2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
7 Copyright (C) Andrew Tridgell 2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "samba/process_model.h"
26 #include "lib/tsocket/tsocket.h"
27 #include "lib/messaging/irpc.h"
28 #include "librpc/gen_ndr/ndr_irpc.h"
29 #include "librpc/gen_ndr/ndr_krb5pac.h"
30 #include "lib/socket/netif.h"
31 #include "param/param.h"
32 #include "kdc/kdc-server.h"
33 #include "kdc/kdc-proxy.h"
34 #include "kdc/kdc-glue.h"
35 #include "kdc/pac-glue.h"
36 #include "kdc/kpasswd-service.h"
37 #include "dsdb/samdb/samdb.h"
38 #include "auth/session.h"
39 #include "libds/common/roles.h"
44 #define DBGC_CLASS DBGC_KERBEROS
46 NTSTATUS
server_service_kdc_init(TALLOC_CTX
*);
48 extern struct krb5plugin_kdc_ftable kdc_plugin_table
;
51 Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
55 static kdc_code
kdc_process(struct kdc_server
*kdc
,
59 struct tsocket_address
*peer_addr
,
60 struct tsocket_address
*my_addr
,
65 struct sockaddr_storage ss
;
67 krb5_kdc_configuration
*kdc_config
=
68 (krb5_kdc_configuration
*)kdc
->private_data
;
70 krb5_data_zero(&k5_reply
);
72 krb5_kdc_update_time(NULL
);
74 ret
= tsocket_address_bsd_sockaddr(peer_addr
, (struct sockaddr
*) &ss
,
75 sizeof(struct sockaddr_storage
));
79 pa
= tsocket_address_string(peer_addr
, mem_ctx
);
84 DBG_DEBUG("Received KDC packet of length %lu from %s\n",
85 (long)input
->length
- 4, pa
);
87 ret
= krb5_kdc_process_krb5_request(kdc
->smb_krb5_context
->krb5_context
,
89 input
->data
, input
->length
,
92 (struct sockaddr
*) &ss
,
95 *reply
= data_blob(NULL
, 0);
99 if (ret
== HDB_ERR_NOT_FOUND_HERE
) {
100 *reply
= data_blob(NULL
, 0);
101 return KDC_PROXY_REQUEST
;
104 if (k5_reply
.length
) {
105 *reply
= data_blob_talloc(mem_ctx
, k5_reply
.data
, k5_reply
.length
);
106 krb5_data_free(&k5_reply
);
108 *reply
= data_blob(NULL
, 0);
114 setup our listening sockets on the configured network interfaces
116 static NTSTATUS
kdc_startup_interfaces(struct kdc_server
*kdc
,
117 struct loadparm_context
*lp_ctx
,
118 struct interface
*ifaces
,
119 const struct model_ops
*model_ops
)
122 TALLOC_CTX
*tmp_ctx
= talloc_new(kdc
);
125 uint16_t kdc_port
= lpcfg_krb5_port(lp_ctx
);
126 uint16_t kpasswd_port
= lpcfg_kpasswd_port(lp_ctx
);
127 bool done_wildcard
= false;
129 num_interfaces
= iface_list_count(ifaces
);
131 /* if we are allowing incoming packets from any address, then
132 we need to bind to the wildcard address */
133 if (!lpcfg_bind_interfaces_only(lp_ctx
)) {
134 size_t num_binds
= 0;
135 char **wcard
= iface_list_wildcard(kdc
);
136 NT_STATUS_HAVE_NO_MEMORY(wcard
);
137 for (i
=0; wcard
[i
]; i
++) {
139 status
= kdc_add_socket(kdc
, model_ops
,
140 "kdc", wcard
[i
], kdc_port
,
142 if (NT_STATUS_IS_OK(status
)) {
148 status
= kdc_add_socket(kdc
, model_ops
,
149 "kpasswd", wcard
[i
], kpasswd_port
,
150 kpasswd_process
, false);
151 if (NT_STATUS_IS_OK(status
)) {
157 if (num_binds
== 0) {
158 return NT_STATUS_INVALID_PARAMETER_MIX
;
160 done_wildcard
= true;
163 for (i
=0; i
<num_interfaces
; i
++) {
164 const char *address
= talloc_strdup(tmp_ctx
, iface_list_n_ip(ifaces
, i
));
167 status
= kdc_add_socket(kdc
, model_ops
,
168 "kdc", address
, kdc_port
,
169 kdc_process
