2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
7 Copyright (C) Andrew Tridgell 2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "smbd/service_task.h"
26 #include "smbd/service.h"
27 #include "smbd/service_stream.h"
28 #include "smbd/process_model.h"
29 #include "lib/events/events.h"
30 #include "lib/socket/socket.h"
31 #include "system/network.h"
32 #include "../lib/util/dlinklist.h"
33 #include "lib/messaging/irpc.h"
34 #include "lib/stream/packet.h"
35 #include "librpc/gen_ndr/samr.h"
36 #include "librpc/gen_ndr/ndr_irpc.h"
37 #include "librpc/gen_ndr/ndr_krb5pac.h"
38 #include "lib/socket/netif.h"
39 #include "param/param.h"
41 #include "librpc/gen_ndr/ndr_misc.h"
44 /* Disgusting hack to get a mem_ctx and lp_ctx into the hdb plugin, when
46 TALLOC_CTX
*hdb_samba4_mem_ctx
;
47 struct tevent_context
*hdb_samba4_ev_ctx
;
48 struct loadparm_context
*hdb_samba4_lp_ctx
;
50 /* hold all the info needed to send a reply */
52 struct kdc_reply
*next
, *prev
;
53 struct socket_address
*dest
;
57 typedef bool (*kdc_process_fn_t
)(struct kdc_server
*kdc
,
61 struct socket_address
*peer_addr
,
62 struct socket_address
*my_addr
,
65 /* hold information about one kdc socket */
67 struct socket_context
*sock
;
68 struct kdc_server
*kdc
;
69 struct tevent_fd
*fde
;
71 /* a queue of outgoing replies that have been deferred */
72 struct kdc_reply
*send_queue
;
74 kdc_process_fn_t process
;
77 state of an open tcp connection
79 struct kdc_tcp_connection
{
80 /* stream connection we belong to */
81 struct stream_connection
*conn
;
83 /* the kdc_server the connection belongs to */
84 struct kdc_server
*kdc
;
86 struct packet_context
*packet
;
88 kdc_process_fn_t process
;
92 handle fd send events on a KDC socket
94 static void kdc_send_handler(struct kdc_socket
*kdc_socket
)
96 while (kdc_socket
->send_queue
) {
97 struct kdc_reply
*rep
= kdc_socket
->send_queue
;
101 status
= socket_sendto(kdc_socket
->sock
, &rep
->packet
, &sendlen
,
103 if (NT_STATUS_EQUAL(status
, STATUS_MORE_ENTRIES
)) {
106 if (NT_STATUS_EQUAL(status
, NT_STATUS_INVALID_BUFFER_SIZE
)) {
107 /* Replace with a krb err, response to big */
110 DLIST_REMOVE(kdc_socket
->send_queue
, rep
);
114 if (kdc_socket
->send_queue
== NULL
) {
115 EVENT_FD_NOT_WRITEABLE(kdc_socket
->fde
);
121 handle fd recv events on a KDC socket
123 static void kdc_recv_handler(struct kdc_socket
*kdc_socket
)
126 TALLOC_CTX
*tmp_ctx
= talloc_new(kdc_socket
);
128 struct kdc_reply
*rep
;
131 struct socket_address
*src
;
132 struct socket_address
*my_addr
;
135 status
= socket_pending(kdc_socket
->sock
, &dsize
);
136 if (!NT_STATUS_IS_OK(status
)) {
137 talloc_free(tmp_ctx
);
141 blob
= data_blob_talloc(tmp_ctx
, NULL
, dsize
);
142 if (blob
.data
== NULL
) {
143 /* hope this is a temporary low memory condition */
144 talloc_free(tmp_ctx
);
148 status
= socket_recvfrom(kdc_socket
->sock
, blob
.data
, blob
.length
, &nread
,
150 if (!NT_STATUS_IS_OK(status
)) {
151 talloc_free(tmp_ctx
);
156 DEBUG(10,("Received krb5 UDP packet of length %lu from %s:%u\n",
157 (long)blob
.length
, src
->addr
, (uint16_t)src
->port
));
159 my_addr
= socket_get_my_addr(kdc_socket
->sock
, tmp_ctx
);
161 talloc_free(tmp_ctx
);
167 ret
= kdc_socket
->process(kdc_socket
->kdc
,
174 talloc_free(tmp_ctx
);
178 /* queue a pending reply */
179 rep
= talloc(kdc_socket
, struct kdc_reply
);
181 talloc_free(tmp_ctx
);
184 rep
->dest
= talloc_steal(rep
, src
);
186 talloc_steal(rep
, reply
.data
);
188 if (rep
->packet
.data
== NULL
) {
190 talloc_free(tmp_ctx
);
194 DLIST_ADD_END(kdc_socket
->send_queue
, rep
, struct kdc_reply
*);
