?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Windows Installer: Add missing Package properties
[heimdal.git] / lib / hdb / hdb-ldap.c
blobd748e0760ab6c1f3958171471b34516cbead3be3
1 /*
2 * Copyright (c) 1999-2001, 2003, PADL Software Pty Ltd.
3 * Copyright (c) 2004, Andrew Bartlett.
4 * Copyright (c) 2003 - 2008, Kungliga Tekniska Högskolan.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 *
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * 3. Neither the name of PADL Software nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 */
34
35 #include "hdb_locl.h"
36
37 #ifdef OPENLDAP
38
39 #include <lber.h>
40 #include <ldap.h>
41 #include <sys/un.h>
42 #include <hex.h>
43
44 static krb5_error_code LDAP__connect(krb5_context context, HDB *);
45 static krb5_error_code LDAP_close(krb5_context context, HDB *);
46
47 static krb5_error_code
48 LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
49 int flags, hdb_entry_ex * ent);
50
51 static const char *default_structural_object = "account";
52 static char *structural_object;
53 static const char *default_ldap_url = "ldapi:///";
54 static krb5_boolean samba_forwardable;
55
56 struct hdbldapdb {
57 LDAP *h_lp;
58 int h_msgid;
59 char *h_base;
60 char *h_url;
61 char *h_bind_dn;
62 char *h_bind_password;
63 krb5_boolean h_start_tls;
64 char *h_createbase;
65 };
66
67 #define HDB2LDAP(db) (((struct hdbldapdb *)(db)->hdb_db)->h_lp)
68 #define HDB2MSGID(db) (((struct hdbldapdb *)(db)->hdb_db)->h_msgid)
69 #define HDBSETMSGID(db,msgid) \
70 do { ((struct hdbldapdb *)(db)->hdb_db)->h_msgid = msgid; } while(0)
71 #define HDB2BASE(dn) (((struct hdbldapdb *)(db)->hdb_db)->h_base)
72 #define HDB2URL(dn) (((struct hdbldapdb *)(db)->hdb_db)->h_url)
73 #define HDB2BINDDN(db) (((struct hdbldapdb *)(db)->hdb_db)->h_bind_dn)
74 #define HDB2BINDPW(db) (((struct hdbldapdb *)(db)->hdb_db)->h_bind_password)
75 #define HDB2CREATE(db) (((struct hdbldapdb *)(db)->hdb_db)->h_createbase)
76
77 /*
78 *
79 */
80
81 static char * krb5kdcentry_attrs[] = {
82 "cn",
83 "createTimestamp",
84 "creatorsName",
85 "krb5EncryptionType",
86 "krb5KDCFlags",
87 "krb5Key",
88 "krb5KeyVersionNumber",
89 "krb5MaxLife",
90 "krb5MaxRenew",
91 "krb5PasswordEnd",
92 "krb5PrincipalName",
93 "krb5PrincipalRealm",
94 "krb5ValidEnd",
95 "krb5ValidStart",
96 "modifiersName",
97 "modifyTimestamp",
98 "objectClass",
99 "sambaAcctFlags",
100 "sambaKickoffTime",
101 "sambaNTPassword",
102 "sambaPwdLastSet",
103 "sambaPwdMustChange",
104 "uid",
105 NULL
106 };
107
108 static char *krb5principal_attrs[] = {
109 "cn",
110 "createTimestamp",
111 "creatorsName",
112 "krb5PrincipalName",
113 "krb5PrincipalRealm",
114 "modifiersName",
115 "modifyTimestamp",
116 "objectClass",
117 "uid",
118 NULL
119 };
120
121 static int
122 LDAP_no_size_limit(krb5_context context, LDAP *lp)
123 {
124 int ret, limit = LDAP_NO_LIMIT;
125
126 ret = ldap_set_option(lp, LDAP_OPT_SIZELIMIT, (const void *)&limit);
127 if (ret != LDAP_SUCCESS) {
128 krb5_set_error_message(context, HDB_ERR_BADVERSION,
129 "ldap_set_option: %s",
130 ldap_err2string(ret));
131 return HDB_ERR_BADVERSION;
132 }
133 return 0;
134 }
135
136 static int
137 check_ldap(krb5_context context, HDB *db, int ret)
138 {
139 switch (ret) {
140 case LDAP_SUCCESS:
141 return 0;
142 case LDAP_SERVER_DOWN:
143 LDAP_close(context, db);
144 return 1;
145 default:
146 return 1;
147 }
148 }
149
150 static krb5_error_code
151 LDAP__setmod(LDAPMod *** modlist, int modop, const char *attribute,
152 int *pIndex)
153 {
154 int cMods;
155
156 if (*modlist == NULL) {
157 *modlist = (LDAPMod **)ber_memcalloc(1, sizeof(LDAPMod *));
158 if (*modlist == NULL)
159 return ENOMEM;
160 }
161
162 for (cMods = 0; (*modlist)[cMods] != NULL; cMods++) {
163 if ((*modlist)[cMods]->mod_op == modop &&
164 strcasecmp((*modlist)[cMods]->mod_type, attribute) == 0) {
165 break;
166 }
167 }
168
169 *pIndex = cMods;
170
171 if ((*modlist)[cMods] == NULL) {
172 LDAPMod *mod;
173
174 *modlist = (LDAPMod **)ber_memrealloc(*modlist,
175 (cMods + 2) * sizeof(LDAPMod *));
176 if (*modlist == NULL)
177 return ENOMEM;
178
179 (*modlist)[cMods] = (LDAPMod *)ber_memalloc(sizeof(LDAPMod));
180 if ((*modlist)[cMods] == NULL)
181 return ENOMEM;
182
183 mod = (*modlist)[cMods];
184 mod->mod_op = modop;
185 mod->mod_type = ber_strdup(attribute);
186 if (mod->mod_type == NULL) {
187 ber_memfree(mod);
188 (*modlist)[cMods] = NULL;
189 return ENOMEM;
190 }
191
192 if (modop & LDAP_MOD_BVALUES) {
193 mod->mod_bvalues = NULL;
194 } else {
195 mod->mod_values = NULL;
196 }
197
198 (*modlist)[cMods + 1] = NULL;
199 }
200
201 return 0;
202 }
203
204 static krb5_error_code
205 LDAP_addmod_len(LDAPMod *** modlist, int modop, const char *attribute,
206 unsigned char *value, size_t len)
207 {
208 krb5_error_code ret;
209 int cMods, i = 0;
210
211 ret = LDAP__setmod(modlist, modop | LDAP_MOD_BVALUES, attribute, &cMods);
212 if (ret)
213 return ret;
214
215 if (value != NULL) {
216 struct berval **bv;
217
218 bv = (*modlist)[cMods]->mod_bvalues;
219 if (bv != NULL) {
220 for (i = 0; bv[i] != NULL; i++)
221 ;
222 bv = ber_memrealloc(bv, (i + 2) * sizeof(*bv));
223 } else
224 bv = ber_memalloc(2 * sizeof(*bv));
225 if (bv == NULL)
226 return ENOMEM;
227
228 (*modlist)[cMods]->mod_bvalues = bv;
229
230 bv[i] = ber_memalloc(sizeof(**bv));;
231 if (bv[i] == NULL)
232 return ENOMEM;
233
234 bv[i]->bv_val = (void *)value;
235 bv[i]->bv_len = len;
236
237 bv[i + 1] = NULL;
238 }
239
240 return 0;
241 }
242
243 static krb5_error_code
244 LDAP_addmod(LDAPMod *** modlist, int modop, const char *attribute,
245 const char *value)
246 {
247 int cMods, i = 0;
248 krb5_error_code ret;
249
250 ret = LDAP__setmod(modlist, modop, attribute, &cMods);
251 if (ret)
252 return ret;
253
254 if (value != NULL) {
255 char **bv;
256
257 bv = (*modlist)[cMods]->mod_values;
258 if (bv != NULL) {
259 for (i = 0; bv[i] != NULL; i++)
260 ;
261 bv = ber_memrealloc(bv, (i + 2) * sizeof(*bv));
262 } else
263 bv = ber_memalloc(2 * sizeof(*bv));
264 if (bv == NULL)
265 return ENOMEM;
266
267 (*modlist)[cMods]->mod_values = bv;
268
269 bv[i] = ber_strdup(value);
270 if (bv[i] == NULL)
271 return ENOMEM;
272
273 bv[i + 1] = NULL;
274 }
275
276 return 0;
277 }
278
279 static krb5_error_code
280 LDAP_addmod_generalized_time(LDAPMod *** mods, int modop,
281 const char *attribute, KerberosTime * time)
282 {
283 char buf[22];
284 struct tm *tm;
285
286 /* XXX not threadsafe */
287 tm = gmtime(time);
288 strftime(buf, sizeof(buf), "%Y%m%d%H%M%SZ", tm);
289
290 return LDAP_addmod(mods, modop, attribute, buf);
291 }
292
293 static krb5_error_code
294 LDAP_addmod_integer(krb5_context context,
295 LDAPMod *** mods, int modop,
296 const char *attribute, unsigned long l)
297 {
298 krb5_error_code ret;
299 char *buf;
300
301 ret = asprintf(&buf, "%ld", l);
