2010-01-28 09:27:11 +03:00
/*
Unix SMB / CIFS implementation .
Database Glue between Samba and the KDC
Copyright ( C ) Andrew Bartlett < abartlet @ samba . org > 2005 - 2009
Copyright ( C ) Simo Sorce < idra @ samba . org > 2010
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation ; either version 3 of the License , or
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
along with this program . If not , see < http : //www.gnu.org/licenses/>.
*/
# include "includes.h"
# include "libcli/security/security.h"
# include "auth/auth.h"
# include "auth/auth_sam.h"
# include "dsdb/samdb/samdb.h"
2010-02-16 07:49:29 +03:00
# include "dsdb/common/util.h"
2010-01-28 09:27:11 +03:00
# include "librpc/gen_ndr/ndr_drsblobs.h"
# include "param/param.h"
# include "../lib/crypto/md4.h"
# include "system/kerberos.h"
2010-06-24 03:40:16 +04:00
# include "auth/kerberos/kerberos.h"
2014-05-08 19:13:04 +04:00
# include "kdc/sdb.h"
2010-01-28 09:27:11 +03:00
# include "kdc/samba_kdc.h"
2011-03-19 02:43:50 +03:00
# include "kdc/db-glue.h"
2017-04-03 07:11:35 +03:00
# include "librpc/gen_ndr/ndr_irpc_c.h"
# include "lib/messaging/irpc.h"
2010-01-28 09:27:11 +03:00
2011-03-04 18:12:29 +03:00
# define SAMBA_KVNO_GET_KRBTGT(kvno) \
( ( uint16_t ) ( ( ( uint32_t ) kvno ) > > 16 ) )
# define SAMBA_KVNO_AND_KRBTGT(kvno, krbtgt) \
( ( krb5_kvno ) ( ( ( ( uint32_t ) kvno ) & 0xFFFF ) | \
( ( ( ( uint32_t ) krbtgt ) < < 16 ) & 0xFFFF0000 ) ) )
2010-01-28 09:27:11 +03:00
enum samba_kdc_ent_type
{ SAMBA_KDC_ENT_TYPE_CLIENT , SAMBA_KDC_ENT_TYPE_SERVER ,
SAMBA_KDC_ENT_TYPE_KRBTGT , SAMBA_KDC_ENT_TYPE_TRUST , SAMBA_KDC_ENT_TYPE_ANY } ;
enum trust_direction {
UNKNOWN = 0 ,
INBOUND = LSA_TRUST_DIRECTION_INBOUND ,
OUTBOUND = LSA_TRUST_DIRECTION_OUTBOUND
} ;
static const char * trust_attrs [ ] = {
" trustPartner " ,
" trustAuthIncoming " ,
" trustAuthOutgoing " ,
" whenCreated " ,
" msDS-SupportedEncryptionTypes " ,
" trustAttributes " ,
" trustDirection " ,
" trustType " ,
NULL
} ;
2017-04-03 07:11:35 +03:00
/*
send a message to the drepl server telling it to initiate a
REPL_SECRET getncchanges extended op to fetch the users secrets
*/
static void auth_sam_trigger_repl_secret ( TALLOC_CTX * mem_ctx ,
struct imessaging_context * msg_ctx ,
struct tevent_context * event_ctx ,
struct ldb_dn * user_dn )
{
struct dcerpc_binding_handle * irpc_handle ;
struct drepl_trigger_repl_secret r ;
struct tevent_req * req ;
TALLOC_CTX * tmp_ctx ;
tmp_ctx = talloc_new ( mem_ctx ) ;
if ( tmp_ctx = = NULL ) {
return ;
}
irpc_handle = irpc_binding_handle_by_name ( tmp_ctx , msg_ctx ,
" dreplsrv " ,
& ndr_table_irpc ) ;
if ( irpc_handle = = NULL ) {
DEBUG ( 1 , ( __location__ " : Unable to get binding handle for dreplsrv \n " ) ) ;
TALLOC_FREE ( tmp_ctx ) ;
return ;
}
r . in . user_dn = ldb_dn_get_linearized ( user_dn ) ;
/*
* This seem to rely on the current IRPC implementation ,
* which delivers the message in the _send function .
*
* TODO : we need a ONE_WAY IRPC handle and register
* a callback and wait for it to be triggered !
*/
req = dcerpc_drepl_trigger_repl_secret_r_send ( tmp_ctx ,
event_ctx ,
irpc_handle ,
& r ) ;
/* we aren't interested in a reply */
talloc_free ( req ) ;
TALLOC_FREE ( tmp_ctx ) ;
}
2012-03-31 09:15:36 +04:00
2014-05-08 12:49:00 +04:00
static time_t ldb_msg_find_krb5time_ldap_time ( struct ldb_message * msg , const char * attr , time_t default_val )
2010-01-28 09:27:11 +03:00
{
const char * tmp ;
const char * gentime ;
struct tm tm ;
gentime = ldb_msg_find_attr_as_string ( msg , attr , NULL ) ;
if ( ! gentime )
return default_val ;
tmp = strptime ( gentime , " %Y%m%d%H%M%SZ " , & tm ) ;
if ( tmp = = NULL ) {
return default_val ;
}
return timegm ( & tm ) ;
}
2014-05-08 19:13:04 +04:00
static struct SDBFlags uf2SDBFlags ( krb5_context context , uint32_t userAccountControl , enum samba_kdc_ent_type ent_type )
2010-01-28 09:27:11 +03:00
{
2014-05-08 19:13:04 +04:00
struct SDBFlags flags = int2SDBFlags ( 0 ) ;
2010-01-28 09:27:11 +03:00
/* we don't allow kadmin deletes */
flags . immutable = 1 ;
/* mark the principal as invalid to start with */
flags . invalid = 1 ;
flags . renewable = 1 ;
/* All accounts are servers, but this may be disabled again in the caller */
flags . server = 1 ;
/* Account types - clear the invalid bit if it turns out to be valid */
if ( userAccountControl & UF_NORMAL_ACCOUNT ) {
if ( ent_type = = SAMBA_KDC_ENT_TYPE_CLIENT | | ent_type = = SAMBA_KDC_ENT_TYPE_ANY ) {
flags . client = 1 ;
}
flags . invalid = 0 ;
}
if ( userAccountControl & UF_INTERDOMAIN_TRUST_ACCOUNT ) {
if ( ent_type = = SAMBA_KDC_ENT_TYPE_CLIENT | | ent_type = = SAMBA_KDC_ENT_TYPE_ANY ) {
flags . client = 1 ;
}
flags . invalid = 0 ;
}
if ( userAccountControl & UF_WORKSTATION_TRUST_ACCOUNT ) {
if ( ent_type = = SAMBA_KDC_ENT_TYPE_CLIENT | | ent_type = = SAMBA_KDC_ENT_TYPE_ANY ) {
flags . client = 1 ;
}
flags . invalid = 0 ;
}
if ( userAccountControl & UF_SERVER_TRUST_ACCOUNT ) {
if ( ent_type = = SAMBA_KDC_ENT_TYPE_CLIENT | | ent_type = = SAMBA_KDC_ENT_TYPE_ANY ) {
flags . client = 1 ;
}
flags . invalid = 0 ;
}
/* Not permitted to act as a client if disabled */
if ( userAccountControl & UF_ACCOUNTDISABLE ) {
flags . client = 0 ;
}
if ( userAccountControl & UF_LOCKOUT ) {
2013-10-29 03:31:46 +04:00
flags . locked_out = 1 ;
2010-01-28 09:27:11 +03:00
}
/*
if ( userAccountControl & UF_PASSWORD_NOTREQD ) {
flags . invalid = 1 ;
}
*/
/*
UF_PASSWORD_CANT_CHANGE and UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED are irrelevent
*/
if ( userAccountControl & UF_TEMP_DUPLICATE_ACCOUNT ) {
flags . invalid = 1 ;
}
/* UF_DONT_EXPIRE_PASSWD and UF_USE_DES_KEY_ONLY handled in samba_kdc_message2entry() */
/*
if ( userAccountControl & UF_MNS_LOGON_ACCOUNT ) {
flags . invalid = 1 ;
}
*/
if ( userAccountControl & UF_SMARTCARD_REQUIRED ) {
flags . require_hwauth = 1 ;
}
if ( userAccountControl & UF_TRUSTED_FOR_DELEGATION ) {
flags . ok_as_delegate = 1 ;
}
2011-04-07 14:16:16 +04:00
if ( userAccountControl & UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION ) {
/*
* this is confusing . . .
*
* UF_TRUSTED_FOR_DELEGATION
* = > ok_as_delegate
*
* and
*
* UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
* = > trusted_for_delegation
*/
flags . trusted_for_delegation = 1 ;
}
2010-01-28 09:27:11 +03:00
if ( ! ( userAccountControl & UF_NOT_DELEGATED ) ) {
flags . forwardable = 1 ;
flags . proxiable = 1 ;
}
if ( userAccountControl & UF_DONT_REQUIRE_PREAUTH ) {
flags . require_preauth = 0 ;
} else {
flags . require_preauth = 1 ;
}
return flags ;
}
static int samba_kdc_entry_destructor ( struct samba_kdc_entry * p )
{
2015-02-25 13:52:45 +03:00
if ( p - > entry_ex ! = NULL ) {
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry_ex = p - > entry_ex ;
free_sdb_entry ( & entry_ex - > entry ) ;
2015-02-25 13:52:45 +03:00
}
return 0 ;
2010-01-28 09:27:11 +03:00
}
2016-09-08 11:50:58 +03:00
/*
* Sort keys in descending order of strength .
*
* Explanaton from Greg Hudson :
*
* To encrypt tickets only the first returned key is used by the MIT KDC . The
* other keys just communicate support for session key enctypes , and aren ' t
* really used . The encryption key for the ticket enc part doesn ' t have
* to be of a type requested by the client . The session key enctype is chosen
* based on the client preference order , limited by the set of enctypes present
* in the server keys ( unless the string attribute is set on the server
* principal overriding that set ) .
*/
static int samba_kdc_sort_encryption_keys ( struct sdb_entry_ex * entry_ex )
{
unsigned int i , j , idx = 0 ;
static const krb5_enctype etype_list [ ] = {
ENCTYPE_AES256_CTS_HMAC_SHA1_96 ,
ENCTYPE_AES128_CTS_HMAC_SHA1_96 ,
ENCTYPE_DES3_CBC_SHA1 ,
ENCTYPE_ARCFOUR_HMAC ,
ENCTYPE_DES_CBC_MD5 ,
ENCTYPE_DES_CBC_MD4 ,
ENCTYPE_DES_CBC_CRC ,
ENCTYPE_NULL
} ;
size_t etype_len = ARRAY_SIZE ( etype_list ) ;
size_t keys_size = entry_ex - > entry . keys . len ;
struct sdb_key * keys = entry_ex - > entry . keys . val ;
struct sdb_key * sorted_keys ;
sorted_keys = calloc ( keys_size , sizeof ( struct sdb_key ) ) ;
if ( sorted_keys = = NULL ) {
return - 1 ;
}
for ( i = 0 ; i < etype_len ; i + + ) {
for ( j = 0 ; j < keys_size ; j + + ) {
const struct sdb_key skey = keys [ j ] ;
2016-09-27 19:34:38 +03:00
if ( idx = = keys_size ) {
break ;
2016-09-08 11:50:58 +03:00
}
if ( KRB5_KEY_TYPE ( & skey . key ) = = etype_list [ i ] ) {
sorted_keys [ idx ] = skey ;
idx + + ;
}
}
}
/* Paranoia: Something went wrong during data copy */
2016-09-27 19:34:38 +03:00
if ( idx ! = keys_size ) {
2016-09-27 19:30:29 +03:00
free ( sorted_keys ) ;
2016-09-08 11:50:58 +03:00
return - 1 ;
}
free ( entry_ex - > entry . keys . val ) ;
entry_ex - > entry . keys . val = sorted_keys ;
return 0 ;
}
2010-01-28 09:27:11 +03:00
static krb5_error_code samba_kdc_message2entry_keys ( krb5_context context ,
2010-11-12 04:32:50 +03:00
struct samba_kdc_db_context * kdc_db_ctx ,
2010-06-13 07:19:23 +04:00
TALLOC_CTX * mem_ctx ,
struct ldb_message * msg ,
2010-06-24 03:40:16 +04:00
uint32_t rid ,
2010-09-29 03:06:39 +04:00
bool is_rodc ,
2010-10-05 11:27:36 +04:00
uint32_t userAccountControl ,
2010-06-13 07:19:23 +04:00
enum samba_kdc_ent_type ent_type ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry_ex )
2010-01-28 09:27:11 +03:00
{
krb5_error_code ret = 0 ;
enum ndr_err_code ndr_err ;
struct samr_Password * hash ;
const struct ldb_val * sc_val ;
struct supplementalCredentialsBlob scb ;
struct supplementalCredentialsPackage * scpk = NULL ;
bool newer_keys = false ;
struct package_PrimaryKerberosBlob _pkb ;
struct package_PrimaryKerberosCtr3 * pkb3 = NULL ;
struct package_PrimaryKerberosCtr4 * pkb4 = NULL ;
2010-04-12 01:17:15 +04:00
uint16_t i ;
uint16_t allocated_keys = 0 ;
2010-09-28 06:49:44 +04:00
int rodc_krbtgt_number = 0 ;
2011-03-04 18:12:29 +03:00
int kvno = 0 ;
2010-11-16 13:01:22 +03:00
uint32_t supported_enctypes
= ldb_msg_find_attr_as_uint ( msg ,
" msDS-SupportedEncryptionTypes " ,
0 ) ;
2010-01-28 09:27:11 +03:00
2010-10-01 23:25:26 +04:00
if ( rid = = DOMAIN_RID_KRBTGT | | is_rodc ) {
2010-11-16 13:01:22 +03:00
/* KDCs (and KDCs on RODCs) use AES */
supported_enctypes | = ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256 ;
2010-10-01 23:25:26 +04:00
} else if ( userAccountControl & ( UF_PARTIAL_SECRETS_ACCOUNT | UF_SERVER_TRUST_ACCOUNT ) ) {
/* DCs and RODCs comptuer accounts use AES */
2010-11-16 13:01:22 +03:00
supported_enctypes | = ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256 ;
2010-10-01 23:25:26 +04:00
} else if ( ent_type = = SAMBA_KDC_ENT_TYPE_CLIENT | |
( ent_type = = SAMBA_KDC_ENT_TYPE_ANY ) ) {
/* for AS-REQ the client chooses the enc types it
* supports , and this will vary between computers a
2010-11-16 13:01:22 +03:00
* user logs in from .
2010-10-01 23:25:26 +04:00
*
* likewise for ' any ' return as much as is supported ,
* to export into a keytab */
2010-11-16 13:01:22 +03:00
supported_enctypes = ENC_ALL_TYPES ;
}
/* If UF_USE_DES_KEY_ONLY has been set, then don't allow use of the newer enc types */
if ( userAccountControl & UF_USE_DES_KEY_ONLY ) {
supported_enctypes = ENC_CRC32 | ENC_RSA_MD5 ;
2010-10-01 23:25:26 +04:00
} else {
2010-11-16 13:01:22 +03:00
/* Otherwise, add in the default enc types */
supported_enctypes | = ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5 ;
2010-06-24 03:40:16 +04:00
}
2010-09-28 06:49:44 +04:00
2010-10-01 23:25:26 +04:00
/* Is this the krbtgt or a RODC krbtgt */
2010-09-29 03:06:39 +04:00
if ( is_rodc ) {
2010-09-28 06:49:44 +04:00
rodc_krbtgt_number = ldb_msg_find_attr_as_int ( msg , " msDS-SecondaryKrbTgtNumber " , - 1 ) ;
if ( rodc_krbtgt_number = = - 1 ) {
return EINVAL ;
}
}
2010-01-28 09:27:11 +03:00
entry_ex - > entry . keys . val = NULL ;
entry_ex - > entry . keys . len = 0 ;
2016-06-02 18:47:12 +03:00
entry_ex - > entry . kvno = 0 ;
if ( ( ent_type = = SAMBA_KDC_ENT_TYPE_CLIENT )
& & ( userAccountControl & UF_SMARTCARD_REQUIRED ) ) {
uint8_t secretbuffer [ 32 ] ;
/*
* Fake keys until we have a better way to reject
* non - pkinit requests .
