mirror of
https://github.com/samba-team/samba.git
synced 2024-12-22 13:34:15 +03:00
1dcd8be8f0
The MIT KDC has a fallback to a consistent time per fetch call, and both implementations then follow the time in each 'struct samba_kdc_entry'. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
466 lines
12 KiB
C
466 lines
12 KiB
C
/*
|
|
Unix SMB/CIFS implementation.
|
|
|
|
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2009
|
|
Copyright (C) Andreas Schneider <asn@samba.org> 2016
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "includes.h"
|
|
#include "system/kerberos.h"
|
|
#include "auth/credentials/credentials.h"
|
|
#include "auth/kerberos/kerberos.h"
|
|
#include "auth/kerberos/kerberos_credentials.h"
|
|
#include "auth/kerberos/kerberos_util.h"
|
|
#include "auth/kerberos/kerberos_srv_keytab.h"
|
|
#include "kdc/samba_kdc.h"
|
|
#include "libnet/libnet_export_keytab.h"
|
|
#include "kdc/db-glue.h"
|
|
#include "kdc/sdb.h"
|
|
#include "dsdb/gmsa/util.h"
|
|
|
|
static NTSTATUS sdb_kt_copy(TALLOC_CTX *mem_ctx,
|
|
struct smb_krb5_context *smb_krb5_context,
|
|
struct samba_kdc_db_context *db_ctx,
|
|
const char *keytab_name,
|
|
const char *principal,
|
|
bool keep_stale_entries,
|
|
bool include_historic_keys,
|
|
const unsigned sdb_flags,
|
|
const char **error_string)
|
|
{
|
|
struct sdb_entry sentry = {};
|
|
krb5_keytab keytab;
|
|
krb5_error_code code = 0;
|
|
NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
|
|
char *entry_principal = NULL;
|
|
bool copy_one_principal = (principal != NULL);
|
|
bool keys_exported = false;
|
|
krb5_context context = smb_krb5_context->krb5_context;
|
|
TALLOC_CTX *tmp_ctx = NULL;
|
|
|
|
code = smb_krb5_kt_open_relative(context,
|
|
keytab_name,
|
|
true, /* write_access */
|
|
&keytab);
|
|
if (code != 0) {
|
|
*error_string = talloc_asprintf(mem_ctx,
|
|
"Failed to open keytab: %s",
|
|
keytab_name);
|
|
status = NT_STATUS_NO_SUCH_FILE;
|
|
goto done;
|
|
}
|
|
|
|
if (copy_one_principal) {
|
|
krb5_principal k5_princ;
|
|
|
|
code = smb_krb5_parse_name(context, principal, &k5_princ);
|
|
if (code != 0) {
|
|
*error_string = smb_get_krb5_error_message(context,
|
|
code,
|
|
mem_ctx);
|
|
status = NT_STATUS_UNSUCCESSFUL;
|
|
goto done;
|
|
}
|
|
|
|
code = samba_kdc_fetch(context, db_ctx, k5_princ,
|
|
SDB_F_GET_ANY | sdb_flags,
|
|
0, &sentry);
|
|
|
|
krb5_free_principal(context, k5_princ);
|
|
} else {
|
|
code = samba_kdc_firstkey(context, db_ctx, sdb_flags, &sentry);
|
|
}
|
|
|
|
for (; code == 0; code = samba_kdc_nextkey(context, db_ctx, sdb_flags, &sentry)) {
|
|
int i;
|
|
bool found_previous = false;
|
|
tmp_ctx = talloc_new(mem_ctx);
|
|
if (tmp_ctx == NULL) {
|
|
status = NT_STATUS_NO_MEMORY;
|
|
goto done;
|
|
}
|
|
|
|
code = krb5_unparse_name(context,
|
|
sentry.principal,
|
|
&entry_principal);
|
|
if (code != 0) {
|
|
*error_string = smb_get_krb5_error_message(context,
|
|
code,
|
|
mem_ctx);
|
|
status = NT_STATUS_UNSUCCESSFUL;
|
|
goto done;
|
|
}
|
|
|
|
if (!keep_stale_entries) {
|
|
code = smb_krb5_remove_obsolete_keytab_entries(mem_ctx,
|
|
context,
|
|
keytab,
|
|
1, &sentry.principal,
|
|
sentry.kvno,
|
|
&found_previous,
|
|
error_string);
|
|
if (code != 0) {
|
|
*error_string = talloc_asprintf(mem_ctx,
|
|
"Failed to remove old principals from keytab: %s\n",
|
|
*error_string);
|
|
status = NT_STATUS_UNSUCCESSFUL;
|
|
goto done;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* If this was a gMSA and we did not just read the
|
|
* keys directly, then generate them
|
|
*/
|
|
if (sentry.skdc_entry->group_managed_service_account
|
|
&& sentry.keys.len == 0) {
|
|
struct ldb_dn *dn = sentry.skdc_entry->msg->dn;
|
|
/*
|
|
* for error message only, but we are about to
|
|
* destroy the string name, so write this out
|
|
* now
|
|
*/
|
|
const char *extended_dn =
|
|
ldb_dn_get_extended_linearized(mem_ctx,
|
|
dn,
|
|
1);
|
|
|
|
/*
|
|
* Modify the DN in the entry (not needed by
|
|
* the KDC code any longer) to be minimal, so
|
|
* we can search on it over LDAP.
