source: trunk/server/source3/libnet/libnet_samsync_keytab.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 8.1 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 dump the remote SAM using rpc samsync operations
4
5 Copyright (C) Guenther Deschner 2008.
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22#include "smb_krb5.h"
23#include "ads.h"
24#include "libnet/libnet_keytab.h"
25#include "libnet/libnet_samsync.h"
26#include "krb5_env.h"
27
28#if defined(HAVE_ADS)
29
30/****************************************************************
31****************************************************************/
32
33static NTSTATUS keytab_ad_connect(TALLOC_CTX *mem_ctx,
34 const char *domain_name,
35 const char *dc,
36 const char *username,
37 const char *password,
38 struct libnet_keytab_context *ctx)
39{
40 ADS_STATUS ad_status;
41 ADS_STRUCT *ads;
42
43 ads = ads_init(NULL, domain_name, dc);
44 NT_STATUS_HAVE_NO_MEMORY(ads);
45
46 if (getenv(KRB5_ENV_CCNAME) == NULL) {
47 setenv(KRB5_ENV_CCNAME, "MEMORY:libnet_samsync_keytab", 1);
48 }
49
50 ads->auth.user_name = SMB_STRDUP(username);
51 ads->auth.password = SMB_STRDUP(password);
52
53 ad_status = ads_connect_user_creds(ads);
54 if (!ADS_ERR_OK(ad_status)) {
55 return NT_STATUS_UNSUCCESSFUL;
56 }
57
58 ctx->ads = ads;
59
60 ctx->dns_domain_name = talloc_strdup_upper(mem_ctx, ads->config.realm);
61 NT_STATUS_HAVE_NO_MEMORY(ctx->dns_domain_name);
62
63 return NT_STATUS_OK;
64}
65
66/****************************************************************
67****************************************************************/
68
69static NTSTATUS fetch_sam_entry_keytab(TALLOC_CTX *mem_ctx,
70 enum netr_SamDatabaseID database_id,
71 uint32_t rid,
72 struct netr_DELTA_USER *r,
73 struct libnet_keytab_context *ctx)
74{
75 NTSTATUS status;
76 uint32_t kvno = 0;
77 DATA_BLOB blob;
78
79 if (memcmp(r->ntpassword.hash, ctx->zero_buf, 16) == 0) {
80 return NT_STATUS_OK;
81 }
82
83 kvno = ads_get_kvno(ctx->ads, r->account_name.string);
84 blob = data_blob_const(r->ntpassword.hash, 16);
85
86 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx,
87 kvno,
88 r->account_name.string,
89 NULL,
90 ENCTYPE_ARCFOUR_HMAC,
91 blob);
92 if (!NT_STATUS_IS_OK(status)) {
93 return status;
94 }
95
96 return NT_STATUS_OK;
97}
98
99/****************************************************************
100****************************************************************/
101
102static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
103 struct samsync_context *ctx,
104 enum netr_SamDatabaseID database_id,
105 uint64_t *sequence_num)
106{
107 krb5_error_code ret = 0;
108 NTSTATUS status;
109 struct libnet_keytab_context *keytab_ctx = NULL;
110 struct libnet_keytab_entry *entry;
111 uint64_t old_sequence_num = 0;
112 const char *principal = NULL;
113 struct netr_DsRGetDCNameInfo *info = NULL;
114 const char *dc;
115
116 ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
117 if (ret) {
118 return krb5_to_nt_status(ret);
119 }
120
121 status = dsgetdcname(mem_ctx, ctx->msg_ctx,
122 ctx->domain_name, NULL, NULL, 0, &info);
123 if (!NT_STATUS_IS_OK(status)) {
124 return status;
125 }
126
127 dc = strip_hostname(info->dc_unc);
128
129 keytab_ctx->clean_old_entries = ctx->clean_old_entries;
130 ctx->private_data = keytab_ctx;
131
132 status = keytab_ad_connect(mem_ctx,
133 ctx->domain_name,
134 dc,
135 ctx->username,
136 ctx->password,
137 keytab_ctx);
138 if (!NT_STATUS_IS_OK(status)) {
139 TALLOC_FREE(keytab_ctx);
140 return status;
141 }
142
143 principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
144 keytab_ctx->dns_domain_name);
145 NT_STATUS_HAVE_NO_MEMORY(principal);
146
147 entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
148 mem_ctx);
149 if (entry && (entry->password.length == 8)) {
150 old_sequence_num = BVAL(entry->password.data, 0);
151 }
152
153 if (sequence_num) {
154 *sequence_num = old_sequence_num;
155 }
156
157 return status;
158}
159
