source3/libnet/libnet_samsync_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    dump the remote SAM using rpc samsync operations
   4
   5    Copyright (C) Guenther Deschner 2008.
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smb_krb5.h"
  23 #include "ads.h"
  24 #include "libnet/libnet_keytab.h"
  25 #include "libnet/libnet_samsync.h"
  26 #include "krb5_env.h"
  27
  28 #if defined(HAVE_ADS)
  29
  30 /****************************************************************
  31 ****************************************************************/
  32
  33 static NTSTATUS keytab_ad_connect(TALLOC_CTX *mem_ctx,
  34                                   const char *domain_name,
  35                                   const char *dc,
  36                                   const char *username,
  37                                   const char *password,
  38                                   struct libnet_keytab_context *ctx)
  39 {
  40         ADS_STATUS ad_status;
  41         ADS_STRUCT *ads;
  42
  43         ads = ads_init(NULL, domain_name, dc);
  44         NT_STATUS_HAVE_NO_MEMORY(ads);
  45
  46         if (getenv(KRB5_ENV_CCNAME) == NULL) {
  47                 setenv(KRB5_ENV_CCNAME, "MEMORY:libnet_samsync_keytab", 1);
  48         }
  49
  50         ads->auth.user_name = SMB_STRDUP(username);
  51         ads->auth.password = SMB_STRDUP(password);
  52
  53         ad_status = ads_connect_user_creds(ads);
  54         if (!ADS_ERR_OK(ad_status)) {
  55                 return NT_STATUS_UNSUCCESSFUL;
  56         }
  57
  58         ctx->ads = ads;
  59
  60         ctx->dns_domain_name = talloc_strdup_upper(mem_ctx, ads->config.realm);
  61         NT_STATUS_HAVE_NO_MEMORY(ctx->dns_domain_name);
  62
  63         return NT_STATUS_OK;
  64 }
  65
  66 /****************************************************************
  67 ****************************************************************/
  68
  69 static NTSTATUS fetch_sam_entry_keytab(TALLOC_CTX *mem_ctx,
  70                                        enum netr_SamDatabaseID database_id,
  71                                        uint32_t rid,
  72                                        struct netr_DELTA_USER *r,
  73                                        struct libnet_keytab_context *ctx)
  74 {
  75         NTSTATUS status;
  76         uint32_t kvno = 0;
  77         DATA_BLOB blob;
  78
  79         if (all_zero(r->ntpassword.hash, 16)) {
  80                 return NT_STATUS_OK;
  81         }
  82
  83         kvno = ads_get_kvno(ctx->ads, r->account_name.string);
  84         blob = data_blob_const(r->ntpassword.hash, 16);
  85
  86         status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx,
  87                                                      kvno,
  88                                                      r->account_name.string,
  89                                                      NULL,
  90                                                      ENCTYPE_ARCFOUR_HMAC,
  91                                                      blob);
  92         if (!NT_STATUS_IS_OK(status)) {
  93                 return status;
  94         }
  95
  96         return NT_STATUS_OK;
  97 }
  98
  99 /****************************************************************
 100 ****************************************************************/
 101
 102 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
 103                             struct samsync_context *ctx,
 104                             enum netr_SamDatabaseID database_id,
 105                             uint64_t *sequence_num)
 106 {
 107         krb5_error_code ret = 0;
 108         NTSTATUS status;
 109         struct libnet_keytab_context *keytab_ctx = NULL;
 110         struct libnet_keytab_entry *entry;
 111         uint64_t old_sequence_num = 0;
 112         const char *principal = NULL;
 113         struct netr_DsRGetDCNameInfo *info = NULL;
 114         const char *dc;
 115
 116         ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
 117         if (ret) {
 118                 return krb5_to_nt_status(ret);
 119         }
 120
 121         status = dsgetdcname(mem_ctx, ctx->msg_ctx,
 122                              ctx->domain_name, NULL, NULL, 0, &info);
 123         if (!NT_STATUS_IS_OK(status)) {
 124                 return status;
 125         }
 126
 127         dc = strip_hostname(info->dc_unc);
 128
 129         keytab_ctx->clean_old_entries = ctx->clean_old_entries;
 130         ctx->private_data = keytab_ctx;
 131
 132         status = keytab_ad_connect(mem_ctx,
 133                                    ctx->domain_name,
 134                                    dc,
 135                                    ctx->username,
 136                                    ctx->password,
 137                                    keytab_ctx);
 138         if (!NT_STATUS_IS_OK(status)) {
 139                 TALLOC_FREE(keytab_ctx);
 140                 return status;
 141         }
 142
 143         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
 144                                     keytab_ctx->dns_domain_name);
 145         NT_STATUS_HAVE_NO_MEMORY(principal);
 146
 147         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
 148                                      mem_ctx);
 149         if (entry && (entry->password.length == 8)) {
 150                 old_sequence_num = BVAL(entry->password.data, 0);
 151         }
 152
 153         if (sequence_num) {
 154                 *sequence_num = old_sequence_num;
 155         }
 156
 157         return status;
 158 }
 159
 160 /****************************************************************
 161 ****************************************************************/
 162
 163 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
 164                                          enum netr_SamDatabaseID database_id,
 165                                          struct netr_DELTA_ENUM_ARRAY *r,
