2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
7 Copyright (C) Andrew Tridgell 2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "samba/process_model.h"
26 #include "lib/tsocket/tsocket.h"
27 #include "lib/messaging/irpc.h"
28 #include "librpc/gen_ndr/ndr_irpc.h"
29 #include "librpc/gen_ndr/ndr_krb5pac.h"
30 #include "lib/socket/netif.h"
31 #include "param/param.h"
32 #include "kdc/kdc-server.h"
33 #include "kdc/kdc-proxy.h"
34 #include "kdc/kdc-glue.h"
35 #include "kdc/pac-glue.h"
36 #include "kdc/kpasswd-service.h"
37 #include "dsdb/samdb/samdb.h"
38 #include "auth/session.h"
39 #include "libds/common/roles.h"
43 NTSTATUS
server_service_kdc_init(TALLOC_CTX
*);
45 extern struct krb5plugin_windc_ftable windc_plugin_table
;
48 Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
52 static kdc_code
kdc_process(struct kdc_server
*kdc
,
56 struct tsocket_address
*peer_addr
,
57 struct tsocket_address
*my_addr
,
62 struct sockaddr_storage ss
;
64 krb5_kdc_configuration
*kdc_config
=
65 (krb5_kdc_configuration
*)kdc
->private_data
;
67 krb5_data_zero(&k5_reply
);
69 krb5_kdc_update_time(NULL
);
71 ret
= tsocket_address_bsd_sockaddr(peer_addr
, (struct sockaddr
*) &ss
,
72 sizeof(struct sockaddr_storage
));
76 pa
= tsocket_address_string(peer_addr
, mem_ctx
);
81 DBG_DEBUG("Received KDC packet of length %lu from %s\n",
82 (long)input
->length
- 4, pa
);
84 ret
= krb5_kdc_process_krb5_request(kdc
->smb_krb5_context
->krb5_context
,
86 input
->data
, input
->length
,
89 (struct sockaddr
*) &ss
,
92 *reply
= data_blob(NULL
, 0);
96 if (ret
== HDB_ERR_NOT_FOUND_HERE
) {
97 *reply
= data_blob(NULL
, 0);
98 return KDC_PROXY_REQUEST
;
101 if (k5_reply
.length
) {
102 *reply
= data_blob_talloc(mem_ctx
, k5_reply
.data
, k5_reply
.length
);
103 krb5_data_free(&k5_reply
);
105 *reply
= data_blob(NULL
, 0);
111 setup our listening sockets on the configured network interfaces
113 static NTSTATUS
kdc_startup_interfaces(struct kdc_server
*kdc
,
114 struct loadparm_context
*lp_ctx
,
115 struct interface
*ifaces
,
116 const struct model_ops
*model_ops
)
119 TALLOC_CTX
*tmp_ctx
= talloc_new(kdc
);
122 uint16_t kdc_port
= lpcfg_krb5_port(lp_ctx
);
123 uint16_t kpasswd_port
= lpcfg_kpasswd_port(lp_ctx
);
124 bool done_wildcard
= false;
126 num_interfaces
= iface_list_count(ifaces
);
128 /* if we are allowing incoming packets from any address, then
129 we need to bind to the wildcard address */
130 if (!lpcfg_bind_interfaces_only(lp_ctx
)) {
131 size_t num_binds
= 0;
132 char **wcard
= iface_list_wildcard(kdc
);
133 NT_STATUS_HAVE_NO_MEMORY(wcard
);
134 for (i
=0; wcard
[i
]; i
++) {
136 status
= kdc_add_socket(kdc
, model_ops
,
137 "kdc", wcard
[i
], kdc_port
,
139 if (NT_STATUS_IS_OK(status
)) {
145 status
= kdc_add_socket(kdc
, model_ops
,
146 "kpasswd", wcard
[i
], kpasswd_port
,
147 kpasswd_process
, false);
148 if (NT_STATUS_IS_OK(status
)) {
154 if (num_binds
== 0) {
155 return NT_STATUS_INVALID_PARAMETER_MIX
;
157 done_wildcard
= true;
160 for (i
=0; i
<num_interfaces
; i
++) {
161 const char *address
= talloc_strdup(tmp_ctx
, iface_list_n_ip(ifaces
, i
));
164 status
= kdc_add_socket(kdc
, model_ops
,
165 "kdc", address
, kdc_port
,
