2 Unix SMB/CIFS implementation.
4 NTP packet signing server
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 Copyright (C) Andrew Tridgell 2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "smbd/service_task.h"
26 #include "smbd/service.h"
27 #include "smbd/service_stream.h"
28 #include "smbd/process_model.h"
29 #include "lib/stream/packet.h"
30 #include "lib/tsocket/tsocket.h"
31 #include "libcli/util/tstream.h"
32 #include "librpc/gen_ndr/ndr_ntp_signd.h"
33 #include "param/param.h"
34 #include "dsdb/samdb/samdb.h"
35 #include "auth/auth.h"
36 #include "libcli/security/security.h"
37 #include "lib/ldb/include/ldb.h"
38 #include "lib/ldb/include/ldb_errors.h"
39 #include "../lib/crypto/md5.h"
40 #include "system/network.h"
41 #include "system/passwd.h"
44 top level context structure for the ntp_signd server
46 struct ntp_signd_server
{
47 struct task_server
*task
;
48 struct ldb_context
*samdb
;
52 state of an open connection
54 struct ntp_signd_connection
{
55 /* stream connection we belong to */
56 struct stream_connection
*conn
;
58 /* the ntp_signd_server the connection belongs to */
59 struct ntp_signd_server
*ntp_signd
;
61 struct tstream_context
*tstream
;
63 struct tevent_queue
*send_queue
;
66 static void ntp_signd_terminate_connection(struct ntp_signd_connection
*ntp_signd_conn
, const char *reason
)
68 stream_terminate_connection(ntp_signd_conn
->conn
, reason
);
71 static NTSTATUS
signing_failure(struct ntp_signd_connection
*ntp_signdconn
,
76 struct signed_reply signed_reply
;
77 enum ndr_err_code ndr_err
;
79 signed_reply
.op
= SIGNING_FAILURE
;
80 signed_reply
.packet_id
= packet_id
;
81 signed_reply
.signed_packet
= data_blob(NULL
, 0);
83 ndr_err
= ndr_push_struct_blob(output
, mem_ctx
, &signed_reply
,
84 (ndr_push_flags_fn_t
)ndr_push_signed_reply
);
86 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
87 DEBUG(1,("failed to push ntp error reply\n"));
88 return ndr_map_error2ntstatus(ndr_err
);
95 receive a full packet on a NTP_SIGND connection
97 static NTSTATUS
ntp_signd_process(struct ntp_signd_connection
*ntp_signd_conn
,
102 const struct dom_sid
*domain_sid
;
104 struct sign_request sign_request
;
105 struct signed_reply signed_reply
;
106 enum ndr_err_code ndr_err
;
107 struct ldb_result
*res
;
108 const char *attrs
[] = { "unicodePwd", "userAccountControl", "cn", NULL
};
109 struct MD5Context ctx
;
110 struct samr_Password
*nt_hash
;
111 uint32_t user_account_control
;
114 ndr_err
= ndr_pull_struct_blob_all(input
, mem_ctx
,
116 (ndr_pull_flags_fn_t
)ndr_pull_sign_request
);
118 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
119 DEBUG(1,("failed to parse ntp signing request\n"));
120 dump_data(1, input
->data
, input
->length
);
121 return ndr_map_error2ntstatus(ndr_err
);
124 /* We need to implement 'check signature' and 'request server
125 * to sign' operations at some point */
126 if (sign_request
.op
!= SIGN_TO_CLIENT
) {
127 return signing_failure(ntp_signd_conn
,
130 sign_request
.packet_id
);
133 /* We need to implement 'check signature' and 'request server
134 * to sign' operations at some point */
135 if (sign_request
.version
!= NTP_SIGND_PROTOCOL_VERSION_0
) {
136 return signing_failure(ntp_signd_conn
,
139 sign_request
.packet_id
);
142 domain_sid
= samdb_domain_sid(ntp_signd_conn
->ntp_signd
->samdb
);
143 if (domain_sid
== NULL
) {
144 return signing_failure(ntp_signd_conn
,
147 sign_request
.packet_id
);
150 /* The top bit is a 'key selector' */
151 sid
= dom_sid_add_rid(mem_ctx
, domain_sid
,
152 sign_request
.key_id