, done_wildcard
);
170 NT_STATUS_NOT_OK_RETURN(status
);
174 status
= kdc_add_socket(kdc
, model_ops
,
175 "kpasswd", address
, kpasswd_port
,
176 kpasswd_process
, done_wildcard
);
177 NT_STATUS_NOT_OK_RETURN(status
);
181 talloc_free(tmp_ctx
);
186 static NTSTATUS
kdc_check_generic_kerberos(struct irpc_message
*msg
,
187 struct kdc_check_generic_kerberos
*r
)
189 struct PAC_Validate pac_validate
;
191 struct PAC_SIGNATURE_DATA kdc_sig
;
192 struct kdc_server
*kdc
= talloc_get_type(msg
->private_data
, struct kdc_server
);
193 krb5_kdc_configuration
*kdc_config
=
194 (krb5_kdc_configuration
*)kdc
->private_data
;
195 enum ndr_err_code ndr_err
;
198 krb5_principal principal
;
201 /* There is no reply to this request */
202 r
->out
.generic_reply
= data_blob(NULL
, 0);
204 ndr_err
= ndr_pull_struct_blob(&r
->in
.generic_request
, msg
, &pac_validate
,
205 (ndr_pull_flags_fn_t
)ndr_pull_PAC_Validate
);
206 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
207 return NT_STATUS_INVALID_PARAMETER
;
210 if (pac_validate
.MessageType
!= NETLOGON_GENERIC_KRB5_PAC_VALIDATE
) {
211 /* We don't implement any other message types - such as certificate validation - yet */
212 return NT_STATUS_INVALID_PARAMETER
;
215 if (pac_validate
.ChecksumAndSignature
.length
!= (pac_validate
.ChecksumLength
+ pac_validate
.SignatureLength
)
216 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.ChecksumLength
217 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.SignatureLength
) {
218 return NT_STATUS_INVALID_PARAMETER
;
221 srv_sig
= data_blob_const(pac_validate
.ChecksumAndSignature
.data
,
222 pac_validate
.ChecksumLength
);
224 ret
= krb5_make_principal(kdc
->smb_krb5_context
->krb5_context
, &principal
,
225 lpcfg_realm(kdc
->task
->lp_ctx
),
226 "krbtgt", lpcfg_realm(kdc
->task
->lp_ctx
),
230 return NT_STATUS_NO_MEMORY
;
233 ret
= kdc_config
->db
[0]->hdb_fetch_kvno(kdc
->smb_krb5_context
->krb5_context
,
236 HDB_F_GET_KRBTGT
| HDB_F_DECRYPT
,
241 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, kdc_config
->db
[0], &ent
);
242 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
244 return NT_STATUS_LOGON_FAILURE
;
247 kdc_sig
.type
= pac_validate
.SignatureType
;
248 kdc_sig
.signature
= data_blob_const(&pac_validate
.ChecksumAndSignature
.data
[pac_validate
.ChecksumLength
],
249 pac_validate
.SignatureLength
);
251 ret
= kdc_check_pac(kdc
->smb_krb5_context
->krb5_context
, srv_sig
, &kdc_sig
, &ent
);
253 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, kdc_config
->db
[0], &ent
);
254 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
257 return NT_STATUS_LOGON_FAILURE
;
267 static NTSTATUS
kdc_task_init(struct task_server
*task
)
269 struct kdc_server
*kdc
;
271 struct interface
*ifaces
;
273 switch (lpcfg_server_role(task
->lp_ctx
)) {
274 case ROLE_STANDALONE
:
275 task_server_terminate(task
, "kdc: no KDC required in standalone configuration", false);
276 return NT_STATUS_INVALID_DOMAIN_ROLE
;
277 case ROLE_DOMAIN_MEMBER
:
278 task_server_terminate(task
, "kdc: no KDC required in member server configuration", false);
279 return NT_STATUS_INVALID_DOMAIN_ROLE
;
280 case ROLE_DOMAIN_PDC
:
281 case ROLE_DOMAIN_BDC
:
283 task_server_terminate(
284 task
