source: trunk/server/source4/kdc/kdc.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 28.7 KB
RevLine 
[745]1/*
2 Unix SMB/CIFS implementation.
3
4 KDC Server startup
5
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
7 Copyright (C) Andrew Tridgell 2005
8 Copyright (C) Stefan Metzmacher 2005
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22*/
23
24#include "includes.h"
25#include "smbd/process_model.h"
26#include "lib/tsocket/tsocket.h"
27#include "libcli/util/tstream.h"
28#include "lib/messaging/irpc.h"
29#include "librpc/gen_ndr/ndr_irpc.h"
30#include "librpc/gen_ndr/ndr_krb5pac.h"
31#include "lib/stream/packet.h"
32#include "lib/socket/netif.h"
33#include "param/param.h"
34#include "kdc/kdc-glue.h"
35#include "dsdb/samdb/samdb.h"
36#include "auth/session.h"
37
38extern struct krb5plugin_windc_ftable windc_plugin_table;
39extern struct hdb_method hdb_samba4;
40
41static NTSTATUS kdc_proxy_unavailable_error(struct kdc_server *kdc,
42 TALLOC_CTX *mem_ctx,
43 DATA_BLOB *out)
44{
45 int kret;
46 krb5_data k5_error_blob;
47
48 kret = krb5_mk_error(kdc->smb_krb5_context->krb5_context,
49 KRB5KDC_ERR_SVC_UNAVAILABLE, NULL, NULL,
50 NULL, NULL, NULL, NULL, &k5_error_blob);
51 if (kret != 0) {
52 DEBUG(2,(__location__ ": Unable to form krb5 error reply\n"));
53 return NT_STATUS_INTERNAL_ERROR;
54 }
55
56 *out = data_blob_talloc(mem_ctx, k5_error_blob.data, k5_error_blob.length);
57 krb5_data_free(&k5_error_blob);
58 if (!out->data) {
59 return NT_STATUS_NO_MEMORY;
60 }
61
62 return NT_STATUS_OK;
63}
64
65typedef enum kdc_process_ret (*kdc_process_fn_t)(struct kdc_server *kdc,
66 TALLOC_CTX *mem_ctx,
67 DATA_BLOB *input,
68 DATA_BLOB *reply,
69 struct tsocket_address *peer_addr,
70 struct tsocket_address *my_addr,
71 int datagram);
72
73/* hold information about one kdc socket */
74struct kdc_socket {
75 struct kdc_server *kdc;
76 struct tsocket_address *local_address;
77 kdc_process_fn_t process;
78};
79
80struct kdc_tcp_call {
81 struct kdc_tcp_connection *kdc_conn;
82 DATA_BLOB in;
83 DATA_BLOB out;
84 uint8_t out_hdr[4];
85 struct iovec out_iov[2];
86};
87
88/*
89 state of an open tcp connection
90*/
91struct kdc_tcp_connection {
92 /* stream connection we belong to */
93 struct stream_connection *conn;
94
95 /* the kdc_server the connection belongs to */
96 struct kdc_socket *kdc_socket;
97
98 struct tstream_context *tstream;
99
100 struct tevent_queue *send_queue;
101};
102
103
104static void kdc_tcp_terminate_connection(struct kdc_tcp_connection *kdcconn, const char *reason)
105{
106 stream_terminate_connection(kdcconn->conn, reason);
107}
108
109static void kdc_tcp_recv(struct stream_connection *conn, uint16_t flags)
110{
111 struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
112 struct kdc_tcp_connection);
113 /* this should never be triggered! */
114 kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_recv: called");
115}
116
117static void kdc_tcp_send(struct stream_connection *conn, uint16_t flags)
118{
119 struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
120 struct kdc_tcp_connection);
121 /* this should never be triggered! */
122 kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_send: called");
123}
124
125/**
126 Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
127 calling conventions
128*/
