?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "s3: Attempt to fix the non-gnumake build"
[Samba/gebeck_regimport.git] / source4 / kdc / kpasswdd.c
bloba0ff28a4cafa6e1126236258cf76b55ba1717cbc
1 /*
2 Unix SMB/CIFS implementation.
3
4 kpasswd Server implementation
5
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 Copyright (C) Andrew Tridgell 2005
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "smbd/service_task.h"
25 #include "lib/events/events.h"
26 #include "lib/socket/socket.h"
27 #include "lib/tsocket/tsocket.h"
28 #include "system/network.h"
29 #include "../lib/util/dlinklist.h"
30 #include "lib/ldb/include/ldb.h"
31 #include "auth/gensec/gensec.h"
32 #include "auth/credentials/credentials.h"
33 #include "auth/credentials/credentials_krb5.h"
34 #include "auth/auth.h"
35 #include "dsdb/samdb/samdb.h"
36 #include "rpc_server/dcerpc_server.h"
37 #include "rpc_server/samr/proto.h"
38 #include "libcli/security/security.h"
39 #include "param/param.h"
40 #include "kdc/kdc.h"
41
42 /* TODO: remove all SAMBA4_INTERNAL_HEIMDAL stuff from this file */
43 #ifdef SAMBA4_INTERNAL_HEIMDAL
44 #include "heimdal_build/kpasswdd-glue.h"
45 #endif
46
47 /* Return true if there is a valid error packet formed in the error_blob */
48 static bool kpasswdd_make_error_reply(struct kdc_server *kdc,
49 TALLOC_CTX *mem_ctx,
50 uint16_t result_code,
51 const char *error_string,
52 DATA_BLOB *error_blob)
53 {
54 char *error_string_utf8;
55 size_t len;
56
57 DEBUG(result_code ? 3 : 10, ("kpasswdd: %s\n", error_string));
58
59 if (!push_utf8_talloc(mem_ctx, &error_string_utf8, error_string, &len)) {
60 return false;
61 }
62
63 *error_blob = data_blob_talloc(mem_ctx, NULL, 2 + len + 1);
64 if (!error_blob->data) {
65 return false;
66 }
67 RSSVAL(error_blob->data, 0, result_code);
68 memcpy(error_blob->data + 2, error_string_utf8, len + 1);
69 return true;
70 }
71
72 /* Return true if there is a valid error packet formed in the error_blob */
73 static bool kpasswdd_make_unauth_error_reply(struct kdc_server *kdc,
74 TALLOC_CTX *mem_ctx,
75 uint16_t result_code,
76 const char *error_string,
77 DATA_BLOB *error_blob)
78 {
79 bool ret;
80 int kret;
81 DATA_BLOB error_bytes;
82 krb5_data k5_error_bytes, k5_error_blob;
83 ret = kpasswdd_make_error_reply(kdc, mem_ctx, result_code, error_string,
84 &error_bytes);
85 if (!ret) {
86 return false;
87 }
88 k5_error_bytes.data = error_bytes.data;
89 k5_error_bytes.length = error_bytes.length;
90 kret = krb5_mk_error(kdc->smb_krb5_context->krb5_context,
91 result_code, NULL, &k5_error_bytes,
92 NULL, NULL, NULL, NULL, &k5_error_blob);
93 if (kret) {
94 return false;
95 }
96 *error_blob = data_blob_talloc(mem_ctx, k5_error_blob.data, k5_error_blob.length);
97 krb5_data_free(&k5_error_blob);
98 if (!error_blob->data) {
99 return false;
100 }
101 return true;
102 }
103
104 static bool kpasswd_make_pwchange_reply(struct kdc_server *kdc,
105 TALLOC_CTX *mem_ctx,
106 NTSTATUS status,
107 enum samPwdChangeReason reject_reason,
108 struct samr_DomInfo1 *dominfo,
109 DATA_BLOB *error_blob)
110 {
111 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
