_keyblock *local_krbtgt_key, + krb5_keyblock *session_key, + krb5_timestamp authtime, + krb5_authdata **tgt_auth_data, + void *authdata_info, + krb5_data ***auth_indicators, + krb5_authdata ***signed_auth_data) +{ + krb5_const_principal ks_client_princ = NULL; + krb5_db_entry *client_entry = NULL; + krb5_authdata **pac_auth_data = NULL; + krb5_authdata **authdata = NULL; + krb5_boolean is_as_req; + krb5_error_code code; + krb5_pac pac = NULL; + krb5_data pac_data; + bool with_pac = false; + bool generate_pac = false; + char *client_name = NULL; + + + krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; + krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; + + /* FIXME: We don't support S4U yet */ + if (flags & KRB5_KDB_FLAGS_S4U) { + return KRB5_KDB_DBTYPE_NOSUP; + } + + is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); + + /* + * When using s4u2proxy client_princ actually refers to the proxied user + * while client->princ to the proxy service asking for the TGS on behalf + * of the proxied user. So always use client_princ in preference. + * + * Note that when client principal is not NULL, client entry might be + * NULL for cross-realm case, so we need to make sure to not + * dereference NULL pointer here. + */ + if (client_princ != NULL) { + ks_client_princ = client_princ; + if (!is_as_req) { + krb5_boolean is_equal = false; + + if (client != NULL && client->princ != NULL) { + is_equal = + krb5_principal_compare(context, + client_princ, + client->princ); + } + + /* + * When client principal is the same as supplied client + * entry, don't fetch it. + */ + if (!is_equal) { + code = ks_get_principal(context, + ks_client_princ, + 0, + &client_entry); + if (code != 0) { + (void)krb5_unparse_name(context, + ks_client_princ, + &client_name); + + DBG_DEBUG("We didn't find the client " + "principal [%s] in our " + "database.\n", + client_name); + SAFE_FREE(client_name); + + /* + * If we didn't find client_princ in our + * database it might be from another + * realm. + */ + client_entry = NULL; + } + } + } + } else { + if (client == NULL) { + *signed_auth_data = NULL; + return 0; + } + ks_client_princ = client->princ; + } + + if (client_entry == NULL) { + client_entry = client; + } + + if (is_as_req) { + with_pac = mit_samba_princ_needs_pac(client_entry); + } else { + with_pac = mit_samba_princ_needs_pac(server); + } + + code = krb5_unparse_name(context, + client_princ, + &client_name); + if (code != 0) { + goto done; + } + + if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC) != 0) { + generate_pac = true; + } + + DBG_DEBUG("*** Sign data for client principal: %s [%s %s%s]\n", + client_name, + is_as_req ? "AS-REQ" : "TGS_REQ", + with_pac ? is_as_req ? "WITH_PAC" : "FIND_PAC" : "NO_PAC", + generate_pac ? " GENERATE_PAC" : ""); + + /* + * Generate PAC for the AS-REQ or check or generate one for the TGS if + * needed. + */ + if (with_pac && generate_pac) { + DBG_DEBUG("Generate PAC for AS-REQ [%s]\n", client_name); + + code = krb5_pac_init(context, &pac); + if (code != 0) { + goto done; + } + + code = ks_get_pac(context, + flags, + client_entry, + server, + NULL, + &pac); + if (code != 0) { + goto done; + } + } else if (with_pac && !is_as_req) { + /* + * Find the PAC in the TGS, if one exists. + */ + code = krb5_find_authdata(context, + tgt_auth_data, + NULL, + KRB5_AUTHDATA_WIN2K_PAC, + &pac_auth_data); + if (code != 0) { + DBG_ERR("krb5_find_authdata failed: %d\n", code); + goto done; + } + DBG_DEBUG("Found PAC data for TGS-REQ [%s]\n", client_name); + + if (pac_auth_data != NULL && pac_auth_data[0] != NULL) { + if (pac_auth_data[1] != NULL) { + DBG_ERR("Invalid PAC data!\n"); + code = KRB5KDC_ERR_BADOPTION; + goto done; + } + + DBG_DEBUG("Verify PAC for TGS [%s]\n", + client_name); + + code = ks_verify_pac(context, + flags, + ks_client_princ, + client_entry, + server, + krbtgt, + server_key, + krbtgt_key, + authtime, + tgt_auth_data, + &pac); + if (code != 0) { + goto done; + } + } else { + if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { + DBG_DEBUG("Generate PAC for constrained" + "delegation TGS [%s]\n", + client_name); + + code = krb5_pac_init(context, &pac); + if (code != 0) { + goto done; + } + + code = ks_get_pac(context, + flags, + client_entry, + server, + NULL, + &pac); + if (code != 0 && code != ENOENT) { + goto done; + } + } + } + } + + if (pac == NULL) { + DBG_DEBUG("No PAC data - we're done [%s]\n", client_name); + *signed_auth_data = NULL; + code = 0; + goto done; + } + + DBG_DEBUG("Signing PAC for %s [%s]\n", + is_as_req ? "AS-REQ" : "TGS-REQ", + client_name); + code = krb5_pac_sign(context, pac, authtime, ks_client_princ, + server_key, krbtgt_key, &pac_data); + if (code != 0) { + DBG_ERR("krb5_pac_sign failed: %d\n", code); + goto done; + } + + authdata = calloc(2, sizeof(krb5_authdata *)); + if (authdata == NULL) { + goto done; + } + + authdata[0] = malloc(sizeof(krb5_authdata)); + if (authdata[0] == NULL) { + goto done; + } + + /* put in signed data */ + authdata[0]->magic = KV5M_AUTHDATA; + authdata[0]->ad_type = KRB5_AUTHDATA_WIN2K_PAC; + authdata[0]->contents = (krb5_octet *)pac_data.data; + authdata[0]->length = pac_data.length; + + code = krb5_encode_authdata_container(context, + KRB5_AUTHDATA_IF_RELEVANT, + authdata, + signed_auth_data); + if (code != 0) { + goto done; + } + + code = 0; + +done: + if (client_entry != NULL && client_entry != client) { + ks_free_principal(context, client_entry); + } + SAFE_FREE(client_name); + krb5_free_authdata(context, authdata); + krb5_pac_free(context, pac); + + return code; +} +#else /* KRB5_KDB_DAL_MAJOR_VERSION >= 9 */ +static krb5_error_code ks_update_pac(krb5_context context, + int flags, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *signing_krbtgt, + krb5_pac old_pac, + krb5_pac new_pac) +{ + struct mit_samba_context *mit_ctx = NULL; + krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + code = mit_samba_update_pac(mit_ctx, + context, + flags, + client, + server, + signing_krbtgt, + old_pac, + new_pac); + if (code != 0) { + return code; + } + + return code; +} + +krb5_error_code kdb_samba_db_issue_pac(krb5_context context, + unsigned int flags, + krb5_db_entry *client, + krb5_keyblock *replaced_reply_key, + krb5_db_entry *server, + krb5_db_entry *signing_krbtgt, + krb5_timestamp authtime, + krb5_pac old_pac, + krb5_pac new_pac, + krb5_data ***auth_indicators) +{ + char *client_name = NULL; + char *server_name = NULL; + krb5_error_code code = EINVAL; + + /* The KDC handles both signing and verification for us. */ + + if (client != NULL) { + code = krb5_unparse_name(context, + client->princ, + &client_name); + if (code != 0) { + return code; + } + } + + if (server != NULL) { + code = krb5_unparse_name(context, + server->princ, + &server_name); + if (code != 0) { + SAFE_FREE(client_name); + return code; + } + } + + /* + * Get a new PAC for AS-REQ or S4U2Self for our realm. + * + * For a simple cross-realm S4U2Proxy there will be the following TGS + * requests after the client realm is identified: + * + * 1. server@SREALM to SREALM for krbtgt/CREALM@SREALM -- a regular TGS + * request with server's normal TGT and no S4U2Self padata. + * 2. server@SREALM to CREALM for server@SREALM (expressed as an + * enterprise principal), with the TGT from #1 as header ticket and + * S4U2Self padata identifying the client. + * 3. server@SREALM to SREALM for server@SREALM with S4U2Self padata, + * with the referral TGT from #2 as header ticket + * + * In request 2 the PROTOCOL_TRANSITION and CROSS_REALM flags are set, + * and the request is for a local client (so client != NULL) and we + * want to make a new PAC. + * + * In request 3 the PROTOCOL_TRANSITION and CROSS_REALM flags are also + * set, but the request is for a non-local client (so client == NULL) + * and we want to copy the subject PAC contained in the referral TGT. + */ + if (old_pac == NULL || + (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { + DBG_NOTICE("Generate PAC for AS-REQ [client=%s, flags=%#08x]\n", + client_name != NULL ? client_name : "<unknown>", + flags); + + code = ks_get_pac(context, + flags, + client, + server, + replaced_reply_key, + &new_pac); + } else { + DBG_NOTICE("Update PAC for TGS-REQ [client=%s, server=%s, " + "flags=%#08x]\n", + client_name != NULL ? client_name : "<unknown>", + server_name != NULL ? server_name : "<unknown>", + flags); + + code = ks_update_pac(context, + flags, + client, + server, + signing_krbtgt, + old_pac, + new_pac); + } + SAFE_FREE(client_name); + SAFE_FREE(server_name); + + return code; +} +#endif /* KRB5_KDB_DAL_MAJOR_VERSION */ + +krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + krb5_const_principal client, + const krb5_db_entry *server, + krb5_const_principal proxy) +{ + struct mit_samba_context *mit_ctx = NULL; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + return mit_samba_check_s4u2proxy(mit_ctx, + server, + proxy); + +} + + +#if KRB5_KDB_DAL_MAJOR_VERSION >= 9 +krb5_error_code kdb_samba_db_allowed_to_delegate_from( + krb5_context context, + krb5_const_principal client_principal, + krb5_const_principal server_principal, + krb5_pac header_pac, + const krb5_db_entry *proxy) +{ + struct mit_samba_context *mit_ctx = NULL; + krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + code = mit_samba_check_allowed_to_delegate_from(mit_ctx, + client_principal, + server_principal, + header_pac, + proxy); + + return code; +} +#endif + + +static void samba_bad_password_count(krb5_db_entry *client, + krb5_error_code error_code) +{ + switch (error_code) { + case 0: + mit_samba_zero_bad_password_count(client); + break; + case KRB5KDC_ERR_PREAUTH_FAILED: + case KRB5KRB_AP_ERR_BAD_INTEGRITY: + mit_samba_update_bad_password_count(client); + break; + } +} + +void kdb_samba_db_audit_as_req(krb5_context context, + krb5_kdc_req *request, + const krb5_address *local_addr, + const krb5_address *remote_addr, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_timestamp authtime, + krb5_error_code error_code) +{ + /* + * FIXME: This segfaulted with a FAST test + * FIND_FAST: <unknown client> for <unknown server>, Unknown FAST armor type 0 + */ + if (client == NULL) { + return; + } + + samba_bad_password_count(client, error_code); + + /* TODO: perform proper audit logging for addresses */ +} diff --git a/source4/kdc/mit-kdb/kdb_samba_principals.c b/source4/kdc/mit-kdb/kdb_samba_principals.c new file mode 100644 index 0000000..2726018 --- /dev/null +++ b/source4/kdc/mit-kdb/kdb_samba_principals.c @@ -0,0 +1,397 @@ +/* + Unix SMB/CIFS implementation. + + Samba KDB plugin for MIT Kerberos + + Copyright (c) 2010 Simo Sorce <idra@samba.org>. + Copyright (c) 2014 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" + +#include "system/kerberos.h" + +#include <profile.h> +#include <kdb.h> + +#include "kdc/samba_kdc.h" +#include "kdc/mit_samba.h" +#include "kdb_samba.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_KERBEROS + +#define ADMIN_LIFETIME 60*60*3 /* 3 hours */ + +krb5_error_code ks_get_principal(krb5_context context, + krb5_const_principal principal, + unsigned int kflags, + krb5_db_entry **kentry) +{ + struct mit_samba_context *mit_ctx; + krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + code = mit_samba_get_principal(mit_ctx, + principal, + kflags, + kentry); + if (code != 0) { + goto cleanup; + } + +cleanup: + + return code; +} + +static void ks_free_principal_e_data(krb5_context context, krb5_octet *e_data) +{ + struct samba_kdc_entry *skdc_entry; + + skdc_entry = talloc_get_type_abort(e_data, + struct samba_kdc_entry); + skdc_entry->kdc_entry = NULL; + TALLOC_FREE(skdc_entry); +} + +void ks_free_principal(krb5_context context, krb5_db_entry *entry) +{ + krb5_tl_data *tl_data_next = NULL; + krb5_tl_data *tl_data = NULL; + size_t i, j; + + if (entry != NULL) { + krb5_free_principal(context, entry->princ); + + for (tl_data = entry->tl_data; tl_data; tl_data = tl_data_next) { + tl_data_next = tl_data->tl_data_next; + if (tl_data->tl_data_contents != NULL) { + free(tl_data->tl_data_contents); + } + free(tl_data); + } + + if (entry->key_data != NULL) { + for (i = 0; i < entry->n_key_data; i++) { + for (j = 0; j < entry->key_data[i].key_data_ver; j++) { + if (entry->key_data[i].key_data_length[j] != 0) { + if (entry->key_data[i].key_data_contents[j] != NULL) { + memset(entry->key_data[i].key_data_contents[j], 0, entry->key_data[i].key_data_length[j]); + free(entry->key_data[i].key_data_contents[j]); + } + } + entry->key_data[i].key_data_contents[j] = NULL; + entry->key_data[i].key_data_length[j] = 0; + entry->key_data[i].key_data_type[j] = 0; + } + } + free(entry->key_data); + } + + if (entry->e_data) { + ks_free_principal_e_data(context, entry->e_data); + } + + free(entry); + } +} + +static krb5_boolean ks_is_master_key_principal(krb5_context context, + krb5_const_principal princ) +{ + return krb5_princ_size(context, princ) == 2 && + ks_data_eq_string(princ->data[0], "K") && + ks_data_eq_string(princ->data[1], "M"); +} + +static krb5_error_code ks_get_master_key_principal(krb5_context context, + krb5_const_principal princ, + krb5_db_entry **kentry_ptr) +{ + krb5_error_code code; + krb5_key_data *key_data; + krb5_timestamp now; + krb5_db_entry *kentry; + + *kentry_ptr = NULL; + + kentry = calloc(1, sizeof(krb5_db_entry)); + if (kentry == NULL) { + return ENOMEM; + } + + kentry->magic = KRB5_KDB_MAGIC_NUMBER; + kentry->len = KRB5_KDB_V1_BASE_LENGTH; + kentry->attributes = KRB5_KDB_DISALLOW_ALL_TIX; + + if (princ == NULL) { + code = krb5_parse_name(context, KRB5_KDB_M_NAME, &kentry->princ); + } else { + code = krb5_copy_principal(context, princ, &kentry->princ); + } + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + + now = time(NULL); + + code = krb5_dbe_update_mod_princ_data(context, kentry, now, kentry->princ); + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + + /* Return a dummy key */ + kentry->n_key_data = 1; + kentry->key_data = calloc(1, sizeof(krb5_key_data)); + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + + key_data = &kentry->key_data[0]; + + key_data->key_data_ver = KRB5_KDB_V1_KEY_DATA_ARRAY; + key_data->key_data_kvno = 1; + key_data->key_data_type[0] = ENCTYPE_UNKNOWN; + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + + *kentry_ptr = kentry; + + return 0; +} + +static krb5_error_code ks_create_principal(krb5_context context, + krb5_const_principal princ, + int attributes, + int max_life, + const char *password, + krb5_db_entry **kentry_ptr) +{ + krb5_error_code code; + krb5_key_data *key_data; + krb5_timestamp now; + krb5_db_entry *kentry; + krb5_keyblock key; + krb5_data salt; + krb5_data pwd; + int enctype = ENCTYPE_AES256_CTS_HMAC_SHA1_96; + int sts = KRB5_KDB_SALTTYPE_SPECIAL; + + if (princ == NULL) { + return KRB5_KDB_NOENTRY; + } + + *kentry_ptr = NULL; + + kentry = calloc(1, sizeof(krb5_db_entry)); + if (kentry == NULL) { + return ENOMEM; + } + + kentry->magic = KRB5_KDB_MAGIC_NUMBER; + kentry->len = KRB5_KDB_V1_BASE_LENGTH; + + if (attributes > 0) { + kentry->attributes = attributes; + } + + if (max_life > 0) { + kentry->max_life = max_life; + } + + code = krb5_copy_principal(context, princ, &kentry->princ); + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + + now = time(NULL); + + code = krb5_dbe_update_mod_princ_data(context, kentry, now, kentry->princ); + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + + code = mit_samba_generate_salt(&salt); + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + + if (password != NULL) { + pwd.data = strdup(password); + pwd.length = strlen(password); + } else { + /* create a random password */ + code = mit_samba_generate_random_password(&pwd); + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + } + + code = krb5_c_string_to_key(context, enctype, &pwd, &salt, &key); + SAFE_FREE(pwd.data); + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + + kentry->n_key_data = 1; + kentry->key_data = calloc(1, sizeof(krb5_key_data)); + if (code != 0) { + krb5_db_free_principal(context, kentry); + return code; + } + + key_data = &kentry->key_data[0]; + + key_data->key_data_ver = KRB5_KDB_V1_KEY_DATA_ARRAY; + key_data->key_data_kvno = 1; + key_data->key_data_type[0] = key.enctype; + key_data->key_data_length[0] = key.length; + key_data->key_data_contents[0] = key.contents; + key_data->key_data_type[1] = sts; + key_data->key_data_length[1] = salt.length; + key_data->key_data_contents[1] = (krb5_octet*)salt.data; + + *kentry_ptr = kentry; + + return 0; +} + +static krb5_error_code ks_get_admin_principal(krb5_context context, + krb5_const_principal princ, + krb5_db_entry **kentry_ptr) +{ + krb5_error_code code = EINVAL; + + code = ks_create_principal(context, + princ, + KRB5_KDB_DISALLOW_TGT_BASED, + ADMIN_LIFETIME, + NULL, + kentry_ptr); + + return code; +} + +krb5_error_code kdb_samba_db_get_principal(krb5_context context, + krb5_const_principal princ, + unsigned int kflags, + krb5_db_entry **kentry) +{ + struct mit_samba_context *mit_ctx; + krb5_error_code code; + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + if (ks_is_master_key_principal(context, princ)) { + return ks_get_master_key_principal(context, princ, kentry); + } + + /* + * Fake a kadmin/admin and kadmin/history principal so that kadmindd can + * start + */ + if (ks_is_kadmin_admin(context, princ) || + ks_is_kadmin_history(context, princ)) { + return ks_get_admin_principal(context, princ, kentry); + } + + code = ks_get_principal(context, princ, kflags, kentry); + + /* + * This restricts the changepw account so it isn't able to request a + * service ticket. It also marks the principal as the changepw service. + */ + if (ks_is_kadmin_changepw(context, princ)) { + /* FIXME: shouldn't we also set KRB5_KDB_DISALLOW_TGT_BASED ? + * testing showed that setpw kpasswd command fails then on the + * server though... */ + (*kentry)->attributes |= KRB5_KDB_PWCHANGE_SERVICE; + (*kentry)->max_life = CHANGEPW_LIFETIME; + } + + return code; +} + +krb5_error_code kdb_samba_db_put_principal(krb5_context context, + krb5_db_entry *entry, + char **db_args) +{ + + /* NOTE: deferred, samba does not allow the KDC to store + * principals for now. We should not return KRB5_KDB_DB_INUSE as this + * would result in confusing error messages after password changes. */ + return 0; +} + +krb5_error_code kdb_samba_db_delete_principal(krb5_context context, + krb5_const_principal princ) +{ + + /* NOTE: deferred, samba does not allow the KDC to delete + * principals for now */ + return KRB5_KDB_DB_INUSE; +} + +krb5_error_code kdb_samba_db_iterate(krb5_context context, + char *match_entry, + int (*func)(krb5_pointer, krb5_db_entry *), + krb5_pointer func_arg, + krb5_flags iterflags) +{ + struct mit_samba_context *mit_ctx; + krb5_db_entry *kentry = NULL; + krb5_error_code code; + + + mit_ctx = ks_get_context(context); + if (mit_ctx == NULL) { + return KRB5_KDB_DBNOTINITED; + } + + code = mit_samba_get_firstkey(mit_ctx, &kentry); + while (code == 0) { + code = (*func)(func_arg, kentry); + if (code != 0) { + break; + } + + code = mit_samba_get_nextkey(mit_ctx, &kentry); + } + + if (code == KRB5_KDB_NOENTRY) { + code = 0; + } + + return code; +} diff --git a/source4/kdc/mit-kdb/wscript_build b/source4/kdc/mit-kdb/wscript_build new file mode 100644 index 0000000..82cea4a --- /dev/null +++ b/source4/kdc/mit-kdb/wscript_build @@ -0,0 +1,22 @@ +#!