129
130static enum kdc_process_ret kdc_process(struct kdc_server *kdc,
131 TALLOC_CTX *mem_ctx,
132 DATA_BLOB *input,
133 DATA_BLOB *reply,
134 struct tsocket_address *peer_addr,
135 struct tsocket_address *my_addr,
136 int datagram_reply)
137{
138 int ret;
139 char *pa;
140 struct sockaddr_storage ss;
141 krb5_data k5_reply;
142 krb5_data_zero(&k5_reply);
143
144 krb5_kdc_update_time(NULL);
145
146 ret = tsocket_address_bsd_sockaddr(peer_addr, (struct sockaddr *) &ss,
147 sizeof(struct sockaddr_storage));
148 if (ret < 0) {
149 return KDC_PROCESS_FAILED;
150 }
151 pa = tsocket_address_string(peer_addr, mem_ctx);
152 if (pa == NULL) {
153 return KDC_PROCESS_FAILED;
154 }
155
156 DEBUG(10,("Received KDC packet of length %lu from %s\n",
157 (long)input->length - 4, pa));
158
159 ret = krb5_kdc_process_krb5_request(kdc->smb_krb5_context->krb5_context,
160 kdc->config,
161 input->data, input->length,
162 &k5_reply,
163 pa,
164 (struct sockaddr *) &ss,
165 datagram_reply);
166 if (ret == -1) {
167 *reply = data_blob(NULL, 0);
168 return KDC_PROCESS_FAILED;
169 }
170
171 if (ret == HDB_ERR_NOT_FOUND_HERE) {
172 *reply = data_blob(NULL, 0);
173 return KDC_PROCESS_PROXY;
174 }
175
176 if (k5_reply.length) {
177 *reply = data_blob_talloc(mem_ctx, k5_reply.data, k5_reply.length);
178 krb5_data_free(&k5_reply);
179 } else {
180 *reply = data_blob(NULL, 0);
181 }
182 return KDC_PROCESS_OK;
183}
184
185static void kdc_tcp_call_proxy_done(struct tevent_req *subreq);
186static void kdc_tcp_call_writev_done(struct tevent_req *subreq);
187
188static void kdc_tcp_call_loop(struct tevent_req *subreq)
189{
190 struct kdc_tcp_connection *kdc_conn = tevent_req_callback_data(subreq,
191 struct kdc_tcp_connection);
192 struct kdc_tcp_call *call;
193 NTSTATUS status;
194 enum kdc_process_ret ret;
195
196 call = talloc(kdc_conn, struct kdc_tcp_call);
197 if (call == NULL) {
198 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
199 "no memory for kdc_tcp_call");
200 return;
201 }
202 call->kdc_conn = kdc_conn;
203
204 status = tstream_read_pdu_blob_recv(subreq,
205 call,
206 &call->in);
207 TALLOC_FREE(subreq);
208 if (!NT_STATUS_IS_OK(status)) {
209 const char *reason;
210
211 reason = talloc_asprintf(call, "kdc_tcp_call_loop: "
212 "tstream_read_pdu_blob_recv() - %s",
213 nt_errstr(status));
214 if (!reason) {
215 reason = nt_errstr(status);
216 }
217
218 kdc_tcp_terminate_connection(kdc_conn, reason);
219 return;
220 }
221
222 DEBUG(10,("Received krb5 TCP packet of length %lu from %s\n",
223 (long) call->in.length,
224 tsocket_address_string(kdc_conn->conn->remote_address, call)));
225
226 /* skip length header */
227 call->in.data +=4;
228 call->in.length -= 4;
229
230 /* Call krb5 */
231 ret = kdc_conn->kdc_socket->process(kdc_conn->kdc_socket->kdc,
232 call,
233 &call->in,
234 &call->out,
235 kdc_conn->conn->remote_address,
236 kdc_conn->conn->local_address,
237 0 /* Stream */);
238 if (ret == KDC_PROCESS_FAILED) {
239 kdc_tcp_terminate_connection(kdc_conn,
240 "kdc_tcp_call_loop: process function failed");
241 return;
242 }
243
244 if (ret == KDC_PROCESS_PROXY) {
245 uint16_t port;
246
247 if (!kdc_conn->kdc_socket->kdc->am_rodc) {
248 kdc_tcp_terminate_connection(kdc_conn,
249 "kdc_tcp_call_loop: proxying requested when not RODC");
250 return;
251 }