*
* We just need to indicate which encryption types are
* supported .
*/
generate_secret_buffer ( secretbuffer , sizeof ( secretbuffer ) ) ;
allocated_keys = 3 ;
entry_ex - > entry . keys . len = 0 ;
entry_ex - > entry . keys . val = calloc ( allocated_keys , sizeof ( struct sdb_key ) ) ;
if ( entry_ex - > entry . keys . val = = NULL ) {
ZERO_STRUCT ( secretbuffer ) ;
ret = ENOMEM ;
goto out ;
}
if ( supported_enctypes & ENC_HMAC_SHA1_96_AES256 ) {
struct sdb_key key = { } ;
ret = smb_krb5_keyblock_init_contents ( context ,
ENCTYPE_AES256_CTS_HMAC_SHA1_96 ,
secretbuffer , 32 ,
& key . key ) ;
if ( ret ) {
ZERO_STRUCT ( secretbuffer ) ;
goto out ;
}
entry_ex - > entry . keys . val [ entry_ex - > entry . keys . len ] = key ;
entry_ex - > entry . keys . len + + ;
}
if ( supported_enctypes & ENC_HMAC_SHA1_96_AES128 ) {
struct sdb_key key = { } ;
ret = smb_krb5_keyblock_init_contents ( context ,
ENCTYPE_AES128_CTS_HMAC_SHA1_96 ,
secretbuffer , 16 ,
& key . key ) ;
if ( ret ) {
ZERO_STRUCT ( secretbuffer ) ;
goto out ;
}
entry_ex - > entry . keys . val [ entry_ex - > entry . keys . len ] = key ;
entry_ex - > entry . keys . len + + ;
}
if ( supported_enctypes & ENC_RC4_HMAC_MD5 ) {
struct sdb_key key = { } ;
ret = smb_krb5_keyblock_init_contents ( context ,
ENCTYPE_ARCFOUR_HMAC ,
secretbuffer , 16 ,
& key . key ) ;
if ( ret ) {
ZERO_STRUCT ( secretbuffer ) ;
goto out ;
}
entry_ex - > entry . keys . val [ entry_ex - > entry . keys . len ] = key ;
entry_ex - > entry . keys . len + + ;
}
ret = 0 ;
goto out ;
}
2010-01-28 09:27:11 +03:00
2011-03-04 18:12:29 +03:00
kvno = ldb_msg_find_attr_as_int ( msg , " msDS-KeyVersionNumber " , 0 ) ;
2010-09-28 06:49:44 +04:00
if ( is_rodc ) {
2011-03-04 18:12:29 +03:00
kvno = SAMBA_KVNO_AND_KRBTGT ( kvno , rodc_krbtgt_number ) ;
2010-09-28 06:49:44 +04:00
}
2011-03-04 18:12:29 +03:00
entry_ex - > entry . kvno = kvno ;
2010-01-28 09:27:11 +03:00
/* Get keys from the db */
hash = samdb_result_hash ( mem_ctx , msg , " unicodePwd " ) ;
sc_val = ldb_msg_find_ldb_val ( msg , " supplementalCredentials " ) ;
/* unicodePwd for enctype 0x17 (23) if present */
if ( hash ) {
allocated_keys + + ;
}
/* supplementalCredentials if present */
if ( sc_val ) {
2010-05-09 19:20:01 +04:00
ndr_err = ndr_pull_struct_blob_all ( sc_val , mem_ctx , & scb ,
2010-01-28 09:27:11 +03:00
( ndr_pull_flags_fn_t ) ndr_pull_supplementalCredentialsBlob ) ;
if ( ! NDR_ERR_CODE_IS_SUCCESS ( ndr_err ) ) {
dump_data ( 0 , sc_val - > data , sc_val - > length ) ;
ret = EINVAL ;
goto out ;
}
if ( scb . sub . signature ! = SUPPLEMENTAL_CREDENTIALS_SIGNATURE ) {
2016-06-03 17:34:08 +03:00
if ( scb . sub . num_packages ! = 0 ) {
NDR_PRINT_DEBUG ( supplementalCredentialsBlob , & scb ) ;
ret = EINVAL ;
goto out ;
}
2010-01-28 09:27:11 +03:00
}
for ( i = 0 ; i < scb . sub . num_packages ; i + + ) {
if ( strcmp ( " Primary:Kerberos-Newer-Keys " , scb . sub . packages [ i ] . name ) = = 0 ) {
scpk = & scb . sub . packages [ i ] ;
if ( ! scpk - > data | | ! scpk - > data [ 0 ] ) {
scpk = NULL ;
continue ;
}
newer_keys = true ;
break ;
} else if ( strcmp ( " Primary:Kerberos " , scb . sub . packages [ i ] . name ) = = 0 ) {
scpk = & scb . sub . packages [ i ] ;
if ( ! scpk - > data | | ! scpk - > data [ 0 ] ) {
scpk = NULL ;
}
/*
* we don ' t break here in hope to find
* a Kerberos - Newer - Keys package
*/
}
}
}
/*
* Primary : Kerberos - Newer - Keys or Primary : Kerberos element
* of supplementalCredentials
*/
if ( scpk ) {
DATA_BLOB blob ;
blob = strhex_to_data_blob ( mem_ctx , scpk - > data ) ;
if ( ! blob . data ) {
ret = ENOMEM ;
goto out ;
}
/* we cannot use ndr_pull_struct_blob_all() here, as w2k and w2k3 add padding bytes */
2010-05-09 19:20:01 +04:00
ndr_err = ndr_pull_struct_blob ( & blob , mem_ctx , & _pkb ,
2010-01-28 09:27:11 +03:00
( ndr_pull_flags_fn_t ) ndr_pull_package_PrimaryKerberosBlob ) ;
if ( ! NDR_ERR_CODE_IS_SUCCESS ( ndr_err ) ) {
ret = EINVAL ;
krb5_set_error_message ( context , ret , " samba_kdc_message2entry_keys: could not parse package_PrimaryKerberosBlob " ) ;
krb5_warnx ( context , " samba_kdc_message2entry_keys: could not parse package_PrimaryKerberosBlob " ) ;
goto out ;
}
if ( newer_keys & & _pkb . version ! = 4 ) {
ret = EINVAL ;
krb5_set_error_message ( context , ret , " samba_kdc_message2entry_keys: Primary:Kerberos-Newer-Keys not version 4 " ) ;
krb5_warnx ( context , " samba_kdc_message2entry_keys: Primary:Kerberos-Newer-Keys not version 4 " ) ;
goto out ;
}
if ( ! newer_keys & & _pkb . version ! = 3 ) {
ret = EINVAL ;
krb5_set_error_message ( context , ret , " samba_kdc_message2entry_keys: could not parse Primary:Kerberos not version 3 " ) ;
krb5_warnx ( context , " samba_kdc_message2entry_keys: could not parse Primary:Kerberos not version 3 " ) ;
goto out ;
}
if ( _pkb . version = = 4 ) {
pkb4 = & _pkb . ctr . ctr4 ;
allocated_keys + = pkb4 - > num_keys ;
} else if ( _pkb . version = = 3 ) {
pkb3 = & _pkb . ctr . ctr3 ;
allocated_keys + = pkb3 - > num_keys ;
}
}
if ( allocated_keys = = 0 ) {
2010-11-12 04:32:50 +03:00
if ( kdc_db_ctx - > rodc ) {
/* We are on an RODC, but don't have keys for this account. Signal this to the caller */
2017-04-03 07:11:35 +03:00
auth_sam_trigger_repl_secret ( kdc_db_ctx , kdc_db_ctx - > msg_ctx ,
kdc_db_ctx - > ev_ctx , msg - > dn ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOT_FOUND_HERE ;
2010-11-12 04:32:50 +03:00
}
2010-01-28 09:27:11 +03:00
/* oh, no password. Apparently (comment in
* hdb - ldap . c ) this violates the ASN .1 , but this
* allows an entry with no keys ( yet ) . */
return 0 ;
}
/* allocate space to decode into */
entry_ex - > entry . keys . len = 0 ;
2014-05-08 19:13:04 +04:00
entry_ex - > entry . keys . val = calloc ( allocated_keys , sizeof ( struct sdb_key ) ) ;
2010-01-28 09:27:11 +03:00
if ( entry_ex - > entry . keys . val = = NULL ) {
ret = ENOMEM ;
goto out ;
}
2010-06-24 03:40:16 +04:00
if ( hash & & ( supported_enctypes & ENC_RC4_HMAC_MD5 ) ) {
2014-05-08 19:13:04 +04:00
struct sdb_key key = { } ;
2010-01-28 09:27:11 +03:00
2014-05-07 18:46:31 +04:00
ret = smb_krb5_keyblock_init_contents ( context ,
ENCTYPE_ARCFOUR_HMAC ,
hash - > hash ,
sizeof ( hash - > hash ) ,
& key . key ) ;
2010-01-28 09:27:11 +03:00
if ( ret ) {
goto out ;
}
entry_ex - > entry . keys . val [ entry_ex - > entry . keys . len ] = key ;
entry_ex - > entry . keys . len + + ;
}
if ( pkb4 ) {
for ( i = 0 ; i < pkb4 - > num_keys ; i + + ) {
2014-05-08 19:13:04 +04:00
struct sdb_key key = { } ;
2010-01-28 09:27:11 +03:00
if ( ! pkb4 - > keys [ i ] . value ) continue ;
2010-06-24 03:40:16 +04:00
if ( ! ( kerberos_enctype_to_bitmap ( pkb4 - > keys [ i ] . keytype ) & supported_enctypes ) ) {
2010-06-13 07:19:23 +04:00
continue ;
2010-01-28 09:27:11 +03:00
}
if ( pkb4 - > salt . string ) {
DATA_BLOB salt ;
salt = data_blob_string_const ( pkb4 - > salt . string ) ;
key . salt = calloc ( 1 , sizeof ( * key . salt ) ) ;
if ( key . salt = = NULL ) {
ret = ENOMEM ;
goto out ;
}
2014-05-08 16:32:47 +04:00
key . salt - > type = KRB5_PW_SALT ;
2010-01-28 09:27:11 +03:00
2016-08-26 12:57:30 +03:00
ret = smb_krb5_copy_data_contents ( & key . salt - > salt ,
salt . data ,
salt . length ) ;
2010-01-28 09:27:11 +03:00
if ( ret ) {
free ( key . salt ) ;
key . salt = NULL ;
goto out ;
}
}
/* TODO: maybe pass the iteration_count somehow... */
2014-05-07 18:46:31 +04:00
ret = smb_krb5_keyblock_init_contents ( context ,
pkb4 - > keys [ i ] . keytype ,
pkb4 - > keys [ i ] . value - > data ,
pkb4 - > keys [ i ] . value - > length ,
& key . key ) ;
2010-01-28 09:27:11 +03:00
if ( ret = = KRB5_PROG_ETYPE_NOSUPP ) {
DEBUG ( 2 , ( " Unsupported keytype ignored - type %u \n " ,
pkb4 - > keys [ i ] . keytype ) ) ;
ret = 0 ;
continue ;
}
if ( ret ) {
if ( key . salt ) {
2016-08-26 12:51:52 +03:00
smb_krb5_free_data_contents ( context , & key . salt - > salt ) ;
2010-01-28 09:27:11 +03:00
free ( key . salt ) ;
key . salt = NULL ;
}
goto out ;
}
entry_ex - > entry . keys . val [ entry_ex - > entry . keys . len ] = key ;
entry_ex - > entry . keys . len + + ;
}
} else if ( pkb3 ) {
for ( i = 0 ; i < pkb3 - > num_keys ; i + + ) {
2014-05-08 19:13:04 +04:00
struct sdb_key key = { } ;
2010-01-28 09:27:11 +03:00
if ( ! pkb3 - > keys [ i ] . value ) continue ;
2010-06-24 03:40:16 +04:00
if ( ! ( kerberos_enctype_to_bitmap ( pkb3 - > keys [ i ] . keytype ) & supported_enctypes ) ) {
2010-06-13 07:19:23 +04:00
continue ;
2010-01-28 09:27:11 +03:00
}
if ( pkb3 - > salt . string ) {
DATA_BLOB salt ;
salt = data_blob_string_const ( pkb3 - > salt . string ) ;
key . salt = calloc ( 1 , sizeof ( * key . salt ) ) ;
if ( key . salt = = NULL ) {
ret = ENOMEM ;
goto out ;
}
2014-05-08 16:32:47 +04:00
key . salt - > type = KRB5_PW_SALT ;
2010-01-28 09:27:11 +03:00
2016-08-26 12:57:30 +03:00
ret = smb_krb5_copy_data_contents ( & key . salt - > salt ,
salt . data ,
salt . length ) ;
2010-01-28 09:27:11 +03:00
if ( ret ) {
free ( key . salt ) ;
key . salt = NULL ;
goto out ;
}
}
2014-05-07 18:46:31 +04:00
ret = smb_krb5_keyblock_init_contents ( context ,
pkb3 - > keys [ i ] . keytype ,
pkb3 - > keys [ i ] . value - > data ,
pkb3 - > keys [ i ] . value - > length ,
& key . key ) ;
2010-01-28 09:27:11 +03:00
if ( ret ) {
if ( key . salt ) {
2016-08-26 12:51:52 +03:00
smb_krb5_free_data_contents ( context , & key . salt - > salt ) ;
2010-01-28 09:27:11 +03:00
free ( key . salt ) ;
key . salt = NULL ;
}
goto out ;
}
entry_ex - > entry . keys . val [ entry_ex - > entry . keys . len ] = key ;
entry_ex - > entry . keys . len + + ;
}
}
out :
if ( ret ! = 0 ) {
entry_ex - > entry . keys . len = 0 ;
2016-09-08 11:50:58 +03:00
} else if ( entry_ex - > entry . keys . len > 0 & &
entry_ex - > entry . keys . val ! = NULL ) {
ret = samba_kdc_sort_encryption_keys ( entry_ex ) ;
if ( ret ! = 0 ) {
entry_ex - > entry . keys . len = 0 ;
ret = ENOMEM ;
}
2010-01-28 09:27:11 +03:00
}
if ( entry_ex - > entry . keys . len = = 0 & & entry_ex - > entry . keys . val ) {
free ( entry_ex - > entry . keys . val ) ;
entry_ex - > entry . keys . val = NULL ;
}
return ret ;
}
2014-05-15 17:57:06 +04:00
static int principal_comp_strcmp_int ( krb5_context context ,
krb5_const_principal principal ,
unsigned int component ,
const char * string ,
bool do_strcasecmp )
{
const char * p ;
size_t len ;
# if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING)
p = krb5_principal_get_comp_string ( context , principal , component ) ;
if ( p = = NULL ) {
return - 1 ;
}
len = strlen ( p ) ;
# else
krb5_data * d ;
if ( component > = krb5_princ_size ( context , principal ) ) {
return - 1 ;
}
d = krb5_princ_component ( context , principal , component ) ;
if ( d = = NULL ) {
return - 1 ;
}
p = d - > data ;
len = d - > length ;
# endif
if ( do_strcasecmp ) {
return strncasecmp ( p , string , len ) ;
} else {
return strncmp ( p , string , len ) ;
}
}
static int principal_comp_strcasecmp ( krb5_context context ,
krb5_const_principal principal ,
unsigned int component ,
const char * string )
{
return principal_comp_strcmp_int ( context , principal ,
component , string , true ) ;
}
static int principal_comp_strcmp ( krb5_context context ,
krb5_const_principal principal ,
unsigned int component ,
const char * string )
{
return principal_comp_strcmp_int ( context , principal ,
component , string , false ) ;
}
2010-01-28 09:27:11 +03:00
/*
* Construct an hdb_entry from a directory entry .