/usr/bin/env python + +bld.SAMBA_LIBRARY('mit-kdb-samba', + source=''' + kdb_samba.c + kdb_samba_common.c + kdb_samba_masterkey.c + kdb_samba_pac.c + kdb_samba_policies.c + kdb_samba_principals.c + kdb_samba_change_pwd.c + ''', + private_library=True, + realname='samba.so', + install_path='${LIBDIR}/krb5/plugins/kdb', + deps=''' + MIT_SAMBA + com_err + krb5 + kdb5 + ''', + enabled=bld.CONFIG_SET('HAVE_KDB_H')) diff --git a/source4/kdc/mit_kdc_irpc.c b/source4/kdc/mit_kdc_irpc.c new file mode 100644 index 0000000..9113cf8 --- /dev/null +++ b/source4/kdc/mit_kdc_irpc.c @@ -0,0 +1,200 @@ +/* + * Unix SMB/CIFS implementation. + * + * Copyright (c) 2015 Andreas Schneider <asn@samba.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include "includes.h" +#include "system/kerberos.h" +#include "source4/auth/kerberos/kerberos.h" +#include "auth/kerberos/pac_utils.h" + +#include "librpc/gen_ndr/irpc.h" +#include "lib/messaging/irpc.h" +#include "source4/librpc/gen_ndr/ndr_irpc.h" +#include "source4/librpc/gen_ndr/irpc.h" + +#include "librpc/gen_ndr/ndr_krb5pac.h" + +#include "source4/samba/process_model.h" +#include "lib/param/param.h" + +#include "samba_kdc.h" +#include "db-glue.h" +#include "sdb.h" +#include "mit_kdc_irpc.h" + +struct mit_kdc_irpc_context { + struct task_server *task; + krb5_context krb5_context; + struct samba_kdc_db_context *db_ctx; +}; + +static NTSTATUS netr_samlogon_generic_logon(struct irpc_message *msg, + struct kdc_check_generic_kerberos *r) +{ + struct PAC_Validate pac_validate; + DATA_BLOB pac_chksum; + struct PAC_SIGNATURE_DATA pac_kdc_sig; + struct mit_kdc_irpc_context *mki_ctx = + talloc_get_type(msg->private_data, + struct mit_kdc_irpc_context); + enum ndr_err_code ndr_err; + int code; + krb5_principal principal; + struct sdb_entry sentry = {}; + struct sdb_keys skeys; + unsigned int i; + const uint8_t *d = NULL; + + /* There is no reply to this request */ + r->out.generic_reply = data_blob(NULL, 0); + + ndr_err = + ndr_pull_struct_blob(&r->in.generic_request, + msg, + &pac_validate, + (ndr_pull_flags_fn_t)ndr_pull_PAC_Validate); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + return NT_STATUS_INVALID_PARAMETER; + } + + if (pac_validate.MessageType != NETLOGON_GENERIC_KRB5_PAC_VALIDATE) { + /* + * We don't implement any other message types - such as + * certificate validation - yet + */ + return NT_STATUS_INVALID_PARAMETER; + } + + if ((pac_validate.ChecksumAndSignature.length != + (pac_validate.ChecksumLength + pac_validate.SignatureLength)) || + (pac_validate.ChecksumAndSignature.length < + pac_validate.ChecksumLength) || + (pac_validate.ChecksumAndSignature.length < + pac_validate.SignatureLength)) { + return NT_STATUS_INVALID_PARAMETER; + } + + /* PAC Checksum */ + pac_chksum = data_blob_const(pac_validate.ChecksumAndSignature.data, + pac_validate.ChecksumLength); + + /* Create the krbtgt principal */ + code = smb_krb5_make_principal(mki_ctx->krb5_context, + &principal, + lpcfg_realm(mki_ctx->task->lp_ctx), + "krbtgt", + lpcfg_realm(mki_ctx->task->lp_ctx), + NULL); + if (code != 0) { + DEBUG(0, ("Failed to create krbtgt@%s principal!\n", + lpcfg_realm(mki_ctx->task->lp_ctx))); + return NT_STATUS_NO_MEMORY; + } + + /* Get the krbtgt from the DB */ + code = samba_kdc_fetch(mki_ctx->krb5_context, + mki_ctx->db_ctx, + principal, + SDB_F_GET_KRBTGT | SDB_F_DECRYPT, + 0, + &sentry); + krb5_free_principal(mki_ctx->krb5_context, principal); + if (code != 0) { + DEBUG(0, ("Failed to fetch krbtgt@%s principal entry!\n", + lpcfg_realm(mki_ctx->task->lp_ctx))); + return NT_STATUS_LOGON_FAILURE; + } + + /* PAC Signature */ + pac_kdc_sig.type = pac_validate.SignatureType; + + d = &pac_validate.ChecksumAndSignature.data[pac_validate.ChecksumLength]; + pac_kdc_sig.signature = + data_blob_const(d, pac_validate.SignatureLength); + + /* + * Brute force variant because MIT KRB5 doesn't provide a function like + * krb5_checksum_to_enctype(). + */ + skeys = sentry.keys; + + for (i = 0; i < skeys.len; i++) { + krb5_keyblock krbtgt_keyblock = skeys.val[i].key; + + code = check_pac_checksum(pac_chksum, + &pac_kdc_sig, + mki_ctx->krb5_context, + &krbtgt_keyblock); + if (code == 0) { + break; + } + } + + sdb_entry_free(&sentry); + + if (code != 0) { + return NT_STATUS_LOGON_FAILURE; + } + + return NT_STATUS_OK; +} + +NTSTATUS samba_setup_mit_kdc_irpc(struct task_server *task) +{ + struct samba_kdc_base_context base_ctx; + struct mit_kdc_irpc_context *mki_ctx; + NTSTATUS status; + int code; + + mki_ctx = talloc_zero(task, struct mit_kdc_irpc_context); + if (mki_ctx == NULL) { + return NT_STATUS_NO_MEMORY; + } + mki_ctx->task = task; + + base_ctx.ev_ctx = task->event_ctx; + base_ctx.lp_ctx = task->lp_ctx; + + /* db-glue.h */ + status = samba_kdc_setup_db_ctx(mki_ctx, + &base_ctx, + &mki_ctx->db_ctx); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + code = smb_krb5_init_context_basic(mki_ctx, + task->lp_ctx, + &mki_ctx->krb5_context); + if (code != 0) { + return NT_STATUS_INTERNAL_ERROR; + } + + status = IRPC_REGISTER(task->msg_ctx, + irpc, + KDC_CHECK_GENERIC_KERBEROS, + netr_samlogon_generic_logon, + mki_ctx); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + irpc_add_name(task->msg_ctx, "kdc_server"); + + return status; +} diff --git a/source4/kdc/mit_kdc_irpc.h b/source4/kdc/mit_kdc_irpc.h new file mode 100644 index 0000000..943c76c --- /dev/null +++ b/source4/kdc/mit_kdc_irpc.h @@ -0,0 +1,20 @@ +/* + * Unix SMB/CIFS implementation. + * + * Copyright (c) 2015 Andreas Schneider <asn@samba.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +NTSTATUS samba_setup_mit_kdc_irpc(struct task_server *task); diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c new file mode 100644 index 0000000..bfe9748 --- /dev/null +++ b/source4/kdc/mit_samba.c @@ -0,0 +1,1066 @@ +/* + MIT-Samba4 library + + Copyright (c) 2010, Simo Sorce <idra@samba.org> + Copyright (c) 2014-2015 Guenther Deschner <gd@samba.org> + Copyright (c) 2014-2016 Andreas Schneider <asn@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#define TEVENT_DEPRECATED 1 + +#include "includes.h" +#include "param/param.h" +#include "dsdb/samdb/samdb.h" +#include "system/kerberos.h" +#include <com_err.h> +#include <kdb.h> +#include <kadm5/kadm_err.h> +#include "kdc/sdb.h" +#include "kdc/sdb_kdb.h" +#include "auth/kerberos/kerberos.h" +#include "auth/kerberos/pac_utils.h" +#include "kdc/samba_kdc.h" +#include "kdc/pac-glue.h" +#include "kdc/db-glue.h" +#include "auth/auth.h" +#include "kdc/kpasswd_glue.h" +#include "auth/auth_sam.h" + +#include "mit_samba.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_KERBEROS + +void mit_samba_context_free(struct mit_samba_context *ctx) +{ + /* free heimdal's krb5_context */ + if (ctx->context) { + krb5_free_context(ctx->context); + } + + /* then free everything else */ + talloc_free(ctx); +} + +/* + * Implemant a callback to log to the MIT KDC log facility + * + * http://web.mit.edu/kerberos/krb5-devel/doc/plugindev/general.html#logging-from-kdc-and-kadmind-plugin-modules + */ +static void mit_samba_debug(void *private_ptr, int msg_level, const char *msg) +{ + int is_error = errno; + + if (msg_level > 0) { + is_error = 0; + } + + com_err("", is_error, "%s", msg); +} + +int mit_samba_context_init(struct mit_samba_context **_ctx) +{ + NTSTATUS status; + struct mit_samba_context *ctx; + const char *s4_conf_file; + int ret; + struct samba_kdc_base_context base_ctx; + + ctx = talloc_zero(NULL, struct mit_samba_context); + if (!ctx) { + ret = ENOMEM; + goto done; + } + + base_ctx.ev_ctx = tevent_context_init(ctx); + if (!base_ctx.ev_ctx) { + ret = ENOMEM; + goto done; + } + tevent_loop_allow_nesting(base_ctx.ev_ctx); + base_ctx.lp_ctx = loadparm_init_global(false); + if (!base_ctx.lp_ctx) { + ret = ENOMEM; + goto done; + } + + debug_set_callback(NULL, mit_samba_debug); + + /* init s4 configuration */ + s4_conf_file = lpcfg_configfile(base_ctx.lp_ctx); + if (s4_conf_file != NULL) { + char *p = talloc_strdup(ctx, s4_conf_file); + if (p == NULL) { + ret = ENOMEM; + goto done; + } + lpcfg_load(base_ctx.lp_ctx, p); + TALLOC_FREE(p); + } else { + lpcfg_load_default(base_ctx.lp_ctx); + } + + status = samba_kdc_setup_db_ctx(ctx, &base_ctx, &ctx->db_ctx); + if (!NT_STATUS_IS_OK(status)) { + ret = EINVAL; + goto done; + } + + /* init heimdal's krb_context and log facilities */ + ret = smb_krb5_init_context_basic(ctx, + ctx->db_ctx->lp_ctx, + &ctx->context); + if (ret) { + goto done; + } + + ret = 0; + +done: + if (ret) { + mit_samba_context_free(ctx); + } else { + *_ctx = ctx; + } + return ret; +} + +static krb5_error_code ks_is_tgs_principal(struct mit_samba_context *ctx, + krb5_const_principal principal) +{ + char *p; + int eq = -1; + + p = smb_krb5_principal_get_comp_string(ctx, ctx->context, principal, 0); + + eq = krb5_princ_size(ctx->context, principal) == 2 && + (strcmp(p, KRB5_TGS_NAME) == 0); + + talloc_free(p); + + return eq; +} + +int mit_samba_generate_salt(krb5_data *salt) +{ + if (salt == NULL) { + return EINVAL; + } + + salt->length = 16; + salt->data = malloc(salt->length); + if (salt->data == NULL) { + return ENOMEM; + } + + generate_random_buffer((uint8_t *)salt->data, salt->length); + + return 0; +} + +int mit_samba_generate_random_password(krb5_data *pwd) +{ + TALLOC_CTX *tmp_ctx; + char *password; + + if (pwd == NULL) { + return EINVAL; + } + pwd->length = 24; + + tmp_ctx = talloc_named(NULL, + 0, + "mit_samba_create_principal_password context"); + if (tmp_ctx == NULL) { + return ENOMEM; + } + + password = generate_random_password(tmp_ctx, pwd->length, pwd->length); + if (password == NULL) { + talloc_free(tmp_ctx); + return ENOMEM; + } + + pwd->data = strdup(password); + talloc_free(tmp_ctx); + if (pwd->data == NULL) { + return ENOMEM; + } + + return 0; +} + +int mit_samba_get_principal(struct mit_samba_context *ctx, + krb5_const_principal principal, + unsigned int kflags, + krb5_db_entry **_kentry) +{ + struct sdb_entry sentry = {}; + krb5_db_entry *kentry; + int ret; + uint32_t sflags = 0; + krb5_principal referral_principal = NULL; + + kentry = calloc(1, sizeof(krb5_db_entry)); + if (kentry == NULL) { + return ENOMEM; + } + +#if KRB5_KDB_API_VERSION >= 10 + /* + * The MIT KDC code that wants the canonical name in all lookups, and + * takes care to canonicalize only when appropriate. + */ + sflags |= SDB_F_FORCE_CANON; +#endif + +#if KRB5_KDB_DAL_MAJOR_VERSION >= 9 + if (kflags & KRB5_KDB_FLAG_REFERRAL_OK) { + sflags |= SDB_F_CANON; + } + + if (kflags & KRB5_KDB_FLAG_CLIENT) { + sflags |= SDB_F_GET_CLIENT; + sflags |= SDB_F_FOR_AS_REQ; + } else { + int equal = smb_krb5_principal_is_tgs(ctx->context, principal); + if (equal == -1) { + return ENOMEM; + } + + if (equal) { + sflags |= SDB_F_GET_KRBTGT; + } else { + sflags |= SDB_F_GET_SERVER; + sflags |= SDB_F_FOR_TGS_REQ; + } + } +#else /* KRB5_KDB_DAL_MAJOR_VERSION < 9 */ + if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { + sflags |= SDB_F_CANON; + } + if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | + KRB5_KDB_FLAG_INCLUDE_PAC)) { + /* + * KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY is equal to + * SDB_F_FOR_AS_REQ + * + * We use ANY to also allow AS_REQ for service principal names + * This is supported by Windows. + */ + sflags |= SDB_F_GET_ANY|SDB_F_FOR_AS_REQ; + } else { + int equal = smb_krb5_principal_is_tgs(ctx->context, principal); + if (equal == -1) { + return ENOMEM; + } + + if (equal) { + sflags |= SDB_F_GET_KRBTGT; + } else { + sflags |= SDB_F_GET_SERVER|SDB_F_FOR_TGS_REQ; + } + } +#endif /* KRB5_KDB_DAL_MAJOR_VERSION */ + + /* always set this or the created_by data will not be populated by samba's + * backend and we will fail to parse the entry later */ + sflags |= SDB_F_ADMIN_DATA; + + +fetch_referral_principal: + ret = samba_kdc_fetch(ctx->context, ctx->db_ctx, + principal, sflags, 0, &sentry); + switch (ret) { + case 0: + break; + case SDB_ERR_NOENTRY: + ret = KRB5_KDB_NOENTRY; + goto done; + case SDB_ERR_WRONG_REALM: { + char *dest_realm = NULL; + const char *our_realm = lpcfg_realm(ctx->db_ctx->lp_ctx); + + if (sflags & SDB_F_FOR_AS_REQ) { + /* + * If this is a request for a TGT, we are done. The KDC + * will return the correct error to the client. + */ + ret = 0; + break; + } + + if (referral_principal != NULL) { + sdb_entry_free(&sentry); + ret = KRB5_KDB_NOENTRY; + goto done; + } + + /* + * We get a TGS request + * + * cifs/dc7.SAMBA2008R2.EXAMPLE.COM@ADDOM.SAMBA.EXAMPLE.COM + * + * to our DC for the realm + * + * ADDOM.SAMBA.EXAMPLE.COM + * + * We look up if we have and entry in the database and get an + * entry with the pricipal: + * + * cifs/dc7.SAMBA2008R2.EXAMPLE.COM@SAMBA2008R2.EXAMPLE.COM + * + * and the error: SDB_ERR_WRONG_REALM. + * + * In the case of a TGS-REQ we need to return a referral ticket + * fo the next trust hop to the client. This ticket will have + * the following principal: + * + * krbtgt/SAMBA2008R2.EXAMPLE.COM@ADDOM.SAMBA.EXAMPLE.COM + * + * We just redo the lookup in the database with the referral + * principal and return success. + */ + dest_realm = smb_krb5_principal_get_realm( + ctx, ctx->context, sentry.principal); + sdb_entry_free(&sentry); + if (dest_realm == NULL) { + ret = KRB5_KDB_NOENTRY; + goto done; + } + + ret = smb_krb5_make_principal(ctx->context, + &referral_principal, + our_realm, + KRB5_TGS_NAME, + dest_realm, + NULL); + TALLOC_FREE(dest_realm); + if (ret != 0) { + goto done; + } + + principal = referral_principal; + goto fetch_referral_principal; + } + case SDB_ERR_NOT_FOUND_HERE: + /* FIXME: RODC support */ + default: + goto done; + } + + ret = sdb_entry_to_krb5_db_entry(ctx->context, &sentry, kentry); + + sdb_entry_free(&sentry); + +done: + krb5_free_principal(ctx->context, referral_principal); + referral_principal = NULL; + + if (ret) { + free(kentry); + } else { + *_kentry = kentry; + } + return ret; +} + +int mit_samba_get_firstkey(struct mit_samba_context *ctx, + krb5_db_entry **_kentry) +{ + struct sdb_entry sentry = {}; + krb5_db_entry *kentry; + int ret; + + kentry = malloc(sizeof(krb5_db_entry)); + if (kentry == NULL) { + return ENOMEM; + } + + ret = samba_kdc_firstkey(ctx->context, ctx->db_ctx, &sentry); + switch (ret) { + case 0: + break; + case SDB_ERR_NOENTRY: + free(kentry); + return KRB5_KDB_NOENTRY; + case SDB_ERR_NOT_FOUND_HERE: + /* FIXME: RODC support */ + default: + free(kentry); + return ret; + } + + ret = sdb_entry_to_krb5_db_entry(ctx->context, &sentry, kentry); + + sdb_entry_free(&sentry); + + if (ret) { + free(kentry); + } else { + *_kentry = kentry; + } + return ret; +} + +int mit_samba_get_nextkey(struct mit_samba_context *ctx, + krb5_db_entry **_kentry) +{ + struct sdb_entry sentry = {}; + krb5_db_entry *kentry; + int ret; + + kentry = malloc(sizeof(krb5_db_entry)); + if (kentry == NULL) { + return ENOMEM; + } + + ret = samba_kdc_nextkey(ctx->context, ctx->db_ctx, &sentry); + switch (ret) { + case 0: + break; + case SDB_ERR_NOENTRY: + free(kentry); + return KRB5_KDB_NOENTRY; + case SDB_ERR_NOT_FOUND_HERE: + /* FIXME: RODC support */ + default: + free(kentry); + return ret; + } + + ret = sdb_entry_to_krb5_db_entry(ctx->context, &sentry, kentry); + + sdb_entry_free(&sentry); + + if (ret) { + free(kentry); + } else { + *_kentry = kentry; + } + return ret; +} + +int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_context context, + uint32_t flags, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_keyblock *replaced_reply_key, + krb5_pac *pac) +{ + TALLOC_CTX *tmp_ctx; + DATA_BLOB *logon_info_blob = NULL; + DATA_BLOB *upn_dns_info_blob = NULL; + DATA_BLOB *cred_ndr = NULL; + DATA_BLOB **cred_ndr_ptr = NULL; + DATA_BLOB cred_blob = data_blob_null; + DATA_BLOB *pcred_blob = NULL; + DATA_BLOB *pac_attrs_blob = NULL; + DATA_BLOB *requester_sid_blob = NULL; + NTSTATUS nt_status; + krb5_error_code code; + struct samba_kdc_entry *skdc_entry; + bool is_krbtgt; + enum samba_asserted_identity asserted_identity = + (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) ? + SAMBA_ASSERTED_IDENTITY_SERVICE : + SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY; + + skdc_entry = talloc_get_type_abort(client->e_data, + struct samba_kdc_entry); + + tmp_ctx = talloc_named(smb_ctx, + 0, + "mit_samba_get_pac_data_blobs context"); + if (tmp_ctx == NULL) { + return ENOMEM; + } + + /* Check if we have a PREAUTH key */ + if (replaced_reply_key != NULL) { + cred_ndr_ptr = &cred_ndr; + } + + is_krbtgt = ks_is_tgs_principal(smb_ctx, server->princ); + + nt_status = samba_kdc_get_pac_blobs(tmp_ctx, + skdc_entry, + asserted_identity, + &logon_info_blob, + cred_ndr_ptr, + &upn_dns_info_blob, + is_krbtgt ? &pac_attrs_blob : NULL, + PAC_ATTRIBUTE_FLAG_PAC_WAS_GIVEN_IMPLICITLY, + is_krbtgt ? &requester_sid_blob : NULL); + if (!NT_STATUS_IS_OK(nt_status)) { + talloc_free(tmp_ctx); + if (NT_STATUS_EQUAL(nt_status, + NT_STATUS_OBJECT_NAME_NOT_FOUND)) { + return ENOENT; + } + return EINVAL; + } + + if (replaced_reply_key != NULL && cred_ndr != NULL) { + code = samba_kdc_encrypt_pac_credentials(context, + replaced_reply_key, + cred_ndr, + tmp_ctx, + &cred_blob); + if (code != 0) { + talloc_free(tmp_ctx); + return code; + } + pcred_blob = &cred_blob; + } + + code = samba_make_krb5_pac(context, + logon_info_blob, + pcred_blob, + upn_dns_info_blob, + pac_attrs_blob, + requester_sid_blob, + NULL, + *pac); + + talloc_free(tmp_ctx); + return code; +} + +#if KRB5_KDB_DAL_MAJOR_VERSION < 9 +krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int kdc_flags, + krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, + krb5_keyblock *krbtgt_keyblock, + krb5_pac *pac) +{ + TALLOC_CTX *tmp_ctx; + krb5_error_code code; + struct samba_kdc_entry *client_skdc_entry = NULL; + struct samba_kdc_entry *krbtgt_skdc_entry = NULL; + struct samba_kdc_entry *server_skdc_entry = NULL; + krb5_principal delegated_proxy_principal = NULL; + krb5_pac new_pac = NULL; + bool is_in_db = false; + bool is_untrusted = false; + uint32_t flags = SAMBA_KDC_FLAG_SKIP_PAC_BUFFER; + + /* Create a memory context early so code can use talloc_stackframe() */ + tmp_ctx = talloc_named(ctx, 0, "mit_samba_reget_pac context"); + if (tmp_ctx == NULL) { + return ENOMEM; + } + + if (client != NULL) { + client_skdc_entry = + talloc_get_type_abort(client->e_data, + struct samba_kdc_entry); + } + + if (server == NULL) { + code = EINVAL; + goto done; + } + + server_skdc_entry = + talloc_get_type_abort(server->e_data, + struct samba_kdc_entry); + + if (krbtgt == NULL) { + code = EINVAL; + goto done; + } + krbtgt_skdc_entry = + talloc_get_type_abort(krbtgt->e_data, + struct samba_kdc_entry); + + code = samba_krbtgt_is_in_db(krbtgt_skdc_entry, + &is_in_db, + &is_untrusted); + if (code != 0) { + goto done; + } + + if (is_untrusted) { + flags |= SAMBA_KDC_FLAG_KRBTGT_IS_UNTRUSTED; + } + + if (is_in_db) { + flags |= SAMBA_KDC_FLAG_KRBTGT_IN_DB; + + } + + if (kdc_flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { + flags |= SAMBA_KDC_FLAG_PROTOCOL_TRANSITION; + } + + if (kdc_flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { + flags |= SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION; + delegated_proxy_principal = discard_const(client_principal); + } + + /* Build an updated PAC */ + code = krb5_pac_init(context, &new_pac); + if (code != 0) { + goto done; + } + + code = samba_kdc_update_pac(tmp_ctx, + context, + krbtgt_skdc_entry->kdc_db_ctx->samdb, + flags, + client_skdc_entry, + server->princ, + server_skdc_entry, + krbtgt_skdc_entry, + delegated_proxy_principal, + *pac, + new_pac); + if (code != 0) { + krb5_pac_free(context, new_pac); + if (code == ENODATA) { + krb5_pac_free(context, *pac); + *pac = NULL; + code = 0; + } + goto done; + } + + /* We now replace the pac */ + krb5_pac_free(context, *pac); + *pac = new_pac; + +done: + talloc_free(tmp_ctx); + return code; +} +#else +krb5_error_code mit_samba_update_pac(struct mit_samba_context *ctx, + krb5_context context, + int kdc_flags, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, + krb5_pac old_pac, + krb5_pac new_pac) +{ + TALLOC_CTX *tmp_ctx = NULL; + krb5_error_code code; + struct samba_kdc_entry *client_skdc_entry = NULL; + struct samba_kdc_entry *server_skdc_entry = NULL; + struct samba_kdc_entry *krbtgt_skdc_entry = NULL; + bool is_in_db = false; + bool is_untrusted = false; + uint32_t flags = SAMBA_KDC_FLAG_SKIP_PAC_BUFFER; + + /* Create a memory context early so code can use talloc_stackframe() */ + tmp_ctx = talloc_named(ctx, 0, "mit_samba_update_pac context"); + if (tmp_ctx == NULL) { + return ENOMEM; + } + + if (client != NULL) { + client_skdc_entry = + talloc_get_type_abort(client->e_data, + struct samba_kdc_entry); + } + + if (krbtgt == NULL) { + code = EINVAL; + goto done; + } + krbtgt_skdc_entry = + talloc_get_type_abort(krbtgt->e_data, + struct samba_kdc_entry); + + server_skdc_entry = + talloc_get_type_abort(server->e_data, + struct samba_kdc_entry); + + /* + * If the krbtgt was generated by an RODC, and we are not that + * RODC, then we need to regenerate the PAC - we can't trust + * it, and confirm that the RODC was permitted to print this ticket + * + * Because of the samba_kdc_validate_pac_blob() step we can be + * sure that the record in 'client' or 'server' matches the SID in the + * original PAC. + */ + code = samba_krbtgt_is_in_db(krbtgt_skdc_entry, + &is_in_db, + &is_untrusted); + if (code != 0) { + goto done; + } + + if (is_untrusted) { + flags |= SAMBA_KDC_FLAG_KRBTGT_IS_UNTRUSTED; + } + + if (is_in_db) { + flags |= SAMBA_KDC_FLAG_KRBTGT_IN_DB; + + } + + if (kdc_flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { + flags |= SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION; + } + + code = samba_kdc_update_pac(tmp_ctx, + context, + krbtgt_skdc_entry->kdc_db_ctx->samdb, + flags, + client_skdc_entry, + server->princ, + server_skdc_entry, + krbtgt_skdc_entry, + NULL, + old_pac, + new_pac); + if (code != 0) { + if (code == ENODATA) { + /* + * We can't tell the KDC to not issue a PAC. It will + * just return the newly allocated empty PAC. + */ + code = 0; + } + } + +done: + talloc_free(tmp_ctx); + return code; +} +#endif + +/* provide header, function is exported but there are no public headers */ + +krb5_error_code encode_krb5_padata_sequence(krb5_pa_data *const *rep, krb5_data **code); + +/* this function allocates 'data' using malloc. + * The caller is responsible for freeing it */ +static void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data) +{ + krb5_error_code ret = 0; + krb5_pa_data pa, *ppa[2]; + krb5_data *d = NULL; + + if (!e_data) + return; + + e_data->data = NULL; + e_data->length = 0; + + pa.magic = KV5M_PA_DATA; + pa.pa_type = KRB5_PADATA_PW_SALT; + pa.length = 12; + pa.contents = malloc(pa.length); + if (!pa.contents) { + return; + } + + SIVAL(pa.contents, 0, NT_STATUS_V(nt_status)); + SIVAL(pa.contents, 4, 0); + SIVAL(pa.contents, 8, 1); + + ppa[0] = &pa; + ppa[1] = NULL; + + ret = encode_krb5_padata_sequence(ppa, &d); + free(pa.contents); + if (ret) { + return; + } + + e_data->data = (uint8_t *)d->data; + e_data->length = d->length; + + /* free d, not d->data - gd */ + free(d); + + return; +} + +int mit_samba_check_client_access(struct mit_samba_context *ctx, + krb5_db_entry *client, + const char *client_name, + krb5_db_entry *server, + const char *server_name, + const char *netbios_name, + bool password_change, + DATA_BLOB *e_data) +{ + struct samba_kdc_entry *skdc_entry; + NTSTATUS nt_status; + + skdc_entry = talloc_get_type(client->e_data, struct samba_kdc_entry); + + nt_status = samba_kdc_check_client_access(skdc_entry, + client_name, + netbios_name, + password_change); + + if (!NT_STATUS_IS_OK(nt_status)) { + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) { + return ENOMEM; + } + + samba_kdc_build_edata_reply(nt_status, e_data); + + return samba_kdc_map_policy_err(nt_status); + } + + return 0; +} + +int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, + const krb5_db_entry *server, + krb5_const_principal target_principal) +{ +#if KRB5_KDB_DAL_MAJOR_VERSION < 9 + return KRB5KDC_ERR_BADOPTION; +#else + struct samba_kdc_entry *server_skdc_entry = + talloc_get_type_abort(server->e_data, struct samba_kdc_entry); + krb5_error_code code; + + code = samba_kdc_check_s4u2proxy(ctx->context, + ctx->db_ctx, + server_skdc_entry, + target_principal); + + return code; +#endif +} + +krb5_error_code mit_samba_check_allowed_to_delegate_from( + struct mit_samba_context *ctx, + krb5_const_principal client_principal, + krb5_const_principal server_principal, + krb5_pac header_pac, + const krb5_db_entry *proxy) +{ +#if KRB5_KDB_DAL_MAJOR_VERSION < 8 + return KRB5KDC_ERR_POLICY; +#else + struct samba_kdc_entry *proxy_skdc_entry = + talloc_get_type_abort(proxy->e_data, struct samba_kdc_entry); + krb5_error_code code; + + code = samba_kdc_check_s4u2proxy_rbcd(ctx->context, + ctx->db_ctx, + client_principal, + server_principal, + header_pac, + proxy_skdc_entry); + + return code; +#endif +} + +static krb5_error_code mit_samba_change_pwd_error(krb5_context context, + NTSTATUS result, + enum samPwdChangeReason reject_reason, + struct samr_DomInfo1 *dominfo) +{ + krb5_error_code code = KADM5_PASS_Q_GENERIC; + + if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) { + code = KADM5_BAD_PRINCIPAL; + krb5_set_error_message(context, + code, + "No such user when changing password"); + } + if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) { + code = KADM5_PASS_Q_GENERIC; + krb5_set_error_message(context, + code, + "Not permitted to change password"); + } + if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) && + dominfo != NULL) { + switch (reject_reason) { + case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT: + code = KADM5_PASS_Q_TOOSHORT; + krb5_set_error_message(context, + code, + "Password too short, password " + "must be at least %d characters " + "long.", + dominfo->min_password_length); + break; + case SAM_PWD_CHANGE_NOT_COMPLEX: + code = KADM5_PASS_Q_DICT; + krb5_set_error_message(context, + code, + "Password does not meet " + "complexity requirements"); + break; + case SAM_PWD_CHANGE_PWD_IN_HISTORY: + code = KADM5_PASS_TOOSOON; + krb5_set_error_message(context, + code, + "Password is already in password " + "history. New password must not " + "match any of your %d previous " + "passwords.", + dominfo->password_history_length); + break; + default: + code = KADM5_PASS_Q_GENERIC; + krb5_set_error_message(context, + code, + "Password change rejected, " + "password changes may not be " + "permitted on this account, or " + "the minimum password age may " + "not have elapsed."); + break; + } + } + + return code; +} + +int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, + char *pwd, + krb5_db_entry *db_entry) +{ + NTSTATUS status; + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + TALLOC_CTX *tmp_ctx; + DATA_BLOB password; + enum samPwdChangeReason reject_reason; + struct samr_DomInfo1 *dominfo; + const char *error_string = NULL; + struct auth_user_info_dc *user_info_dc; + struct samba_kdc_entry *p = + talloc_get_type_abort(db_entry->e_data, struct samba_kdc_entry); + krb5_error_code code = 0; + +#ifdef DEBUG_PASSWORD + DEBUG(1,("mit_samba_kpasswd_change_password called with: %s\n", pwd)); +#endif + + tmp_ctx = talloc_named(ctx, 0, "mit_samba_kpasswd_change_password"); + if (tmp_ctx == NULL) { + return ENOMEM; + } + + status = samba_kdc_get_user_info_from_db(p, + p->msg, + &user_info_dc); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1,("samba_kdc_get_user_info_from_db failed: %s\n", + nt_errstr(status))); + talloc_free(tmp_ctx); + return EINVAL; + } + + status = auth_generate_session_info(tmp_ctx, + ctx->db_ctx->lp_ctx, + ctx->db_ctx->samdb, + user_info_dc, + 0, /* session_info_flags */ + &ctx->session_info); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1,("auth_generate_session_info failed: %s\n", + nt_errstr(status))); + talloc_free(tmp_ctx); + return EINVAL; + } + + /* password is expected as UTF16 */ + + if (!convert_string_talloc(tmp_ctx, CH_UTF8, CH_UTF16, + pwd, strlen(pwd), + &password.data, &password.length)) { + DEBUG(1,("convert_string_talloc failed\n")); + talloc_free(tmp_ctx); + return EINVAL; + } + + status = samdb_kpasswd_change_password(tmp_ctx, + ctx->db_ctx->lp_ctx, + ctx->db_ctx->ev_ctx, + ctx->session_info, + &password, + &reject_reason, + &dominfo, + &error_string, + &result); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1,("samdb_kpasswd_change_password failed: %s\n", + nt_errstr(status))); + code = KADM5_PASS_Q_GENERIC; + krb5_set_error_message(ctx->context, code, "%s", error_string); + goto out; + } + + if (!NT_STATUS_IS_OK(result)) { + code = mit_samba_change_pwd_error(ctx->context, + result, + reject_reason, + dominfo); + } + +out: + talloc_free(tmp_ctx); + + return code; +} + +void mit_samba_zero_bad_password_count(krb5_db_entry *db_entry) +{ + /* struct netr_SendToSamBase *send_to_sam = NULL; */ + struct samba_kdc_entry *p = + talloc_get_type_abort(db_entry->e_data, struct samba_kdc_entry); + struct ldb_dn *domain_dn; + + domain_dn = ldb_get_default_basedn(p->kdc_db_ctx->samdb); + + authsam_logon_success_accounting(p->kdc_db_ctx->samdb, + p->msg, + domain_dn, + true, + NULL, NULL); + /* TODO: RODC support */ +} + + +void mit_samba_update_bad_password_count(krb5_db_entry *db_entry) +{ + struct samba_kdc_entry *p = + talloc_get_type_abort(db_entry->e_data, struct samba_kdc_entry); + + authsam_update_bad_pwd_count(p->kdc_db_ctx->samdb, + p->msg, + ldb_get_default_basedn(p->kdc_db_ctx->samdb)); +} + +bool mit_samba_princ_needs_pac(krb5_db_entry *db_entry) +{ + struct samba_kdc_entry *skdc_entry = + talloc_get_type_abort(db_entry->e_data, struct samba_kdc_entry); + + return samba_princ_needs_pac(skdc_entry); +} diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h new file mode 100644 index 0000000..0357408 --- /dev/null +++ b/source4/kdc/mit_samba.h @@ -0,0 +1,106 @@ +/* + MIT-Samba4 library + + Copyright (c) 2010, Simo Sorce <idra@samba.org> + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#ifndef _MIT_SAMBA_H +#define _MIT_SAMBA_H + +struct mit_samba_context { + struct auth_session_info *session_info; + + /* for compat with hdb plugin common code */ + krb5_context context; + struct samba_kdc_db_context *db_ctx; +}; + +int mit_samba_context_init(struct mit_samba_context **_ctx); + +void mit_samba_context_free(struct mit_samba_context *ctx); + +int mit_samba_generate_salt(krb5_data *salt); + +int mit_samba_generate_random_password(krb5_data *pwd); + +int mit_samba_get_principal(struct mit_samba_context *ctx, + krb5_const_principal principal, + unsigned int kflags, + krb5_db_entry **_kentry); + +int mit_samba_get_firstkey(struct mit_samba_context *ctx, + krb5_db_entry **_kentry); + +int mit_samba_get_nextkey(struct mit_samba_context *ctx, + krb5_db_entry **_kentry); + +int mit_samba_get_pac(struct mit_samba_context *smb_ctx, + krb5_context context, + uint32_t flags, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_keyblock *replaced_reply_key, + krb5_pac *pac); + +krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, + krb5_const_principal client_principal, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, + krb5_keyblock *krbtgt_keyblock, + krb5_pac *pac); + +krb5_error_code mit_samba_update_pac(struct mit_samba_context *ctx, + krb5_context context, + int flags, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *signing_krbtgt, + krb5_pac old_pac, + krb5_pac new_pac); + +int mit_samba_check_client_access(struct mit_samba_context *ctx, + krb5_db_entry *client, + const char *client_name, + krb5_db_entry *server, + const char *server_name, + const char *netbios_name, + bool password_change, + DATA_BLOB *e_data); + +int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, + const krb5_db_entry *server, + krb5_const_principal target_principal); +krb5_error_code mit_samba_check_allowed_to_delegate_from( + struct mit_samba_context *ctx, + krb5_const_principal client, + krb5_const_principal server, + krb5_pac header_pac, + const krb5_db_entry *proxy); + +int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, + char *pwd, + krb5_db_entry *db_entry); + +void mit_samba_zero_bad_password_count(krb5_db_entry *db_entry); + +void mit_samba_update_bad_password_count(krb5_db_entry *db_entry); + +bool mit_samba_princ_needs_pac(krb5_db_entry *db_entry); + +#endif /* _MIT_SAMBA_H */ diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c new file mode 100644 index 0000000..6692619 --- /dev/null +++ b/source4/kdc/pac-glue.c @@ -0,0 +1,2006 @@ +/* + Unix SMB/CIFS implementation. + + PAC Glue between Samba and the KDC + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009 + Copyright (C) Simo Sorce <idra@samba.org> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "lib/replace/replace.h" +#include "lib/replace/system/kerberos.h" +#include "lib/util/debug.h" +#include "lib/util/samba_util.h" +#include "lib/util/talloc_stack.h" + +#include "auth/auth_sam_reply.h" +#include "auth/kerberos/kerberos.h" +#include "auth/kerberos/pac_utils.h" +#include "libcli/security/security.h" +#include "libds/common/flags.h" +#include "librpc/gen_ndr/ndr_krb5pac.h" +#include "param/param.h" +#include "source4/auth/auth.h" +#include "source4/dsdb/common/util.h" +#include "source4/dsdb/samdb/samdb.h" +#include "source4/kdc/samba_kdc.h" +#include "source4/kdc/pac-glue.h" + +#include <ldb.h> + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_KERBEROS + +static +NTSTATUS samba_get_logon_info_pac_blob(TALLOC_CTX *mem_ctx, + const struct auth_user_info_dc *info, + DATA_BLOB *pac_data, + DATA_BLOB *requester_sid_blob) +{ + struct netr_SamInfo3 *info3; + union PAC_INFO pac_info; + enum ndr_err_code ndr_err; + NTSTATUS nt_status; + + ZERO_STRUCT(pac_info); + + *pac_data = data_blob_null; + if (requester_sid_blob != NULL) { + *requester_sid_blob = data_blob_null; + } + + nt_status = auth_convert_user_info_dc_saminfo3(mem_ctx, info, &info3); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(1, ("Getting Samba info failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + + pac_info.logon_info.info = talloc_zero(mem_ctx, struct PAC_LOGON_INFO); + if (!pac_info.logon_info.info) { + return NT_STATUS_NO_MEMORY; + } + + pac_info.logon_info.info->info3 = *info3; + + ndr_err = ndr_push_union_blob(pac_data, mem_ctx, &pac_info, + PAC_TYPE_LOGON_INFO, + (ndr_push_flags_fn_t)ndr_push_PAC_INFO); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(1, ("PAC_LOGON_INFO (presig) push failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + + if (requester_sid_blob != NULL && info->num_sids > 0) { + union PAC_INFO pac_requester_sid; + + ZERO_STRUCT(pac_requester_sid); + + pac_requester_sid.requester_sid.sid = info->sids[0]; + + ndr_err = ndr_push_union_blob(requester_sid_blob, mem_ctx, + &pac_requester_sid, + PAC_TYPE_REQUESTER_SID, + (ndr_push_flags_fn_t)ndr_push_PAC_INFO); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(1, ("PAC_REQUESTER_SID (presig) push failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + } + + return NT_STATUS_OK; +} + +static +NTSTATUS samba_get_upn_info_pac_blob(TALLOC_CTX *mem_ctx, + const struct auth_user_info_dc *info, + DATA_BLOB *upn_data) +{ + union PAC_INFO pac_upn; + enum ndr_err_code ndr_err; + NTSTATUS nt_status; + bool ok; + + ZERO_STRUCT(pac_upn); + + *upn_data = data_blob_null; + + pac_upn.upn_dns_info.upn_name = info->info->user_principal_name; + pac_upn.upn_dns_info.dns_domain_name = strupper_talloc(mem_ctx, + info->info->dns_domain_name); + if (pac_upn.upn_dns_info.dns_domain_name == NULL) { + return NT_STATUS_NO_MEMORY; + } + if (info->info->user_principal_constructed) { + pac_upn.upn_dns_info.flags |= PAC_UPN_DNS_FLAG_CONSTRUCTED; + } + + pac_upn.upn_dns_info.flags |= PAC_UPN_DNS_FLAG_HAS_SAM_NAME_AND_SID; + + pac_upn.upn_dns_info.ex.sam_name_and_sid.samaccountname + = info->info->account_name; + + pac_upn.upn_dns_info.ex.sam_name_and_sid.objectsid + = &info->sids[0]; + + ndr_err = ndr_push_union_blob(upn_data, mem_ctx, &pac_upn, + PAC_TYPE_UPN_DNS_INFO, + (ndr_push_flags_fn_t)ndr_push_PAC_INFO); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(1, ("PAC UPN_DNS_INFO (presig) push failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + + ok = data_blob_pad(mem_ctx, upn_data, 8); + if (!ok) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +static +NTSTATUS samba_get_pac_attrs_blob(TALLOC_CTX *mem_ctx, + uint64_t pac_attributes, + DATA_BLOB *pac_attrs_data) +{ + union PAC_INFO pac_attrs; + enum ndr_err_code ndr_err; + NTSTATUS nt_status; + + ZERO_STRUCT(pac_attrs); + + *pac_attrs_data = data_blob_null; + + /* Set the length of the flags in bits. */ + pac_attrs.attributes_info.flags_length = 2; + pac_attrs.attributes_info.flags = pac_attributes; + + ndr_err = ndr_push_union_blob(pac_attrs_data, mem_ctx, &pac_attrs, + PAC_TYPE_ATTRIBUTES_INFO, + (ndr_push_flags_fn_t)ndr_push_PAC_INFO); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(1, ("PAC