?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
asn1_tests: Implement negative unit-tests for ber_write_OID_String()
[Samba.git] / source4 / kdc / db-glue.c
blobe9ae5b348626bdd385c13e4dcba92a1aa8fc314a
1 /*
2 Unix SMB/CIFS implementation.
3
4 Database Glue between Samba and the KDC
5
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
7 Copyright (C) Simo Sorce <idra@samba.org> 2010
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "system/time.h"
26 #include "../libds/common/flags.h"
27 #include "lib/ldb/include/ldb.h"
28 #include "librpc/gen_ndr/netlogon.h"
29 #include "libcli/security/security.h"
30 #include "auth/auth.h"
31 #include "auth/credentials/credentials.h"
32 #include "auth/auth_sam.h"
33 #include "dsdb/samdb/samdb.h"
34 #include "dsdb/common/util.h"
35 #include "librpc/ndr/libndr.h"
36 #include "librpc/gen_ndr/ndr_drsblobs.h"
37 #include "librpc/gen_ndr/lsa.h"
38 #include "libcli/auth/libcli_auth.h"
39 #include "param/param.h"
40 #include "../lib/crypto/md4.h"
41 #include "system/kerberos.h"
42 #include "auth/kerberos/kerberos.h"
43 #include <hdb.h>
44 #include "kdc/samba_kdc.h"
45 #include "kdc/db-glue.h"
46
47 enum samba_kdc_ent_type
48 { SAMBA_KDC_ENT_TYPE_CLIENT, SAMBA_KDC_ENT_TYPE_SERVER,
49 SAMBA_KDC_ENT_TYPE_KRBTGT, SAMBA_KDC_ENT_TYPE_TRUST, SAMBA_KDC_ENT_TYPE_ANY };
50
51 enum trust_direction {
52 UNKNOWN = 0,
53 INBOUND = LSA_TRUST_DIRECTION_INBOUND,
54 OUTBOUND = LSA_TRUST_DIRECTION_OUTBOUND
55 };
56
57 static const char *trust_attrs[] = {
58 "trustPartner",
59 "trustAuthIncoming",
60 "trustAuthOutgoing",
61 "whenCreated",
62 "msDS-SupportedEncryptionTypes",
63 "trustAttributes",
64 "trustDirection",
65 "trustType",
66 NULL
67 };
68
69 static KerberosTime ldb_msg_find_krb5time_ldap_time(struct ldb_message *msg, const char *attr, KerberosTime default_val)
70 {
71 const char *tmp;
72 const char *gentime;
73 struct tm tm;
74
75 gentime = ldb_msg_find_attr_as_string(msg, attr, NULL);
76 if (!gentime)
77 return default_val;
78
79 tmp = strptime(gentime, "%Y%m%d%H%M%SZ", &tm);
80 if (tmp == NULL) {
81 return default_val;
82 }
83
84 return timegm(&tm);
85 }
86
87 static HDBFlags uf2HDBFlags(krb5_context context, uint32_t userAccountControl, enum samba_kdc_ent_type ent_type)
88 {
89 HDBFlags flags = int2HDBFlags(0);
90
91 /* we don't allow kadmin deletes */
92 flags.immutable = 1;
93
94 /* mark the principal as invalid to start with */
95 flags.invalid = 1;
96
97 flags.renewable = 1;
98
99 /* All accounts are servers, but this may be disabled again in the caller */
100 flags.server = 1;
101
102 /* Account types - clear the invalid bit if it turns out to be valid */
103 if (userAccountControl & UF_NORMAL_ACCOUNT) {
104 if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT || ent_type == SAMBA_KDC_ENT_TYPE_ANY) {
105 flags.client = 1;
106 }
107 flags.invalid = 0;
108 }
109
110 if (userAccountControl & UF_INTERDOMAIN_TRUST_ACCOUNT) {
111 if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT || ent_type == SAMBA_KDC_ENT_TYPE_ANY) {
112 flags.client = 1;
113 }
114 flags.invalid = 0;
115 }
116 if (userAccountControl & UF_WORKSTATION_TRUST_ACCOUNT) {
117 if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT || ent_type == SAMBA_KDC_ENT_TYPE_ANY) {
118 flags.client = 1;
119 }
120 flags.invalid = 0;
121 }
122 if (userAccountControl & UF_SERVER_TRUST_ACCOUNT) {
123 if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT || ent_type == SAMBA_KDC_ENT_TYPE_ANY) {
124 flags.client = 1;
125 }
126 flags.invalid = 0;
127 }
128
129 /* Not permitted to act as a client if disabled */
130 if (userAccountControl & UF_ACCOUNTDISABLE) {
131 flags.client = 0;
132 }
133 if (userAccountControl & UF_LOCKOUT) {
134 flags.invalid = 1;
135 }
136 /*
137 if (userAccountControl & UF_PASSWORD_NOTREQD) {
138 flags.invalid = 1;
139 }
140 */
141 /*
142 UF_PASSWORD_CANT_CHANGE and UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED are irrelevent
143 */
144 if (userAccountControl & UF_TEMP_DUPLICATE_ACCOUNT) {
145 flags.invalid = 1;
146 }
147
148 /* UF_DONT_EXPIRE_PASSWD and UF_USE_DES_KEY_ONLY handled in samba_kdc_message2entry() */
149
150 /*
151 if (userAccountControl & UF_MNS_LOGON_ACCOUNT) {
152 flags.invalid = 1;
153 }
154 */
155 if (userAccountControl & UF_SMARTCARD_REQUIRED) {
156 flags.require_hwauth = 1;
157 }
158 if (userAccountControl & UF_TRUSTED_FOR_DELEGATION) {
159 flags.ok_as_delegate = 1;
160 }
161 if (!(userAccountControl & UF_NOT_DELEGATED)) {
162 flags.forwardable = 1;
163 flags.proxiable = 1;
164 }
165
166 if (userAccountControl & UF_DONT_REQUIRE_PREAUTH) {
167 flags.require_preauth = 0;
168 } else {
169 flags.require_preauth = 1;
170
171 }
172 return flags;
173 }
174
175 static int samba_kdc_entry_destructor(struct samba_kdc_entry *p)
176 {
177 hdb_entry_ex *entry_ex = p->entry_ex;
178 free_hdb_entry(&entry_ex->entry);
179 return 0;
180 }
181
182 static void samba_kdc_free_entry(krb5_context context, hdb_entry_ex *entry_ex)
183 {
184 /* this function is called only from hdb_free_entry().