302 if (ret < 0) {
303 krb5_set_error_message(context, ENOMEM,
304 "asprintf: out of memory:");
305 return ENOMEM;
306 }
307 ret = LDAP_addmod(mods, modop, attribute, buf);
308 free (buf);
309 return ret;
310 }
311
312 static krb5_error_code
313 LDAP_get_string_value(HDB * db, LDAPMessage * entry,
314 const char *attribute, char **ptr)
315 {
316 struct berval **vals;
317
318 vals = ldap_get_values_len(HDB2LDAP(db), entry, attribute);
319 if (vals == NULL || vals[0] == NULL) {
320 *ptr = NULL;
321 return HDB_ERR_NOENTRY;
322 }
323
324 *ptr = malloc(vals[0]->bv_len + 1);
325 if (*ptr == NULL) {
326 ldap_value_free_len(vals);
327 return ENOMEM;
328 }
329
330 memcpy(*ptr, vals[0]->bv_val, vals[0]->bv_len);
331 (*ptr)[vals[0]->bv_len] = 0;
332
333 ldap_value_free_len(vals);
334
335 return 0;
336 }
337
338 static krb5_error_code
339 LDAP_get_integer_value(HDB * db, LDAPMessage * entry,
340 const char *attribute, int *ptr)
341 {
342 krb5_error_code ret;
343 char *val;
344
345 ret = LDAP_get_string_value(db, entry, attribute, &val);
346 if (ret)
347 return ret;
348 *ptr = atoi(val);
349 free(val);
350 return 0;
351 }
352
353 static krb5_error_code
354 LDAP_get_generalized_time_value(HDB * db, LDAPMessage * entry,
355 const char *attribute, KerberosTime * kt)
356 {
357 char *tmp, *gentime;
358 struct tm tm;
359 int ret;
360
361 *kt = 0;
362
363 ret = LDAP_get_string_value(db, entry, attribute, &gentime);
364 if (ret)
365 return ret;
366
367 tmp = strptime(gentime, "%Y%m%d%H%M%SZ", &tm);
368 if (tmp == NULL) {
369 free(gentime);
370 return HDB_ERR_NOENTRY;
371 }
372
373 free(gentime);
374
375 *kt = timegm(&tm);
376
377 return 0;
378 }
379
380 static int
381 bervalstrcmp(struct berval *v, const char *str)
382 {
383 size_t len = strlen(str);
384 return (v->bv_len == len) && strncasecmp(str, (char *)v->bv_val, len) == 0;
385 }
386
387
388 static krb5_error_code
389 LDAP_entry2mods(krb5_context context, HDB * db, hdb_entry_ex * ent,
390 LDAPMessage * msg, LDAPMod *** pmods)
391 {
392 krb5_error_code ret;
393 krb5_boolean is_new_entry;
394 char *tmp = NULL;
395 LDAPMod **mods = NULL;
396 hdb_entry_ex orig;
397 unsigned long oflags, nflags;
398 int i;
399
400 krb5_boolean is_samba_account = FALSE;
401 krb5_boolean is_account = FALSE;
402 krb5_boolean is_heimdal_entry = FALSE;
403 krb5_boolean is_heimdal_principal = FALSE;
404
405 struct berval **vals;
406
407 *pmods = NULL;
408
409 if (msg != NULL) {
410
411 ret = LDAP_message2entry(context, db, msg, 0, &orig);
412 if (ret)
413 goto out;
414
415 is_new_entry = FALSE;
416
417 vals = ldap_get_values_len(HDB2LDAP(db), msg, "objectClass");
418 if (vals) {
419 int num_objectclasses = ldap_count_values_len(vals);
420 for (i=0; i < num_objectclasses; i++) {
421 if (bervalstrcmp(vals[i], "sambaSamAccount"))
422 is_samba_account = TRUE;
423 else if (bervalstrcmp(vals[i], structural_object))
424 is_account = TRUE;
425 else if (bervalstrcmp(vals[i], "krb5Principal"))
426 is_heimdal_principal = TRUE;
427 else if (bervalstrcmp(vals[i], "krb5KDCEntry"))
428 is_heimdal_entry = TRUE;
429 }
430 ldap_value_free_len(vals);
431 }
432
433 /*
434 * If this is just a "account" entry and no other objectclass
435 * is hanging on this entry, it's really a new entry.
436 */
437 if (is_samba_account == FALSE && is_heimdal_principal == FALSE &&
438 is_heimdal_entry == FALSE) {
439 if (is_account == TRUE) {
440 is_new_entry = TRUE;
441 } else {
442 ret = HDB_ERR_NOENTRY;
443 goto out;
444 }
445 }
446 } else
447 is_new_entry = TRUE;
448
449 if (is_new_entry) {
450
451 /* to make it perfectly obvious we're depending on
452 * orig being intiialized to zero */
453 memset(&orig, 0, sizeof(orig));
454
455 ret = LDAP_addmod(&mods, LDAP_MOD_ADD, "objectClass", "top");
456 if (ret)
457 goto out;
458
459 /* account is the structural object class */
460 if (is_account == FALSE) {
461 ret = LDAP_addmod(&mods, LDAP_MOD_ADD, "objectClass",
462 structural_object);
463 is_account = TRUE;
464 if (ret)
465 goto out;
466 }
467
468 ret = LDAP_addmod(&mods, LDAP_MOD_ADD, "objectClass", "krb5Principal");
469 is_heimdal_principal = TRUE;
470 if (ret)
471 goto out;
472
473 ret = LDAP_addmod(&mods, LDAP_MOD_ADD, "objectClass", "krb5KDCEntry");
474 is_heimdal_entry = TRUE;
475 if (ret)
476 goto out;
477 }
478
479 if (is_new_entry ||
480 krb5_principal_compare(context, ent->entry.principal, orig.entry.principal)
481 == FALSE)
482 {
483 if (is_heimdal_principal || is_heimdal_entry) {
484
485 ret = krb5_unparse_name(context, ent->entry.principal, &tmp);
486 if (ret)
487 goto out;
488
489 ret = LDAP_addmod(&mods, LDAP_MOD_REPLACE,
490 "krb5PrincipalName", tmp);
491 if (ret) {
492 free(tmp);
493 goto out;
494 }
495 free(tmp);
496 }
497
498 if (is_account || is_samba_account) {
499 ret = krb5_unparse_name_short(context, ent->entry.principal, &tmp);
500 if (ret)
501 goto out;
502 ret = LDAP_addmod(&mods, LDAP_MOD_REPLACE, "uid", tmp);
503 if (ret) {
504 free(tmp);
505 goto out;
506 }
507 free(tmp);
508 }
509 }
510
511 if (is_heimdal_entry && (ent->entry.kvno != orig.entry.kvno || is_new_entry)) {
512 ret = LDAP_addmod_integer(context, &mods, LDAP_MOD_REPLACE,
513 "krb5KeyVersionNumber",
514 ent->entry.kvno);
515 if (ret)
516 goto out;
517 }
518
519 if (is_heimdal_entry && ent->entry.valid_start) {
520 if (orig.entry.valid_end == NULL
521 || (*(ent->entry.valid_start) != *(orig.entry.valid_start))) {
522 ret = LDAP_addmod_generalized_time(&mods, LDAP_MOD_REPLACE,
523 "krb5ValidStart",
524 ent->entry.valid_start);
525 if (ret)
526 goto out;
527 }
528 }
529
530 if (ent->entry.valid_end) {
531 if (orig.entry.valid_end == NULL || (*(ent->entry.valid_end) != *(orig.entry.valid_end))) {
532 if (is_heimdal_entry) {
533 ret = LDAP_addmod_generalized_time(&mods, LDAP_MOD_REPLACE,
534 "krb5ValidEnd",
535 ent->entry.valid_end);
536 if (ret)
537 goto out;
538 }
539 if (is_samba_account) {
540 ret = LDAP_addmod_integer(context, &mods, LDAP_MOD_REPLACE,
541 "sambaKickoffTime",
542 *(ent->entry.valid_end));
543 if (ret)
544 goto out;
545 }
546 }
547 }
548
549 if (ent->entry.pw_end) {
550 if (orig.entry.pw_end == NULL || (*(ent->entry.pw_end) != *(orig.entry.pw_end))) {
551 if (is_heimdal_entry) {
552 ret = LDAP_addmod_generalized_time(&mods, LDAP_MOD_REPLACE,
553 "krb5PasswordEnd",
554 ent->entry.pw_end);
555 if (ret)
556 goto out;
557 }
558
559 if (is_samba_account) {
560 ret = LDAP_addmod_integer(context, &mods, LDAP_MOD_REPLACE,
561 "sambaPwdMustChange",
562 *(ent->entry.pw_end));
563 if (ret)
564 goto out;
565 }
566 }
567 }
568
569
570 #if 0 /* we we have last_pw_change */
571 if (is_samba_account && ent->entry.last_pw_change) {
572 if (orig.entry.last_pw_change == NULL || (*(ent->entry.last_pw_change) != *(orig.entry.last_pw_change))) {
573 ret = LDAP_addmod_integer(context, &mods, LDAP_MOD_REPLACE,
