mirror of
https://github.com/samba-team/samba.git
synced 2024-12-25 23:21:54 +03:00
233ce6b2b8
The resulting user_info_dc is kept in the 'samba_kdc_entry' structure, so it can be reused between calls. This allows us to simplify samba_kdc_get_pac_blobs(), as it no longer need to return a user_info_dc structure. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
1908 lines
50 KiB
C
1908 lines
50 KiB
C
/*
|
|
Unix SMB/CIFS implementation.
|
|
|
|
PAC Glue between Samba and the KDC
|
|
|
|
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
|
|
Copyright (C) Simo Sorce <idra@samba.org> 2010
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "lib/replace/replace.h"
|
|
#include "lib/replace/system/kerberos.h"
|
|
#include "lib/util/debug.h"
|
|
#include "lib/util/samba_util.h"
|
|
#include "lib/util/talloc_stack.h"
|
|
|
|
#include "auth/auth_sam_reply.h"
|
|
#include "auth/kerberos/kerberos.h"
|
|
#include "auth/kerberos/pac_utils.h"
|
|
#include "libcli/security/security.h"
|
|
#include "libds/common/flags.h"
|
|
#include "librpc/gen_ndr/ndr_krb5pac.h"
|
|
#include "param/param.h"
|
|
#include "source4/auth/auth.h"
|
|
#include "source4/dsdb/common/util.h"
|
|
#include "source4/dsdb/samdb/samdb.h"
|
|
#include "source4/kdc/samba_kdc.h"
|
|
#include "source4/kdc/pac-glue.h"
|
|
|
|
#include <ldb.h>
|
|
|
|
static
|
|
NTSTATUS samba_get_logon_info_pac_blob(TALLOC_CTX *mem_ctx,
|
|
const struct auth_user_info_dc *info,
|
|
DATA_BLOB *pac_data,
|
|
DATA_BLOB *requester_sid_blob)
|
|
{
|
|
struct netr_SamInfo3 *info3;
|
|
union PAC_INFO pac_info;
|
|
enum ndr_err_code ndr_err;
|
|
NTSTATUS nt_status;
|
|
|
|
ZERO_STRUCT(pac_info);
|
|
|
|
*pac_data = data_blob_null;
|
|
if (requester_sid_blob != NULL) {
|
|
*requester_sid_blob = data_blob_null;
|
|
}
|
|
|
|
nt_status = auth_convert_user_info_dc_saminfo3(mem_ctx, info, &info3);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(1, ("Getting Samba info failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
|
|
pac_info.logon_info.info = talloc_zero(mem_ctx, struct PAC_LOGON_INFO);
|
|
if (!pac_info.logon_info.info) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
pac_info.logon_info.info->info3 = *info3;
|
|
|
|
ndr_err = ndr_push_union_blob(pac_data, mem_ctx, &pac_info,
|
|
PAC_TYPE_LOGON_INFO,
|
|
(ndr_push_flags_fn_t)ndr_push_PAC_INFO);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(1, ("PAC_LOGON_INFO (presig) push failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
|
|
if (requester_sid_blob != NULL && info->num_sids > 0) {
|
|
union PAC_INFO pac_requester_sid;
|
|
|
|
ZERO_STRUCT(pac_requester_sid);
|
|
|
|
pac_requester_sid.requester_sid.sid = info->sids[0];
|
|
|
|
ndr_err = ndr_push_union_blob(requester_sid_blob, mem_ctx,
|
|
&pac_requester_sid,
|
|
PAC_TYPE_REQUESTER_SID,
|
|
(ndr_push_flags_fn_t)ndr_push_PAC_INFO);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(1, ("PAC_REQUESTER_SID (presig) push failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
}
|
|
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
static
|
|
NTSTATUS samba_get_upn_info_pac_blob(TALLOC_CTX *mem_ctx,
|
|
const struct auth_user_info_dc *info,
|
|
DATA_BLOB *upn_data)
|
|
{
|
|
union PAC_INFO pac_upn;
|
|
enum ndr_err_code ndr_err;
|
|
NTSTATUS nt_status;
|
|
bool ok;
|
|
|
|
ZERO_STRUCT(pac_upn);
|
|
|
|
*upn_data = data_blob_null;
|
|
|
|
pac_upn.upn_dns_info.upn_name = info->info->user_principal_name;
|
|
pac_upn.upn_dns_info.dns_domain_name = strupper_talloc(mem_ctx,
|
|
info->info->dns_domain_name);
|
|
if (pac_upn.upn_dns_info.dns_domain_name == NULL) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
if (info->info->user_principal_constructed) {
|
|
pac_upn.upn_dns_info.flags |= PAC_UPN_DNS_FLAG_CONSTRUCTED;
|
|
}
|
|
|
|
pac_upn.upn_dns_info.flags |= PAC_UPN_DNS_FLAG_HAS_SAM_NAME_AND_SID;
|
|
|
|
pac_upn.upn_dns_info.ex.sam_name_and_sid.samaccountname
|
|
= info->info->account_name;
|
|
|
|
pac_upn.upn_dns_info.ex.sam_name_and_sid.objectsid
|
|
= &info->sids[0];
|
|
|
|
ndr_err = ndr_push_union_blob(upn_data, mem_ctx, &pac_upn,
|
|
PAC_TYPE_UPN_DNS_INFO,
|
|
(ndr_push_flags_fn_t)ndr_push_PAC_INFO);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(1, ("PAC UPN_DNS_INFO (presig) push failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
|
|
ok = data_blob_pad(mem_ctx, upn_data, 8);
|
|
if (!ok) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
static
|
|
NTSTATUS samba_get_pac_attrs_blob(TALLOC_CTX *mem_ctx,
|
|
uint64_t pac_attributes,
|
|
DATA_BLOB *pac_attrs_data)
|
|
{
|
|
union PAC_INFO pac_attrs;
|
|
enum ndr_err_code ndr_err;
|
|
NTSTATUS nt_status;
|
|
|
|
ZERO_STRUCT(pac_attrs);
|
|
|
|
*pac_attrs_data = data_blob_null;
|
|
|
|
/* Set the length of the flags in bits. */
|
|
pac_attrs.attributes_info.flags_length = 2;
|
|
pac_attrs.attributes_info.flags = pac_attributes;
|
|
|
|
ndr_err = ndr_push_union_blob(pac_attrs_data, mem_ctx, &pac_attrs,
|
|
PAC_TYPE_ATTRIBUTES_INFO,
|
|
(ndr_push_flags_fn_t)ndr_push_PAC_INFO);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(1, ("PAC ATTRIBUTES_INFO (presig) push failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
static
|
|
NTSTATUS samba_get_cred_info_ndr_blob(TALLOC_CTX *mem_ctx,
|
|
const struct ldb_message *msg,
|
|
DATA_BLOB *cred_blob)
|
|
{
|
|
enum ndr_err_code ndr_err;
|
|
NTSTATUS nt_status;
|
|
struct samr_Password *lm_hash = NULL;
|
|
struct samr_Password *nt_hash = NULL;
|
|
struct PAC_CREDENTIAL_NTLM_SECPKG ntlm_secpkg = {
|
|
.version = 0,
|
|
};
|
|
DATA_BLOB ntlm_blob = data_blob_null;
|
|
struct PAC_CREDENTIAL_SUPPLEMENTAL_SECPKG secpkgs[1] = {{
|
|
.credential_size = 0,
|
|
}};
|
|
struct PAC_CREDENTIAL_DATA cred_data = {
|
|
.credential_count = 0,
|
|
};
|
|
struct PAC_CREDENTIAL_DATA_NDR cred_ndr;
|
|
|
|
ZERO_STRUCT(cred_ndr);
|
|
|
|
*cred_blob = data_blob_null;
|
|
|
|
lm_hash = samdb_result_hash(mem_ctx, msg, "dBCSPwd");
|
|
if (lm_hash != NULL) {
|
|
bool zero = all_zero(lm_hash->hash, 16);
|
|
if (zero) {
|
|
lm_hash = NULL;
|
|
}
|
|
}
|
|
if (lm_hash != NULL) {
|
|
DEBUG(5, ("Passing LM password hash through credentials set\n"));
|
|
ntlm_secpkg.flags |= PAC_CREDENTIAL_NTLM_HAS_LM_HASH;
|
|
ntlm_secpkg.lm_password = *lm_hash;
|
|
ZERO_STRUCTP(lm_hash);
|
|
TALLOC_FREE(lm_hash);
|
|
}
|
|
|
|
nt_hash = samdb_result_hash(mem_ctx, msg, "unicodePwd");
|
|
if (nt_hash != NULL) {
|
|
bool zero = all_zero(nt_hash->hash, 16);
|
|
if (zero) {
|
|
nt_hash = NULL;
|
|
}
|
|
}
|
|
if (nt_hash != NULL) {
|
|
DEBUG(5, ("Passing LM password hash through credentials set\n"));
|
|
ntlm_secpkg.flags |= PAC_CREDENTIAL_NTLM_HAS_NT_HASH;
|
|
ntlm_secpkg.nt_password = *nt_hash;
|
|
ZERO_STRUCTP(nt_hash);
|
|
TALLOC_FREE(nt_hash);
|
|
}
|
|
|
|
if (ntlm_secpkg.flags == 0) {
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
#ifdef DEBUG_PASSWORD
|
|
if (DEBUGLVL(11)) {
|
|
NDR_PRINT_DEBUG(PAC_CREDENTIAL_NTLM_SECPKG, &ntlm_secpkg);
|
|
}
|
|
#endif
|
|
|
|
ndr_err = ndr_push_struct_blob(&ntlm_blob, mem_ctx, &ntlm_secpkg,
|
|
(ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_NTLM_SECPKG);
|
|