185 * Make sure we neutralize the destructor or we will
186 * get a double free later when hdb_free_entry() will
187 * try to call free_hdb_entry() */
188 talloc_set_destructor(entry_ex->ctx, NULL);
189
190 /* now proceed to free the talloc part */
191 talloc_free(entry_ex->ctx);
192 }
193
194 static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
195 TALLOC_CTX *mem_ctx,
196 struct ldb_message *msg,
197 uint32_t rid,
198 bool is_rodc,
199 uint32_t userAccountControl,
200 enum samba_kdc_ent_type ent_type,
201 hdb_entry_ex *entry_ex)
202 {
203 krb5_error_code ret = 0;
204 enum ndr_err_code ndr_err;
205 struct samr_Password *hash;
206 const struct ldb_val *sc_val;
207 struct supplementalCredentialsBlob scb;
208 struct supplementalCredentialsPackage *scpk = NULL;
209 bool newer_keys = false;
210 struct package_PrimaryKerberosBlob _pkb;
211 struct package_PrimaryKerberosCtr3 *pkb3 = NULL;
212 struct package_PrimaryKerberosCtr4 *pkb4 = NULL;
213 uint16_t i;
214 uint16_t allocated_keys = 0;
215 int rodc_krbtgt_number = 0;
216 uint32_t supported_enctypes;
217
218 if (rid == DOMAIN_RID_KRBTGT || is_rodc) {
219 /* KDCs (and KDCs on RODCs) use AES, but not DES */
220 supported_enctypes = ENC_ALL_TYPES;
221 supported_enctypes &= ~(ENC_CRC32|ENC_RSA_MD5);
222 } else if (userAccountControl & (UF_PARTIAL_SECRETS_ACCOUNT|UF_SERVER_TRUST_ACCOUNT)) {
223 /* DCs and RODCs comptuer accounts use AES */
224 supported_enctypes = ENC_ALL_TYPES;
225 } else if (ent_type == SAMBA_KDC_ENT_TYPE_CLIENT ||
226 (ent_type == SAMBA_KDC_ENT_TYPE_ANY)) {
227 /* for AS-REQ the client chooses the enc types it
228 * supports, and this will vary between computers a
229 * user logs in from. However, some accounts may be
230 * banned from using DES, so allow the default to be
231 * overridden
232 *
233 * likewise for 'any' return as much as is supported,
234 * to export into a keytab */
235 supported_enctypes = ldb_msg_find_attr_as_uint(msg, "msDS-SupportedEncryptionTypes",
236 ENC_ALL_TYPES);
237 } else {
238 /* However, if this is a TGS-REQ, then lock it down to
239 * a reasonable guess as to what the server can decode
240 * - we must use whatever is in
241 * "msDS-SupportedEncryptionTypes", or the 'old' set
242 * of keys (ie, what Windows 2000 supported) */
243 supported_enctypes = ldb_msg_find_attr_as_uint(msg, "msDS-SupportedEncryptionTypes",
244 ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5);
245 }
246
247 /* Is this the krbtgt or a RODC krbtgt */
248 if (is_rodc) {
249 rodc_krbtgt_number = ldb_msg_find_attr_as_int(msg, "msDS-SecondaryKrbTgtNumber", -1);
250
251 if (rodc_krbtgt_number == -1) {
252 return EINVAL;
253 }
254 }
255
256
257 /* If UF_USE_DES_KEY_ONLY has been set, then don't allow use of the newer enc types */
258 if (userAccountControl & UF_USE_DES_KEY_ONLY) {
259 /* However, this still won't allow use of DES, if we
260 * were told not to by msDS-SupportedEncTypes */
261 supported_enctypes &= ENC_CRC32|ENC_RSA_MD5;
262 } else {
263 switch (ent_type) {
264 case SAMBA_KDC_ENT_TYPE_KRBTGT:
265 case SAMBA_KDC_ENT_TYPE_TRUST:
266 /* Unless a very special effort it made,
267 * disallow trust tickets to be DES encrypted,
268 * it's just too dangerous */
269 supported_enctypes &= ~(ENC_CRC32|ENC_RSA_MD5);
270 break;
271 default:
272 break;
273 /* No further restrictions */
274 }
275 }
276
277 entry_ex->entry.keys.val = NULL;
278 entry_ex->entry.keys.len = 0;
279
280 entry_ex->entry.kvno = ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0);
281 if (is_rodc) {
282 entry_ex->entry.kvno |= (rodc_krbtgt_number << 16);
283 }
284
285 /* Get keys from the db */
286
287 hash = samdb_result_hash(mem_ctx, msg, "unicodePwd");
288 sc_val = ldb_msg_find_ldb_val(msg, "supplementalCredentials");
289
290 /* unicodePwd for enctype 0x17 (23) if present */
291 if (hash) {
292 allocated_keys++;
293 }
294
295 /* supplementalCredentials if present */
296 if (sc_val) {
297 ndr_err = ndr_pull_struct_blob_all(sc_val, mem_ctx, &scb,
298 (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
299 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
300 dump_data(0, sc_val->data, sc_val->length);
301 ret = EINVAL;
302 goto out;
303 }
304
305 if (scb.sub.signature != SUPPLEMENTAL_CREDENTIALS_SIGNATURE) {
306 NDR_PRINT_DEBUG(supplementalCredentialsBlob, &scb);
307 ret = EINVAL;
308 goto out;
309 }
310
311 for (i=0; i < scb.sub.num_packages; i++) {
312 if (strcmp("Primary:Kerberos-Newer-Keys", scb.sub.packages[i].name) == 0) {
313 scpk = &scb.sub.packages[i];
314 if (!scpk->data || !scpk->data[0]) {
315 scpk = NULL;
316 continue;
317 }
318 newer_keys = true;
319 break;
320 } else if (strcmp("Primary:Kerberos", scb.sub.packages[i].name) == 0) {
321 scpk = &scb.sub.packages[i];
322 if (!scpk->data || !scpk->data[0]) {
323 scpk = NULL;
324 }
325 /*
326 * we don't break here in hope to find
327 * a Kerberos-Newer-Keys package
328 */
329 }
330 }
331 }
332 /*
333 * Primary:Kerberos-Newer-Keys or Primary:Kerberos element
334 * of supplementalCredentials
335 */
336 if (scpk) {
337 DATA_BLOB blob;
338
339 blob = strhex_to_data_blob(mem_ctx, scpk->data);
340 if (!blob.data) {
341 ret = ENOMEM;
342 goto out;
343 }
344
345 /* we cannot use ndr_pull_struct_blob_all() here, as w2k and w2k3 add padding bytes */
346 ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, &_pkb,
347 (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
348 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
349 ret = EINVAL;
350 krb5_set_error_message(context, ret, "samba_kdc_message2entry_keys: could not parse package_PrimaryKerberosBlob");
351 krb5_warnx(context, "samba_kdc_message2entry_keys: could not parse package_PrimaryKerberosBlob");
352 goto out;
353 }
354
355 if (newer_keys && _pkb.version != 4) {
356 ret = EINVAL;
357 krb5_set_error_message(context, ret, "samba_kdc_message2entry_keys: Primary:Kerberos-Newer-Keys not version 4");
358 krb5_warnx(context, "samba_kdc_message2entry_keys: Primary:Kerberos-Newer-Keys not version 4");
359 goto out;
360 }
361
362 if (!newer_keys && _pkb.version != 3) {
363 ret = EINVAL;
364 krb5_set_error_message(context, ret, "samba_kdc_message2entry_keys: could not parse Primary:Kerberos not version 3");
365 krb5_warnx(context, "samba_kdc_message2entry_keys: could not parse Primary:Kerberos not version 3");
366 goto out;
367 }
368
369 if (_pkb.version == 4) {
370 pkb4 = &_pkb.ctr.ctr4;
371 allocated_keys += pkb4->num_keys;
372 } else if (_pkb.version == 3) {
373 pkb3 = &_pkb.ctr.ctr3;
374 allocated_keys += pkb3->num_keys;
375 }
376 }
377
378 if (allocated_keys == 0) {
379 /* oh, no password. Apparently (comment in
380 * hdb-ldap.c) this violates the ASN.1, but this
381 * allows an entry with no keys (yet). */
382 return 0;
383 }
384
385 /* allocate space to decode into */
386 entry_ex->entry.keys.len = 0;
387 entry_ex->entry.keys.val = calloc(allocated_keys, sizeof(Key));
388 if (entry_ex->entry.keys.val == NULL) {
389 ret = ENOMEM;
390 goto out;
391 }
392
393 if (hash && (supported_enctypes & ENC_RC4_HMAC_MD5)) {
394 Key key;
395
396 key.mkvno = 0;
397 key.salt = NULL; /* No salt for this enc type */
398
399 ret = krb5_keyblock_init(context,
400 ENCTYPE_ARCFOUR_HMAC,
401 hash->hash, sizeof(hash->hash),
402 &key.key);
403 if (ret) {
404 goto out;
405 }
406
407 entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
408 entry_ex->entry.keys.len++;
409 }
410
411 if (pkb4) {
412 for (i=0; i < pkb4->num_keys; i++) {
413 Key key;
414
415 if (!pkb4->keys[i].value) continue;
416
417 if (!(kerberos_enctype_to_bitmap(pkb4->keys[i].keytype) & supported_enctypes)) {
418 continue;
419 }
420
421 key.mkvno = 0;
422 key.salt = NULL;
423
424 if (pkb4->salt.string) {
425 DATA_BLOB salt;
426
427 salt = data_blob_string_const(pkb4->salt.string);
428
429 key.salt = calloc(1, sizeof(*key.salt));
430 if (key.salt == NULL) {
431 ret = ENOMEM;
432 goto out;
433 }
434
435 key.salt->type = hdb_pw_salt;
436
437 ret = krb5_data_copy(&key.salt->salt, salt.data, salt.length);
438 if (ret) {
439 free(key.salt);
440 key.salt = NULL;
441 goto out;
442 }
443 }
444
445 /* TODO: maybe pass the iteration_count somehow... */
446
447 ret = krb5_keyblock_init(context,
448 pkb4->keys[i].keytype,
449 pkb4->keys[i].value->data,
450 pkb4->keys[i].value->length,
451 &key.key);
452 if (ret == KRB5_PROG_ETYPE_NOSUPP) {
453 DEBUG(2,("Unsupported keytype ignored - type %u\n",
454 pkb4->keys[i].keytype));
455 ret = 0;
456 continue;
457 }
458 if (ret) {
459 if (key.salt) {
460 free_Salt(key.salt);
461 free(key.salt);
462 key.salt = NULL;
463 }
464 goto out;
465 }
466
467 entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
468 entry_ex->entry.keys.len++;
469 }
470 } else if (pkb3) {
471 for (i=0; i < pkb3->num_keys; i++) {
472 Key key;
473
474 if (!pkb3->keys[i].value) continue;
475
476 if (!(kerberos_enctype_to_bitmap(pkb3->keys[i].keytype) & supported_enctypes)) {
477 continue;
478 }
479
480 key.mkvno = 0;
481 key.salt = NULL;
482
483 if (pkb3->salt.string) {
484 DATA_BLOB salt;
485
486 salt = data_blob_string_const(pkb3->salt.string);
487
488 key.salt = calloc(1, sizeof(*key.salt));
489 if (key.salt == NULL) {
490 ret = ENOMEM;
491 goto out;
492 }
493
494 key.salt->type = hdb_pw_salt;
495
496 ret = krb5_data_copy(&key.salt->salt, salt.data, salt.length);
497 if (ret) {
498 free(key.salt);
499 key.salt = NULL;
500 goto out;
501 }
502 }
503
504 ret = krb5_keyblock_init(context,
505 pkb3->keys[i].keytype,
506 pkb3->keys[i].value->data,
507 pkb3->keys[i].value->length,
508 &key.key);
509 if (ret) {
510 if (key.salt) {
511 free_Salt(key.salt);
512 free(key.salt);
513 key.salt = NULL;
514 }
515 goto out;
516 }
517
518 entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
519 entry_ex->entry.keys.len++;
520 }
521 }
522
523 out:
524 if (ret != 0) {
525 entry_ex->entry.keys.len = 0;
526 }
527 if (entry_ex->entry.keys.len == 0 && entry_ex->entry.keys.val) {
528 free(entry_ex->entry.keys.val);
529 entry_ex->entry.keys.val = NULL;
530 }
531 return ret;
532 }
533
534 /*
535 * Construct an hdb_entry from a directory entry.