574 "sambaPwdLastSet",
575 *(ent->entry.last_pw_change));
576 if (ret)
577 goto out;
578 }
579 }
580 #endif
581
582 if (is_heimdal_entry && ent->entry.max_life) {
583 if (orig.entry.max_life == NULL
584 || (*(ent->entry.max_life) != *(orig.entry.max_life))) {
585
586 ret = LDAP_addmod_integer(context, &mods, LDAP_MOD_REPLACE,
587 "krb5MaxLife",
588 *(ent->entry.max_life));
589 if (ret)
590 goto out;
591 }
592 }
593
594 if (is_heimdal_entry && ent->entry.max_renew) {
595 if (orig.entry.max_renew == NULL
596 || (*(ent->entry.max_renew) != *(orig.entry.max_renew))) {
597
598 ret = LDAP_addmod_integer(context, &mods, LDAP_MOD_REPLACE,
599 "krb5MaxRenew",
600 *(ent->entry.max_renew));
601 if (ret)
602 goto out;
603 }
604 }
605
606 oflags = HDBFlags2int(orig.entry.flags);
607 nflags = HDBFlags2int(ent->entry.flags);
608
609 if (is_heimdal_entry && oflags != nflags) {
610
611 ret = LDAP_addmod_integer(context, &mods, LDAP_MOD_REPLACE,
612 "krb5KDCFlags",
613 nflags);
614 if (ret)
615 goto out;
616 }
617
618 /* Remove keys if they exists, and then replace keys. */
619 if (!is_new_entry && orig.entry.keys.len > 0) {
620 vals = ldap_get_values_len(HDB2LDAP(db), msg, "krb5Key");
621 if (vals) {
622 ldap_value_free_len(vals);
623
624 ret = LDAP_addmod(&mods, LDAP_MOD_DELETE, "krb5Key", NULL);
625 if (ret)
626 goto out;
627 }
628 }
629
630 for (i = 0; i < ent->entry.keys.len; i++) {
631
632 if (is_samba_account
633 && ent->entry.keys.val[i].key.keytype == ETYPE_ARCFOUR_HMAC_MD5) {
634 char *ntHexPassword;
635 char *nt;
636 time_t now = time(NULL);
637
638 /* the key might have been 'sealed', but samba passwords
639 are clear in the directory */
640 ret = hdb_unseal_key(context, db, &ent->entry.keys.val[i]);
641 if (ret)
642 goto out;
643
644 nt = ent->entry.keys.val[i].key.keyvalue.data;
645 /* store in ntPassword, not krb5key */
646 ret = hex_encode(nt, 16, &ntHexPassword);
647 if (ret < 0) {
648 ret = ENOMEM;
649 krb5_set_error_message(context, ret, "hdb-ldap: failed to "
650 "hex encode key");
651 goto out;
652 }
653 ret = LDAP_addmod(&mods, LDAP_MOD_REPLACE, "sambaNTPassword",
654 ntHexPassword);
655 free(ntHexPassword);
656 if (ret)
657 goto out;
658 ret = LDAP_addmod_integer(context, &mods, LDAP_MOD_REPLACE,
659 "sambaPwdLastSet", now);
660 if (ret)
661 goto out;
662
663 /* have to kill the LM passwod if it exists */
664 vals = ldap_get_values_len(HDB2LDAP(db), msg, "sambaLMPassword");
665 if (vals) {
666 ldap_value_free_len(vals);
667 ret = LDAP_addmod(&mods, LDAP_MOD_DELETE,
668 "sambaLMPassword", NULL);
669 if (ret)
670 goto out;
671 }
672
673 } else if (is_heimdal_entry) {
674 unsigned char *buf;
675 size_t len, buf_size;
676
677 ASN1_MALLOC_ENCODE(Key, buf, buf_size, &ent->entry.keys.val[i], &len, ret);
678 if (ret)
679 goto out;
680 if(buf_size != len)
681 krb5_abortx(context, "internal error in ASN.1 encoder");
682
683 /* addmod_len _owns_ the key, doesn't need to copy it */
684 ret = LDAP_addmod_len(&mods, LDAP_MOD_ADD, "krb5Key", buf, len);
685 if (ret)
686 goto out;
687 }
688 }
689
690 if (ent->entry.etypes) {
691 int add_krb5EncryptionType = 0;
692
693 /*
694 * Only add/modify krb5EncryptionType if it's a new heimdal
695 * entry or krb5EncryptionType already exists on the entry.
696 */
697
698 if (!is_new_entry) {
699 vals = ldap_get_values_len(HDB2LDAP(db), msg, "krb5EncryptionType");
700 if (vals) {
701 ldap_value_free_len(vals);
702 ret = LDAP_addmod(&mods, LDAP_MOD_DELETE, "krb5EncryptionType",
703 NULL);
704 if (ret)
705 goto out;
706 add_krb5EncryptionType = 1;
707 }
708 } else if (is_heimdal_entry)
709 add_krb5EncryptionType = 1;
710
711 if (add_krb5EncryptionType) {
712 for (i = 0; i < ent->entry.etypes->len; i++) {
713 if (is_samba_account &&
714 ent->entry.keys.val[i].key.keytype == ETYPE_ARCFOUR_HMAC_MD5)
715 {
716 ;
717 } else if (is_heimdal_entry) {
718 ret = LDAP_addmod_integer(context, &mods, LDAP_MOD_ADD,
719 "krb5EncryptionType",
720 ent->entry.etypes->val[i]);
721 if (ret)
722 goto out;
723 }
724 }
725 }
726 }
727
728 /* for clarity */
729 ret = 0;
730
731 out:
732
733 if (ret == 0)
734 *pmods = mods;
735 else if (mods != NULL) {
736 ldap_mods_free(mods, 1);
737 *pmods = NULL;
738 }
739
740 if (msg)
741 hdb_free_entry(context, &orig);
742
743 return ret;
744 }
745
746 static krb5_error_code
747 LDAP_dn2principal(krb5_context context, HDB * db, const char *dn,
748 krb5_principal * principal)
749 {
750 krb5_error_code ret;
751 int rc;
752 const char *filter = "(objectClass=krb5Principal)";
753 LDAPMessage *res = NULL, *e;
754 char *p;
755
756 ret = LDAP_no_size_limit(context, HDB2LDAP(db));
757 if (ret)
758 goto out;
759
760 rc = ldap_search_ext_s(HDB2LDAP(db), dn, LDAP_SCOPE_SUBTREE,
761 filter, krb5principal_attrs, 0,
762 NULL, NULL, NULL,
763 0, &res);
764 if (check_ldap(context, db, rc)) {
765 ret = HDB_ERR_NOENTRY;
766 krb5_set_error_message(context, ret, "ldap_search_ext_s: "
767 "filter: %s error: %s",
768 filter, ldap_err2string(rc));
769 goto out;
770 }
771
772 e = ldap_first_entry(HDB2LDAP(db), res);
773 if (e == NULL) {
774 ret = HDB_ERR_NOENTRY;
775 goto out;
776 }
777
778 ret = LDAP_get_string_value(db, e, "krb5PrincipalName", &p);
779 if (ret) {
780 ret = HDB_ERR_NOENTRY;
781 goto out;
782 }
783
784 ret = krb5_parse_name(context, p, principal);
785 free(p);
786
787 out:
788 if (res)
789 ldap_msgfree(res);
790
791 return ret;
792 }
793
794 static int
795 need_quote(unsigned char c)
796 {
797 return (c & 0x80) ||
798 (c < 32) ||
799 (c == '(') ||
800 (c == ')') ||
801 (c == '*') ||
802 (c == '\\') ||
803 (c == 0x7f);
804 }
805
806 const static char hexchar[] = "0123456789ABCDEF";
807
808 static krb5_error_code
809 escape_value(krb5_context context, const unsigned char *unquoted, char **quoted)
810 {
811 size_t i, len;
812
813 for (i = 0, len = 0; unquoted[i] != '\0'; i++, len++) {
814 if (need_quote((unsigned char)unquoted[i]))
815 len += 2;
816 }
817
818 *quoted = malloc(len + 1);
819 if (*quoted == NULL) {
820 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
821 return ENOMEM;
822 }
823
824 for (i = 0; unquoted[0] ; unquoted++) {
825 if (need_quote((unsigned char *)unquoted[0])) {
826 (*quoted)[i++] = '\\';
827 (*quoted)[i++] = hexchar[(unquoted[0] >> 4) & 0xf];
828 (*quoted)[i++] = hexchar[(unquoted[0] ) & 0xf];
829 } else
830 (*quoted)[i++] = (char)unquoted[0];
831 }
832 (*quoted)[i] = '\0';
833 return 0;
834 }
835
836
837 static krb5_error_code
838 LDAP__lookup_princ(krb5_context context,
839 HDB *db,
840 const char *princname,
841 const char *userid,
842 LDAPMessage **msg)
843 {
844 krb5_error_code ret;
845 int rc;
846 char *quote, *filter = NULL;
847
848 ret = LDAP__connect(context, db);
849 if (ret)
850 return ret;
851
852 /*
853 * Quote searches that contain filter language, this quote
854 * searches for *@REALM, which takes very long time.