ZERO_STRUCT(ntlm_secpkg);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(1, ("PAC_CREDENTIAL_NTLM_SECPKG (presig) push failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
|
|
DEBUG(10, ("NTLM credential BLOB (len %zu) for user\n",
|
|
ntlm_blob.length));
|
|
dump_data_pw("PAC_CREDENTIAL_NTLM_SECPKG",
|
|
ntlm_blob.data, ntlm_blob.length);
|
|
|
|
secpkgs[0].package_name.string = discard_const_p(char, "NTLM");
|
|
secpkgs[0].credential_size = ntlm_blob.length;
|
|
secpkgs[0].credential = ntlm_blob.data;
|
|
|
|
cred_data.credential_count = ARRAY_SIZE(secpkgs);
|
|
cred_data.credentials = secpkgs;
|
|
|
|
#ifdef DEBUG_PASSWORD
|
|
if (DEBUGLVL(11)) {
|
|
NDR_PRINT_DEBUG(PAC_CREDENTIAL_DATA, &cred_data);
|
|
}
|
|
#endif
|
|
|
|
cred_ndr.ctr.data = &cred_data;
|
|
|
|
#ifdef DEBUG_PASSWORD
|
|
if (DEBUGLVL(11)) {
|
|
NDR_PRINT_DEBUG(PAC_CREDENTIAL_DATA_NDR, &cred_ndr);
|
|
}
|
|
#endif
|
|
|
|
ndr_err = ndr_push_struct_blob(cred_blob, mem_ctx, &cred_ndr,
|
|
(ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_DATA_NDR);
|
|
data_blob_clear(&ntlm_blob);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(1, ("PAC_CREDENTIAL_DATA_NDR (presig) push failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
|
|
DEBUG(10, ("Created credential BLOB (len %zu) for user\n",
|
|
cred_blob->length));
|
|
dump_data_pw("PAC_CREDENTIAL_DATA_NDR",
|
|
cred_blob->data, cred_blob->length);
|
|
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
#ifdef SAMBA4_USES_HEIMDAL
|
|
krb5_error_code samba_kdc_encrypt_pac_credentials(krb5_context context,
|
|
const krb5_keyblock *pkreplykey,
|
|
const DATA_BLOB *cred_ndr_blob,
|
|
TALLOC_CTX *mem_ctx,
|
|
DATA_BLOB *cred_info_blob)
|
|
{
|
|
krb5_crypto cred_crypto;
|
|
krb5_enctype cred_enctype;
|
|
krb5_data cred_ndr_crypt;
|
|
struct PAC_CREDENTIAL_INFO pac_cred_info = { .version = 0, };
|
|
krb5_error_code ret;
|
|
const char *krb5err;
|
|
enum ndr_err_code ndr_err;
|
|
NTSTATUS nt_status;
|
|
|
|
*cred_info_blob = data_blob_null;
|
|
|
|
ret = krb5_crypto_init(context, pkreplykey, ETYPE_NULL,
|
|
&cred_crypto);
|
|
if (ret != 0) {
|
|
krb5err = krb5_get_error_message(context, ret);
|
|
DEBUG(1, ("Failed initializing cred data crypto: %s\n", krb5err));
|
|
krb5_free_error_message(context, krb5err);
|
|
return ret;
|
|
}
|
|
|
|
ret = krb5_crypto_getenctype(context, cred_crypto, &cred_enctype);
|
|
if (ret != 0) {
|
|
DEBUG(1, ("Failed getting crypto type for key\n"));
|
|
krb5_crypto_destroy(context, cred_crypto);
|
|
return ret;
|
|
}
|
|
|
|
DEBUG(10, ("Plain cred_ndr_blob (len %zu)\n",
|
|
cred_ndr_blob->length));
|
|
dump_data_pw("PAC_CREDENTIAL_DATA_NDR",
|
|
cred_ndr_blob->data, cred_ndr_blob->length);
|
|
|
|
ret = krb5_encrypt(context, cred_crypto,
|
|
KRB5_KU_OTHER_ENCRYPTED,
|
|
cred_ndr_blob->data, cred_ndr_blob->length,
|
|
&cred_ndr_crypt);
|
|
krb5_crypto_destroy(context, cred_crypto);
|
|
if (ret != 0) {
|
|
krb5err = krb5_get_error_message(context, ret);
|
|
DEBUG(1, ("Failed crypt of cred data: %s\n", krb5err));
|
|
krb5_free_error_message(context, krb5err);
|
|
return ret;
|
|
}
|
|
|
|
pac_cred_info.encryption_type = cred_enctype;
|
|
pac_cred_info.encrypted_data.length = cred_ndr_crypt.length;
|
|
pac_cred_info.encrypted_data.data = (uint8_t *)cred_ndr_crypt.data;
|
|
|
|
if (DEBUGLVL(10)) {
|
|
NDR_PRINT_DEBUG(PAC_CREDENTIAL_INFO, &pac_cred_info);
|
|
}
|
|
|
|
ndr_err = ndr_push_struct_blob(cred_info_blob, mem_ctx, &pac_cred_info,
|
|
(ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_INFO);
|
|
krb5_data_free(&cred_ndr_crypt);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(1, ("PAC_CREDENTIAL_INFO (presig) push failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return KRB5KDC_ERR_SVC_UNAVAILABLE;
|
|
}
|
|
|
|
DEBUG(10, ("Encrypted credential BLOB (len %zu) with alg %d\n",
|
|
cred_info_blob->length, (int)pac_cred_info.encryption_type));
|
|
dump_data_pw("PAC_CREDENTIAL_INFO",
|
|
cred_info_blob->data, cred_info_blob->length);
|
|
|
|
return 0;
|
|
}
|
|
#else /* SAMBA4_USES_HEIMDAL */
|
|
krb5_error_code samba_kdc_encrypt_pac_credentials(krb5_context context,
|
|
const krb5_keyblock *pkreplykey,
|
|
const DATA_BLOB *cred_ndr_blob,
|
|
TALLOC_CTX *mem_ctx,
|
|
DATA_BLOB *cred_info_blob)
|
|
{
|
|
krb5_key cred_key;
|
|
krb5_enctype cred_enctype;
|
|
struct PAC_CREDENTIAL_INFO pac_cred_info = { .version = 0, };
|
|
krb5_error_code code;
|
|
const char *krb5err;
|
|
enum ndr_err_code ndr_err;
|
|
NTSTATUS nt_status;
|
|
krb5_data cred_ndr_data;
|
|
krb5_enc_data cred_ndr_crypt;
|
|
size_t enc_len = 0;
|
|
|
|
*cred_info_blob = data_blob_null;
|
|
|
|
code = krb5_k_create_key(context,
|
|
pkreplykey,
|
|
&cred_key);
|
|
if (code != 0) {
|
|
krb5err = krb5_get_error_message(context, code);
|
|
DEBUG(1, ("Failed initializing cred data crypto: %s\n", krb5err));
|
|
krb5_free_error_message(context, krb5err);
|
|
return code;
|
|
}
|
|
|
|
cred_enctype = krb5_k_key_enctype(context, cred_key);
|
|
|
|
DEBUG(10, ("Plain cred_ndr_blob (len %zu)\n",
|
|
cred_ndr_blob->length));
|
|
dump_data_pw("PAC_CREDENTIAL_DATA_NDR",
|
|
cred_ndr_blob->data, cred_ndr_blob->length);
|
|
|
|
pac_cred_info.encryption_type = cred_enctype;
|
|
|
|
cred_ndr_data.magic = 0;
|
|
cred_ndr_data.data = (char *)cred_ndr_blob->data;
|
|
cred_ndr_data.length = cred_ndr_blob->length;
|
|
|
|
code = krb5_c_encrypt_length(context,
|
|
cred_enctype,
|
|
cred_ndr_data.length,
|
|
&enc_len);
|
|
if (code != 0) {
|
|
krb5err = krb5_get_error_message(context, code);
|
|
DEBUG(1, ("Failed initializing cred data crypto: %s\n", krb5err));
|
|
krb5_free_error_message(context, krb5err);
|
|
return code;
|
|
}
|
|
|
|
pac_cred_info.encrypted_data = data_blob_talloc_zero(mem_ctx, enc_len);
|
|
if (pac_cred_info.encrypted_data.data == NULL) {
|
|
DBG_ERR("Out of memory\n");
|
|
return ENOMEM;
|
|
}
|
|
|
|
cred_ndr_crypt.ciphertext.length = enc_len;
|
|
cred_ndr_crypt.ciphertext.data = (char *)pac_cred_info.encrypted_data.data;
|
|
|
|
code = krb5_k_encrypt(context,
|
|
cred_key,
|
|
KRB5_KU_OTHER_ENCRYPTED,
|
|
NULL,
|
|
&cred_ndr_data,
|
|
&cred_ndr_crypt);
|
|
krb5_k_free_key(context, cred_key);
|
|
if (code != 0) {
|
|
krb5err = krb5_get_error_message(context, code);
|
|
DEBUG(1, ("Failed crypt of cred data: %s\n", krb5err));
|
|
krb5_free_error_message(context, krb5err);
|
|
return code;
|
|
}
|
|
|
|
if (DEBUGLVL(10)) {
|
|
NDR_PRINT_DEBUG(PAC_CREDENTIAL_INFO, &pac_cred_info);
|
|
}
|
|
|
|
ndr_err = ndr_push_struct_blob(cred_info_blob, mem_ctx, &pac_cred_info,
|
|
(ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_INFO);
|
|
TALLOC_FREE(pac_cred_info.encrypted_data.data);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(1, ("PAC_CREDENTIAL_INFO (presig) push failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return KRB5KDC_ERR_SVC_UNAVAILABLE;
|
|
}
|
|
|
|
DEBUG(10, ("Encrypted credential BLOB (len %zu) with alg %d\n",
|
|
cred_info_blob->length, (int)pac_cred_info.encryption_type));
|
|
dump_data_pw("PAC_CREDENTIAL_INFO",
|
|
cred_info_blob->data, cred_info_blob->length);
|
|
|
|
return 0;
|
|
}
|
|
#endif /* SAMBA4_USES_HEIMDAL */
|
|
|
|
|
|
/**
|
|
* @brief Create a PAC with the given blobs (logon, credentials, upn and
|
|
* delegation).