536 */
537 static krb5_error_code samba_kdc_message2entry(krb5_context context,
538 struct samba_kdc_db_context *kdc_db_ctx,
539 TALLOC_CTX *mem_ctx, krb5_const_principal principal,
540 enum samba_kdc_ent_type ent_type,
541 struct ldb_dn *realm_dn,
542 struct ldb_message *msg,
543 hdb_entry_ex *entry_ex)
544 {
545 struct loadparm_context *lp_ctx = kdc_db_ctx->lp_ctx;
546 uint32_t userAccountControl;
547 unsigned int i;
548 krb5_error_code ret = 0;
549 krb5_boolean is_computer = FALSE;
550 char *realm = strupper_talloc(mem_ctx, lpcfg_realm(lp_ctx));
551
552 struct samba_kdc_entry *p;
553 NTTIME acct_expiry;
554 NTSTATUS status;
555
556 uint32_t rid;
557 bool is_rodc = false;
558 struct ldb_message_element *objectclasses;
559 struct ldb_val computer_val;
560 const char *samAccountName = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
561 computer_val.data = discard_const_p(uint8_t,"computer");
562 computer_val.length = strlen((const char *)computer_val.data);
563
564 if (ldb_msg_find_element(msg, "msDS-SecondaryKrbTgtNumber")) {
565 is_rodc = true;
566 }
567
568 if (!samAccountName) {
569 ret = ENOENT;
570 krb5_set_error_message(context, ret, "samba_kdc_message2entry: no samAccountName present");
571 goto out;
572 }
573
574 objectclasses = ldb_msg_find_element(msg, "objectClass");
575
576 if (objectclasses && ldb_msg_find_val(objectclasses, &computer_val)) {
577 is_computer = TRUE;
578 }
579
580 memset(entry_ex, 0, sizeof(*entry_ex));
581
582 if (!realm) {
583 ret = ENOMEM;
584 krb5_set_error_message(context, ret, "talloc_strdup: out of memory");
585 goto out;
586 }
587
588 p = talloc(mem_ctx, struct samba_kdc_entry);
589 if (!p) {
590 ret = ENOMEM;
591 goto out;
592 }
593
594 p->kdc_db_ctx = kdc_db_ctx;
595 p->entry_ex = entry_ex;
596 p->realm_dn = talloc_reference(p, realm_dn);
597 if (!p->realm_dn) {
598 ret = ENOMEM;
599 goto out;
600 }
601
602 talloc_set_destructor(p, samba_kdc_entry_destructor);
603
604 /* make sure we do not have bogus data in there */
605 memset(&entry_ex->entry, 0, sizeof(hdb_entry));
606
607 entry_ex->ctx = p;
608 entry_ex->free_entry = samba_kdc_free_entry;
609
610 userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
611
612
613 entry_ex->entry.principal = malloc(sizeof(*(entry_ex->entry.principal)));
614 if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) {
615 krb5_make_principal(context, &entry_ex->entry.principal, realm, samAccountName, NULL);
616 } else {
617 ret = copy_Principal(principal, entry_ex->entry.principal);
618 if (ret) {
619 krb5_clear_error_message(context);
620 goto out;
621 }
622
623 /* While we have copied the client principal, tests
624 * show that Win2k3 returns the 'corrected' realm, not
625 * the client-specified realm. This code attempts to
626 * replace the client principal's realm with the one
627 * we determine from our records */
628
629 /* this has to be with malloc() */
630 krb5_principal_set_realm(context, entry_ex->entry.principal, realm);
631 }
632
633 /* First try and figure out the flags based on the userAccountControl */
634 entry_ex->entry.flags = uf2HDBFlags(context, userAccountControl, ent_type);
635
636 /* Windows 2008 seems to enforce this (very sensible) rule by
637 * default - don't allow offline attacks on a user's password
638 * by asking for a ticket to them as a service (encrypted with
639 * their probably patheticly insecure password) */
640
641 if (entry_ex->entry.flags.server
642 && lpcfg_parm_bool(lp_ctx, NULL, "kdc", "require spn for service", true)) {
643 if (!is_computer && !ldb_msg_find_attr_as_string(msg, "servicePrincipalName", NULL)) {
644 entry_ex->entry.flags.server = 0;
645 }
646 }
647
648 {
649 /* These (created_by, modified_by) parts of the entry are not relevant for Samba4's use
650 * of the Heimdal KDC. They are stored in a the traditional
651 * DB for audit purposes, and still form part of the structure
652 * we must return */
653
654 /* use 'whenCreated' */
655 entry_ex->entry.created_by.time = ldb_msg_find_krb5time_ldap_time(msg, "whenCreated", 0);
656 /* use 'kadmin' for now (needed by mit_samba) */
657 krb5_make_principal(context,
658 &entry_ex->entry.created_by.principal,
659 realm, "kadmin", NULL);
660
661 entry_ex->entry.modified_by = (Event *) malloc(sizeof(Event));
662 if (entry_ex->entry.modified_by == NULL) {
663 ret = ENOMEM;
664 krb5_set_error_message(context, ret, "malloc: out of memory");
665 goto out;
666 }
667
668 /* use 'whenChanged' */
669 entry_ex->entry.modified_by->time = ldb_msg_find_krb5time_ldap_time(msg, "whenChanged", 0);
670 /* use 'kadmin' for now (needed by mit_samba) */
671 krb5_make_principal(context,
672 &entry_ex->entry.modified_by->principal,
673 realm, "kadmin", NULL);
674 }
675
676
677 /* The lack of password controls etc applies to krbtgt by
678 * virtue of being that particular RID */
679 status = dom_sid_split_rid(NULL, samdb_result_dom_sid(mem_ctx, msg, "objectSid"), NULL, &rid);
680
681 if (!NT_STATUS_IS_OK(status)) {
682 ret = EINVAL;
683 goto out;
684 }
685
686 if (rid == DOMAIN_RID_KRBTGT) {
687 entry_ex->entry.valid_end = NULL;
688 entry_ex->entry.pw_end = NULL;
689
690 entry_ex->entry.flags.invalid = 0;
691 entry_ex->entry.flags.server = 1;
692
693 /* Don't mark all requests for the krbtgt/realm as
694 * 'change password', as otherwise we could get into
695 * trouble, and not enforce the password expirty.
