source: branches/samba-3.3.x/source/libnet/libnet_dssync_keytab.c

Last change on this file was 206, checked in by Herwig Bauernfeind, 16 years ago

Import Samba 3.3 branch at 3.0.0 level (psmedley's port)
File size: 15.1 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Guenther Deschner <gd@samba.org> 2008
5 Copyright (C) Michael Adam 2008
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22#include "libnet/libnet.h"
23#include "librpc/gen_ndr/ndr_drsblobs.h"
24
25#if defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC)
26
27static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
28 struct replUpToDateVectorBlob **pold_utdv)
29{
30 krb5_error_code ret = 0;
31 struct libnet_keytab_context *keytab_ctx;
32 struct libnet_keytab_entry *entry;
33 struct replUpToDateVectorBlob *old_utdv = NULL;
34 char *principal;
35
36 ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
37 if (ret) {
38 return krb5_to_nt_status(ret);
39 }
40
41 keytab_ctx->dns_domain_name = ctx->dns_domain_name;
42 keytab_ctx->clean_old_entries = ctx->clean_old_entries;
43 ctx->private_data = keytab_ctx;
44
45 principal = talloc_asprintf(mem_ctx, "UTDV/%s@%s",
46 ctx->nc_dn, ctx->dns_domain_name);
47 NT_STATUS_HAVE_NO_MEMORY(principal);
48
49 entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
50 mem_ctx);
51 if (entry) {
52 enum ndr_err_code ndr_err;
53 old_utdv = talloc(mem_ctx, struct replUpToDateVectorBlob);
54
55 ndr_err = ndr_pull_struct_blob(&entry->password, old_utdv,
56 old_utdv,
57 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
58 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
59 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
60 ctx->error_message = talloc_asprintf(ctx,
61 "Failed to pull UpToDateVector: %s",
62 nt_errstr(status));
63 return status;
64 }
65
66 if (DEBUGLEVEL >= 10) {
67 NDR_PRINT_DEBUG(replUpToDateVectorBlob, old_utdv);
68 }
69 }
70
71 if (pold_utdv) {
72 *pold_utdv = old_utdv;
73 }
74
75 return NT_STATUS_OK;
76}
77
78static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
79 struct replUpToDateVectorBlob *new_utdv)
80{
81 NTSTATUS status = NT_STATUS_OK;
82 krb5_error_code ret = 0;
83 struct libnet_keytab_context *keytab_ctx =
84 (struct libnet_keytab_context *)ctx->private_data;
85
86 if (new_utdv) {
87 enum ndr_err_code ndr_err;
88 DATA_BLOB blob;
89
90 if (DEBUGLEVEL >= 10) {
91 NDR_PRINT_DEBUG(replUpToDateVectorBlob, new_utdv);
92 }
93
94 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, new_utdv,
95 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
96 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
97 status = ndr_map_error2ntstatus(ndr_err);
98 ctx->error_message = talloc_asprintf(ctx,
99 "Failed to push UpToDateVector: %s",
100 nt_errstr(status));
101 goto done;
102 }
103
104 status = libnet_keytab_add_to_keytab_entries(mem_ctx, keytab_ctx, 0,
105 ctx->nc_dn, "UTDV",
106 ENCTYPE_NULL,
107 blob);
108 if (!NT_STATUS_IS_OK(status)) {
109 goto done;
110 }
111 }
112
113 ret = libnet_keytab_add(keytab_ctx);
114 if (ret) {
115 status = krb5_to_nt_status(ret);
116 ctx->error_message = talloc_asprintf(ctx,
117 "Failed to add entries to keytab %s: %s",
118 keytab_ctx->keytab_name, error_message(ret));
119 goto done;
120 }
121
122 ctx->result_message = talloc_asprintf(ctx,
123 "Vampired %d accounts to keytab %s",
124 keytab_ctx->count,
125 keytab_ctx->keytab_name);
126
127done:
128 TALLOC_FREE(keytab_ctx);
129 return status;
130}
131
132/****************************************************************
133****************************************************************/
134
135static NTSTATUS parse_supplemental_credentials(TALLOC_CTX *mem_ctx,
136 const DATA_BLOB *blob,
137 struct package_PrimaryKerberosCtr3 **pkb3,
138 struct package_PrimaryKerberosCtr4 **pkb4)
139{
140 NTSTATUS status;
141 enum ndr_err_code ndr_err;
142 struct supplementalCredentialsBlob scb;
143 struct supplementalCredentialsPackage *scpk = NULL;
144 DATA_BLOB scpk_blob;
145 struct package_PrimaryKerberosBlob *pkb;
146 bool newer_keys = false;
147 uint32_t j;
148
149 ndr_err = ndr_pull_struct_blob_all(blob, mem_ctx, &scb,
150 (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
151 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
152 status = ndr_map_error2ntstatus(ndr_err);
153 goto done;
154 }
155 if (scb.sub.signature !=
156 SUPPLEMENTAL_CREDENTIALS_SIGNATURE)
157 {
158 if (DEBUGLEVEL >= 10) {
159 NDR_PRINT_DEBUG(supplementalCredentialsBlob, &scb);
160 }
161 status = NT_STATUS_INVALID_PARAMETER;
162 goto done;
163 }
164 for (j=0; j < scb.sub.num_packages; j++) {
165 if (strcmp("Primary:Kerberos-Newer-Keys",
166 scb.sub.packages[j].name) == 0)
167 {
168 scpk = &scb.sub.packages[j];
169 if (!scpk->data || !scpk->data[0]) {
170 scpk = NULL;
171 continue;
172 }
173 newer_keys = true;
174 break;
175 } else if (strcmp("Primary:Kerberos",
176 scb.sub.packages[j].name) == 0)
177 {
178 /*
179 * grab this but don't break here:
180 * there might still be newer-keys ...