855 */
856
857 ret = escape_value(context, princname, &quote);
858 if (ret)
859 goto out;
860
861 rc = asprintf(&filter,
862 "(&(objectClass=krb5Principal)(krb5PrincipalName=%s))",
863 quote);
864 free(quote);
865
866 if (rc < 0) {
867 ret = ENOMEM;
868 krb5_set_error_message(context, ret, "malloc: out of memory");
869 goto out;
870 }
871
872 ret = LDAP_no_size_limit(context, HDB2LDAP(db));
873 if (ret)
874 goto out;
875
876 rc = ldap_search_ext_s(HDB2LDAP(db), HDB2BASE(db),
877 LDAP_SCOPE_SUBTREE, filter,
878 krb5kdcentry_attrs, 0,
879 NULL, NULL, NULL,
880 0, msg);
881 if (check_ldap(context, db, rc)) {
882 ret = HDB_ERR_NOENTRY;
883 krb5_set_error_message(context, ret, "ldap_search_ext_s: "
884 "filter: %s - error: %s",
885 filter, ldap_err2string(rc));
886 goto out;
887 }
888
889 if (userid && ldap_count_entries(HDB2LDAP(db), *msg) == 0) {
890 free(filter);
891 filter = NULL;
892 ldap_msgfree(*msg);
893 *msg = NULL;
894
895 ret = escape_value(context, userid, &quote);
896 if (ret)
897 goto out;
898
899 rc = asprintf(&filter,
900 "(&(|(objectClass=sambaSamAccount)(objectClass=%s))(uid=%s))",
901 structural_object, quote);
902 free(quote);
903 if (rc < 0) {
904 ret = ENOMEM;
905 krb5_set_error_message(context, ret, "asprintf: out of memory");
906 goto out;
907 }
908
909 ret = LDAP_no_size_limit(context, HDB2LDAP(db));
910 if (ret)
911 goto out;
912
913 rc = ldap_search_ext_s(HDB2LDAP(db), HDB2BASE(db), LDAP_SCOPE_SUBTREE,
914 filter, krb5kdcentry_attrs, 0,
915 NULL, NULL, NULL,
916 0, msg);
917 if (check_ldap(context, db, rc)) {
918 ret = HDB_ERR_NOENTRY;
919 krb5_set_error_message(context, ret,
920 "ldap_search_ext_s: filter: %s error: %s",
921 filter, ldap_err2string(rc));
922 goto out;
923 }
924 }
925
926 ret = 0;
927
928 out:
929 if (filter)
930 free(filter);
931
932 return ret;
933 }
934
935 static krb5_error_code
936 LDAP_principal2message(krb5_context context, HDB * db,
937 krb5_const_principal princ, LDAPMessage ** msg)
938 {
939 char *name, *name_short = NULL;
940 krb5_error_code ret;
941 krb5_realm *r, *r0;
942
943 *msg = NULL;
944
945 ret = krb5_unparse_name(context, princ, &name);
946 if (ret)
947 return ret;
948
949 ret = krb5_get_default_realms(context, &r0);
950 if(ret) {
951 free(name);
952 return ret;
953 }
954 for (r = r0; *r != NULL; r++) {
955 if(strcmp(krb5_principal_get_realm(context, princ), *r) == 0) {
956 ret = krb5_unparse_name_short(context, princ, &name_short);
957 if (ret) {
958 krb5_free_host_realm(context, r0);
959 free(name);
960 return ret;
961 }
962 break;
963 }
964 }
965 krb5_free_host_realm(context, r0);
966
967 ret = LDAP__lookup_princ(context, db, name, name_short, msg);
968 free(name);
969 free(name_short);
970
971 return ret;
972 }
973
974 /*
975 * Construct an hdb_entry from a directory entry.
976 */
977 static krb5_error_code
978 LDAP_message2entry(krb5_context context, HDB * db, LDAPMessage * msg,
979 int flags, hdb_entry_ex * ent)
980 {
981 char *unparsed_name = NULL, *dn = NULL, *ntPasswordIN = NULL;
982 char *samba_acct_flags = NULL;
983 struct berval **keys;
984 struct berval **vals;
985 int tmp, tmp_time, i, ret, have_arcfour = 0;
986
987 memset(ent, 0, sizeof(*ent));
988 ent->entry.flags = int2HDBFlags(0);
989
990 ret = LDAP_get_string_value(db, msg, "krb5PrincipalName", &unparsed_name);
991 if (ret == 0) {
992 ret = krb5_parse_name(context, unparsed_name, &ent->entry.principal);
993 if (ret)
994 goto out;
995 } else {
996 ret = LDAP_get_string_value(db, msg, "uid",
997 &unparsed_name);
998 if (ret == 0) {
999 ret = krb5_parse_name(context, unparsed_name, &ent->entry.principal);
1000 if (ret)
1001 goto out;
1002 } else {
1003 krb5_set_error_message(context, HDB_ERR_NOENTRY,
1004 "hdb-ldap: ldap entry missing"
1005 "principal name");
1006 return HDB_ERR_NOENTRY;
1007 }
1008 }
1009
1010 {
1011 int integer;
1012 ret = LDAP_get_integer_value(db, msg, "krb5KeyVersionNumber",
1013 &integer);
1014 if (ret)
1015 ent->entry.kvno = 0;
1016 else
1017 ent->entry.kvno = integer;
1018 }
1019
1020 keys = ldap_get_values_len(HDB2LDAP(db), msg, "krb5Key");
1021 if (keys != NULL) {
1022 int i;
1023 size_t l;
1024
1025 ent->entry.keys.len = ldap_count_values_len(keys);
1026 ent->entry.keys.val = (Key *) calloc(ent->entry.keys.len, sizeof(Key));
1027 if (ent->entry.keys.val == NULL) {
1028 ret = ENOMEM;
1029 krb5_set_error_message(context, ret, "calloc: out of memory");
1030 goto out;
1031 }
1032 for (i = 0; i < ent->entry.keys.len; i++) {
1033 decode_Key((unsigned char *) keys[i]->bv_val,
1034 (size_t) keys[i]->bv_len, &ent->entry.keys.val[i], &l);
1035 }
1036 ber_bvecfree(keys);
1037 } else {
1038 #if 1
1039 /*
1040 * This violates the ASN1 but it allows a principal to
1041 * be related to a general directory entry without creating
1042 * the keys. Hopefully it's OK.