195 EVENT_FD_WRITEABLE(kdc_socket
->fde
);
196 talloc_free(tmp_ctx
);
200 handle fd events on a KDC socket
202 static void kdc_socket_handler(struct tevent_context
*ev
, struct tevent_fd
*fde
,
203 uint16_t flags
, void *private_data
)
205 struct kdc_socket
*kdc_socket
= talloc_get_type(private_data
, struct kdc_socket
);
206 if (flags
& EVENT_FD_WRITE
) {
207 kdc_send_handler(kdc_socket
);
209 if (flags
& EVENT_FD_READ
) {
210 kdc_recv_handler(kdc_socket
);
214 static void kdc_tcp_terminate_connection(struct kdc_tcp_connection
*kdcconn
, const char *reason
)
216 stream_terminate_connection(kdcconn
->conn
, reason
);
220 receive a full packet on a KDC connection
222 static NTSTATUS
kdc_tcp_recv(void *private_data
, DATA_BLOB blob
)
224 struct kdc_tcp_connection
*kdcconn
= talloc_get_type(private_data
,
225 struct kdc_tcp_connection
);
226 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
227 TALLOC_CTX
*tmp_ctx
= talloc_new(kdcconn
);
229 DATA_BLOB input
, reply
;
230 struct socket_address
*src_addr
;
231 struct socket_address
*my_addr
;
233 talloc_steal(tmp_ctx
, blob
.data
);
235 src_addr
= socket_get_peer_addr(kdcconn
->conn
->socket
, tmp_ctx
);
237 talloc_free(tmp_ctx
);
238 return NT_STATUS_NO_MEMORY
;
241 my_addr
= socket_get_my_addr(kdcconn
->conn
->socket
, tmp_ctx
);
243 talloc_free(tmp_ctx
);
244 return NT_STATUS_NO_MEMORY
;
248 input
= data_blob_const(blob
.data
+ 4, blob
.length
- 4);
250 ret
= kdcconn
->process(kdcconn
->kdc
,
256 0 /* Not datagram */);
258 talloc_free(tmp_ctx
);
259 return NT_STATUS_INTERNAL_ERROR
;
262 /* and now encode the reply */
263 blob
= data_blob_talloc(kdcconn
, NULL
, reply
.length
+ 4);
265 talloc_free(tmp_ctx
);
266 return NT_STATUS_NO_MEMORY
;
269 RSIVAL(blob
.data
, 0, reply
.length
);
270 memcpy(blob
.data
+ 4, reply
.data
, reply
.length
);
272 status
= packet_send(kdcconn
->packet
, blob
);
273 if (!NT_STATUS_IS_OK(status
)) {
274 talloc_free(tmp_ctx
);
278 /* the call isn't needed any more */
279 talloc_free(tmp_ctx
);
284 receive some data on a KDC connection
286 static void kdc_tcp_recv_handler(struct stream_connection
*conn
, uint16_t flags
)
288 struct kdc_tcp_connection
*kdcconn
= talloc_get_type(conn
->private_data
,
289 struct kdc_tcp_connection
);
290 packet_recv(kdcconn
->packet
);
294 called on a tcp recv error
296 static void kdc_tcp_recv_error(void *private_data
, NTSTATUS status
)
298 struct kdc_tcp_connection
*kdcconn
= talloc_get_type(private_data
,
299 struct kdc_tcp_connection
);
300 kdc_tcp_terminate_connection(kdcconn
, nt_errstr(status
));
304 called when we can write to a connection
306 static void kdc_tcp_send(struct stream_connection
*conn
, uint16_t flags
)
308 struct kdc_tcp_connection
*kdcconn
= talloc_get_type(conn
->private_data
,
309 struct kdc_tcp_connection
);
310 packet_queue_run(kdcconn
->packet
);
314 Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
318 static bool kdc_process(struct kdc_server
*kdc
,
322 struct socket_address
*peer_addr
,
323 struct socket_address
*my_addr
,
328 krb5_data_zero(&k5_reply
);
330 krb5_kdc_update_time(NULL
);
332 DEBUG(10,("Received KDC packet of length %lu from %s:%d\n",
333 (long)input
->length
- 4, peer_addr
->addr
, peer_addr
->port
));
335 ret
= krb5_kdc_process_krb5_request(kdc
->smb_krb5_context
->krb5_context
,
337 input
->data
, input
->length
,
343 *reply
= data_blob(NULL
, 0);
346 if (k5_reply
.length
) {
347 *reply
= data_blob_talloc(mem_ctx
, k5_reply
.data
, k5_reply
.length
);
348 krb5_data_free(&k5_reply
);
350 *reply
= data_blob(NULL
, 0);
356 called when we get a new connection