*/
static krb5_error_code samba_kdc_message2entry ( krb5_context context ,
2010-11-16 06:12:17 +03:00
struct samba_kdc_db_context * kdc_db_ctx ,
2015-02-25 13:54:52 +03:00
TALLOC_CTX * mem_ctx ,
krb5_const_principal principal ,
2010-11-16 06:12:17 +03:00
enum samba_kdc_ent_type ent_type ,
unsigned flags ,
struct ldb_dn * realm_dn ,
struct ldb_message * msg ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry_ex )
2010-01-28 09:27:11 +03:00
{
struct loadparm_context * lp_ctx = kdc_db_ctx - > lp_ctx ;
2010-10-05 11:27:36 +04:00
uint32_t userAccountControl ;
2013-10-30 01:50:19 +04:00
uint32_t msDS_User_Account_Control_Computed ;
2010-01-28 09:27:11 +03:00
krb5_error_code ret = 0 ;
krb5_boolean is_computer = FALSE ;
struct samba_kdc_entry * p ;
NTTIME acct_expiry ;
NTSTATUS status ;
uint32_t rid ;
2010-09-29 03:06:39 +04:00
bool is_rodc = false ;
2010-01-28 09:27:11 +03:00
struct ldb_message_element * objectclasses ;
struct ldb_val computer_val ;
const char * samAccountName = ldb_msg_find_attr_as_string ( msg , " samAccountName " , NULL ) ;
computer_val . data = discard_const_p ( uint8_t , " computer " ) ;
computer_val . length = strlen ( ( const char * ) computer_val . data ) ;
2010-09-29 03:06:39 +04:00
if ( ldb_msg_find_element ( msg , " msDS-SecondaryKrbTgtNumber " ) ) {
is_rodc = true ;
}
2010-01-28 09:27:11 +03:00
if ( ! samAccountName ) {
ret = ENOENT ;
krb5_set_error_message ( context , ret , " samba_kdc_message2entry: no samAccountName present " ) ;
goto out ;
}
objectclasses = ldb_msg_find_element ( msg , " objectClass " ) ;
if ( objectclasses & & ldb_msg_find_val ( objectclasses , & computer_val ) ) {
is_computer = TRUE ;
}
2015-02-25 13:55:43 +03:00
ZERO_STRUCTP ( entry_ex ) ;
2010-01-28 09:27:11 +03:00
2015-02-25 13:55:43 +03:00
p = talloc_zero ( mem_ctx , struct samba_kdc_entry ) ;
2010-01-28 09:27:11 +03:00
if ( ! p ) {
ret = ENOMEM ;
goto out ;
}
p - > kdc_db_ctx = kdc_db_ctx ;
p - > realm_dn = talloc_reference ( p , realm_dn ) ;
if ( ! p - > realm_dn ) {
ret = ENOMEM ;
goto out ;
}
talloc_set_destructor ( p , samba_kdc_entry_destructor ) ;
entry_ex - > ctx = p ;
userAccountControl = ldb_msg_find_attr_as_uint ( msg , " userAccountControl " , 0 ) ;
2013-10-30 01:50:19 +04:00
msDS_User_Account_Control_Computed
= ldb_msg_find_attr_as_uint ( msg ,
" msDS-User-Account-Control-Computed " ,
UF_ACCOUNTDISABLE ) ;
/*
* This brings in the lockout flag , block the account if not
* found . We need the weird UF_ACCOUNTDISABLE check because
* we do not want to fail open if the value is not returned ,
* but 0 is a valid value ( all OK )
*/
if ( msDS_User_Account_Control_Computed = = UF_ACCOUNTDISABLE ) {
ret = EINVAL ;
krb5_set_error_message ( context , ret , " samba_kdc_message2entry: "
" no msDS-User-Account-Control-Computed present " ) ;
goto out ;
} else {
userAccountControl | = msDS_User_Account_Control_Computed ;
}
2010-01-28 09:27:11 +03:00
2015-01-22 04:11:52 +03:00
/*
* If we are set to canonicalize , we get back the fixed UPPER
* case realm , and the real username ( ie matching LDAP
* samAccountName )
*
* Otherwise , if we are set to enterprise , we
* get back the whole principal as - sent
*
* Finally , if we are not set to canonicalize , we get back the
* fixed UPPER case realm , but the as - sent username
*/
2015-01-23 06:41:50 +03:00
if ( ent_type = = SAMBA_KDC_ENT_TYPE_KRBTGT ) {
2014-05-08 19:13:04 +04:00
if ( flags & ( SDB_F_CANON ) ) {
2015-01-30 02:31:29 +03:00
/*
* When requested to do so , ensure that the
2015-01-23 06:41:50 +03:00
* both realm values in the principal are set
2015-01-30 02:31:29 +03:00
* to the upper case , canonical realm
*/
2014-05-07 18:47:52 +04:00
ret = smb_krb5_make_principal ( context , & entry_ex - > entry . principal ,
lpcfg_realm ( lp_ctx ) , " krbtgt " ,
lpcfg_realm ( lp_ctx ) , NULL ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
2015-02-10 15:14:21 +03:00
smb_krb5_principal_set_type ( context , entry_ex - > entry . principal , KRB5_NT_SRV_INST ) ;
2015-01-30 02:31:29 +03:00
} else {
ret = krb5_copy_principal ( context , principal , & entry_ex - > entry . principal ) ;
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
/*
* this appears to be required regardless of
* the canonicalize flag from the client
*/
2014-05-08 12:09:17 +04:00
ret = smb_krb5_principal_set_realm ( context , entry_ex - > entry . principal , lpcfg_realm ( lp_ctx ) ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
2015-01-23 06:41:50 +03:00
}
}
} else if ( ent_type = = SAMBA_KDC_ENT_TYPE_ANY & & principal = = NULL ) {
2014-05-07 18:47:52 +04:00
ret = smb_krb5_make_principal ( context , & entry_ex - > entry . principal , lpcfg_realm ( lp_ctx ) , samAccountName , NULL ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
2014-05-08 19:13:04 +04:00
} else if ( flags & SDB_F_CANON & & flags & SDB_F_FOR_AS_REQ ) {
2015-01-30 02:31:29 +03:00
/*
2014-05-08 19:13:04 +04:00
* SDB_F_CANON maps from the canonicalize flag in the
2015-01-30 02:31:29 +03:00
* packet , and has a different meaning between AS - REQ
* and TGS - REQ . We only change the principal in the AS - REQ case
*/
2014-05-07 18:47:52 +04:00
ret = smb_krb5_make_principal ( context , & entry_ex - > entry . principal , lpcfg_realm ( lp_ctx ) , samAccountName , NULL ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
2010-01-28 09:27:11 +03:00
} else {
2015-01-30 02:31:29 +03:00
ret = krb5_copy_principal ( context , principal , & entry_ex - > entry . principal ) ;
2010-01-28 09:27:11 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
2014-05-08 14:21:43 +04:00
if ( smb_krb5_principal_get_type ( context , principal ) ! = KRB5_NT_ENTERPRISE_PRINCIPAL ) {
2015-01-22 04:11:52 +03:00
/* While we have copied the client principal, tests
* show that Win2k3 returns the ' corrected ' realm , not
* the client - specified realm . This code attempts to
* replace the client principal ' s realm with the one
* we determine from our records */
/* this has to be with malloc() */
2014-05-08 12:09:17 +04:00
ret = smb_krb5_principal_set_realm ( context , entry_ex - > entry . principal , lpcfg_realm ( lp_ctx ) ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
2015-01-22 04:11:52 +03:00
}
2010-01-28 09:27:11 +03:00
}
/* First try and figure out the flags based on the userAccountControl */
2014-05-08 19:13:04 +04:00
entry_ex - > entry . flags = uf2SDBFlags ( context , userAccountControl , ent_type ) ;
2010-01-28 09:27:11 +03:00
/* Windows 2008 seems to enforce this (very sensible) rule by
* default - don ' t allow offline attacks on a user ' s password
* by asking for a ticket to them as a service ( encrypted with
* their probably patheticly insecure password ) */
if ( entry_ex - > entry . flags . server
2010-07-16 08:32:42 +04:00
& & lpcfg_parm_bool ( lp_ctx , NULL , " kdc " , " require spn for service " , true ) ) {
2010-01-28 09:27:11 +03:00
if ( ! is_computer & & ! ldb_msg_find_attr_as_string ( msg , " servicePrincipalName " , NULL ) ) {
entry_ex - > entry . flags . server = 0 ;
}
}
2015-01-30 02:31:29 +03:00
/*
* To give the correct type of error to the client , we must
* not just return the entry without . server set , we must
* pretend the principal does not exist . Otherwise we may
* return ERR_POLICY instead of
* KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN
*/
if ( ent_type = = SAMBA_KDC_ENT_TYPE_SERVER & & entry_ex - > entry . flags . server = = 0 ) {
2014-05-08 19:13:04 +04:00
ret = SDB_ERR_NOENTRY ;
2015-01-30 02:31:29 +03:00
krb5_set_error_message ( context , ret , " samba_kdc_message2entry: no servicePrincipalName present for this server, refusing with no-such-entry " ) ;
goto out ;
}
2014-05-08 19:13:04 +04:00
if ( flags & SDB_F_ADMIN_DATA ) {
2010-01-28 09:27:11 +03:00
/* These (created_by, modified_by) parts of the entry are not relevant for Samba4's use
* of the Heimdal KDC . They are stored in a the traditional
* DB for audit purposes , and still form part of the structure
* we must return */
/* use 'whenCreated' */
entry_ex - > entry . created_by . time = ldb_msg_find_krb5time_ldap_time ( msg , " whenCreated " , 0 ) ;
2010-01-28 16:58:44 +03:00
/* use 'kadmin' for now (needed by mit_samba) */
2014-05-07 18:47:52 +04:00
ret = smb_krb5_make_principal ( context ,
& entry_ex - > entry . created_by . principal ,
lpcfg_realm ( lp_ctx ) , " kadmin " , NULL ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
2010-01-28 09:27:11 +03:00
2014-05-08 19:13:04 +04:00
entry_ex - > entry . modified_by = ( struct sdb_event * ) malloc ( sizeof ( struct sdb_event ) ) ;
2010-01-28 09:27:11 +03:00
if ( entry_ex - > entry . modified_by = = NULL ) {
ret = ENOMEM ;
krb5_set_error_message ( context , ret , " malloc: out of memory " ) ;
goto out ;
}
/* use 'whenChanged' */
entry_ex - > entry . modified_by - > time = ldb_msg_find_krb5time_ldap_time ( msg , " whenChanged " , 0 ) ;
2010-01-28 16:58:44 +03:00
/* use 'kadmin' for now (needed by mit_samba) */
2014-05-07 18:47:52 +04:00
ret = smb_krb5_make_principal ( context ,
& entry_ex - > entry . modified_by - > principal ,
lpcfg_realm ( lp_ctx ) , " kadmin " , NULL ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
2010-01-28 09:27:11 +03:00
}
/* The lack of password controls etc applies to krbtgt by
* virtue of being that particular RID */
status = dom_sid_split_rid ( NULL , samdb_result_dom_sid ( mem_ctx , msg , " objectSid " ) , NULL , & rid ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
ret = EINVAL ;
goto out ;
}
if ( rid = = DOMAIN_RID_KRBTGT ) {
2014-05-08 12:10:49 +04:00
char * realm = NULL ;
2010-01-28 09:27:11 +03:00
entry_ex - > entry . valid_end = NULL ;
entry_ex - > entry . pw_end = NULL ;
entry_ex - > entry . flags . invalid = 0 ;
entry_ex - > entry . flags . server = 1 ;
2014-05-08 12:10:49 +04:00
realm = smb_krb5_principal_get_realm ( context , principal ) ;
if ( realm = = NULL ) {
ret = ENOMEM ;
goto out ;
}
2010-01-28 09:27:11 +03:00
/* Don't mark all requests for the krbtgt/realm as
* ' change password ' , as otherwise we could get into
* trouble , and not enforce the password expirty .
* Instead , only do it when request is for the kpasswd service */
if ( ent_type = = SAMBA_KDC_ENT_TYPE_SERVER
2014-05-08 12:25:07 +04:00
& & krb5_princ_size ( context , principal ) = = 2
2014-05-16 13:44:02 +04:00
& & ( principal_comp_strcmp ( context , principal , 0 , " kadmin " ) = = 0 )
& & ( principal_comp_strcmp ( context , principal , 1 , " changepw " ) = = 0 )
2014-05-08 12:10:49 +04:00
& & lpcfg_is_my_domain_or_realm ( lp_ctx , realm ) ) {
2010-01-28 09:27:11 +03:00
entry_ex - > entry . flags . change_pw = 1 ;
}
2014-05-08 12:10:49 +04:00
SAFE_FREE ( realm ) ;
2010-01-28 09:27:11 +03:00
entry_ex - > entry . flags . client = 0 ;
entry_ex - > entry . flags . forwardable = 1 ;
entry_ex - > entry . flags . ok_as_delegate = 1 ;
2010-09-29 03:06:39 +04:00
} else if ( is_rodc ) {
/* The RODC krbtgt account is like the main krbtgt,
* but it does not have a changepw or kadmin
* service */
entry_ex - > entry . valid_end = NULL ;
entry_ex - > entry . pw_end = NULL ;
/* Also don't allow the RODC krbtgt to be a client (it should not be needed) */
entry_ex - > entry . flags . client = 0 ;
entry_ex - > entry . flags . invalid = 0 ;
entry_ex - > entry . flags . server = 1 ;
entry_ex - > entry . flags . client = 0 ;
2010-09-29 06:10:27 +04:00
entry_ex - > entry . flags . forwardable = 1 ;
2010-09-29 03:06:39 +04:00
entry_ex - > entry . flags . ok_as_delegate = 0 ;
2010-01-28 09:27:11 +03:00
} else if ( entry_ex - > entry . flags . server & & ent_type = = SAMBA_KDC_ENT_TYPE_SERVER ) {
/* The account/password expiry only applies when the account is used as a
* client ( ie password login ) , not when used as a server */
/* Make very well sure we don't use this for a client,
* it could bypass the password restrictions */
entry_ex - > entry . flags . client = 0 ;
entry_ex - > entry . valid_end = NULL ;
entry_ex - > entry . pw_end = NULL ;
} else {
NTTIME must_change_time
2016-06-04 01:48:56 +03:00
= samdb_result_nttime ( msg ,
" msDS-UserPasswordExpiryTimeComputed " ,
0 ) ;
2010-01-28 09:27:11 +03:00
if ( must_change_time = = 0x7FFFFFFFFFFFFFFFULL ) {
entry_ex - > entry . pw_end = NULL ;
} else {
entry_ex - > entry . pw_end = malloc ( sizeof ( * entry_ex - > entry . pw_end ) ) ;
if ( entry_ex - > entry . pw_end = = NULL ) {
ret = ENOMEM ;
goto out ;
}
* entry_ex - > entry . pw_end = nt_time_to_unix ( must_change_time ) ;
}
acct_expiry = samdb_result_account_expires ( msg ) ;
if ( acct_expiry = = 0x7FFFFFFFFFFFFFFFULL ) {
entry_ex - > entry . valid_end = NULL ;
} else {
entry_ex - > entry . valid_end = malloc ( sizeof ( * entry_ex - > entry . valid_end ) ) ;
if ( entry_ex - > entry . valid_end = = NULL ) {
ret = ENOMEM ;
goto out ;
}
* entry_ex - > entry . valid_end = nt_time_to_unix ( acct_expiry ) ;
}
}
entry_ex - > entry . valid_start = NULL ;
2010-12-09 06:17:54 +03:00
entry_ex - > entry . max_life = malloc ( sizeof ( * entry_ex - > entry . max_life ) ) ;
if ( entry_ex - > entry . max_life = = NULL ) {
ret = ENOMEM ;
goto out ;
}
2010-01-28 09:27:11 +03:00
2010-12-09 06:17:54 +03:00
if ( ent_type = = SAMBA_KDC_ENT_TYPE_SERVER ) {
2012-04-20 01:54:57 +04:00
* entry_ex - > entry . max_life = kdc_db_ctx - > policy . svc_tkt_lifetime ;
2010-12-09 06:17:54 +03:00
} else if ( ent_type = = SAMBA_KDC_ENT_TYPE_KRBTGT | | ent_type = = SAMBA_KDC_ENT_TYPE_CLIENT ) {
2012-04-20 01:54:57 +04:00
* entry_ex - > entry . max_life = kdc_db_ctx - > policy . usr_tkt_lifetime ;
2010-12-09 06:17:54 +03:00
} else {
2012-04-20 01:54:57 +04:00
* entry_ex - > entry . max_life = MIN ( kdc_db_ctx - > policy . svc_tkt_lifetime ,
kdc_db_ctx - > policy . usr_tkt_lifetime ) ;
2010-12-09 06:17:54 +03:00
}
entry_ex - > entry . max_renew = malloc ( sizeof ( * entry_ex - > entry . max_life ) ) ;
if ( entry_ex - > entry . max_renew = = NULL ) {
ret = ENOMEM ;
goto out ;
}
2012-04-20 01:54:57 +04:00
* entry_ex - > entry . max_renew = kdc_db_ctx - > policy . renewal_lifetime ;
2010-01-28 09:27:11 +03:00
/* Get keys from the db */
2010-11-12 04:32:50 +03:00
ret = samba_kdc_message2entry_keys ( context , kdc_db_ctx , p , msg ,
2010-09-29 03:06:39 +04:00
rid , is_rodc , userAccountControl ,
2010-06-13 07:19:23 +04:00
ent_type , entry_ex ) ;
2010-01-28 09:27:11 +03:00
if ( ret ) {
2015-04-16 13:57:14 +03:00
/* Could be bogus data in the entry, or out of memory */
2010-01-28 09:27:11 +03:00
goto out ;
}
p - > msg = talloc_steal ( p , msg ) ;
out :
if ( ret ! = 0 ) {
/* This doesn't free ent itself, that is for the eventual caller to do */
2014-05-08 19:13:04 +04:00
sdb_free_entry ( entry_ex ) ;
2015-02-25 13:55:43 +03:00
ZERO_STRUCTP ( entry_ex ) ;
2010-01-28 09:27:11 +03:00
} else {
talloc_steal ( kdc_db_ctx , entry_ex - > ctx ) ;
}
return ret ;
}
/*
* Construct an hdb_entry from a directory entry .