|
|
*
|
|
* @param[in] context The KRB5 context to use.
|
|
*
|
|
* @param[in] logon_blob Fill the logon info PAC buffer with the given blob,
|
|
* use NULL to ignore it.
|
|
*
|
|
* @param[in] cred_blob Fill the credentials info PAC buffer with the given
|
|
* blob, use NULL to ignore it.
|
|
*
|
|
* @param[in] upn_blob Fill the UPN info PAC buffer with the given blob, use
|
|
* NULL to ignore it.
|
|
*
|
|
* @param[in] deleg_blob Fill the delegation info PAC buffer with the given
|
|
* blob, use NULL to ignore it.
|
|
*
|
|
* @param[in] pac The pac buffer to fill. This should be allocated with
|
|
* krb5_pac_init() already.
|
|
*
|
|
* @returns 0 on success or a corresponding KRB5 error.
|
|
*/
|
|
krb5_error_code samba_make_krb5_pac(krb5_context context,
|
|
const DATA_BLOB *logon_blob,
|
|
const DATA_BLOB *cred_blob,
|
|
const DATA_BLOB *upn_blob,
|
|
const DATA_BLOB *pac_attrs_blob,
|
|
const DATA_BLOB *requester_sid_blob,
|
|
const DATA_BLOB *deleg_blob,
|
|
krb5_pac pac)
|
|
{
|
|
krb5_data logon_data;
|
|
krb5_data cred_data;
|
|
krb5_data upn_data;
|
|
krb5_data pac_attrs_data;
|
|
krb5_data requester_sid_data;
|
|
krb5_data deleg_data;
|
|
krb5_error_code ret;
|
|
#ifdef SAMBA4_USES_HEIMDAL
|
|
char null_byte = '\0';
|
|
krb5_data null_data = {
|
|
.length = 1,
|
|
.data = &null_byte,
|
|
};
|
|
#endif
|
|
|
|
/* The user account may be set not to want the PAC */
|
|
if (logon_blob == NULL) {
|
|
return 0;
|
|
}
|
|
|
|
ret = smb_krb5_copy_data_contents(&logon_data,
|
|
logon_blob->data,
|
|
logon_blob->length);
|
|
if (ret != 0) {
|
|
return ret;
|
|
}
|
|
|
|
ZERO_STRUCT(cred_data);
|
|
if (cred_blob != NULL) {
|
|
ret = smb_krb5_copy_data_contents(&cred_data,
|
|
cred_blob->data,
|
|
cred_blob->length);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &logon_data);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
ZERO_STRUCT(upn_data);
|
|
if (upn_blob != NULL) {
|
|
ret = smb_krb5_copy_data_contents(&upn_data,
|
|
upn_blob->data,
|
|
upn_blob->length);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &logon_data);
|
|
smb_krb5_free_data_contents(context, &cred_data);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
ZERO_STRUCT(pac_attrs_data);
|
|
if (pac_attrs_blob != NULL) {
|
|
ret = smb_krb5_copy_data_contents(&pac_attrs_data,
|
|
pac_attrs_blob->data,
|
|
pac_attrs_blob->length);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &logon_data);
|
|
smb_krb5_free_data_contents(context, &cred_data);
|
|
smb_krb5_free_data_contents(context, &upn_data);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
ZERO_STRUCT(requester_sid_data);
|
|
if (requester_sid_blob != NULL) {
|
|
ret = smb_krb5_copy_data_contents(&requester_sid_data,
|
|
requester_sid_blob->data,
|
|
requester_sid_blob->length);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &logon_data);
|
|
smb_krb5_free_data_contents(context, &cred_data);
|
|
smb_krb5_free_data_contents(context, &upn_data);
|
|
smb_krb5_free_data_contents(context, &pac_attrs_data);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
ZERO_STRUCT(deleg_data);
|
|
if (deleg_blob != NULL) {
|
|
ret = smb_krb5_copy_data_contents(&deleg_data,
|
|
deleg_blob->data,
|
|
deleg_blob->length);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &logon_data);
|
|
smb_krb5_free_data_contents(context, &cred_data);
|
|
smb_krb5_free_data_contents(context, &upn_data);
|
|
smb_krb5_free_data_contents(context, &pac_attrs_data);
|
|
smb_krb5_free_data_contents(context, &requester_sid_data);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
ret = krb5_pac_add_buffer(context, pac, PAC_TYPE_LOGON_INFO, &logon_data);
|
|
smb_krb5_free_data_contents(context, &logon_data);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &cred_data);
|
|
smb_krb5_free_data_contents(context, &upn_data);
|
|
smb_krb5_free_data_contents(context, &pac_attrs_data);
|
|
smb_krb5_free_data_contents(context, &requester_sid_data);
|
|
smb_krb5_free_data_contents(context, &deleg_data);
|
|
return ret;
|
|
}
|
|
|
|
if (cred_blob != NULL) {
|
|
ret = krb5_pac_add_buffer(context, pac,
|
|
PAC_TYPE_CREDENTIAL_INFO,
|
|
&cred_data);
|
|
smb_krb5_free_data_contents(context, &cred_data);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &upn_data);
|
|
smb_krb5_free_data_contents(context, &pac_attrs_data);
|
|
smb_krb5_free_data_contents(context, &requester_sid_data);
|
|
smb_krb5_free_data_contents(context, &deleg_data);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
#ifdef SAMBA4_USES_HEIMDAL
|
|
/*
|
|
* null_data will be filled by the generic KDC code in the caller
|
|
* here we just add it in order to have it before
|
|
* PAC_TYPE_UPN_DNS_INFO
|
|
*
|
|
* Not needed with MIT Kerberos - asn
|
|
*/
|
|
ret = krb5_pac_add_buffer(context, pac,
|
|
PAC_TYPE_LOGON_NAME,
|
|
&null_data);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &upn_data);
|
|
smb_krb5_free_data_contents(context, &pac_attrs_data);
|
|
smb_krb5_free_data_contents(context, &requester_sid_data);
|
|
smb_krb5_free_data_contents(context, &deleg_data);
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
if (upn_blob != NULL) {
|
|
ret = krb5_pac_add_buffer(context, pac,
|
|
PAC_TYPE_UPN_DNS_INFO,
|
|
&upn_data);
|
|
smb_krb5_free_data_contents(context, &upn_data);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &pac_attrs_data);
|
|
smb_krb5_free_data_contents(context, &requester_sid_data);
|
|
smb_krb5_free_data_contents(context, &deleg_data);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
if (pac_attrs_blob != NULL) {
|
|
ret = krb5_pac_add_buffer(context, pac,
|
|
PAC_TYPE_ATTRIBUTES_INFO,
|
|
&pac_attrs_data);
|
|
smb_krb5_free_data_contents(context, &pac_attrs_data);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &requester_sid_data);
|
|
smb_krb5_free_data_contents(context, &deleg_data);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
if (requester_sid_blob != NULL) {
|
|
ret = krb5_pac_add_buffer(context, pac,
|
|
PAC_TYPE_REQUESTER_SID,
|
|
&requester_sid_data);
|
|
smb_krb5_free_data_contents(context, &requester_sid_data);
|
|
if (ret != 0) {
|
|
smb_krb5_free_data_contents(context, &deleg_data);
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
if (deleg_blob != NULL) {
|
|
ret = krb5_pac_add_buffer(context, pac,
|
|
PAC_TYPE_CONSTRAINED_DELEGATION,
|
|
&deleg_data);
|
|
smb_krb5_free_data_contents(context, &deleg_data);
|
|
if (ret != 0) {
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
bool samba_princ_needs_pac(struct samba_kdc_entry *skdc_entry)
|
|
{
|
|
|
|
uint32_t userAccountControl;
|
|
|
|
/* The service account may be set not to want the PAC */
|
|
userAccountControl = ldb_msg_find_attr_as_uint(skdc_entry->msg, "userAccountControl", 0);
|
|
if (userAccountControl & UF_NO_AUTH_DATA_REQUIRED) {
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
int samba_client_requested_pac(krb5_context context,
|
|
const krb5_pac *pac,
|
|
TALLOC_CTX *mem_ctx,
|
|
bool *requested_pac)
|
|
{
|
|
enum ndr_err_code ndr_err;
|
|
krb5_data k5pac_attrs_in;
|
|
DATA_BLOB pac_attrs_in;
|
|
union PAC_INFO pac_attrs;
|
|
int ret;
|
|
|
|
*requested_pac = true;
|
|
|
|
ret = krb5_pac_get_buffer(context, *pac, PAC_TYPE_ATTRIBUTES_INFO,
|
|