|
|
*/
|
|
ldb_dn_minimise(dn);
|
|
|
|
status = smb_krb5_fill_keytab_gmsa_keys(tmp_ctx,
|
|
smb_krb5_context,
|
|
keytab,
|
|
sentry.principal,
|
|
db_ctx->samdb,
|
|
dn,
|
|
include_historic_keys,
|
|
error_string);
|
|
if (NT_STATUS_IS_OK(status)) {
|
|
keys_exported = true;
|
|
} else if (copy_one_principal) {
|
|
*error_string = talloc_asprintf(mem_ctx,
|
|
"Failed to write gMSA password for %s to keytab: %s\n",
|
|
principal,
|
|
*error_string);
|
|
goto done;
|
|
} else if (!NT_STATUS_EQUAL(status, NT_STATUS_NO_USER_KEYS)) {
|
|
*error_string = talloc_asprintf(mem_ctx,
|
|
"Failed to write gMSA password for %s to keytab: %s\n",
|
|
extended_dn,
|
|
*error_string);
|
|
goto done;
|
|
}
|
|
} else {
|
|
krb5_keytab_entry kt_entry;
|
|
ZERO_STRUCT(kt_entry);
|
|
kt_entry.principal = sentry.principal;
|
|
kt_entry.vno = sentry.kvno;
|
|
|
|
for (i = 0; i < sentry.keys.len; i++) {
|
|
struct sdb_key *s = &(sentry.keys.val[i]);
|
|
krb5_keyblock *keyp;
|
|
bool found;
|
|
|
|
keyp = KRB5_KT_KEY(&kt_entry);
|
|
|
|
*keyp = s->key;
|
|
|
|
code = smb_krb5_is_exact_entry_in_keytab(mem_ctx,
|
|
context,
|
|
keytab,
|
|
&kt_entry,
|
|
&found,
|
|
error_string);
|
|
if (code != 0) {
|
|
status = NT_STATUS_UNSUCCESSFUL;
|
|
*error_string = smb_get_krb5_error_message(context,
|
|
code,
|
|
mem_ctx);
|
|
DEBUG(0, ("smb_krb5_is_exact_entry_in_keytab failed code=%d, error = %s\n",
|
|
code, *error_string));
|
|
goto done;
|
|
}
|
|
|
|
if (found) {
|
|
continue;
|
|
}
|
|
|
|
code = krb5_kt_add_entry(context, keytab, &kt_entry);
|
|
if (code != 0) {
|
|
status = NT_STATUS_UNSUCCESSFUL;
|
|
*error_string = smb_get_krb5_error_message(context,
|
|
code,
|
|
mem_ctx);
|
|
DEBUG(0, ("smb_krb5_kt_add_entry failed code=%d, error = %s\n",
|
|
code, *error_string));
|
|
goto done;
|
|
}
|
|
keys_exported = true;
|
|
}
|
|
kt_entry.vno -= 1;
|
|
for (i = 0; include_historic_keys && i < sentry.old_keys.len; i++) {
|
|
struct sdb_key *s = &(sentry.old_keys.val[i]);
|
|
krb5_keyblock *keyp;
|
|
bool found;
|
|
|
|
keyp = KRB5_KT_KEY(&kt_entry);
|
|
|
|
*keyp = s->key;
|
|
|
|
code = smb_krb5_is_exact_entry_in_keytab(mem_ctx,
|
|
context,
|
|
keytab,
|
|
&kt_entry,
|
|
&found,
|
|
error_string);
|
|
if (code != 0) {
|
|
status = NT_STATUS_UNSUCCESSFUL;
|
|
*error_string = smb_get_krb5_error_message(context,
|
|
code,
|
|
mem_ctx);
|
|
DEBUG(0, ("smb_krb5_is_exact_entry_in_keytab failed code=%d, error = %s\n",
|
|
code, *error_string));
|
|
goto done;
|
|
}
|
|
|
|
if (found) {
|
|
continue;
|
|
}
|
|
|
|
code = krb5_kt_add_entry(context, keytab, &kt_entry);
|
|
if (code != 0) {
|
|
status = NT_STATUS_UNSUCCESSFUL;
|
|
*error_string = smb_get_krb5_error_message(context,
|
|
code,
|
|
mem_ctx);
|
|
DEBUG(0, ("smb_krb5_kt_add_entry failed code=%d, error = %s\n",
|
|
code, *error_string));
|
|
goto done;
|
|
}
|
|