2011-09-30 00:47:08 +04:00
* The kvno is what the remote client asked for
2010-01-28 09:27:11 +03:00
*/
static krb5_error_code samba_kdc_trust_message2entry ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
TALLOC_CTX * mem_ctx , krb5_const_principal principal ,
enum trust_direction direction ,
struct ldb_dn * realm_dn ,
2011-09-30 00:47:08 +04:00
unsigned flags ,
uint32_t kvno ,
2010-01-28 09:27:11 +03:00
struct ldb_message * msg ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry_ex )
2010-01-28 09:27:11 +03:00
{
struct loadparm_context * lp_ctx = kdc_db_ctx - > lp_ctx ;
2015-06-10 11:25:20 +03:00
const char * our_realm = lpcfg_realm ( lp_ctx ) ;
const char * dnsdomain = NULL ;
char * partner_realm = NULL ;
const char * realm = NULL ;
const char * krbtgt_realm = NULL ;
2014-12-15 18:48:27 +03:00
DATA_BLOB password_utf16 = data_blob_null ;
DATA_BLOB password_utf8 = data_blob_null ;
struct samr_Password _password_hash ;
const struct samr_Password * password_hash = NULL ;
2010-01-28 09:27:11 +03:00
const struct ldb_val * password_val ;
struct trustAuthInOutBlob password_blob ;
struct samba_kdc_entry * p ;
2015-04-10 23:31:20 +03:00
bool use_previous = false ;
2011-09-30 00:47:08 +04:00
uint32_t current_kvno ;
2015-04-10 23:31:20 +03:00
uint32_t previous_kvno ;
2014-12-15 18:48:27 +03:00
uint32_t num_keys = 0 ;
2010-01-28 09:27:11 +03:00
enum ndr_err_code ndr_err ;
2010-04-12 01:17:15 +04:00
int ret , trust_direction_flags ;
unsigned int i ;
2011-09-30 00:47:08 +04:00
struct AuthenticationInformationArray * auth_array ;
2015-07-01 06:33:10 +03:00
struct timeval tv ;
NTTIME an_hour_ago ;
2015-04-10 23:31:20 +03:00
uint32_t * auth_kvno ;
2015-07-01 06:33:10 +03:00
bool preferr_current = false ;
2015-01-20 13:52:22 +03:00
uint32_t supported_enctypes = ENC_RC4_HMAC_MD5 ;
2014-12-15 18:48:27 +03:00
if ( dsdb_functional_level ( kdc_db_ctx - > samdb ) > = DS_DOMAIN_FUNCTION_2008 ) {
supported_enctypes = ldb_msg_find_attr_as_uint ( msg ,
" msDS-SupportedEncryptionTypes " ,
supported_enctypes ) ;
}
2010-01-28 09:27:11 +03:00
2015-03-16 00:25:49 +03:00
trust_direction_flags = ldb_msg_find_attr_as_int ( msg , " trustDirection " , 0 ) ;
2015-06-10 11:25:20 +03:00
if ( ! ( trust_direction_flags & direction ) ) {
krb5_clear_error_message ( context ) ;
2014-05-08 19:13:04 +04:00
ret = SDB_ERR_NOENTRY ;
2015-06-10 11:25:20 +03:00
goto out ;
}
dnsdomain = ldb_msg_find_attr_as_string ( msg , " trustPartner " , NULL ) ;
if ( dnsdomain = = NULL ) {
krb5_clear_error_message ( context ) ;
2014-05-08 19:13:04 +04:00
ret = SDB_ERR_NOENTRY ;
2015-06-10 11:25:20 +03:00
goto out ;
}
partner_realm = strupper_talloc ( mem_ctx , dnsdomain ) ;
if ( partner_realm = = NULL ) {
krb5_clear_error_message ( context ) ;
ret = ENOMEM ;
goto out ;
}
2015-03-16 00:25:49 +03:00
if ( direction = = INBOUND ) {
2015-06-10 11:25:20 +03:00
realm = our_realm ;
krbtgt_realm = partner_realm ;
2015-03-16 00:25:49 +03:00
2015-06-10 11:25:20 +03:00
password_val = ldb_msg_find_ldb_val ( msg , " trustAuthIncoming " ) ;
2015-03-16 00:25:49 +03:00
} else { /* OUTBOUND */
2015-06-10 11:25:20 +03:00
realm = partner_realm ;
krbtgt_realm = our_realm ;
2015-03-16 00:25:49 +03:00
password_val = ldb_msg_find_ldb_val ( msg , " trustAuthOutgoing " ) ;
}
2015-06-10 11:25:20 +03:00
if ( password_val = = NULL ) {
2015-03-16 00:25:49 +03:00
krb5_clear_error_message ( context ) ;
2014-05-08 19:13:04 +04:00
ret = SDB_ERR_NOENTRY ;
2015-03-16 00:25:49 +03:00
goto out ;
}
ndr_err = ndr_pull_struct_blob ( password_val , mem_ctx , & password_blob ,
( ndr_pull_flags_fn_t ) ndr_pull_trustAuthInOutBlob ) ;
if ( ! NDR_ERR_CODE_IS_SUCCESS ( ndr_err ) ) {
krb5_clear_error_message ( context ) ;
ret = EINVAL ;
goto out ;
}
2010-01-28 09:27:11 +03:00
p = talloc ( mem_ctx , struct samba_kdc_entry ) ;
if ( ! p ) {
ret = ENOMEM ;
goto out ;
}
p - > kdc_db_ctx = kdc_db_ctx ;
p - > realm_dn = realm_dn ;
talloc_set_destructor ( p , samba_kdc_entry_destructor ) ;
2010-02-12 22:54:18 +03:00
/* make sure we do not have bogus data in there */
2014-05-08 19:13:04 +04:00
memset ( & entry_ex - > entry , 0 , sizeof ( struct sdb_entry ) ) ;
2010-02-12 22:54:18 +03:00
2010-01-28 09:27:11 +03:00
entry_ex - > ctx = p ;
/* use 'whenCreated' */
entry_ex - > entry . created_by . time = ldb_msg_find_krb5time_ldap_time ( msg , " whenCreated " , 0 ) ;
2010-02-13 00:24:22 +03:00
/* use 'kadmin' for now (needed by mit_samba) */
2014-05-07 18:47:52 +04:00
ret = smb_krb5_make_principal ( context ,
& entry_ex - > entry . created_by . principal ,
realm , " kadmin " , NULL ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
2010-01-28 09:27:11 +03:00
2014-12-15 18:48:27 +03:00
/*
2015-06-10 11:25:20 +03:00
* We always need to generate the canonicalized principal
* with the values of our database .
2014-12-15 18:48:27 +03:00
*/
2015-06-10 11:25:20 +03:00
ret = smb_krb5_make_principal ( context , & entry_ex - > entry . principal , realm ,
" krbtgt " , krbtgt_realm , NULL ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
krb5_clear_error_message ( context ) ;
goto out ;
}
2015-06-10 11:25:20 +03:00
smb_krb5_principal_set_type ( context , entry_ex - > entry . principal ,
KRB5_NT_SRV_INST ) ;
2014-12-15 18:48:27 +03:00
2010-01-28 09:27:11 +03:00
entry_ex - > entry . valid_start = NULL ;
2011-09-30 00:47:08 +04:00
/* we need to work out if we are going to use the current or
* the previous password hash .
* We base this on the kvno the client passes in . If the kvno
* passed in is equal to the current kvno in our database then
* we use the current structure . If it is the current kvno - 1 ,
* then we use the previous substrucure .
2011-09-16 05:15:27 +04:00
*/
2011-09-30 00:47:08 +04:00
2015-07-01 06:33:10 +03:00
/*
* Windows preferrs the previous key for one hour .
*/
tv = timeval_current ( ) ;
if ( tv . tv_sec > 3600 ) {
tv . tv_sec - = 3600 ;
}
an_hour_ago = timeval_to_nttime ( & tv ) ;
2011-09-30 00:47:08 +04:00
/* first work out the current kvno */
current_kvno = 0 ;
2010-01-28 09:27:11 +03:00
for ( i = 0 ; i < password_blob . count ; i + + ) {
2015-04-10 23:31:20 +03:00
struct AuthenticationInformation * a =
& password_blob . current . array [ i ] ;
2015-07-01 06:33:10 +03:00
if ( a - > LastUpdateTime < = an_hour_ago ) {
preferr_current = true ;
}
2015-04-10 23:31:20 +03:00
if ( a - > AuthType = = TRUST_AUTH_TYPE_VERSION ) {
current_kvno = a - > AuthInfo . version . version ;
}
}
if ( current_kvno = = 0 ) {
previous_kvno = 255 ;
} else {
previous_kvno = current_kvno - 1 ;
}
for ( i = 0 ; i < password_blob . count ; i + + ) {
struct AuthenticationInformation * a =
& password_blob . previous . array [ i ] ;
if ( a - > AuthType = = TRUST_AUTH_TYPE_VERSION ) {
previous_kvno = a - > AuthInfo . version . version ;
2010-01-28 09:27:11 +03:00
}
}
2011-09-30 00:47:08 +04:00
/* work out whether we will use the previous or current
password */
if ( password_blob . previous . count = = 0 ) {
/* there is no previous password */
use_previous = false ;
2014-05-08 19:13:04 +04:00
} else if ( ! ( flags & SDB_F_KVNO_SPECIFIED ) ) {
2015-04-10 23:31:20 +03:00
/*
2015-07-01 06:33:10 +03:00
* If not specified we use the lowest kvno
* for the first hour after an update .
2015-04-10 23:31:20 +03:00
*/
2015-07-01 06:33:10 +03:00
if ( preferr_current ) {
use_previous = false ;
} else if ( previous_kvno < current_kvno ) {
use_previous = true ;
} else {
use_previous = false ;
}
2015-04-10 23:31:20 +03:00
} else if ( kvno = = current_kvno ) {
/*
* Exact match . . .
*/
2011-09-30 00:47:08 +04:00
use_previous = false ;
2015-04-10 23:31:20 +03:00
} else if ( kvno = = previous_kvno ) {
/*
* Exact match . . .
