2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
7 Copyright (C) Andrew Tridgell 2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "smbd/process_model.h"
26 #include "lib/tsocket/tsocket.h"
27 #include "lib/messaging/irpc.h"
28 #include "librpc/gen_ndr/ndr_irpc.h"
29 #include "librpc/gen_ndr/ndr_krb5pac.h"
30 #include "lib/socket/netif.h"
31 #include "param/param.h"
32 #include "kdc/kdc-server.h"
33 #include "kdc/kdc-proxy.h"
34 #include "kdc/kdc-glue.h"
35 #include "kdc/pac-glue.h"
36 #include "kdc/kpasswd-service.h"
37 #include "dsdb/samdb/samdb.h"
38 #include "auth/session.h"
39 #include "libds/common/roles.h"
43 NTSTATUS
server_service_kdc_init(TALLOC_CTX
*);
45 extern struct krb5plugin_windc_ftable windc_plugin_table
;
48 Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
52 static kdc_code
kdc_process(struct kdc_server
*kdc
,
56 struct tsocket_address
*peer_addr
,
57 struct tsocket_address
*my_addr
,
62 struct sockaddr_storage ss
;
64 krb5_kdc_configuration
*kdc_config
=
65 (krb5_kdc_configuration
*)kdc
->private_data
;
67 krb5_data_zero(&k5_reply
);
69 krb5_kdc_update_time(NULL
);
71 ret
= tsocket_address_bsd_sockaddr(peer_addr
, (struct sockaddr
*) &ss
,
72 sizeof(struct sockaddr_storage
));
76 pa
= tsocket_address_string(peer_addr
, mem_ctx
);
81 DEBUG(10,("Received KDC packet of length %lu from %s\n",
82 (long)input
->length
- 4, pa
));
84 ret
= krb5_kdc_process_krb5_request(kdc
->smb_krb5_context
->krb5_context
,
86 input
->data
, input
->length
,
89 (struct sockaddr
*) &ss
,
92 *reply
= data_blob(NULL
, 0);
96 if (ret
== HDB_ERR_NOT_FOUND_HERE
) {
97 *reply
= data_blob(NULL
, 0);
98 return KDC_PROXY_REQUEST
;
101 if (k5_reply
.length
) {
102 *reply
= data_blob_talloc(mem_ctx
, k5_reply
.data
, k5_reply
.length
);
103 krb5_data_free(&k5_reply
);
105 *reply
= data_blob(NULL
, 0);
111 setup our listening sockets on the configured network interfaces
113 static NTSTATUS
kdc_startup_interfaces(struct kdc_server
*kdc
,
114 struct loadparm_context
*lp_ctx
,
115 struct interface
*ifaces
,
116 const struct model_ops
*model_ops
)
119 TALLOC_CTX
*tmp_ctx
= talloc_new(kdc
);
122 uint16_t kdc_port
= lpcfg_krb5_port(lp_ctx
);
123 uint16_t kpasswd_port
= lpcfg_kpasswd_port(lp_ctx
);
124 bool done_wildcard
= false;
126 num_interfaces
= iface_list_count(ifaces
);
128 /* if we are allowing incoming packets from any address, then
129 we need to bind to the wildcard address */
130 if (!lpcfg_bind_interfaces_only(lp_ctx
)) {
132 char **wcard
= iface_list_wildcard(kdc
);
133 NT_STATUS_HAVE_NO_MEMORY(wcard
);
134 for (i
=0; wcard
[i
]; i
++) {
136 status
= kdc_add_socket(kdc
, model_ops
,
137 "kdc", wcard
[i
], kdc_port
,
139 if (NT_STATUS_IS_OK(status
)) {
145 status
= kdc_add_socket(kdc
, model_ops
,
146 "kpasswd", wcard
[i
], kpasswd_port
,
147 kpasswd_process
, false);
148 if (NT_STATUS_IS_OK(status
)) {
154 if (num_binds
== 0) {
155 return NT_STATUS_INVALID_PARAMETER_MIX
;
157 done_wildcard
= true;
160 for (i
=0; i
<num_interfaces
; i
++) {
161 const char *address
= talloc_strdup(tmp_ctx
, iface_list_n_ip(ifaces
, i
));
164 status
= kdc_add_socket(kdc
, model_ops
,
165 "kdc", address
, kdc_port
,
166 kdc_process
, done_wildcard
);
167 NT_STATUS_NOT_OK_RETURN(status
);
171 status
= kdc_add_socket(kdc
, model_ops
,
172 "kpasswd", address
, kpasswd_port
,
173 kpasswd_process
, done_wildcard
);
174 NT_STATUS_NOT_OK_RETURN(status
);
178 talloc_free(tmp_ctx
);
183 static NTSTATUS
kdc_check_generic_kerberos(struct irpc_message
*msg
,
184 struct kdc_check_generic_kerberos
*r
)
186 struct PAC_Validate pac_validate
;
188 struct PAC_SIGNATURE_DATA kdc_sig
;
189 struct kdc_server
*kdc
= talloc_get_type(msg
->private_data
, struct kdc_server
);
190 krb5_kdc_configuration
*kdc_config
=
191 (krb5_kdc_configuration
*)kdc
->private_data
;
192 enum ndr_err_code ndr_err
;
195 krb5_principal principal
;
198 /* There is no reply to this request */
199 r
->out
.generic_reply
= data_blob(NULL
, 0);
201 ndr_err
= ndr_pull_struct_blob(&r
->in
.generic_request
, msg
, &pac_validate
,
202 (ndr_pull_flags_fn_t
)ndr_pull_PAC_Validate
);
203 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
204 return NT_STATUS_INVALID_PARAMETER
;
207 if (pac_validate
.MessageType
!= NETLOGON_GENERIC_KRB5_PAC_VALIDATE
) {
208 /* We don't implement any other message types - such as certificate validation - yet */