&k5pac_attrs_in);
|
|
if (ret != 0) {
|
|
return ret == ENOENT ? 0 : ret;
|
|
}
|
|
|
|
pac_attrs_in = data_blob_const(k5pac_attrs_in.data,
|
|
k5pac_attrs_in.length);
|
|
|
|
ndr_err = ndr_pull_union_blob(&pac_attrs_in, mem_ctx, &pac_attrs,
|
|
PAC_TYPE_ATTRIBUTES_INFO,
|
|
(ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
|
|
smb_krb5_free_data_contents(context, &k5pac_attrs_in);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(0,("can't parse the PAC ATTRIBUTES_INFO: %s\n", nt_errstr(nt_status)));
|
|
return EINVAL;
|
|
}
|
|
|
|
if (pac_attrs.attributes_info.flags & (PAC_ATTRIBUTE_FLAG_PAC_WAS_GIVEN_IMPLICITLY
|
|
| PAC_ATTRIBUTE_FLAG_PAC_WAS_REQUESTED)) {
|
|
*requested_pac = true;
|
|
} else {
|
|
*requested_pac = false;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* Was the krbtgt in this DB (ie, should we check the incoming signature) and was it an RODC */
|
|
int samba_krbtgt_is_in_db(struct samba_kdc_entry *p,
|
|
bool *is_in_db,
|
|
bool *is_untrusted)
|
|
{
|
|
NTSTATUS status;
|
|
int rodc_krbtgt_number, trust_direction;
|
|
uint32_t rid;
|
|
|
|
TALLOC_CTX *mem_ctx = talloc_new(NULL);
|
|
if (!mem_ctx) {
|
|
return ENOMEM;
|
|
}
|
|
|
|
trust_direction = ldb_msg_find_attr_as_int(p->msg, "trustDirection", 0);
|
|
|
|
if (trust_direction != 0) {
|
|
/* Domain trust - we cannot check the sig, but we trust it for a correct PAC
|
|
|
|
This is exactly where we should flag for SID
|
|
validation when we do inter-foreest trusts
|
|
*/
|
|
talloc_free(mem_ctx);
|
|
*is_untrusted = false;
|
|
*is_in_db = false;
|
|
return 0;
|
|
}
|
|
|
|
/* The lack of password controls etc applies to krbtgt by
|
|
* virtue of being that particular RID */
|
|
status = dom_sid_split_rid(NULL, samdb_result_dom_sid(mem_ctx, p->msg, "objectSid"), NULL, &rid);
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
talloc_free(mem_ctx);
|
|
return EINVAL;
|
|
}
|
|
|
|
rodc_krbtgt_number = ldb_msg_find_attr_as_int(p->msg, "msDS-SecondaryKrbTgtNumber", -1);
|
|
|
|
if (p->kdc_db_ctx->my_krbtgt_number == 0) {
|
|
if (rid == DOMAIN_RID_KRBTGT) {
|
|
*is_untrusted = false;
|
|
*is_in_db = true;
|
|
talloc_free(mem_ctx);
|
|
return 0;
|
|
} else if (rodc_krbtgt_number != -1) {
|
|
*is_in_db = true;
|
|
*is_untrusted = true;
|
|
talloc_free(mem_ctx);
|
|
return 0;
|
|
}
|
|
} else if ((rid != DOMAIN_RID_KRBTGT) && (rodc_krbtgt_number == p->kdc_db_ctx->my_krbtgt_number)) {
|
|
talloc_free(mem_ctx);
|
|
*is_untrusted = false;
|
|
*is_in_db = true;
|
|
return 0;
|
|
} else if (rid == DOMAIN_RID_KRBTGT) {
|
|
/* krbtgt viewed from an RODC */
|
|
talloc_free(mem_ctx);
|
|
*is_untrusted = false;
|
|
*is_in_db = false;
|
|
return 0;
|
|
}
|
|
|
|
/* Another RODC */
|
|
talloc_free(mem_ctx);
|
|
*is_untrusted = true;
|
|
*is_in_db = false;
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* Look up the user's info in the database and create a auth_user_info_dc
|
|
* structure. If the resulting structure is not talloc_free()d, it will be
|
|
* reused on future calls to this function.
|
|
*/
|
|
NTSTATUS samba_kdc_get_user_info_from_db(struct samba_kdc_entry *skdc_entry,
|
|
struct ldb_message *msg,
|
|
struct auth_user_info_dc **user_info_dc)
|
|
{
|
|
if (skdc_entry->user_info_dc == NULL) {
|
|
NTSTATUS nt_status;
|
|
struct loadparm_context *lp_ctx = skdc_entry->kdc_db_ctx->lp_ctx;
|
|
|
|
nt_status = authsam_make_user_info_dc(skdc_entry,
|
|
skdc_entry->kdc_db_ctx->samdb,
|
|
lpcfg_netbios_name(lp_ctx),
|
|
lpcfg_sam_name(lp_ctx),
|
|
lpcfg_sam_dnsname(lp_ctx),
|
|
skdc_entry->realm_dn,
|
|
msg,
|
|
data_blob_null,
|
|
data_blob_null,
|
|
&skdc_entry->user_info_dc);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
return nt_status;
|
|
}
|
|
}
|
|
|
|
*user_info_dc = skdc_entry->user_info_dc;
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
NTSTATUS samba_kdc_get_pac_blobs(TALLOC_CTX *mem_ctx,
|
|
struct samba_kdc_entry *p,
|
|
DATA_BLOB **_logon_info_blob,
|
|
DATA_BLOB **_cred_ndr_blob,
|
|
DATA_BLOB **_upn_info_blob,
|
|
DATA_BLOB **_pac_attrs_blob,
|
|
uint64_t pac_attributes,
|
|
DATA_BLOB **_requester_sid_blob)
|
|
{
|
|
struct auth_user_info_dc *user_info_dc = NULL;
|
|
DATA_BLOB *logon_blob = NULL;
|
|
DATA_BLOB *cred_blob = NULL;
|
|
DATA_BLOB *upn_blob = NULL;
|
|
DATA_BLOB *pac_attrs_blob = NULL;
|
|
DATA_BLOB *requester_sid_blob = NULL;
|
|
NTSTATUS nt_status;
|
|
|
|
*_logon_info_blob = NULL;
|
|
if (_cred_ndr_blob != NULL) {
|
|
*_cred_ndr_blob = NULL;
|
|
}
|
|
*_upn_info_blob = NULL;
|
|
if (_pac_attrs_blob != NULL) {
|
|
*_pac_attrs_blob = NULL;
|
|
}
|
|
if (_requester_sid_blob != NULL) {
|
|
*_requester_sid_blob = NULL;
|
|
}
|
|
|
|
logon_blob = talloc_zero(mem_ctx, DATA_BLOB);
|
|
if (logon_blob == NULL) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
if (_cred_ndr_blob != NULL) {
|
|
cred_blob = talloc_zero(mem_ctx, DATA_BLOB);
|
|
if (cred_blob == NULL) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
}
|
|
|
|
upn_blob = talloc_zero(mem_ctx, DATA_BLOB);
|
|
if (upn_blob == NULL) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
if (_pac_attrs_blob != NULL) {
|
|
pac_attrs_blob = talloc_zero(mem_ctx, DATA_BLOB);
|
|
if (pac_attrs_blob == NULL) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
}
|
|
|
|
if (_requester_sid_blob != NULL) {
|
|
requester_sid_blob = talloc_zero(mem_ctx, DATA_BLOB);
|
|
if (requester_sid_blob == NULL) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
}
|
|
|
|
nt_status = samba_kdc_get_user_info_from_db(p,
|
|
p->msg,
|
|
&user_info_dc);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(0, ("Getting user info for PAC failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
|
|
nt_status = samba_get_logon_info_pac_blob(logon_blob,
|
|
user_info_dc,
|
|
logon_blob,
|
|
requester_sid_blob);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(0, ("Building PAC LOGON INFO failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
|
|
if (cred_blob != NULL) {
|
|
nt_status = samba_get_cred_info_ndr_blob(cred_blob,
|
|
p->msg,
|
|
cred_blob);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(0, ("Building PAC CRED INFO failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
}
|
|
|
|
nt_status = samba_get_upn_info_pac_blob(upn_blob,
|
|
user_info_dc,
|
|
upn_blob);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(0, ("Building PAC UPN INFO failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
|
|
if (pac_attrs_blob != NULL) {
|
|
nt_status = samba_get_pac_attrs_blob(pac_attrs_blob,
|
|
pac_attributes,
|
|
pac_attrs_blob);
|
|
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(0, ("Building PAC ATTRIBUTES failed: %s\n",
|
|
nt_errstr(nt_status)));
|
|
return nt_status;
|
|
}
|
|
}
|
|
|
|
*_logon_info_blob = logon_blob;
|
|
if (_cred_ndr_blob != NULL) {
|
|
*_cred_ndr_blob = cred_blob;
|
|
}
|
|
*_upn_info_blob = upn_blob;
|
|
if (_pac_attrs_blob != NULL) {
|
|
*_pac_attrs_blob = pac_attrs_blob;
|
|
}
|
|
if (_requester_sid_blob != NULL) {
|
|
*_requester_sid_blob = requester_sid_blob;
|
|
}
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx,
|
|
krb5_context context,
|
|
struct ldb_context *samdb,
|
|
const krb5_pac pac, DATA_BLOB *pac_blob,
|
|
struct PAC_SIGNATURE_DATA *pac_srv_sig,
|
|