252 port = tsocket_address_inet_port(kdc_conn->conn->local_address);
253
254 subreq = kdc_tcp_proxy_send(call,
255 kdc_conn->conn->event.ctx,
256 kdc_conn->kdc_socket->kdc,
257 port,
258 call->in);
259 if (subreq == NULL) {
260 kdc_tcp_terminate_connection(kdc_conn,
261 "kdc_tcp_call_loop: kdc_tcp_proxy_send failed");
262 return;
263 }
264 tevent_req_set_callback(subreq, kdc_tcp_call_proxy_done, call);
265 return;
266 }
267
268 /* First add the length of the out buffer */
269 RSIVAL(call->out_hdr, 0, call->out.length);
270 call->out_iov[0].iov_base = (char *) call->out_hdr;
271 call->out_iov[0].iov_len = 4;
272
273 call->out_iov[1].iov_base = (char *) call->out.data;
274 call->out_iov[1].iov_len = call->out.length;
275
276 subreq = tstream_writev_queue_send(call,
277 kdc_conn->conn->event.ctx,
278 kdc_conn->tstream,
279 kdc_conn->send_queue,
280 call->out_iov, 2);
281 if (subreq == NULL) {
282 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
283 "no memory for tstream_writev_queue_send");
284 return;
285 }
286 tevent_req_set_callback(subreq, kdc_tcp_call_writev_done, call);
287
288 /*
289 * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
290 * packet_full_request_u32 provides the pdu length then.
291 */
292 subreq = tstream_read_pdu_blob_send(kdc_conn,
293 kdc_conn->conn->event.ctx,
294 kdc_conn->tstream,
295 4, /* initial_read_size */
296 packet_full_request_u32,
297 kdc_conn);
298 if (subreq == NULL) {
299 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
300 "no memory for tstream_read_pdu_blob_send");
301 return;
302 }
303 tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
304}
305
306static void kdc_tcp_call_proxy_done(struct tevent_req *subreq)
307{
308 struct kdc_tcp_call *call = tevent_req_callback_data(subreq,
309 struct kdc_tcp_call);
310 struct kdc_tcp_connection *kdc_conn = call->kdc_conn;
311 NTSTATUS status;
312
313 status = kdc_tcp_proxy_recv(subreq, call, &call->out);
314 TALLOC_FREE(subreq);
315 if (!NT_STATUS_IS_OK(status)) {
316 /* generate an error packet */
317 status = kdc_proxy_unavailable_error(kdc_conn->kdc_socket->kdc,
318 call, &call->out);
319 }
320
321 if (!NT_STATUS_IS_OK(status)) {
322 const char *reason;
323
324 reason = talloc_asprintf(call, "kdc_tcp_call_proxy_done: "
325 "kdc_proxy_unavailable_error - %s",
326 nt_errstr(status));
327 if (!reason) {
328 reason = "kdc_tcp_call_proxy_done: kdc_proxy_unavailable_error() failed";
329 }
330
331 kdc_tcp_terminate_connection(call->kdc_conn, reason);
332 return;
333 }
334
335 /* First add the length of the out buffer */
336 RSIVAL(call->out_hdr, 0, call->out.length);
337 call->out_iov[0].iov_base = (char *) call->out_hdr;
338 call->out_iov[0].iov_len = 4;
339
340 call->out_iov[1].iov_base = (char *) call->out.data;
341 call->out_iov[1].iov_len = call->out.length;
342
343 subreq = tstream_writev_queue_send(call,
344 kdc_conn->conn->event.ctx,
345 kdc_conn->tstream,
346 kdc_conn->send_queue,
347 call->out_iov, 2);
348 if (subreq == NULL) {
349 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
350 "no memory for tstream_writev_queue_send");
351 return;
352 }
353 tevent_req_set_callback(subreq, kdc_tcp_call_writev_done, call);
354
355 /*
356 * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
357 * packet_full_request_u32 provides the pdu length then.