1043 */
1044 ent->entry.keys.len = 0;
1045 ent->entry.keys.val = NULL;
1046 #else
1047 ret = HDB_ERR_NOENTRY;
1048 goto out;
1049 #endif
1050 }
1051
1052 vals = ldap_get_values_len(HDB2LDAP(db), msg, "krb5EncryptionType");
1053 if (vals != NULL) {
1054 int i;
1055
1056 ent->entry.etypes = malloc(sizeof(*(ent->entry.etypes)));
1057 if (ent->entry.etypes == NULL) {
1058 ret = ENOMEM;
1059 krb5_set_error_message(context, ret,"malloc: out of memory");
1060 goto out;
1061 }
1062 ent->entry.etypes->len = ldap_count_values_len(vals);
1063 ent->entry.etypes->val = calloc(ent->entry.etypes->len, sizeof(int));
1064 if (ent->entry.etypes->val == NULL) {
1065 ret = ENOMEM;
1066 krb5_set_error_message(context, ret, "malloc: out of memory");
1067 ent->entry.etypes->len = 0;
1068 goto out;
1069 }
1070 for (i = 0; i < ent->entry.etypes->len; i++) {
1071 char *buf;
1072
1073 buf = malloc(vals[i]->bv_len + 1);
1074 if (buf == NULL) {
1075 ret = ENOMEM;
1076 krb5_set_error_message(context, ret, "malloc: out of memory");
1077 goto out;
1078 }
1079 memcpy(buf, vals[i]->bv_val, vals[i]->bv_len);
1080 buf[vals[i]->bv_len] = '\0';
1081 ent->entry.etypes->val[i] = atoi(buf);
1082 free(buf);
1083 }
1084 ldap_value_free_len(vals);
1085 }
1086
1087 for (i = 0; i < ent->entry.keys.len; i++) {
1088 if (ent->entry.keys.val[i].key.keytype == ETYPE_ARCFOUR_HMAC_MD5) {
1089 have_arcfour = 1;
1090 break;
1091 }
1092 }
1093
1094 /* manually construct the NT (type 23) key */
1095 ret = LDAP_get_string_value(db, msg, "sambaNTPassword", &ntPasswordIN);
1096 if (ret == 0 && have_arcfour == 0) {
1097 unsigned *etypes;
1098 Key *keys;
1099 int i;
1100
1101 keys = realloc(ent->entry.keys.val,
1102 (ent->entry.keys.len + 1) * sizeof(ent->entry.keys.val[0]));
1103 if (keys == NULL) {
1104 free(ntPasswordIN);
1105 ret = ENOMEM;
1106 krb5_set_error_message(context, ret, "malloc: out of memory");
1107 goto out;
1108 }
1109 ent->entry.keys.val = keys;
1110 memset(&ent->entry.keys.val[ent->entry.keys.len], 0, sizeof(Key));
1111 ent->entry.keys.val[ent->entry.keys.len].key.keytype = ETYPE_ARCFOUR_HMAC_MD5;
1112 ret = krb5_data_alloc (&ent->entry.keys.val[ent->entry.keys.len].key.keyvalue, 16);
1113 if (ret) {
1114 krb5_set_error_message(context, ret, "malloc: out of memory");
1115 free(ntPasswordIN);
1116 ret = ENOMEM;
1117 goto out;
1118 }
1119 ret = hex_decode(ntPasswordIN,
1120 ent->entry.keys.val[ent->entry.keys.len].key.keyvalue.data, 16);
1121 ent->entry.keys.len++;
1122
1123 if (ent->entry.etypes == NULL) {
1124 ent->entry.etypes = malloc(sizeof(*(ent->entry.etypes)));
1125 if (ent->entry.etypes == NULL) {
1126 ret = ENOMEM;
1127 krb5_set_error_message(context, ret, "malloc: out of memory");
1128 goto out;
1129 }
1130 ent->entry.etypes->val = NULL;
1131 ent->entry.etypes->len = 0;
1132 }
1133
1134 for (i = 0; i < ent->entry.etypes->len; i++)
1135 if (ent->entry.etypes->val[i] == ETYPE_ARCFOUR_HMAC_MD5)
1136 break;
1137 /* If there is no ARCFOUR enctype, add one */
1138 if (i == ent->entry.etypes->len) {
1139 etypes = realloc(ent->entry.etypes->val,
1140 (ent->entry.etypes->len + 1) *
1141 sizeof(ent->entry.etypes->val[0]));
1142 if (etypes == NULL) {
1143 ret = ENOMEM;
1144 krb5_set_error_message(context, ret, "malloc: out of memory");
1145 goto out;
1146 }
1147 ent->entry.etypes->val = etypes;
1148 ent->entry.etypes->val[ent->entry.etypes->len] =
1149 ETYPE_ARCFOUR_HMAC_MD5;
1150 ent->entry.etypes->len++;
1151 }
1152 }
1153
1154 ret = LDAP_get_generalized_time_value(db, msg, "createTimestamp",
1155 &ent->entry.created_by.time);
1156 if (ret)
1157 ent->entry.created_by.time = time(NULL);
1158
1159 ent->entry.created_by.principal = NULL;
1160
1161 if (flags & HDB_F_ADMIN_DATA) {
1162 ret = LDAP_get_string_value(db, msg, "creatorsName", &dn);
1163 if (ret == 0) {
1164 LDAP_dn2principal(context, db, dn, &ent->entry.created_by.principal);
1165 free(dn);
1166 }
1167
1168 ent->entry.modified_by = calloc(1, sizeof(*ent->entry.modified_by));
1169 if (ent->entry.modified_by == NULL) {
1170 ret = ENOMEM;
1171 krb5_set_error_message(context, ret, "malloc: out of memory");
1172 goto out;
1173 }
1174
1175 ret = LDAP_get_generalized_time_value(db, msg, "modifyTimestamp",
1176 &ent->entry.modified_by->time);
1177 if (ret == 0) {
1178 ret = LDAP_get_string_value(db, msg, "modifiersName", &dn);
1179 if (ret == 0) {
1180 LDAP_dn2principal(context, db, dn, &ent->entry.modified_by->principal);
1181 free(dn);
1182 } else {
1183 free(ent->entry.modified_by);
1184 ent->entry.modified_by = NULL;
1185 }
1186 }
1187 }
1188
1189 ent->entry.valid_start = malloc(sizeof(*ent->entry.valid_start));
1190 if (ent->entry.valid_start == NULL) {
1191 ret = ENOMEM;
1192 krb5_set_error_message(context, ret, "malloc: out of memory");
1193 goto out;
1194 }
1195 ret = LDAP_get_generalized_time_value(db, msg, "krb5ValidStart",
1196 ent->entry.valid_start);
1197 if (ret) {
1198 /* OPTIONAL */
1199 free(ent->entry.valid_start);
1200 ent->entry.valid_start = NULL;
1201 }
1202
1203 ent->entry.valid_end = malloc(sizeof(*ent->entry.valid_end));
1204 if (ent->entry.valid_end == NULL) {
1205 ret = ENOMEM;
1206 krb5_set_error_message(context, ret, "malloc: out of memory");
1207 goto out;
1208 }
1209 ret = LDAP_get_generalized_time_value(db, msg, "krb5ValidEnd",
1210 ent->entry.valid_end);
1211 if (ret) {
1212 /* OPTIONAL */
1213 free(ent->entry.valid_end);
1214 ent->entry.valid_end = NULL;
1215 }
1216
1217 ret = LDAP_get_integer_value(db, msg, "sambaKickoffTime", &tmp_time);
1218 if (ret == 0) {
1219 if (ent->entry.valid_end == NULL) {
1220 ent->entry.valid_end = malloc(sizeof(*ent->entry.valid_end));
1221 if (ent->entry.valid_end == NULL) {
1222 ret = ENOMEM;
1223 krb5_set_error_message(context, ret, "malloc: out of memory");
1224 goto out;
1225 }
1226 }
1227 *ent->entry.valid_end = tmp_time;
1228 }
1229
1230 ent->entry.pw_end = malloc(sizeof(*ent->entry.pw_end));
1231 if (ent->entry.pw_end == NULL) {
1232 ret = ENOMEM;
1233 krb5_set_error_message(context, ret, "malloc: out of memory");
1234 goto out;
1235 }
1236 ret = LDAP_get_generalized_time_value(db, msg, "krb5PasswordEnd",
1237 ent->entry.pw_end);
1238 if (ret) {
1239 /* OPTIONAL */
1240 free(ent->entry.pw_end);
1241 ent->entry.pw_end = NULL;
1242 }
1243
1244 ret = LDAP_get_integer_value(db, msg, "sambaPwdLastSet", &tmp_time);
1245 if (ret == 0) {
1246 time_t delta;
1247
1248 delta = krb5_config_get_time_default(context, NULL,
1249 0,
1250 "kadmin",
1251 "password_lifetime",
1252 NULL);
1253
1254 if (delta) {
1255 if (ent->entry.pw_end == NULL) {
1256 ent->entry.pw_end = malloc(sizeof(*ent->entry.pw_end));
1257 if (ent->entry.pw_end == NULL) {
1258 ret = ENOMEM;
1259 krb5_set_error_message(context, ret, "malloc: out of memory");
1260 goto out;
1261 }
1262 }
1263
1264 *ent->entry.pw_end = tmp_time + delta;
1265 }
1266 }
1267
1268 ret = LDAP_get_integer_value(db, msg, "sambaPwdMustChange", &tmp_time);
1269 if (ret == 0) {
1270 if (ent->entry.pw_end == NULL) {
1271 ent->entry.pw_end = malloc(sizeof(*ent->entry.pw_end));
1272 if (ent->entry.pw_end == NULL) {
1273 ret = ENOMEM;
1274 krb5_set_error_message(context, ret, "malloc: out of memory");
1275 goto out;
1276 }
1277 }
1278 *ent->entry.pw_end = tmp_time;
1279 }
1280
1281 /* OPTIONAL */
1282 ret = LDAP_get_integer_value(db, msg, "sambaPwdLastSet", &tmp_time);
1283 if (ret == 0)
1284 hdb_entry_set_pw_change_time(context, &ent->entry, tmp_time);
1285
1286 {
1287 int max_life;
1288
1289 ent->entry.max_life = malloc(sizeof(*ent->entry.max_life));
1290 if (ent->entry.max_life == NULL) {
1291 ret = ENOMEM;
1292 krb5_set_error_message(context, ret, "malloc: out of memory");
1293 goto out;
1294 }
1295 ret = LDAP_get_integer_value(db, msg, "krb5MaxLife", &max_life);
1296 if (ret) {
1297 free(ent->entry.max_life);
1298 ent->entry.max_life = NULL;
1299 } else
1300 *ent->entry.max_life = max_life;
1301 }
1302
1303 {
1304 int max_renew;
1305
1306 ent->entry.max_renew = malloc(sizeof(*ent->entry.max_renew));
1307 if (ent->entry.max_renew == NULL) {
1308 ret = ENOMEM;
1309 krb5_set_error_message(context, ret, "malloc: out of memory");
1310 goto out;
1311 }
1312 ret = LDAP_get_integer_value(db, msg, "krb5MaxRenew", &max_renew);
1313 if (ret) {
1314 free(ent->entry.max_renew);
1315 ent->entry.max_renew = NULL;
1316 } else
1317 *ent->entry.max_renew = max_renew;
1318 }
1319
1320 ret = LDAP_get_integer_value(db, msg, "krb5KDCFlags", &tmp);
1321 if (ret)
1322 tmp = 0;
1323
1324 ent->entry.flags = int2HDBFlags(tmp);
1325
1326 /* Try and find Samba flags to put into the mix */
1327 ret = LDAP_get_string_value(db, msg, "sambaAcctFlags", &samba_acct_flags);
1328 if (ret == 0) {
1329 /* parse the [UXW...] string:
1330
1331 'N' No password
1332 'D' Disabled
1333 'H' Homedir required
1334 'T' Temp account.