struct PAC_SIGNATURE_DATA *pac_kdc_sig)
|
|
{
|
|
struct auth_user_info_dc *user_info_dc;
|
|
krb5_error_code ret;
|
|
NTSTATUS nt_status;
|
|
|
|
ret = kerberos_pac_to_user_info_dc(mem_ctx, pac,
|
|
context, &user_info_dc, pac_srv_sig, pac_kdc_sig);
|
|
if (ret) {
|
|
return NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
/*
|
|
* We need to expand group memberships within our local domain,
|
|
* as the token might be generated by a trusted domain.
|
|
*/
|
|
nt_status = authsam_update_user_info_dc(mem_ctx,
|
|
samdb,
|
|
user_info_dc);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
return nt_status;
|
|
}
|
|
|
|
nt_status = samba_get_logon_info_pac_blob(mem_ctx,
|
|
user_info_dc, pac_blob, NULL);
|
|
|
|
return nt_status;
|
|
}
|
|
|
|
NTSTATUS samba_kdc_update_delegation_info_blob(TALLOC_CTX *mem_ctx,
|
|
krb5_context context,
|
|
const krb5_pac pac,
|
|
const krb5_principal server_principal,
|
|
const krb5_principal proxy_principal,
|
|
DATA_BLOB *new_blob)
|
|
{
|
|
krb5_data old_data;
|
|
DATA_BLOB old_blob;
|
|
krb5_error_code ret;
|
|
NTSTATUS nt_status;
|
|
enum ndr_err_code ndr_err;
|
|
union PAC_INFO info;
|
|
struct PAC_CONSTRAINED_DELEGATION _d;
|
|
struct PAC_CONSTRAINED_DELEGATION *d = NULL;
|
|
char *server = NULL;
|
|
char *proxy = NULL;
|
|
uint32_t i;
|
|
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
|
|
|
|
if (tmp_ctx == NULL) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_CONSTRAINED_DELEGATION, &old_data);
|
|
if (ret == ENOENT) {
|
|
ZERO_STRUCT(old_data);
|
|
} else if (ret) {
|
|
talloc_free(tmp_ctx);
|
|
return NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
old_blob.length = old_data.length;
|
|
old_blob.data = (uint8_t *)old_data.data;
|
|
|
|
ZERO_STRUCT(info);
|
|
if (old_blob.length > 0) {
|
|
ndr_err = ndr_pull_union_blob(&old_blob, mem_ctx,
|
|
&info, PAC_TYPE_CONSTRAINED_DELEGATION,
|
|
(ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
smb_krb5_free_data_contents(context, &old_data);
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(0,("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status)));
|
|
talloc_free(tmp_ctx);
|
|
return nt_status;
|
|
}
|
|
} else {
|
|
ZERO_STRUCT(_d);
|
|
info.constrained_delegation.info = &_d;
|
|
}
|
|
smb_krb5_free_data_contents(context, &old_data);
|
|
|
|
ret = krb5_unparse_name_flags(context, server_principal,
|
|
KRB5_PRINCIPAL_UNPARSE_NO_REALM, &server);
|
|
if (ret) {
|
|
talloc_free(tmp_ctx);
|
|
return NT_STATUS_INTERNAL_ERROR;
|
|
}
|
|
|
|
ret = krb5_unparse_name(context, proxy_principal, &proxy);
|
|
if (ret) {
|
|
SAFE_FREE(server);
|
|
talloc_free(tmp_ctx);
|
|
return NT_STATUS_INTERNAL_ERROR;
|
|
}
|
|
|
|
d = info.constrained_delegation.info;
|
|
i = d->num_transited_services;
|
|
d->proxy_target.string = server;
|
|
d->transited_services = talloc_realloc(mem_ctx, d->transited_services,
|
|
struct lsa_String, i + 1);
|
|
d->transited_services[i].string = proxy;
|
|
d->num_transited_services = i + 1;
|
|
|
|
ndr_err = ndr_push_union_blob(new_blob, mem_ctx,
|
|
&info, PAC_TYPE_CONSTRAINED_DELEGATION,
|
|
(ndr_push_flags_fn_t)ndr_push_PAC_INFO);
|
|
SAFE_FREE(server);
|
|
SAFE_FREE(proxy);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
smb_krb5_free_data_contents(context, &old_data);
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(0,("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status)));
|
|
talloc_free(tmp_ctx);
|
|
return nt_status;
|
|
}
|
|
|
|
talloc_free(tmp_ctx);
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
/* function to map policy errors */
|
|
krb5_error_code samba_kdc_map_policy_err(NTSTATUS nt_status)
|
|
{
|
|
krb5_error_code ret;
|
|
|
|
if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_MUST_CHANGE))
|
|
ret = KRB5KDC_ERR_KEY_EXP;
|
|
else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_EXPIRED))
|
|
ret = KRB5KDC_ERR_KEY_EXP;
|
|
else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_EXPIRED))
|
|
ret = KRB5KDC_ERR_CLIENT_REVOKED;
|
|
else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_DISABLED))
|
|
ret = KRB5KDC_ERR_CLIENT_REVOKED;
|
|
else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_LOGON_HOURS))
|
|
ret = KRB5KDC_ERR_CLIENT_REVOKED;
|
|
else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_LOCKED_OUT))
|
|
ret = KRB5KDC_ERR_CLIENT_REVOKED;
|
|
else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_WORKSTATION))
|
|
ret = KRB5KDC_ERR_POLICY;
|
|
else
|
|
ret = KRB5KDC_ERR_POLICY;
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Given a kdc entry, consult the account_ok routine in auth/auth_sam.c
|
|
* for consistency */
|
|
NTSTATUS samba_kdc_check_client_access(struct samba_kdc_entry *kdc_entry,
|
|
const char *client_name,
|
|
const char *workstation,
|
|
bool password_change)
|
|
{
|
|
TALLOC_CTX *tmp_ctx;
|
|
NTSTATUS nt_status;
|
|
|
|
tmp_ctx = talloc_named(NULL, 0, "samba_kdc_check_client_access");
|
|
if (!tmp_ctx) {
|
|
return NT_STATUS_NO_MEMORY;
|
|
}
|
|
|
|
/* we allow all kinds of trusts here */
|
|
nt_status = authsam_account_ok(tmp_ctx,
|
|
kdc_entry->kdc_db_ctx->samdb,
|
|
MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
|
|
MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
|
|
kdc_entry->realm_dn, kdc_entry->msg,
|
|
workstation, client_name,
|
|
true, password_change);
|
|
|
|
kdc_entry->reject_status = nt_status;
|
|
talloc_free(tmp_ctx);
|
|
return nt_status;
|
|
}
|
|
|
|
static krb5_error_code samba_get_requester_sid(TALLOC_CTX *mem_ctx,
|
|
krb5_pac pac,
|
|
krb5_context context,
|
|
struct dom_sid *sid)
|
|
{
|
|
NTSTATUS nt_status;
|
|
enum ndr_err_code ndr_err;
|
|
krb5_error_code ret;
|
|
|
|
DATA_BLOB pac_requester_sid_in;
|
|
krb5_data k5pac_requester_sid_in;
|
|
|
|
union PAC_INFO info;
|
|
|
|
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
|
|
if (tmp_ctx == NULL) {
|
|
return ENOMEM;
|
|
}
|
|
|
|
ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_REQUESTER_SID,
|
|
&k5pac_requester_sid_in);
|
|
if (ret != 0) {
|
|
talloc_free(tmp_ctx);
|
|
return ret;
|
|
}
|
|
|
|
pac_requester_sid_in = data_blob_const(k5pac_requester_sid_in.data,
|
|
k5pac_requester_sid_in.length);
|
|
|
|
ndr_err = ndr_pull_union_blob(&pac_requester_sid_in, tmp_ctx, &info,
|
|
PAC_TYPE_REQUESTER_SID,
|
|
(ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
|
|
smb_krb5_free_data_contents(context, &k5pac_requester_sid_in);
|
|
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
|
nt_status = ndr_map_error2ntstatus(ndr_err);
|
|
DEBUG(0,("can't parse the PAC REQUESTER_SID: %s\n", nt_errstr(nt_status)));
|
|
talloc_free(tmp_ctx);
|
|
return EINVAL;
|
|
}
|
|
|
|
*sid = info.requester_sid.sid;
|
|
|
|
talloc_free(tmp_ctx);
|
|
return 0;
|
|
}
|
|
|
|
/* Does a parse and SID check, but no crypto. */
|
|
krb5_error_code samba_kdc_validate_pac_blob(
|
|
krb5_context context,
|
|
struct samba_kdc_entry *client_skdc_entry,
|
|
const krb5_pac pac)
|
|
{
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
struct auth_user_info_dc *pac_user_info = NULL;
|
|
struct dom_sid *client_sid = NULL;
|
|
struct dom_sid pac_sid;
|
|
krb5_error_code code;
|
|
bool ok;
|
|
|
|
/*
|
|
* First, try to get the SID from the requester SID buffer in the PAC.