696 * Instead, only do it when request is for the kpasswd service */
697 if (ent_type == SAMBA_KDC_ENT_TYPE_SERVER
698 && principal->name.name_string.len == 2
699 && (strcmp(principal->name.name_string.val[0], "kadmin") == 0)
700 && (strcmp(principal->name.name_string.val[1], "changepw") == 0)
701 && lpcfg_is_my_domain_or_realm(lp_ctx, principal->realm)) {
702 entry_ex->entry.flags.change_pw = 1;
703 }
704 entry_ex->entry.flags.client = 0;
705 entry_ex->entry.flags.forwardable = 1;
706 entry_ex->entry.flags.ok_as_delegate = 1;
707 } else if (is_rodc) {
708 /* The RODC krbtgt account is like the main krbtgt,
709 * but it does not have a changepw or kadmin
710 * service */
711
712 entry_ex->entry.valid_end = NULL;
713 entry_ex->entry.pw_end = NULL;
714
715 /* Also don't allow the RODC krbtgt to be a client (it should not be needed) */
716 entry_ex->entry.flags.client = 0;
717 entry_ex->entry.flags.invalid = 0;
718 entry_ex->entry.flags.server = 1;
719
720 entry_ex->entry.flags.client = 0;
721 entry_ex->entry.flags.forwardable = 1;
722 entry_ex->entry.flags.ok_as_delegate = 0;
723 } else if (entry_ex->entry.flags.server && ent_type == SAMBA_KDC_ENT_TYPE_SERVER) {
724 /* The account/password expiry only applies when the account is used as a
725 * client (ie password login), not when used as a server */
726
727 /* Make very well sure we don't use this for a client,
728 * it could bypass the password restrictions */
729 entry_ex->entry.flags.client = 0;
730
731 entry_ex->entry.valid_end = NULL;
732 entry_ex->entry.pw_end = NULL;
733
734 } else {
735 NTTIME must_change_time
736 = samdb_result_force_password_change(kdc_db_ctx->samdb, mem_ctx,
737 realm_dn, msg);
738 if (must_change_time == 0x7FFFFFFFFFFFFFFFULL) {
739 entry_ex->entry.pw_end = NULL;
740 } else {
741 entry_ex->entry.pw_end = malloc(sizeof(*entry_ex->entry.pw_end));
742 if (entry_ex->entry.pw_end == NULL) {
743 ret = ENOMEM;
744 goto out;
745 }
746 *entry_ex->entry.pw_end = nt_time_to_unix(must_change_time);
747 }
748
749 acct_expiry = samdb_result_account_expires(msg);
750 if (acct_expiry == 0x7FFFFFFFFFFFFFFFULL) {
751 entry_ex->entry.valid_end = NULL;
752 } else {
753 entry_ex->entry.valid_end = malloc(sizeof(*entry_ex->entry.valid_end));
754 if (entry_ex->entry.valid_end == NULL) {
755 ret = ENOMEM;
756 goto out;
757 }
758 *entry_ex->entry.valid_end = nt_time_to_unix(acct_expiry);
759 }
760 }
761
762 entry_ex->entry.valid_start = NULL;
763
764 entry_ex->entry.max_life = NULL;
765
766 entry_ex->entry.max_renew = NULL;
767
768 entry_ex->entry.generation = NULL;
769
770 /* Get keys from the db */
771 ret = samba_kdc_message2entry_keys(context, p, msg,
772 rid, is_rodc, userAccountControl,
773 ent_type, entry_ex);
774 if (ret) {
775 /* Could be bougus data in the entry, or out of memory */
776 goto out;
777 }
778
779 entry_ex->entry.etypes = malloc(sizeof(*(entry_ex->entry.etypes)));
780 if (entry_ex->entry.etypes == NULL) {
781 krb5_clear_error_message(context);
782 ret = ENOMEM;
783 goto out;
784 }
785 entry_ex->entry.etypes->len = entry_ex->entry.keys.len;
786 entry_ex->entry.etypes->val = calloc(entry_ex->entry.etypes->len, sizeof(int));
787 if (entry_ex->entry.etypes->val == NULL) {
788 krb5_clear_error_message(context);
789 ret = ENOMEM;
790 goto out;
791 }
792 for (i=0; i < entry_ex->entry.etypes->len; i++) {
793 entry_ex->entry.etypes->val[i] = entry_ex->entry.keys.val[i].key.keytype;
794 }
795
796
797 p->msg = talloc_steal(p, msg);
798
799 out:
800 if (ret != 0) {
801 /* This doesn't free ent itself, that is for the eventual caller to do */
802 hdb_free_entry(context, entry_ex);
803 } else {
804 talloc_steal(kdc_db_ctx, entry_ex->ctx);
805 }
806
807 return ret;
808 }
809
810 /*
811 * Construct an hdb_entry from a directory entry.
812 */
813 static krb5_error_code samba_kdc_trust_message2entry(krb5_context context,
814 struct samba_kdc_db_context *kdc_db_ctx,
815 TALLOC_CTX *mem_ctx, krb5_const_principal principal,
816 enum trust_direction direction,
817 struct ldb_dn *realm_dn,
818 struct ldb_message *msg,
819 hdb_entry_ex *entry_ex)
820 {
821 struct loadparm_context *lp_ctx = kdc_db_ctx->lp_ctx;
822 const char *dnsdomain;
823 char *realm = strupper_talloc(mem_ctx, lpcfg_realm(lp_ctx));
824 DATA_BLOB password_utf16;
825 struct samr_Password password_hash;
826 const struct ldb_val *password_val;
827 struct trustAuthInOutBlob password_blob;
828 struct samba_kdc_entry *p;
829
830 enum ndr_err_code ndr_err;
831 int ret, trust_direction_flags;
832 unsigned int i;
833
834 p = talloc(mem_ctx, struct samba_kdc_entry);
835 if (!p) {
836 ret = ENOMEM;
837 goto out;
838 }
839
840 p->kdc_db_ctx = kdc_db_ctx;
841 p->entry_ex = entry_ex;
842 p->realm_dn = realm_dn;
843
844 talloc_set_destructor(p, samba_kdc_entry_destructor);
845
846 /* make sure we do not have bogus data in there */
847 memset(&entry_ex->entry, 0, sizeof(hdb_entry));
848
849 entry_ex->ctx = p;
850 entry_ex->free_entry = samba_kdc_free_entry;
851
852 /* use 'whenCreated' */
853 entry_ex->entry.created_by.time = ldb_msg_find_krb5time_ldap_time(msg, "whenCreated", 0);
854 /* use 'kadmin' for now (needed by mit_samba) */
855 krb5_make_principal(context,
856 &entry_ex->entry.created_by.principal,
857 realm, "kadmin", NULL);
858
859 entry_ex->entry.valid_start = NULL;
860
861 trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
862
863 if (direction == INBOUND) {
864 password_val = ldb_msg_find_ldb_val(msg, "trustAuthIncoming");
865
866 } else { /* OUTBOUND */
867 dnsdomain = ldb_msg_find_attr_as_string(msg, "trustPartner", NULL);
868 /* replace realm */
869 talloc_free(realm);
870 realm = strupper_talloc(mem_ctx, dnsdomain);
871 password_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
872 }
873
874 if (!password_val || !(trust_direction_flags & direction)) {
875 ret = ENOENT;
876 goto out;
877 }
878
879 ndr_err = ndr_pull_struct_blob(password_val, mem_ctx, &password_blob,
880 (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
881 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
882 ret = EINVAL;
883 goto out;
884 }
885
886 entry_ex->entry.kvno = -1;
887 for (i=0; i < password_blob.count; i++) {
888 if (password_blob.current.array[i].AuthType == TRUST_AUTH_TYPE_VERSION) {
889 entry_ex->entry.kvno = password_blob.current.array[i].AuthInfo.version.version;
890 }
891 }
892
893 for (i=0; i < password_blob.count; i++) {
894 if (password_blob.current.array[i].AuthType == TRUST_AUTH_TYPE_CLEAR) {
895 password_utf16 = data_blob_const(password_blob.current.array[i].AuthInfo.clear.password,
896 password_blob.current.array[i].AuthInfo.clear.size);
897 /* In the future, generate all sorts of
898 * hashes, but for now we can't safely convert
899 * the random strings windows uses into
900 * utf8 */
901
902 /* but as it is utf16 already, we can get the NT password/arcfour-hmac-md5 key */
903 mdfour(password_hash.hash, password_utf16.data, password_utf16.length);
904 break;