209 return NT_STATUS_INVALID_PARAMETER
;
212 if (pac_validate
.ChecksumAndSignature
.length
!= (pac_validate
.ChecksumLength
+ pac_validate
.SignatureLength
)
213 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.ChecksumLength
214 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.SignatureLength
) {
215 return NT_STATUS_INVALID_PARAMETER
;
218 srv_sig
= data_blob_const(pac_validate
.ChecksumAndSignature
.data
,
219 pac_validate
.ChecksumLength
);
221 ret
= krb5_make_principal(kdc
->smb_krb5_context
->krb5_context
, &principal
,
222 lpcfg_realm(kdc
->task
->lp_ctx
),
223 "krbtgt", lpcfg_realm(kdc
->task
->lp_ctx
),
227 return NT_STATUS_NO_MEMORY
;
230 ret
= kdc_config
->db
[0]->hdb_fetch_kvno(kdc
->smb_krb5_context
->krb5_context
,
233 HDB_F_GET_KRBTGT
| HDB_F_DECRYPT
,
238 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, &ent
);
239 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
241 return NT_STATUS_LOGON_FAILURE
;
244 kdc_sig
.type
= pac_validate
.SignatureType
;
245 kdc_sig
.signature
= data_blob_const(&pac_validate
.ChecksumAndSignature
.data
[pac_validate
.ChecksumLength
],
246 pac_validate
.SignatureLength
);
248 ret
= kdc_check_pac(kdc
->smb_krb5_context
->krb5_context
, srv_sig
, &kdc_sig
, &ent
);
250 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, &ent
);
251 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
254 return NT_STATUS_LOGON_FAILURE
;
264 static void kdc_task_init(struct task_server
*task
)
266 struct kdc_server
*kdc
;
267 krb5_kdc_configuration
*kdc_config
= NULL
;
270 struct interface
*ifaces
;
273 switch (lpcfg_server_role(task
->lp_ctx
)) {
274 case ROLE_STANDALONE
:
275 task_server_terminate(task
, "kdc: no KDC required in standalone configuration", false);
277 case ROLE_DOMAIN_MEMBER
:
278 task_server_terminate(task
, "kdc: no KDC required in member server configuration", false);
280 case ROLE_DOMAIN_PDC
:
281 case ROLE_DOMAIN_BDC
:
282 task_server_terminate(task
, "Cannot start KDC as a 'classic Samba' DC", true);
284 case ROLE_ACTIVE_DIRECTORY_DC
:
285 /* Yes, we want a KDC */
289 load_interface_list(task
, task
->lp_ctx
, &ifaces
);
291 if (iface_list_count(ifaces
) == 0) {
292 task_server_terminate(task
, "kdc: no network interfaces configured", false);
296 task_server_set_title(task
, "task[kdc]");
298 kdc
= talloc_zero(task
, struct kdc_server
);
300 task_server_terminate(task
, "kdc: out of memory", true);
307 /* get a samdb connection */
308 kdc
->samdb
= samdb_connect(kdc
, kdc
->task
->event_ctx
, kdc
->task
->lp_ctx
,
309 system_session(kdc
->task
->lp_ctx
), 0);
311 DEBUG(1,("kdc_task_init: unable to connect to samdb\n"));
312 task_server_terminate(task
, "kdc: krb5_init_context samdb connect failed", true);
316 ldb_ret
= samdb_rodc(kdc
->samdb
, &kdc
->am_rodc
);
317 if (ldb_ret
!= LDB_SUCCESS
) {
318 DEBUG(1, ("kdc_task_init: Cannot determine if we are an RODC: %s\n",
319 ldb_errstring(kdc
->samdb
)));
320 task_server_terminate(task
, "kdc: krb5_init_context samdb RODC connect failed", true);
324 kdc
->proxy_timeout
= lpcfg_parm_int(kdc
->task
->lp_ctx
, NULL
, "kdc", "proxy timeout", 5);
326 initialize_krb5_error_table();
328 ret
= smb_krb5_init_context(kdc
, task
->lp_ctx
, &kdc
->smb_krb5_context
);
330 DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n",
331 error_message(ret
)));
332 task_server_terminate(task
, "kdc: krb5_init_context failed", true);
336 krb5_add_et_list(kdc
->smb_krb5_context
->krb5_context
, initialize_hdb_error_table_r
);
338 ret
= krb5_kdc_get_config(kdc
->smb_krb5_context
->krb5_context
,
341 task_server_terminate(task
, "kdc: failed to get KDC configuration", true);
345 kdc_config
->logf
= (krb5_log_facility
*)kdc
->smb_krb5_context
->pvt_log_data
;
346 kdc_config
->db
= talloc(kdc
, struct HDB
*);
347 if (!kdc_config
->db
) {
348 task_server_terminate(task
, "kdc: out of memory", true);
351 kdc_config
->num_db
= 1;
354 * This restores the behavior before
355 * commit 255e3e18e00f717d99f3bc57c8a8895ff624f3c3
356 * s4:heimdal: import lorikeet-heimdal-201107150856
357 * (commit 48936803fae4a2fb362c79365d31f420c917b85b)
359 * as_use_strongest_session_key,preauth_use_strongest_session_key
360 * and tgs_use_strongest_session_key are input to the
361 * _kdc_find_etype() function. The old bahavior is in
362 * the use_strongest_session_key=FALSE code path.