1335 'U' User account (normal)
1336 'M' MNS logon user account - what is this ?
1337 'W' Workstation account
1338 'S' Server account
1339 'L' Locked account
1340 'X' No Xpiry on password
1341 'I' Interdomain trust account
1342
1343 */
1344
1345 int i;
1346 int flags_len = strlen(samba_acct_flags);
1347
1348 if (flags_len < 2)
1349 goto out2;
1350
1351 if (samba_acct_flags[0] != '['
1352 || samba_acct_flags[flags_len - 1] != ']')
1353 goto out2;
1354
1355 /* Allow forwarding */
1356 if (samba_forwardable)
1357 ent->entry.flags.forwardable = TRUE;
1358
1359 for (i=0; i < flags_len; i++) {
1360 switch (samba_acct_flags[i]) {
1361 case ' ':
1362 case '[':
1363 case ']':
1364 break;
1365 case 'N':
1366 /* how to handle no password in kerberos? */
1367 break;
1368 case 'D':
1369 ent->entry.flags.invalid = TRUE;
1370 break;
1371 case 'H':
1372 break;
1373 case 'T':
1374 /* temp duplicate */
1375 ent->entry.flags.invalid = TRUE;
1376 break;
1377 case 'U':
1378 ent->entry.flags.client = TRUE;
1379 break;
1380 case 'M':
1381 break;
1382 case 'W':
1383 case 'S':
1384 ent->entry.flags.server = TRUE;
1385 ent->entry.flags.client = TRUE;
1386 break;
1387 case 'L':
1388 ent->entry.flags.invalid = TRUE;
1389 break;
1390 case 'X':
1391 if (ent->entry.pw_end) {
1392 free(ent->entry.pw_end);
1393 ent->entry.pw_end = NULL;
1394 }
1395 break;
1396 case 'I':
1397 ent->entry.flags.server = TRUE;
1398 ent->entry.flags.client = TRUE;
1399 break;
1400 }
1401 }
1402 out2:
1403 free(samba_acct_flags);
1404 }
1405
1406 ret = 0;
1407
1408 out:
1409 if (unparsed_name)
1410 free(unparsed_name);
1411
1412 if (ret)
1413 hdb_free_entry(context, ent);
1414
1415 return ret;
1416 }
1417
1418 static krb5_error_code
1419 LDAP_close(krb5_context context, HDB * db)
1420 {
1421 if (HDB2LDAP(db)) {
1422 ldap_unbind_ext(HDB2LDAP(db), NULL, NULL);
1423 ((struct hdbldapdb *)db->hdb_db)->h_lp = NULL;
1424 }
1425
1426 return 0;
1427 }
1428
1429 static krb5_error_code
1430 LDAP_lock(krb5_context context, HDB * db, int operation)
1431 {
1432 return 0;
1433 }
1434
1435 static krb5_error_code
1436 LDAP_unlock(krb5_context context, HDB * db)
1437 {
1438 return 0;
1439 }
1440
1441 static krb5_error_code
1442 LDAP_seq(krb5_context context, HDB * db, unsigned flags, hdb_entry_ex * entry)
1443 {
1444 int msgid, rc, parserc;
1445 krb5_error_code ret;
1446 LDAPMessage *e;
1447
1448 msgid = HDB2MSGID(db);
1449 if (msgid < 0)
1450 return HDB_ERR_NOENTRY;
1451
1452 do {
1453 rc = ldap_result(HDB2LDAP(db), msgid, LDAP_MSG_ONE, NULL, &e);
1454 switch (rc) {
1455 case LDAP_RES_SEARCH_REFERENCE:
1456 ldap_msgfree(e);
1457 ret = 0;
1458 break;
1459 case LDAP_RES_SEARCH_ENTRY:
1460 /* We have an entry. Parse it. */
1461 ret = LDAP_message2entry(context, db, e, flags, entry);
1462 ldap_msgfree(e);
1463 break;
1464 case LDAP_RES_SEARCH_RESULT:
1465 /* We're probably at the end of the results. If not, abandon. */
1466 parserc =
1467 ldap_parse_result(HDB2LDAP(db), e, NULL, NULL, NULL,
1468 NULL, NULL, 1);
1469 ret = HDB_ERR_NOENTRY;
1470 if (parserc != LDAP_SUCCESS
1471 && parserc != LDAP_MORE_RESULTS_TO_RETURN) {
1472 krb5_set_error_message(context, ret, "ldap_parse_result: %s",
1473 ldap_err2string(parserc));
1474 ldap_abandon_ext(HDB2LDAP(db), msgid, NULL, NULL);
1475 }
1476 HDBSETMSGID(db, -1);
1477 break;
1478 case LDAP_SERVER_DOWN:
1479 ldap_msgfree(e);
1480 LDAP_close(context, db);
1481 HDBSETMSGID(db, -1);
1482 ret = ENETDOWN;
1483 break;
1484 default:
1485 /* Some unspecified error (timeout?). Abandon. */
1486 ldap_msgfree(e);
1487 ldap_abandon_ext(HDB2LDAP(db), msgid, NULL, NULL);
1488 ret = HDB_ERR_NOENTRY;
1489 HDBSETMSGID(db, -1);
1490 break;
1491 }
1492 } while (rc == LDAP_RES_SEARCH_REFERENCE);
1493
1494 if (ret == 0) {
1495 if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) {
1496 ret = hdb_unseal_keys(context, db, &entry->entry);
1497 if (ret)
1498 hdb_free_entry(context, entry);
1499 }
1500 }
1501
1502 return ret;
1503 }
1504
1505 static krb5_error_code
1506 LDAP_firstkey(krb5_context context, HDB *db, unsigned flags,
1507 hdb_entry_ex *entry)
1508 {
1509 krb5_error_code ret;
1510 int msgid;
1511
1512 ret = LDAP__connect(context, db);
1513 if (ret)
1514 return ret;
1515
1516 ret = LDAP_no_size_limit(context, HDB2LDAP(db));
1517 if (ret)
1518 return ret;
1519
1520 ret = ldap_search_ext(HDB2LDAP(db), HDB2BASE(db),
1521 LDAP_SCOPE_SUBTREE,
1522 "(|(objectClass=krb5Principal)(objectClass=sambaSamAccount))",
1523 krb5kdcentry_attrs, 0,
1524 NULL, NULL, NULL, 0, &msgid);
1525 if (msgid < 0)
1526 return HDB_ERR_NOENTRY;
1527
1528 HDBSETMSGID(db, msgid);
1529
1530 return LDAP_seq(context, db, flags, entry);
1531 }
1532
1533 static krb5_error_code
1534 LDAP_nextkey(krb5_context context, HDB * db, unsigned flags,
1535 hdb_entry_ex * entry)
1536 {
1537 return LDAP_seq(context, db, flags, entry);
1538 }
1539
1540 static krb5_error_code
1541 LDAP__connect(krb5_context context, HDB * db)
1542 {
1543 int rc, version = LDAP_VERSION3;
1544 /*
1545 * Empty credentials to do a SASL bind with LDAP. Note that empty
1546 * different from NULL credentials. If you provide NULL
1547 * credentials instead of empty credentials you will get a SASL
1548 * bind in progress message.