112 return kpasswdd_make_error_reply(kdc, mem_ctx,
113 KRB5_KPASSWD_ACCESSDENIED,
114 "No such user when changing password",
115 error_blob);
116 }
117 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
118 return kpasswdd_make_error_reply(kdc, mem_ctx,
119 KRB5_KPASSWD_ACCESSDENIED,
120 "Not permitted to change password",
121 error_blob);
122 }
123 if (dominfo && NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
124 const char *reject_string;
125 switch (reject_reason) {
126 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT:
127 reject_string = talloc_asprintf(mem_ctx, "Password too short, password must be at least %d characters long",
128 dominfo->min_password_length);
129 break;
130 case SAM_PWD_CHANGE_NOT_COMPLEX:
131 reject_string = "Password does not meet complexity requirements";
132 break;
133 case SAM_PWD_CHANGE_PWD_IN_HISTORY:
134 reject_string = "Password is already in password history";
135 break;
136 default:
137 reject_string = talloc_asprintf(mem_ctx, "Password must be at least %d characters long, and cannot match any of your %d previous passwords",
138 dominfo->min_password_length, dominfo->password_history_length);
139 break;
140 }
141 return kpasswdd_make_error_reply(kdc, mem_ctx,
142 KRB5_KPASSWD_SOFTERROR,
143 reject_string,
144 error_blob);
145 }
146 if (!NT_STATUS_IS_OK(status)) {
147 return kpasswdd_make_error_reply(kdc, mem_ctx,
148 KRB5_KPASSWD_HARDERROR,
149 talloc_asprintf(mem_ctx, "failed to set password: %s", nt_errstr(status)),
150 error_blob);
151
152 }
153 return kpasswdd_make_error_reply(kdc, mem_ctx, KRB5_KPASSWD_SUCCESS,
154 "Password changed",
155 error_blob);
156 }
157
158 /*
159 A user password change
160
161 Return true if there is a valid error packet (or success) formed in
162 the error_blob
163 */
164 static bool kpasswdd_change_password(struct kdc_server *kdc,
165 TALLOC_CTX *mem_ctx,
166 struct auth_session_info *session_info,
167 const DATA_BLOB *password,
168 DATA_BLOB *reply)
169 {
170 NTSTATUS status;
171 enum samPwdChangeReason reject_reason;
172 struct samr_DomInfo1 *dominfo;
173 struct ldb_context *samdb;
174
175 samdb = samdb_connect(mem_ctx, kdc->task->event_ctx, kdc->task->lp_ctx, system_session(kdc->task->lp_ctx));
176 if (!samdb) {
177 return kpasswdd_make_error_reply(kdc, mem_ctx,
178 KRB5_KPASSWD_HARDERROR,
179 "Failed to open samdb",
180 reply);
181 }
182
183 DEBUG(3, ("Changing password of %s\\%s (%s)\n",
184 session_info->server_info->domain_name,
185 session_info->server_info->account_name,
186 dom_sid_string(mem_ctx, session_info->security_token->user_sid)));
187
188 /* User password change */
189 status = samdb_set_password_sid(samdb, mem_ctx,
190 session_info->security_token->user_sid,
191 password, NULL, NULL,
192 true, /* this is a user password change */
193 &reject_reason,
194 &dominfo);
195 return kpasswd_make_pwchange_reply(kdc, mem_ctx,
196 status,
197 reject_reason,
198 dominfo,
199 reply);
200
201 }
202
203 static bool kpasswd_process_request(struct kdc_server *kdc,
204 TALLOC_CTX *mem_ctx,
205 struct gensec_security *gensec_security,
206 uint16_t version,
207 DATA_BLOB *input,
208 DATA_BLOB *reply)
209 {