358 */
359 subreq = tstream_read_pdu_blob_send(kdc_conn,
360 kdc_conn->conn->event.ctx,
361 kdc_conn->tstream,
362 4, /* initial_read_size */
363 packet_full_request_u32,
364 kdc_conn);
365 if (subreq == NULL) {
366 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
367 "no memory for tstream_read_pdu_blob_send");
368 return;
369 }
370 tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
371}
372
373static void kdc_tcp_call_writev_done(struct tevent_req *subreq)
374{
375 struct kdc_tcp_call *call = tevent_req_callback_data(subreq,
376 struct kdc_tcp_call);
377 int sys_errno;
378 int rc;
379
380 rc = tstream_writev_queue_recv(subreq, &sys_errno);
381 TALLOC_FREE(subreq);
382 if (rc == -1) {
383 const char *reason;
384
385 reason = talloc_asprintf(call, "kdc_tcp_call_writev_done: "
386 "tstream_writev_queue_recv() - %d:%s",
387 sys_errno, strerror(sys_errno));
388 if (!reason) {
389 reason = "kdc_tcp_call_writev_done: tstream_writev_queue_recv() failed";
390 }
391
392 kdc_tcp_terminate_connection(call->kdc_conn, reason);
393 return;
394 }
395
396 /* We don't care about errors */
397
398 talloc_free(call);
399}
400
401/*
402 called when we get a new connection
403*/
404static void kdc_tcp_accept(struct stream_connection *conn)
405{
406 struct kdc_socket *kdc_socket;
407 struct kdc_tcp_connection *kdc_conn;
408 struct tevent_req *subreq;
409 int rc;
410
411 kdc_conn = talloc_zero(conn, struct kdc_tcp_connection);
412 if (kdc_conn == NULL) {
413 stream_terminate_connection(conn,
414 "kdc_tcp_accept: out of memory");
415 return;
416 }
417
418 kdc_conn->send_queue = tevent_queue_create(conn, "kdc_tcp_accept");
419 if (kdc_conn->send_queue == NULL) {
420 stream_terminate_connection(conn,
421 "kdc_tcp_accept: out of memory");
422 return;
423 }
424
425 kdc_socket = talloc_get_type(conn->private_data, struct kdc_socket);
426
427 TALLOC_FREE(conn->event.fde);
428
429 rc = tstream_bsd_existing_socket(kdc_conn,
430 socket_get_fd(conn->socket),
431 &kdc_conn->tstream);
432 if (rc < 0) {
433 stream_terminate_connection(conn,
434 "kdc_tcp_accept: out of memory");
435 return;
436 }
437
438 kdc_conn->conn = conn;
439 kdc_conn->kdc_socket = kdc_socket;
440 conn->private_data = kdc_conn;
441
442 /*
443 * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
444 * packet_full_request_u32 provides the pdu length then.