358 static void kdc_tcp_generic_accept(struct stream_connection
*conn
, kdc_process_fn_t process_fn
)
360 struct kdc_server
*kdc
= talloc_get_type(conn
->private_data
, struct kdc_server
);
361 struct kdc_tcp_connection
*kdcconn
;
363 kdcconn
= talloc_zero(conn
, struct kdc_tcp_connection
);
365 stream_terminate_connection(conn
, "kdc_tcp_accept: out of memory");
368 kdcconn
->conn
= conn
;
370 kdcconn
->process
= process_fn
;
371 conn
->private_data
= kdcconn
;
373 kdcconn
->packet
= packet_init(kdcconn
);
374 if (kdcconn
->packet
== NULL
) {
375 kdc_tcp_terminate_connection(kdcconn
, "kdc_tcp_accept: out of memory");
378 packet_set_private(kdcconn
->packet
, kdcconn
);
379 packet_set_socket(kdcconn
->packet
, conn
->socket
);
380 packet_set_callback(kdcconn
->packet
, kdc_tcp_recv
);
381 packet_set_full_request(kdcconn
->packet
, packet_full_request_u32
);
382 packet_set_error_handler(kdcconn
->packet
, kdc_tcp_recv_error
);
383 packet_set_event_context(kdcconn
->packet
, conn
->event
.ctx
);
384 packet_set_fde(kdcconn
->packet
, conn
->event
.fde
);
385 packet_set_serialise(kdcconn
->packet
);
388 static void kdc_tcp_accept(struct stream_connection
*conn
)
390 kdc_tcp_generic_accept(conn
, kdc_process
);
393 static const struct stream_server_ops kdc_tcp_stream_ops
= {
395 .accept_connection
= kdc_tcp_accept
,
396 .recv_handler
= kdc_tcp_recv_handler
,
397 .send_handler
= kdc_tcp_send
400 static void kpasswdd_tcp_accept(struct stream_connection
*conn
)
402 kdc_tcp_generic_accept(conn
, kpasswdd_process
);
405 static const struct stream_server_ops kpasswdd_tcp_stream_ops
= {
406 .name
= "kpasswdd_tcp",
407 .accept_connection
= kpasswdd_tcp_accept
,
408 .recv_handler
= kdc_tcp_recv_handler
,
409 .send_handler
= kdc_tcp_send
413 start listening on the given address
415 static NTSTATUS
kdc_add_socket(struct kdc_server
*kdc
,
416 const struct model_ops
*model_ops
,
420 const struct stream_server_ops
*tcp_stream_ops
,
421 kdc_process_fn_t process
)
423 struct kdc_socket
*kdc_socket
;
424 struct socket_address
*socket_address
;
427 kdc_socket
= talloc(kdc
, struct kdc_socket
);
428 NT_STATUS_HAVE_NO_MEMORY(kdc_socket
);
430 status
= socket_create("ip", SOCKET_TYPE_DGRAM
, &kdc_socket
->sock
, 0);
431 if (!NT_STATUS_IS_OK(status
)) {
432 talloc_free(kdc_socket
);
436 kdc_socket
->kdc
= kdc
;
437 kdc_socket
->send_queue
= NULL
;
438 kdc_socket
->process
= process
;
440 talloc_steal(kdc_socket
, kdc_socket
->sock
);
442 kdc_socket
->fde
= event_add_fd(kdc
->task
->event_ctx
, kdc
,
443 socket_get_fd(kdc_socket
->sock
), EVENT_FD_READ
,
444 kdc_socket_handler
, kdc_socket
);
446 socket_address
= socket_address_from_strings(kdc_socket
, kdc_socket
->sock
->backend_name
,
448 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(socket_address
, kdc_socket
);
450 status
= socket_listen(kdc_socket
->sock
, socket_address
, 0, 0);
451 if (!NT_STATUS_IS_OK(status
)) {
452 DEBUG(0,("Failed to bind to %s:%d UDP for %s - %s\n",
453 address
, port
, name
, nt_errstr(status
)));
454 talloc_free(kdc_socket
);
458 status
= stream_setup_socket(kdc
->task
->event_ctx
,
462 "ip", address
, &port
,
463 lp_socket_options(kdc
->task
->lp_ctx
),
465 if (!NT_STATUS_IS_OK(status
)) {
466 DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
467 address
, port
, nt_errstr(status
)));
468 talloc_free(kdc_socket
);
477 setup our listening sockets on the configured network interfaces
479 static NTSTATUS
kdc_startup_interfaces(struct kdc_server
*kdc
, struct loadparm_context
*lp_ctx
,
480 struct interface
*ifaces
)
482 const struct model_ops
*model_ops
;
484 TALLOC_CTX
*tmp_ctx
= talloc_new(kdc