181 */
182 scpk = &scb.sub.packages[j];
183 if (!scpk->data || !scpk->data[0]) {
184 scpk = NULL;
185 }
186 }
187 }
188
189 if (!scpk) {
190 /* no data */
191 status = NT_STATUS_OK;
192 goto done;
193 }
194
195 scpk_blob = strhex_to_data_blob(mem_ctx, scpk->data);
196 if (!scpk_blob.data) {
197 status = NT_STATUS_NO_MEMORY;
198 goto done;
199 }
200
201 pkb = TALLOC_ZERO_P(mem_ctx, struct package_PrimaryKerberosBlob);
202 if (!pkb) {
203 status = NT_STATUS_NO_MEMORY;
204 goto done;
205 }
206 ndr_err = ndr_pull_struct_blob(&scpk_blob, mem_ctx, pkb,
207 (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
208 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
209 status = ndr_map_error2ntstatus(ndr_err);
210 goto done;
211 }
212
213 if (!newer_keys && pkb->version != 3) {
214 status = NT_STATUS_INVALID_PARAMETER;
215 goto done;
216 }
217
218 if (newer_keys && pkb->version != 4) {
219 status = NT_STATUS_INVALID_PARAMETER;
220 goto done;
221 }
222
223 if (pkb->version == 4 && pkb4) {
224 *pkb4 = &pkb->ctr.ctr4;
225 } else if (pkb->version == 3 && pkb3) {
226 *pkb3 = &pkb->ctr.ctr3;
227 }
228
229 status = NT_STATUS_OK;
230
231done:
232 return status;
233}
234
235static NTSTATUS parse_object(TALLOC_CTX *mem_ctx,
236 struct libnet_keytab_context *ctx,
237 struct drsuapi_DsReplicaObjectListItemEx *cur)
238{
239 NTSTATUS status = NT_STATUS_OK;
240 uchar nt_passwd[16];
241 DATA_BLOB *blob;
242 int i = 0;
243 struct drsuapi_DsReplicaAttribute *attr;
244 bool got_pwd = false;
245
246 struct package_PrimaryKerberosCtr3 *pkb3 = NULL;
247 struct package_PrimaryKerberosCtr4 *pkb4 = NULL;
248
249 char *object_dn = NULL;
250 char *upn = NULL;
251 char **spn = NULL;
252 uint32_t num_spns = 0;
253 char *name = NULL;
254 uint32_t kvno = 0;
255 uint32_t uacc = 0;
256 uint32_t sam_type = 0;
257
258 uint32_t pwd_history_len = 0;
259 uint8_t *pwd_history = NULL;
260
261 ZERO_STRUCT(nt_passwd);
262
263 object_dn = talloc_strdup(mem_ctx, cur->object.identifier->dn);
264 if (!object_dn) {
265 return NT_STATUS_NO_MEMORY;
266 }
267
268 DEBUG(3, ("parsing object '%s'\n", object_dn));
269
270 for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
271
272 attr = &cur->object.attribute_ctr.attributes[i];
273
274 if (attr->attid == DRSUAPI_ATTRIBUTE_servicePrincipalName) {
275 uint32_t count;
276 num_spns = attr->value_ctr.num_values;
277 spn = TALLOC_ARRAY(mem_ctx, char *, num_spns);
278 for (count = 0; count < num_spns; count++) {
279 blob = attr->value_ctr.values[count].blob;
280 pull_string_talloc(spn, NULL, 0,
281 &spn[count],
282 blob->data, blob->length,
283 STR_UNICODE);
284 }
285 }
286
287 if (attr->value_ctr.num_values != 1) {
288 continue;
289 }
290
291 if (!attr->value_ctr.values[0].blob) {
292 continue;
293 }
294
295 blob = attr->value_ctr.values[0].blob;
296
297 switch (attr->attid) {
298 case DRSUAPI_ATTRIBUTE_unicodePwd:
299
300 if (blob->length != 16) {
301 break;
302 }
303
304 memcpy(&nt_passwd, blob->data, 16);
305 got_pwd = true;
306
307 /* pick the kvno from the meta_data version,
308 * thanks, metze, for explaining this */
309
310 if (!cur->meta_data_ctr) {
311 break;
312 }
313 if (cur->meta_data_ctr->count !=
314 cur->object.attribute_ctr.num_attributes) {
315 break;
316 }
317 kvno = cur->meta_data_ctr->meta_data[i].version;
318 break;
319 case DRSUAPI_ATTRIBUTE_ntPwdHistory:
320 pwd_history_len = blob->length / 16;
321 pwd_history = blob->data;
322 break;
323 case DRSUAPI_ATTRIBUTE_userPrincipalName:
324 pull_string_talloc(mem_ctx, NULL, 0, &upn,
325 blob->data, blob->length,