1549 */
1550 struct berval bv = { 0, "" };
1551 const char *sasl_method = "EXTERNAL";
1552 const char *bind_dn = NULL;
1553
1554 if (HDB2BINDDN(db) != NULL && HDB2BINDPW(db) != NULL) {
1555 /* A bind DN was specified; use SASL SIMPLE */
1556 bind_dn = HDB2BINDDN(db);
1557 sasl_method = LDAP_SASL_SIMPLE;
1558 bv.bv_val = HDB2BINDPW(db);
1559 bv.bv_len = strlen(bv.bv_val);
1560 }
1561
1562 if (HDB2LDAP(db)) {
1563 /* connection has been opened. ping server. */
1564 struct sockaddr_un addr;
1565 socklen_t len = sizeof(addr);
1566 int sd;
1567
1568 if (ldap_get_option(HDB2LDAP(db), LDAP_OPT_DESC, &sd) == 0 &&
1569 getpeername(sd, (struct sockaddr *) &addr, &len) < 0) {
1570 /* the other end has died. reopen. */
1571 LDAP_close(context, db);
1572 }
1573 }
1574
1575 if (HDB2LDAP(db) != NULL) /* server is UP */
1576 return 0;
1577
1578 rc = ldap_initialize(&((struct hdbldapdb *)db->hdb_db)->h_lp, HDB2URL(db));
1579 if (rc != LDAP_SUCCESS) {
1580 krb5_set_error_message(context, HDB_ERR_NOENTRY, "ldap_initialize: %s",
1581 ldap_err2string(rc));
1582 return HDB_ERR_NOENTRY;
1583 }
1584
1585 rc = ldap_set_option(HDB2LDAP(db), LDAP_OPT_PROTOCOL_VERSION,
1586 (const void *)&version);
1587 if (rc != LDAP_SUCCESS) {
1588 krb5_set_error_message(context, HDB_ERR_BADVERSION,
1589 "ldap_set_option: %s", ldap_err2string(rc));
1590 LDAP_close(context, db);
1591 return HDB_ERR_BADVERSION;
1592 }
1593
1594 if (((struct hdbldapdb *)db->hdb_db)->h_start_tls) {
1595 rc = ldap_start_tls_s(HDB2LDAP(db), NULL, NULL);
1596
1597 if (rc != LDAP_SUCCESS) {
1598 krb5_set_error_message(context, HDB_ERR_BADVERSION,
1599 "ldap_start_tls_s: %s", ldap_err2string(rc));
1600 LDAP_close(context, db);
1601 return HDB_ERR_BADVERSION;
1602 }
1603 }
1604
1605 rc = ldap_sasl_bind_s(HDB2LDAP(db), bind_dn, sasl_method, &bv,
1606 NULL, NULL, NULL);
1607 if (rc != LDAP_SUCCESS) {
1608 krb5_set_error_message(context, HDB_ERR_BADVERSION,
1609 "ldap_sasl_bind_s: %s", ldap_err2string(rc));
1610 LDAP_close(context, db);
1611 return HDB_ERR_BADVERSION;
1612 }
1613
1614 return 0;
1615 }
1616
1617 static krb5_error_code
1618 LDAP_open(krb5_context context, HDB * db, int flags, mode_t mode)
1619 {
1620 /* Not the right place for this. */
1621 #ifdef HAVE_SIGACTION
1622 struct sigaction sa;
1623
1624 sa.sa_flags = 0;
1625 sa.sa_handler = SIG_IGN;
1626 sigemptyset(&sa.sa_mask);
1627
1628 sigaction(SIGPIPE, &sa, NULL);
1629 #else
1630 signal(SIGPIPE, SIG_IGN);
1631 #endif /* HAVE_SIGACTION */
1632
1633 return LDAP__connect(context, db);
1634 }
1635
1636 static krb5_error_code
1637 LDAP_fetch_kvno(krb5_context context, HDB * db, krb5_const_principal principal,
1638 unsigned flags, krb5_kvno kvno, hdb_entry_ex * entry)
1639 {
1640 LDAPMessage *msg, *e;
1641 krb5_error_code ret;
1642
1643 ret = LDAP_principal2message(context, db, principal, &msg);
1644 if (ret)
1645 return ret;
1646
1647 e = ldap_first_entry(HDB2LDAP(db), msg);
1648 if (e == NULL) {
1649 ret = HDB_ERR_NOENTRY;
1650 goto out;
1651 }
1652
1653 ret = LDAP_message2entry(context, db, e, flags, entry);
1654 if (ret == 0) {
1655 if (db->hdb_master_key_set && (flags & HDB_F_DECRYPT)) {
1656 ret = hdb_unseal_keys(context, db, &entry->entry);
1657 if (ret)
1658 hdb_free_entry(context, entry);
1659 }
1660 }
1661
1662 out:
1663 ldap_msgfree(msg);
1664
1665 return ret;
1666 }
1667
1668 static krb5_error_code
1669 LDAP_fetch(krb5_context context, HDB * db, krb5_const_principal principal,
1670 unsigned flags, hdb_entry_ex * entry)
1671 {
1672 return LDAP_fetch_kvno(context, db, principal,
1673 flags & (~HDB_F_KVNO_SPECIFIED), 0, entry);
1674 }
1675
1676 static krb5_error_code
1677 LDAP_store(krb5_context context, HDB * db, unsigned flags,
1678 hdb_entry_ex * entry)
1679 {
1680 LDAPMod **mods = NULL;
1681 krb5_error_code ret;
1682 const char *errfn;
1683 int rc;
1684 LDAPMessage *msg = NULL, *e = NULL;
1685 char *dn = NULL, *name = NULL;
1686
1687 ret = LDAP_principal2message(context, db, entry->entry.principal, &msg);
1688 if (ret == 0)
1689 e = ldap_first_entry(HDB2LDAP(db), msg);
1690
1691 ret = krb5_unparse_name(context, entry->entry.principal, &name);
1692 if (ret) {
1693 free(name);
1694 return ret;
1695 }
1696
1697 ret = hdb_seal_keys(context, db, &entry->entry);
1698 if (ret)
1699 goto out;
1700
1701 /* turn new entry into LDAPMod array */
1702 ret = LDAP_entry2mods(context, db, entry, e, &mods);
1703 if (ret)
1704 goto out;
1705
1706 if (e == NULL) {
1707 ret = asprintf(&dn, "krb5PrincipalName=%s,%s", name, HDB2CREATE(db));
1708 if (ret < 0) {
1709 ret = ENOMEM;
1710 krb5_set_error_message(context, ret, "asprintf: out of memory");
1711 goto out;
1712 }
1713 } else if (flags & HDB_F_REPLACE) {
1714 /* Entry exists, and we're allowed to replace it. */
1715 dn = ldap_get_dn(HDB2LDAP(db), e);
1716 } else {
1717 /* Entry exists, but we're not allowed to replace it. Bail. */
1718 ret = HDB_ERR_EXISTS;
1719 goto out;
1720 }
1721
1722 /* write entry into directory */
1723 if (e == NULL) {
1724 /* didn't exist before */
1725 rc = ldap_add_ext_s(HDB2LDAP(db), dn, mods, NULL, NULL );
1726 errfn = "ldap_add_ext_s";
1727 } else {
1728 /* already existed, send deltas only */
1729 rc = ldap_modify_ext_s(HDB2LDAP(db), dn, mods, NULL, NULL );
1730 errfn = "ldap_modify_ext_s";
1731 }
1732
1733 if (check_ldap(context, db, rc)) {
1734 char *ld_error = NULL;
1735 ldap_get_option(HDB2LDAP(db), LDAP_OPT_ERROR_STRING,
1736 &ld_error);
1737 ret = HDB_ERR_CANT_LOCK_DB;
1738 krb5_set_error_message(context, ret, "%s: %s (DN=%s) %s: %s",
1739 errfn, name, dn, ldap_err2string(rc), ld_error);
1740 } else
1741 ret = 0;
1742
1743 out:
1744 /* free stuff */
1745 if (dn)
1746 free(dn);
1747 if (msg)
1748 ldap_msgfree(msg);
1749 if (mods)
1750 ldap_mods_free(mods, 1);
1751 if (name)
1752 free(name);
1753
1754 return ret;
1755 }
1756
1757 static krb5_error_code
1758 LDAP_remove(krb5_context context, HDB *db, krb5_const_principal principal)
1759 {
1760 krb5_error_code ret;
1761 LDAPMessage *msg, *e;
1762 char *dn = NULL;
1763 int rc, limit = LDAP_NO_LIMIT;
1764
1765 ret = LDAP_principal2message(context, db, principal, &msg);
1766 if (ret)
1767 goto out;
1768
1769 e = ldap_first_entry(HDB2LDAP(db), msg);
1770 if (e == NULL) {
1771 ret = HDB_ERR_NOENTRY;
1772 goto out;
1773 }
1774
1775 dn = ldap_get_dn(HDB2LDAP(db), e);
1776 if (dn == NULL) {
1777 ret = HDB_ERR_NOENTRY;
1778 goto out;
1779 }
1780
1781 rc = ldap_set_option(HDB2LDAP(db), LDAP_OPT_SIZELIMIT, (const void *)&limit);
