source3/libnet/libnet_samsync_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    dump the remote SAM using rpc samsync operations
   4
   5    Copyright (C) Guenther Deschner 2008.
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smb_krb5.h"
  23 #include "ads.h"
  24 #include "libnet/libnet_keytab.h"
  25 #include "libnet/libnet_samsync.h"
  26
  27 #if defined(HAVE_ADS)
  28
  29 /****************************************************************
  30 ****************************************************************/
  31
  32 static NTSTATUS keytab_ad_connect(TALLOC_CTX *mem_ctx,
  33                                   const char *domain_name,
  34                                   const char *username,
  35                                   const char *password,
  36                                   struct libnet_keytab_context *ctx)
  37 {
  38         NTSTATUS status;
  39         ADS_STATUS ad_status;
  40         ADS_STRUCT *ads;
  41         struct netr_DsRGetDCNameInfo *info = NULL;
  42         const char *dc;
  43
  44         status = dsgetdcname(mem_ctx, NULL, domain_name, NULL, NULL, 0, &info);
  45         if (!NT_STATUS_IS_OK(status)) {
  46                 return status;
  47         }
  48
  49         dc = strip_hostname(info->dc_unc);
  50
  51         ads = ads_init(NULL, domain_name, dc);
  52         NT_STATUS_HAVE_NO_MEMORY(ads);
  53
  54         if (getenv(KRB5_ENV_CCNAME) == NULL) {
  55                 setenv(KRB5_ENV_CCNAME, "MEMORY:libnet_samsync_keytab", 1);
  56         }
  57
  58         ads->auth.user_name = SMB_STRDUP(username);
  59         ads->auth.password = SMB_STRDUP(password);
  60
  61         ad_status = ads_connect_user_creds(ads);
  62         if (!ADS_ERR_OK(ad_status)) {
  63                 return NT_STATUS_UNSUCCESSFUL;
  64         }
  65
  66         ctx->ads = ads;
  67
  68         ctx->dns_domain_name = talloc_strdup_upper(mem_ctx, ads->config.realm);
  69         NT_STATUS_HAVE_NO_MEMORY(ctx->dns_domain_name);
  70
  71         return NT_STATUS_OK;
  72 }
  73
  74 /****************************************************************
  75 ****************************************************************/
  76
  77 static NTSTATUS fetch_sam_entry_keytab(TALLOC_CTX *mem_ctx,
  78                                        enum netr_SamDatabaseID database_id,
  79                                        uint32_t rid,
  80                                        struct netr_DELTA_USER *r,
  81                                        struct libnet_keytab_context *ctx)
  82 {
  83         NTSTATUS status;
  84         uint32_t kvno = 0;
  85         DATA_BLOB blob;
  86
  87         if (memcmp(r->ntpassword.hash, ctx->zero_buf, 16) == 0) {
  88                 return NT_STATUS_OK;
  89         }
  90
  91         kvno = ads_get_kvno(ctx->ads, r->account_name.string);
  92         blob = data_blob_const(r->ntpassword.hash, 16);
  93
  94         status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx,
  95                                                      kvno,
  96                                                      r->account_name.string,
  97                                                      NULL,
  98                                                      ENCTYPE_ARCFOUR_HMAC,
  99                                                      blob);
 100         if (!NT_STATUS_IS_OK(status)) {
 101                 return status;
 102         }
 103
 104         return NT_STATUS_OK;
 105 }
 106
 107 /****************************************************************
 108 ****************************************************************/
 109
 110 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
 111                             struct samsync_context *ctx,
 112                             enum netr_SamDatabaseID database_id,
 113                             uint64_t *sequence_num)
 114 {
 115         krb5_error_code ret = 0;
 116         NTSTATUS status;
 117         struct libnet_keytab_context *keytab_ctx = NULL;
 118         struct libnet_keytab_entry *entry;
 119         uint64_t old_sequence_num = 0;
 120         const char *principal = NULL;
 121
 122         ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
 123         if (ret) {
 124                 return krb5_to_nt_status(ret);
 125         }
 126
 127         keytab_ctx->clean_old_entries = ctx->clean_old_entries;
 128         ctx->private_data = keytab_ctx;
 129
 130         status = keytab_ad_connect(mem_ctx,
 131                                    ctx->domain_name,
 132                                    ctx->username,
 133                                    ctx->password,
 134                                    keytab_ctx);
 135         if (!NT_STATUS_IS_OK(status)) {
 136                 TALLOC_FREE(keytab_ctx);
 137                 return status;
 138         }
 139
 140         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
 141                                     keytab_ctx->dns_domain_name);
 142         NT_STATUS_HAVE_NO_MEMORY(principal);
 143
 144         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
 145                                      mem_ctx);
 146         if (entry && (entry->password.length == 8)) {
 147                 old_sequence_num = BVAL(entry->password.data, 0);
 148         }
 149
 150         if (sequence_num) {
 151                 *sequence_num = old_sequence_num;
 152         }
 153
 154         return status;
 155 }
 156
 157 /****************************************************************
 158 ****************************************************************/
 159
 160 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
 161                                          enum netr_SamDatabaseID database_id,
 162                                          struct netr_DELTA_ENUM_ARRAY *r,