326 STR_UNICODE);
327 break;
328 case DRSUAPI_ATTRIBUTE_sAMAccountName:
329 pull_string_talloc(mem_ctx, NULL, 0, &name,
330 blob->data, blob->length,
331 STR_UNICODE);
332 break;
333 case DRSUAPI_ATTRIBUTE_sAMAccountType:
334 sam_type = IVAL(blob->data, 0);
335 break;
336 case DRSUAPI_ATTRIBUTE_userAccountControl:
337 uacc = IVAL(blob->data, 0);
338 break;
339 case DRSUAPI_ATTRIBUTE_supplementalCredentials:
340 status = parse_supplemental_credentials(mem_ctx,
341 blob,
342 &pkb3,
343 &pkb4);
344 if (!NT_STATUS_IS_OK(status)) {
345 DEBUG(2, ("parsing of supplemental "
346 "credentials failed: %s\n",
347 nt_errstr(status)));
348 }
349 break;
350 default:
351 break;
352 }
353 }
354
355 if (!got_pwd) {
356 DEBUG(10, ("no password (unicodePwd) found - skipping.\n"));
357 return NT_STATUS_OK;
358 }
359
360 if (name) {
361 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx, 0, object_dn,
362 "SAMACCOUNTNAME",
363 ENCTYPE_NULL,
364 data_blob_talloc(mem_ctx, name,
365 strlen(name) + 1));
366 if (!NT_STATUS_IS_OK(status)) {
367 return status;
368 }
369 } else {
370 /* look into keytab ... */
371 struct libnet_keytab_entry *entry = NULL;
372 char *principal = NULL;
373
374 DEBUG(10, ("looking for SAMACCOUNTNAME/%s@%s in keytayb...\n",
375 object_dn, ctx->dns_domain_name));
376
377 principal = talloc_asprintf(mem_ctx, "%s/%s@%s",
378 "SAMACCOUNTNAME",
379 object_dn,
380 ctx->dns_domain_name);
381 if (!principal) {
382 DEBUG(1, ("talloc failed\n"));
383 return NT_STATUS_NO_MEMORY;
384 }
385 entry = libnet_keytab_search(ctx, principal, 0, ENCTYPE_NULL,
386 mem_ctx);
387 if (entry) {
388 name = (char *)TALLOC_MEMDUP(mem_ctx,
389 entry->password.data,
390 entry->password.length);
391 if (!name) {
392 DEBUG(1, ("talloc failed!"));
393 return NT_STATUS_NO_MEMORY;
394 } else {
395 DEBUG(10, ("found name %s\n", name));
396 }
397 TALLOC_FREE(entry);
398 } else {
399 DEBUG(10, ("entry not found\n"));
400 }
401 TALLOC_FREE(principal);
402 }
403
404 if (!name) {
405 DEBUG(10, ("no name (sAMAccountName) found - skipping.\n"));
406 return NT_STATUS_OK;
407 }
408
409 DEBUG(1,("#%02d: %s:%d, ", ctx->count, name, kvno));
410 DEBUGADD(1,("sAMAccountType: 0x%08x, userAccountControl: 0x%08x",
411 sam_type, uacc));
412 if (upn) {
413 DEBUGADD(1,(", upn: %s", upn));
414 }
415 if (num_spns > 0) {
416 DEBUGADD(1, (", spns: ["));
417 for (i = 0; i < num_spns; i++) {
418 DEBUGADD(1, ("%s%s", spn[i],
419 (i+1 == num_spns)?"]":", "));
420 }
421 }
422 DEBUGADD(1,("\n"));
423
424 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx, kvno, name, NULL,
425 ENCTYPE_ARCFOUR_HMAC,
426 data_blob_talloc(mem_ctx, nt_passwd, 16));
427
428 if (!NT_STATUS_IS_OK(status)) {
429 return status;
430 }
431
432 /* add kerberos keys (if any) */
433
434 if (pkb4) {
435 for (i=0; i < pkb4->num_keys; i++) {
436 if (!pkb4->keys[i].value) {
437 continue;
438 }
439 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx, kvno,
440 name,
441 NULL,
442 pkb4->keys[i].keytype,
443 *pkb4->keys[i].value);
444 if (!NT_STATUS_IS_OK(status)) {
445 return status;
446 }
447 }
448 for (i=0; i < pkb4->num_old_keys; i++) {
449 if (!pkb4->old_keys[i].value) {
450 continue;
451 }
452 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx, kvno - 1,
453 name,
454 NULL,
455 pkb4->old_keys[i].keytype,
456 *pkb4->old_keys[i].value);
457 if (!NT_STATUS_IS_OK(status)) {
458 return status;
459 }
460 }
461 for (i=0; i < pkb4->num_older_keys; i++) {
462 if (!pkb4->older_keys[i].value) {
463 continue;
464 }