210 struct auth_session_info *session_info;
211 size_t pw_len;
212
213 if (!NT_STATUS_IS_OK(gensec_session_info(gensec_security,
214 &session_info))) {
215 return kpasswdd_make_error_reply(kdc, mem_ctx,
216 KRB5_KPASSWD_HARDERROR,
217 "gensec_session_info failed!",
218 reply);
219 }
220
221 switch (version) {
222 case KRB5_KPASSWD_VERS_CHANGEPW:
223 {
224 DATA_BLOB password;
225 if (!convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(kdc->task->lp_ctx),
226 CH_UTF8, CH_UTF16,
227 (const char *)input->data,
228 input->length,
229 (void **)&password.data, &pw_len, false)) {
230 return false;
231 }
232 password.length = pw_len;
233
234 return kpasswdd_change_password(kdc, mem_ctx, session_info,
235 &password, reply);
236 break;
237 }
238 case KRB5_KPASSWD_VERS_SETPW:
239 {
240 NTSTATUS status;
241 enum samPwdChangeReason reject_reason = SAM_PWD_CHANGE_NO_ERROR;
242 struct samr_DomInfo1 *dominfo = NULL;
243 struct ldb_context *samdb;
244 krb5_context context = kdc->smb_krb5_context->krb5_context;
245
246 ChangePasswdDataMS chpw;
247 DATA_BLOB password;
248
249 krb5_principal principal;
250 char *set_password_on_princ;
251 struct ldb_dn *set_password_on_dn;
252 bool service_principal_name = false;
253
254 size_t len;
255 int ret;
256
257 ret = decode_ChangePasswdDataMS(input->data, input->length,
258 &chpw, &len);
259 if (ret) {
260 return kpasswdd_make_error_reply(kdc, mem_ctx,
261 KRB5_KPASSWD_MALFORMED,
262 "failed to decode password change structure",
263 reply);
264 }
265
266 if (!convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(kdc->task->lp_ctx),
267 CH_UTF8, CH_UTF16,
268 (const char *)chpw.newpasswd.data,
269 chpw.newpasswd.length,
270 (void **)&password.data, &pw_len, false)) {
271 free_ChangePasswdDataMS(&chpw);
272 return false;
273 }
274
275 password.length = pw_len;
276
277 if ((chpw.targname && !chpw.targrealm)
278 || (!chpw.targname && chpw.targrealm)) {
279 return kpasswdd_make_error_reply(kdc, mem_ctx,
280 KRB5_KPASSWD_MALFORMED,
281 "Realm and principal must be both present, or neither present",
282 reply);
283 }
284 if (chpw.targname && chpw.targrealm) {
285 #ifdef SAMBA4_INTERNAL_HEIMDAL
286 if (_krb5_principalname2krb5_principal(kdc->smb_krb5_context->krb5_context,
287 &principal, *chpw.targname,
288 *chpw.targrealm) != 0) {
289 free_ChangePasswdDataMS(&chpw);
290 return kpasswdd_make_error_reply(kdc, mem_ctx,
291 KRB5_KPASSWD_MALFORMED,
292 "failed to extract principal to set",
293 reply);
294
295 }
296 #else /* SAMBA4_INTERNAL_HEIMDAL */
297 return kpasswdd_make_error_reply(kdc, mem_ctx,
298 KRB5_KPASSWD_BAD_VERSION,
299 "Operation Not Implemented",
300 reply);
301 #endif /* SAMBA4_INTERNAL_HEIMDAL */
302 } else {
303 free_ChangePasswdDataMS(&chpw);
304 return kpasswdd_change_password(kdc, mem_ctx, session_info,
305 &password, reply);
306 }
307 free_ChangePasswdDataMS(&chpw);
308
309 if (principal->name.name_string.len >= 2) {
310 service_principal_name = true;
311
312 /* We use this, rather than 'no realm' flag,
313 * as we don't want to accept a password
314 * change on a principal from another realm */
315
316 if (krb5_unparse_name_short(context, principal, &set_password_on_princ) != 0) {