);
488 /* within the kdc task we want to be a single process, so
489 ask for the single process model ops and pass these to the
490 stream_setup_socket() call. */
491 model_ops
= process_model_startup(kdc
->task
->event_ctx
, "single");
493 DEBUG(0,("Can't find 'single' process model_ops\n"));
494 return NT_STATUS_INTERNAL_ERROR
;
497 num_interfaces
= iface_count(ifaces
);
499 for (i
=0; i
<num_interfaces
; i
++) {
500 const char *address
= talloc_strdup(tmp_ctx
, iface_n_ip(ifaces
, i
));
501 uint16_t kdc_port
= lp_krb5_port(lp_ctx
);
502 uint16_t kpasswd_port
= lp_kpasswd_port(lp_ctx
);
505 status
= kdc_add_socket(kdc
, model_ops
,
506 "kdc", address
, kdc_port
,
509 NT_STATUS_NOT_OK_RETURN(status
);
513 status
= kdc_add_socket(kdc
, model_ops
,
514 "kpasswd", address
, kpasswd_port
,
515 &kpasswdd_tcp_stream_ops
,
517 NT_STATUS_NOT_OK_RETURN(status
);
521 talloc_free(tmp_ctx
);
527 static NTSTATUS
kdc_check_generic_kerberos(struct irpc_message
*msg
,
528 struct kdc_check_generic_kerberos
*r
)
530 struct PAC_Validate pac_validate
;
532 struct PAC_SIGNATURE_DATA kdc_sig
;
533 struct kdc_server
*kdc
= talloc_get_type(msg
->private_data
, struct kdc_server
);
534 enum ndr_err_code ndr_err
;
538 krb5_principal principal
;
539 krb5_keyblock keyblock
;
542 /* There is no reply to this request */
543 r
->out
.generic_reply
= data_blob(NULL
, 0);
545 ndr_err
= ndr_pull_struct_blob(&r
->in
.generic_request
, msg
,
546 lp_iconv_convenience(kdc
->task
->lp_ctx
),
548 (ndr_pull_flags_fn_t
)ndr_pull_PAC_Validate
);
549 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
550 return NT_STATUS_INVALID_PARAMETER
;
553 if (pac_validate
.MessageType
!= 3) {
554 /* We don't implement any other message types - such as certificate validation - yet */
555 return NT_STATUS_INVALID_PARAMETER
;
558 if (pac_validate
.ChecksumAndSignature
.length
!= (pac_validate
.ChecksumLength
+ pac_validate
.SignatureLength
)
559 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.ChecksumLength
560 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.SignatureLength
) {
561 return NT_STATUS_INVALID_PARAMETER
;
564 srv_sig
= data_blob_const(pac_validate
.ChecksumAndSignature
.data
,
565 pac_validate
.ChecksumLength
);
567 if (pac_validate
.SignatureType
== CKSUMTYPE_HMAC_MD5
) {
568 etype
= ETYPE_ARCFOUR_HMAC_MD5
;
570 ret
= krb5_cksumtype_to_enctype(kdc
->smb_krb5_context
->krb5_context
, pac_validate
.SignatureType
,
573 return NT_STATUS_LOGON_FAILURE
;
577 ret
= krb5_make_principal(kdc
->smb_krb5_context
->krb5_context
, &principal
,
578 lp_realm(kdc
->task
->lp_ctx
),
579 "krbtgt", lp_realm(kdc
->task
->lp_ctx
),
583 return NT_STATUS_NO_MEMORY
;
586 ret
= kdc
->config
->db
[0]->hdb_fetch(kdc
->smb_krb5_context
->krb5_context
,
589 HDB_F_GET_KRBTGT
| HDB_F_DECRYPT
,
593 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, &ent
);
594 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
596 return NT_STATUS_LOGON_FAILURE
;
599 ret
= hdb_enctype2key(kdc
->smb_krb5_context
->krb5_context
, &ent
.entry
, etype
, &key
);
602 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, &ent
);
603 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
604 return NT_STATUS_LOGON_FAILURE
;
609 kdc_sig
.type
= pac_validate
.SignatureType
;
610 kdc_sig
.signature
= data_blob_const(&pac_validate
.ChecksumAndSignature
.data
[pac_validate
.ChecksumLength
],
611 pac_validate
.SignatureLength
);
612 ret
= check_pac_checksum(msg
, srv_sig
, &kdc_sig
,
613 kdc
->smb_krb5_context
->krb5_context
, &keyblock
);
615 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, &ent
);