905 } else if (password_blob.current.array[i].AuthType == TRUST_AUTH_TYPE_NT4OWF) {
906 password_hash = password_blob.current.array[i].AuthInfo.nt4owf.password;
907 break;
908 }
909 }
910
911 if (i < password_blob.count) {
912 Key key;
913 /* Must have found a cleartext or MD4 password */
914 entry_ex->entry.keys.val = calloc(1, sizeof(Key));
915
916 key.mkvno = 0;
917 key.salt = NULL; /* No salt for this enc type */
918
919 if (entry_ex->entry.keys.val == NULL) {
920 ret = ENOMEM;
921 goto out;
922 }
923
924 ret = krb5_keyblock_init(context,
925 ENCTYPE_ARCFOUR_HMAC,
926 password_hash.hash, sizeof(password_hash.hash),
927 &key.key);
928
929 entry_ex->entry.keys.val[entry_ex->entry.keys.len] = key;
930 entry_ex->entry.keys.len++;
931 }
932
933 entry_ex->entry.principal = malloc(sizeof(*(entry_ex->entry.principal)));
934
935 ret = copy_Principal(principal, entry_ex->entry.principal);
936 if (ret) {
937 krb5_clear_error_message(context);
938 goto out;
939 }
940
941 /* While we have copied the client principal, tests
942 * show that Win2k3 returns the 'corrected' realm, not
943 * the client-specified realm. This code attempts to
944 * replace the client principal's realm with the one
945 * we determine from our records */
946
947 krb5_principal_set_realm(context, entry_ex->entry.principal, realm);
948 entry_ex->entry.flags = int2HDBFlags(0);
949 entry_ex->entry.flags.immutable = 1;
950 entry_ex->entry.flags.invalid = 0;
951 entry_ex->entry.flags.server = 1;
952 entry_ex->entry.flags.require_preauth = 1;
953
954 entry_ex->entry.pw_end = NULL;
955
956 entry_ex->entry.max_life = NULL;
957
958 entry_ex->entry.max_renew = NULL;
959
960 entry_ex->entry.generation = NULL;
961
962 entry_ex->entry.etypes = malloc(sizeof(*(entry_ex->entry.etypes)));
963 if (entry_ex->entry.etypes == NULL) {
964 krb5_clear_error_message(context);
965 ret = ENOMEM;
966 goto out;
967 }
968 entry_ex->entry.etypes->len = entry_ex->entry.keys.len;
969 entry_ex->entry.etypes->val = calloc(entry_ex->entry.etypes->len, sizeof(int));
970 if (entry_ex->entry.etypes->val == NULL) {
971 krb5_clear_error_message(context);
972 ret = ENOMEM;
973 goto out;
974 }
975 for (i=0; i < entry_ex->entry.etypes->len; i++) {
976 entry_ex->entry.etypes->val[i] = entry_ex->entry.keys.val[i].key.keytype;
977 }
978
979
980 p->msg = talloc_steal(p, msg);
981
982 out:
983 if (ret != 0) {
984 /* This doesn't free ent itself, that is for the eventual caller to do */
985 hdb_free_entry(context, entry_ex);
986 } else {
987 talloc_steal(kdc_db_ctx, entry_ex->ctx);
988 }
989
990 return ret;
991
992 }
993
994 static krb5_error_code samba_kdc_lookup_trust(krb5_context context, struct ldb_context *ldb_ctx,
995 TALLOC_CTX *mem_ctx,
996 const char *realm,
997 struct ldb_dn *realm_dn,
998 struct ldb_message **pmsg)
999 {
1000 int lret;
1001 krb5_error_code ret;
1002 char *filter = NULL;
1003 const char * const *attrs = trust_attrs;
1004
1005 struct ldb_result *res = NULL;
1006 filter = talloc_asprintf(mem_ctx, "(&(objectClass=trustedDomain)(|(flatname=%s)(trustPartner=%s)))", realm, realm);
1007
1008 if (!filter) {
1009 ret = ENOMEM;
1010 krb5_set_error_message(context, ret, "talloc_asprintf: out of memory");
1011 return ret;
1012 }
1013
1014 lret = ldb_search(ldb_ctx, mem_ctx, &res,
1015 ldb_get_default_basedn(ldb_ctx),
1016 LDB_SCOPE_SUBTREE, attrs, "%s", filter);
1017 if (lret != LDB_SUCCESS) {
1018 DEBUG(3, ("Failed to search for %s: %s\n", filter, ldb_errstring(ldb_ctx)));
1019 return HDB_ERR_NOENTRY;
1020 } else if (res->count == 0 || res->count > 1) {
1021 DEBUG(3, ("Failed find a single entry for %s: got %d\n", filter, res->count));
1022 talloc_free(res);
1023 return HDB_ERR_NOENTRY;
1024 }
1025 talloc_steal(mem_ctx, res->msgs);
1026 *pmsg = res->msgs[0];
1027 talloc_free(res);
1028 return 0;
1029 }
1030
1031 static krb5_error_code samba_kdc_lookup_client(krb5_context context,
1032 struct samba_kdc_db_context *kdc_db_ctx,
1033 TALLOC_CTX *mem_ctx,
1034 krb5_const_principal principal,
1035 const char **attrs,
1036 struct ldb_dn **realm_dn,
1037 struct ldb_message **msg) {
1038 NTSTATUS nt_status;
1039 char *principal_string;
1040 krb5_error_code ret;
1041
1042 ret = krb5_unparse_name(context, principal, &principal_string);
1043
1044 if (ret != 0) {
1045 return ret;
1046 }
1047
1048 nt_status = sam_get_results_principal(kdc_db_ctx->samdb,
1049 mem_ctx, principal_string, attrs,
1050 realm_dn, msg);
1051 free(principal_string);
1052 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
1053 return HDB_ERR_NOENTRY;
1054 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) {
1055 return ENOMEM;
1056 } else if (!NT_STATUS_IS_OK(nt_status)) {
1057 return EINVAL;
1058 }
1059
1060 return ret;
1061 }
1062
1063 static krb5_error_code samba_kdc_fetch_client(krb5_context context,
1064 struct samba_kdc_db_context *kdc_db_ctx,
1065 TALLOC_CTX *mem_ctx,
1066 krb5_const_principal principal,
1067 hdb_entry_ex *entry_ex) {
1068 struct ldb_dn *realm_dn;
1069 krb5_error_code ret;
1070 struct ldb_message *msg = NULL;
1071
1072 ret = samba_kdc_lookup_client(context, kdc_db_ctx,
1073 mem_ctx, principal, user_attrs,
1074 &realm_dn, &msg);
1075 if (ret != 0) {
1076 return ret;
1077 }
1078
1079 ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx,
1080 principal, SAMBA_KDC_ENT_TYPE_CLIENT,
1081 realm_dn, msg, entry_ex);
1082 return ret;
1083 }
1084
1085 static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
1086 struct samba_kdc_db_context *kdc_db_ctx,
1087 TALLOC_CTX *mem_ctx,
1088 krb5_const_principal principal,
1089 uint32_t krbtgt_number,
1090 hdb_entry_ex *entry_ex)
1091 {
1092 struct loadparm_context *lp_ctx = kdc_db_ctx->lp_ctx;
1093 krb5_error_code ret;
1094 struct ldb_message *msg = NULL;
1095 struct ldb_dn *realm_dn = ldb_get_default_basedn(kdc_db_ctx->samdb);
1096
1097 krb5_principal alloc_principal = NULL;
1098 if (principal->name.name_string.len != 2
1099 || (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) != 0)) {
1100 /* Not a krbtgt */
1101 return HDB_ERR_NOENTRY;
1102 }
1103
1104 /* krbtgt case. Either us or a trusted realm */
1105
1106 if (lpcfg_is_my_domain_or_realm(lp_ctx, principal->realm)
1107 && lpcfg_is_my_domain_or_realm(lp_ctx, principal->name.name_string.val[1])) {
1108 /* us, or someone quite like us */
1109 /* Cludge, cludge cludge. If the realm part of krbtgt/realm,
1110 * is in our db, then direct the caller at our primary
1111 * krbtgt */
1112
1113 int lret;
1114 char *realm_fixed;
1115
1116 if (krbtgt_number == kdc_db_ctx->my_krbtgt_number) {
1117 lret = dsdb_search_one(kdc_db_ctx->samdb, mem_ctx,
1118 &msg, kdc_db_ctx->krbtgt_dn, LDB_SCOPE_BASE,
1119 krbtgt_attrs, 0,
1120 "(objectClass=user)");
1121 } else {
1122 /* We need to look up an RODC krbtgt (perhaps
1123 * ours, if we are an RODC, perhaps another
1124 * RODC if we are a read-write DC */
1125 lret = dsdb_search_one(kdc_db_ctx->samdb, mem_ctx,
1126 &msg, realm_dn, LDB_SCOPE_SUBTREE,