445 */
446 subreq = tstream_read_pdu_blob_send(kdc_conn,
447 kdc_conn->conn->event.ctx,
448 kdc_conn->tstream,
449 4, /* initial_read_size */
450 packet_full_request_u32,
451 kdc_conn);
452 if (subreq == NULL) {
453 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_accept: "
454 "no memory for tstream_read_pdu_blob_send");
455 return;
456 }
457 tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
458}
459
460static const struct stream_server_ops kdc_tcp_stream_ops = {
461 .name = "kdc_tcp",
462 .accept_connection = kdc_tcp_accept,
463 .recv_handler = kdc_tcp_recv,
464 .send_handler = kdc_tcp_send
465};
466
467/* hold information about one kdc/kpasswd udp socket */
468struct kdc_udp_socket {
469 struct kdc_socket *kdc_socket;
470 struct tdgram_context *dgram;
471 struct tevent_queue *send_queue;
472};
473
474struct kdc_udp_call {
475 struct kdc_udp_socket *sock;
476 struct tsocket_address *src;
477 DATA_BLOB in;
478 DATA_BLOB out;
479};
480
481static void kdc_udp_call_proxy_done(struct tevent_req *subreq);
482static void kdc_udp_call_sendto_done(struct tevent_req *subreq);
483
484static void kdc_udp_call_loop(struct tevent_req *subreq)
485{
486 struct kdc_udp_socket *sock = tevent_req_callback_data(subreq,
487 struct kdc_udp_socket);
488 struct kdc_udp_call *call;
489 uint8_t *buf;
490 ssize_t len;
491 int sys_errno;
492 enum kdc_process_ret ret;
493
494 call = talloc(sock, struct kdc_udp_call);
495 if (call == NULL) {
496 talloc_free(call);
497 goto done;
498 }
499 call->sock = sock;
500
501 len = tdgram_recvfrom_recv(subreq, &sys_errno,
502 call, &buf, &call->src);
503 TALLOC_FREE(subreq);
504 if (len == -1) {
505 talloc_free(call);
506 goto done;
507 }
508
509 call->in.data = buf;
510 call->in.length = len;
511
512 DEBUG(10,("Received krb5 UDP packet of length %lu from %s\n",
513 (long)call->in.length,
514 tsocket_address_string(call->src, call)));
515
516 /* Call krb5 */
517 ret = sock->kdc_socket->process(sock->kdc_socket->kdc,
518 call,
519 &call->in,
520 &call->out,
521 call->src,
522 sock->kdc_socket->local_address,
523 1 /* Datagram */);
524 if (ret == KDC_PROCESS_FAILED) {
525 talloc_free(call);
526 goto done;
527 }
528
529 if (ret == KDC_PROCESS_PROXY) {
530 uint16_t port;
531
532 if (!sock->kdc_socket->kdc->am_rodc) {
533 DEBUG(0,("kdc_udp_call_loop: proxying requested when not RODC"));
534 talloc_free(call);
535 goto done;
536 }
537
538 port = tsocket_address_inet_port(sock->kdc_socket->local_address);
539
540 subreq = kdc_udp_proxy_send(call,
541 sock->kdc_socket->kdc->task->event_ctx,
542 sock->kdc_socket->kdc,
543 port,
544 call->in);
545 if (subreq == NULL) {
546 talloc_free(call);
547 goto done;
548 }
549 tevent_req_set_callback(subreq, kdc_udp_call_proxy_done, call);
550 goto done;
551 }
552
553 subreq = tdgram_sendto_queue_send(call,
554 sock->kdc_socket->kdc->task->event_ctx,
555 sock->dgram,
556 sock->send_queue,
557 call->out.data,
558 call->out.length,
559 call->src);
560 if (subreq == NULL) {
561 talloc_free(call);
562 goto done;
563 }
564 tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call);
565
566done:
567 subreq = tdgram_recvfrom_send(sock,
568 sock->kdc_socket->kdc->task->event_ctx,
569 sock->dgram);
570 if (subreq == NULL) {
571 task_server_terminate(sock->kdc_socket->kdc->task,
572 "no memory for tdgram_recvfrom_send",
573 true);
574 return;
575 }
576 tevent_req_set_callback(subreq, kdc_udp_call_loop, sock);
577}
578
579static void kdc_udp_call_proxy_done(struct tevent_req *subreq)
580{
581 struct kdc_udp_call *call =