keys_exported = true;
|
|
}
|
|
kt_entry.vno -= 1;
|
|
for (i = 0; include_historic_keys && i < sentry.older_keys.len; i++) {
|
|
struct sdb_key *s = &(sentry.older_keys.val[i]);
|
|
krb5_keyblock *keyp;
|
|
bool found;
|
|
|
|
keyp = KRB5_KT_KEY(&kt_entry);
|
|
|
|
*keyp = s->key;
|
|
|
|
code = smb_krb5_is_exact_entry_in_keytab(mem_ctx,
|
|
context,
|
|
keytab,
|
|
&kt_entry,
|
|
&found,
|
|
error_string);
|
|
if (code != 0) {
|
|
status = NT_STATUS_UNSUCCESSFUL;
|
|
*error_string = smb_get_krb5_error_message(context,
|
|
code,
|
|
mem_ctx);
|
|
DEBUG(0, ("smb_krb5_is_exact_entry_in_keytab failed code=%d, error = %s\n",
|
|
code, *error_string));
|
|
goto done;
|
|
}
|
|
|
|
if (found) {
|
|
continue;
|
|
}
|
|
|
|
code = krb5_kt_add_entry(context, keytab, &kt_entry);
|
|
if (code != 0) {
|
|
status = NT_STATUS_UNSUCCESSFUL;
|
|
*error_string = smb_get_krb5_error_message(context,
|
|
code,
|
|
mem_ctx);
|
|
DEBUG(0, ("smb_krb5_kt_add_entry failed code=%d, error = %s\n",
|
|
code, *error_string));
|
|
goto done;
|
|
}
|
|
keys_exported = true;
|
|
}
|
|
}
|
|
|
|
if (copy_one_principal) {
|
|
break;
|
|
}
|
|
|
|
TALLOC_FREE(tmp_ctx);
|
|
SAFE_FREE(entry_principal);
|
|
sdb_entry_free(&sentry);
|
|
}
|
|
|
|
if (code != 0 && code != SDB_ERR_NOENTRY) {
|
|
*error_string = smb_get_krb5_error_message(context,
|
|
code,
|
|
mem_ctx);
|
|
status = NT_STATUS_NO_SUCH_USER;
|
|
goto done;
|
|
}
|
|
|
|
if (keys_exported == false) {
|
|
if (keep_stale_entries == false) {
|
|
*error_string = talloc_asprintf(mem_ctx,
|
|
"No keys found while exporting %s. "
|
|
"Consider connecting to a local sam.ldb, "
|
|
"only gMSA accounts can be exported over "
|
|
"LDAP and connecting user needs to be authorized",
|
|
principal ? principal : "all users in domain");
|
|
status = NT_STATUS_NO_USER_KEYS;
|
|
} else {
|
|
DBG_NOTICE("No new keys found while exporting %s. "
|
|
"If new keys were expected, consider connecting "
|
|
"to a local sam.ldb, only gMSA accounts can be exported over "
|
|
"LDAP and connecting user needs to be authorized\n",
|
|
principal ? principal : "all users in domain");
|
|
status = NT_STATUS_OK;
|
|
}
|
|
} else {
|
|
status = NT_STATUS_OK;
|
|
}
|
|
|
|
done:
|
|
TALLOC_FREE(tmp_ctx);
|
|
SAFE_FREE(entry_principal);
|
|
sdb_entry_free(&sentry);
|
|
|
|
return status;
|
|
}
|
|
|
|
NTSTATUS libnet_export_keytab(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_export_keytab *r)
|
|
{
|
|
krb5_error_code ret;
|
|
struct smb_krb5_context *smb_krb5_context;
|
|
struct samba_kdc_base_context *base_ctx;
|
|
struct samba_kdc_db_context *db_ctx = NULL;
|
|
const char *error_string = NULL;
|
|
unsigned sdb_flags;
|
|
NTSTATUS status;
|
|
|
|
bool keep_stale_entries = r->in.keep_stale_entries;
|
|
|
|
ret = smb_krb5_init_context(ctx, ctx->lp_ctx, &smb_krb5_context);
|
|