1127 krbtgt_attrs,
1128 DSDB_SEARCH_SHOW_EXTENDED_DN,
1129 "(&(objectClass=user)(msDS-SecondaryKrbTgtNumber=%u))", (unsigned)(krbtgt_number));
1130 }
1131
1132 if (lret == LDB_ERR_NO_SUCH_OBJECT) {
1133 krb5_warnx(context, "samba_kdc_fetch: could not find KRBTGT number %u in DB!",
1134 (unsigned)(krbtgt_number));
1135 krb5_set_error_message(context, HDB_ERR_NOENTRY,
1136 "samba_kdc_fetch: could not find KRBTGT number %u in DB!",
1137 (unsigned)(krbtgt_number));
1138 return HDB_ERR_NOENTRY;
1139 } else if (lret != LDB_SUCCESS) {
1140 krb5_warnx(context, "samba_kdc_fetch: could not find KRBTGT number %u in DB!",
1141 (unsigned)(krbtgt_number));
1142 krb5_set_error_message(context, HDB_ERR_NOENTRY,
1143 "samba_kdc_fetch: could not find KRBTGT number %u in DB!",
1144 (unsigned)(krbtgt_number));
1145 return HDB_ERR_NOENTRY;
1146 }
1147
1148 realm_fixed = strupper_talloc(mem_ctx, lpcfg_realm(lp_ctx));
1149 if (!realm_fixed) {
1150 ret = ENOMEM;
1151 krb5_set_error_message(context, ret, "strupper_talloc: out of memory");
1152 return ret;
1153 }
1154
1155 ret = krb5_copy_principal(context, principal, &alloc_principal);
1156 if (ret) {
1157 return ret;
1158 }
1159
1160 free(alloc_principal->name.name_string.val[1]);
1161 alloc_principal->name.name_string.val[1] = strdup(realm_fixed);
1162 talloc_free(realm_fixed);
1163 if (!alloc_principal->name.name_string.val[1]) {
1164 ret = ENOMEM;
1165 krb5_set_error_message(context, ret, "samba_kdc_fetch: strdup() failed!");
1166 return ret;
1167 }
1168 principal = alloc_principal;
1169
1170 ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx,
1171 principal, SAMBA_KDC_ENT_TYPE_KRBTGT,
1172 realm_dn, msg, entry_ex);
1173 if (ret != 0) {
1174 krb5_warnx(context, "samba_kdc_fetch: self krbtgt message2entry failed");
1175 }
1176 return ret;
1177
1178 } else {
1179 enum trust_direction direction = UNKNOWN;
1180 const char *realm = NULL;
1181
1182 /* Either an inbound or outbound trust */
1183
1184 if (strcasecmp(lpcfg_realm(lp_ctx), principal->realm) == 0) {
1185 /* look for inbound trust */
1186 direction = INBOUND;
1187 realm = principal->name.name_string.val[1];
1188 } else if (strcasecmp(lpcfg_realm(lp_ctx), principal->name.name_string.val[1]) == 0) {
1189 /* look for outbound trust */
1190 direction = OUTBOUND;
1191 realm = principal->realm;
1192 } else {
1193 krb5_warnx(context, "samba_kdc_fetch: not our realm for trusts ('%s', '%s')",
1194 principal->realm, principal->name.name_string.val[1]);
1195 krb5_set_error_message(context, HDB_ERR_NOENTRY, "samba_kdc_fetch: not our realm for trusts ('%s', '%s')",
1196 principal->realm, principal->name.name_string.val[1]);
1197 return HDB_ERR_NOENTRY;
1198 }
1199
1200 /* Trusted domains are under CN=system */
1201
1202 ret = samba_kdc_lookup_trust(context, kdc_db_ctx->samdb,
1203 mem_ctx,
1204 realm, realm_dn, &msg);
1205
1206 if (ret != 0) {
1207 krb5_warnx(context, "samba_kdc_fetch: could not find principal in DB");
1208 krb5_set_error_message(context, ret, "samba_kdc_fetch: could not find principal in DB");
1209 return ret;
1210 }
1211
1212 ret = samba_kdc_trust_message2entry(context, kdc_db_ctx, mem_ctx,
1213 principal, direction,
1214 realm_dn, msg, entry_ex);
1215 if (ret != 0) {
1216 krb5_warnx(context, "samba_kdc_fetch: trust_message2entry failed");
1217 }
1218 return ret;
1219 }
1220
1221 }
1222
1223 static krb5_error_code samba_kdc_lookup_server(krb5_context context,
1224 struct samba_kdc_db_context *kdc_db_ctx,
1225 TALLOC_CTX *mem_ctx,
1226 krb5_const_principal principal,
1227 const char **attrs,
1228 struct ldb_dn **realm_dn,
1229 struct ldb_message **msg)
1230 {
1231 krb5_error_code ret;
1232 const char *realm;
1233 if (principal->name.name_string.len >= 2) {
1234 /* 'normal server' case */
1235 int ldb_ret;
1236 NTSTATUS nt_status;
1237 struct ldb_dn *user_dn;
1238 char *principal_string;
1239
1240 ret = krb5_unparse_name_flags(context, principal,
1241 KRB5_PRINCIPAL_UNPARSE_NO_REALM,
1242 &principal_string);
1243 if (ret != 0) {
1244 return ret;
1245 }
1246
1247 /* At this point we may find the host is known to be
1248 * in a different realm, so we should generate a
1249 * referral instead */
1250 nt_status = crack_service_principal_name(kdc_db_ctx->samdb,
1251 mem_ctx, principal_string,
1252 &user_dn, realm_dn);
1253 free(principal_string);
1254
1255 if (!NT_STATUS_IS_OK(nt_status)) {
1256 return HDB_ERR_NOENTRY;
1257 }
1258
1259 ldb_ret = dsdb_search_one(kdc_db_ctx->samdb,
1260 mem_ctx,
1261 msg, user_dn, LDB_SCOPE_BASE,
1262 attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
1263 if (ldb_ret != LDB_SUCCESS) {
1264 return HDB_ERR_NOENTRY;
1265 }
1266
1267 } else {
1268 int lret;
1269 char *filter = NULL;
1270 char *short_princ;
1271 /* server as client principal case, but we must not lookup userPrincipalNames */
1272 *realm_dn = ldb_get_default_basedn(kdc_db_ctx->samdb);
1273 realm = krb5_principal_get_realm(context, principal);
1274
1275 /* TODO: Check if it is our realm, otherwise give referall */
1276
1277 ret = krb5_unparse_name_flags(context, principal, KRB5_PRINCIPAL_UNPARSE_NO_REALM, &short_princ);
1278
1279 if (ret != 0) {
1280 krb5_set_error_message(context, ret, "samba_kdc_lookup_principal: could not parse principal");
1281 krb5_warnx(context, "samba_kdc_lookup_principal: could not parse principal");
1282 return ret;
1283 }
1284
1285 lret = dsdb_search_one(kdc_db_ctx->samdb, mem_ctx, msg,
1286 *realm_dn, LDB_SCOPE_SUBTREE,
1287 attrs,
1288 DSDB_SEARCH_SHOW_EXTENDED_DN,
1289 "(&(objectClass=user)(samAccountName=%s))",
1290 ldb_binary_encode_string(mem_ctx, short_princ));
1291 free(short_princ);
1292 if (lret == LDB_ERR_NO_SUCH_OBJECT) {
1293 DEBUG(3, ("Failed find a entry for %s\n", filter));
1294 return HDB_ERR_NOENTRY;
1295 }
1296 if (lret != LDB_SUCCESS) {
1297 DEBUG(3, ("Failed single search for for %s - %s\n",
1298 filter, ldb_errstring(kdc_db_ctx->samdb)));
1299 return HDB_ERR_NOENTRY;
1300 }
1301 }
1302
1303 return 0;
1304 }
1305
1306 static krb5_error_code samba_kdc_fetch_server(krb5_context context,
1307 struct samba_kdc_db_context *kdc_db_ctx,
1308 TALLOC_CTX *mem_ctx,
1309 krb5_const_principal principal,
1310 hdb_entry_ex *entry_ex)
1311 {
1312 krb5_error_code ret;
1313 struct ldb_dn *realm_dn;
1314 struct ldb_message *msg;
1315
1316 ret = samba_kdc_lookup_server(context, kdc_db_ctx, mem_ctx, principal,
1317 server_attrs, &realm_dn, &msg);
1318 if (ret != 0) {
1319 return ret;
1320 }
1321
1322 ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx,
1323 principal, SAMBA_KDC_ENT_TYPE_SERVER,
1324 realm_dn, msg, entry_ex);
1325 if (ret != 0) {
1326 krb5_warnx(context, "samba_kdc_fetch: message2entry failed");
1327 }
1328
1329 return ret;
1330 }
1331
1332 krb5_error_code samba_kdc_fetch(krb5_context context,
1333 struct samba_kdc_db_context *kdc_db_ctx,
1334 krb5_const_principal principal,
1335 unsigned flags,
1336 unsigned kvno,
1337 hdb_entry_ex *entry_ex)
1338 {
