1
0
mirror of https://github.com/samba-team/samba.git synced 2025-06-23 11:17:06 +03:00
Andrew Bartlett c82c9fe7bb r12599: This new LDB module (and associated changes) allows Samba4 to operate
using pre-calculated passwords for all kerberos key types.
(Previously we could only use these for the NT# type).

The module handles all of the hash/string2key tasks for all parts of
Samba, which was previously in the rpc_server/samr/samr_password.c
code.  We also update the msDS-KeyVersionNumber, and the password
history.  This new module can be called at provision time, which
ensures we start with a database that is consistent in this respect.

By ensuring that the krb5key attribute is the only one we need to
retrieve, this also simplifies the run-time KDC logic.  (Each value of
the multi-valued attribute is encoded as a 'Key' in ASN.1, using the
definition from Heimdal's HDB.  This simplfies the KDC code.).

It is hoped that this will speed up the KDC enough that it can again
operate under valgrind.
(This used to be commit e9022743210b59f19f370d772e532e0f08bfebd9)
2007-10-10 13:49:01 -05:00

267 lines
6.8 KiB
C

/*
ldb database library
Copyright (C) Simo Sorce 2004
** NOTE! The following LGPL license applies to the ldb
** library. This does NOT imply that all of Samba is released
** under the LGPL
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
/*
* Name: ldb
*
* Component: ldb modules core
*
* Description: core modules routines
*
* Author: Simo Sorce
*/
#include "includes.h"
#include "ldb/include/ldb.h"
#include "ldb/include/ldb_errors.h"
#include "ldb/include/ldb_private.h"
#include "dlinklist.h"
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#ifdef HAVE_DLOPEN_DISABLED
#include <dlfcn.h>
#endif
#define LDB_MODULE_PREFIX "modules:"
#define LDB_MODULE_PREFIX_LEN 8
static char *talloc_strdup_no_spaces(struct ldb_context *ldb, const char *string)
{
int i, len;
char *trimmed;
trimmed = talloc_strdup(ldb, string);
if (!trimmed) {
ldb_debug(ldb, LDB_DEBUG_FATAL, "Out of Memory in talloc_strdup_trim_spaces()\n");
return NULL;
}
len = strlen(trimmed);
for (i = 0; trimmed[i] != '\0'; i++) {
switch (trimmed[i]) {
case ' ':
case '\t':
case '\n':
memmove(&trimmed[i], &trimmed[i + 1], len -i -1);
break;
}
}
return trimmed;
}
/* modules are called in inverse order on the stack.
Lets place them as an admin would think the right order is.
Modules order is imprtant */
static char **ldb_modules_list_from_string(struct ldb_context *ldb, const char *string)
{
char **modules = NULL;
char *modstr, *p;
int i;
/* spaces not admitted */
modstr = talloc_strdup_no_spaces(ldb, string);
if ( ! modstr) {
return NULL;
}
modules = talloc_realloc(ldb, modules, char *, 2);
if ( ! modules ) {
ldb_debug(ldb, LDB_DEBUG_FATAL, "Out of Memory in ldb_modules_list_from_string()\n");
talloc_free(modstr);
return NULL;
}
talloc_steal(modules, modstr);
i = 0;
while ((p = strrchr(modstr, ',')) != NULL) {
*p = '\0';
p++;
modules[i] = p;
i++;
modules = talloc_realloc(ldb, modules, char *, i + 2);
if ( ! modules ) {
ldb_debug(ldb, LDB_DEBUG_FATAL, "Out of Memory in ldb_modules_list_from_string()\n");
return NULL;
}
}
modules[i] = modstr;
modules[i + 1] = NULL;
return modules;
}
int ldb_load_modules(struct ldb_context *ldb, const char *options[])
{
char **modules = NULL;
int i;
struct {
const char *name;
ldb_module_init_t init;
} well_known_modules[] = {
{ "schema", schema_module_init },
{ "operational", operational_module_init },
{ "rdn_name", rdn_name_module_init },