*/
2011-09-30 00:47:08 +04:00
use_previous = true ;
} else {
2015-04-10 23:31:20 +03:00
/*
* Fallback to the current one for anything else
*/
use_previous = false ;
2011-09-30 00:47:08 +04:00
}
if ( use_previous ) {
auth_array = & password_blob . previous ;
2015-04-10 23:31:20 +03:00
auth_kvno = & previous_kvno ;
2011-09-30 00:47:08 +04:00
} else {
auth_array = & password_blob . current ;
2015-04-10 23:31:20 +03:00
auth_kvno = & current_kvno ;
2011-09-30 00:47:08 +04:00
}
/* use the kvno the client specified, if available */
2014-05-08 19:13:04 +04:00
if ( flags & SDB_F_KVNO_SPECIFIED ) {
2011-09-30 00:47:08 +04:00
entry_ex - > entry . kvno = kvno ;
} else {
2015-04-10 23:31:20 +03:00
entry_ex - > entry . kvno = * auth_kvno ;
2011-09-30 00:47:08 +04:00
}
for ( i = 0 ; i < auth_array - > count ; i + + ) {
if ( auth_array - > array [ i ] . AuthType = = TRUST_AUTH_TYPE_CLEAR ) {
2014-12-15 18:48:27 +03:00
bool ok ;
2011-09-30 00:47:08 +04:00
password_utf16 = data_blob_const ( auth_array - > array [ i ] . AuthInfo . clear . password ,
auth_array - > array [ i ] . AuthInfo . clear . size ) ;
2014-12-15 18:48:27 +03:00
if ( password_utf16 . length = = 0 ) {
break ;
}
2015-01-20 13:52:22 +03:00
if ( supported_enctypes & ENC_RC4_HMAC_MD5 ) {
2014-12-15 18:48:27 +03:00
mdfour ( _password_hash . hash , password_utf16 . data , password_utf16 . length ) ;
if ( password_hash = = NULL ) {
num_keys + = 1 ;
}
password_hash = & _password_hash ;
}
if ( ! ( supported_enctypes & ( ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256 ) ) ) {
break ;
}
ok = convert_string_talloc ( mem_ctx ,
CH_UTF16MUNGED , CH_UTF8 ,
password_utf16 . data ,
password_utf16 . length ,
( void * ) & password_utf8 . data ,
& password_utf8 . length ) ;
if ( ! ok ) {
krb5_clear_error_message ( context ) ;
ret = ENOMEM ;
goto out ;
}
2010-01-28 09:27:11 +03:00
2014-12-15 18:48:27 +03:00
if ( supported_enctypes & ENC_HMAC_SHA1_96_AES128 ) {
num_keys + = 1 ;
}
if ( supported_enctypes & ENC_HMAC_SHA1_96_AES256 ) {
num_keys + = 1 ;
}
2010-01-28 09:27:11 +03:00
break ;
2011-09-30 00:47:08 +04:00
} else if ( auth_array - > array [ i ] . AuthType = = TRUST_AUTH_TYPE_NT4OWF ) {
2015-01-20 13:52:22 +03:00
if ( supported_enctypes & ENC_RC4_HMAC_MD5 ) {
2014-12-15 18:48:27 +03:00
password_hash = & auth_array - > array [ i ] . AuthInfo . nt4owf . password ;
num_keys + = 1 ;
}
2010-01-28 09:27:11 +03:00
}
}
2014-12-15 18:48:27 +03:00
/* Must have found a cleartext or MD4 password */
if ( num_keys = = 0 ) {
DEBUG ( 1 , ( __location__ " : no usable key found \n " ) ) ;
krb5_clear_error_message ( context ) ;
2014-05-08 19:13:04 +04:00
ret = SDB_ERR_NOENTRY ;
2014-12-15 18:48:27 +03:00
goto out ;
}
2010-01-28 09:27:11 +03:00
2014-05-08 19:13:04 +04:00
entry_ex - > entry . keys . val = calloc ( num_keys , sizeof ( struct sdb_key ) ) ;
2014-12-15 18:48:27 +03:00
if ( entry_ex - > entry . keys . val = = NULL ) {
krb5_clear_error_message ( context ) ;
ret = ENOMEM ;
goto out ;
}
2010-01-28 09:27:11 +03:00
2014-12-15 18:48:27 +03:00
if ( password_utf8 . length ! = 0 ) {
2014-05-08 19:13:04 +04:00
struct sdb_key key = { } ;
2015-03-26 12:24:05 +03:00
krb5_const_principal salt_principal = entry_ex - > entry . principal ;
2014-12-19 18:35:48 +03:00
krb5_data salt ;
2014-12-15 18:48:27 +03:00
krb5_data cleartext_data ;
2015-04-16 13:57:35 +03:00
cleartext_data . data = discard_const_p ( char , password_utf8 . data ) ;
2014-12-15 18:48:27 +03:00
cleartext_data . length = password_utf8 . length ;
2014-12-19 18:35:48 +03:00
ret = smb_krb5_get_pw_salt ( context ,
salt_principal ,
& salt ) ;
2014-12-15 18:48:27 +03:00
if ( ret ! = 0 ) {
2010-01-28 09:27:11 +03:00
goto out ;
}
2015-01-20 13:52:22 +03:00
if ( supported_enctypes & ENC_HMAC_SHA1_96_AES256 ) {
2014-12-19 18:35:48 +03:00
ret = smb_krb5_create_key_from_string ( context ,
salt_principal ,
& salt ,
& cleartext_data ,
ENCTYPE_AES256_CTS_HMAC_SHA1_96 ,
& key . key ) ;
2014-12-15 18:48:27 +03:00
if ( ret ! = 0 ) {
2016-08-26 12:51:52 +03:00
smb_krb5_free_data_contents ( context , & salt ) ;
2014-12-15 18:48:27 +03:00
goto out ;
}
entry_ex - > entry . keys . val [ entry_ex - > entry . keys . len ] = key ;
entry_ex - > entry . keys . len + + ;
}
2015-01-20 13:52:22 +03:00
if ( supported_enctypes & ENC_HMAC_SHA1_96_AES128 ) {
2014-12-19 18:35:48 +03:00
ret = smb_krb5_create_key_from_string ( context ,
salt_principal ,
& salt ,
& cleartext_data ,
ENCTYPE_AES128_CTS_HMAC_SHA1_96 ,
& key . key ) ;
2014-12-15 18:48:27 +03:00
if ( ret ! = 0 ) {
2016-08-26 12:51:52 +03:00
smb_krb5_free_data_contents ( context , & salt ) ;
2014-12-15 18:48:27 +03:00
goto out ;
}
entry_ex - > entry . keys . val [ entry_ex - > entry . keys . len ] = key ;
entry_ex - > entry . keys . len + + ;
}
2016-08-26 12:51:52 +03:00
smb_krb5_free_data_contents ( context , & salt ) ;
2014-12-15 18:48:27 +03:00
}
if ( password_hash ! = NULL ) {
2014-05-08 19:13:04 +04:00
struct sdb_key key = { } ;
2014-12-15 18:48:27 +03:00
2014-05-07 18:46:31 +04:00
ret = smb_krb5_keyblock_init_contents ( context ,
ENCTYPE_ARCFOUR_HMAC ,
password_hash - > hash ,
sizeof ( password_hash - > hash ) ,
& key . key ) ;
2011-09-30 00:47:08 +04:00
if ( ret ! = 0 ) {
goto out ;
}
2010-01-28 09:27:11 +03:00
entry_ex - > entry . keys . val [ entry_ex - > entry . keys . len ] = key ;
entry_ex - > entry . keys . len + + ;
}
2014-05-08 19:13:04 +04:00
entry_ex - > entry . flags = int2SDBFlags ( 0 ) ;
2010-01-28 09:27:11 +03:00
entry_ex - > entry . flags . immutable = 1 ;
entry_ex - > entry . flags . invalid = 0 ;
entry_ex - > entry . flags . server = 1 ;
entry_ex - > entry . flags . require_preauth = 1 ;
entry_ex - > entry . pw_end = NULL ;
entry_ex - > entry . max_life = NULL ;
entry_ex - > entry . max_renew = NULL ;
2016-09-08 11:50:58 +03:00
ret = samba_kdc_sort_encryption_keys ( entry_ex ) ;
if ( ret ! = 0 ) {
krb5_clear_error_message ( context ) ;
ret = ENOMEM ;
goto out ;
}
2010-01-28 09:27:11 +03:00
p - > msg = talloc_steal ( p , msg ) ;
out :
2015-06-10 11:25:20 +03:00
TALLOC_FREE ( partner_realm ) ;
2010-01-28 09:27:11 +03:00
if ( ret ! = 0 ) {
/* This doesn't free ent itself, that is for the eventual caller to do */
2014-05-08 19:13:04 +04:00
sdb_free_entry ( entry_ex ) ;
2010-01-28 09:27:11 +03:00
} else {
talloc_steal ( kdc_db_ctx , entry_ex - > ctx ) ;
}
return ret ;
}
static krb5_error_code samba_kdc_lookup_trust ( krb5_context context , struct ldb_context * ldb_ctx ,
TALLOC_CTX * mem_ctx ,
const char * realm ,
struct ldb_dn * realm_dn ,
struct ldb_message * * pmsg )
{
2014-08-15 07:00:25 +04:00
NTSTATUS status ;
2010-01-28 09:27:11 +03:00
const char * const * attrs = trust_attrs ;
2015-03-30 11:17:51 +03:00
status = dsdb_trust_search_tdo ( ldb_ctx , realm , realm ,
attrs , mem_ctx , pmsg ) ;
2014-08-15 07:00:25 +04:00
if ( NT_STATUS_IS_OK ( status ) ) {
return 0 ;
2015-03-30 11:17:51 +03:00
} else if ( NT_STATUS_EQUAL ( status , NT_STATUS_OBJECT_NAME_NOT_FOUND ) ) {
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2014-08-15 07:00:25 +04:00
} else if ( NT_STATUS_EQUAL ( status , NT_STATUS_NO_MEMORY ) ) {
int ret = ENOMEM ;
krb5_set_error_message ( context , ret , " get_sam_result_trust: out of memory " ) ;
return ret ;
} else {
int ret = EINVAL ;
krb5_set_error_message ( context , ret , " get_sam_result_trust: %s " , nt_errstr ( status ) ) ;
return ret ;
2010-01-28 09:27:11 +03:00
}
}
static krb5_error_code samba_kdc_lookup_client ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
TALLOC_CTX * mem_ctx ,
krb5_const_principal principal ,
const char * * attrs ,
struct ldb_dn * * realm_dn ,
2015-03-23 13:00:51 +03:00
struct ldb_message * * msg )
{
2010-01-28 09:27:11 +03:00
NTSTATUS nt_status ;
2015-03-23 13:00:51 +03:00
char * principal_string = NULL ;
2010-01-28 09:27:11 +03:00
2014-05-08 14:21:43 +04:00
if ( smb_krb5_principal_get_type ( context , principal ) = = KRB5_NT_ENTERPRISE_PRINCIPAL ) {
2014-12-17 07:02:53 +03:00
principal_string = smb_krb5_principal_get_comp_string ( mem_ctx , context ,
principal , 0 ) ;
if ( principal_string = = NULL ) {
return ENOMEM ;
}
} else {
2015-03-23 13:00:51 +03:00
char * principal_string_m = NULL ;
2014-12-17 07:02:53 +03:00
krb5_error_code ret ;
2015-03-23 13:00:51 +03:00
ret = krb5_unparse_name ( context , principal , & principal_string_m ) ;
2014-12-17 07:02:53 +03:00
if ( ret ! = 0 ) {
return ret ;
}
2015-03-23 13:00:51 +03:00
principal_string = talloc_strdup ( mem_ctx , principal_string_m ) ;
SAFE_FREE ( principal_string_m ) ;
if ( principal_string = = NULL ) {
return ENOMEM ;
}
}
nt_status = sam_get_results_principal ( kdc_db_ctx - > samdb ,
mem_ctx , principal_string , attrs ,
realm_dn , msg ) ;
if ( NT_STATUS_EQUAL ( nt_status , NT_STATUS_NO_SUCH_USER ) ) {
krb5_principal fallback_principal = NULL ;
unsigned int num_comp ;
char * fallback_realm = NULL ;
char * fallback_account = NULL ;
krb5_error_code ret ;
ret = krb5_parse_name ( context , principal_string ,
& fallback_principal ) ;
TALLOC_FREE ( principal_string ) ;
if ( ret ! = 0 ) {
return ret ;
}
num_comp = krb5_princ_size ( context , fallback_principal ) ;
fallback_realm = smb_krb5_principal_get_realm ( context ,
fallback_principal ) ;
if ( fallback_realm = = NULL ) {
krb5_free_principal ( context , fallback_principal ) ;
return ENOMEM ;
}
if ( num_comp = = 1 ) {
size_t len ;
fallback_account = smb_krb5_principal_get_comp_string ( mem_ctx ,
context , fallback_principal , 0 ) ;
if ( fallback_account = = NULL ) {
krb5_free_principal ( context , fallback_principal ) ;
SAFE_FREE ( fallback_realm ) ;
return ENOMEM ;
}
len = strlen ( fallback_account ) ;
if ( len > = 2 & & fallback_account [ len - 1 ] = = ' $ ' ) {
TALLOC_FREE ( fallback_account ) ;
}
}
krb5_free_principal ( context , fallback_principal ) ;
fallback_principal = NULL ;
if ( fallback_account ! = NULL ) {
char * with_dollar ;
with_dollar = talloc_asprintf ( mem_ctx , " %s$ " ,
fallback_account ) ;
if ( with_dollar = = NULL ) {
SAFE_FREE ( fallback_realm ) ;
return ENOMEM ;
}
TALLOC_FREE ( fallback_account ) ;
ret = smb_krb5_make_principal ( context ,
& fallback_principal ,
fallback_realm ,
with_dollar , NULL ) ;
TALLOC_FREE ( with_dollar ) ;
if ( ret ! = 0 ) {
SAFE_FREE ( fallback_realm ) ;
return ret ;
}
}
SAFE_FREE ( fallback_realm ) ;
if ( fallback_principal ! = NULL ) {
char * fallback_string = NULL ;
ret = krb5_unparse_name ( context ,
fallback_principal ,
& fallback_string ) ;
if ( ret ! = 0 ) {
krb5_free_principal ( context , fallback_principal ) ;
return ret ;
}
nt_status = sam_get_results_principal ( kdc_db_ctx - > samdb ,
mem_ctx ,
fallback_string ,
attrs ,
realm_dn , msg ) ;
SAFE_FREE ( fallback_string ) ;
}
krb5_free_principal ( context , fallback_principal ) ;
fallback_principal = NULL ;
2010-01-28 09:27:11 +03:00
}
2015-03-23 13:00:51 +03:00
TALLOC_FREE ( principal_string ) ;
2010-01-28 09:27:11 +03:00
if ( NT_STATUS_EQUAL ( nt_status , NT_STATUS_NO_SUCH_USER ) ) {
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
} else if ( NT_STATUS_EQUAL ( nt_status , NT_STATUS_NO_MEMORY ) ) {
return ENOMEM ;
} else if ( ! NT_STATUS_IS_OK ( nt_status ) ) {
return EINVAL ;
}
2014-12-17 07:02:53 +03:00
return 0 ;
2010-01-28 09:27:11 +03:00
}
static krb5_error_code samba_kdc_fetch_client ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
TALLOC_CTX * mem_ctx ,
krb5_const_principal principal ,
2010-11-16 06:07:18 +03:00
unsigned flags ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry_ex ) {
2010-01-28 09:27:11 +03:00
struct ldb_dn * realm_dn ;
krb5_error_code ret ;
struct ldb_message * msg = NULL ;
ret = samba_kdc_lookup_client ( context , kdc_db_ctx ,
2015-01-30 02:31:29 +03:00
mem_ctx , principal , user_attrs ,
& realm_dn , & msg ) ;
2010-01-28 09:27:11 +03:00
if ( ret ! = 0 ) {
return ret ;
}
ret = samba_kdc_message2entry ( context , kdc_db_ctx , mem_ctx ,
2010-11-16 06:12:17 +03:00
principal , SAMBA_KDC_ENT_TYPE_CLIENT ,
flags ,
realm_dn , msg , entry_ex ) ;
2010-01-28 09:27:11 +03:00
return ret ;
}
static krb5_error_code samba_kdc_fetch_krbtgt ( krb5_context context ,
2010-09-28 07:13:28 +04:00
struct samba_kdc_db_context * kdc_db_ctx ,
TALLOC_CTX * mem_ctx ,
krb5_const_principal principal ,
2010-11-16 06:07:18 +03:00
unsigned flags ,
2011-09-30 00:47:08 +04:00
uint32_t kvno ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry_ex )
2010-01-28 09:27:11 +03:00
{
struct loadparm_context * lp_ctx = kdc_db_ctx - > lp_ctx ;
krb5_error_code ret ;
struct ldb_message * msg = NULL ;
struct ldb_dn * realm_dn = ldb_get_default_basedn ( kdc_db_ctx - > samdb ) ;
2014-05-08 12:10:49 +04:00
char * realm_from_princ , * realm_from_princ_malloc ;
2014-05-16 13:44:49 +04:00
char * realm_princ_comp = smb_krb5_principal_get_comp_string ( mem_ctx , context , principal , 1 ) ;
2014-05-08 12:10:49 +04:00
realm_from_princ_malloc = smb_krb5_principal_get_realm ( context , principal ) ;
if ( realm_from_princ_malloc = = NULL ) {
/* can't happen */
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2014-05-08 12:10:49 +04:00
}
realm_from_princ = talloc_strdup ( mem_ctx , realm_from_princ_malloc ) ;
free ( realm_from_princ_malloc ) ;
if ( realm_from_princ = = NULL ) {
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2014-05-08 12:10:49 +04:00
}
2014-05-08 12:25:07 +04:00
if ( krb5_princ_size ( context , principal ) ! = 2
2014-05-16 13:44:02 +04:00
| | ( principal_comp_strcmp ( context , principal , 0 , KRB5_TGS_NAME ) ! = 0 ) ) {
2010-01-28 09:27:11 +03:00
/* Not a krbtgt */
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
/* krbtgt case. Either us or a trusted realm */
2014-05-08 12:10:49 +04:00
if ( lpcfg_is_my_domain_or_realm ( lp_ctx , realm_from_princ )