616 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
619 return NT_STATUS_LOGON_FAILURE
;
629 static void kdc_task_init(struct task_server
*task
)
631 struct kdc_server
*kdc
;
634 struct interface
*ifaces
;
636 switch (lp_server_role(task
->lp_ctx
)) {
637 case ROLE_STANDALONE
:
638 task_server_terminate(task
, "kdc: no KDC required in standalone configuration", false);
640 case ROLE_DOMAIN_MEMBER
:
641 task_server_terminate(task
, "kdc: no KDC required in member server configuration", false);
643 case ROLE_DOMAIN_CONTROLLER
:
644 /* Yes, we want a KDC */
648 load_interfaces(task
, lp_interfaces(task
->lp_ctx
), &ifaces
);
650 if (iface_count(ifaces
) == 0) {
651 task_server_terminate(task
, "kdc: no network interfaces configured", false);
655 task_server_set_title(task
, "task[kdc]");
657 kdc
= talloc(task
, struct kdc_server
);
659 task_server_terminate(task
, "kdc: out of memory", true);
665 initialize_krb5_error_table();
667 ret
= smb_krb5_init_context(kdc
, task
->event_ctx
, task
->lp_ctx
, &kdc
->smb_krb5_context
);
669 DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n",
670 error_message(ret
)));
671 task_server_terminate(task
, "kdc: krb5_init_context failed", true);
675 krb5_add_et_list(kdc
->smb_krb5_context
->krb5_context
, initialize_hdb_error_table_r
);
677 ret
= krb5_kdc_get_config(kdc
->smb_krb5_context
->krb5_context
,
680 task_server_terminate(task
, "kdc: failed to get KDC configuration", true);
684 kdc
->config
->logf
= kdc
->smb_krb5_context
->logf
;
685 kdc
->config
->db
= talloc(kdc
, struct HDB
*);
686 if (!kdc
->config
->db
) {
687 task_server_terminate(task
, "kdc: out of memory", true);
690 kdc
->config
->num_db
= 1;
692 status
= hdb_samba4_create_kdc(kdc
, task
->event_ctx
, task
->lp_ctx
,
693 kdc
->smb_krb5_context
->krb5_context
,
694 &kdc
->config
->db
[0]);
695 if (!NT_STATUS_IS_OK(status
)) {
696 task_server_terminate(task
, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
700 /* Register hdb-samba4 hooks for use as a keytab */
702 kdc
->hdb_samba4_context
= talloc(kdc
, struct hdb_samba4_context
);
703 if (!kdc
->hdb_samba4_context
) {
704 task_server_terminate(task
, "kdc: out of memory", true);
708 kdc
->hdb_samba4_context
->ev_ctx
= task
->event_ctx
;
709 kdc
->hdb_samba4_context
->lp_ctx
= task
->lp_ctx
;
711 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
712 PLUGIN_TYPE_DATA
, "hdb",
715 task_server_terminate(task
, "kdc: failed to register hdb keytab", true);
719 ret
= krb5_kt_register(kdc
->smb_krb5_context
->krb5_context
, &hdb_kt_ops
);
721 task_server_terminate(task
, "kdc: failed to register hdb keytab", true);
725 /* Registar WinDC hooks */
726 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
727 PLUGIN_TYPE_DATA
, "windc",
728 &windc_plugin_table
);
730 task_server_terminate(task
, "kdc: failed to register hdb keytab", true);
734 krb5_kdc_windc_init(kdc
->smb_krb5_context
->krb5_context
);
736 /* start listening on the configured network interfaces */
737 status
= kdc_startup_interfaces(kdc
, task
->lp_ctx
, ifaces
);
738 if (!NT_STATUS_IS_OK(status
)) {
739 task_server_terminate(task
, "kdc failed to setup interfaces", true);
743 status
= IRPC_REGISTER(task
->msg_ctx
, irpc
, KDC_CHECK_GENERIC_KERBEROS
,
744 kdc_check_generic_kerberos
, kdc
);
745 if (!NT_STATUS_IS_OK(status
)) {
746 task_server_terminate(task
, "nbtd failed to setup monitoring", true);
750 irpc_add_name(task
->msg_ctx
, "kdc_server");
754 /* called at smbd startup - register ourselves as a server service */
755 NTSTATUS
server_service_kdc_init(void)
757 return register_server_service("kdc", kdc_task_init
);