317 krb5_free_principal(context, principal);
318 return kpasswdd_make_error_reply(kdc, mem_ctx,
319 KRB5_KPASSWD_MALFORMED,
320 "krb5_unparse_name failed!",
321 reply);
322 }
323 } else {
324 if (krb5_unparse_name(context, principal, &set_password_on_princ) != 0) {
325 krb5_free_principal(context, principal);
326 return kpasswdd_make_error_reply(kdc, mem_ctx,
327 KRB5_KPASSWD_MALFORMED,
328 "krb5_unparse_name failed!",
329 reply);
330 }
331 }
332 krb5_free_principal(context, principal);
333
334 samdb = samdb_connect(mem_ctx, kdc->task->event_ctx, kdc->task->lp_ctx, session_info);
335 if (!samdb) {
336 return kpasswdd_make_error_reply(kdc, mem_ctx,
337 KRB5_KPASSWD_HARDERROR,
338 "Unable to open database!",
339 reply);
340 }
341
342 DEBUG(3, ("%s\\%s (%s) is changing password of %s\n",
343 session_info->server_info->domain_name,
344 session_info->server_info->account_name,
345 dom_sid_string(mem_ctx, session_info->security_token->user_sid),
346 set_password_on_princ));
347 ret = ldb_transaction_start(samdb);
348 if (ret != LDB_SUCCESS) {
349 status = NT_STATUS_TRANSACTION_ABORTED;
350 return kpasswd_make_pwchange_reply(kdc, mem_ctx,
351 status,
352 SAM_PWD_CHANGE_NO_ERROR,
353 NULL,
354 reply);
355 }
356
357 if (service_principal_name) {
358 status = crack_service_principal_name(samdb, mem_ctx,
359 set_password_on_princ,
360 &set_password_on_dn, NULL);
361 } else {
362 status = crack_user_principal_name(samdb, mem_ctx,
363 set_password_on_princ,
364 &set_password_on_dn, NULL);
365 }
366 free(set_password_on_princ);
367 if (!NT_STATUS_IS_OK(status)) {
368 ldb_transaction_cancel(samdb);
369 return kpasswd_make_pwchange_reply(kdc, mem_ctx,
370 status,
371 SAM_PWD_CHANGE_NO_ERROR,
372 NULL,
373 reply);
374 }
375
376 if (NT_STATUS_IS_OK(status)) {
377 /* Admin password set */
378 status = samdb_set_password(samdb, mem_ctx,
379 set_password_on_dn, NULL,
380 &password, NULL, NULL,
381 false, /* this is not a user password change */
382 &reject_reason, &dominfo);
383 }
384
385 if (NT_STATUS_IS_OK(status)) {
386 ret = ldb_transaction_commit(samdb);
387 if (ret != LDB_SUCCESS) {
388 DEBUG(1,("Failed to commit transaction to set password on %s: %s\n",
389 ldb_dn_get_linearized(set_password_on_dn),
390 ldb_errstring(samdb)));
391 status = NT_STATUS_TRANSACTION_ABORTED;
392 }
393 } else {
394 ldb_transaction_cancel(samdb);
395 }
396 return kpasswd_make_pwchange_reply(kdc, mem_ctx,
397 status,
398 reject_reason,
399 dominfo,
400 reply);
401 }
402 default:
403 return kpasswdd_make_error_reply(kdc, mem_ctx,
404 KRB5_KPASSWD_BAD_VERSION,
405 talloc_asprintf(mem_ctx,
406 "Protocol version %u not supported",
407 version),
408 reply);
409 }
410 return true;
411 }
412
413 bool kpasswdd_process(struct kdc_server *kdc,
414 TALLOC_CTX *mem_ctx,
415 DATA_BLOB *input,
416 DATA_BLOB *reply,
417 struct tsocket_address *peer_addr,
418 struct tsocket_address *my_addr,
419 int datagram_reply)
420 {
421 bool ret;
422 const uint16_t header_len = 6;
423 uint16_t len;
424 uint16_t ap_req_len;
425 uint16_t krb_priv_len;
426 uint16_t version;
427 NTSTATUS nt_status;
428 DATA_BLOB ap_req, krb_priv_req;