1339 krb5_error_code ret = HDB_ERR_NOENTRY;
1340 TALLOC_CTX *mem_ctx;
1341 unsigned int krbtgt_number;
1342 if (flags & HDB_F_KVNO_SPECIFIED) {
1343 krbtgt_number = kvno >> 16;
1344 if (kdc_db_ctx->rodc) {
1345 if (krbtgt_number != kdc_db_ctx->my_krbtgt_number) {
1346 return HDB_ERR_NOT_FOUND_HERE;
1347 }
1348 }
1349 } else {
1350 krbtgt_number = kdc_db_ctx->my_krbtgt_number;
1351 }
1352
1353 mem_ctx = talloc_named(kdc_db_ctx, 0, "samba_kdc_fetch context");
1354 if (!mem_ctx) {
1355 ret = ENOMEM;
1356 krb5_set_error_message(context, ret, "samba_kdc_fetch: talloc_named() failed!");
1357 return ret;
1358 }
1359
1360 if (flags & HDB_F_GET_CLIENT) {
1361 ret = samba_kdc_fetch_client(context, kdc_db_ctx, mem_ctx, principal, entry_ex);
1362 if (ret != HDB_ERR_NOENTRY) goto done;
1363 }
1364 if (flags & HDB_F_GET_SERVER) {
1365 /* krbtgt fits into this situation for trusted realms, and for resolving different versions of our own realm name */
1366 ret = samba_kdc_fetch_krbtgt(context, kdc_db_ctx, mem_ctx, principal, krbtgt_number, entry_ex);
1367 if (ret != HDB_ERR_NOENTRY) goto done;
1368
1369 /* We return 'no entry' if it does not start with krbtgt/, so move to the common case quickly */
1370 ret = samba_kdc_fetch_server(context, kdc_db_ctx, mem_ctx, principal, entry_ex);
1371 if (ret != HDB_ERR_NOENTRY) goto done;
1372 }
1373 if (flags & HDB_F_GET_KRBTGT) {
1374 ret = samba_kdc_fetch_krbtgt(context, kdc_db_ctx, mem_ctx, principal, krbtgt_number, entry_ex);
1375 if (ret != HDB_ERR_NOENTRY) goto done;
1376 }
1377
1378 done:
1379 talloc_free(mem_ctx);
1380 return ret;
1381 }
1382
1383 struct samba_kdc_seq {
1384 unsigned int index;
1385 unsigned int count;
1386 struct ldb_message **msgs;
1387 struct ldb_dn *realm_dn;
1388 };
1389
1390 static krb5_error_code samba_kdc_seq(krb5_context context,
1391 struct samba_kdc_db_context *kdc_db_ctx,
1392 hdb_entry_ex *entry)
1393 {
1394 krb5_error_code ret;
1395 struct samba_kdc_seq *priv = kdc_db_ctx->seq_ctx;
1396 TALLOC_CTX *mem_ctx;
1397 hdb_entry_ex entry_ex;
1398 memset(&entry_ex, '\0', sizeof(entry_ex));
1399
1400 if (!priv) {
1401 return HDB_ERR_NOENTRY;
1402 }
1403
1404 mem_ctx = talloc_named(priv, 0, "samba_kdc_seq context");
1405
1406 if (!mem_ctx) {
1407 ret = ENOMEM;
1408 krb5_set_error_message(context, ret, "samba_kdc_seq: talloc_named() failed!");
1409 return ret;
1410 }
1411
1412 if (priv->index < priv->count) {
1413 ret = samba_kdc_message2entry(context, kdc_db_ctx, mem_ctx,
1414 NULL, SAMBA_KDC_ENT_TYPE_ANY,
1415 priv->realm_dn, priv->msgs[priv->index++], entry);
1416 } else {
1417 ret = HDB_ERR_NOENTRY;
1418 }
1419
1420 if (ret != 0) {
1421 TALLOC_FREE(priv);
1422 kdc_db_ctx->seq_ctx = NULL;
1423 } else {
1424 talloc_free(mem_ctx);
1425 }
1426
1427 return ret;
1428 }
1429
1430 krb5_error_code samba_kdc_firstkey(krb5_context context,
1431 struct samba_kdc_db_context *kdc_db_ctx,
1432 hdb_entry_ex *entry)
1433 {
1434 struct ldb_context *ldb_ctx = kdc_db_ctx->samdb;
1435 struct samba_kdc_seq *priv = kdc_db_ctx->seq_ctx;
1436 char *realm;
1437 struct ldb_result *res = NULL;
1438 krb5_error_code ret;
1439 TALLOC_CTX *mem_ctx;
1440 int lret;
1441
1442 if (priv) {
1443 TALLOC_FREE(priv);
1444 kdc_db_ctx->seq_ctx = NULL;
1445 }
1446
1447 priv = (struct samba_kdc_seq *) talloc(kdc_db_ctx, struct samba_kdc_seq);
1448 if (!priv) {
1449 ret = ENOMEM;
1450 krb5_set_error_message(context, ret, "talloc: out of memory");
1451 return ret;
1452 }
1453
1454 priv->index = 0;
1455 priv->msgs = NULL;
1456 priv->realm_dn = ldb_get_default_basedn(ldb_ctx);
1457 priv->count = 0;
1458
1459 mem_ctx = talloc_named(priv, 0, "samba_kdc_firstkey context");
1460
1461 if (!mem_ctx) {
1462 ret = ENOMEM;
1463 krb5_set_error_message(context, ret, "samba_kdc_firstkey: talloc_named() failed!");
1464 return ret;
1465 }
1466
1467 ret = krb5_get_default_realm(context, &realm);
1468 if (ret != 0) {
1469 TALLOC_FREE(priv);
1470 return ret;
1471 }
1472
1473 lret = ldb_search(ldb_ctx, priv, &res,
1474 priv->realm_dn, LDB_SCOPE_SUBTREE, user_attrs,
1475 "(objectClass=user)");
1476
1477 if (lret != LDB_SUCCESS) {
1478 TALLOC_FREE(priv);
1479 return HDB_ERR_NOENTRY;
1480 }
1481
1482 priv->count = res->count;
1483 priv->msgs = talloc_steal(priv, res->msgs);
1484 talloc_free(res);
1485
1486 kdc_db_ctx->seq_ctx = priv;
1487
1488 ret = samba_kdc_seq(context, kdc_db_ctx, entry);
1489
1490 if (ret != 0) {
1491 TALLOC_FREE(priv);
1492 kdc_db_ctx->seq_ctx = NULL;
1493 } else {
1494 talloc_free(mem_ctx);
1495 }
1496 return ret;
1497 }
1498
1499 krb5_error_code samba_kdc_nextkey(krb5_context context,
1500 struct samba_kdc_db_context *kdc_db_ctx,
1501 hdb_entry_ex *entry)
1502 {
1503 return samba_kdc_seq(context, kdc_db_ctx, entry);
1504 }
1505
1506 /* Check if a given entry may delegate or do s4u2self to this target principal
1507 *
1508 * This is currently a very nasty hack - allowing only delegation to itself.
1509 *
1510 * This is shared between the constrained delegation and S4U2Self code.
1511 */
1512 krb5_error_code
1513 samba_kdc_check_identical_client_and_server(krb5_context context,
1514 struct samba_kdc_db_context *kdc_db_ctx,
1515 hdb_entry_ex *entry,
1516 krb5_const_principal target_principal)
1517 {
1518 krb5_error_code ret;
1519 krb5_principal enterprise_prinicpal = NULL;
1520 struct ldb_dn *realm_dn;
1521 struct ldb_message *msg;
1522 struct dom_sid *orig_sid;
1523 struct dom_sid *target_sid;
1524 struct samba_kdc_entry *p = talloc_get_type(entry->ctx, struct samba_kdc_entry);
1525 const char *delegation_check_attrs[] = {
1526 "objectSid", NULL
1527 };
1528
1529 TALLOC_CTX *mem_ctx = talloc_named(kdc_db_ctx, 0, "samba_kdc_check_constrained_delegation");
1530
1531 if (!mem_ctx) {
1532 ret = ENOMEM;
1533 krb5_set_error_message(context, ret, "samba_kdc_fetch: talloc_named() failed!");
1534 return ret;
1535 }
1536
1537 if (target_principal->name.name_type == KRB5_NT_ENTERPRISE_PRINCIPAL) {
1538 /* Need to reparse the enterprise principal to find the real target */
1539 if (target_principal->name.name_string.len != 1) {
1540 ret = KRB5_PARSE_MALFORMED;
1541 krb5_set_error_message(context, ret, "samba_kdc_check_constrained_delegation: request for delegation to enterprise principal with wrong (%d) number of components",
1542 target_principal->name.name_string.len);
1543 talloc_free(mem_ctx);
1544 return ret;
1545 }
1546 ret = krb5_parse_name(context, target_principal->name.name_string.val[0],
1547 &enterprise_prinicpal);
1548 if (ret) {
1549 talloc_free(mem_ctx);
1550 return ret;
1551 }
1552 target_principal = enterprise_prinicpal;
1553 }
1554
1555 ret = samba_kdc_lookup_server(context, kdc_db_ctx, mem_ctx, target_principal,
1556 delegation_check_attrs, &realm_dn, &msg);
1557
1558 krb5_free_principal(context, enterprise_prinicpal);
1559
1560 if (ret != 0) {
1561 talloc_free(mem_ctx);
1562 return ret;
1563 }
1564
1565 orig_sid = samdb_result_dom_sid(mem_ctx, p->msg, "objectSid");
1566 target_sid = samdb_result_dom_sid(mem_ctx, msg, "objectSid");