& 0x7FFFFFFF);
154 talloc_free(mem_ctx
);
155 return signing_failure(ntp_signd_conn
,
158 sign_request
.packet_id
);
161 ret
= ldb_search(ntp_signd_conn
->ntp_signd
->samdb
, mem_ctx
,
163 ldb_get_default_basedn(ntp_signd_conn
->ntp_signd
->samdb
),
166 "(&(objectSid=%s)(objectClass=user))",
167 dom_sid_string(mem_ctx
, sid
));
168 if (ret
!= LDB_SUCCESS
) {
169 DEBUG(2, ("Failed to search for SID %s in SAM for NTP signing: "
171 dom_sid_string(mem_ctx
, sid
),
172 ldb_errstring(ntp_signd_conn
->ntp_signd
->samdb
)));
173 return signing_failure(ntp_signd_conn
,
176 sign_request
.packet_id
);
179 if (res
->count
== 0) {
180 DEBUG(5, ("Failed to find SID %s in SAM for NTP signing\n",
181 dom_sid_string(mem_ctx
, sid
)));
182 } else if (res
->count
!= 1) {
183 DEBUG(1, ("Found SID %s %u times in SAM for NTP signing\n",
184 dom_sid_string(mem_ctx
, sid
), res
->count
));
185 return signing_failure(ntp_signd_conn
,
188 sign_request
.packet_id
);
191 user_account_control
= ldb_msg_find_attr_as_uint(res
->msgs
[0],
192 "userAccountControl",
195 if (user_account_control
& UF_ACCOUNTDISABLE
) {
196 DEBUG(1, ("Account %s for SID [%s] is disabled\n",
197 ldb_dn_get_linearized(res
->msgs
[0]->dn
),
198 dom_sid_string(mem_ctx
, sid
)));
199 return NT_STATUS_ACCESS_DENIED
;
202 if (!(user_account_control
& (UF_INTERDOMAIN_TRUST_ACCOUNT
|UF_SERVER_TRUST_ACCOUNT
|UF_WORKSTATION_TRUST_ACCOUNT
))) {
203 DEBUG(1, ("Account %s for SID [%s] is not a trust account\n",
204 ldb_dn_get_linearized(res
->msgs
[0]->dn
),
205 dom_sid_string(mem_ctx
, sid
)));
206 return NT_STATUS_ACCESS_DENIED
;
209 nt_hash
= samdb_result_hash(mem_ctx
, res
->msgs
[0], "unicodePwd");
211 DEBUG(1, ("No unicodePwd found on record of SID %s "
212 "for NTP signing\n", dom_sid_string(mem_ctx
, sid
)));
213 return signing_failure(ntp_signd_conn
,
216 sign_request
.packet_id
);
219 /* Generate the reply packet */
220 signed_reply
.packet_id
= sign_request
.packet_id
;
221 signed_reply
.op
= SIGNING_SUCCESS
;
222 signed_reply
.signed_packet
= data_blob_talloc(mem_ctx
,
224 sign_request
.packet_to_sign
.length
+ 20);
226 if (!signed_reply
.signed_packet
.data
) {
227 return signing_failure(ntp_signd_conn
,
230 sign_request
.packet_id
);
233 memcpy(signed_reply
.signed_packet
.data
, sign_request
.packet_to_sign
.data
, sign_request
.packet_to_sign
.length
);
234 SIVAL(signed_reply
.signed_packet
.data
, sign_request
.packet_to_sign
.length
, sign_request
.key_id
);
236 /* Sign the NTP response with the unicodePwd */
238 MD5Update(&ctx
, nt_hash
->hash
, sizeof(nt_hash
->hash
));
239 MD5Update(&ctx
, sign_request
.packet_to_sign
.data
, sign_request
.packet_to_sign
.length
);
240 MD5Final(signed_reply
.signed_packet
.data
+ sign_request
.packet_to_sign
.length
+ 4, &ctx
);
243 /* Place it into the packet for the wire */
244 ndr_err
= ndr_push_struct_blob(output
, mem_ctx
, &signed_reply
,
245 (ndr_push_flags_fn_t
)ndr_push_signed_reply
);
247 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
248 DEBUG(1,("failed to push ntp error reply\n"));
249 return ndr_map_error2ntstatus(ndr_err
);
258 static void ntp_signd_recv(struct stream_connection
*conn
, uint16_t flags
)
260 struct ntp_signd_connection
*ntp_signd_conn
= talloc_get_type(conn
->private_data
,
261 struct ntp_signd_connection
);
262 ntp_signd_terminate_connection(ntp_signd_conn
,
263 "ntp_signd_recv: called");
267 called when we can write to a connection
269 static void ntp_signd_send(struct stream_connection
*conn
, uint16_t flags
)
271 struct ntp_signd_connection