429 DATA_BLOB krb_priv_rep = data_blob(NULL, 0);
430 DATA_BLOB ap_rep = data_blob(NULL, 0);
431 DATA_BLOB kpasswd_req, kpasswd_rep;
432 struct cli_credentials *server_credentials;
433 struct gensec_security *gensec_security;
434 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
435
436 char *keytab_name;
437
438 if (!tmp_ctx) {
439 return false;
440 }
441
442 /* Be parinoid. We need to ensure we don't just let the
443 * caller lead us into a buffer overflow */
444 if (input->length <= header_len) {
445 talloc_free(tmp_ctx);
446 return false;
447 }
448
449 len = RSVAL(input->data, 0);
450 if (input->length != len) {
451 talloc_free(tmp_ctx);
452 return false;
453 }
454
455 /* There are two different versions of this protocol so far,
456 * plus others in the standards pipe. Fortunetly they all
457 * take a very similar framing */
458 version = RSVAL(input->data, 2);
459 ap_req_len = RSVAL(input->data, 4);
460 if ((ap_req_len >= len) || (ap_req_len + header_len) >= len) {
461 talloc_free(tmp_ctx);
462 return false;
463 }
464
465 krb_priv_len = len - ap_req_len;
466 ap_req = data_blob_const(&input->data[header_len], ap_req_len);
467 krb_priv_req = data_blob_const(&input->data[header_len + ap_req_len], krb_priv_len);
468
469 server_credentials = cli_credentials_init(tmp_ctx);
470 if (!server_credentials) {
471 DEBUG(1, ("Failed to init server credentials\n"));
472 return false;
473 }
474
475 /* We want the credentials subsystem to use the krb5 context
476 * we already have, rather than a new context */
477 cli_credentials_set_krb5_context(server_credentials, kdc->smb_krb5_context);
478 cli_credentials_set_conf(server_credentials, kdc->task->lp_ctx);
479
480 keytab_name = talloc_asprintf(server_credentials, "HDB:samba4&%p", kdc->base_ctx);
481
482 cli_credentials_set_username(server_credentials, "kadmin/changepw", CRED_SPECIFIED);
483 ret = cli_credentials_set_keytab_name(server_credentials, kdc->task->event_ctx, kdc->task->lp_ctx, keytab_name, CRED_SPECIFIED);
484 if (ret != 0) {
485 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
486 KRB5_KPASSWD_HARDERROR,
487 talloc_asprintf(mem_ctx,
488 "Failed to obtain server credentials for kadmin/changepw: %s\n",
489 nt_errstr(nt_status)),
490 &krb_priv_rep);
491 ap_rep.length = 0;
492 if (ret) {
493 goto reply;
494 }
495 talloc_free(tmp_ctx);
496 return ret;
497 }
498
499 /* We don't strictly need to call this wrapper, and could call
500 * gensec_server_start directly, as we have no need for NTLM
501 * and we have a PAC, but this ensures that the wrapper can be
502 * safely extended for other helpful things in future */
503 nt_status = samba_server_gensec_start(tmp_ctx, kdc->task->event_ctx,
504 kdc->task->msg_ctx,
505 kdc->task->lp_ctx,
506 server_credentials,
507 "kpasswd",
508 &gensec_security);
509 if (!NT_STATUS_IS_OK(nt_status)) {
510 talloc_free(tmp_ctx);
511 return false;
512 }
513
514 /* The kerberos PRIV packets include these addresses. MIT
515 * clients check that they are present */
516 #if 0
517 /* Skip this part for now, it breaks with a NetAPP filer and
518 * in any case where the client address is behind NAT. If