#ifdef _SAMBA_BUILD_
{ "objectguid", objectguid_module_init },
{ "samldb", samldb_module_init },
{ "samba3sam", ldb_samba3sam_module_init },
{ "proxy", proxy_module_init },
{ "rootdse", rootdse_module_init },
{ "password_hash", password_hash_module_init },
#endif
{ NULL, NULL }
};
/* find out which modules we are requested to activate */
/* check if we have a custom module list passd as ldb option */
if (options) {
for (i = 0; options[i] != NULL; i++) {
if (strncmp(options[i], LDB_MODULE_PREFIX, LDB_MODULE_PREFIX_LEN) == 0) {
modules = ldb_modules_list_from_string(ldb, &options[i][LDB_MODULE_PREFIX_LEN]);
}
}
}
/* if not overloaded by options and the backend is not ldap try to load the modules list form ldb */
if ((modules == NULL) && (strcmp("ldap", ldb->modules->ops->name) != 0)) {
int ret;
const char * const attrs[] = { "@LIST" , NULL};
struct ldb_result *res = NULL;
struct ldb_dn *mods;
mods = ldb_dn_explode(ldb, "@MODULES");
if (mods == NULL) {
return -1;
}
ret = ldb_search(ldb, mods, LDB_SCOPE_BASE, "", attrs, &res);
talloc_free(mods);
if (ret == LDB_SUCCESS && (res->count == 0 || res->msgs[0]->num_elements == 0)) {
ldb_debug(ldb, LDB_DEBUG_TRACE, "no modules required by the db\n");
} else {
if (ret != LDB_SUCCESS) {
ldb_debug(ldb, LDB_DEBUG_FATAL, "ldb error (%s) occurred searching for modules, bailing out\n", ldb_errstring(ldb));
return -1;
}
if (res->count > 1) {
ldb_debug(ldb, LDB_DEBUG_FATAL, "Too many records found (%d), bailing out\n", res->count);
talloc_free(res);
return -1;
}
modules = ldb_modules_list_from_string(ldb,
(const char *)res->msgs[0]->elements[0].values[0].data);
}
talloc_free(res);
}
if (modules == NULL) {
ldb_debug(ldb, LDB_DEBUG_TRACE, "No modules specified for this database\n");
return 0;
}
for (i = 0; modules[i] != NULL; i++) {
struct ldb_module *current;
int m;
for (m=0;well_known_modules[m].name;m++) {
if (strcmp(modules[i], well_known_modules[m].name) == 0) {
current = well_known_modules[m].init(ldb, options);
if (current == NULL) {
ldb_debug(ldb, LDB_DEBUG_FATAL, "function 'init_module' in %s fails\n", modules[i]);
return -1;
}
DLIST_ADD(ldb->modules, current);
break;
}
}
if (well_known_modules[m].name == NULL) {
ldb_debug(ldb, LDB_DEBUG_WARNING, "WARNING: Module [%s] not found\n",
modules[i]);
}
}
talloc_free(modules);
return 0;
}
/*
by using this we allow ldb modules to only implement the functions they care about,
which makes writing a module simpler, and makes it more likely to keep working
when ldb is extended
*/
#define FIND_OP(module, op) do { \
module = module->next; \
while (module && module->ops->op == NULL) module = module->next; \
if (module == NULL) return -1; \
} while (0)
/*
helper functions to call the next module in chain
*/
int ldb_next_request(struct ldb_module *module, struct ldb_request *request)
{
FIND_OP(module, request);
return module->ops->request(module, request);
}
int ldb_next_start_trans(struct ldb_module *module)
{
FIND_OP(module, start_transaction);
return module->ops->start_transaction(module);
}
int ldb_next_end_trans(struct ldb_module *module)
{
FIND_OP(module, end_transaction);
return module->ops->end_transaction(module);
}
int ldb_next_del_trans(struct ldb_module *module)
{
FIND_OP(module, del_transaction);
return module->ops->del_transaction(module);
}
void ldb_set_errstring(struct ldb_module *module, char *err_string)
{
if (module->ldb->err_string) {
talloc_free(module->ldb->err_string);
}
module->ldb->err_string = talloc_steal(module->ldb, err_string);
}