2014-05-16 13:44:49 +04:00
& & lpcfg_is_my_domain_or_realm ( lp_ctx , realm_princ_comp ) ) {
2010-09-28 07:13:28 +04:00
/* us, or someone quite like us */
2010-01-28 09:27:11 +03:00
/* Cludge, cludge cludge. If the realm part of krbtgt/realm,
* is in our db , then direct the caller at our primary
* krbtgt */
int lret ;
2011-09-30 00:47:08 +04:00
unsigned int krbtgt_number ;
/* w2k8r2 sometimes gives us a kvno of 255 for inter-domain
trust tickets . We don ' t yet know what this means , but we do
seem to need to treat it as unspecified */
2014-05-08 19:13:04 +04:00
if ( flags & SDB_F_KVNO_SPECIFIED ) {
2011-09-30 00:47:08 +04:00
krbtgt_number = SAMBA_KVNO_GET_KRBTGT ( kvno ) ;
if ( kdc_db_ctx - > rodc ) {
if ( krbtgt_number ! = kdc_db_ctx - > my_krbtgt_number ) {
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOT_FOUND_HERE ;
2011-09-30 00:47:08 +04:00
}
}
} else {
krbtgt_number = kdc_db_ctx - > my_krbtgt_number ;
}
2010-01-28 09:27:11 +03:00
2010-09-28 07:13:28 +04:00
if ( krbtgt_number = = kdc_db_ctx - > my_krbtgt_number ) {
lret = dsdb_search_one ( kdc_db_ctx - > samdb , mem_ctx ,
& msg , kdc_db_ctx - > krbtgt_dn , LDB_SCOPE_BASE ,
2011-09-28 23:23:38 +04:00
krbtgt_attrs , DSDB_SEARCH_NO_GLOBAL_CATALOG ,
2010-09-28 07:13:28 +04:00
" (objectClass=user) " ) ;
} else {
/* We need to look up an RODC krbtgt (perhaps
* ours , if we are an RODC , perhaps another
* RODC if we are a read - write DC */
lret = dsdb_search_one ( kdc_db_ctx - > samdb , mem_ctx ,
& msg , realm_dn , LDB_SCOPE_SUBTREE ,
krbtgt_attrs ,
2011-09-28 23:23:38 +04:00
DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG ,
2010-09-28 07:13:28 +04:00
" (&(objectClass=user)(msDS-SecondaryKrbTgtNumber=%u)) " , ( unsigned ) ( krbtgt_number ) ) ;
}
2010-01-28 09:27:11 +03:00
if ( lret = = LDB_ERR_NO_SUCH_OBJECT ) {
2010-09-28 07:13:28 +04:00
krb5_warnx ( context , " samba_kdc_fetch: could not find KRBTGT number %u in DB! " ,
( unsigned ) ( krbtgt_number ) ) ;
2014-05-08 19:13:04 +04:00
krb5_set_error_message ( context , SDB_ERR_NOENTRY ,
2010-09-28 07:13:28 +04:00
" samba_kdc_fetch: could not find KRBTGT number %u in DB! " ,
( unsigned ) ( krbtgt_number ) ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
} else if ( lret ! = LDB_SUCCESS ) {
2010-09-28 07:13:28 +04:00
krb5_warnx ( context , " samba_kdc_fetch: could not find KRBTGT number %u in DB! " ,
( unsigned ) ( krbtgt_number ) ) ;
2014-05-08 19:13:04 +04:00
krb5_set_error_message ( context , SDB_ERR_NOENTRY ,
2010-09-28 07:13:28 +04:00
" samba_kdc_fetch: could not find KRBTGT number %u in DB! " ,
( unsigned ) ( krbtgt_number ) ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
ret = samba_kdc_message2entry ( context , kdc_db_ctx , mem_ctx ,
2010-11-16 06:12:17 +03:00
principal , SAMBA_KDC_ENT_TYPE_KRBTGT ,
flags , realm_dn , msg , entry_ex ) ;
2010-01-28 09:27:11 +03:00
if ( ret ! = 0 ) {
krb5_warnx ( context , " samba_kdc_fetch: self krbtgt message2entry failed " ) ;
}
return ret ;
} else {
enum trust_direction direction = UNKNOWN ;
2010-09-16 11:20:08 +04:00
const char * realm = NULL ;
2010-01-28 09:27:11 +03:00
/* Either an inbound or outbound trust */
2014-05-08 12:10:49 +04:00
if ( strcasecmp ( lpcfg_realm ( lp_ctx ) , realm_from_princ ) = = 0 ) {
2010-01-28 09:27:11 +03:00
/* look for inbound trust */
direction = INBOUND ;
2014-05-16 13:44:49 +04:00
realm = realm_princ_comp ;
2014-05-16 13:44:02 +04:00
} else if ( principal_comp_strcasecmp ( context , principal , 1 , lpcfg_realm ( lp_ctx ) ) = = 0 ) {
2010-01-28 09:27:11 +03:00
/* look for outbound trust */
direction = OUTBOUND ;
2014-05-08 12:10:49 +04:00
realm = realm_from_princ ;
2010-09-16 11:20:08 +04:00
} else {
krb5_warnx ( context , " samba_kdc_fetch: not our realm for trusts ('%s', '%s') " ,
2014-05-08 12:10:49 +04:00
realm_from_princ ,
2014-05-16 13:44:49 +04:00
realm_princ_comp ) ;
2014-05-08 19:13:04 +04:00
krb5_set_error_message ( context , SDB_ERR_NOENTRY , " samba_kdc_fetch: not our realm for trusts ('%s', '%s') " ,
2014-05-08 12:10:49 +04:00
realm_from_princ ,
2014-05-16 13:44:49 +04:00
realm_princ_comp ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
/* Trusted domains are under CN=system */
ret = samba_kdc_lookup_trust ( context , kdc_db_ctx - > samdb ,
mem_ctx ,
realm , realm_dn , & msg ) ;
if ( ret ! = 0 ) {
krb5_warnx ( context , " samba_kdc_fetch: could not find principal in DB " ) ;
krb5_set_error_message ( context , ret , " samba_kdc_fetch: could not find principal in DB " ) ;
return ret ;
}
ret = samba_kdc_trust_message2entry ( context , kdc_db_ctx , mem_ctx ,
2011-09-30 00:47:08 +04:00
principal , direction ,
realm_dn , flags , kvno , msg , entry_ex ) ;
2010-01-28 09:27:11 +03:00
if ( ret ! = 0 ) {
2014-12-15 18:48:27 +03:00
krb5_warnx ( context , " samba_kdc_fetch: trust_message2entry failed for %s " ,
ldb_dn_get_linearized ( msg - > dn ) ) ;
krb5_set_error_message ( context , ret , " samba_kdc_fetch: "
" trust_message2entry failed for %s " ,
ldb_dn_get_linearized ( msg - > dn ) ) ;
2010-01-28 09:27:11 +03:00
}
return ret ;
}
}
static krb5_error_code samba_kdc_lookup_server ( krb5_context context ,
2015-01-30 02:31:29 +03:00
struct samba_kdc_db_context * kdc_db_ctx ,
TALLOC_CTX * mem_ctx ,
krb5_const_principal principal ,
unsigned flags ,
const char * * attrs ,
struct ldb_dn * * realm_dn ,
struct ldb_message * * msg )
2010-01-28 09:27:11 +03:00
{
krb5_error_code ret ;
2015-01-30 02:31:29 +03:00
if ( ( smb_krb5_principal_get_type ( context , principal ) ! = KRB5_NT_ENTERPRISE_PRINCIPAL )
& & krb5_princ_size ( context , principal ) > = 2 ) {
2010-01-28 09:27:11 +03:00
/* 'normal server' case */
int ldb_ret ;
NTSTATUS nt_status ;
struct ldb_dn * user_dn ;
char * principal_string ;
ret = krb5_unparse_name_flags ( context , principal ,
KRB5_PRINCIPAL_UNPARSE_NO_REALM ,
& principal_string ) ;
if ( ret ! = 0 ) {
return ret ;
}
/* At this point we may find the host is known to be
* in a different realm , so we should generate a
* referral instead */
nt_status = crack_service_principal_name ( kdc_db_ctx - > samdb ,
mem_ctx , principal_string ,
& user_dn , realm_dn ) ;
free ( principal_string ) ;
if ( ! NT_STATUS_IS_OK ( nt_status ) ) {
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
2010-02-16 07:49:29 +03:00
ldb_ret = dsdb_search_one ( kdc_db_ctx - > samdb ,
mem_ctx ,
msg , user_dn , LDB_SCOPE_BASE ,
2011-09-22 03:57:26 +04:00
attrs ,
DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG ,
" (objectClass=*) " ) ;
2010-01-28 09:27:11 +03:00
if ( ldb_ret ! = LDB_SUCCESS ) {
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
2015-01-30 02:31:29 +03:00
return 0 ;
2014-05-08 19:13:04 +04:00
} else if ( ! ( flags & SDB_F_FOR_AS_REQ )
2015-01-30 02:31:29 +03:00
& & smb_krb5_principal_get_type ( context , principal ) = = KRB5_NT_ENTERPRISE_PRINCIPAL ) {
/*
* The behaviour of accepting an
* KRB5_NT_ENTERPRISE_PRINCIPAL server principal
* containing a UPN only applies to TGS - REQ packets ,
* not AS - REQ packets .
*/
return samba_kdc_lookup_client ( context , kdc_db_ctx ,
mem_ctx , principal , attrs ,
realm_dn , msg ) ;
2010-01-28 09:27:11 +03:00
} else {
2015-01-30 02:31:29 +03:00
/*
* This case is for :
* - the AS - REQ , where we only accept
* samAccountName based lookups for the server , no
* matter if the name is an
* KRB5_NT_ENTERPRISE_PRINCIPAL or not
* - for the TGS - REQ when we are not given an
* KRB5_NT_ENTERPRISE_PRINCIPAL , which also must
* only lookup samAccountName based names .
*/
2010-01-28 09:27:11 +03:00
int lret ;
char * short_princ ;
2015-06-11 21:04:09 +03:00
krb5_principal enterprise_principal = NULL ;
krb5_const_principal used_principal = NULL ;
2015-03-23 13:00:51 +03:00
char * name1 = NULL ;
size_t len1 = 0 ;
char * filter = NULL ;
2015-01-30 02:31:29 +03:00
if ( smb_krb5_principal_get_type ( context , principal ) = = KRB5_NT_ENTERPRISE_PRINCIPAL ) {
2015-02-10 15:23:14 +03:00
char * str = NULL ;
2015-01-30 02:31:29 +03:00
/* Need to reparse the enterprise principal to find the real target */
2014-05-08 12:25:07 +04:00
if ( krb5_princ_size ( context , principal ) ! = 1 ) {
2015-01-30 02:31:29 +03:00
ret = KRB5_PARSE_MALFORMED ;
krb5_set_error_message ( context , ret , " samba_kdc_lookup_server: request for an "
" enterprise principal with wrong (%d) number of components " ,
2014-05-08 12:25:07 +04:00
krb5_princ_size ( context , principal ) ) ;
2015-01-30 02:31:29 +03:00
return ret ;
}
2015-02-10 15:23:14 +03:00
str = smb_krb5_principal_get_comp_string ( mem_ctx , context , principal , 0 ) ;
if ( str = = NULL ) {
return KRB5_PARSE_MALFORMED ;
}
ret = krb5_parse_name ( context , str ,
2015-06-11 21:04:09 +03:00
& enterprise_principal ) ;
2015-02-10 15:23:14 +03:00
talloc_free ( str ) ;
2015-01-30 02:31:29 +03:00
if ( ret ) {
return ret ;
}
2015-06-11 21:04:09 +03:00
used_principal = enterprise_principal ;
} else {
used_principal = principal ;
2015-01-30 02:31:29 +03:00
}
2010-01-28 09:27:11 +03:00
/* server as client principal case, but we must not lookup userPrincipalNames */
* realm_dn = ldb_get_default_basedn ( kdc_db_ctx - > samdb ) ;
2011-09-22 03:57:26 +04:00
/* TODO: Check if it is our realm, otherwise give referral */
2010-01-28 09:27:11 +03:00
2015-06-11 21:04:09 +03:00
ret = krb5_unparse_name_flags ( context , used_principal ,
2015-03-12 03:29:56 +03:00
KRB5_PRINCIPAL_UNPARSE_NO_REALM |
KRB5_PRINCIPAL_UNPARSE_DISPLAY ,
& short_princ ) ;
2015-06-11 21:04:09 +03:00
used_principal = NULL ;
krb5_free_principal ( context , enterprise_principal ) ;
enterprise_principal = NULL ;
2010-01-28 09:27:11 +03:00
if ( ret ! = 0 ) {
krb5_set_error_message ( context , ret , " samba_kdc_lookup_principal: could not parse principal " ) ;
krb5_warnx ( context , " samba_kdc_lookup_principal: could not parse principal " ) ;
return ret ;
}
2015-03-23 13:00:51 +03:00
name1 = ldb_binary_encode_string ( mem_ctx , short_princ ) ;
SAFE_FREE ( short_princ ) ;
if ( name1 = = NULL ) {
return ENOMEM ;
}
len1 = strlen ( name1 ) ;
if ( len1 > = 1 & & name1 [ len1 - 1 ] ! = ' $ ' ) {
filter = talloc_asprintf ( mem_ctx ,
" (&(objectClass=user)(|(samAccountName=%s)(samAccountName=%s$))) " ,
name1 , name1 ) ;
if ( filter = = NULL ) {
return ENOMEM ;
}
} else {
filter = talloc_asprintf ( mem_ctx ,
" (&(objectClass=user)(samAccountName=%s)) " ,
name1 ) ;
if ( filter = = NULL ) {
return ENOMEM ;
}
}
2010-02-16 07:49:29 +03:00
lret = dsdb_search_one ( kdc_db_ctx - > samdb , mem_ctx , msg ,
* realm_dn , LDB_SCOPE_SUBTREE ,
attrs ,
2011-09-22 03:57:26 +04:00
DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG ,
2015-03-23 13:00:51 +03:00
" %s " , filter ) ;
2010-01-28 09:27:11 +03:00
if ( lret = = LDB_ERR_NO_SUCH_OBJECT ) {
2015-03-23 13:00:51 +03:00
DEBUG ( 10 , ( " Failed to find an entry for %s filter:%s \n " ,
name1 , filter ) ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2015-03-23 13:00:51 +03:00
}
if ( lret = = LDB_ERR_CONSTRAINT_VIOLATION ) {
DEBUG ( 10 , ( " Failed to find unique entry for %s filter:%s \n " ,
name1 , filter ) ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
if ( lret ! = LDB_SUCCESS ) {
2015-03-23 13:00:51 +03:00
DEBUG ( 0 , ( " Failed single search for %s - %s \n " ,
name1 , ldb_errstring ( kdc_db_ctx - > samdb ) ) ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
2015-01-30 02:31:29 +03:00
return 0 ;
2010-01-28 09:27:11 +03:00
}
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
2015-01-30 02:31:29 +03:00
2010-01-28 09:27:11 +03:00
static krb5_error_code samba_kdc_fetch_server ( krb5_context context ,
2010-11-16 06:07:18 +03:00
struct samba_kdc_db_context * kdc_db_ctx ,
TALLOC_CTX * mem_ctx ,
krb5_const_principal principal ,
unsigned flags ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry_ex )
2010-01-28 09:27:11 +03:00
{
krb5_error_code ret ;
struct ldb_dn * realm_dn ;
struct ldb_message * msg ;
ret = samba_kdc_lookup_server ( context , kdc_db_ctx , mem_ctx , principal ,
2015-01-30 02:31:29 +03:00
flags , server_attrs , & realm_dn , & msg ) ;
2010-01-28 09:27:11 +03:00
if ( ret ! = 0 ) {
return ret ;
}
ret = samba_kdc_message2entry ( context , kdc_db_ctx , mem_ctx ,
2010-11-16 06:12:17 +03:00
principal , SAMBA_KDC_ENT_TYPE_SERVER ,
flags ,
realm_dn , msg , entry_ex ) ;
2010-01-28 09:27:11 +03:00
if ( ret ! = 0 ) {
krb5_warnx ( context , " samba_kdc_fetch: message2entry failed " ) ;
}
return ret ;
}
2015-02-10 16:43:01 +03:00
static krb5_error_code samba_kdc_lookup_realm ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
TALLOC_CTX * mem_ctx ,
krb5_const_principal principal ,
unsigned flags ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry_ex )
2015-02-10 16:43:01 +03:00
{
TALLOC_CTX * frame = talloc_stackframe ( ) ;
NTSTATUS status ;
krb5_error_code ret ;
char * _realm = NULL ;
bool check_realm = false ;
const char * realm = NULL ;
struct dsdb_trust_routing_table * trt = NULL ;
const struct lsa_TrustDomainInfoInfoEx * tdo = NULL ;
unsigned int num_comp ;
bool ok ;
char * upper = NULL ;
num_comp = krb5_princ_size ( context , principal ) ;
2014-05-08 19:13:04 +04:00
if ( flags & SDB_F_GET_CLIENT ) {
if ( flags & SDB_F_FOR_AS_REQ ) {
2015-02-10 16:43:01 +03:00
check_realm = true ;
}
}
2014-05-08 19:13:04 +04:00
if ( flags & SDB_F_GET_SERVER ) {
if ( flags & SDB_F_FOR_TGS_REQ ) {
2015-02-10 16:43:01 +03:00
check_realm = true ;
}
}
if ( ! check_realm ) {
TALLOC_FREE ( frame ) ;
return 0 ;
}
_realm = smb_krb5_principal_get_realm ( context , principal ) ;
if ( _realm = = NULL ) {
TALLOC_FREE ( frame ) ;
return ENOMEM ;
}
/*
* The requested realm needs to be our own
*/
ok = lpcfg_is_my_domain_or_realm ( kdc_db_ctx - > lp_ctx , _realm ) ;
if ( ! ok ) {
/*
* The request is not for us . . .