519 * older MIT clients need this, we might have to insert more
520 * complex code */
521
522 nt_status = gensec_set_local_address(gensec_security, peer_addr);
523 if (!NT_STATUS_IS_OK(nt_status)) {
524 talloc_free(tmp_ctx);
525 return false;
526 }
527 #endif
528
529 nt_status = gensec_set_local_address(gensec_security, my_addr);
530 if (!NT_STATUS_IS_OK(nt_status)) {
531 talloc_free(tmp_ctx);
532 return false;
533 }
534
535 /* We want the GENSEC wrap calls to generate PRIV tokens */
536 gensec_want_feature(gensec_security, GENSEC_FEATURE_SEAL);
537
538 nt_status = gensec_start_mech_by_name(gensec_security, "krb5");
539 if (!NT_STATUS_IS_OK(nt_status)) {
540 talloc_free(tmp_ctx);
541 return false;
542 }
543
544 /* Accept the AP-REQ and generate teh AP-REP we need for the reply */
545 nt_status = gensec_update(gensec_security, tmp_ctx, ap_req, &ap_rep);
546 if (!NT_STATUS_IS_OK(nt_status) && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
547
548 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
549 KRB5_KPASSWD_HARDERROR,
550 talloc_asprintf(mem_ctx,
551 "gensec_update failed: %s",
552 nt_errstr(nt_status)),
553 &krb_priv_rep);
554 ap_rep.length = 0;
555 if (ret) {
556 goto reply;
557 }
558 talloc_free(tmp_ctx);
559 return ret;
560 }
561
562 /* Extract the data from the KRB-PRIV half of the message */
563 nt_status = gensec_unwrap(gensec_security, tmp_ctx, &krb_priv_req, &kpasswd_req);
564 if (!NT_STATUS_IS_OK(nt_status)) {
565 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
566 KRB5_KPASSWD_HARDERROR,
567 talloc_asprintf(mem_ctx,
568 "gensec_unwrap failed: %s",
569 nt_errstr(nt_status)),
570 &krb_priv_rep);
571 ap_rep.length = 0;
572 if (ret) {
573 goto reply;
574 }
575 talloc_free(tmp_ctx);
576 return ret;
577 }
578
579 /* Figure out something to do with it (probably changing a password...) */
580 ret = kpasswd_process_request(kdc, tmp_ctx,
581 gensec_security,
582 version,
583 &kpasswd_req, &kpasswd_rep);
584 if (!ret) {
585 /* Argh! */
586 return false;
587 }
588
589 /* And wrap up the reply: This ensures that the error message
590 * or success can be verified by the client */
591 nt_status = gensec_wrap(gensec_security, tmp_ctx,
592 &kpasswd_rep, &krb_priv_rep);
593 if (!NT_STATUS_IS_OK(nt_status)) {
594 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
595 KRB5_KPASSWD_HARDERROR,
596 talloc_asprintf(mem_ctx,
597 "gensec_wrap failed: %s",
598 nt_errstr(nt_status)),
599 &krb_priv_rep);
600 ap_rep.length = 0;
601 if (ret) {
602 goto reply;
603 }
604 talloc_free(tmp_ctx);
605 return ret;
606 }
607
608 reply:
609 *reply = data_blob_talloc(mem_ctx, NULL, krb_priv_rep.length + ap_rep.length + header_len);
610 if (!reply->data) {
611 return false;
612 }
613
614 RSSVAL(reply->data, 0, reply->length);
615 RSSVAL(reply->data, 2, 1); /* This is a version 1 reply, MS change/set or otherwise */
616 RSSVAL(reply->data, 4, ap_rep.length);
617 memcpy(reply->data + header_len,
618 ap_rep.data,
619 ap_rep.length);
620 memcpy(reply->data + header_len + ap_rep.length,
621 krb_priv_rep.data,
622 krb_priv_rep.length);
623
624 talloc_free(tmp_ctx);
625 return ret;
626 }
627
reg import