465 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx, kvno - 2,
466 name,
467 NULL,
468 pkb4->older_keys[i].keytype,
469 *pkb4->older_keys[i].value);
470 if (!NT_STATUS_IS_OK(status)) {
471 return status;
472 }
473 }
474 }
475
476 if (pkb3) {
477 for (i=0; i < pkb3->num_keys; i++) {
478 if (!pkb3->keys[i].value) {
479 continue;
480 }
481 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx, kvno, name,
482 NULL,
483 pkb3->keys[i].keytype,
484 *pkb3->keys[i].value);
485 if (!NT_STATUS_IS_OK(status)) {
486 return status;
487 }
488 }
489 for (i=0; i < pkb3->num_old_keys; i++) {
490 if (!pkb3->old_keys[i].value) {
491 continue;
492 }
493 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx, kvno - 1,
494 name,
495 NULL,
496 pkb3->old_keys[i].keytype,
497 *pkb3->old_keys[i].value);
498 if (!NT_STATUS_IS_OK(status)) {
499 return status;
500 }
501 }
502 }
503
504 if ((kvno < 0) && (kvno < pwd_history_len)) {
505 return status;
506 }
507
508 /* add password history */
509
510 /* skip first entry */
511 if (got_pwd) {
512 kvno--;
513 i = 1;
514 } else {
515 i = 0;
516 }
517
518 for (; i<pwd_history_len; i++) {
519 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx, kvno--, name, NULL,
520 ENCTYPE_ARCFOUR_HMAC,
521 data_blob_talloc(mem_ctx, &pwd_history[i*16], 16));
522 if (!NT_STATUS_IS_OK(status)) {
523 break;
524 }
525 }
526
527 return status;
528}
529
530static bool dn_is_in_object_list(struct dssync_context *ctx,
531 const char *dn)
532{
533 uint32_t count;
534
535 if (ctx->object_count == 0) {
536 return true;
537 }
538
539 for (count = 0; count < ctx->object_count; count++) {
540 if (strequal(ctx->object_dns[count], dn)) {
541 return true;
542 }
543 }
544
545 return false;
546}
547
548/****************************************************************
549****************************************************************/
550
551static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
552 TALLOC_CTX *mem_ctx,
553 struct drsuapi_DsReplicaObjectListItemEx *cur,
554 struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
555{
556 NTSTATUS status = NT_STATUS_OK;
557 struct libnet_keytab_context *keytab_ctx =
558 (struct libnet_keytab_context *)ctx->private_data;
559
560 for (; cur; cur = cur->next_object) {
561 /*
562 * When not in single object replication mode,
563 * the object_dn list is used as a positive write filter.
564 */
565 if (!ctx->single_object_replication &&
566 !dn_is_in_object_list(ctx, cur->object.identifier->dn))
567 {
568 continue;
569 }
570
571 status = parse_object(mem_ctx, keytab_ctx, cur);
572 if (!NT_STATUS_IS_OK(status)) {
573 goto out;
574 }
575 }
576
577 out:
578 return status;
579}
580
581#else
582
583static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
584 struct replUpToDateVectorBlob **pold_utdv)
585{
586 return NT_STATUS_NOT_SUPPORTED;
587}
588
589static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
590 struct replUpToDateVectorBlob *new_utdv)
591{
592 return NT_STATUS_NOT_SUPPORTED;
593}
594
595static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
596 TALLOC_CTX *mem_ctx,
597 struct drsuapi_DsReplicaObjectListItemEx *cur,
598 struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
599{
600 return NT_STATUS_NOT_SUPPORTED;
601}
602#endif /* defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC) */
603
604const struct dssync_ops libnet_dssync_keytab_ops = {
605 .startup = keytab_startup,
606 .process_objects = keytab_process_objects,
607 .finish = keytab_finish,
608};
Note: See TracBrowser for help on using the repository browser.