*/
SAFE_FREE ( _realm ) ;
TALLOC_FREE ( frame ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2015-02-10 16:43:01 +03:00
}
realm = talloc_strdup ( frame , _realm ) ;
SAFE_FREE ( _realm ) ;
if ( realm = = NULL ) {
TALLOC_FREE ( frame ) ;
return ENOMEM ;
}
2015-07-24 18:48:08 +03:00
if ( smb_krb5_principal_get_type ( context , principal ) = = KRB5_NT_ENTERPRISE_PRINCIPAL ) {
2015-02-10 16:43:01 +03:00
char * principal_string = NULL ;
krb5_principal enterprise_principal = NULL ;
char * enterprise_realm = NULL ;
if ( num_comp ! = 1 ) {
TALLOC_FREE ( frame ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2015-02-10 16:43:01 +03:00
}
principal_string = smb_krb5_principal_get_comp_string ( frame , context ,
principal , 0 ) ;
if ( principal_string = = NULL ) {
TALLOC_FREE ( frame ) ;
return ENOMEM ;
}
ret = krb5_parse_name ( context , principal_string ,
& enterprise_principal ) ;
TALLOC_FREE ( principal_string ) ;
if ( ret ) {
TALLOC_FREE ( frame ) ;
return ret ;
}
enterprise_realm = smb_krb5_principal_get_realm ( context ,
enterprise_principal ) ;
krb5_free_principal ( context , enterprise_principal ) ;
if ( enterprise_realm ! = NULL ) {
realm = talloc_strdup ( frame , enterprise_realm ) ;
SAFE_FREE ( enterprise_realm ) ;
if ( realm = = NULL ) {
TALLOC_FREE ( frame ) ;
return ENOMEM ;
}
}
}
2014-05-08 19:13:04 +04:00
if ( flags & SDB_F_GET_SERVER ) {
2015-02-10 16:43:01 +03:00
char * service_realm = NULL ;
ret = principal_comp_strcmp ( context , principal , 0 , KRB5_TGS_NAME ) ;
if ( ret = = 0 ) {
/*
* we need to search krbtgt / locally
*/
TALLOC_FREE ( frame ) ;
return 0 ;
}
/*
* We need to check the last component against the routing table .
*
* Note this works only with 2 or 3 component principals , e . g :
*
* servicePrincipalName : ldap / W2K8R2 - 219. bla . base
* servicePrincipalName : ldap / W2K8R2 - 219. bla . base / bla . base
* servicePrincipalName : ldap / W2K8R2 - 219. bla . base / ForestDnsZones . bla . base
* servicePrincipalName : ldap / W2K8R2 - 219. bla . base / DomainDnsZones . bla . base
*/
if ( num_comp = = 2 | | num_comp = = 3 ) {
service_realm = smb_krb5_principal_get_comp_string ( frame ,
context ,
principal ,
num_comp - 1 ) ;
}
if ( service_realm ! = NULL ) {
realm = service_realm ;
}
}
ok = lpcfg_is_my_domain_or_realm ( kdc_db_ctx - > lp_ctx , realm ) ;
if ( ok ) {
/*
* skip the expensive routing lookup
*/
TALLOC_FREE ( frame ) ;
return 0 ;
}
status = dsdb_trust_routing_table_load ( kdc_db_ctx - > samdb ,
frame , & trt ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( frame ) ;
return EINVAL ;
}
tdo = dsdb_trust_routing_by_name ( trt , realm ) ;
if ( tdo = = NULL ) {
/*
* This principal has to be local
*/
TALLOC_FREE ( frame ) ;
return 0 ;
}
if ( tdo - > trust_attributes & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST ) {
/*
* TODO : handle the routing within the forest
*
* This should likely be handled in
* samba_kdc_message2entry ( ) in case we ' re
* a global catalog . We ' d need to check
* if realm_dn is our own domain and derive
* the dns domain name from realm_dn and check that
* against the routing table or fallback to
* the tdo we found here .
*
* But for now we don ' t support multiple domains
* in our forest correctly anyway .
*
* Just search in our local database .
*/
TALLOC_FREE ( frame ) ;
return 0 ;
}
ZERO_STRUCT ( entry_ex - > entry ) ;
ret = krb5_copy_principal ( context , principal ,
& entry_ex - > entry . principal ) ;
if ( ret ) {
TALLOC_FREE ( frame ) ;
return ret ;
}
upper = strupper_talloc ( frame , tdo - > domain_name . string ) ;
if ( upper = = NULL ) {
TALLOC_FREE ( frame ) ;
return ENOMEM ;
}
2015-07-24 18:48:08 +03:00
ret = smb_krb5_principal_set_realm ( context ,
entry_ex - > entry . principal ,
upper ) ;
2015-02-10 16:43:01 +03:00
if ( ret ) {
TALLOC_FREE ( frame ) ;
return ret ;
}
TALLOC_FREE ( frame ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_WRONG_REALM ;
2015-02-10 16:43:01 +03:00
}
2010-01-28 09:27:11 +03:00
krb5_error_code samba_kdc_fetch ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
krb5_const_principal principal ,
unsigned flags ,
2010-12-04 01:06:53 +03:00
krb5_kvno kvno ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry_ex )
2010-01-28 09:27:11 +03:00
{
2014-05-08 19:13:04 +04:00
krb5_error_code ret = SDB_ERR_NOENTRY ;
2010-09-28 07:13:28 +04:00
TALLOC_CTX * mem_ctx ;
2010-01-28 09:27:11 +03:00
2010-09-28 07:13:28 +04:00
mem_ctx = talloc_named ( kdc_db_ctx , 0 , " samba_kdc_fetch context " ) ;
2010-01-28 09:27:11 +03:00
if ( ! mem_ctx ) {
ret = ENOMEM ;
krb5_set_error_message ( context , ret , " samba_kdc_fetch: talloc_named() failed! " ) ;
return ret ;
}
2015-02-10 16:43:01 +03:00
ret = samba_kdc_lookup_realm ( context , kdc_db_ctx , mem_ctx ,
principal , flags , entry_ex ) ;
if ( ret ! = 0 ) {
goto done ;
}
2014-05-08 19:13:04 +04:00
ret = SDB_ERR_NOENTRY ;
2015-02-10 16:43:01 +03:00
2014-05-08 19:13:04 +04:00
if ( flags & SDB_F_GET_CLIENT ) {
2010-11-16 06:07:18 +03:00
ret = samba_kdc_fetch_client ( context , kdc_db_ctx , mem_ctx , principal , flags , entry_ex ) ;
2014-05-08 19:13:04 +04:00
if ( ret ! = SDB_ERR_NOENTRY ) goto done ;
2010-01-28 09:27:11 +03:00
}
2014-05-08 19:13:04 +04:00
if ( flags & SDB_F_GET_SERVER ) {
2010-01-28 09:27:11 +03:00
/* krbtgt fits into this situation for trusted realms, and for resolving different versions of our own realm name */
2011-09-30 00:47:08 +04:00
ret = samba_kdc_fetch_krbtgt ( context , kdc_db_ctx , mem_ctx , principal , flags , kvno , entry_ex ) ;
2014-05-08 19:13:04 +04:00
if ( ret ! = SDB_ERR_NOENTRY ) goto done ;
2010-01-28 09:27:11 +03:00
/* We return 'no entry' if it does not start with krbtgt/, so move to the common case quickly */
2010-11-16 06:07:18 +03:00
ret = samba_kdc_fetch_server ( context , kdc_db_ctx , mem_ctx , principal , flags , entry_ex ) ;
2014-05-08 19:13:04 +04:00
if ( ret ! = SDB_ERR_NOENTRY ) goto done ;
2010-01-28 09:27:11 +03:00
}
2014-05-08 19:13:04 +04:00
if ( flags & SDB_F_GET_KRBTGT ) {
2011-09-30 00:47:08 +04:00
ret = samba_kdc_fetch_krbtgt ( context , kdc_db_ctx , mem_ctx , principal , flags , kvno , entry_ex ) ;
2014-05-08 19:13:04 +04:00
if ( ret ! = SDB_ERR_NOENTRY ) goto done ;
2010-01-28 09:27:11 +03:00
}
done :
talloc_free ( mem_ctx ) ;
return ret ;
}
struct samba_kdc_seq {
2010-04-12 01:17:15 +04:00
unsigned int index ;
unsigned int count ;
2010-01-28 09:27:11 +03:00
struct ldb_message * * msgs ;
struct ldb_dn * realm_dn ;
} ;
static krb5_error_code samba_kdc_seq ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry )
2010-01-28 09:27:11 +03:00
{
krb5_error_code ret ;
struct samba_kdc_seq * priv = kdc_db_ctx - > seq_ctx ;
2015-03-20 17:29:30 +03:00
const char * realm = lpcfg_realm ( kdc_db_ctx - > lp_ctx ) ;
struct ldb_message * msg = NULL ;
const char * sAMAccountName = NULL ;
krb5_principal principal = NULL ;
2010-01-28 09:27:11 +03:00
TALLOC_CTX * mem_ctx ;
if ( ! priv ) {
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
mem_ctx = talloc_named ( priv , 0 , " samba_kdc_seq context " ) ;
if ( ! mem_ctx ) {
ret = ENOMEM ;
krb5_set_error_message ( context , ret , " samba_kdc_seq: talloc_named() failed! " ) ;
return ret ;
}
2015-03-20 17:29:30 +03:00
while ( priv - > index < priv - > count ) {
msg = priv - > msgs [ priv - > index + + ] ;
sAMAccountName = ldb_msg_find_attr_as_string ( msg , " sAMAccountName " , NULL ) ;
if ( sAMAccountName ! = NULL ) {
break ;
}
}
if ( sAMAccountName = = NULL ) {
2014-05-08 19:13:04 +04:00
ret = SDB_ERR_NOENTRY ;
2015-03-20 17:29:30 +03:00
goto out ;
}
ret = smb_krb5_make_principal ( context , & principal ,
realm , sAMAccountName , NULL ) ;
if ( ret ! = 0 ) {
goto out ;
}
ret = samba_kdc_message2entry ( context , kdc_db_ctx , mem_ctx ,
principal , SAMBA_KDC_ENT_TYPE_ANY ,
2014-05-08 19:13:04 +04:00
SDB_F_ADMIN_DATA | SDB_F_GET_ANY ,
2015-03-20 17:29:30 +03:00
priv - > realm_dn , msg , entry ) ;
out :
if ( principal ! = NULL ) {
krb5_free_principal ( context , principal ) ;
2010-01-28 09:27:11 +03:00
}
if ( ret ! = 0 ) {
2010-04-17 22:08:15 +04:00
TALLOC_FREE ( priv ) ;
2010-01-28 09:27:11 +03:00
kdc_db_ctx - > seq_ctx = NULL ;
} else {
talloc_free ( mem_ctx ) ;
}
return ret ;
}
krb5_error_code samba_kdc_firstkey ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry )
2010-01-28 09:27:11 +03:00
{
struct ldb_context * ldb_ctx = kdc_db_ctx - > samdb ;
struct samba_kdc_seq * priv = kdc_db_ctx - > seq_ctx ;
char * realm ;
struct ldb_result * res = NULL ;
krb5_error_code ret ;
TALLOC_CTX * mem_ctx ;
int lret ;
if ( priv ) {
2010-04-17 22:08:15 +04:00
TALLOC_FREE ( priv ) ;
2010-01-28 09:27:11 +03:00
kdc_db_ctx - > seq_ctx = NULL ;
}
priv = ( struct samba_kdc_seq * ) talloc ( kdc_db_ctx , struct samba_kdc_seq ) ;
if ( ! priv ) {
ret = ENOMEM ;
krb5_set_error_message ( context , ret , " talloc: out of memory " ) ;
return ret ;
}
priv - > index = 0 ;
priv - > msgs = NULL ;
priv - > realm_dn = ldb_get_default_basedn ( ldb_ctx ) ;
priv - > count = 0 ;
mem_ctx = talloc_named ( priv , 0 , " samba_kdc_firstkey context " ) ;
if ( ! mem_ctx ) {
ret = ENOMEM ;
krb5_set_error_message ( context , ret , " samba_kdc_firstkey: talloc_named() failed! " ) ;
return ret ;
}
ret = krb5_get_default_realm ( context , & realm ) ;
if ( ret ! = 0 ) {
2010-04-17 22:08:15 +04:00
TALLOC_FREE ( priv ) ;
2010-01-28 09:27:11 +03:00
return ret ;
}
2014-02-21 08:13:47 +04:00
krb5_free_default_realm ( context , realm ) ;
2010-01-28 09:27:11 +03:00
2011-09-28 23:23:38 +04:00
lret = dsdb_search ( ldb_ctx , priv , & res ,
priv - > realm_dn , LDB_SCOPE_SUBTREE , user_attrs ,
DSDB_SEARCH_NO_GLOBAL_CATALOG ,
" (objectClass=user) " ) ;
2010-01-28 09:27:11 +03:00
if ( lret ! = LDB_SUCCESS ) {
2010-04-17 22:08:15 +04:00
TALLOC_FREE ( priv ) ;
2014-05-08 19:13:04 +04:00
return SDB_ERR_NOENTRY ;
2010-01-28 09:27:11 +03:00
}
priv - > count = res - > count ;
priv - > msgs = talloc_steal ( priv , res - > msgs ) ;
talloc_free ( res ) ;
kdc_db_ctx - > seq_ctx = priv ;
ret = samba_kdc_seq ( context , kdc_db_ctx , entry ) ;
if ( ret ! = 0 ) {
2010-04-17 22:08:15 +04:00
TALLOC_FREE ( priv ) ;
2010-01-28 09:27:11 +03:00
kdc_db_ctx - > seq_ctx = NULL ;
} else {
talloc_free ( mem_ctx ) ;
}
return ret ;
}
krb5_error_code samba_kdc_nextkey ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
2014-05-08 19:13:04 +04:00
struct sdb_entry_ex * entry )
2010-01-28 09:27:11 +03:00
{
return samba_kdc_seq ( context , kdc_db_ctx , entry ) ;
}
2010-03-27 15:11:06 +03:00
/* Check if a given entry may delegate or do s4u2self to this target principal
2010-01-28 09:27:11 +03:00
*
* This is currently a very nasty hack - allowing only delegation to itself .