1782 if (rc != LDAP_SUCCESS) {
1783 ret = HDB_ERR_BADVERSION;
1784 krb5_set_error_message(context, ret, "ldap_set_option: %s",
1785 ldap_err2string(rc));
1786 goto out;
1787 }
1788
1789 rc = ldap_delete_ext_s(HDB2LDAP(db), dn, NULL, NULL );
1790 if (check_ldap(context, db, rc)) {
1791 ret = HDB_ERR_CANT_LOCK_DB;
1792 krb5_set_error_message(context, ret, "ldap_delete_ext_s: %s",
1793 ldap_err2string(rc));
1794 } else
1795 ret = 0;
1796
1797 out:
1798 if (dn != NULL)
1799 free(dn);
1800 if (msg != NULL)
1801 ldap_msgfree(msg);
1802
1803 return ret;
1804 }
1805
1806 static krb5_error_code
1807 LDAP_destroy(krb5_context context, HDB * db)
1808 {
1809 krb5_error_code ret;
1810
1811 LDAP_close(context, db);
1812
1813 ret = hdb_clear_master_key(context, db);
1814 if (HDB2BASE(db))
1815 free(HDB2BASE(db));
1816 if (HDB2CREATE(db))
1817 free(HDB2CREATE(db));
1818 if (HDB2URL(db))
1819 free(HDB2URL(db));
1820 if (db->hdb_name)
1821 free(db->hdb_name);
1822 free(db->hdb_db);
1823 free(db);
1824
1825 return ret;
1826 }
1827
1828 static krb5_error_code
1829 hdb_ldap_common(krb5_context context,
1830 HDB ** db,
1831 const char *search_base,
1832 const char *url)
1833 {
1834 struct hdbldapdb *h;
1835 const char *create_base = NULL;
1836 const char *ldap_secret_file = NULL;
1837
1838 if (url == NULL || url[0] == '\0') {
1839 const char *p;
1840 p = krb5_config_get_string(context, NULL, "kdc",
1841 "hdb-ldap-url", NULL);
1842 if (p == NULL)
1843 p = default_ldap_url;
1844
1845 url = p;
1846 }
1847
1848 if (search_base == NULL && search_base[0] == '\0') {
1849 krb5_set_error_message(context, ENOMEM, "ldap search base not configured");
1850 return ENOMEM; /* XXX */
1851 }
1852
1853 if (structural_object == NULL) {
1854 const char *p;
1855
1856 p = krb5_config_get_string(context, NULL, "kdc",
1857 "hdb-ldap-structural-object", NULL);
1858 if (p == NULL)
1859 p = default_structural_object;
1860 structural_object = strdup(p);
1861 if (structural_object == NULL) {
1862 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1863 return ENOMEM;
1864 }
1865 }
1866
1867 samba_forwardable =
1868 krb5_config_get_bool_default(context, NULL, TRUE,
1869 "kdc", "hdb-samba-forwardable", NULL);
1870
1871 *db = calloc(1, sizeof(**db));
1872 if (*db == NULL) {
1873 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1874 return ENOMEM;
1875 }
1876 memset(*db, 0, sizeof(**db));
1877
1878 h = calloc(1, sizeof(*h));
1879 if (h == NULL) {
1880 free(*db);
1881 *db = NULL;
1882 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
1883 return ENOMEM;
1884 }
1885 (*db)->hdb_db = h;
1886
1887 /* XXX */
1888 if (asprintf(&(*db)->hdb_name, "ldap:%s", search_base) == -1) {
1889 LDAP_destroy(context, *db);
1890 *db = NULL;
1891 krb5_set_error_message(context, ENOMEM, "strdup: out of memory");
1892 return ENOMEM;
1893 }
1894
1895 h->h_url = strdup(url);
1896 h->h_base = strdup(search_base);
1897 if (h->h_url == NULL || h->h_base == NULL) {
1898 LDAP_destroy(context, *db);
1899 *db = NULL;
1900 krb5_set_error_message(context, ENOMEM, "strdup: out of memory");
1901 return ENOMEM;
1902 }
1903
1904 ldap_secret_file = krb5_config_get_string(context, NULL, "kdc",
1905 "hdb-ldap-secret-file", NULL);
1906 if (ldap_secret_file != NULL) {
1907 krb5_config_binding *tmp;
1908 krb5_error_code ret;
1909 const char *p;
1910
1911 ret = krb5_config_parse_file(context, ldap_secret_file, &tmp);
1912 if (ret)
1913 return ret;
1914
1915 p = krb5_config_get_string(context, tmp, "kdc",
1916 "hdb-ldap-bind-dn", NULL);
1917 if (p != NULL)
1918 h->h_bind_dn = strdup(p);
1919
1920 p = krb5_config_get_string(context, tmp, "kdc",
1921 "hdb-ldap-bind-password", NULL);
1922 if (p != NULL)
1923 h->h_bind_password = strdup(p);
1924
1925 krb5_config_file_free(context, tmp);
1926 }
1927
1928 h->h_start_tls =
1929 krb5_config_get_bool_default(context, NULL, FALSE,
1930 "kdc", "hdb-ldap-start-tls", NULL);
1931
1932 create_base = krb5_config_get_string(context, NULL, "kdc",
1933 "hdb-ldap-create-base", NULL);
1934 if (create_base == NULL)
1935 create_base = h->h_base;
1936
1937 h->h_createbase = strdup(create_base);
1938 if (h->h_createbase == NULL) {
1939 LDAP_destroy(context, *db);
1940 *db = NULL;
1941 krb5_set_error_message(context, ENOMEM, "strdup: out of memory");
1942 return ENOMEM;
1943 }
1944
1945 (*db)->hdb_master_key_set = 0;
1946 (*db)->hdb_openp = 0;
1947 (*db)->hdb_capability_flags = 0;
1948 (*db)->hdb_open = LDAP_open;
1949 (*db)->hdb_close = LDAP_close;
1950 (*db)->hdb_fetch_kvno = LDAP_fetch_kvno;
1951 (*db)->hdb_store = LDAP_store;
1952 (*db)->hdb_remove = LDAP_remove;
1953 (*db)->hdb_firstkey = LDAP_firstkey;
1954 (*db)->hdb_nextkey = LDAP_nextkey;
1955 (*db)->hdb_lock = LDAP_lock;
1956 (*db)->hdb_unlock = LDAP_unlock;
1957 (*db)->hdb_rename = NULL;
1958 (*db)->hdb__get = NULL;
1959 (*db)->hdb__put = NULL;
1960 (*db)->hdb__del = NULL;
1961 (*db)->hdb_destroy = LDAP_destroy;
1962
1963 return 0;
1964 }
1965
1966 krb5_error_code
1967 hdb_ldap_create(krb5_context context, HDB ** db, const char *arg)
1968 {
1969 return hdb_ldap_common(context, db, arg, NULL);
1970 }
1971
1972 krb5_error_code
1973 hdb_ldapi_create(krb5_context context, HDB ** db, const char *arg)
1974 {
1975 krb5_error_code ret;
1976 char *search_base, *p;
1977
1978 asprintf(&p, "ldapi:%s", arg);
1979 if (p == NULL) {
1980 *db = NULL;
1981 krb5_set_error_message(context, ENOMEM, "out of memory");
1982 return ENOMEM;
1983 }
1984 search_base = strchr(p + strlen("ldapi://"), ':');
1985 if (search_base == NULL) {
1986 *db = NULL;
1987 krb5_set_error_message(context, HDB_ERR_BADVERSION,
1988 "search base missing");
1989 return HDB_ERR_BADVERSION;
1990 }
1991 *search_base = '\0';
1992 search_base++;
1993
1994 ret = hdb_ldap_common(context, db, search_base, p);
1995 free(p);
1996 return ret;
1997 }
1998
1999 #ifdef OPENLDAP_MODULE
2000
2001
2002 static krb5_error_code KRB5_LIB_CALL *
2003 init(krb5_context context, void **ctx)
2004 {
2005 *ctx = NULL;
2006 }
2007
2008 static void KRB5_LIB_CALL *
2009 fini(void *ctx)
2010 {
2011 }
2012
2013 struct hdb_method hdb_ldap_interface = {
2014 HDB_INTERFACE_VERSION,
2015 init,
2016 fini,
2017 "ldap",
2018 hdb_ldap_create
2019 };
2020
2021 struct hdb_so_method hdb_ldapi_interface = {
2022 HDB_INTERFACE_VERSION,
2023 init,
2024 fini,
2025 "ldapi",
2026 hdb_ldapi_create
2027 };
2028
2029 #endif
2030
2031 #endif /* OPENLDAP */
Heimdal