if (ret) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
base_ctx = talloc_zero(mem_ctx, struct samba_kdc_base_context);
|
|
if (base_ctx == NULL) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
base_ctx->ev_ctx = ctx->event_ctx;
|
|
base_ctx->lp_ctx = ctx->lp_ctx;
|
|
base_ctx->samdb = r->in.samdb;
|
|
if (base_ctx->samdb != NULL) {
|
|
base_ctx->current_nttime_ull = talloc_get_type(
|
|
ldb_get_opaque(base_ctx->samdb, DSDB_GMSA_TIME_OPAQUE), unsigned long long);
|
|
}
|
|
|
|
/*
|
|
* If the caller hasn't set a fixed time, or a samdb, set up
|
|
* the pointer for the opaque and set to the current time
|
|
*/
|
|
if (base_ctx->current_nttime_ull == NULL) {
|
|
bool time_ok;
|
|
NTTIME current_nttime;
|
|
|
|
base_ctx->current_nttime_ull = talloc_zero(base_ctx, unsigned long long);
|
|
if (base_ctx->current_nttime_ull == NULL) {
|
|
r->out.error_string = NULL;
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
time_ok = gmsa_current_time(¤t_nttime);
|
|
|
|
if (!time_ok) {
|
|
/* This is really quite unlikely */
|
|
r->out.error_string
|
|
= talloc_asprintf(mem_ctx,
|
|
"Failed to get current time to check "
|
|
"time-dependent keys against for export");
|
|
return NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
*base_ctx->current_nttime_ull = current_nttime;
|
|
}
|
|
|
|
status = samba_kdc_setup_db_ctx(mem_ctx, base_ctx, &db_ctx);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return status;
|
|
}
|
|
|
|
if (r->in.principal != NULL) {
|
|
DEBUG(0, ("Export one principal to %s\n", r->in.keytab_name));
|
|
} else {
|
|
DEBUG(0, ("Export complete keytab to %s\n", r->in.keytab_name));
|
|
if (!keep_stale_entries) {
|
|
struct stat st;
|
|
int stat_ret = stat(r->in.keytab_name, &st);
|
|
if (stat_ret == -1 && errno == ENOENT) {
|
|
/* continue */
|
|
} else if (stat_ret == -1) {
|
|
int errno_save = errno;
|
|
r->out.error_string
|
|
= talloc_asprintf(mem_ctx,
|
|
"Failure checking if keytab export location %s is an existing file: %s",
|
|
r->in.keytab_name,
|
|
strerror(errno_save));
|
|
return map_nt_error_from_unix_common(errno_save);
|
|
} else {
|
|
r->out.error_string
|
|
= talloc_asprintf(mem_ctx,
|
|
"Refusing to export keytab to existing file %s",
|
|
r->in.keytab_name);
|
|
return NT_STATUS_OBJECT_NAME_EXISTS;
|
|
}
|
|
|
|
/*
|
|
* No point looking for old
|
|
* keys in a empty file
|
|
*/
|
|
keep_stale_entries = true;
|
|
}
|
|
}
|
|
|
|
sdb_flags = r->in.as_for_AS_REQ ? SDB_F_FOR_AS_REQ : SDB_F_ADMIN_DATA;
|
|
|
|
status = sdb_kt_copy(mem_ctx,
|
|
smb_krb5_context,
|
|
db_ctx,
|
|
r->in.keytab_name,
|
|
r->in.principal,
|
|
keep_stale_entries,
|
|
!r->in.only_current_keys,
|
|
sdb_flags,
|
|
&error_string);
|
|
|
|
talloc_free(db_ctx);
|
|
talloc_free(base_ctx);
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
r->out.error_string = error_string;
|
|
}
|
|
|
|
return status;
|
|
}
|