*/
krb5_error_code
2011-04-07 13:16:55 +04:00
samba_kdc_check_s4u2self ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
2014-05-09 16:54:23 +04:00
struct samba_kdc_entry * skdc_entry ,
2011-04-07 13:16:55 +04:00
krb5_const_principal target_principal )
2010-01-28 09:27:11 +03:00
{
krb5_error_code ret ;
struct ldb_dn * realm_dn ;
struct ldb_message * msg ;
struct dom_sid * orig_sid ;
struct dom_sid * target_sid ;
const char * delegation_check_attrs [ ] = {
" objectSid " , NULL
} ;
2011-04-07 13:16:55 +04:00
TALLOC_CTX * mem_ctx = talloc_named ( kdc_db_ctx , 0 , " samba_kdc_check_s4u2self " ) ;
2010-01-28 09:27:11 +03:00
if ( ! mem_ctx ) {
ret = ENOMEM ;
2011-04-07 13:16:55 +04:00
krb5_set_error_message ( context , ret , " samba_kdc_check_s4u2self: talloc_named() failed! " ) ;
2010-01-28 09:27:11 +03:00
return ret ;
}
ret = samba_kdc_lookup_server ( context , kdc_db_ctx , mem_ctx , target_principal ,
2014-05-08 19:13:04 +04:00
SDB_F_GET_CLIENT | SDB_F_GET_SERVER ,
2015-01-30 02:31:29 +03:00
delegation_check_attrs , & realm_dn , & msg ) ;
2010-01-28 09:27:11 +03:00
if ( ret ! = 0 ) {
talloc_free ( mem_ctx ) ;
return ret ;
}
2014-05-09 16:54:23 +04:00
orig_sid = samdb_result_dom_sid ( mem_ctx , skdc_entry - > msg , " objectSid " ) ;
2010-01-28 09:27:11 +03:00
target_sid = samdb_result_dom_sid ( mem_ctx , msg , " objectSid " ) ;
/* Allow delegation to the same principal, even if by a different
* name . The easy and safe way to prove this is by SID
* comparison */
if ( ! ( orig_sid & & target_sid & & dom_sid_equal ( orig_sid , target_sid ) ) ) {
talloc_free ( mem_ctx ) ;
return KRB5KDC_ERR_BADOPTION ;
}
talloc_free ( mem_ctx ) ;
return ret ;
}
/* Certificates printed by a the Certificate Authority might have a
* slightly different form of the user principal name to that in the
* database . Allow a mismatch where they both refer to the same
* SID */
krb5_error_code
samba_kdc_check_pkinit_ms_upn_match ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
2014-05-09 16:56:22 +04:00
struct samba_kdc_entry * skdc_entry ,
2010-01-28 09:27:11 +03:00
krb5_const_principal certificate_principal )
{
krb5_error_code ret ;
struct ldb_dn * realm_dn ;
struct ldb_message * msg ;
struct dom_sid * orig_sid ;
struct dom_sid * target_sid ;
const char * ms_upn_check_attrs [ ] = {
" objectSid " , NULL
} ;
TALLOC_CTX * mem_ctx = talloc_named ( kdc_db_ctx , 0 , " samba_kdc_check_pkinit_ms_upn_match " ) ;
if ( ! mem_ctx ) {
ret = ENOMEM ;
krb5_set_error_message ( context , ret , " samba_kdc_fetch: talloc_named() failed! " ) ;
return ret ;
}
ret = samba_kdc_lookup_client ( context , kdc_db_ctx ,
2015-01-30 02:31:29 +03:00
mem_ctx , certificate_principal ,
ms_upn_check_attrs , & realm_dn , & msg ) ;
2010-01-28 09:27:11 +03:00
if ( ret ! = 0 ) {
talloc_free ( mem_ctx ) ;
return ret ;
}
2014-05-09 16:56:22 +04:00
orig_sid = samdb_result_dom_sid ( mem_ctx , skdc_entry - > msg , " objectSid " ) ;
2010-01-28 09:27:11 +03:00
target_sid = samdb_result_dom_sid ( mem_ctx , msg , " objectSid " ) ;
/* Consider these to be the same principal, even if by a different
* name . The easy and safe way to prove this is by SID
* comparison */
if ( ! ( orig_sid & & target_sid & & dom_sid_equal ( orig_sid , target_sid ) ) ) {
talloc_free ( mem_ctx ) ;
2014-05-08 16:42:20 +04:00
# ifdef KRB5_KDC_ERR_CLIENT_NAME_MISMATCH /* Heimdal */
2010-01-28 09:27:11 +03:00
return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH ;
2014-05-08 16:42:20 +04:00
# elif defined(KRB5KDC_ERR_CLIENT_NAME_MISMATCH) /* MIT */
return KRB5KDC_ERR_CLIENT_NAME_MISMATCH ;
# endif
2010-01-28 09:27:11 +03:00
}
talloc_free ( mem_ctx ) ;
return ret ;
}
2011-04-07 13:16:55 +04:00
/*
* Check if a given entry may delegate to this target principal
* with S4U2Proxy .
*/
krb5_error_code
samba_kdc_check_s4u2proxy ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
2014-05-09 16:58:08 +04:00
struct samba_kdc_entry * skdc_entry ,
2011-04-07 13:16:55 +04:00
krb5_const_principal target_principal )
{
2011-04-27 13:41:49 +04:00
krb5_error_code ret ;
char * tmp = NULL ;
const char * client_dn = NULL ;
const char * target_principal_name = NULL ;
struct ldb_message_element * el ;
struct ldb_val val ;
unsigned int i ;
bool found = false ;
TALLOC_CTX * mem_ctx = talloc_named ( kdc_db_ctx , 0 , " samba_kdc_check_s4u2proxy " ) ;
if ( ! mem_ctx ) {
ret = ENOMEM ;
krb5_set_error_message ( context , ret ,
" samba_kdc_check_s4u2proxy: "
" talloc_named() failed! " ) ;
return ret ;
}
2014-05-09 16:58:08 +04:00
client_dn = ldb_dn_get_linearized ( skdc_entry - > msg - > dn ) ;
2011-04-27 13:41:49 +04:00
if ( ! client_dn ) {
if ( errno = = 0 ) {
errno = ENOMEM ;
}
ret = errno ;
krb5_set_error_message ( context , ret ,
" samba_kdc_check_s4u2proxy: "
" ldb_dn_get_linearized() failed! " ) ;
return ret ;
}
/*
* The main heimdal code already checked that the target_principal
* belongs to the same realm as the client .
*
* So we just need the principal without the realm ,
* as that is what is configured in the " msDS-AllowedToDelegateTo "
* attribute .
*/
ret = krb5_unparse_name_flags ( context , target_principal ,
KRB5_PRINCIPAL_UNPARSE_NO_REALM , & tmp ) ;
if ( ret ) {
talloc_free ( mem_ctx ) ;
krb5_set_error_message ( context , ret ,
" samba_kdc_check_s4u2proxy: "
" krb5_unparse_name() failed! " ) ;
return ret ;
}
DEBUG ( 10 , ( " samba_kdc_check_s4u2proxy: client[%s] for target[%s] \n " ,
client_dn , tmp ) ) ;
target_principal_name = talloc_strdup ( mem_ctx , tmp ) ;
SAFE_FREE ( tmp ) ;
if ( target_principal_name = = NULL ) {
ret = ENOMEM ;
krb5_set_error_message ( context , ret ,
" samba_kdc_check_s4u2proxy: "
" talloc_strdup() failed! " ) ;
return ret ;
}
2014-05-09 16:58:08 +04:00
el = ldb_msg_find_element ( skdc_entry - > msg , " msDS-AllowedToDelegateTo " ) ;
2011-04-27 13:41:49 +04:00
if ( el = = NULL ) {
goto bad_option ;
}
val = data_blob_string_const ( target_principal_name ) ;
for ( i = 0 ; i < el - > num_values ; i + + ) {
struct ldb_val * val1 = & val ;
struct ldb_val * val2 = & el - > values [ i ] ;
int cmp ;
if ( val1 - > length ! = val2 - > length ) {
continue ;
}
cmp = strncasecmp ( ( const char * ) val1 - > data ,
( const char * ) val2 - > data ,
val1 - > length ) ;
if ( cmp ! = 0 ) {
continue ;
}
found = true ;
break ;
}
if ( ! found ) {
goto bad_option ;
}
DEBUG ( 10 , ( " samba_kdc_check_s4u2proxy: client[%s] allowed target[%s] \n " ,
client_dn , tmp ) ) ;
talloc_free ( mem_ctx ) ;
return 0 ;
bad_option :
krb5_set_error_message ( context , ret ,
" samba_kdc_check_s4u2proxy: client[%s] "
" not allowed for delegation to target[%s] " ,
client_dn ,
target_principal_name ) ;
talloc_free ( mem_ctx ) ;
2011-04-07 13:16:55 +04:00
return KRB5KDC_ERR_BADOPTION ;
}
2010-09-28 07:05:37 +04:00
NTSTATUS samba_kdc_setup_db_ctx ( TALLOC_CTX * mem_ctx , struct samba_kdc_base_context * base_ctx ,
struct samba_kdc_db_context * * kdc_db_ctx_out )
{
int ldb_ret ;
struct ldb_message * msg ;
struct auth_session_info * session_info ;
struct samba_kdc_db_context * kdc_db_ctx ;
/* The idea here is very simple. Using Kerberos to
* authenticate the KDC to the LDAP server is higly likely to
* be circular .
*
* In future we may set this up to use EXERNAL and SSL
* certificates , for now it will almost certainly be NTLMSSP_SET_USERNAME
*/
kdc_db_ctx = talloc_zero ( mem_ctx , struct samba_kdc_db_context ) ;
if ( kdc_db_ctx = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
kdc_db_ctx - > ev_ctx = base_ctx - > ev_ctx ;
kdc_db_ctx - > lp_ctx = base_ctx - > lp_ctx ;
2017-02-21 04:07:54 +03:00
kdc_db_ctx - > msg_ctx = base_ctx - > msg_ctx ;
2010-09-28 07:05:37 +04:00
2012-04-20 01:54:57 +04:00
/* get default kdc policy */
2017-08-09 20:30:00 +03:00
lpcfg_default_kdc_policy ( mem_ctx ,
base_ctx - > lp_ctx ,
2012-04-20 01:54:57 +04:00
& kdc_db_ctx - > policy . svc_tkt_lifetime ,
& kdc_db_ctx - > policy . usr_tkt_lifetime ,
& kdc_db_ctx - > policy . renewal_lifetime ) ;
2010-12-09 06:17:54 +03:00
2010-09-28 07:05:37 +04:00
session_info = system_session ( kdc_db_ctx - > lp_ctx ) ;
if ( session_info = = NULL ) {
return NT_STATUS_INTERNAL_ERROR ;
}
/* Setup the link to LDB */
kdc_db_ctx - > samdb = samdb_connect ( kdc_db_ctx , base_ctx - > ev_ctx ,
2010-10-10 19:00:45 +04:00
base_ctx - > lp_ctx , session_info , 0 ) ;
2010-09-28 07:05:37 +04:00
if ( kdc_db_ctx - > samdb = = NULL ) {
2014-05-07 18:11:51 +04:00
DEBUG ( 1 , ( " samba_kdc_setup_db_ctx: Cannot open samdb for KDC backend! " ) ) ;
2010-09-28 07:05:37 +04:00
talloc_free ( kdc_db_ctx ) ;
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO ;
}
/* Find out our own krbtgt kvno */
ldb_ret = samdb_rodc ( kdc_db_ctx - > samdb , & kdc_db_ctx - > rodc ) ;
if ( ldb_ret ! = LDB_SUCCESS ) {
2014-05-07 18:11:51 +04:00
DEBUG ( 1 , ( " samba_kdc_setup_db_ctx: Cannot determine if we are an RODC in KDC backend: %s \n " ,
2010-09-28 07:05:37 +04:00
ldb_errstring ( kdc_db_ctx - > samdb ) ) ) ;
talloc_free ( kdc_db_ctx ) ;
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO ;
}
if ( kdc_db_ctx - > rodc ) {
int my_krbtgt_number ;
const char * secondary_keytab [ ] = { " msDS-SecondaryKrbTgtNumber " , NULL } ;
struct ldb_dn * account_dn ;
struct ldb_dn * server_dn = samdb_server_dn ( kdc_db_ctx - > samdb , kdc_db_ctx ) ;
if ( ! server_dn ) {
2014-05-07 18:11:51 +04:00
DEBUG ( 1 , ( " samba_kdc_setup_db_ctx: Cannot determine server DN in KDC backend: %s \n " ,
2010-09-28 07:05:37 +04:00
ldb_errstring ( kdc_db_ctx - > samdb ) ) ) ;
talloc_free ( kdc_db_ctx ) ;
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO ;
}
ldb_ret = samdb_reference_dn ( kdc_db_ctx - > samdb , kdc_db_ctx , server_dn ,
" serverReference " , & account_dn ) ;
if ( ldb_ret ! = LDB_SUCCESS ) {
2014-05-07 18:11:51 +04:00
DEBUG ( 1 , ( " samba_kdc_setup_db_ctx: Cannot determine server account in KDC backend: %s \n " ,
2010-09-28 07:05:37 +04:00
ldb_errstring ( kdc_db_ctx - > samdb ) ) ) ;
talloc_free ( kdc_db_ctx ) ;
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO ;
}
ldb_ret = samdb_reference_dn ( kdc_db_ctx - > samdb , kdc_db_ctx , account_dn ,
" msDS-KrbTgtLink " , & kdc_db_ctx - > krbtgt_dn ) ;
talloc_free ( account_dn ) ;
if ( ldb_ret ! = LDB_SUCCESS ) {
2014-05-07 18:11:51 +04:00
DEBUG ( 1 , ( " samba_kdc_setup_db_ctx: Cannot determine RODC krbtgt account in KDC backend: %s \n " ,
2010-09-28 07:05:37 +04:00
ldb_errstring ( kdc_db_ctx - > samdb ) ) ) ;
talloc_free ( kdc_db_ctx ) ;
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO ;
}
ldb_ret = dsdb_search_one ( kdc_db_ctx - > samdb , kdc_db_ctx ,
& msg , kdc_db_ctx - > krbtgt_dn , LDB_SCOPE_BASE ,
secondary_keytab ,
2011-09-28 23:23:38 +04:00
DSDB_SEARCH_NO_GLOBAL_CATALOG ,
2010-09-28 07:05:37 +04:00
" (&(objectClass=user)(msDS-SecondaryKrbTgtNumber=*)) " ) ;
if ( ldb_ret ! = LDB_SUCCESS ) {
2014-05-07 18:11:51 +04:00
DEBUG ( 1 , ( " samba_kdc_setup_db_ctx: Cannot read krbtgt account %s in KDC backend to get msDS-SecondaryKrbTgtNumber: %s: %s \n " ,
2010-09-28 07:05:37 +04:00
ldb_dn_get_linearized ( kdc_db_ctx - > krbtgt_dn ) ,
ldb_errstring ( kdc_db_ctx - > samdb ) ,
ldb_strerror ( ldb_ret ) ) ) ;
talloc_free ( kdc_db_ctx ) ;
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO ;
}
my_krbtgt_number = ldb_msg_find_attr_as_int ( msg , " msDS-SecondaryKrbTgtNumber " , - 1 ) ;
if ( my_krbtgt_number = = - 1 ) {
2014-05-07 18:11:51 +04:00
DEBUG ( 1 , ( " samba_kdc_setup_db_ctx: Cannot read msDS-SecondaryKrbTgtNumber from krbtgt account %s in KDC backend: got %d \n " ,
2010-09-28 07:05:37 +04:00
ldb_dn_get_linearized ( kdc_db_ctx - > krbtgt_dn ) ,
my_krbtgt_number ) ) ;
talloc_free ( kdc_db_ctx ) ;
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO ;
}
kdc_db_ctx - > my_krbtgt_number = my_krbtgt_number ;
} else {
kdc_db_ctx - > my_krbtgt_number = 0 ;
ldb_ret = dsdb_search_one ( kdc_db_ctx - > samdb , kdc_db_ctx ,
2011-08-19 11:31:13 +04:00
& msg ,
ldb_get_default_basedn ( kdc_db_ctx - > samdb ) ,
LDB_SCOPE_SUBTREE ,
2010-09-28 07:05:37 +04:00
krbtgt_attrs ,
2011-09-28 23:23:38 +04:00
DSDB_SEARCH_NO_GLOBAL_CATALOG ,
2010-09-28 07:05:37 +04:00
" (&(objectClass=user)(samAccountName=krbtgt)) " ) ;
if ( ldb_ret ! = LDB_SUCCESS ) {
DEBUG ( 1 , ( " samba_kdc_fetch: could not find own KRBTGT in DB: %s \n " , ldb_errstring ( kdc_db_ctx - > samdb ) ) ) ;
talloc_free ( kdc_db_ctx ) ;
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO ;
}
kdc_db_ctx - > krbtgt_dn = talloc_steal ( kdc_db_ctx , msg - > dn ) ;
kdc_db_ctx - > my_krbtgt_number = 0 ;
talloc_free ( msg ) ;
}
* kdc_db_ctx_out = kdc_db_ctx ;
return NT_STATUS_OK ;
}