582 tevent_req_callback_data(subreq,
583 struct kdc_udp_call);
584 NTSTATUS status;
585
586 status = kdc_udp_proxy_recv(subreq, call, &call->out);
587 TALLOC_FREE(subreq);
588 if (!NT_STATUS_IS_OK(status)) {
589 /* generate an error packet */
590 status = kdc_proxy_unavailable_error(call->sock->kdc_socket->kdc,
591 call, &call->out);
592 }
593
594 if (!NT_STATUS_IS_OK(status)) {
595 talloc_free(call);
596 return;
597 }
598
599 subreq = tdgram_sendto_queue_send(call,
600 call->sock->kdc_socket->kdc->task->event_ctx,
601 call->sock->dgram,
602 call->sock->send_queue,
603 call->out.data,
604 call->out.length,
605 call->src);
606 if (subreq == NULL) {
607 talloc_free(call);
608 return;
609 }
610
611 tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call);
612}
613
614static void kdc_udp_call_sendto_done(struct tevent_req *subreq)
615{
616 struct kdc_udp_call *call = tevent_req_callback_data(subreq,
617 struct kdc_udp_call);
618 ssize_t ret;
619 int sys_errno;
620
621 ret = tdgram_sendto_queue_recv(subreq, &sys_errno);
622
623 /* We don't care about errors */
624
625 talloc_free(call);
626}
627
628/*
629 start listening on the given address
630*/
631static NTSTATUS kdc_add_socket(struct kdc_server *kdc,
632 const struct model_ops *model_ops,
633 const char *name,
634 const char *address,
635 uint16_t port,
636 kdc_process_fn_t process,
637 bool udp_only)
638{
639 struct kdc_socket *kdc_socket;
640 struct kdc_udp_socket *kdc_udp_socket;
641 struct tevent_req *udpsubreq;
642 NTSTATUS status;
643 int ret;
644
645 kdc_socket = talloc(kdc, struct kdc_socket);
646 NT_STATUS_HAVE_NO_MEMORY(kdc_socket);
647
648 kdc_socket->kdc = kdc;
649 kdc_socket->process = process;
650
651 ret = tsocket_address_inet_from_strings(kdc_socket, "ip",
652 address, port,
653 &kdc_socket->local_address);
654 if (ret != 0) {
655 status = map_nt_error_from_unix(errno);
656 return status;
657 }
658
659 if (!udp_only) {
660 status = stream_setup_socket(kdc->task,
661 kdc->task->event_ctx,
662 kdc->task->lp_ctx,
663 model_ops,
664 &kdc_tcp_stream_ops,
665 "ip", address, &port,
666 lpcfg_socket_options(kdc->task->lp_ctx),
667 kdc_socket);
668 if (!NT_STATUS_IS_OK(status)) {
669 DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
670 address, port, nt_errstr(status)));
671 talloc_free(kdc_socket);
672 return status;
673 }
674 }
675
676 kdc_udp_socket = talloc(kdc_socket, struct kdc_udp_socket);
677 NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket);
678
679 kdc_udp_socket->kdc_socket = kdc_socket;
680
681 ret = tdgram_inet_udp_socket(kdc_socket->local_address,
682 NULL,
683 kdc_udp_socket,
684 &kdc_udp_socket->dgram);
685 if (ret != 0) {
686 status = map_nt_error_from_unix(errno);
687 DEBUG(0,("Failed to bind to %s:%u UDP - %s\n",
688 address, port, nt_errstr(status)));
689 return status;
690 }
691
692 kdc_udp_socket->send_queue = tevent_queue_create(kdc_udp_socket,
693 "kdc_udp_send_queue");
694 NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket->send_queue);
695
696 udpsubreq = tdgram_recvfrom_send(kdc_udp_socket,
697 kdc->task->event_ctx,
698 kdc_udp_socket->dgram);
699 NT_STATUS_HAVE_NO_MEMORY(udpsubreq);
700 tevent_req_set_callback(udpsubreq, kdc_udp_call_loop, kdc_udp_socket);
701
702 return NT_STATUS_OK;
703}
704
705
706/*
707 setup our listening sockets on the configured network interfaces
708*/
709static NTSTATUS kdc_startup_interfaces(struct kdc_server *kdc, struct loadparm_context *lp_ctx,
710 struct interface *ifaces)
711{
712 const struct model_ops *model_ops;
713 int num_interfaces;