1567
1568 /* Allow delegation to the same principal, even if by a different
1569 * name. The easy and safe way to prove this is by SID
1570 * comparison */
1571 if (!(orig_sid && target_sid && dom_sid_equal(orig_sid, target_sid))) {
1572 talloc_free(mem_ctx);
1573 return KRB5KDC_ERR_BADOPTION;
1574 }
1575
1576 talloc_free(mem_ctx);
1577 return ret;
1578 }
1579
1580 /* Certificates printed by a the Certificate Authority might have a
1581 * slightly different form of the user principal name to that in the
1582 * database. Allow a mismatch where they both refer to the same
1583 * SID */
1584
1585 krb5_error_code
1586 samba_kdc_check_pkinit_ms_upn_match(krb5_context context,
1587 struct samba_kdc_db_context *kdc_db_ctx,
1588 hdb_entry_ex *entry,
1589 krb5_const_principal certificate_principal)
1590 {
1591 krb5_error_code ret;
1592 struct ldb_dn *realm_dn;
1593 struct ldb_message *msg;
1594 struct dom_sid *orig_sid;
1595 struct dom_sid *target_sid;
1596 struct samba_kdc_entry *p = talloc_get_type(entry->ctx, struct samba_kdc_entry);
1597 const char *ms_upn_check_attrs[] = {
1598 "objectSid", NULL
1599 };
1600
1601 TALLOC_CTX *mem_ctx = talloc_named(kdc_db_ctx, 0, "samba_kdc_check_pkinit_ms_upn_match");
1602
1603 if (!mem_ctx) {
1604 ret = ENOMEM;
1605 krb5_set_error_message(context, ret, "samba_kdc_fetch: talloc_named() failed!");
1606 return ret;
1607 }
1608
1609 ret = samba_kdc_lookup_client(context, kdc_db_ctx,
1610 mem_ctx, certificate_principal,
1611 ms_upn_check_attrs, &realm_dn, &msg);
1612
1613 if (ret != 0) {
1614 talloc_free(mem_ctx);
1615 return ret;
1616 }
1617
1618 orig_sid = samdb_result_dom_sid(mem_ctx, p->msg, "objectSid");
1619 target_sid = samdb_result_dom_sid(mem_ctx, msg, "objectSid");
1620
1621 /* Consider these to be the same principal, even if by a different
1622 * name. The easy and safe way to prove this is by SID
1623 * comparison */
1624 if (!(orig_sid && target_sid && dom_sid_equal(orig_sid, target_sid))) {
1625 talloc_free(mem_ctx);
1626 return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
1627 }
1628
1629 talloc_free(mem_ctx);
1630 return ret;
1631 }
1632
1633 NTSTATUS samba_kdc_setup_db_ctx(TALLOC_CTX *mem_ctx, struct samba_kdc_base_context *base_ctx,
1634 struct samba_kdc_db_context **kdc_db_ctx_out)
1635 {
1636 int ldb_ret;
1637 struct ldb_message *msg;
1638 struct auth_session_info *session_info;
1639 struct samba_kdc_db_context *kdc_db_ctx;
1640 /* The idea here is very simple. Using Kerberos to
1641 * authenticate the KDC to the LDAP server is higly likely to
1642 * be circular.
1643 *
1644 * In future we may set this up to use EXERNAL and SSL
1645 * certificates, for now it will almost certainly be NTLMSSP_SET_USERNAME
1646 */
1647
1648 kdc_db_ctx = talloc_zero(mem_ctx, struct samba_kdc_db_context);
1649 if (kdc_db_ctx == NULL) {
1650 return NT_STATUS_NO_MEMORY;
1651 }
1652 kdc_db_ctx->ev_ctx = base_ctx->ev_ctx;
1653 kdc_db_ctx->lp_ctx = base_ctx->lp_ctx;
1654
1655 session_info = system_session(kdc_db_ctx->lp_ctx);
1656 if (session_info == NULL) {
1657 return NT_STATUS_INTERNAL_ERROR;
1658 }
1659
1660 /* Setup the link to LDB */
1661 kdc_db_ctx->samdb = samdb_connect(kdc_db_ctx, base_ctx->ev_ctx,
1662 base_ctx->lp_ctx, session_info, 0);
1663 if (kdc_db_ctx->samdb == NULL) {
1664 DEBUG(1, ("hdb_samba4_create: Cannot open samdb for KDC backend!"));
1665 talloc_free(kdc_db_ctx);
1666 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1667 }
1668
1669 /* Find out our own krbtgt kvno */
1670 ldb_ret = samdb_rodc(kdc_db_ctx->samdb, &kdc_db_ctx->rodc);
1671 if (ldb_ret != LDB_SUCCESS) {
1672 DEBUG(1, ("hdb_samba4_create: Cannot determine if we are an RODC in KDC backend: %s\n",
1673 ldb_errstring(kdc_db_ctx->samdb)));
1674 talloc_free(kdc_db_ctx);
1675 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1676 }
1677 if (kdc_db_ctx->rodc) {
1678 int my_krbtgt_number;
1679 const char *secondary_keytab[] = { "msDS-SecondaryKrbTgtNumber", NULL };
1680 struct ldb_dn *account_dn;
1681 struct ldb_dn *server_dn = samdb_server_dn(kdc_db_ctx->samdb, kdc_db_ctx);
1682 if (!server_dn) {
1683 DEBUG(1, ("hdb_samba4_create: Cannot determine server DN in KDC backend: %s\n",
1684 ldb_errstring(kdc_db_ctx->samdb)));
1685 talloc_free(kdc_db_ctx);
1686 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1687 }
1688
1689 ldb_ret = samdb_reference_dn(kdc_db_ctx->samdb, kdc_db_ctx, server_dn,
1690 "serverReference", &account_dn);
1691 if (ldb_ret != LDB_SUCCESS) {
1692 DEBUG(1, ("hdb_samba4_create: Cannot determine server account in KDC backend: %s\n",
1693 ldb_errstring(kdc_db_ctx->samdb)));
1694 talloc_free(kdc_db_ctx);
1695 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1696 }
1697
1698 ldb_ret = samdb_reference_dn(kdc_db_ctx->samdb, kdc_db_ctx, account_dn,
1699 "msDS-KrbTgtLink", &kdc_db_ctx->krbtgt_dn);
1700 talloc_free(account_dn);
1701 if (ldb_ret != LDB_SUCCESS) {
1702 DEBUG(1, ("hdb_samba4_create: Cannot determine RODC krbtgt account in KDC backend: %s\n",
1703 ldb_errstring(kdc_db_ctx->samdb)));
1704 talloc_free(kdc_db_ctx);
1705 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1706 }
1707
1708 ldb_ret = dsdb_search_one(kdc_db_ctx->samdb, kdc_db_ctx,
1709 &msg, kdc_db_ctx->krbtgt_dn, LDB_SCOPE_BASE,
1710 secondary_keytab,
1711 0,
1712 "(&(objectClass=user)(msDS-SecondaryKrbTgtNumber=*))");
1713 if (ldb_ret != LDB_SUCCESS) {
1714 DEBUG(1, ("hdb_samba4_create: Cannot read krbtgt account %s in KDC backend to get msDS-SecondaryKrbTgtNumber: %s: %s\n",
1715 ldb_dn_get_linearized(kdc_db_ctx->krbtgt_dn),
1716 ldb_errstring(kdc_db_ctx->samdb),
1717 ldb_strerror(ldb_ret)));
1718 talloc_free(kdc_db_ctx);
1719 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1720 }
1721 my_krbtgt_number = ldb_msg_find_attr_as_int(msg, "msDS-SecondaryKrbTgtNumber", -1);
1722 if (my_krbtgt_number == -1) {
1723 DEBUG(1, ("hdb_samba4_create: Cannot read msDS-SecondaryKrbTgtNumber from krbtgt account %s in KDC backend: got %d\n",
1724 ldb_dn_get_linearized(kdc_db_ctx->krbtgt_dn),
1725 my_krbtgt_number));
1726 talloc_free(kdc_db_ctx);
1727 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1728 }
1729 kdc_db_ctx->my_krbtgt_number = my_krbtgt_number;
1730
1731 } else {
1732 kdc_db_ctx->my_krbtgt_number = 0;
1733 ldb_ret = dsdb_search_one(kdc_db_ctx->samdb, kdc_db_ctx,
1734 &msg, NULL, LDB_SCOPE_SUBTREE,
1735 krbtgt_attrs,
1736 DSDB_SEARCH_SHOW_EXTENDED_DN,
1737 "(&(objectClass=user)(samAccountName=krbtgt))");
1738
1739 if (ldb_ret != LDB_SUCCESS) {
1740 DEBUG(1, ("samba_kdc_fetch: could not find own KRBTGT in DB: %s\n", ldb_errstring(kdc_db_ctx->samdb)));
1741 talloc_free(kdc_db_ctx);
1742 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1743 }
1744 kdc_db_ctx->krbtgt_dn = talloc_steal(kdc_db_ctx, msg->dn);
1745 kdc_db_ctx->my_krbtgt_number = 0;
1746 talloc_free(msg);
1747 }
1748 *kdc_db_ctx_out = kdc_db_ctx;
1749 return NT_STATUS_OK;
1750 }
Samba GIT mirror