source4/kdc/mit_samba.c

   1 /*
   2    MIT-Samba4 library
   3
   4    Copyright (c) 2010, Simo Sorce <idra@samba.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "param/param.h"
  22 #include "dsdb/samdb/samdb.h"
  23 #include "auth/auth.h"
  24 #include "auth/credentials/credentials.h"
  25 #include "system/kerberos.h"
  26 #include "hdb.h"
  27 #include "mit_samba_interface.h"
  28 #include "auth/kerberos/kerberos.h"
  29 #include "kdc/samba_kdc.h"
  30 #include "kdc/pac-glue.h"
  31 #include "kdc/db-glue.h"
  32
  33 const int mit_samba_interface_version = MIT_SAMBA_INTERFACE_VERSION;
  34
  35 struct mit_samba_context {
  36         struct auth_session_info *session_info;
  37
  38         /* for compat with hdb plugin common code */
  39         krb5_context context;
  40         struct samba_kdc_db_context *db_ctx;
  41 };
  42
  43 static void mit_samba_context_free(struct mit_samba_context *ctx)
  44 {
  45         /* free heimdal's krb5_context */
  46         if (ctx->context) {
  47                 krb5_free_context(ctx->context);
  48         }
  49
  50         /* then free everything else */
  51         talloc_free(ctx);
  52 }
  53
  54 static int mit_samba_context_init(struct mit_samba_context **_ctx)
  55 {
  56         NTSTATUS status;
  57         struct mit_samba_context *ctx;
  58         const char *s4_conf_file;
  59         int ret;
  60         struct samba_kdc_base_context base_ctx;
  61
  62         ctx = talloc(NULL, struct mit_samba_context);
  63         if (!ctx) {
  64                 ret = ENOMEM;
  65                 goto done;
  66         }
  67
  68         base_ctx.ev_ctx = tevent_context_init(ctx);
  69         if (!base_ctx.ev_ctx) {
  70                 ret = ENOMEM;
  71                 goto done;
  72         }
  73         base_ctx.lp_ctx = loadparm_init_global(false);
  74         if (!base_ctx.lp_ctx) {
  75                 ret = ENOMEM;
  76                 goto done;
  77         }
  78         /* init s4 configuration */
  79         s4_conf_file = lpcfg_configfile(base_ctx.lp_ctx);
  80         if (s4_conf_file) {
  81                 lpcfg_load(base_ctx.lp_ctx, s4_conf_file);
  82         } else {
  83                 lpcfg_load_default(base_ctx.lp_ctx);
  84         }
  85
  86         status = samba_kdc_setup_db_ctx(ctx, &base_ctx, &ctx->db_ctx);
  87         if (!NT_STATUS_IS_OK(status)) {
  88                 ret = EINVAL;
  89                 goto done;
  90         }
  91
  92         /* init heimdal's krb_context and log facilities */
  93         ret = smb_krb5_init_context_basic(ctx,
  94                                           ctx->db_ctx->lp_ctx,
  95                                           &ctx->context);
  96         if (ret) {
  97                 goto done;
  98         }
  99
 100         ret = 0;
 101
 102 done:
 103         if (ret) {
 104                 mit_samba_context_free(ctx);
 105         } else {
 106                 *_ctx = ctx;
 107         }
 108         return ret;
 109 }
 110
 111
 112 static int mit_samba_get_principal(struct mit_samba_context *ctx,
 113                                    char *principal_string,
 114                                    unsigned int flags,
 115                                    hdb_entry_ex **_hentry)
 116 {
 117         krb5_principal principal;
 118         hdb_entry_ex *hentry;
 119         int ret;
 120
 121         hentry = talloc(ctx, hdb_entry_ex);
 122         if (!hentry) {
 123                 return ENOMEM;
 124         }
 125
 126         ret = krb5_parse_name(ctx->context, principal_string, &principal);
 127         if (ret) {
 128                 goto done;
 129         }
 130
 131         ret = samba_kdc_fetch(ctx->context, ctx->db_ctx,
 132                               principal, flags, 0, hentry);
 133
 134         krb5_free_principal(ctx->context, principal);
 135
 136 done:
 137         if (ret) {
 138                 talloc_free(hentry);
 139         } else {
 140                 talloc_steal(hentry->ctx, hentry);
 141                 *_hentry = hentry;
 142         }
 143         return ret;
 144 }
 145
 146 static int mit_samba_get_firstkey(struct mit_samba_context *ctx,
 147                                   hdb_entry_ex **_hentry)
 148 {
 149         hdb_entry_ex *hentry;
 150         int ret;
 151
 152         hentry = talloc(ctx, hdb_entry_ex);
 153         if (!hentry) {
 154                 return ENOMEM;
 155         }
 156
 157         ret = samba_kdc_firstkey(ctx->context, ctx->db_ctx, hentry);
 158
 159         if (ret) {
 160                 talloc_free(hentry);
 161         } else {
 162                 talloc_steal(hentry->ctx, hentry);
 163                 *_hentry = hentry;
 164         }
 165         return ret;
 166 }
 167
 168 static int mit_samba_get_nextkey(struct mit_samba_context *ctx,
 169                                  hdb_entry_ex **_hentry)
 170 {
 171         hdb_entry_ex *hentry;
 172         int ret;
 173
 174         hentry = talloc(ctx, hdb_entry_ex);
 175         if (!hentry) {
 176                 return ENOMEM;
 177         }
 178
 179         ret = samba_kdc_nextkey(ctx->context, ctx->db_ctx, hentry);
 180
 181         if (ret) {
 182                 talloc_free(hentry);
 183         } else {
 184                 talloc_steal(hentry->ctx, hentry);
 185                 *_hentry = hentry;
 186         }
 187         return ret;
 188 }
 189
 190 static int mit_samba_get_pac_data(struct mit_samba_context *ctx,
 191                                   hdb_entry_ex *client,
 192                                   DATA_BLOB *data)
 193 {
 194         TALLOC_CTX *tmp_ctx;
 195         DATA_BLOB *pac_blob;
 196         NTSTATUS nt_status;
 197
 198         tmp_ctx = talloc_named(ctx, 0, "mit_samba_get_pac_data context");