*ntp_signd_conn
= talloc_get_type(conn
->private_data
,
272 struct ntp_signd_connection
);
273 /* this should never be triggered! */
274 ntp_signd_terminate_connection(ntp_signd_conn
,
275 "ntp_signd_send: called");
278 struct ntp_signd_call
{
279 struct ntp_signd_connection
*ntp_signd_conn
;
283 struct iovec out_iov
[2];
286 static void ntp_signd_call_writev_done(struct tevent_req
*subreq
);
288 static void ntp_signd_call_loop(struct tevent_req
*subreq
)
290 struct ntp_signd_connection
*ntp_signd_conn
= tevent_req_callback_data(subreq
,
291 struct ntp_signd_connection
);
292 struct ntp_signd_call
*call
;
295 call
= talloc(ntp_signd_conn
, struct ntp_signd_call
);
297 ntp_signd_terminate_connection(ntp_signd_conn
,
298 "ntp_signd_call_loop: "
299 "no memory for ntp_signd_call");
302 call
->ntp_signd_conn
= ntp_signd_conn
;
304 status
= tstream_read_pdu_blob_recv(subreq
,
308 if (!NT_STATUS_IS_OK(status
)) {
311 reason
= talloc_asprintf(call
, "ntp_signd_call_loop: "
312 "tstream_read_pdu_blob_recv() - %s",
314 if (reason
== NULL
) {
315 reason
= nt_errstr(status
);
318 ntp_signd_terminate_connection(ntp_signd_conn
, reason
);
322 DEBUG(10,("Received NTP TCP packet of length %lu from %s\n",
323 (long) call
->in
.length
,
324 tsocket_address_string(ntp_signd_conn
->conn
->remote_address
, call
)));
326 /* skip length header */
328 call
->in
.length
-= 4;
330 status
= ntp_signd_process(ntp_signd_conn
,
334 if (! NT_STATUS_IS_OK(status
)) {
337 reason
= talloc_asprintf(call
, "ntp_signd_process failed: %s",
339 if (reason
== NULL
) {
340 reason
= nt_errstr(status
);
343 ntp_signd_terminate_connection(ntp_signd_conn
, reason
);
347 /* First add the length of the out buffer */
348 RSIVAL(call
->out_hdr
, 0, call
->out
.length
);
349 call
->out_iov
[0].iov_base
= (char *) call
->out_hdr
;
350 call
->out_iov
[0].iov_len
= 4;
352 call
->out_iov
[1].iov_base
= (char *) call
->out
.data
;
353 call
->out_iov
[1].iov_len
= call
->out
.length
;
355 subreq
= tstream_writev_queue_send(call
,
356 ntp_signd_conn
->conn
->event
.ctx
,
357 ntp_signd_conn
->tstream
,
358 ntp_signd_conn
->send_queue
,
360 if (subreq
== NULL
) {
361 ntp_signd_terminate_connection(ntp_signd_conn
, "ntp_signd_call_loop: "
362 "no memory for tstream_writev_queue_send");
366 tevent_req_set_callback(subreq
, ntp_signd_call_writev_done
, call
);
369 * The NTP tcp pdu's has the length as 4 byte (initial_read_size),
370 * packet_full_request_u32 provides the pdu length then.
372 subreq
= tstream_read_pdu_blob_send(ntp_signd_conn
,
373 ntp_signd_conn
->conn
->event
.ctx
,
374 ntp_signd_conn
->tstream
,
375 4, /* initial_read_size */
376 packet_full_request_u32
,
378 if (subreq
== NULL
) {
379 ntp_signd_terminate_connection(ntp_signd_conn
, "ntp_signd_call_loop: "
380 "no memory for tstream_read_pdu_blob_send");
383 tevent_req_set_callback(subreq
, ntp_signd_call_loop
, ntp_signd_conn
);
386 static void ntp_signd_call_writev_done(struct tevent_req
*subreq
)
388 struct ntp_signd_call
*call
= tevent_req_callback_data(subreq
,
389 struct ntp_signd_call
);
393 rc
= tstream_writev_queue_recv(subreq
, &sys_errno
);
398 reason
= talloc_asprintf(call
, "ntp_signd_call_writev_done: "
399 "tstream_writev_queue_recv() - %d:%s",
400 sys_errno
, strerror(sys_errno
));
402 reason
= "ntp_signd_call_writev_done: "
403 "tstream_writev_queue_recv() failed";
406 ntp_signd_terminate_connection(call
->ntp_signd_conn
, reason
);
410 /* We don't care about errors */
416 called when we get a new connection
418 static void ntp_signd_accept(struct stream_connection