|
|
*/
|
|
code = samba_get_requester_sid(frame, pac, context, &pac_sid);
|
|
|
|
if (code == ENOENT) {
|
|
/*
|
|
* If the requester SID buffer isn't present, fall back to the
|
|
* SID in the LOGON_INFO PAC buffer.
|
|
*/
|
|
code = kerberos_pac_to_user_info_dc(frame,
|
|
pac,
|
|
context,
|
|
&pac_user_info,
|
|
NULL,
|
|
NULL);
|
|
if (code != 0) {
|
|
goto out;
|
|
}
|
|
|
|
if (pac_user_info->num_sids == 0) {
|
|
code = EINVAL;
|
|
goto out;
|
|
}
|
|
|
|
pac_sid = pac_user_info->sids[0];
|
|
} else if (code != 0) {
|
|
goto out;
|
|
}
|
|
|
|
client_sid = samdb_result_dom_sid(frame,
|
|
client_skdc_entry->msg,
|
|
"objectSid");
|
|
|
|
ok = dom_sid_equal(&pac_sid, client_sid);
|
|
if (!ok) {
|
|
struct dom_sid_buf buf1;
|
|
struct dom_sid_buf buf2;
|
|
|
|
DBG_ERR("SID mismatch between PAC and looked up client: "
|
|
"PAC[%s] != CLI[%s]\n",
|
|
dom_sid_str_buf(&pac_sid, &buf1),
|
|
dom_sid_str_buf(client_sid, &buf2));
|
|
code = KRB5KDC_ERR_TGT_REVOKED;
|
|
goto out;
|
|
}
|
|
|
|
code = 0;
|
|
out:
|
|
TALLOC_FREE(frame);
|
|
return code;
|
|
}
|
|
|
|
|
|
/*
|
|
* In the RODC case, to confirm that the returned user is permitted to
|
|
* be replicated to the KDC (krbgtgt_xxx user) represented by *rodc
|
|
*/
|
|
WERROR samba_rodc_confirm_user_is_allowed(uint32_t num_object_sids,
|
|
struct dom_sid *object_sids,
|
|
struct samba_kdc_entry *rodc,
|
|
struct samba_kdc_entry *object)
|
|
{
|
|
int ret;
|
|
WERROR werr;
|
|
TALLOC_CTX *frame = talloc_stackframe();
|
|
const char *rodc_attrs[] = { "msDS-KrbTgtLink",
|
|
"msDS-NeverRevealGroup",
|
|
"msDS-RevealOnDemandGroup",
|
|
"userAccountControl",
|
|
"objectSid",
|
|
NULL };
|
|
struct ldb_result *rodc_machine_account = NULL;
|
|
struct ldb_dn *rodc_machine_account_dn = samdb_result_dn(rodc->kdc_db_ctx->samdb,
|
|
frame,
|
|
rodc->msg,
|
|
"msDS-KrbTgtLinkBL",
|
|
NULL);
|
|
const struct dom_sid *rodc_machine_account_sid = NULL;
|
|
|
|
if (rodc_machine_account_dn == NULL) {
|
|
DBG_ERR("krbtgt account %s has no msDS-KrbTgtLinkBL to find RODC machine account for allow/deny list\n",
|
|
ldb_dn_get_linearized(rodc->msg->dn));
|
|
TALLOC_FREE(frame);
|
|
return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
|
|
}
|
|
|
|
/*
|
|
* Follow the link and get the RODC account (the krbtgt
|
|
* account is the krbtgt_XXX account, but the
|
|
* msDS-NeverRevealGroup and msDS-RevealOnDemandGroup is on
|
|
* the RODC$ account)
|
|
*
|
|
* We need DSDB_SEARCH_SHOW_EXTENDED_DN as we get a SID lists
|
|
* out of the extended DNs
|
|
*/
|
|
|
|
ret = dsdb_search_dn(rodc->kdc_db_ctx->samdb,
|
|
frame,
|
|
&rodc_machine_account,
|
|
rodc_machine_account_dn,
|
|
rodc_attrs,
|
|
DSDB_SEARCH_SHOW_EXTENDED_DN);
|
|
if (ret != LDB_SUCCESS) {
|
|
DBG_ERR("Failed to fetch RODC machine account %s pointed to by %s to check allow/deny list: %s\n",
|
|
ldb_dn_get_linearized(rodc_machine_account_dn),
|
|
ldb_dn_get_linearized(rodc->msg->dn),
|
|
ldb_errstring(rodc->kdc_db_ctx->samdb));
|
|
TALLOC_FREE(frame);
|
|
return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
|
|
}
|
|
|
|
if (rodc_machine_account->count != 1) {
|
|
DBG_ERR("Failed to fetch RODC machine account %s pointed to by %s to check allow/deny list: (%d)\n",
|
|
ldb_dn_get_linearized(rodc_machine_account_dn),
|
|
ldb_dn_get_linearized(rodc->msg->dn),
|
|
rodc_machine_account->count);
|
|
TALLOC_FREE(frame);
|
|
return WERR_DS_DRA_BAD_DN;
|
|
}
|
|
|
|
/* if the object SID is equal to the user_sid, allow */
|
|
rodc_machine_account_sid = samdb_result_dom_sid(frame,
|
|
rodc_machine_account->msgs[0],
|
|
"objectSid");
|
|
if (rodc_machine_account_sid == NULL) {
|
|
return WERR_DS_DRA_BAD_DN;
|
|
}
|
|
|
|
werr = samdb_confirm_rodc_allowed_to_repl_to_sid_list(rodc->kdc_db_ctx->samdb,
|
|
rodc_machine_account_sid,
|
|
rodc_machine_account->msgs[0],
|
|
object->msg,
|
|
num_object_sids,
|
|
object_sids);
|
|
|
|
TALLOC_FREE(frame);
|
|
return werr;
|
|
}
|
|
|
|
/**
|
|
* @brief Update a PAC
|
|
*
|
|
* @param mem_ctx A talloc memory context
|
|
*
|
|
* @param context A krb5 context
|
|
*
|
|
* @param samdb An open samdb connection.
|
|
*
|
|
* @param flags Bitwise OR'ed flags
|
|
*
|
|
* @param client The client samba kdc entry.
|
|
|
|
* @param server_principal The server principal
|
|
|
|
* @param server The server samba kdc entry.