, "Cannot start KDC as a 'classic Samba' DC", false);
285 return NT_STATUS_INVALID_DOMAIN_ROLE
;
286 case ROLE_ACTIVE_DIRECTORY_DC
:
287 /* Yes, we want a KDC */
291 load_interface_list(task
, task
->lp_ctx
, &ifaces
);
293 if (iface_list_count(ifaces
) == 0) {
294 task_server_terminate(task
, "kdc: no network interfaces configured", false);
295 return NT_STATUS_UNSUCCESSFUL
;
298 task_server_set_title(task
, "task[kdc]");
300 kdc
= talloc_zero(task
, struct kdc_server
);
302 task_server_terminate(task
, "kdc: out of memory", true);
303 return NT_STATUS_NO_MEMORY
;
307 task
->private_data
= kdc
;
309 /* start listening on the configured network interfaces */
310 status
= kdc_startup_interfaces(kdc
, task
->lp_ctx
, ifaces
,
312 if (!NT_STATUS_IS_OK(status
)) {
313 task_server_terminate(task
, "kdc failed to setup interfaces", true);
322 initialise the kdc task after a fork
324 static void kdc_post_fork(struct task_server
*task
, struct process_details
*pd
)
326 struct kdc_server
*kdc
;
327 krb5_kdc_configuration
*kdc_config
= NULL
;
333 task_server_terminate(task
, "kdc: Null task", true);
336 if (task
->private_data
== NULL
) {
337 task_server_terminate(task
, "kdc: No kdc_server info", true);
340 kdc
= talloc_get_type_abort(task
->private_data
, struct kdc_server
);
342 /* get a samdb connection */
343 kdc
->samdb
= samdb_connect(kdc
,
344 kdc
->task
->event_ctx
,
346 system_session(kdc
->task
->lp_ctx
),
350 DBG_WARNING("kdc_task_init: unable to connect to samdb\n");
351 task_server_terminate(task
, "kdc: krb5_init_context samdb connect failed", true);
355 ldb_ret
= samdb_rodc(kdc
->samdb
, &kdc
->am_rodc
);
356 if (ldb_ret
!= LDB_SUCCESS
) {
357 DBG_WARNING("kdc_task_init: "
358 "Cannot determine if we are an RODC: %s\n",
359 ldb_errstring(kdc
->samdb
));
360 task_server_terminate(task
, "kdc: krb5_init_context samdb RODC connect failed", true);
364 kdc
->proxy_timeout
= lpcfg_parm_int(kdc
->task
->lp_ctx
, NULL
, "kdc", "proxy timeout", 5);
366 initialize_krb5_error_table();
368 ret
= smb_krb5_init_context(kdc
, task
->lp_ctx
, &kdc
->smb_krb5_context
);
370 DBG_WARNING("kdc_task_init: krb5_init_context failed (%s)\n",
372 task_server_terminate(task
, "kdc: krb5_init_context failed", true);
376 krb5_add_et_list(kdc
->smb_krb5_context
->krb5_context
, initialize_hdb_error_table_r
);
378 ret
= krb5_kdc_get_config(kdc
->smb_krb5_context
->krb5_context
,
381 task_server_terminate(task
, "kdc: failed to get KDC configuration", true);
385 kdc_config
->logf
= (krb5_log_facility
*)kdc
->smb_krb5_context
->pvt_log_data
;
386 kdc_config
->db
= talloc(kdc
, struct HDB
*);
387 if (!kdc_config
->db
) {
388 task_server_terminate(task
, "kdc: out of memory", true);
391 kdc_config
->num_db
= 1;
394 * This restores the behavior before
395 * commit 255e3e18e00f717d99f3bc57c8a8895ff624f3c3
396 * s4:heimdal: import lorikeet-heimdal-201107150856
397 * (commit 48936803fae4a2fb362c79365d31f420c917b85b)
399 * as_use_strongest_session_key,preauth_use_strongest_session_key
400 * and tgs_use_strongest_session_key are input to the
401 * _kdc_find_etype() function. The old bahavior is in
402 * the use_strongest_session_key=FALSE code path.
403 * (The only remaining difference in _kdc_find_etype()
404 * is the is_preauth parameter.)