363 * (The only remaining difference in _kdc_find_etype()
364 * is the is_preauth parameter.)
366 * The old behavior in the _kdc_get_preferred_key()
367 * function is use_strongest_server_key=TRUE.
369 kdc_config
->as_use_strongest_session_key
= false;
370 kdc_config
->preauth_use_strongest_session_key
= false;
371 kdc_config
->tgs_use_strongest_session_key
= false;
372 kdc_config
->use_strongest_server_key
= true;
374 kdc_config
->autodetect_referrals
= false;
376 /* Register hdb-samba4 hooks for use as a keytab */
378 kdc
->base_ctx
= talloc_zero(kdc
, struct samba_kdc_base_context
);
379 if (!kdc
->base_ctx
) {
380 task_server_terminate(task
, "kdc: out of memory", true);
384 kdc
->base_ctx
->ev_ctx
= task
->event_ctx
;
385 kdc
->base_ctx
->lp_ctx
= task
->lp_ctx
;
386 kdc
->base_ctx
->msg_ctx
= task
->msg_ctx
;
388 status
= hdb_samba4_create_kdc(kdc
->base_ctx
,
389 kdc
->smb_krb5_context
->krb5_context
,
391 if (!NT_STATUS_IS_OK(status
)) {
392 task_server_terminate(task
, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
396 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
397 PLUGIN_TYPE_DATA
, "hdb",
398 &hdb_samba4_interface
);
400 task_server_terminate(task
, "kdc: failed to register hdb plugin", true);
404 ret
= krb5_kt_register(kdc
->smb_krb5_context
->krb5_context
, &hdb_kt_ops
);
406 task_server_terminate(task
, "kdc: failed to register keytab plugin", true);
410 kdc
->keytab_name
= talloc_asprintf(kdc
, "HDB:samba4&%p", kdc
->base_ctx
);
411 if (kdc
->keytab_name
== NULL
) {
412 task_server_terminate(task
,
413 "kdc: Failed to set keytab name",
418 /* Register WinDC hooks */
419 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
420 PLUGIN_TYPE_DATA
, "windc",
421 &windc_plugin_table
);
423 task_server_terminate(task
, "kdc: failed to register windc plugin", true);
427 ret
= krb5_kdc_windc_init(kdc
->smb_krb5_context
->krb5_context
);
430 task_server_terminate(task
, "kdc: failed to init windc plugin", true);
434 ret
= krb5_kdc_pkinit_config(kdc
->smb_krb5_context
->krb5_context
, kdc_config
);
437 task_server_terminate(task
, "kdc: failed to init kdc pkinit subsystem", true);
440 kdc
->private_data
= kdc_config
;
442 /* start listening on the configured network interfaces */
443 status
= kdc_startup_interfaces(kdc
, task
->lp_ctx
, ifaces
,
445 if (!NT_STATUS_IS_OK(status
)) {
446 task_server_terminate(task
, "kdc failed to setup interfaces", true);
450 status
= IRPC_REGISTER(task
->msg_ctx
, irpc
, KDC_CHECK_GENERIC_KERBEROS
,
451 kdc_check_generic_kerberos
, kdc
);
452 if (!NT_STATUS_IS_OK(status
)) {
453 task_server_terminate(task
, "kdc failed to setup monitoring", true);
457 irpc_add_name(task
->msg_ctx
, "kdc_server");
461 /* called at smbd startup - register ourselves as a server service */
462 NTSTATUS
server_service_kdc_init(TALLOC_CTX
*ctx
)
464 struct service_details details
= {
465 .inhibit_fork_on_accept
= true,
467 * Need to prevent pre-forking on kdc.
468 * The task_init function is run on the master process only
469 * and the irpc process name is registered in it's event loop.
470 * The child worker processes initialise their event loops on
471 * fork, so are not listening for the irpc event.
473 * The master process does not wait on that event context
474 * the master process is responsible for managing the worker
475 * processes not performing work.
477 .inhibit_pre_fork
= true
479 return register_server_service(ctx
, "kdc", kdc_task_init
, &details
);