 166                                          uint64_t *sequence_num,
 167                                          struct samsync_context *ctx)
 168 {
 169         struct libnet_keytab_context *keytab_ctx =
 170                 (struct libnet_keytab_context *)ctx->private_data;
 171
 172         NTSTATUS status = NT_STATUS_OK;
 173         int i;
 174
 175         for (i = 0; i < r->num_deltas; i++) {
 176
 177                 switch (r->delta_enum[i].delta_type) {
 178                 case NETR_DELTA_USER:
 179                         break;
 180                 case NETR_DELTA_DOMAIN:
 181                         if (sequence_num) {
 182                                 *sequence_num =
 183                                         r->delta_enum[i].delta_union.domain->sequence_num;
 184                         }
 185                         continue;
 186                 case NETR_DELTA_MODIFY_COUNT:
 187                         if (sequence_num) {
 188                                 *sequence_num =
 189                                         *r->delta_enum[i].delta_union.modified_count;
 190                         }
 191                         continue;
 192                 default:
 193                         continue;
 194                 }
 195
 196                 status = fetch_sam_entry_keytab(mem_ctx, database_id,
 197                                                 r->delta_enum[i].delta_id_union.rid,
 198                                                 r->delta_enum[i].delta_union.user,
 199                                                 keytab_ctx);
 200                 if (!NT_STATUS_IS_OK(status)) {
 201                         goto out;
 202                 }
 203         }
 204  out:
 205         return status;
 206 }
 207
 208 /****************************************************************
 209 ****************************************************************/
 210
 211 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
 212                              struct samsync_context *ctx,
 213                              enum netr_SamDatabaseID database_id,
 214                              uint64_t sequence_num)
 215 {
 216         struct libnet_keytab_context *keytab_ctx =
 217                 (struct libnet_keytab_context *)ctx->private_data;
 218         krb5_error_code ret;
 219         NTSTATUS status;
 220         struct libnet_keytab_entry *entry;
 221         uint64_t old_sequence_num = 0;
 222         const char *principal = NULL;
 223
 224         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
 225                                     keytab_ctx->dns_domain_name);
 226         NT_STATUS_HAVE_NO_MEMORY(principal);
 227
 228
 229         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
 230                                      mem_ctx);
 231         if (entry && (entry->password.length == 8)) {
 232                 old_sequence_num = BVAL(entry->password.data, 0);
 233         }
 234
 235
 236         if (sequence_num > old_sequence_num) {
 237                 DATA_BLOB blob;
 238                 blob = data_blob_talloc_zero(mem_ctx, 8);
 239                 SBVAL(blob.data, 0, sequence_num);
 240
 241                 status = libnet_keytab_add_to_keytab_entries(mem_ctx, keytab_ctx,
 242                                                              0,
 243                                                              "SEQUENCE_NUM",
 244                                                              NULL,
 245                                                              ENCTYPE_NULL,
 246                                                              blob);
 247                 if (!NT_STATUS_IS_OK(status)) {
 248                         goto done;
 249                 }
 250         }
 251
 252         ret = libnet_keytab_add(keytab_ctx);
 253         if (ret) {
 254                 status = krb5_to_nt_status(ret);
 255                 ctx->error_message = talloc_asprintf(ctx,
 256                         "Failed to add entries to keytab %s: %s",
 257                         keytab_ctx->keytab_name, error_message(ret));
 258                 TALLOC_FREE(keytab_ctx);
 259                 return status;
 260         }
 261
 262         ctx->result_message = talloc_asprintf(ctx,
 263                 "Vampired %d accounts to keytab %s",
 264                 keytab_ctx->count,
 265                 keytab_ctx->keytab_name);
 266
 267         status = NT_STATUS_OK;
 268
 269  done:
 270         TALLOC_FREE(keytab_ctx);
 271
 272         return status;
 273 }
 274
 275 #else
 276
 277 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
 278                             struct samsync_context *ctx,
 279                             enum netr_SamDatabaseID database_id,
 280                             uint64_t *sequence_num)
 281 {
 282         return NT_STATUS_NOT_SUPPORTED;
 283 }
 284
 285 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
 286                                          enum netr_SamDatabaseID database_id,
 287                                          struct netr_DELTA_ENUM_ARRAY *r,
 288                                          uint64_t *sequence_num,
 289                                          struct samsync_context *ctx)
 290 {
 291         return NT_STATUS_NOT_SUPPORTED;
 292 }
 293
 294 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
 295                              struct samsync_context *ctx,
 296                              enum netr_SamDatabaseID database_id,
 297                              uint64_t sequence_num)
 298 {
 299         return NT_STATUS_NOT_SUPPORTED;
 300 }
 301
 302 #endif /* defined(HAVE_ADS) */
 303
 304 const struct samsync_ops libnet_samsync_keytab_ops = {
 305         .startup                = init_keytab,
 306         .process_objects        = fetch_sam_entries_keytab,
 307         .finish                 = close_keytab
 308 };