ATTRIBUTES_INFO (presig) push failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + + return NT_STATUS_OK; +} + +static +NTSTATUS samba_get_cred_info_ndr_blob(TALLOC_CTX *mem_ctx, + const struct ldb_message *msg, + DATA_BLOB *cred_blob) +{ + enum ndr_err_code ndr_err; + NTSTATUS nt_status; + struct samr_Password *lm_hash = NULL; + struct samr_Password *nt_hash = NULL; + struct PAC_CREDENTIAL_NTLM_SECPKG ntlm_secpkg = { + .version = 0, + }; + DATA_BLOB ntlm_blob = data_blob_null; + struct PAC_CREDENTIAL_SUPPLEMENTAL_SECPKG secpkgs[1] = {{ + .credential_size = 0, + }}; + struct PAC_CREDENTIAL_DATA cred_data = { + .credential_count = 0, + }; + struct PAC_CREDENTIAL_DATA_NDR cred_ndr; + + ZERO_STRUCT(cred_ndr); + + *cred_blob = data_blob_null; + + lm_hash = samdb_result_hash(mem_ctx, msg, "dBCSPwd"); + if (lm_hash != NULL) { + bool zero = all_zero(lm_hash->hash, 16); + if (zero) { + lm_hash = NULL; + } + } + if (lm_hash != NULL) { + DEBUG(5, ("Passing LM password hash through credentials set\n")); + ntlm_secpkg.flags |= PAC_CREDENTIAL_NTLM_HAS_LM_HASH; + ntlm_secpkg.lm_password = *lm_hash; + ZERO_STRUCTP(lm_hash); + TALLOC_FREE(lm_hash); + } + + nt_hash = samdb_result_hash(mem_ctx, msg, "unicodePwd"); + if (nt_hash != NULL) { + bool zero = all_zero(nt_hash->hash, 16); + if (zero) { + nt_hash = NULL; + } + } + if (nt_hash != NULL) { + DEBUG(5, ("Passing LM password hash through credentials set\n")); + ntlm_secpkg.flags |= PAC_CREDENTIAL_NTLM_HAS_NT_HASH; + ntlm_secpkg.nt_password = *nt_hash; + ZERO_STRUCTP(nt_hash); + TALLOC_FREE(nt_hash); + } + + if (ntlm_secpkg.flags == 0) { + return NT_STATUS_OK; + } + +#ifdef DEBUG_PASSWORD + if (DEBUGLVL(11)) { + NDR_PRINT_DEBUG(PAC_CREDENTIAL_NTLM_SECPKG, &ntlm_secpkg); + } +#endif + + ndr_err = ndr_push_struct_blob(&ntlm_blob, mem_ctx, &ntlm_secpkg, + (ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_NTLM_SECPKG); + ZERO_STRUCT(ntlm_secpkg); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(1, ("PAC_CREDENTIAL_NTLM_SECPKG (presig) push failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + + DEBUG(10, ("NTLM credential BLOB (len %zu) for user\n", + ntlm_blob.length)); + dump_data_pw("PAC_CREDENTIAL_NTLM_SECPKG", + ntlm_blob.data, ntlm_blob.length); + + secpkgs[0].package_name.string = discard_const_p(char, "NTLM"); + secpkgs[0].credential_size = ntlm_blob.length; + secpkgs[0].credential = ntlm_blob.data; + + cred_data.credential_count = ARRAY_SIZE(secpkgs); + cred_data.credentials = secpkgs; + +#ifdef DEBUG_PASSWORD + if (DEBUGLVL(11)) { + NDR_PRINT_DEBUG(PAC_CREDENTIAL_DATA, &cred_data); + } +#endif + + cred_ndr.ctr.data = &cred_data; + +#ifdef DEBUG_PASSWORD + if (DEBUGLVL(11)) { + NDR_PRINT_DEBUG(PAC_CREDENTIAL_DATA_NDR, &cred_ndr); + } +#endif + + ndr_err = ndr_push_struct_blob(cred_blob, mem_ctx, &cred_ndr, + (ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_DATA_NDR); + data_blob_clear(&ntlm_blob); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(1, ("PAC_CREDENTIAL_DATA_NDR (presig) push failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + + DEBUG(10, ("Created credential BLOB (len %zu) for user\n", + cred_blob->length)); + dump_data_pw("PAC_CREDENTIAL_DATA_NDR", + cred_blob->data, cred_blob->length); + + return NT_STATUS_OK; +} + +#ifdef SAMBA4_USES_HEIMDAL +krb5_error_code samba_kdc_encrypt_pac_credentials(krb5_context context, + const krb5_keyblock *pkreplykey, + const DATA_BLOB *cred_ndr_blob, + TALLOC_CTX *mem_ctx, + DATA_BLOB *cred_info_blob) +{ + krb5_crypto cred_crypto; + krb5_enctype cred_enctype; + krb5_data cred_ndr_crypt; + struct PAC_CREDENTIAL_INFO pac_cred_info = { .version = 0, }; + krb5_error_code ret; + const char *krb5err; + enum ndr_err_code ndr_err; + NTSTATUS nt_status; + + *cred_info_blob = data_blob_null; + + ret = krb5_crypto_init(context, pkreplykey, ETYPE_NULL, + &cred_crypto); + if (ret != 0) { + krb5err = krb5_get_error_message(context, ret); + DEBUG(1, ("Failed initializing cred data crypto: %s\n", krb5err)); + krb5_free_error_message(context, krb5err); + return ret; + } + + ret = krb5_crypto_getenctype(context, cred_crypto, &cred_enctype); + if (ret != 0) { + DEBUG(1, ("Failed getting crypto type for key\n")); + krb5_crypto_destroy(context, cred_crypto); + return ret; + } + + DEBUG(10, ("Plain cred_ndr_blob (len %zu)\n", + cred_ndr_blob->length)); + dump_data_pw("PAC_CREDENTIAL_DATA_NDR", + cred_ndr_blob->data, cred_ndr_blob->length); + + ret = krb5_encrypt(context, cred_crypto, + KRB5_KU_OTHER_ENCRYPTED, + cred_ndr_blob->data, cred_ndr_blob->length, + &cred_ndr_crypt); + krb5_crypto_destroy(context, cred_crypto); + if (ret != 0) { + krb5err = krb5_get_error_message(context, ret); + DEBUG(1, ("Failed crypt of cred data: %s\n", krb5err)); + krb5_free_error_message(context, krb5err); + return ret; + } + + pac_cred_info.encryption_type = cred_enctype; + pac_cred_info.encrypted_data.length = cred_ndr_crypt.length; + pac_cred_info.encrypted_data.data = (uint8_t *)cred_ndr_crypt.data; + + if (DEBUGLVL(10)) { + NDR_PRINT_DEBUG(PAC_CREDENTIAL_INFO, &pac_cred_info); + } + + ndr_err = ndr_push_struct_blob(cred_info_blob, mem_ctx, &pac_cred_info, + (ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_INFO); + krb5_data_free(&cred_ndr_crypt); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(1, ("PAC_CREDENTIAL_INFO (presig) push failed: %s\n", + nt_errstr(nt_status))); + return KRB5KDC_ERR_SVC_UNAVAILABLE; + } + + DEBUG(10, ("Encrypted credential BLOB (len %zu) with alg %d\n", + cred_info_blob->length, (int)pac_cred_info.encryption_type)); + dump_data_pw("PAC_CREDENTIAL_INFO", + cred_info_blob->data, cred_info_blob->length); + + return 0; +} +#else /* SAMBA4_USES_HEIMDAL */ +krb5_error_code samba_kdc_encrypt_pac_credentials(krb5_context context, + const krb5_keyblock *pkreplykey, + const DATA_BLOB *cred_ndr_blob, + TALLOC_CTX *mem_ctx, + DATA_BLOB *cred_info_blob) +{ + krb5_key cred_key; + krb5_enctype cred_enctype; + struct PAC_CREDENTIAL_INFO pac_cred_info = { .version = 0, }; + krb5_error_code code; + const char *krb5err; + enum ndr_err_code ndr_err; + NTSTATUS nt_status; + krb5_data cred_ndr_data; + krb5_enc_data cred_ndr_crypt; + size_t enc_len = 0; + + *cred_info_blob = data_blob_null; + + code = krb5_k_create_key(context, + pkreplykey, + &cred_key); + if (code != 0) { + krb5err = krb5_get_error_message(context, code); + DEBUG(1, ("Failed initializing cred data crypto: %s\n", krb5err)); + krb5_free_error_message(context, krb5err); + return code; + } + + cred_enctype = krb5_k_key_enctype(context, cred_key); + + DEBUG(10, ("Plain cred_ndr_blob (len %zu)\n", + cred_ndr_blob->length)); + dump_data_pw("PAC_CREDENTIAL_DATA_NDR", + cred_ndr_blob->data, cred_ndr_blob->length); + + pac_cred_info.encryption_type = cred_enctype; + + cred_ndr_data.magic = 0; + cred_ndr_data.data = (char *)cred_ndr_blob->data; + cred_ndr_data.length = cred_ndr_blob->length; + + code = krb5_c_encrypt_length(context, + cred_enctype, + cred_ndr_data.length, + &enc_len); + if (code != 0) { + krb5err = krb5_get_error_message(context, code); + DEBUG(1, ("Failed initializing cred data crypto: %s\n", krb5err)); + krb5_free_error_message(context, krb5err); + return code; + } + + pac_cred_info.encrypted_data = data_blob_talloc_zero(mem_ctx, enc_len); + if (pac_cred_info.encrypted_data.data == NULL) { + DBG_ERR("Out of memory\n"); + return ENOMEM; + } + + cred_ndr_crypt.ciphertext.length = enc_len; + cred_ndr_crypt.ciphertext.data = (char *)pac_cred_info.encrypted_data.data; + + code = krb5_k_encrypt(context, + cred_key, + KRB5_KU_OTHER_ENCRYPTED, + NULL, + &cred_ndr_data, + &cred_ndr_crypt); + krb5_k_free_key(context, cred_key); + if (code != 0) { + krb5err = krb5_get_error_message(context, code); + DEBUG(1, ("Failed crypt of cred data: %s\n", krb5err)); + krb5_free_error_message(context, krb5err); + return code; + } + + if (DEBUGLVL(10)) { + NDR_PRINT_DEBUG(PAC_CREDENTIAL_INFO, &pac_cred_info); + } + + ndr_err = ndr_push_struct_blob(cred_info_blob, mem_ctx, &pac_cred_info, + (ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_INFO); + TALLOC_FREE(pac_cred_info.encrypted_data.data); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(1, ("PAC_CREDENTIAL_INFO (presig) push failed: %s\n", + nt_errstr(nt_status))); + return KRB5KDC_ERR_SVC_UNAVAILABLE; + } + + DEBUG(10, ("Encrypted credential BLOB (len %zu) with alg %d\n", + cred_info_blob->length, (int)pac_cred_info.encryption_type)); + dump_data_pw("PAC_CREDENTIAL_INFO", + cred_info_blob->data, cred_info_blob->length); + + return 0; +} +#endif /* SAMBA4_USES_HEIMDAL */ + + +/** + * @brief Create a PAC with the given blobs (logon, credentials, upn and + * delegation). + * + * @param[in] context The KRB5 context to use. + * + * @param[in] logon_blob Fill the logon info PAC buffer with the given blob, + * use NULL to ignore it. + * + * @param[in] cred_blob Fill the credentials info PAC buffer with the given + * blob, use NULL to ignore it. + * + * @param[in] upn_blob Fill the UPN info PAC buffer with the given blob, use + * NULL to ignore it. + * + * @param[in] deleg_blob Fill the delegation info PAC buffer with the given + * blob, use NULL to ignore it. + * + * @param[in] pac The pac buffer to fill. This should be allocated with + * krb5_pac_init() already. + * + * @returns 0 on success or a corresponding KRB5 error. + */ +krb5_error_code samba_make_krb5_pac(krb5_context context, + const DATA_BLOB *logon_blob, + const DATA_BLOB *cred_blob, + const DATA_BLOB *upn_blob, + const DATA_BLOB *pac_attrs_blob, + const DATA_BLOB *requester_sid_blob, + const DATA_BLOB *deleg_blob, + krb5_pac pac) +{ + krb5_data logon_data; + krb5_data cred_data; + krb5_data upn_data; + krb5_data pac_attrs_data; + krb5_data requester_sid_data; + krb5_data deleg_data; + krb5_error_code ret; +#ifdef SAMBA4_USES_HEIMDAL + char null_byte = '\0'; + krb5_data null_data = { + .length = 1, + .data = &null_byte, + }; +#endif + + /* The user account may be set not to want the PAC */ + if (logon_blob == NULL) { + return 0; + } + + ret = smb_krb5_copy_data_contents(&logon_data, + logon_blob->data, + logon_blob->length); + if (ret != 0) { + return ret; + } + + ZERO_STRUCT(cred_data); + if (cred_blob != NULL) { + ret = smb_krb5_copy_data_contents(&cred_data, + cred_blob->data, + cred_blob->length); + if (ret != 0) { + smb_krb5_free_data_contents(context, &logon_data); + return ret; + } + } + + ZERO_STRUCT(upn_data); + if (upn_blob != NULL) { + ret = smb_krb5_copy_data_contents(&upn_data, + upn_blob->data, + upn_blob->length); + if (ret != 0) { + smb_krb5_free_data_contents(context, &logon_data); + smb_krb5_free_data_contents(context, &cred_data); + return ret; + } + } + + ZERO_STRUCT(pac_attrs_data); + if (pac_attrs_blob != NULL) { + ret = smb_krb5_copy_data_contents(&pac_attrs_data, + pac_attrs_blob->data, + pac_attrs_blob->length); + if (ret != 0) { + smb_krb5_free_data_contents(context, &logon_data); + smb_krb5_free_data_contents(context, &cred_data); + smb_krb5_free_data_contents(context, &upn_data); + return ret; + } + } + + ZERO_STRUCT(requester_sid_data); + if (requester_sid_blob != NULL) { + ret = smb_krb5_copy_data_contents(&requester_sid_data, + requester_sid_blob->data, + requester_sid_blob->length); + if (ret != 0) { + smb_krb5_free_data_contents(context, &logon_data); + smb_krb5_free_data_contents(context, &cred_data); + smb_krb5_free_data_contents(context, &upn_data); + smb_krb5_free_data_contents(context, &pac_attrs_data); + return ret; + } + } + + ZERO_STRUCT(deleg_data); + if (deleg_blob != NULL) { + ret = smb_krb5_copy_data_contents(&deleg_data, + deleg_blob->data, + deleg_blob->length); + if (ret != 0) { + smb_krb5_free_data_contents(context, &logon_data); + smb_krb5_free_data_contents(context, &cred_data); + smb_krb5_free_data_contents(context, &upn_data); + smb_krb5_free_data_contents(context, &pac_attrs_data); + smb_krb5_free_data_contents(context, &requester_sid_data); + return ret; + } + } + + ret = krb5_pac_add_buffer(context, pac, PAC_TYPE_LOGON_INFO, &logon_data); + smb_krb5_free_data_contents(context, &logon_data); + if (ret != 0) { + smb_krb5_free_data_contents(context, &cred_data); + smb_krb5_free_data_contents(context, &upn_data); + smb_krb5_free_data_contents(context, &pac_attrs_data); + smb_krb5_free_data_contents(context, &requester_sid_data); + smb_krb5_free_data_contents(context, &deleg_data); + return ret; + } + + if (cred_blob != NULL) { + ret = krb5_pac_add_buffer(context, pac, + PAC_TYPE_CREDENTIAL_INFO, + &cred_data); + smb_krb5_free_data_contents(context, &cred_data); + if (ret != 0) { + smb_krb5_free_data_contents(context, &upn_data); + smb_krb5_free_data_contents(context, &pac_attrs_data); + smb_krb5_free_data_contents(context, &requester_sid_data); + smb_krb5_free_data_contents(context, &deleg_data); + return ret; + } + } + +#ifdef SAMBA4_USES_HEIMDAL + /* + * null_data will be filled by the generic KDC code in the caller + * here we just add it in order to have it before + * PAC_TYPE_UPN_DNS_INFO + * + * Not needed with MIT Kerberos - asn + */ + ret = krb5_pac_add_buffer(context, pac, + PAC_TYPE_LOGON_NAME, + &null_data); + if (ret != 0) { + smb_krb5_free_data_contents(context, &upn_data); + smb_krb5_free_data_contents(context, &pac_attrs_data); + smb_krb5_free_data_contents(context, &requester_sid_data); + smb_krb5_free_data_contents(context, &deleg_data); + return ret; + } +#endif + + if (upn_blob != NULL) { + ret = krb5_pac_add_buffer(context, pac, + PAC_TYPE_UPN_DNS_INFO, + &upn_data); + smb_krb5_free_data_contents(context, &upn_data); + if (ret != 0) { + smb_krb5_free_data_contents(context, &pac_attrs_data); + smb_krb5_free_data_contents(context, &requester_sid_data); + smb_krb5_free_data_contents(context, &deleg_data); + return ret; + } + } + + if (pac_attrs_blob != NULL) { + ret = krb5_pac_add_buffer(context, pac, + PAC_TYPE_ATTRIBUTES_INFO, + &pac_attrs_data); + smb_krb5_free_data_contents(context, &pac_attrs_data); + if (ret != 0) { + smb_krb5_free_data_contents(context, &requester_sid_data); + smb_krb5_free_data_contents(context, &deleg_data); + return ret; + } + } + + if (requester_sid_blob != NULL) { + ret = krb5_pac_add_buffer(context, pac, + PAC_TYPE_REQUESTER_SID, + &requester_sid_data); + smb_krb5_free_data_contents(context, &requester_sid_data); + if (ret != 0) { + smb_krb5_free_data_contents(context, &deleg_data); + return ret; + } + } + + if (deleg_blob != NULL) { + ret = krb5_pac_add_buffer(context, pac, + PAC_TYPE_CONSTRAINED_DELEGATION, + &deleg_data); + smb_krb5_free_data_contents(context, &deleg_data); + if (ret != 0) { + return ret; + } + } + + return ret; +} + +bool samba_princ_needs_pac(struct samba_kdc_entry *skdc_entry) +{ + + uint32_t userAccountControl; + + /* The service account may be set not to want the PAC */ + userAccountControl = ldb_msg_find_attr_as_uint(skdc_entry->msg, "userAccountControl", 0); + if (userAccountControl & UF_NO_AUTH_DATA_REQUIRED) { + return false; + } + + return true; +} + +int samba_client_requested_pac(krb5_context context, + const krb5_pac *pac, + TALLOC_CTX *mem_ctx, + bool *requested_pac) +{ + enum ndr_err_code ndr_err; + krb5_data k5pac_attrs_in; + DATA_BLOB pac_attrs_in; + union PAC_INFO pac_attrs; + int ret; + + *requested_pac = true; + + ret = krb5_pac_get_buffer(context, *pac, PAC_TYPE_ATTRIBUTES_INFO, + &k5pac_attrs_in); + if (ret != 0) { + return ret == ENOENT ? 0 : ret; + } + + pac_attrs_in = data_blob_const(k5pac_attrs_in.data, + k5pac_attrs_in.length); + + ndr_err = ndr_pull_union_blob(&pac_attrs_in, mem_ctx, &pac_attrs, + PAC_TYPE_ATTRIBUTES_INFO, + (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO); + smb_krb5_free_data_contents(context, &k5pac_attrs_in); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(0,("can't parse the PAC ATTRIBUTES_INFO: %s\n", nt_errstr(nt_status))); + return EINVAL; + } + + if (pac_attrs.attributes_info.flags & (PAC_ATTRIBUTE_FLAG_PAC_WAS_GIVEN_IMPLICITLY + | PAC_ATTRIBUTE_FLAG_PAC_WAS_REQUESTED)) { + *requested_pac = true; + } else { + *requested_pac = false; + } + + return 0; +} + +/* Was the krbtgt in this DB (ie, should we check the incoming signature) and was it an RODC */ +int samba_krbtgt_is_in_db(struct samba_kdc_entry *p, + bool *is_in_db, + bool *is_untrusted) +{ + NTSTATUS status; + int rodc_krbtgt_number, trust_direction; + uint32_t rid; + + TALLOC_CTX *mem_ctx = talloc_new(NULL); + if (!mem_ctx) { + return ENOMEM; + } + + trust_direction = ldb_msg_find_attr_as_int(p->msg, "trustDirection", 0); + + if (trust_direction != 0) { + /* Domain trust - we cannot check the sig, but we trust it for a correct PAC + + This is exactly where we should flag for SID + validation when we do inter-foreest trusts + */ + talloc_free(mem_ctx); + *is_untrusted = false; + *is_in_db = false; + return 0; + } + + /* The lack of password controls etc applies to krbtgt by + * virtue of being that particular RID */ + status = dom_sid_split_rid(NULL, samdb_result_dom_sid(mem_ctx, p->msg, "objectSid"), NULL, &rid); + + if (!NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return EINVAL; + } + + rodc_krbtgt_number = ldb_msg_find_attr_as_int(p->msg, "msDS-SecondaryKrbTgtNumber", -1); + + if (p->kdc_db_ctx->my_krbtgt_number == 0) { + if (rid == DOMAIN_RID_KRBTGT) { + *is_untrusted = false; + *is_in_db = true; + talloc_free(mem_ctx); + return 0; + } else if (rodc_krbtgt_number != -1) { + *is_in_db = true; + *is_untrusted = true; + talloc_free(mem_ctx); + return 0; + } + } else if ((rid != DOMAIN_RID_KRBTGT) && (rodc_krbtgt_number == p->kdc_db_ctx->my_krbtgt_number)) { + talloc_free(mem_ctx); + *is_untrusted = false; + *is_in_db = true; + return 0; + } else if (rid == DOMAIN_RID_KRBTGT) { + /* krbtgt viewed from an RODC */ + talloc_free(mem_ctx); + *is_untrusted = false; + *is_in_db = false; + return 0; + } + + /* Another RODC */ + talloc_free(mem_ctx); + *is_untrusted = true; + *is_in_db = false; + return 0; +} + +/* + * Because the KDC does not limit protocol transition, two new well-known SIDs + * were introduced to give this control to the resource administrator. These + * SIDs identify whether protocol transition has occurred, and can be used with + * standard access control lists to grant or limit access as needed. + * + * https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview + */ +static NTSTATUS samba_add_asserted_identity(TALLOC_CTX *mem_ctx, + enum samba_asserted_identity ai, + struct auth_user_info_dc *user_info_dc) +{ + struct dom_sid ai_sid; + const char *sid_str = NULL; + + switch (ai) { + case SAMBA_ASSERTED_IDENTITY_SERVICE: + sid_str = SID_SERVICE_ASSERTED_IDENTITY; + break; + case SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY: + sid_str = SID_AUTHENTICATION_AUTHORITY_ASSERTED_IDENTITY; + break; + case SAMBA_ASSERTED_IDENTITY_IGNORE: + return NT_STATUS_OK; + } + + dom_sid_parse(sid_str, &ai_sid); + + return add_sid_to_array_unique(user_info_dc, + &ai_sid, + &user_info_dc->sids, + &user_info_dc->num_sids); +} + +/* + * Look up the user's info in the database and create a auth_user_info_dc + * structure. If the resulting structure is not talloc_free()d, it will be + * reused on future calls to this function. + */ +NTSTATUS samba_kdc_get_user_info_from_db(struct samba_kdc_entry *skdc_entry, + struct ldb_message *msg, + struct auth_user_info_dc **user_info_dc) +{ + if (skdc_entry->user_info_dc == NULL) { + NTSTATUS nt_status; + struct loadparm_context *lp_ctx = skdc_entry->kdc_db_ctx->lp_ctx; + + nt_status = authsam_make_user_info_dc(skdc_entry, + skdc_entry->kdc_db_ctx->samdb, + lpcfg_netbios_name(lp_ctx), + lpcfg_sam_name(lp_ctx), + lpcfg_sam_dnsname(lp_ctx), + skdc_entry->realm_dn, + msg, + data_blob_null, + data_blob_null, + &skdc_entry->user_info_dc); + if (!NT_STATUS_IS_OK(nt_status)) { + return nt_status; + } + } + + *user_info_dc = skdc_entry->user_info_dc; + return NT_STATUS_OK; +} + +NTSTATUS samba_kdc_get_pac_blobs(TALLOC_CTX *mem_ctx, + struct samba_kdc_entry *p, + enum samba_asserted_identity asserted_identity, + DATA_BLOB **_logon_info_blob, + DATA_BLOB **_cred_ndr_blob, + DATA_BLOB **_upn_info_blob, + DATA_BLOB **_pac_attrs_blob, + uint64_t pac_attributes, + DATA_BLOB **_requester_sid_blob) +{ + struct auth_user_info_dc *user_info_dc = NULL; + DATA_BLOB *logon_blob = NULL; + DATA_BLOB *cred_blob = NULL; + DATA_BLOB *upn_blob = NULL; + DATA_BLOB *pac_attrs_blob = NULL; + DATA_BLOB *requester_sid_blob = NULL; + NTSTATUS nt_status; + + *_logon_info_blob = NULL; + if (_cred_ndr_blob != NULL) { + *_cred_ndr_blob = NULL; + } + *_upn_info_blob = NULL; + if (_pac_attrs_blob != NULL) { + *_pac_attrs_blob = NULL; + } + if (_requester_sid_blob != NULL) { + *_requester_sid_blob = NULL; + } + + logon_blob = talloc_zero(mem_ctx, DATA_BLOB); + if (logon_blob == NULL) { + return NT_STATUS_NO_MEMORY; + } + + if (_cred_ndr_blob != NULL) { + cred_blob = talloc_zero(mem_ctx, DATA_BLOB); + if (cred_blob == NULL) { + return NT_STATUS_NO_MEMORY; + } + } + + upn_blob = talloc_zero(mem_ctx, DATA_BLOB); + if (upn_blob == NULL) { + return NT_STATUS_NO_MEMORY; + } + + if (_pac_attrs_blob != NULL) { + pac_attrs_blob = talloc_zero(mem_ctx, DATA_BLOB); + if (pac_attrs_blob == NULL) { + return NT_STATUS_NO_MEMORY; + } + } + + if (_requester_sid_blob != NULL) { + requester_sid_blob = talloc_zero(mem_ctx, DATA_BLOB); + if (requester_sid_blob == NULL) { + return NT_STATUS_NO_MEMORY; + } + } + + nt_status = samba_kdc_get_user_info_from_db(p, + p->msg, + &user_info_dc); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("Getting user info for PAC failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + + nt_status = samba_add_asserted_identity(mem_ctx, + asserted_identity, + user_info_dc); + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_ERR("Failed to add assertied identity!\n"); + return nt_status; + } + + nt_status = samba_get_logon_info_pac_blob(logon_blob, + user_info_dc, + logon_blob, + requester_sid_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("Building PAC LOGON INFO failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + + if (cred_blob != NULL) { + nt_status = samba_get_cred_info_ndr_blob(cred_blob, + p->msg, + cred_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("Building PAC CRED INFO failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + } + + nt_status = samba_get_upn_info_pac_blob(upn_blob, + user_info_dc, + upn_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("Building PAC UPN INFO failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + + if (pac_attrs_blob != NULL) { + nt_status = samba_get_pac_attrs_blob(pac_attrs_blob, + pac_attributes, + pac_attrs_blob); + + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("Building PAC ATTRIBUTES failed: %s\n", + nt_errstr(nt_status))); + return nt_status; + } + } + + *_logon_info_blob = logon_blob; + if (_cred_ndr_blob != NULL) { + *_cred_ndr_blob = cred_blob; + } + *_upn_info_blob = upn_blob; + if (_pac_attrs_blob != NULL) { + *_pac_attrs_blob = pac_attrs_blob; + } + if (_requester_sid_blob != NULL) { + *_requester_sid_blob = requester_sid_blob; + } + return NT_STATUS_OK; +} + +NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx, + krb5_context context, + struct ldb_context *samdb, + const krb5_pac pac, DATA_BLOB *pac_blob, + struct PAC_SIGNATURE_DATA *pac_srv_sig, + struct PAC_SIGNATURE_DATA *pac_kdc_sig) +{ + struct auth_user_info_dc *user_info_dc; + krb5_error_code ret; + NTSTATUS nt_status; + + ret = kerberos_pac_to_user_info_dc(mem_ctx, pac, + context, &user_info_dc, pac_srv_sig, pac_kdc_sig); + if (ret) { + return NT_STATUS_UNSUCCESSFUL; + } + + /* + * We need to expand group memberships within our local domain, + * as the token might be generated by a trusted domain. + */ + nt_status = authsam_update_user_info_dc(mem_ctx, + samdb, + user_info_dc); + if (!NT_STATUS_IS_OK(nt_status)) { + return nt_status; + } + + nt_status = samba_get_logon_info_pac_blob(mem_ctx, + user_info_dc, pac_blob, NULL); + + return nt_status; +} + +NTSTATUS samba_kdc_update_delegation_info_blob(TALLOC_CTX *mem_ctx, + krb5_context context, + const krb5_pac pac, + const krb5_principal server_principal, + const krb5_principal proxy_principal, + DATA_BLOB *new_blob) +{ + krb5_data old_data; + DATA_BLOB old_blob; + krb5_error_code ret; + NTSTATUS nt_status; + enum ndr_err_code ndr_err; + union PAC_INFO info; + struct PAC_CONSTRAINED_DELEGATION _d; + struct PAC_CONSTRAINED_DELEGATION *d = NULL; + char *server = NULL; + char *proxy = NULL; + uint32_t i; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); + + if (tmp_ctx == NULL) { + return NT_STATUS_NO_MEMORY; + } + + ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_CONSTRAINED_DELEGATION, &old_data); + if (ret == ENOENT) { + ZERO_STRUCT(old_data); + } else if (ret) { + talloc_free(tmp_ctx); + return NT_STATUS_UNSUCCESSFUL; + } + + old_blob.length = old_data.length; + old_blob.data = (uint8_t *)old_data.data; + + ZERO_STRUCT(info); + if (old_blob.length > 0) { + ndr_err = ndr_pull_union_blob(&old_blob, mem_ctx, + &info, PAC_TYPE_CONSTRAINED_DELEGATION, + (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + smb_krb5_free_data_contents(context, &old_data); + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(0,("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status))); + talloc_free(tmp_ctx); + return nt_status; + } + } else { + ZERO_STRUCT(_d); + info.constrained_delegation.info = &_d; + } + smb_krb5_free_data_contents(context, &old_data); + + ret = krb5_unparse_name_flags(context, server_principal, + KRB5_PRINCIPAL_UNPARSE_NO_REALM, &server); + if (ret) { + talloc_free(tmp_ctx); + return NT_STATUS_INTERNAL_ERROR; + } + + ret = krb5_unparse_name(context, proxy_principal, &proxy); + if (ret) { + SAFE_FREE(server); + talloc_free(tmp_ctx); + return NT_STATUS_INTERNAL_ERROR; + } + + d = info.constrained_delegation.info; + i = d->num_transited_services; + d->proxy_target.string = server; + d->transited_services = talloc_realloc(mem_ctx, d->transited_services, + struct lsa_String, i + 1); + d->transited_services[i].string = proxy; + d->num_transited_services = i + 1; + + ndr_err = ndr_push_union_blob(new_blob, mem_ctx, + &info, PAC_TYPE_CONSTRAINED_DELEGATION, + (ndr_push_flags_fn_t)ndr_push_PAC_INFO); + SAFE_FREE(server); + SAFE_FREE(proxy); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + smb_krb5_free_data_contents(context, &old_data); + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(0,("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status))); + talloc_free(tmp_ctx); + return nt_status; + } + + talloc_free(tmp_ctx); + return NT_STATUS_OK; +} + +/* function to map policy errors */ +krb5_error_code samba_kdc_map_policy_err(NTSTATUS nt_status) +{ + krb5_error_code ret; + + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_MUST_CHANGE)) + ret = KRB5KDC_ERR_KEY_EXP; + else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_EXPIRED)) + ret = KRB5KDC_ERR_KEY_EXP; + else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_EXPIRED)) + ret = KRB5KDC_ERR_CLIENT_REVOKED; + else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_DISABLED)) + ret = KRB5KDC_ERR_CLIENT_REVOKED; + else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_LOGON_HOURS)) + ret = KRB5KDC_ERR_CLIENT_REVOKED; + else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_LOCKED_OUT)) + ret = KRB5KDC_ERR_CLIENT_REVOKED; + else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_WORKSTATION)) + ret = KRB5KDC_ERR_POLICY; + else + ret = KRB5KDC_ERR_POLICY; + + return ret; +} + +/* Given a kdc entry, consult the account_ok routine in auth/auth_sam.c + * for consistency */ +NTSTATUS samba_kdc_check_client_access(struct samba_kdc_entry *kdc_entry, + const char *client_name, + const char *workstation, + bool password_change) +{ + TALLOC_CTX *tmp_ctx; + NTSTATUS nt_status; + + tmp_ctx = talloc_named(NULL, 0, "samba_kdc_check_client_access"); + if (!tmp_ctx) { + return NT_STATUS_NO_MEMORY; + } + + /* we allow all kinds of trusts here */ + nt_status = authsam_account_ok(tmp_ctx, + kdc_entry->kdc_db_ctx->samdb, + MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | + MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT, + kdc_entry->realm_dn, kdc_entry->msg, + workstation, client_name, + true, password_change); + + kdc_entry->reject_status = nt_status; + talloc_free(tmp_ctx); + return nt_status; +} + +static krb5_error_code samba_get_requester_sid(TALLOC_CTX *mem_ctx, + krb5_pac pac, + krb5_context context, + struct dom_sid *sid) +{ + NTSTATUS nt_status; + enum ndr_err_code ndr_err; + krb5_error_code ret; + + DATA_BLOB pac_requester_sid_in; + krb5_data k5pac_requester_sid_in; + + union PAC_INFO info; + + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); + if (tmp_ctx == NULL) { + return ENOMEM; + } + + ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_REQUESTER_SID, + &k5pac_requester_sid_in); + if (ret != 0) { + talloc_free(tmp_ctx); + return ret; + } + + pac_requester_sid_in = data_blob_const(k5pac_requester_sid_in.data, + k5pac_requester_sid_in.length); + + ndr_err = ndr_pull_union_blob(&pac_requester_sid_in, tmp_ctx, &info, + PAC_TYPE_REQUESTER_SID, + (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO); + smb_krb5_free_data_contents(context, &k5pac_requester_sid_in); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + nt_status = ndr_map_error2ntstatus(ndr_err); + DEBUG(0,("can't parse the PAC REQUESTER_SID: %s\n", nt_errstr(nt_status))); + talloc_free(tmp_ctx); + return EINVAL; + } + + *sid = info.requester_sid.sid; + + talloc_free(tmp_ctx); + return 0; +} + +/* Does a parse and SID check, but no crypto. */ +krb5_error_code samba_kdc_validate_pac_blob( + krb5_context context, + struct samba_kdc_entry *client_skdc_entry, + const krb5_pac pac) +{ + TALLOC_CTX *frame = talloc_stackframe(); + struct auth_user_info_dc *pac_user_info = NULL; + struct dom_sid *client_sid = NULL; + struct dom_sid pac_sid; + krb5_error_code code; + bool ok; + + /* + * First, try to get the SID from the requester SID buffer in the PAC. + */ + code = samba_get_requester_sid(frame, pac, context, &pac_sid); + + if (code == ENOENT) { + /* + * If the requester SID buffer isn't present, fall back to the + * SID in the LOGON_INFO PAC buffer. + */ + code = kerberos_pac_to_user_info_dc(frame, + pac, + context, + &pac_user_info, + NULL, + NULL); + if (code != 0) { + goto out; + } + + if (pac_user_info->num_sids == 0) { + code = EINVAL; + goto out; + } + + pac_sid = pac_user_info->sids[0]; + } else if (code != 0) { + goto out; + } + + client_sid = samdb_result_dom_sid(frame, + client_skdc_entry->msg, + "objectSid"); + + ok = dom_sid_equal(&pac_sid, client_sid); + if (!ok) { + struct dom_sid_buf buf1; + struct dom_sid_buf buf2; + + DBG_ERR("SID mismatch between PAC and looked up client: " + "PAC[%s] != CLI[%s]\n", + dom_sid_str_buf(&pac_sid, &buf1), + dom_sid_str_buf(client_sid, &buf2)); + code = KRB5KDC_ERR_TGT_REVOKED; + goto out; + } + + code = 0; +out: + TALLOC_FREE(frame); + return code; +} + + +/* + * In the RODC case, to confirm that the returned user is permitted to + * be replicated to the KDC (krbgtgt_xxx user) represented by *rodc + */ +WERROR samba_rodc_confirm_user_is_allowed(uint32_t num_object_sids, + struct dom_sid *object_sids, + struct samba_kdc_entry *rodc, + struct samba_kdc_entry *object) +{ + int ret; + WERROR werr; + TALLOC_CTX *frame = talloc_stackframe(); + const char *rodc_attrs[] = { "msDS-KrbTgtLink", + "msDS-NeverRevealGroup", + "msDS-RevealOnDemandGroup", + "userAccountControl", + "objectSid", + NULL }; + struct ldb_result *rodc_machine_account = NULL; + struct ldb_dn *rodc_machine_account_dn = samdb_result_dn(rodc->kdc_db_ctx->samdb, + frame, + rodc->msg, + "msDS-KrbTgtLinkBL", + NULL); + const struct dom_sid *rodc_machine_account_sid = NULL; + + if (rodc_machine_account_dn == NULL) { + DBG_ERR("krbtgt account %s has no msDS-KrbTgtLinkBL to find RODC machine account for allow/deny list\n", + ldb_dn_get_linearized(rodc->msg->dn)); + TALLOC_FREE(frame); + return WERR_DOMAIN_CONTROLLER_NOT_FOUND; + } + + /* + * Follow the link and get the RODC account (the krbtgt + * account is the krbtgt_XXX account, but the + * msDS-NeverRevealGroup and msDS-RevealOnDemandGroup is on + * the RODC$ account) + * + * We need DSDB_SEARCH_SHOW_EXTENDED_DN as we get a SID lists + * out of the extended DNs + */ + + ret = dsdb_search_dn(rodc->kdc_db_ctx->samdb, + frame, + &rodc_machine_account, + rodc_machine_account_dn, + rodc_attrs, + DSDB_SEARCH_SHOW_EXTENDED_DN); + if (ret != LDB_SUCCESS) { + DBG_ERR("Failed to fetch RODC machine account %s pointed to by %s to check allow/deny list: %s\n", + ldb_dn_get_linearized(rodc_machine_account_dn), + ldb_dn_get_linearized(rodc->msg->dn), + ldb_errstring(rodc->kdc_db_ctx->samdb)); + TALLOC_FREE(frame); + return WERR_DOMAIN_CONTROLLER_NOT_FOUND; + } + + if (rodc_machine_account->count != 1) { + DBG_ERR("Failed to fetch RODC machine account %s pointed to by %s to check allow/deny list: (%d)\n", + ldb_dn_get_linearized(rodc_machine_account_dn), + ldb_dn_get_linearized(rodc->msg->dn), + rodc_machine_account->count); + TALLOC_FREE(frame); + return WERR_DS_DRA_BAD_DN; + } + + /* if the object SID is equal to the user_sid, allow */ + rodc_machine_account_sid = samdb_result_dom_sid(frame, + rodc_machine_account->msgs[0], + "objectSid"); + if (rodc_machine_account_sid == NULL) { + return WERR_DS_DRA_BAD_DN; + } + + werr = samdb_confirm_rodc_allowed_to_repl_to_sid_list(rodc->kdc_db_ctx->samdb, + rodc_machine_account_sid, + rodc_machine_account->msgs[0], + object->msg, + num_object_sids, + object_sids); + + TALLOC_FREE(frame); + return werr; +} + +/** + * @brief Update a PAC + * + * @param mem_ctx A talloc memory context + * + * @param context A krb5 context + * + * @param samdb An open samdb connection. + * + * @param flags Bitwise OR'ed flags + * + * @param client The client samba kdc entry. + + * @param server_principal The server principal + + * @param server The server samba kdc entry. + + * @param krbtgt The krbtgt samba kdc entry. + * + * @param delegated_proxy_principal The delegated proxy principal used for + * updating the constrained delegation PAC + * buffer. + + * @param old_pac The old PAC + + * @param new_pac The new already allocated PAC + + * @return A Kerberos error code. If no PAC should be returned, the code will be + * ENODATA! + */ +krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx, + krb5_context context, + struct ldb_context *samdb, + uint32_t flags, + struct samba_kdc_entry *client, + const krb5_principal server_principal, + struct samba_kdc_entry *server, + struct samba_kdc_entry *krbtgt, + const krb5_principal delegated_proxy_principal, + const krb5_pac old_pac, + krb5_pac new_pac) +{ + krb5_error_code code = EINVAL; + NTSTATUS nt_status; + DATA_BLOB *pac_blob = NULL; + DATA_BLOB *upn_blob = NULL; + DATA_BLOB *deleg_blob = NULL; + DATA_BLOB *requester_sid_blob = NULL; + bool is_untrusted = flags & SAMBA_KDC_FLAG_KRBTGT_IS_UNTRUSTED; + int is_tgs = false; + size_t num_types = 0; + uint32_t *types = NULL; + /* + * FIXME: Do we really still need forced_next_type? With MIT Kerberos + * the PAC buffers do not get ordered and it works just fine. We are + * not aware of any issues in this regard. This might be just ancient + * code. + */ + uint32_t forced_next_type = 0; + size_t i = 0; + ssize_t logon_info_idx = -1; + ssize_t delegation_idx = -1; + ssize_t logon_name_idx = -1; + ssize_t upn_dns_info_idx = -1; + ssize_t srv_checksum_idx = -1; + ssize_t kdc_checksum_idx = -1; + ssize_t tkt_checksum_idx = -1; + ssize_t attrs_info_idx = -1; + ssize_t requester_sid_idx = -1; + ssize_t full_checksum_idx = -1; + + if (client != NULL) { + /* + * Check the objectSID of the client and pac data are the same. + * Does a parse and SID check, but no crypto. + */ + code = samba_kdc_validate_pac_blob(context, + client, + old_pac); + if (code != 0) { + goto done; + } + } + + if (delegated_proxy_principal != NULL) { + deleg_blob = talloc_zero(mem_ctx, DATA_BLOB); + if (deleg_blob == NULL) { + code = ENOMEM; + goto done; + } + + nt_status = samba_kdc_update_delegation_info_blob( + mem_ctx, + context, + old_pac, + server_principal, + delegated_proxy_principal, + deleg_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_ERR("update delegation info blob failed: %s\n", + nt_errstr(nt_status)); + code = EINVAL; + goto done; + } + } + + if (is_untrusted) { + struct auth_user_info_dc *user_info_dc = NULL; + WERROR werr; + /* + * In this case the RWDC discards the PAC an RODC generated. + * Windows adds the asserted_identity in this case too. + * + * Note that SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION + * generates KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN. + * So we can always use + * SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY + * here. + */ + enum samba_asserted_identity asserted_identity = + SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY; + + if (client == NULL) { + code = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; + goto done; + } + + nt_status = samba_kdc_get_pac_blobs(mem_ctx, + client, + asserted_identity, + &pac_blob, + NULL, + &upn_blob, + NULL, + PAC_ATTRIBUTE_FLAG_PAC_WAS_GIVEN_IMPLICITLY, + &requester_sid_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_ERR("samba_kdc_get_pac_blobs failed: %s\n", + nt_errstr(nt_status)); + code = KRB5KDC_ERR_TGT_REVOKED; + goto done; + } + + nt_status = samba_kdc_get_user_info_from_db(client, + client->msg, + &user_info_dc); + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_ERR("samba_kdc_get_user_info_from_db failed: %s\n", + nt_errstr(nt_status)); + code = KRB5KDC_ERR_TGT_REVOKED; + goto done; + } + + /* + * Check if the SID list in the user_info_dc intersects + * correctly with the RODC allow/deny lists. + */ + werr = samba_rodc_confirm_user_is_allowed(user_info_dc->num_sids, + user_info_dc->sids, + krbtgt, + client); + TALLOC_FREE(user_info_dc); + if (!W_ERROR_IS_OK(werr)) { + code = KRB5KDC_ERR_TGT_REVOKED; + if (W_ERROR_EQUAL(werr, + WERR_DOMAIN_CONTROLLER_NOT_FOUND)) { + code = KRB5KDC_ERR_POLICY; + } + goto done; + } + + /* + * The RODC PAC data isn't trusted for authorization as it may + * be stale. The only thing meaningful we can do with an RODC + * account on a full DC is exchange the RODC TGT for a 'real' + * TGT. + * + * So we match Windows (at least server 2022) and + * don't allow S4U2Self. + * + * https://lists.samba.org/archive/cifs-protocol/2022-April/003673.html + */ + if (flags & SAMBA_KDC_FLAG_PROTOCOL_TRANSITION) { + code = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN; + goto done; + } + } else { + pac_blob = talloc_zero(mem_ctx, DATA_BLOB); + if (pac_blob == NULL) { + code = ENOMEM; + goto done; + } + + nt_status = samba_kdc_update_pac_blob(mem_ctx, + context, + samdb, + old_pac, + pac_blob, + NULL, + NULL); + if (!NT_STATUS_IS_OK(nt_status)) { + DBG_ERR("samba_kdc_update_pac_blob failed: %s\n", + nt_errstr(nt_status)); + code = EINVAL; + goto done; + } + } + + /* Check the types of the given PAC */ + code = krb5_pac_get_types(context, old_pac, &num_types, &types); + if (code != 0) { + DBG_ERR("krb5_pac_get_types failed\n"); + goto done; + } + + for (i = 0; i < num_types; i++) { + switch (types[i]) { + case PAC_TYPE_LOGON_INFO: + if (logon_info_idx != -1) { + DBG_WARNING("logon info type[%u] twice [%zd] " + "and [%zu]: \n", + types[i], + logon_info_idx, + i); + code = EINVAL; + goto done; + } + logon_info_idx = i; + break; + case PAC_TYPE_CONSTRAINED_DELEGATION: + if (delegation_idx != -1) { + DBG_WARNING("constrained delegation type[%u] " + "twice [%zd] and [%zu]: \n", + types[i], + delegation_idx, + i); + code = EINVAL; + goto done; + } + delegation_idx = i; + break; + case PAC_TYPE_LOGON_NAME: + if (logon_name_idx != -1) { + DBG_WARNING("logon name type[%u] twice [%zd] " + "and [%zu]: \n", + types[i], + logon_name_idx, + i); + code = EINVAL; + goto done; + } + logon_name_idx = i; + break; + case PAC_TYPE_UPN_DNS_INFO: + if (upn_dns_info_idx != -1) { + DBG_WARNING("upn dns info type[%u] twice [%zd] " + "and [%zu]: \n", + types[i], + upn_dns_info_idx, + i); + code = EINVAL; + goto done; + } + upn_dns_info_idx = i; + break; + case PAC_TYPE_SRV_CHECKSUM: + if (srv_checksum_idx != -1) { + DBG_WARNING("srv checksum type[%u] twice [%zd] " + "and [%zu]: \n", + types[i], + srv_checksum_idx, + i); + code = EINVAL; + goto done; + } + srv_checksum_idx = i; + break; + case PAC_TYPE_KDC_CHECKSUM: + if (kdc_checksum_idx != -1) { + DBG_WARNING("kdc checksum type[%u] twice [%zd] " + "and [%zu]: \n", + types[i], + kdc_checksum_idx, + i); + code = EINVAL; + goto done; + } + kdc_checksum_idx = i; + break; + case PAC_TYPE_TICKET_CHECKSUM: + if (tkt_checksum_idx != -1) { + DBG_WARNING("ticket checksum type[%u] twice " + "[%zd] and [%zu]: \n", + types[i], + tkt_checksum_idx, + i); + code = EINVAL; + goto done; + } + tkt_checksum_idx = i; + break; + case PAC_TYPE_ATTRIBUTES_INFO: + if (attrs_info_idx != -1) { + DBG_WARNING("attributes info type[%u] twice " + "[%zd] and [%zu]: \n", + types[i], + attrs_info_idx, + i); + code = EINVAL; + goto done; + } + attrs_info_idx = i; + break; + case PAC_TYPE_REQUESTER_SID: + if (requester_sid_idx != -1) { + DBG_WARNING("requester sid type[%u] twice" + "[%zd] and [%zu]: \n", + types[i], + requester_sid_idx, + i); + code = EINVAL; + goto done; + } + requester_sid_idx = i; + break; + case PAC_TYPE_FULL_CHECKSUM: + if (full_checksum_idx != -1) { + DBG_WARNING("full checksum type[%u] twice " + "[%zd] and [%zu]: \n", + types[i], + full_checksum_idx, + i); + code = EINVAL; + goto done; + } + full_checksum_idx = i; + break; + default: + continue; + } + } + + if (logon_info_idx == -1) { + DBG_WARNING("PAC_TYPE_LOGON_INFO missing\n"); + code = EINVAL; + goto done; + } + if (logon_name_idx == -1) { + DBG_WARNING("PAC_TYPE_LOGON_NAME missing\n"); + code = EINVAL; + goto done; + } + if (srv_checksum_idx == -1) { + DBG_WARNING("PAC_TYPE_SRV_CHECKSUM missing\n"); + code = EINVAL; + goto done; + } + if (kdc_checksum_idx == -1) { + DBG_WARNING("PAC_TYPE_KDC_CHECKSUM missing\n"); + code = EINVAL; + goto done; + } + if (!(flags & SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION) && + requester_sid_idx == -1) { + DBG_WARNING("PAC_TYPE_REQUESTER_SID missing\n"); + code = KRB5KDC_ERR_TGT_REVOKED; + goto done; + } + + /* + * The server account may be set not to want the PAC. + * + * While this is wasteful if the above cacluations were done + * and now thrown away, this is cleaner as we do any ticket + * signature checking etc always. + * + * UF_NO_AUTH_DATA_REQUIRED is the rare case and most of the + * time (eg not accepting a ticket from the RODC) we do not + * need to re-generate anything anyway. + */ + if (!samba_princ_needs_pac(server)) { + code = ENODATA; + goto done; + } + + is_tgs = smb_krb5_principal_is_tgs(context, server_principal); + if (is_tgs == -1) { + code = ENOMEM; + goto done; + } + + if (!is_untrusted && !is_tgs) { + /* + * The client may have requested no PAC when obtaining the + * TGT. + */ + bool requested_pac = false; + + code = samba_client_requested_pac(context, + &old_pac, + mem_ctx, + &requested_pac); + if (code != 0 || !requested_pac) { + if (!requested_pac) { + code = ENODATA; + } + goto done; + } + } + +#define MAX_PAC_BUFFERS 128 /* Avoid infinite loops */ + + for (i = 0; i < MAX_PAC_BUFFERS;) { + const uint8_t zero_byte = 0; + krb5_data type_data; + DATA_BLOB type_blob = data_blob_null; + uint32_t type; + + if (forced_next_type != 0) { + /* + * We need to inject possible missing types + */ + type = forced_next_type; + forced_next_type = 0; + } else if (i < num_types) { + type = types[i]; + i++; + } else { + break; + } + + switch (type) { + case PAC_TYPE_LOGON_INFO: + type_blob = *pac_blob; + + if (delegation_idx == -1 && deleg_blob != NULL) { + /* inject CONSTRAINED_DELEGATION behind */ + forced_next_type = + PAC_TYPE_CONSTRAINED_DELEGATION; + } + break; + case PAC_TYPE_CONSTRAINED_DELEGATION: + /* + * This is generated in the main KDC code + */ + if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) { + continue; + } + + if (deleg_blob != NULL) { + type_blob = *deleg_blob; + } + break; + case PAC_TYPE_CREDENTIAL_INFO: + /* + * Note that we copy the credential blob, + * as it's only usable with the PKINIT based + * AS-REP reply key, it's only available on the + * host which did the AS-REQ/AS-REP exchange. + * + * This matches Windows 2008R2... + */ + break; + case PAC_TYPE_LOGON_NAME: + /* + * This is generated in the main KDC code + */ + if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) { + continue; + } + + type_blob = data_blob_const(&zero_byte, 1); + + if (upn_dns_info_idx == -1 && upn_blob != NULL) { + /* inject UPN_DNS_INFO behind */ + forced_next_type = PAC_TYPE_UPN_DNS_INFO; + } + break; + case PAC_TYPE_UPN_DNS_INFO: + /* + * Replace in the RODC case, otherwise + * upn_blob is NULL and we just copy. + */ + if (upn_blob != NULL) { + type_blob = *upn_blob; + } + break; + case PAC_TYPE_SRV_CHECKSUM: + /* + * This is generated in the main KDC code + */ + if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) { + continue; + } + + type_blob = data_blob_const(&zero_byte, 1); + + if (requester_sid_idx == -1 && requester_sid_blob != NULL) { + /* inject REQUESTER_SID behind */ + forced_next_type = PAC_TYPE_REQUESTER_SID; + } + break; + case PAC_TYPE_KDC_CHECKSUM: + /* + * This is generated in the main KDC code + */ + if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) { + continue; + } + + type_blob = data_blob_const(&zero_byte, 1); + + break; + case PAC_TYPE_TICKET_CHECKSUM: + /* + * This is generated in the main KDC code + */ + if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) { + continue; + } + + type_blob = data_blob_const(&zero_byte, 1); + + break; + case PAC_TYPE_ATTRIBUTES_INFO: + if (!is_untrusted && is_tgs) { + /* just copy... */ + break; + } + + continue; + case PAC_TYPE_REQUESTER_SID: + if (!is_tgs) { + continue; + } + + /* + * Replace in the RODC case, otherwise + * requester_sid_blob is NULL and we just copy. + */ + if (requester_sid_blob != NULL) { + type_blob = *requester_sid_blob; + } + break; + case PAC_TYPE_FULL_CHECKSUM: + /* + * This is generated in the main KDC code + */ + if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) { + continue; + } + + type_blob = data_blob_const(&zero_byte, 1); + + break; + default: + /* just copy... */ + break; + } + + if (type_blob.length != 0) { + code = smb_krb5_copy_data_contents(&type_data, + type_blob.data, + type_blob.length); + if (code != 0) { + goto done; + } + } else { + code = krb5_pac_get_buffer(context, + old_pac, + type, + &type_data); + if (code != 0) { + goto done; + } + } + + code = krb5_pac_add_buffer(context, + new_pac, + type, + &type_data); + smb_krb5_free_data_contents(context, &type_data); + if (code != 0) { + goto done; + } + } + + code = 0; +done: + TALLOC_FREE(pac_blob); + TALLOC_FREE(upn_blob); + TALLOC_FREE(deleg_blob); + SAFE_FREE(types); + return code; +} diff --git a/source4/kdc/pac-glue.h b/source4/kdc/pac-glue.h new file mode 100644 index 0000000..7b7c489 --- /dev/null +++ b/source4/kdc/pac-glue.h @@ -0,0 +1,122 @@ +/* + Unix SMB/CIFS implementation. + + PAC Glue between Samba and the KDC + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009 + Copyright (C) Simo Sorce <idra@samba.org> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +enum samba_asserted_identity { + SAMBA_ASSERTED_IDENTITY_IGNORE = 0, + SAMBA_ASSERTED_IDENTITY_SERVICE, + SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY, +}; + +enum { + SAMBA_KDC_FLAG_PROTOCOL_TRANSITION = 0x00000001, + SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION = 0x00000002, + SAMBA_KDC_FLAG_KRBTGT_IN_DB = 0x00000004, + SAMBA_KDC_FLAG_KRBTGT_IS_UNTRUSTED = 0x00000008, + SAMBA_KDC_FLAG_SKIP_PAC_BUFFER = 0x00000010, +}; + +krb5_error_code samba_kdc_encrypt_pac_credentials(krb5_context context, + const krb5_keyblock *pkreplykey, + const DATA_BLOB *cred_ndr_blob, + TALLOC_CTX *mem_ctx, + DATA_BLOB *cred_info_blob); + +krb5_error_code samba_make_krb5_pac(krb5_context context, + const DATA_BLOB *logon_blob, + const DATA_BLOB *cred_blob, + const DATA_BLOB *upn_blob, + const DATA_BLOB *pac_attrs_blob, + const DATA_BLOB *requester_sid_blob, + const DATA_BLOB *deleg_blob, + krb5_pac pac); + +bool samba_princ_needs_pac(struct samba_kdc_entry *skdc_entry); + +int samba_client_requested_pac(krb5_context context, + const krb5_pac *pac, + TALLOC_CTX *mem_ctx, + bool *requested_pac); + +int samba_krbtgt_is_in_db(struct samba_kdc_entry *skdc_entry, + bool *is_in_db, + bool *is_untrusted); + +NTSTATUS samba_kdc_get_user_info_from_db(struct samba_kdc_entry *skdc_entry, + struct ldb_message *msg, + struct auth_user_info_dc **user_info_dc); + +NTSTATUS samba_kdc_get_pac_blobs(TALLOC_CTX *mem_ctx, + struct samba_kdc_entry *skdc_entry, + enum samba_asserted_identity asserted_identity, + DATA_BLOB **_logon_info_blob, + DATA_BLOB **_cred_ndr_blob, + DATA_BLOB **_upn_info_blob, + DATA_BLOB **_pac_attrs_blob, + uint64_t pac_attributes, + DATA_BLOB **_requester_sid_blob); +NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx, + krb5_context context, + struct ldb_context *samdb, + const krb5_pac pac, DATA_BLOB *pac_blob, + struct PAC_SIGNATURE_DATA *pac_srv_sig, + struct PAC_SIGNATURE_DATA *pac_kdc_sig); + +NTSTATUS samba_kdc_update_delegation_info_blob(TALLOC_CTX *mem_ctx, + krb5_context context, + const krb5_pac pac, + const krb5_principal server_principal, + const krb5_principal proxy_principal, + DATA_BLOB *pac_blob); + +krb5_error_code samba_kdc_map_policy_err(NTSTATUS nt_status); + +NTSTATUS samba_kdc_check_client_access(struct samba_kdc_entry *kdc_entry, + const char *client_name, + const char *workstation, + bool password_change); + +krb5_error_code samba_kdc_validate_pac_blob( + krb5_context context, + struct samba_kdc_entry *client_skdc_entry, + const krb5_pac pac); + +/* + * In the RODC case, to confirm that the returned user is permitted to + * be replicated to the KDC (krbgtgt_xxx user) represented by *rodc + */ +WERROR samba_rodc_confirm_user_is_allowed(uint32_t num_sids, + struct dom_sid *sids, + struct samba_kdc_entry *rodc, + struct samba_kdc_entry *object); + +krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx, + krb5_context context, + struct ldb_context *samdb, + uint32_t flags, + struct samba_kdc_entry *client, + const krb5_principal server_principal, + struct samba_kdc_entry *server, + struct samba_kdc_entry *krbtgt, + const krb5_principal delegated_proxy_principal, + const krb5_pac old_pac, + krb5_pac new_pac); diff --git a/source4/kdc/samba_kdc.h b/source4/kdc/samba_kdc.h new file mode 100644 index 0000000..5d73c5b --- /dev/null +++ b/source4/kdc/samba_kdc.h @@ -0,0 +1,73 @@ +/* + Unix SMB/CIFS implementation. + + KDC structures + + Copyright (C) Andrew Tridgell 2005 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + Copyright (C) Simo Sorce <idra@samba.org> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _SAMBA_KDC_H_ +#define _SAMBA_KDC_H_ + +struct samba_kdc_policy { + time_t svc_tkt_lifetime; + time_t usr_tkt_lifetime; + time_t renewal_lifetime; +}; + +struct samba_kdc_base_context { + struct tevent_context *ev_ctx; + struct loadparm_context *lp_ctx; + struct imessaging_context *msg_ctx; +}; + +struct samba_kdc_seq; + +struct samba_kdc_db_context { + struct tevent_context *ev_ctx; + struct loadparm_context *lp_ctx; + struct imessaging_context *msg_ctx; + struct ldb_context *samdb; + struct samba_kdc_seq *seq_ctx; + bool rodc; + unsigned int my_krbtgt_number; + struct ldb_dn *krbtgt_dn; + struct samba_kdc_policy policy; + struct ldb_dn *fx_cookie_dn; + struct ldb_context *secrets_db; +}; + +struct samba_kdc_entry { + struct samba_kdc_db_context *kdc_db_ctx; + const struct sdb_entry *db_entry; /* this is only temporary valid */ + const void *kdc_entry; /* this is a reference to hdb_entry/krb5_db_entry */ + struct ldb_message *msg; + struct ldb_dn *realm_dn; + struct auth_user_info_dc *user_info_dc; + bool is_krbtgt; + bool is_rodc; + bool is_trust; + uint32_t supported_enctypes; + NTSTATUS reject_status; +}; + +extern struct hdb_method hdb_samba4_interface; + +#define CHANGEPW_LIFETIME 60*2 /* 2 minutes */ + +#endif /* _SAMBA_KDC_H_ */ diff --git a/source4/kdc/sdb.c b/source4/kdc/sdb.c new file mode 100644 index 0000000..5fb1146 --- /dev/null +++ b/source4/kdc/sdb.c @@ -0,0 +1,212 @@ +/* + Unix SMB/CIFS implementation. + + Database Glue between Samba and the KDC + + Copyright (C) Guenther Deschner <gd@samba.org> 2014 + Copyright (C) Andreas Schneider <asn@samba.org> 2014 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "system/kerberos.h" +#include "sdb.h" +#include "samba_kdc.h" +#include "lib/krb5_wrap/krb5_samba.h" + +void sdb_key_free(struct sdb_key *k) +{ + if (k == NULL) { + return; + } + + /* + * Passing NULL as the Kerberos context is intentional here, as + * both Heimdal and MIT libraries don't use the context when + * clearing the keyblocks. + */ + krb5_free_keyblock_contents(NULL, &k->key); + + if (k->salt) { + smb_krb5_free_data_contents(NULL, &k->salt->salt); + SAFE_FREE(k->salt); + } + + ZERO_STRUCTP(k); +} + +void sdb_keys_free(struct sdb_keys *keys) +{ + unsigned int i; + + if (keys == NULL) { + return; + } + + for (i=0; i < keys->len; i++) { + sdb_key_free(&keys->val[i]); + } + + SAFE_FREE(keys->val); + ZERO_STRUCTP(keys); +} + +void sdb_entry_free(struct sdb_entry *s) +{ + if (s->skdc_entry != NULL) { + s->skdc_entry->db_entry = NULL; + TALLOC_FREE(s->skdc_entry); + } + + /* + * Passing NULL as the Kerberos context is intentional here, as both + * Heimdal and MIT libraries don't use the context when clearing the + * principals. + */ + krb5_free_principal(NULL, s->principal); + + sdb_keys_free(&s->keys); + sdb_keys_free(&s->old_keys); + sdb_keys_free(&s->older_keys); + krb5_free_principal(NULL, s->created_by.principal); + if (s->modified_by) { + krb5_free_principal(NULL, s->modified_by->principal); + } + SAFE_FREE(s->valid_start); + SAFE_FREE(s->valid_end); + SAFE_FREE(s->pw_end); + + ZERO_STRUCTP(s); +} + +struct SDBFlags int2SDBFlags(unsigned n) +{ + struct SDBFlags flags; + + memset(&flags, 0, sizeof(flags)); + + flags.initial = (n >> 0) & 1; + flags.forwardable = (n >> 1) & 1; + flags.proxiable = (n >> 2) & 1; + flags.renewable = (n >> 3) & 1; + flags.postdate = (n >> 4) & 1; + flags.server = (n >> 5) & 1; + flags.client = (n >> 6) & 1; + flags.invalid = (n >> 7) & 1; + flags.require_preauth = (n >> 8) & 1; + flags.change_pw = (n >> 9) & 1; + flags.require_hwauth = (n >> 10) & 1; + flags.ok_as_delegate = (n >> 11) & 1; + flags.user_to_user = (n >> 12) & 1; + flags.immutable = (n >> 13) & 1; + flags.trusted_for_delegation = (n >> 14) & 1; + flags.allow_kerberos4 = (n >> 15) & 1; + flags.allow_digest = (n >> 16) & 1; + flags.locked_out = (n >> 17) & 1; + flags.do_not_store = (n >> 31) & 1; + return flags; +} + +/* Set the etypes of an sdb_entry based on its available current keys. */ +krb5_error_code sdb_entry_set_etypes(struct sdb_entry *s) +{ + if (s->keys.val != NULL) { + unsigned i; + + s->etypes = malloc(sizeof(*s->etypes)); + if (s->etypes == NULL) { + return ENOMEM; + } + + s->etypes->len = s->keys.len; + + s->etypes->val = calloc(s->etypes->len, sizeof(*s->etypes->val)); + if (s->etypes->val == NULL) { + return ENOMEM; + } + + for (i = 0; i < s->etypes->len; i++) { + const struct sdb_key *k = &s->keys.val[i]; + + s->etypes->val[i] = KRB5_KEY_TYPE(&(k->key)); + } + } + + return 0; +} + +/* + * Set the session etypes of a server sdb_entry based on its etypes, forcing in + * strong etypes as desired. + */ +krb5_error_code sdb_entry_set_session_etypes(struct sdb_entry *s, + bool add_aes256, + bool add_aes128, + bool add_rc4) +{ + unsigned len = 0; + + if (add_aes256) { + /* Reserve space for AES256 */ + len += 1; + } + + if (add_aes128) { + /* Reserve space for AES128 */ + len += 1; + } + + if (add_rc4) { + /* Reserve space for RC4. */ + len += 1; + } + + if (len != 0) { + unsigned j = 0; + + s->session_etypes = malloc(sizeof(*s->session_etypes)); + if (s->session_etypes == NULL) { + return ENOMEM; + } + + /* session_etypes must be sorted in order of strength, with