160/****************************************************************
161****************************************************************/
162
163static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
164 enum netr_SamDatabaseID database_id,
165 struct netr_DELTA_ENUM_ARRAY *r,
166 uint64_t *sequence_num,
167 struct samsync_context *ctx)
168{
169 struct libnet_keytab_context *keytab_ctx =
170 (struct libnet_keytab_context *)ctx->private_data;
171
172 NTSTATUS status = NT_STATUS_OK;
173 int i;
174
175 for (i = 0; i < r->num_deltas; i++) {
176
177 switch (r->delta_enum[i].delta_type) {
178 case NETR_DELTA_USER:
179 break;
180 case NETR_DELTA_DOMAIN:
181 if (sequence_num) {
182 *sequence_num =
183 r->delta_enum[i].delta_union.domain->sequence_num;
184 }
185 continue;
186 case NETR_DELTA_MODIFY_COUNT:
187 if (sequence_num) {
188 *sequence_num =
189 *r->delta_enum[i].delta_union.modified_count;
190 }
191 continue;
192 default:
193 continue;
194 }
195
196 status = fetch_sam_entry_keytab(mem_ctx, database_id,
197 r->delta_enum[i].delta_id_union.rid,
198 r->delta_enum[i].delta_union.user,
199 keytab_ctx);
200 if (!NT_STATUS_IS_OK(status)) {
201 goto out;
202 }
203 }
204 out:
205 return status;
206}
207
208/****************************************************************
209****************************************************************/
210
211static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
212 struct samsync_context *ctx,
213 enum netr_SamDatabaseID database_id,
214 uint64_t sequence_num)
215{
216 struct libnet_keytab_context *keytab_ctx =
217 (struct libnet_keytab_context *)ctx->private_data;
218 krb5_error_code ret;
219 NTSTATUS status;
220 struct libnet_keytab_entry *entry;
221 uint64_t old_sequence_num = 0;
222 const char *principal = NULL;
223
224 principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
225 keytab_ctx->dns_domain_name);
226 NT_STATUS_HAVE_NO_MEMORY(principal);
227
228
229 entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
230 mem_ctx);
231 if (entry && (entry->password.length == 8)) {
232 old_sequence_num = BVAL(entry->password.data, 0);
233 }
234
235
236 if (sequence_num > old_sequence_num) {
237 DATA_BLOB blob;
238 blob = data_blob_talloc_zero(mem_ctx, 8);
239 SBVAL(blob.data, 0, sequence_num);
240
241 status = libnet_keytab_add_to_keytab_entries(mem_ctx, keytab_ctx,
242 0,
243 "SEQUENCE_NUM",
244 NULL,
245 ENCTYPE_NULL,
246 blob);
247 if (!NT_STATUS_IS_OK(status)) {
248 goto done;
249 }
250 }
251
252 ret = libnet_keytab_add(keytab_ctx);
253 if (ret) {
254 status = krb5_to_nt_status(ret);
255 ctx->error_message = talloc_asprintf(ctx,
256 "Failed to add entries to keytab %s: %s",
257 keytab_ctx->keytab_name, error_message(ret));
258 TALLOC_FREE(keytab_ctx);
259 return status;
260 }
261
262 ctx->result_message = talloc_asprintf(ctx,
263 "Vampired %d accounts to keytab %s",
264 keytab_ctx->count,
265 keytab_ctx->keytab_name);
266
267 status = NT_STATUS_OK;
268
269 done:
270 TALLOC_FREE(keytab_ctx);
271
272 return status;
273}
274
275#else
276
277static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
278 struct samsync_context *ctx,
279 enum netr_SamDatabaseID database_id,
280 uint64_t *sequence_num)
281{
282 return NT_STATUS_NOT_SUPPORTED;
283}
284
285static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
286 enum netr_SamDatabaseID database_id,
287 struct netr_DELTA_ENUM_ARRAY *r,
288 uint64_t *sequence_num,
289 struct samsync_context *ctx)
290{
291 return NT_STATUS_NOT_SUPPORTED;
292}
293
294static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
295 struct samsync_context *ctx,
296 enum netr_SamDatabaseID database_id,
297 uint64_t sequence_num)
298{
299 return NT_STATUS_NOT_SUPPORTED;
300}
301
302#endif /* defined(HAVE_ADS) */
303
304const struct samsync_ops libnet_samsync_keytab_ops = {
305 .startup = init_keytab,
306 .process_objects = fetch_sam_entries_keytab,
307 .finish = close_keytab
308};
Note: See TracBrowser for help on using the repository browser.