|
|
|
|
* @param krbtgt The krbtgt samba kdc entry.
|
|
*
|
|
* @param delegated_proxy_principal The delegated proxy principal used for
|
|
* updating the constrained delegation PAC
|
|
* buffer.
|
|
|
|
* @param old_pac The old PAC
|
|
|
|
* @param new_pac The new already allocated PAC
|
|
|
|
* @return A Kerberos error code. If no PAC should be returned, the code will be
|
|
* ENODATA!
|
|
*/
|
|
krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx,
|
|
krb5_context context,
|
|
struct ldb_context *samdb,
|
|
uint32_t flags,
|
|
struct samba_kdc_entry *client,
|
|
const krb5_principal server_principal,
|
|
struct samba_kdc_entry *server,
|
|
struct samba_kdc_entry *krbtgt,
|
|
const krb5_principal delegated_proxy_principal,
|
|
const krb5_pac old_pac,
|
|
krb5_pac new_pac)
|
|
{
|
|
krb5_error_code code = EINVAL;
|
|
NTSTATUS nt_status;
|
|
DATA_BLOB *pac_blob = NULL;
|
|
DATA_BLOB *upn_blob = NULL;
|
|
DATA_BLOB *deleg_blob = NULL;
|
|
DATA_BLOB *requester_sid_blob = NULL;
|
|
bool is_untrusted = flags & SAMBA_KDC_FLAG_KRBTGT_IS_UNTRUSTED;
|
|
int is_tgs = false;
|
|
size_t num_types = 0;
|
|
uint32_t *types = NULL;
|
|
/*
|
|
* FIXME: Do we really still need forced_next_type? With MIT Kerberos
|
|
* the PAC buffers do not get ordered and it works just fine. We are
|
|
* not aware of any issues in this regard. This might be just ancient
|
|
* code.
|
|
*/
|
|
uint32_t forced_next_type = 0;
|
|
size_t i = 0;
|
|
ssize_t logon_info_idx = -1;
|
|
ssize_t delegation_idx = -1;
|
|
ssize_t logon_name_idx = -1;
|
|
ssize_t upn_dns_info_idx = -1;
|
|
ssize_t srv_checksum_idx = -1;
|
|
ssize_t kdc_checksum_idx = -1;
|
|
ssize_t tkt_checksum_idx = -1;
|
|
ssize_t attrs_info_idx = -1;
|
|
ssize_t requester_sid_idx = -1;
|
|
|
|
if (client != NULL) {
|
|
/*
|
|
* Check the objectSID of the client and pac data are the same.
|
|
* Does a parse and SID check, but no crypto.
|
|
*/
|
|
code = samba_kdc_validate_pac_blob(context,
|
|
client,
|
|
old_pac);
|
|
if (code != 0) {
|
|
goto done;
|
|
}
|
|
}
|
|
|
|
if (delegated_proxy_principal != NULL) {
|
|
deleg_blob = talloc_zero(mem_ctx, DATA_BLOB);
|
|
if (deleg_blob == NULL) {
|
|
code = ENOMEM;
|
|
goto done;
|
|
}
|
|
|
|
nt_status = samba_kdc_update_delegation_info_blob(
|
|
mem_ctx,
|
|
context,
|
|
old_pac,
|
|
server_principal,
|
|
delegated_proxy_principal,
|
|
deleg_blob);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DBG_ERR("update delegation info blob failed: %s\n",
|
|
nt_errstr(nt_status));
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
}
|
|
|
|
if (is_untrusted) {
|
|
struct auth_user_info_dc *user_info_dc = NULL;
|
|
WERROR werr;
|
|
|
|
if (client == NULL) {
|
|
code = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
|
|
goto done;
|
|
}
|
|
|
|
nt_status = samba_kdc_get_pac_blobs(mem_ctx,
|
|
client,
|
|
&pac_blob,
|
|
NULL,
|
|
&upn_blob,
|
|
NULL,
|
|
PAC_ATTRIBUTE_FLAG_PAC_WAS_GIVEN_IMPLICITLY,
|
|
&requester_sid_blob);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DBG_ERR("samba_kdc_get_pac_blobs failed: %s\n",
|
|
nt_errstr(nt_status));
|
|
code = KRB5KDC_ERR_TGT_REVOKED;
|
|
goto done;
|
|
}
|
|
|
|
nt_status = samba_kdc_get_user_info_from_db(client,
|
|
client->msg,
|
|
&user_info_dc);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DBG_ERR("samba_kdc_get_user_info_from_db failed: %s\n",
|
|
nt_errstr(nt_status));
|
|
code = KRB5KDC_ERR_TGT_REVOKED;
|
|
goto done;
|
|
}
|
|
|
|
/*
|
|
* Check if the SID list in the user_info_dc intersects
|
|
* correctly with the RODC allow/deny lists.
|
|
*/
|
|
werr = samba_rodc_confirm_user_is_allowed(user_info_dc->num_sids,
|
|
user_info_dc->sids,
|
|
krbtgt,
|
|
client);
|
|
TALLOC_FREE(user_info_dc);
|
|
if (!W_ERROR_IS_OK(werr)) {
|
|
code = KRB5KDC_ERR_TGT_REVOKED;
|
|
if (W_ERROR_EQUAL(werr,
|
|
WERR_DOMAIN_CONTROLLER_NOT_FOUND)) {
|
|
code = KRB5KDC_ERR_POLICY;
|
|
}
|
|
goto done;
|
|
}
|
|
} else {
|
|
pac_blob = talloc_zero(mem_ctx, DATA_BLOB);
|
|
if (pac_blob == NULL) {
|
|
code = ENOMEM;
|
|
goto done;
|
|
}
|
|
|
|
nt_status = samba_kdc_update_pac_blob(mem_ctx,
|
|
context,
|
|
samdb,
|
|
old_pac,
|
|
pac_blob,
|
|
NULL,
|
|
NULL);
|
|
if (!NT_STATUS_IS_OK(nt_status)) {
|
|
DBG_ERR("samba_kdc_update_pac_blob failed: %s\n",
|
|
nt_errstr(nt_status));
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
}
|
|
|
|
/* Check the types of the given PAC */
|
|
code = krb5_pac_get_types(context, old_pac, &num_types, &types);
|
|
if (code != 0) {
|
|
DBG_ERR("krb5_pac_get_types failed\n");
|
|
goto done;
|
|
}
|
|
|
|
for (i = 0; i < num_types; i++) {
|
|
switch (types[i]) {
|
|
case PAC_TYPE_LOGON_INFO:
|
|
if (logon_info_idx != -1) {
|
|
DBG_WARNING("logon info type[%u] twice [%zd] "
|
|
"and [%zu]: \n",
|
|
types[i],
|
|
logon_info_idx,
|
|
i);
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
logon_info_idx = i;
|
|
break;
|
|
case PAC_TYPE_CONSTRAINED_DELEGATION:
|
|
if (delegation_idx != -1) {
|
|
DBG_WARNING("constrained delegation type[%u] "
|
|
"twice [%zd] and [%zu]: \n",
|
|
types[i],
|
|
delegation_idx,
|
|
i);
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
delegation_idx = i;
|
|
break;
|
|
case PAC_TYPE_LOGON_NAME:
|
|
if (logon_name_idx != -1) {
|
|
DBG_WARNING("logon name type[%u] twice [%zd] "
|
|
"and [%zu]: \n",
|
|
types[i],
|
|
logon_name_idx,
|
|
i);
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
logon_name_idx = i;
|
|
break;
|
|
case PAC_TYPE_UPN_DNS_INFO:
|
|
if (upn_dns_info_idx != -1) {
|
|
DBG_WARNING("upn dns info type[%u] twice [%zd] "
|
|
"and [%zu]: \n",
|
|
types[i],
|
|
upn_dns_info_idx,
|
|
i);
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
upn_dns_info_idx = i;
|
|
break;
|
|
case PAC_TYPE_SRV_CHECKSUM:
|
|
if (srv_checksum_idx != -1) {
|
|
DBG_WARNING("srv checksum type[%u] twice [%zd] "
|
|
"and [%zu]: \n",
|
|
types[i],
|
|
srv_checksum_idx,
|
|
i);
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
srv_checksum_idx = i;
|
|
break;
|
|
case PAC_TYPE_KDC_CHECKSUM:
|
|
if (kdc_checksum_idx != -1) {
|
|
DBG_WARNING("kdc checksum type[%u] twice [%zd] "
|
|
"and [%zu]: \n",
|
|
types[i],
|
|
kdc_checksum_idx,
|
|
i);
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
kdc_checksum_idx = i;
|
|
break;
|
|
case PAC_TYPE_TICKET_CHECKSUM:
|
|
if (tkt_checksum_idx != -1) {
|
|
DBG_WARNING("ticket checksum type[%u] twice "
|
|
"[%zd] and [%zu]: \n",
|
|
types[i],
|
|
tkt_checksum_idx,
|
|
i);
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
tkt_checksum_idx = i;
|
|
break;
|
|
case PAC_TYPE_ATTRIBUTES_INFO:
|
|
if (attrs_info_idx != -1) {
|
|
DBG_WARNING("attributes info type[%u] twice "
|
|
"[%zd] and [%zu]: \n",
|
|
types[i],
|
|
attrs_info_idx,
|
|
i);
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
attrs_info_idx = i;
|
|
break;
|
|
case PAC_TYPE_REQUESTER_SID:
|
|
if (requester_sid_idx != -1) {
|
|
DBG_WARNING("requester sid type[%u] twice"
|
|
"[%zd] and [%zu]: \n",
|
|
types[i],
|
|
requester_sid_idx,
|
|
i);
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
requester_sid_idx = i;
|
|
break;
|
|
default:
|
|
continue;
|
|
}
|
|
}
|
|
|
|
if (logon_info_idx == -1) {
|
|
DBG_WARNING("PAC_TYPE_LOGON_INFO missing\n");
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
if (logon_name_idx == -1) {
|
|
DBG_WARNING("PAC_TYPE_LOGON_NAME missing\n");
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
if (srv_checksum_idx == -1) {
|
|
DBG_WARNING("PAC_TYPE_SRV_CHECKSUM missing\n");
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
if (kdc_checksum_idx == -1) {
|
|
DBG_WARNING("PAC_TYPE_KDC_CHECKSUM missing\n");
|
|
code = EINVAL;
|
|
goto done;
|
|
}
|
|
if (!(flags & SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION) &&
|
|
requester_sid_idx == -1) {
|
|
DBG_WARNING("PAC_TYPE_REQUESTER_SID missing\n");
|
|
code = KRB5KDC_ERR_TGT_REVOKED;
|
|
goto done;
|
|
}
|
|
|
|
/*
|
|
* The server account may be set not to want the PAC.