preferred etype first. */ + + s->session_etypes->val = calloc(len, sizeof(*s->session_etypes->val)); + if (s->session_etypes->val == NULL) { + SAFE_FREE(s->session_etypes); + return ENOMEM; + } + + if (add_aes256) { + /* Add AES256 */ + s->session_etypes->val[j++] = ENCTYPE_AES256_CTS_HMAC_SHA1_96; + } + + if (add_aes128) { + /* Add AES128. */ + s->session_etypes->val[j++] = ENCTYPE_AES128_CTS_HMAC_SHA1_96; + } + + if (add_rc4) { + /* Add RC4. */ + s->session_etypes->val[j++] = ENCTYPE_ARCFOUR_HMAC; + } + + s->session_etypes->len = j; + } + + return 0; +} diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h new file mode 100644 index 0000000..ec1ce59 --- /dev/null +++ b/source4/kdc/sdb.h @@ -0,0 +1,146 @@ +/* + Unix SMB/CIFS implementation. + + Database Glue between Samba and the KDC + + Copyright (C) Guenther Deschner <gd@samba.org> 2014 + Copyright (C) Andreas Schneider <asn@samba.org> 2014 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _KDC_SDB_H_ +#define _KDC_SDB_H_ + +struct sdb_salt { + unsigned int type; + krb5_data salt; +}; + +struct sdb_key { + krb5_keyblock key; + struct sdb_salt *salt; +}; + +struct sdb_keys { + unsigned int len; + struct sdb_key *val; +}; + +struct sdb_event { + krb5_principal principal; + time_t time; +}; + +struct sdb_etypes { + unsigned len; + krb5_enctype *val; +}; + +struct SDBFlags { + unsigned int initial:1; + unsigned int forwardable:1; + unsigned int proxiable:1; + unsigned int renewable:1; + unsigned int postdate:1; + unsigned int server:1; + unsigned int client:1; + unsigned int invalid:1; + unsigned int require_preauth:1; + unsigned int change_pw:1; + unsigned int require_hwauth:1; + unsigned int ok_as_delegate:1; + unsigned int user_to_user:1; + unsigned int immutable:1; + unsigned int trusted_for_delegation:1; + unsigned int allow_kerberos4:1; + unsigned int allow_digest:1; + unsigned int locked_out:1; + unsigned int require_pwchange:1; + unsigned int materialize:1; + unsigned int virtual_keys:1; + unsigned int virtual:1; + unsigned int synthetic:1; + unsigned int no_auth_data_reqd:1; + unsigned int _unused24:1; + unsigned int _unused25:1; + unsigned int _unused26:1; + unsigned int _unused27:1; + unsigned int _unused28:1; + unsigned int _unused29:1; + unsigned int force_canonicalize:1; + unsigned int do_not_store:1; +}; + +struct sdb_entry { + struct samba_kdc_entry *skdc_entry; + krb5_principal principal; + unsigned int kvno; + struct sdb_keys keys; + struct sdb_etypes *etypes; + struct sdb_keys old_keys; + struct sdb_keys older_keys; + struct sdb_etypes *session_etypes; + struct sdb_event created_by; + struct sdb_event *modified_by; + time_t *valid_start; + time_t *valid_end; + time_t *pw_end; + unsigned int *max_life; + unsigned int *max_renew; + struct SDBFlags flags; +}; + +#define SDB_ERR_NOENTRY 36150275 +#define SDB_ERR_NOT_FOUND_HERE 36150287 +#define SDB_ERR_WRONG_REALM 36150289 + +/* These must match the values in hdb.h */ + +#define SDB_F_DECRYPT 1 /* decrypt keys */ +#define SDB_F_GET_CLIENT 4 /* fetch client */ +#define SDB_F_GET_SERVER 8 /* fetch server */ +#define SDB_F_GET_KRBTGT 16 /* fetch krbtgt */ +#define SDB_F_GET_ANY 28 /* fetch any of client,server,krbtgt */ +#define SDB_F_CANON 32 /* want canonicalition */ +#define SDB_F_ADMIN_DATA 64 /* want data that kdc don't use */ +#define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ +#define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ +#define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ + +#define SDB_F_HDB_MASK (SDB_F_DECRYPT | \ + SDB_F_GET_CLIENT| \ + SDB_F_GET_SERVER | \ + SDB_F_GET_KRBTGT | \ + SDB_F_CANON | \ + SDB_F_ADMIN_DATA | \ + SDB_F_KVNO_SPECIFIED | \ + SDB_F_FOR_AS_REQ | \ + SDB_F_FOR_TGS_REQ) + +/* This is not supported by HDB */ +#define SDB_F_FORCE_CANON 16384 /* force canonicalition */ + +void sdb_key_free(struct sdb_key *key); +void sdb_keys_free(struct sdb_keys *keys); +void sdb_entry_free(struct sdb_entry *e); +struct SDBFlags int2SDBFlags(unsigned n); +krb5_error_code sdb_entry_set_etypes(struct sdb_entry *s); +krb5_error_code sdb_entry_set_session_etypes(struct sdb_entry *s, + bool add_aes256, + bool add_aes128, + bool add_rc4); + +#endif /* _KDC_SDB_H_ */ diff --git a/source4/kdc/sdb_to_hdb.c b/source4/kdc/sdb_to_hdb.c new file mode 100644 index 0000000..06e20ae --- /dev/null +++ b/source4/kdc/sdb_to_hdb.c @@ -0,0 +1,323 @@ +/* + Unix SMB/CIFS implementation. + + Database Glue between Samba and the KDC + + Copyright (C) Guenther Deschner <gd@samba.org> 2014 + Copyright (C) Andreas Schneider <asn@samba.org> 2014 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include <hdb.h> +#include "sdb.h" +#include "sdb_hdb.h" +#include "lib/krb5_wrap/krb5_samba.h" +#include "librpc/gen_ndr/security.h" +#include "kdc/samba_kdc.h" + +static void sdb_flags_to_hdb_flags(const struct SDBFlags *s, + HDBFlags *h) +{ + SMB_ASSERT(sizeof(struct SDBFlags) == sizeof(HDBFlags)); + + h->initial = s->initial; + h->forwardable = s->forwardable; + h->proxiable = s->proxiable; + h->renewable = s->renewable; + h->postdate = s->postdate; + h->server = s->server; + h->client = s->client; + h->invalid = s->invalid; + h->require_preauth = s->require_preauth; + h->change_pw = s->change_pw; + h->require_hwauth = s->require_hwauth; + h->ok_as_delegate = s->ok_as_delegate; + h->user_to_user = s->user_to_user; + h->immutable = s->immutable; + h->trusted_for_delegation = s->trusted_for_delegation; + h->allow_kerberos4 = s->allow_kerberos4; + h->allow_digest = s->allow_digest; + h->locked_out = s->locked_out; + h->require_pwchange = s->require_pwchange; + h->materialize = s->materialize; + h->virtual_keys = s->virtual_keys; + h->virtual = s->virtual; + h->synthetic = s->synthetic; + h->no_auth_data_reqd = s->no_auth_data_reqd; + h->_unused24 = s->_unused24; + h->_unused25 = s->_unused25; + h->_unused26 = s->_unused26; + h->_unused27 = s->_unused27; + h->_unused28 = s->_unused28; + h->_unused29 = s->_unused29; + h->force_canonicalize = s->force_canonicalize; + h->do_not_store = s->do_not_store; +} + +static int sdb_salt_to_Salt(const struct sdb_salt *s, Salt *h) +{ + int ret; + + h->type = s->type; + ret = smb_krb5_copy_data_contents(&h->salt, s->salt.data, s->salt.length); + if (ret != 0) { + free_Salt(h); + return ENOMEM; + } + h->opaque = NULL; + + return 0; +} + +static int sdb_key_to_Key(const struct sdb_key *s, Key *h) +{ + int rc; + + ZERO_STRUCTP(h); + + h->key.keytype = s->key.keytype; + rc = smb_krb5_copy_data_contents(&h->key.keyvalue, + s->key.keyvalue.data, + s->key.keyvalue.length); + if (rc != 0) { + goto error_nomem; + } + + if (s->salt != NULL) { + h->salt = malloc(sizeof(Salt)); + if (h->salt == NULL) { + goto error_nomem; + } + + rc = sdb_salt_to_Salt(s->salt, + h->salt); + if (rc != 0) { + goto error_nomem; + } + } else { + h->salt = NULL; + } + + return 0; + +error_nomem: + free_Key(h); + return ENOMEM; +} + +static int sdb_keys_to_Keys(const struct sdb_keys *s, Keys *h) +{ + int ret, i; + + h->len = s->len; + if (s->val != NULL) { + h->val = malloc(h->len * sizeof(Key)); + if (h->val == NULL) { + return ENOMEM; + } + for (i = 0; i < h->len; i++) { + ret = sdb_key_to_Key(&s->val[i], + &h->val[i]); + if (ret != 0) { + free_Keys(h); + return ENOMEM; + } + } + } else { + h->val = NULL; + } + + return 0; +} + +static int sdb_event_to_Event(krb5_context context, + const struct sdb_event *s, Event *h) +{ + int ret; + + if (s->principal != NULL) { + ret = krb5_copy_principal(context, + s->principal, + &h->principal); + if (ret != 0) { + free_Event(h); + return ret; + } + } else { + h->principal = NULL; + } + h->time = s->time; + + return 0; +} + +int sdb_entry_to_hdb_entry(krb5_context context, + const struct sdb_entry *s, + hdb_entry *h) +{ + struct samba_kdc_entry *ske = s->skdc_entry; + unsigned int i; + int rc; + + ZERO_STRUCTP(h); + + rc = krb5_copy_principal(context, + s->principal, + &h->principal); + if (rc != 0) { + return rc; + } + + h->kvno = s->kvno; + + rc = sdb_keys_to_Keys(&s->keys, &h->keys); + if (rc != 0) { + goto error; + } + + rc = sdb_event_to_Event(context, + &s->created_by, + &h->created_by); + if (rc != 0) { + goto error; + } + + if (s->modified_by) { + h->modified_by = malloc(sizeof(Event)); + if (h->modified_by == NULL) { + rc = ENOMEM; + goto error; + } + + rc = sdb_event_to_Event(context, + s->modified_by, + h->modified_by); + if (rc != 0) { + goto error; + } + } else { + h->modified_by = NULL; + } + + if (s->valid_start != NULL) { + h->valid_start = malloc(sizeof(KerberosTime)); + if (h->valid_start == NULL) { + rc = ENOMEM; + goto error; + } + *h->valid_start = *s->valid_start; + } else { + h->valid_start = NULL; + } + + if (s->valid_end != NULL) { + h->valid_end = malloc(sizeof(KerberosTime)); + if (h->valid_end == NULL) { + rc = ENOMEM; + goto error; + } + *h->valid_end = *s->valid_end; + } else { + h->valid_end = NULL; + } + + if (s->pw_end != NULL) { + h->pw_end = malloc(sizeof(KerberosTime)); + if (h->pw_end == NULL) { + rc = ENOMEM; + goto error; + } + *h->pw_end = *s->pw_end; + } else { + h->pw_end = NULL; + } + + if (s->max_life != NULL) { + h->max_life = malloc(sizeof(unsigned int)); + if (h->max_life == NULL) { + rc = ENOMEM; + goto error; + } + *h->max_life = *s->max_life; + } else { + h->max_life = NULL; + } + + if (s->max_renew != NULL) { + h->max_renew = malloc(sizeof(unsigned int)); + if (h->max_renew == NULL) { + rc = ENOMEM; + goto error; + } + *h->max_renew = *s->max_renew; + } else { + h->max_renew = NULL; + } + + sdb_flags_to_hdb_flags(&s->flags, &h->flags); + + h->etypes = NULL; + if (s->etypes != NULL) { + h->etypes = malloc(sizeof(*h->etypes)); + if (h->etypes == NULL) { + rc = ENOMEM; + goto error; + } + + h->etypes->len = s->etypes->len; + + h->etypes->val = calloc(h->etypes->len, sizeof(int)); + if (h->etypes->val == NULL) { + rc = ENOMEM; + goto error; + } + + for (i = 0; i < h->etypes->len; i++) { + h->etypes->val[i] = s->etypes->val[i]; + } + } + + h->session_etypes = NULL; + if (s->session_etypes != NULL) { + h->session_etypes = malloc(sizeof(*h->session_etypes)); + if (h->session_etypes == NULL) { + rc = ENOMEM; + goto error; + } + + h->session_etypes->len = s->session_etypes->len; + + h->session_etypes->val = calloc(h->session_etypes->len, sizeof(*h->session_etypes->val)); + if (h->session_etypes->val == NULL) { + rc = ENOMEM; + goto error; + } + + for (i = 0; i < h->session_etypes->len; ++i) { + h->session_etypes->val[i] = s->session_etypes->val[i]; + } + } + + h->context = ske; + if (ske != NULL) { + ske->kdc_entry = h; + } + return 0; +error: + free_hdb_entry(h); + return rc; +} diff --git a/source4/kdc/sdb_to_kdb.c b/source4/kdc/sdb_to_kdb.c new file mode 100644 index 0000000..c24fd73 --- /dev/null +++ b/source4/kdc/sdb_to_kdb.c @@ -0,0 +1,329 @@ +/* + Unix SMB/CIFS implementation. + + Database Glue between Samba and the KDC + + Copyright (C) Guenther Deschner <gd@samba.org> 2014 + Copyright (C) Andreas Schneider <asn@samba.org> 2014 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include <kdb.h> +#include "sdb.h" +#include "sdb_kdb.h" +#include "kdc/samba_kdc.h" +#include "lib/krb5_wrap/krb5_samba.h" + +static int SDBFlags_to_kflags(const struct SDBFlags *s, + krb5_flags *k) +{ + *k = 0; + + if (s->initial) { + *k |= KRB5_KDB_DISALLOW_TGT_BASED; + } + /* The forwardable and proxiable flags are set according to client and + * server attributes. */ + if (!s->forwardable) { + *k |= KRB5_KDB_DISALLOW_FORWARDABLE; + } + if (!s->proxiable) { + *k |= KRB5_KDB_DISALLOW_PROXIABLE; + } + if (s->renewable) { + ; + } + if (s->postdate) { + ; + } + if (s->server) { + ; + } + if (s->client) { + ; + } + if (s->invalid) { + *k |= KRB5_KDB_DISALLOW_ALL_TIX; + } + if (s->require_preauth) { + *k |= KRB5_KDB_REQUIRES_PRE_AUTH; + } + if (s->change_pw) { + *k |= KRB5_KDB_PWCHANGE_SERVICE; + } +#if 0 + /* + * Do not set KRB5_KDB_REQUIRES_HW_AUTH as this would tell the client + * to enforce hardware authentication. It prevents the use of files + * based public key authentication which we use for testing. + */ + if (s->require_hwauth) { + *k |= KRB5_KDB_REQUIRES_HW_AUTH; + } +#endif + if (s->ok_as_delegate) { + *k |= KRB5_KDB_OK_AS_DELEGATE; + } + if (s->user_to_user) { + ; + } + if (s->immutable) { + ; + } + if (s->trusted_for_delegation) { + *k |= KRB5_KDB_OK_TO_AUTH_AS_DELEGATE; + } + if (s->allow_kerberos4) { + ; + } + if (s->allow_digest) { + ; + } + if (s->no_auth_data_reqd) { + *k |= KRB5_KDB_NO_AUTH_DATA_REQUIRED; + } + + return 0; +} + +static int sdb_event_to_kmod(krb5_context context, + const struct sdb_event *s, + krb5_db_entry *k) +{ + krb5_error_code ret; + krb5_principal principal = NULL; + + if (s->principal != NULL) { + ret = krb5_copy_principal(context, + s->principal, + &principal); + if (ret != 0) { + return ret; + } + } + + ret = krb5_dbe_update_mod_princ_data(context, + k, s->time, + principal); + + krb5_free_principal(context, principal); + + return ret; +} + +/* sets up salt on the 2nd array position */ + +static int sdb_salt_to_krb5_key_data(const struct sdb_salt *s, + krb5_key_data *k) +{ + switch (s->type) { +#if 0 + /* for now use the special mechanism where the MIT KDC creates the salt + * on its own */ + case 3: /* FIXME KRB5_PW_SALT */ + k->key_data_type[1] = KRB5_KDB_SALTTYPE_NORMAL; + break; + /* + case hdb_afs3_salt: + k->key_data_type[1] = KRB5_KDB_SALTTYPE_AFS3; + break; + */ +#endif + default: + k->key_data_type[1] = KRB5_KDB_SALTTYPE_SPECIAL; + break; + } + + k->key_data_contents[1] = malloc(s->salt.length); + if (k->key_data_contents[1] == NULL) { + return ENOMEM; + } + memcpy(k->key_data_contents[1], + s->salt.data, + s->salt.length); + k->key_data_length[1] = s->salt.length; + + return 0; +} + +static int sdb_key_to_krb5_key_data(const struct sdb_key *s, + int kvno, + krb5_key_data *k) +{ + int ret = 0; + + ZERO_STRUCTP(k); + + k->key_data_ver = KRB5_KDB_V1_KEY_DATA_ARRAY; + k->key_data_kvno = kvno; + + k->key_data_type[0] = KRB5_KEY_TYPE(&s->key); + k->key_data_length[0] = KRB5_KEY_LENGTH(&s->key); + k->key_data_contents[0] = malloc(k->key_data_length[0]); + if (k->key_data_contents[0] == NULL) { + return ENOMEM; + } + + memcpy(k->key_data_contents[0], + KRB5_KEY_DATA(&s->key), + k->key_data_length[0]); + + if (s->salt != NULL) { + ret = sdb_salt_to_krb5_key_data(s->salt, k); + if (ret) { + memset(k->key_data_contents[0], 0, k->key_data_length[0]); + free(k->key_data_contents[0]); + } + } + + return ret; +} + +static void free_krb5_db_entry(krb5_context context, + krb5_db_entry *k) +{ + krb5_tl_data *tl_data_next = NULL; + krb5_tl_data *tl_data = NULL; + int i, j; + + if (k == NULL) { + return; + } + + krb5_free_principal(context, k->princ); + + for (tl_data = k->tl_data; tl_data; tl_data = tl_data_next) { + tl_data_next = tl_data->tl_data_next; + if (tl_data->tl_data_contents != NULL) { + free(tl_data->tl_data_contents); + } + free(tl_data); + } + + if (k->key_data != NULL) { + for (i = 0; i < k->n_key_data; i++) { + for (j = 0; j < k->key_data[i].key_data_ver; j++) { + if (k->key_data[i].key_data_length[j] != 0) { + if (k->key_data[i].key_data_contents[j] != NULL) { + memset(k->key_data[i].key_data_contents[j], 0, k->key_data[i].key_data_length[j]); + free(k->key_data[i].key_data_contents[j]); + } + } + k->key_data[i].key_data_contents[j] = NULL; + k->key_data[i].key_data_length[j] = 0; + k->key_data[i].key_data_type[j] = 0; + } + } + free(k->key_data); + } + + ZERO_STRUCTP(k); +} + +int sdb_entry_to_krb5_db_entry(krb5_context context, + const struct sdb_entry *s, + krb5_db_entry *k) +{ + struct samba_kdc_entry *ske = s->skdc_entry; + krb5_error_code ret; + int i; + + ZERO_STRUCTP(k); + + k->magic = KRB5_KDB_MAGIC_NUMBER; + k->len = KRB5_KDB_V1_BASE_LENGTH; + + ret = krb5_copy_principal(context, + s->principal, + &k->princ); + if (ret) { + free_krb5_db_entry(context, k); + return ret; + } + + ret = SDBFlags_to_kflags(&s->flags, + &k->attributes); + if (ret) { + free_krb5_db_entry(context, k); + return ret; + } + + if (s->max_life != NULL) { + k->max_life = *s->max_life; + } + if (s->max_renew != NULL) { + k->max_renewable_life = *s->max_renew; + } + if (s->valid_end != NULL) { + k->expiration = *s->valid_end; + } + if (s->pw_end != NULL) { + k->pw_expiration = *s->pw_end; + } + + /* last_success */ + /* last_failed */ + /* fail_auth_count */ + /* n_tl_data */ + + /* + * If we leave early when looking up the realm, we do not have all + * information about a principal. We need to construct a db entry + * with minimal information, so skip this part. + */ + if (s->created_by.time != 0) { + ret = sdb_event_to_kmod(context, + s->modified_by ? s->modified_by : &s->created_by, + k); + if (ret) { + free_krb5_db_entry(context, k); + return ret; + } + } + + /* FIXME: TODO HDB Extensions */ + + /* + * Don't copy keys (allow password auth) if s->flags.require_hwauth is + * set which translates to UF_SMARTCARD_REQUIRED. + */ + if (s->keys.len > 0 && s->flags.require_hwauth == 0) { + k->key_data = malloc(s->keys.len * sizeof(krb5_key_data)); + if (k->key_data == NULL) { + free_krb5_db_entry(context, k); + return ret; + } + + for (i=0; i < s->keys.len; i++) { + ret = sdb_key_to_krb5_key_data(&s->keys.val[i], + s->kvno, + &k->key_data[i]); + if (ret) { + free_krb5_db_entry(context, k); + return ret; + } + + k->n_key_data++; + } + } + + k->e_data = (void *)ske; + if (ske != NULL) { + ske->kdc_entry = k; + } + return 0; +} diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c new file mode 100644 index 0000000..06025cc --- /dev/null +++ b/source4/kdc/wdc-samba4.c @@ -0,0 +1,642 @@ +/* + Unix SMB/CIFS implementation. + + PAC Glue between Samba and the KDC + + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009 + Copyright (C) Simo Sorce <idra@samba.org> 2010 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "kdc/kdc-glue.h" +#include "kdc/db-glue.h" +#include "kdc/pac-glue.h" +#include "sdb.h" +#include "sdb_hdb.h" +#include "librpc/gen_ndr/auth.h" +#include <krb5_locl.h> + +static bool samba_wdc_is_s4u2self_req(astgs_request_t r) +{ + krb5_kdc_configuration *config = kdc_request_get_config((kdc_request_t)r); + const KDC_REQ *req = kdc_request_get_req(r); + const PA_DATA *pa_for_user = NULL; + + if (req->msg_type != krb_tgs_req) { + return false; + } + + if (config->enable_fast && req->padata != NULL) { + const PA_DATA *pa_fx_fast = NULL; + int idx = 0; + + pa_fx_fast = krb5_find_padata(req->padata->val, + req->padata->len, + KRB5_PADATA_FX_FAST, + &idx); + if (pa_fx_fast != NULL) { + /* + * We're in the outer request + * with KRB5_PADATA_FX_FAST + * if fast is enabled we'll + * process the s4u2self + * request only in the + * inner request. + */ + return false; + } + } + + if (req->padata != NULL) { + int idx = 0; + + pa_for_user = krb5_find_padata(req->padata->val, + req->padata->len, + KRB5_PADATA_FOR_USER, + &idx); + } + + if (pa_for_user != NULL) { + return true; + } + + return false; +} + +/* + * Given the right private pointer from hdb_samba4, + * get a PAC from the attached ldb messages. + * + * For PKINIT we also get pk_reply_key and can add PAC_CREDENTIAL_INFO. + */ +static krb5_error_code samba_wdc_get_pac(void *priv, + astgs_request_t r, + hdb_entry *client, + hdb_entry *server, + const krb5_keyblock *pk_reply_key, + uint64_t pac_attributes, + krb5_pac *pac) +{ + krb5_context context = kdc_request_get_context((kdc_request_t)r); + TALLOC_CTX *mem_ctx; + DATA_BLOB *logon_blob = NULL; + DATA_BLOB *cred_ndr = NULL; + DATA_BLOB **cred_ndr_ptr = NULL; + DATA_BLOB _cred_blob = data_blob_null; + DATA_BLOB *cred_blob = NULL; + DATA_BLOB *upn_blob = NULL; + DATA_BLOB *pac_attrs_blob = NULL; + DATA_BLOB *requester_sid_blob = NULL; + krb5_error_code ret; + NTSTATUS nt_status; + struct samba_kdc_entry *skdc_entry = + talloc_get_type_abort(client->context, + struct samba_kdc_entry); + bool is_krbtgt; + bool is_s4u2self = samba_wdc_is_s4u2self_req(r); + enum samba_asserted_identity asserted_identity = + (is_s4u2self) ? + SAMBA_ASSERTED_IDENTITY_SERVICE : + SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY; + + mem_ctx = talloc_named(client->context, 0, "samba_get_pac context"); + if (!mem_ctx) { + return ENOMEM; + } + + if (pk_reply_key != NULL) { + cred_ndr_ptr = &cred_ndr; + } + + is_krbtgt = krb5_principal_is_krbtgt(context, server->principal); + + nt_status = samba_kdc_get_pac_blobs(mem_ctx, skdc_entry, + asserted_identity, + &logon_blob, + cred_ndr_ptr, + &upn_blob, + is_krbtgt ? &pac_attrs_blob : NULL, + pac_attributes, + is_krbtgt ? &requester_sid_blob : NULL); + if (!NT_STATUS_IS_OK(nt_status)) { + talloc_free(mem_ctx); + return EINVAL; + } + + if (pk_reply_key != NULL && cred_ndr != NULL) { + ret = samba_kdc_encrypt_pac_credentials(context, + pk_reply_key, + cred_ndr, + mem_ctx, + &_cred_blob); + if (ret != 0) { + talloc_free(mem_ctx); + return ret; + } + cred_blob = &_cred_blob; + } + + ret = krb5_pac_init(context, pac); + if (ret != 0) { + talloc_free(mem_ctx); + return ret; + } + + ret = samba_make_krb5_pac(context, logon_blob, cred_blob, + upn_blob, pac_attrs_blob, + requester_sid_blob, NULL, *pac); + + talloc_free(mem_ctx); + return ret; +} + +static krb5_error_code samba_wdc_reget_pac2(astgs_request_t r, + const krb5_principal delegated_proxy_principal, + hdb_entry *client, + hdb_entry *server, + hdb_entry *krbtgt, + krb5_pac *pac, + krb5_cksumtype ctype) +{ + krb5_context context = kdc_request_get_context((kdc_request_t)r); + struct samba_kdc_entry *client_skdc_entry = NULL; + struct samba_kdc_entry *server_skdc_entry = + talloc_get_type_abort(server->context, struct samba_kdc_entry); + struct samba_kdc_entry *krbtgt_skdc_entry = + talloc_get_type_abort(krbtgt->context, struct samba_kdc_entry); + TALLOC_CTX *mem_ctx = NULL; + krb5_pac new_pac = NULL; + krb5_error_code ret; + bool is_s4u2self = samba_wdc_is_s4u2self_req(r); + bool is_in_db = false; + bool is_untrusted = false; + uint32_t flags = 0; + + mem_ctx = talloc_named(NULL, 0, "samba_kdc_reget_pac2 context"); + if (mem_ctx == NULL) { + return ENOMEM; + } + + if (client != NULL) { + client_skdc_entry = talloc_get_type_abort(client->context, + struct samba_kdc_entry); + } + + /* + * If the krbtgt was generated by an RODC, and we are not that + * RODC, then we need to regenerate the PAC - we can't trust + * it, and confirm that the RODC was permitted to print this ticket + * + * Becasue of the samba_kdc_validate_pac_blob() step we can be + * sure that the record in 'client' matches the SID in the + * original PAC. + */ + ret = samba_krbtgt_is_in_db(krbtgt_skdc_entry, &is_in_db, &is_untrusted); + if (ret != 0) { + goto out; + } + + if (is_s4u2self) { + flags |= SAMBA_KDC_FLAG_PROTOCOL_TRANSITION; + } + + if (delegated_proxy_principal != NULL) { + krb5_enctype etype; + Key *key = NULL; + + if (!is_in_db) { + /* + * The RODC-issued PAC was signed by a KDC entry that we + * don't have a key for. The server signature is not + * trustworthy, since it could have been created by the + * server we got the ticket from. We must not proceed as + * otherwise the ticket signature is unchecked. + */ + ret = HDB_ERR_NOT_FOUND_HERE; + goto out; + } + + /* Fetch the correct key depending on the checksum type. */ + if (ctype == CKSUMTYPE_HMAC_MD5) { + etype = ENCTYPE_ARCFOUR_HMAC; + } else { + ret = krb5_cksumtype_to_enctype(context, + ctype, + &etype); + if (ret != 0) { + goto out; + } + } + ret = hdb_enctype2key(context, krbtgt, NULL, etype, &key); + if (ret != 0) { + goto out; + } + + /* Check the KDC, whole-PAC and ticket signatures. */ + ret = krb5_pac_verify(context, + *pac, + 0, + NULL, + NULL, + &key->key); + if (ret != 0) { + DEBUG(1, ("PAC KDC signature failed to verify\n")); + goto out; + } + + flags |= SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION; + } + + if (is_untrusted) { + flags |= SAMBA_KDC_FLAG_KRBTGT_IS_UNTRUSTED; + } + + if (is_in_db) { + flags |= SAMBA_KDC_FLAG_KRBTGT_IN_DB; + } + + ret = krb5_pac_init(context, &new_pac); + if (ret != 0) { + new_pac = NULL; + goto out; + } + + ret = samba_kdc_update_pac(mem_ctx, + context, + krbtgt_skdc_entry->kdc_db_ctx->samdb, + flags, + client_skdc_entry, + server->principal, + server_skdc_entry, + krbtgt_skdc_entry, + delegated_proxy_principal, + *pac, + new_pac); + if (ret != 0) { + krb5_pac_free(context, new_pac); + if (ret == ENODATA) { + krb5_pac_free(context, *pac); + *pac = NULL; + ret = 0; + } + goto out; + } + + /* Replace the pac */ + krb5_pac_free(context, *pac); + *pac = new_pac; + +out: + talloc_free(mem_ctx); + return ret; +} + +/* Resign (and reform, including possibly new groups) a PAC */ + +static krb5_error_code samba_wdc_reget_pac(void *priv, astgs_request_t r, + const krb5_principal client_principal, + const krb5_principal delegated_proxy_principal, + hdb_entry *client, + hdb_entry *server, + hdb_entry *krbtgt, + krb5_pac *pac) +{ + krb5_context context = kdc_request_get_context((kdc_request_t)r); + krb5_kdc_configuration *config = kdc_request_get_config((kdc_request_t)r); + struct samba_kdc_entry *krbtgt_skdc_entry = + talloc_get_type_abort(krbtgt->context, + struct samba_kdc_entry); + krb5_error_code ret; + krb5_cksumtype ctype = CKSUMTYPE_NONE; + hdb_entry signing_krbtgt_hdb; + + if (delegated_proxy_principal) { + uint16_t rodc_id; + unsigned int my_krbtgt_number; + + /* + * We're using delegated_proxy_principal for the moment to + * indicate cases where the ticket was encrypted with the server + * key, and not a krbtgt key. This cannot be trusted, so we need + * to find a krbtgt key that signs the PAC in order to trust the + * ticket. + * + * The krbtgt passed in to this function refers to the krbtgt + * used to decrypt the ticket of the server requesting + * S4U2Proxy. + * + * When we implement service ticket renewal, we need to check + * the PAC, and this will need to be updated. + */ + ret = krb5_pac_get_kdc_checksum_info(context, + *pac, + &ctype, + &rodc_id); + if (ret != 0) { + DEBUG(1, ("Failed to get PAC checksum info\n")); + return ret; + } + + /* + * We need to check the KDC and ticket signatures, fetching the + * correct key based on the enctype. + */ + + my_krbtgt_number = krbtgt_skdc_entry->kdc_db_ctx->my_krbtgt_number; + + if (my_krbtgt_number != 0) { + /* + * If we are an RODC, and we are not the KDC that signed + * the evidence ticket, then we need to proxy the + * request. + */ + if (rodc_id != my_krbtgt_number) { + return HDB_ERR_NOT_FOUND_HERE; + } + } else { + /* + * If we are a DC, the ticket may have been signed by a + * different KDC than the one that issued the header + * ticket. + */ + if (rodc_id != krbtgt->kvno >> 16) { + struct sdb_entry signing_krbtgt_sdb; + + /* + * If we didn't sign the ticket, then return an + * error. + */ + if (rodc_id != 0) { + return KRB5KRB_AP_ERR_MODIFIED; + } + + /* + * Fetch our key from the database. To support + * key rollover, we're going to need to try + * multiple keys by trial and error. For now, + * krbtgt keys aren't assumed to change. + */ + ret = samba_kdc_fetch(context, + krbtgt_skdc_entry->kdc_db_ctx, + krbtgt->principal, + SDB_F_GET_KRBTGT | SDB_F_CANON, + 0, + &signing_krbtgt_sdb); + if (ret != 0) { + return ret; + } + + ret = sdb_entry_to_hdb_entry(context, + &signing_krbtgt_sdb, + &signing_krbtgt_hdb); + sdb_entry_free(&signing_krbtgt_sdb); + if (ret != 0) { + return ret; + } + + /* + * Replace the krbtgt entry with our own entry + * for further processing. + */ + krbtgt = &signing_krbtgt_hdb; + } + } + } else if (!krbtgt_skdc_entry->is_trust) { + /* + * We expect to have received a TGT, so check that we haven't + * been given a kpasswd ticket instead. We don't need to do this + * check for an incoming trust, as they use a different secret + * and can't be confused with a normal TGT. + */ + krb5_ticket *tgt = kdc_request_get_ticket(r); + + struct timeval now = krb5_kdc_get_time(); + + /* + * Check if the ticket is in the last two minutes of its + * life. + */ + KerberosTime lifetime = rk_time_sub(tgt->ticket.endtime, now.tv_sec); + if (lifetime <= CHANGEPW_LIFETIME) { + /* + * This ticket has at most two minutes left to live. It + * may be a kpasswd ticket rather than a TGT, so don't + * accept it. + */ + kdc_audit_addreason((kdc_request_t)r, + "Ticket is not a ticket-granting ticket"); + return KRB5KRB_AP_ERR_TKT_EXPIRED; + } + } + + ret = samba_wdc_reget_pac2(r, + delegated_proxy_principal, + client, + server, + krbtgt, + pac, + ctype); + + if (krbtgt == &signing_krbtgt_hdb) { + hdb_free_entry(context, config->db[0], &signing_krbtgt_hdb); + } + + return ret; +} + +static char *get_netbios_name(TALLOC_CTX *mem_ctx, HostAddresses *addrs) +{ + char *nb_name = NULL; + size_t len; + unsigned int i; + + for (i = 0; addrs && i < addrs->len; i++) { + if (addrs->val[i].addr_type != KRB5_ADDRESS_NETBIOS) { + continue; + } + len = MIN(addrs->val[i].address.length, 15); + nb_name = talloc_strndup(mem_ctx, + addrs->val[i].address.data, len); + if (nb_name) { + break; + } + } + + if ((nb_name == NULL) || (nb_name[0] == '\0')) { + return NULL; + } + + /* Strip space padding */ + for (len = strlen(nb_name) - 1; + (len > 0) && (nb_name[len] == ' '); + --len) { + nb_name[len] = '\0'; + } + + return nb_name; +} + +/* this function allocates 'data' using malloc. + * The caller is responsible for freeing it */ +static void samba_kdc_build_edata_reply(NTSTATUS nt_status, krb5_data *e_data) +{ + e_data->data = malloc(12); + if (e_data->data == NULL) { + e_data->length = 0; + e_data->data = NULL; + return; + } + e_data->length = 12; + + SIVAL(e_data->data, 0, NT_STATUS_V(nt_status)); + SIVAL(e_data->data, 4, 0); + SIVAL(e_data->data, 8, 1); + + return; +} + +static krb5_error_code samba_wdc_check_client_access(void *priv, + astgs_request_t r) +{ + struct samba_kdc_entry *kdc_entry; + bool password_change; + char *workstation; + NTSTATUS nt_status; + + + kdc_entry = talloc_get_type(kdc_request_get_client(r)->context, struct samba_kdc_entry); + password_change = (kdc_request_get_server(r) && kdc_request_get_server(r)->flags.change_pw); + workstation = get_netbios_name((TALLOC_CTX *)kdc_request_get_client(r)->context, + kdc_request_get_req(r)->req_body.addresses); + + nt_status = samba_kdc_check_client_access(kdc_entry, + kdc_request_get_cname((kdc_request_t)r), + workstation, + password_change); + + if (!NT_STATUS_IS_OK(nt_status)) { + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) { + return ENOMEM; + } + + if (kdc_request_get_rep(r)->padata) { + int ret; + krb5_data kd; + + samba_kdc_build_edata_reply(nt_status, &kd); + ret = krb5_padata_add(kdc_request_get_context((kdc_request_t)r), kdc_request_get_rep(r)->padata, + KRB5_PADATA_PW_SALT, + kd.data, kd.length); + if (ret != 0) { + /* + * So we do not leak the allocated + * memory on kd in the error case + */ + krb5_data_free(&kd); + } + } + + return samba_kdc_map_policy_err(nt_status); + } + + /* Now do the standard Heimdal check */ + return KRB5_PLUGIN_NO_HANDLE; +} + +/* this function allocates 'data' using malloc. + * The caller is responsible for freeing it */ +static krb5_error_code samba_kdc_build_supported_etypes(uint32_t supported_etypes, + krb5_data *e_data) +{ + e_data->data = malloc(4); + if (e_data->data == NULL) { + return ENOMEM; + } + e_data->length = 4; + + PUSH_LE_U32(e_data->data, 0, supported_etypes); + + return 0; +} + +static krb5_error_code samba_wdc_finalize_reply(void *priv, + astgs_request_t r) +{ + struct samba_kdc_entry *server_kdc_entry; + uint32_t supported_enctypes; + + server_kdc_entry = talloc_get_type(kdc_request_get_server(r)->context, struct samba_kdc_entry); + + /* + * If the canonicalize flag is set, add PA-SUPPORTED-ENCTYPES padata + * type to indicate what encryption types the server supports. + */ + supported_enctypes = server_kdc_entry->supported_enctypes; + if (kdc_request_get_req(r)->req_body.kdc_options.canonicalize && supported_enctypes != 0) { + krb5_error_code ret; + + PA_DATA md; + + ret = samba_kdc_build_supported_etypes(supported_enctypes, &md.padata_value); + if (ret != 0) { + return ret; + } + + md.padata_type = KRB5_PADATA_SUPPORTED_ETYPES; + + ret = kdc_request_add_encrypted_padata(r, &md); + if (ret != 0) { + /* + * So we do not leak the allocated + * memory on kd in the error case + */ + krb5_data_free(&md.padata_value); + } + } + + return 0; +} + +static krb5_error_code samba_wdc_plugin_init(krb5_context context, void **ptr) +{ + *ptr = NULL; + return 0; +} + +static void samba_wdc_plugin_fini(void *ptr) +{ + return; +} + +static krb5_error_code samba_wdc_referral_policy(void *priv, + astgs_request_t r) +{ + return kdc_request_get_error_code((kdc_request_t)r); +} + +struct krb5plugin_kdc_ftable kdc_plugin_table = { + .minor_version = KRB5_PLUGIN_KDC_VERSION_10, + .init = samba_wdc_plugin_init, + .fini = samba_wdc_plugin_fini, + .pac_verify = samba_wdc_reget_pac, + .client_access = samba_wdc_check_client_access, + .finalize_reply = samba_wdc_finalize_reply, + .pac_generate = samba_wdc_get_pac, + .referral_policy = samba_wdc_referral_policy, +}; + + diff --git a/source4/kdc/wscript_build b/source4/kdc/wscript_build new file mode 100644 index 0000000..0c902f5 --- /dev/null +++ b/source4/kdc/wscript_build @@ -0,0 +1,182 @@ +#!/usr/bin/env python + +# We do this because we do not want to depend on the KDC, only find and use it's header files. We do not want +if not bld.CONFIG_SET("USING_SYSTEM_KDC"): + kdc_include = "../../third_party/heimdal/kdc ../../third_party/heimdal/lib/gssapi" +else: + kdc_include = getattr(bld.env, "CPPPATH_KDC") + +if bld.CONFIG_SET('SAMBA4_USES_HEIMDAL'): + bld.SAMBA_MODULE('service_kdc', + source='kdc-heimdal.c', + subsystem='service', + init_function='server_service_kdc_init', + deps=''' + kdc + HDB_SAMBA4 + WDC_SAMBA4 + samba-hostconfig + com_err + samba_server_gensec + PAC_GLUE + KDC-GLUE + KDC-SERVER + KPASSWD-SERVICE + KPASSWD_GLUE + ''', + internal_module=False) + +if bld.CONFIG_GET('SAMBA_USES_MITKDC'): + bld.SAMBA_MODULE('service_kdc', + source='kdc-service-mit.c', + cflags_end='-Wno-strict-prototypes', + subsystem='service', + init_function='server_service_mitkdc_init', + deps=''' + samba-hostconfig + service + talloc + UTIL_RUNCMD + MIT_KDC_IRPC + KDC-SERVER + KPASSWD-SERVICE + com_err + kadm5srv_mit + kdb5 + ''', + internal_module=False) + +bld.SAMBA_LIBRARY('HDB_SAMBA4', + source='hdb-samba4.c hdb-samba4-plugin.c', + deps='ldb auth4_sam common_auth samba-credentials hdb kdc db-glue samba-hostconfig com_err sdb_hdb RPC_NDR_WINBIND', + includes=kdc_include, + private_library=True, + enabled=bld.CONFIG_SET('SAMBA4_USES_HEIMDAL') + ) + +# A plugin for Heimdal's kadmin for users who need to operate that tool +bld.SAMBA_LIBRARY('HDB_SAMBA4_PLUGIN', + source='hdb-samba4-plugin.c', + deps='hdb HDB_SAMBA4 samba-util samba-hostconfig ', + link_name='modules/hdb/hdb_samba4.so', + realname='hdb_samba4.so', + install_path='${MODULESDIR}/hdb', + enabled = (bld.CONFIG_SET("USING_SYSTEM_KRB5") and bld.CONFIG_SET("USING_SYSTEM_HDB")) + ) + +bld.SAMBA_SUBSYSTEM('KDC-SERVER', + source='kdc-server.c kdc-proxy.c', + deps=''' + krb5samba + ldb + LIBTSOCKET + LIBSAMBA_TSOCKET + ''') + +kpasswd_flavor_src = 'kpasswd-service.c kpasswd-helper.c' +if bld.CONFIG_SET('SAMBA4_USES_HEIMDAL'): + kpasswd_flavor_src = kpasswd_flavor_src + ' kpasswd-service-heimdal.c' +elif bld.CONFIG_GET('SAMBA_USES_MITKDC'): + kpasswd_flavor_src = kpasswd_flavor_src + ' kpasswd-service-mit.c' + +bld.SAMBA_SUBSYSTEM('KPASSWD-SERVICE', + source=kpasswd_flavor_src, + deps=''' + krb5samba + samba_server_gensec + KPASSWD_GLUE + gensec_krb5_helpers + ''') + +bld.SAMBA_SUBSYSTEM('KDC-GLUE', + source='kdc-glue.c', + includes=kdc_include, + deps='hdb PAC_GLUE', + enabled=bld.CONFIG_SET('SAMBA4_USES_HEIMDAL') + ) + +bld.SAMBA_SUBSYSTEM('WDC_SAMBA4', + source='wdc-samba4.c', + includes=kdc_include, + deps='ldb auth4_sam common_auth samba-credentials hdb PAC_GLUE samba-hostconfig com_err KDC-GLUE', + enabled=bld.CONFIG_SET('SAMBA4_USES_HEIMDAL') + ) + +bld.SAMBA_SUBSYSTEM('sdb', + source='sdb.c', + deps='talloc krb5', + ) + +bld.SAMBA_SUBSYSTEM('sdb_hdb', + source='sdb_to_hdb.c', + deps='talloc sdb hdb', + autoproto='sdb_hdb.h', + enabled=bld.CONFIG_SET('SAMBA4_USES_HEIMDAL') + ) + +bld.SAMBA_SUBSYSTEM('sdb_kdb', + source='sdb_to_kdb.c', + deps='sdb kdb5', + autoproto='sdb_kdb.h', + enabled=bld.CONFIG_SET('HAVE_KDB_H') + ) + +bld.SAMBA_SUBSYSTEM('PAC_GLUE', + source='pac-glue.c', + deps='ldb auth4_sam common_auth samba-credentials samba-hostconfig com_err' + ) + +bld.SAMBA_LIBRARY('pac', + source=[], + deps='PAC_GLUE', + private_library=True, + grouping_library=True) + + +bld.SAMBA_LIBRARY('db-glue', + source='db-glue.c', + deps='ldb auth4_sam common_auth samba-credentials sdb samba-hostconfig com_err RPC_NDR_IRPC MESSAGING PAC_GLUE', + private_library=True, + ) + +bld.SAMBA_SUBSYSTEM('KPASSWD_GLUE', + source='kpasswd_glue.c', + deps='ldb com_err') + +bld.SAMBA_SUBSYSTEM('MIT_KDC_IRPC', + source='mit_kdc_irpc.c', + deps=''' + ldb + auth4_sam + samba-credentials + db-glue + samba-hostconfig + com_err + kdb5 + ''', + enabled=(bld.CONFIG_SET('SAMBA_USES_MITKDC') and bld.CONFIG_SET('HAVE_KDB_H')) + ) + +bld.SAMBA_SUBSYSTEM('MIT_SAMBA', + source='mit_samba.c', + deps=''' + ldb + auth4_sam + common_auth + samba-credentials + db-glue + PAC_GLUE + KPASSWD_GLUE + samba-hostconfig + com_err + sdb_kdb + kdb5 + ''', + enabled=(not bld.CONFIG_SET('SAMBA4_USES_HEIMDAL') and bld.CONFIG_SET('HAVE_KDB_H')) ) + +bld.SAMBA_BINARY('samba4ktutil', + 'ktutil.c', + deps='krb5samba', + install=False) + +bld.RECURSE('mit-kdb') |