 163                                          uint64_t *sequence_num,
 164                                          struct samsync_context *ctx)
 165 {
 166         struct libnet_keytab_context *keytab_ctx =
 167                 (struct libnet_keytab_context *)ctx->private_data;
 168
 169         NTSTATUS status = NT_STATUS_OK;
 170         int i;
 171
 172         for (i = 0; i < r->num_deltas; i++) {
 173
 174                 switch (r->delta_enum[i].delta_type) {
 175                 case NETR_DELTA_USER:
 176                         break;
 177                 case NETR_DELTA_DOMAIN:
 178                         if (sequence_num) {
 179                                 *sequence_num =
 180                                         r->delta_enum[i].delta_union.domain->sequence_num;
 181                         }
 182                         continue;
 183                 case NETR_DELTA_MODIFY_COUNT:
 184                         if (sequence_num) {
 185                                 *sequence_num =
 186                                         *r->delta_enum[i].delta_union.modified_count;
 187                         }
 188                         continue;
 189                 default:
 190                         continue;
 191                 }
 192
 193                 status = fetch_sam_entry_keytab(mem_ctx, database_id,
 194                                                 r->delta_enum[i].delta_id_union.rid,
 195                                                 r->delta_enum[i].delta_union.user,
 196                                                 keytab_ctx);
 197                 if (!NT_STATUS_IS_OK(status)) {
 198                         goto out;
 199                 }
 200         }
 201  out:
 202         return status;
 203 }
 204
 205 /****************************************************************
 206 ****************************************************************/
 207
 208 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
 209                              struct samsync_context *ctx,
 210                              enum netr_SamDatabaseID database_id,
 211                              uint64_t sequence_num)
 212 {
 213         struct libnet_keytab_context *keytab_ctx =
 214                 (struct libnet_keytab_context *)ctx->private_data;
 215         krb5_error_code ret;
 216         NTSTATUS status;
 217         struct libnet_keytab_entry *entry;
 218         uint64_t old_sequence_num = 0;
 219         const char *principal = NULL;
 220
 221         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
 222                                     keytab_ctx->dns_domain_name);
 223         NT_STATUS_HAVE_NO_MEMORY(principal);
 224
 225
 226         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
 227                                      mem_ctx);
 228         if (entry && (entry->password.length == 8)) {
 229                 old_sequence_num = BVAL(entry->password.data, 0);
 230         }
 231
 232
 233         if (sequence_num > old_sequence_num) {
 234                 DATA_BLOB blob;
 235                 blob = data_blob_talloc_zero(mem_ctx, 8);
 236                 SBVAL(blob.data, 0, sequence_num);
 237
 238                 status = libnet_keytab_add_to_keytab_entries(mem_ctx, keytab_ctx,
 239                                                              0,
 240                                                              "SEQUENCE_NUM",
 241                                                              NULL,
 242                                                              ENCTYPE_NULL,
 243                                                              blob);
 244                 if (!NT_STATUS_IS_OK(status)) {
 245                         goto done;
 246                 }
 247         }
 248
 249         ret = libnet_keytab_add(keytab_ctx);
 250         if (ret) {
 251                 status = krb5_to_nt_status(ret);
 252                 ctx->error_message = talloc_asprintf(ctx,
 253                         "Failed to add entries to keytab %s: %s",
 254                         keytab_ctx->keytab_name, error_message(ret));
 255                 TALLOC_FREE(keytab_ctx);
 256                 return status;
 257         }
 258
 259         ctx->result_message = talloc_asprintf(ctx,
 260                 "Vampired %d accounts to keytab %s",
 261                 keytab_ctx->count,
 262                 keytab_ctx->keytab_name);
 263
 264         status = NT_STATUS_OK;
 265
 266  done:
 267         TALLOC_FREE(keytab_ctx);
 268
 269         return status;
 270 }
 271
 272 #else
 273
 274 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
 275                             struct samsync_context *ctx,
 276                             enum netr_SamDatabaseID database_id,
 277                             uint64_t *sequence_num)
 278 {
 279         return NT_STATUS_NOT_SUPPORTED;
 280 }
 281
 282 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
 283                                          enum netr_SamDatabaseID database_id,
 284                                          struct netr_DELTA_ENUM_ARRAY *r,
 285                                          uint64_t *sequence_num,
 286                                          struct samsync_context *ctx)
 287 {
 288         return NT_STATUS_NOT_SUPPORTED;
 289 }
 290
 291 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
 292                              struct samsync_context *ctx,
 293                              enum netr_SamDatabaseID database_id,
 294                              uint64_t sequence_num)
 295 {
 296         return NT_STATUS_NOT_SUPPORTED;
 297 }
 298
 299 #endif /* defined(HAVE_ADS) */
 300
 301 const struct samsync_ops libnet_samsync_keytab_ops = {
 302         .startup                = init_keytab,
 303         .process_objects        = fetch_sam_entries_keytab,
 304         .finish                 = close_keytab
 305 };