 199         if (!tmp_ctx) {
 200                 return ENOMEM;
 201         }
 202
 203         nt_status = samba_kdc_get_pac_blob(tmp_ctx, client, &pac_blob);
 204         if (!NT_STATUS_IS_OK(nt_status)) {
 205                 talloc_free(tmp_ctx);
 206                 return EINVAL;
 207         }
 208
 209         data->data = (uint8_t *)malloc(pac_blob->length);
 210         if (!data->data) {
 211                 talloc_free(tmp_ctx);
 212                 return ENOMEM;
 213         }
 214         memcpy(data->data, pac_blob->data, pac_blob->length);
 215         data->length = pac_blob->length;
 216
 217         talloc_free(tmp_ctx);
 218         return 0;
 219 }
 220
 221 static int mit_samba_update_pac_data(struct mit_samba_context *ctx,
 222                                      hdb_entry_ex *client,
 223                                      DATA_BLOB *pac_data,
 224                                      DATA_BLOB *logon_data)
 225 {
 226         TALLOC_CTX *tmp_ctx;
 227         DATA_BLOB *logon_blob;
 228         krb5_error_code code;
 229         NTSTATUS nt_status;
 230         krb5_pac pac = NULL;
 231         int ret;
 232
 233         /* The user account may be set not to want the PAC */
 234         if (client && !samba_princ_needs_pac(client)) {
 235                 return EINVAL;
 236         }
 237
 238         tmp_ctx = talloc_named(ctx, 0, "mit_samba_update_pac_data context");
 239         if (!tmp_ctx) {
 240                 return ENOMEM;
 241         }
 242
 243         logon_blob = talloc_zero(tmp_ctx, DATA_BLOB);
 244         if (!logon_blob) {
 245                 ret = ENOMEM;
 246                 goto done;
 247         }
 248
 249         code = krb5_pac_parse(ctx->context,
 250                               pac_data->data, pac_data->length, &pac);
 251         if (code) {
 252                 ret = EINVAL;
 253                 goto done;
 254         }
 255
 256         nt_status = samba_kdc_update_pac_blob(tmp_ctx, ctx->context,
 257                                               &pac, logon_blob);
 258         if (!NT_STATUS_IS_OK(nt_status)) {
 259                 DEBUG(0, ("Building PAC failed: %s\n",
 260                           nt_errstr(nt_status)));
 261                 ret = EINVAL;
 262                 goto done;
 263         }
 264
 265         logon_data->data = (uint8_t *)malloc(logon_blob->length);
 266         if (!logon_data->data) {
 267                 ret = ENOMEM;
 268                 goto done;
 269         }
 270         memcpy(logon_data->data, logon_blob->data, logon_blob->length);
 271         logon_data->length = logon_blob->length;
 272
 273         ret = 0;
 274
 275 done:
 276         if (pac) krb5_pac_free(ctx->context, pac);
 277         talloc_free(tmp_ctx);
 278         return ret;
 279 }
 280
 281 static int mit_samba_check_client_access(struct mit_samba_context *ctx,
 282                                          hdb_entry_ex *client,
 283                                          const char *client_name,
 284                                          hdb_entry_ex *server,
 285                                          const char *server_name,
 286                                          const char *netbios_name,
 287                                          bool password_change,
 288                                          DATA_BLOB *e_data)
 289 {
 290         struct samba_kdc_entry *kdc_entry;
 291         NTSTATUS nt_status;
 292
 293         kdc_entry = talloc_get_type(client->ctx, struct samba_kdc_entry);
 294
 295         nt_status = samba_kdc_check_client_access(kdc_entry,
 296                                                   client_name,
 297                                                   netbios_name,
 298                                                   password_change);
 299
 300         if (!NT_STATUS_IS_OK(nt_status)) {
 301                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) {
 302                         return ENOMEM;
 303                 }
 304
 305                 samba_kdc_build_edata_reply(nt_status, e_data);
 306
 307                 return samba_kdc_map_policy_err(nt_status);
 308         }
 309
 310         return 0;
 311 }
 312
 313 static int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
 314                                      hdb_entry_ex *entry,
 315                                      const char *target_name,
 316                                      bool is_nt_enterprise_name)
 317 {
 318         krb5_principal target_principal;
 319         int flags = 0;
 320         int ret;
 321
 322         if (is_nt_enterprise_name) {
 323                 flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE;
 324         }
 325
 326         ret = krb5_parse_name_flags(ctx->context, target_name,
 327                                     flags, &target_principal);
 328         if (ret) {
 329                 return ret;
 330         }
 331
 332         ret = samba_kdc_check_identical_client_and_server(ctx->context,
 333                                                           ctx->db_ctx,
 334                                                           entry,
 335                                                           target_principal);
 336
 337         krb5_free_principal(ctx->context, target_principal);
 338
 339         return ret;
 340 }
 341
 342 struct mit_samba_function_table mit_samba_function_table = {
 343         mit_samba_context_init,
 344         mit_samba_context_free,
 345         mit_samba_get_principal,
 346         mit_samba_get_firstkey,
 347         mit_samba_get_nextkey,
 348         mit_samba_get_pac_data,
 349         mit_samba_update_pac_data,
 350         mit_samba_check_client_access,
 351         mit_samba_check_s4u2proxy
 352 };