166 kdc_process
, done_wildcard
);
167 NT_STATUS_NOT_OK_RETURN(status
);
171 status
= kdc_add_socket(kdc
, model_ops
,
172 "kpasswd", address
, kpasswd_port
,
173 kpasswd_process
, done_wildcard
);
174 NT_STATUS_NOT_OK_RETURN(status
);
178 talloc_free(tmp_ctx
);
183 static NTSTATUS
kdc_check_generic_kerberos(struct irpc_message
*msg
,
184 struct kdc_check_generic_kerberos
*r
)
186 struct PAC_Validate pac_validate
;
188 struct PAC_SIGNATURE_DATA kdc_sig
;
189 struct kdc_server
*kdc
= talloc_get_type(msg
->private_data
, struct kdc_server
);
190 krb5_kdc_configuration
*kdc_config
=
191 (krb5_kdc_configuration
*)kdc
->private_data
;
192 enum ndr_err_code ndr_err
;
195 krb5_principal principal
;
198 /* There is no reply to this request */
199 r
->out
.generic_reply
= data_blob(NULL
, 0);
201 ndr_err
= ndr_pull_struct_blob(&r
->in
.generic_request
, msg
, &pac_validate
,
202 (ndr_pull_flags_fn_t
)ndr_pull_PAC_Validate
);
203 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
204 return NT_STATUS_INVALID_PARAMETER
;
207 if (pac_validate
.MessageType
!= NETLOGON_GENERIC_KRB5_PAC_VALIDATE
) {
208 /* We don't implement any other message types - such as certificate validation - yet */
209 return NT_STATUS_INVALID_PARAMETER
;
212 if (pac_validate
.ChecksumAndSignature
.length
!= (pac_validate
.ChecksumLength
+ pac_validate
.SignatureLength
)
213 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.ChecksumLength
214 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.SignatureLength
) {
215 return NT_STATUS_INVALID_PARAMETER
;
218 srv_sig
= data_blob_const(pac_validate
.ChecksumAndSignature
.data
,
219 pac_validate
.ChecksumLength
);
221 ret
= krb5_make_principal(kdc
->smb_krb5_context
->krb5_context
, &principal
,
222 lpcfg_realm(kdc
->task
->lp_ctx
),
223 "krbtgt", lpcfg_realm(kdc
->task
->lp_ctx
),
227 return NT_STATUS_NO_MEMORY
;
230 ret
= kdc_config
->db
[0]->hdb_fetch_kvno(kdc
->smb_krb5_context
->krb5_context
,
233 HDB_F_GET_KRBTGT
| HDB_F_DECRYPT
,
238 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, &ent
);
239 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
241 return NT_STATUS_LOGON_FAILURE
;
244 kdc_sig
.type
= pac_validate
.SignatureType
;
245 kdc_sig
.signature
= data_blob_const(&pac_validate
.ChecksumAndSignature
.data
[pac_validate
.ChecksumLength
],
246 pac_validate
.SignatureLength
);
248 ret
= kdc_check_pac(kdc
->smb_krb5_context
->krb5_context
, srv_sig
, &kdc_sig
, &ent
);
250 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, &ent
);
251 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
254 return NT_STATUS_LOGON_FAILURE
;
264 static NTSTATUS
kdc_task_init(struct task_server
*task
)
266 struct kdc_server
*kdc
;
268 struct interface
*ifaces
;
270 switch (lpcfg_server_role(task
->lp_ctx
)) {
271 case ROLE_STANDALONE
:
272 task_server_terminate(task
, "kdc: no KDC required in standalone configuration", false);
273 return NT_STATUS_INVALID_DOMAIN_ROLE
;
274 case ROLE_DOMAIN_MEMBER
:
275 task_server_terminate(task
, "kdc: no KDC required in member server configuration", false);
276 return NT_STATUS_INVALID_DOMAIN_ROLE
;
277 case ROLE_DOMAIN_PDC
:
278 case ROLE_DOMAIN_BDC
:
280 task_server_terminate(