406 * The old behavior in the _kdc_get_preferred_key()
407 * function is use_strongest_server_key=TRUE.
409 kdc_config
->tgt_use_strongest_session_key
= false;
410 kdc_config
->preauth_use_strongest_session_key
= true;
411 kdc_config
->svc_use_strongest_session_key
= false;
412 kdc_config
->use_strongest_server_key
= true;
414 kdc_config
->force_include_pa_etype_salt
= true;
417 * For Samba CVE-2020-25719 Require PAC to be present
418 * This instructs Heimdal to match AD behaviour,
419 * as seen after Microsoft's CVE-2021-42287 when
420 * PacRequestorEnforcement is set to 2.
422 * Samba BUG: https://bugzilla.samba.org/show_bug.cgi?id=14686
423 * REF: https://support.microsoft.com/en-au/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041
426 kdc_config
->require_pac
= true;
429 * By default we enable RFC6113/FAST support,
430 * but we have an option to disable in order to
431 * test against a KDC with FAST support.
433 kdc_config
->enable_fast
= lpcfg_kdc_enable_fast(task
->lp_ctx
);
436 * Match Windows and RFC6113 and Windows but break older
439 kdc_config
->enable_armored_pa_enc_timestamp
= false;
441 /* Register hdb-samba4 hooks for use as a keytab */
443 kdc
->base_ctx
= talloc_zero(kdc
, struct samba_kdc_base_context
);
444 if (!kdc
->base_ctx
) {
445 task_server_terminate(task
, "kdc: out of memory", true);
449 kdc
->base_ctx
->ev_ctx
= task
->event_ctx
;
450 kdc
->base_ctx
->lp_ctx
= task
->lp_ctx
;
451 kdc
->base_ctx
->msg_ctx
= task
->msg_ctx
;
453 status
= hdb_samba4_create_kdc(kdc
->base_ctx
,
454 kdc
->smb_krb5_context
->krb5_context
,
456 if (!NT_STATUS_IS_OK(status
)) {
457 task_server_terminate(task
, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
461 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
462 PLUGIN_TYPE_DATA
, "hdb_samba4_interface",
463 &hdb_samba4_interface
);
465 task_server_terminate(task
, "kdc: failed to register hdb plugin", true);
469 kdc
->kpasswd_keytab_name
= talloc_asprintf(kdc
, "HDBGET:samba4:&%p", kdc
->base_ctx
);
470 if (kdc
->kpasswd_keytab_name
== NULL
) {
471 task_server_terminate(task
,
472 "kdc: Failed to set keytab name",
477 ret
= krb5_kt_register(kdc
->smb_krb5_context
->krb5_context
, &hdb_get_kt_ops
);
479 task_server_terminate(task
, "kdc: failed to register keytab plugin", true);
483 /* Register KDC hooks */
484 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
485 PLUGIN_TYPE_DATA
, "kdc",
488 task_server_terminate(task
, "kdc: failed to register kdc plugin", true);
492 ret
= krb5_kdc_plugin_init(kdc
->smb_krb5_context
->krb5_context
);
495 task_server_terminate(task
, "kdc: failed to init kdc plugin", true);
499 ret
= krb5_kdc_pkinit_config(kdc
->smb_krb5_context
->krb5_context
, kdc_config
);
502 task_server_terminate(task
, "kdc: failed to init kdc pkinit subsystem", true);
505 kdc
->private_data
= kdc_config
;
507 status
= IRPC_REGISTER(task
->msg_ctx
, irpc
, KDC_CHECK_GENERIC_KERBEROS
,
508 kdc_check_generic_kerberos
, kdc
);
509 if (!NT_STATUS_IS_OK(status
)) {
510 task_server_terminate(task
, "kdc failed to setup monitoring", true);
514 irpc_add_name(task
->msg_ctx
, "kdc_server");
518 /* called at smbd startup - register ourselves as a server service */
519 NTSTATUS
server_service_kdc_init(TALLOC_CTX
*ctx
)
521 static const struct service_details details
= {
522 .inhibit_fork_on_accept
= true,
523 .inhibit_pre_fork
= false,
524 .task_init
= kdc_task_init
,
525 .post_fork
= kdc_post_fork
527 return register_server_service(ctx
, "kdc", &details
);