*conn
)
420 struct ntp_signd_server
*ntp_signd
= talloc_get_type(conn
->private_data
,
421 struct ntp_signd_server
);
422 struct ntp_signd_connection
*ntp_signd_conn
;
423 struct tevent_req
*subreq
;
426 ntp_signd_conn
= talloc_zero(conn
, struct ntp_signd_connection
);
427 if (ntp_signd_conn
== NULL
) {
428 stream_terminate_connection(conn
,
429 "ntp_signd_accept: out of memory");
433 ntp_signd_conn
->send_queue
= tevent_queue_create(conn
,
435 if (ntp_signd_conn
->send_queue
== NULL
) {
436 stream_terminate_connection(conn
,
437 "ntp_signd_accept: out of memory");
441 TALLOC_FREE(conn
->event
.fde
);
443 rc
= tstream_bsd_existing_socket(ntp_signd_conn
,
444 socket_get_fd(conn
->socket
),
445 &ntp_signd_conn
->tstream
);
447 stream_terminate_connection(conn
,
448 "ntp_signd_accept: out of memory");
452 ntp_signd_conn
->conn
= conn
;
453 ntp_signd_conn
->ntp_signd
= ntp_signd
;
454 conn
->private_data
= ntp_signd_conn
;
457 * The NTP tcp pdu's has the length as 4 byte (initial_read_size),
458 * packet_full_request_u32 provides the pdu length then.
460 subreq
= tstream_read_pdu_blob_send(ntp_signd_conn
,
461 ntp_signd_conn
->conn
->event
.ctx
,
462 ntp_signd_conn
->tstream
,
463 4, /* initial_read_size */
464 packet_full_request_u32
,
466 if (subreq
== NULL
) {
467 ntp_signd_terminate_connection(ntp_signd_conn
,
469 "no memory for tstream_read_pdu_blob_send");
472 tevent_req_set_callback(subreq
, ntp_signd_call_loop
, ntp_signd_conn
);
475 static const struct stream_server_ops ntp_signd_stream_ops
= {
477 .accept_connection
= ntp_signd_accept
,
478 .recv_handler
= ntp_signd_recv
,
479 .send_handler
= ntp_signd_send
483 startup the ntp_signd task
485 static void ntp_signd_task_init(struct task_server
*task
)
487 struct ntp_signd_server
*ntp_signd
;
490 const struct model_ops
*model_ops
;
494 if (!directory_create_or_exist(lpcfg_ntp_signd_socket_directory(task
->lp_ctx
), geteuid(), 0755)) {
495 char *error
= talloc_asprintf(task
, "Cannot create NTP signd pipe directory: %s",
496 lpcfg_ntp_signd_socket_directory(task
->lp_ctx
));
497 task_server_terminate(task
,
502 /* within the ntp_signd task we want to be a single process, so
503 ask for the single process model ops and pass these to the
504 stream_setup_socket() call. */
505 model_ops
= process_model_startup(task
->event_ctx
, "single");
507 DEBUG(0,("Can't find 'single' process model_ops\n"));
511 task_server_set_title(task
, "task[ntp_signd]");
513 ntp_signd
= talloc(task
, struct ntp_signd_server
);
514 if (ntp_signd
== NULL
) {
515 task_server_terminate(task
, "ntp_signd: out of memory", true);
519 ntp_signd
->task
= task
;
521 /* Must be system to get at the password hashes */
522 ntp_signd
->samdb
= samdb_connect(ntp_signd
, task
->event_ctx
, task
->lp_ctx
, system_session(task
->lp_ctx
));
523 if (ntp_signd
->samdb
== NULL
) {
524 task_server_terminate(task
, "ntp_signd failed to open samdb", true);
528 address
= talloc_asprintf(ntp_signd
, "%s/socket", lpcfg_ntp_signd_socket_directory(task
->lp_ctx
));
530 status
= stream_setup_socket(ntp_signd
->task
->event_ctx
,
531 ntp_signd
->task
->lp_ctx
,
533 &ntp_signd_stream_ops
,
534 "unix", address
, NULL
,
535 lpcfg_socket_options(ntp_signd
->task
->lp_ctx
),
537 if (!NT_STATUS_IS_OK(status
)) {
538 DEBUG(0,("Failed to bind to %s - %s\n",
539 address
, nt_errstr(status
)));
546 /* called at smbd startup - register ourselves as a server service */
547 NTSTATUS
server_service_ntp_signd_init(void)
549 return register_server_service("ntp_signd", ntp_signd_task_init
);