281 task
, "Cannot start KDC as a 'classic Samba' DC", false);
282 return NT_STATUS_INVALID_DOMAIN_ROLE
;
283 case ROLE_ACTIVE_DIRECTORY_DC
:
284 /* Yes, we want a KDC */
288 load_interface_list(task
, task
->lp_ctx
, &ifaces
);
290 if (iface_list_count(ifaces
) == 0) {
291 task_server_terminate(task
, "kdc: no network interfaces configured", false);
292 return NT_STATUS_UNSUCCESSFUL
;
295 task_server_set_title(task
, "task[kdc]");
297 kdc
= talloc_zero(task
, struct kdc_server
);
299 task_server_terminate(task
, "kdc: out of memory", true);
300 return NT_STATUS_NO_MEMORY
;
304 task
->private_data
= kdc
;
306 /* start listening on the configured network interfaces */
307 status
= kdc_startup_interfaces(kdc
, task
->lp_ctx
, ifaces
,
309 if (!NT_STATUS_IS_OK(status
)) {
310 task_server_terminate(task
, "kdc failed to setup interfaces", true);
319 initialise the kdc task after a fork
321 static void kdc_post_fork(struct task_server
*task
, struct process_details
*pd
)
323 struct kdc_server
*kdc
;
324 krb5_kdc_configuration
*kdc_config
= NULL
;
330 task_server_terminate(task
, "kdc: Null task", true);
333 if (task
->private_data
== NULL
) {
334 task_server_terminate(task
, "kdc: No kdc_server info", true);
337 kdc
= talloc_get_type_abort(task
->private_data
, struct kdc_server
);
339 /* get a samdb connection */
340 kdc
->samdb
= samdb_connect(kdc
,
341 kdc
->task
->event_ctx
,
343 system_session(kdc
->task
->lp_ctx
),
347 DBG_WARNING("kdc_task_init: unable to connect to samdb\n");
348 task_server_terminate(task
, "kdc: krb5_init_context samdb connect failed", true);
352 ldb_ret
= samdb_rodc(kdc
->samdb
, &kdc
->am_rodc
);
353 if (ldb_ret
!= LDB_SUCCESS
) {
354 DBG_WARNING("kdc_task_init: "
355 "Cannot determine if we are an RODC: %s\n",
356 ldb_errstring(kdc
->samdb
));
357 task_server_terminate(task
, "kdc: krb5_init_context samdb RODC connect failed", true);
361 kdc
->proxy_timeout
= lpcfg_parm_int(kdc
->task
->lp_ctx
, NULL
, "kdc", "proxy timeout", 5);
363 initialize_krb5_error_table();
365 ret
= smb_krb5_init_context(kdc
, task
->lp_ctx
, &kdc
->smb_krb5_context
);
367 DBG_WARNING("kdc_task_init: krb5_init_context failed (%s)\n",
369 task_server_terminate(task
, "kdc: krb5_init_context failed", true);
373 krb5_add_et_list(kdc
->smb_krb5_context
->krb5_context
, initialize_hdb_error_table_r
);
375 ret
= krb5_kdc_get_config(kdc
->smb_krb5_context
->krb5_context
,
378 task_server_terminate(task
, "kdc: failed to get KDC configuration", true);
382 kdc_config
->logf
= (krb5_log_facility
*)kdc
->smb_krb5_context
->pvt_log_data
;
383 kdc_config
->db
= talloc(kdc
, struct HDB
*);
384 if (!kdc_config
->db
) {
385 task_server_terminate(task
, "kdc: out of memory", true);
388 kdc_config
->num_db
= 1;
391 * This restores the behavior before
392 * commit 255e3e18e00f717d99f3bc57c8a8895ff624f3c3
393 * s4:heimdal: import lorikeet-heimdal-201107150856
394 * (commit 48936803fae4a2fb362c79365d31f420c917b85b)
396 * as_use_strongest_session_key,preauth_use_strongest_session_key
397 * and tgs_use_strongest_session_key are input to the
398 * _kdc_find_etype() function. The old bahavior is in
399 * the use_strongest_session_key=FALSE code path.