|
|
*
|
|
* While this is wasteful if the above cacluations were done
|
|
* and now thrown away, this is cleaner as we do any ticket
|
|
* signature checking etc always.
|
|
*
|
|
* UF_NO_AUTH_DATA_REQUIRED is the rare case and most of the
|
|
* time (eg not accepting a ticket from the RODC) we do not
|
|
* need to re-generate anything anyway.
|
|
*/
|
|
if (!samba_princ_needs_pac(server)) {
|
|
code = ENODATA;
|
|
goto done;
|
|
}
|
|
|
|
is_tgs = smb_krb5_principal_is_tgs(context, server_principal);
|
|
if (is_tgs == -1) {
|
|
code = ENOMEM;
|
|
goto done;
|
|
}
|
|
|
|
if (!is_untrusted && !is_tgs) {
|
|
/*
|
|
* The client may have requested no PAC when obtaining the
|
|
* TGT.
|
|
*/
|
|
bool requested_pac = false;
|
|
|
|
code = samba_client_requested_pac(context,
|
|
&old_pac,
|
|
mem_ctx,
|
|
&requested_pac);
|
|
if (code != 0 || !requested_pac) {
|
|
if (!requested_pac) {
|
|
code = ENODATA;
|
|
}
|
|
goto done;
|
|
}
|
|
}
|
|
|
|
#define MAX_PAC_BUFFERS 128 /* Avoid infinite loops */
|
|
|
|
for (i = 0; i < MAX_PAC_BUFFERS;) {
|
|
const uint8_t zero_byte = 0;
|
|
krb5_data type_data;
|
|
DATA_BLOB type_blob = data_blob_null;
|
|
uint32_t type;
|
|
|
|
if (forced_next_type != 0) {
|
|
/*
|
|
* We need to inject possible missing types
|
|
*/
|
|
type = forced_next_type;
|
|
forced_next_type = 0;
|
|
} else if (i < num_types) {
|
|
type = types[i];
|
|
i++;
|
|
} else {
|
|
break;
|
|
}
|
|
|
|
switch (type) {
|
|
case PAC_TYPE_LOGON_INFO:
|
|
type_blob = *pac_blob;
|
|
|
|
if (delegation_idx == -1 && deleg_blob != NULL) {
|
|
/* inject CONSTRAINED_DELEGATION behind */
|
|
forced_next_type =
|
|
PAC_TYPE_CONSTRAINED_DELEGATION;
|
|
}
|
|
break;
|
|
case PAC_TYPE_CONSTRAINED_DELEGATION:
|
|
/*
|
|
* This is generated in the main KDC code
|
|
*/
|
|
if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) {
|
|
continue;
|
|
}
|
|
|
|
if (deleg_blob != NULL) {
|
|
type_blob = *deleg_blob;
|
|
}
|
|
break;
|
|
case PAC_TYPE_CREDENTIAL_INFO:
|
|
/*
|
|
* Note that we copy the credential blob,
|
|
* as it's only usable with the PKINIT based
|
|
* AS-REP reply key, it's only available on the
|
|
* host which did the AS-REQ/AS-REP exchange.
|
|
*
|
|
* This matches Windows 2008R2...
|
|
*/
|
|
break;
|
|
case PAC_TYPE_LOGON_NAME:
|
|
/*
|
|
* This is generated in the main KDC code
|
|
*/
|
|
if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) {
|
|
continue;
|
|
}
|
|
|
|
type_blob = data_blob_const(&zero_byte, 1);
|
|
|
|
if (upn_dns_info_idx == -1 && upn_blob != NULL) {
|
|
/* inject UPN_DNS_INFO behind */
|
|
forced_next_type = PAC_TYPE_UPN_DNS_INFO;
|
|
}
|
|
break;
|
|
case PAC_TYPE_UPN_DNS_INFO:
|
|
/*
|
|
* Replace in the RODC case, otherwise
|
|
* upn_blob is NULL and we just copy.
|
|
*/
|
|
if (upn_blob != NULL) {
|
|
type_blob = *upn_blob;
|
|
}
|
|
break;
|
|
case PAC_TYPE_SRV_CHECKSUM:
|
|
/*
|
|
* This is generated in the main KDC code
|
|
*/
|
|
if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) {
|
|
continue;
|
|
}
|
|
|
|
type_blob = data_blob_const(&zero_byte, 1);
|
|
|
|
if (requester_sid_idx == -1 && requester_sid_blob != NULL) {
|
|
/* inject REQUESTER_SID behind */
|
|
forced_next_type = PAC_TYPE_REQUESTER_SID;
|
|
}
|
|
break;
|
|
case PAC_TYPE_KDC_CHECKSUM:
|
|
/*
|
|
* This is generated in the main KDC code
|
|
*/
|
|
if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) {
|
|
continue;
|
|
}
|
|
|
|
type_blob = data_blob_const(&zero_byte, 1);
|
|
|
|
break;
|
|
case PAC_TYPE_TICKET_CHECKSUM:
|
|
/*
|
|
* This is generated in the main KDC code
|
|
*/
|
|
if (flags & SAMBA_KDC_FLAG_SKIP_PAC_BUFFER) {
|
|
continue;
|
|
}
|
|
|
|
type_blob = data_blob_const(&zero_byte, 1);
|
|
|
|
break;
|
|
case PAC_TYPE_ATTRIBUTES_INFO:
|
|
if (!is_untrusted && is_tgs) {
|
|
/* just copy... */
|
|
break;
|
|
}
|
|
|
|
continue;
|
|
case PAC_TYPE_REQUESTER_SID:
|
|
if (!is_tgs) {
|
|
continue;
|
|
}
|
|
|
|
/*
|
|
* Replace in the RODC case, otherwise
|
|
* requester_sid_blob is NULL and we just copy.
|
|
*/
|
|
if (requester_sid_blob != NULL) {
|
|
type_blob = *requester_sid_blob;
|
|
}
|
|
break;
|
|
default:
|
|
/* just copy... */
|
|
break;
|
|
}
|
|
|
|
if (type_blob.length != 0) {
|
|
code = smb_krb5_copy_data_contents(&type_data,
|
|
type_blob.data,
|
|
type_blob.length);
|
|
if (code != 0) {
|
|
goto done;
|
|
}
|
|
} else {
|
|
code = krb5_pac_get_buffer(context,
|
|
old_pac,
|
|
type,
|
|
&type_data);
|
|
if (code != 0) {
|
|
goto done;
|
|
}
|
|
}
|
|
|
|
code = krb5_pac_add_buffer(context,
|
|
new_pac,
|
|
type,
|
|
&type_data);
|
|
smb_krb5_free_data_contents(context, &type_data);
|
|
if (code != 0) {
|
|
goto done;
|
|
}
|
|
}
|
|
|
|
code = 0;
|
|
done:
|
|
TALLOC_FREE(pac_blob);
|
|
TALLOC_FREE(upn_blob);
|
|
TALLOC_FREE(deleg_blob);
|
|
SAFE_FREE(types);
|
|
return code;
|
|
}
|