400 * (The only remaining difference in _kdc_find_etype()
401 * is the is_preauth parameter.)
403 * The old behavior in the _kdc_get_preferred_key()
404 * function is use_strongest_server_key=TRUE.
406 kdc_config
->as_use_strongest_session_key
= false;
407 kdc_config
->preauth_use_strongest_session_key
= false;
408 kdc_config
->tgs_use_strongest_session_key
= false;
409 kdc_config
->use_strongest_server_key
= true;
411 kdc_config
->autodetect_referrals
= false;
413 /* Register hdb-samba4 hooks for use as a keytab */
415 kdc
->base_ctx
= talloc_zero(kdc
, struct samba_kdc_base_context
);
416 if (!kdc
->base_ctx
) {
417 task_server_terminate(task
, "kdc: out of memory", true);
421 kdc
->base_ctx
->ev_ctx
= task
->event_ctx
;
422 kdc
->base_ctx
->lp_ctx
= task
->lp_ctx
;
423 kdc
->base_ctx
->msg_ctx
= task
->msg_ctx
;
425 status
= hdb_samba4_create_kdc(kdc
->base_ctx
,
426 kdc
->smb_krb5_context
->krb5_context
,
428 if (!NT_STATUS_IS_OK(status
)) {
429 task_server_terminate(task
, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
433 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
434 PLUGIN_TYPE_DATA
, "hdb",
435 &hdb_samba4_interface
);
437 task_server_terminate(task
, "kdc: failed to register hdb plugin", true);
441 ret
= krb5_kt_register(kdc
->smb_krb5_context
->krb5_context
, &hdb_kt_ops
);
443 task_server_terminate(task
, "kdc: failed to register keytab plugin", true);
447 kdc
->keytab_name
= talloc_asprintf(kdc
, "HDB:samba4&%p", kdc
->base_ctx
);
448 if (kdc
->keytab_name
== NULL
) {
449 task_server_terminate(task
,
450 "kdc: Failed to set keytab name",
455 /* Register WinDC hooks */
456 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
457 PLUGIN_TYPE_DATA
, "windc",
458 &windc_plugin_table
);
460 task_server_terminate(task
, "kdc: failed to register windc plugin", true);
464 ret
= krb5_kdc_windc_init(kdc
->smb_krb5_context
->krb5_context
);
467 task_server_terminate(task
, "kdc: failed to init windc plugin", true);
471 ret
= krb5_kdc_pkinit_config(kdc
->smb_krb5_context
->krb5_context
, kdc_config
);
474 task_server_terminate(task
, "kdc: failed to init kdc pkinit subsystem", true);
477 kdc
->private_data
= kdc_config
;
479 status
= IRPC_REGISTER(task
->msg_ctx
, irpc
, KDC_CHECK_GENERIC_KERBEROS
,
480 kdc_check_generic_kerberos
, kdc
);
481 if (!NT_STATUS_IS_OK(status
)) {
482 task_server_terminate(task
, "kdc failed to setup monitoring", true);
486 irpc_add_name(task
->msg_ctx
, "kdc_server");
490 /* called at smbd startup - register ourselves as a server service */
491 NTSTATUS
server_service_kdc_init(TALLOC_CTX
*ctx
)
493 static const struct service_details details
= {
494 .inhibit_fork_on_accept
= true,
495 .inhibit_pre_fork
= false,
496 .task_init
= kdc_task_init
,
497 .post_fork
= kdc_post_fork
499 return register_server_service(ctx
, "kdc", &details
);