714 TALLOC_CTX *tmp_ctx = talloc_new(kdc);
715 NTSTATUS status;
716 int i;
717 uint16_t kdc_port = lpcfg_krb5_port(lp_ctx);
718 uint16_t kpasswd_port = lpcfg_kpasswd_port(lp_ctx);
719 bool done_wildcard = false;
720
721 /* within the kdc task we want to be a single process, so
722 ask for the single process model ops and pass these to the
723 stream_setup_socket() call. */
724 model_ops = process_model_startup("single");
725 if (!model_ops) {
726 DEBUG(0,("Can't find 'single' process model_ops\n"));
727 return NT_STATUS_INTERNAL_ERROR;
728 }
729
730 num_interfaces = iface_count(ifaces);
731
732 /* if we are allowing incoming packets from any address, then
733 we need to bind to the wildcard address */
734 if (!lpcfg_bind_interfaces_only(lp_ctx)) {
735 if (kdc_port) {
736 status = kdc_add_socket(kdc, model_ops,
737 "kdc", "0.0.0.0", kdc_port,
738 kdc_process, false);
739 NT_STATUS_NOT_OK_RETURN(status);
740 }
741
742 if (kpasswd_port) {
743 status = kdc_add_socket(kdc, model_ops,
744 "kpasswd", "0.0.0.0", kpasswd_port,
745 kpasswdd_process, false);
746 NT_STATUS_NOT_OK_RETURN(status);
747 }
748 done_wildcard = true;
749 }
750
751 for (i=0; i<num_interfaces; i++) {
752 const char *address = talloc_strdup(tmp_ctx, iface_n_ip(ifaces, i));
753
754 if (kdc_port) {
755 status = kdc_add_socket(kdc, model_ops,
756 "kdc", address, kdc_port,
757 kdc_process, done_wildcard);
758 NT_STATUS_NOT_OK_RETURN(status);
759 }
760
761 if (kpasswd_port) {
762 status = kdc_add_socket(kdc, model_ops,
763 "kpasswd", address, kpasswd_port,
764 kpasswdd_process, done_wildcard);
765 NT_STATUS_NOT_OK_RETURN(status);
766 }
767 }
768
769 talloc_free(tmp_ctx);
770
771 return NT_STATUS_OK;
772}
773
774
775static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg,
776 struct kdc_check_generic_kerberos *r)
777{
778 struct PAC_Validate pac_validate;
779 DATA_BLOB srv_sig;
780 struct PAC_SIGNATURE_DATA kdc_sig;
781 struct kdc_server *kdc = talloc_get_type(msg->private_data, struct kdc_server);
782 enum ndr_err_code ndr_err;
783 krb5_enctype etype;
784 int ret;
785 hdb_entry_ex ent;
786 krb5_principal principal;
787 krb5_keyblock keyblock;
788 Key *key;
789
790 /* There is no reply to this request */
791 r->out.generic_reply = data_blob(NULL, 0);
792
793 ndr_err = ndr_pull_struct_blob(&r->in.generic_request, msg, &pac_validate,
794 (ndr_pull_flags_fn_t)ndr_pull_PAC_Validate);
795 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
796 return NT_STATUS_INVALID_PARAMETER;
797 }
798
799 if (pac_validate.MessageType != 3) {
800 /* We don't implement any other message types - such as certificate validation - yet */
801 return NT_STATUS_INVALID_PARAMETER;
802 }
803
804 if (pac_validate.ChecksumAndSignature.length != (pac_validate.ChecksumLength + pac_validate.SignatureLength)
805 || pac_validate.ChecksumAndSignature.length < pac_validate.ChecksumLength
806 || pac_validate.ChecksumAndSignature.length < pac_validate.SignatureLength ) {
807 return NT_STATUS_INVALID_PARAMETER;
808 }
809
810 srv_sig = data_blob_const(pac_validate.ChecksumAndSignature.data,
811 pac_validate.ChecksumLength);
812
813 if (pac_validate.SignatureType == CKSUMTYPE_HMAC_MD5) {
814 etype = ETYPE_ARCFOUR_HMAC_MD5;
815 } else {
816 ret = krb5_cksumtype_to_enctype(kdc->smb_krb5_context->krb5_context, pac_validate.SignatureType,
817 &etype);
818 if (ret != 0) {
819 return NT_STATUS_LOGON_FAILURE;
820 }
821 }
822
823 ret = krb5_make_principal(kdc->smb_krb5_context->krb5_context, &principal,
824 lpcfg_realm(kdc->task->lp_ctx),
825 "krbtgt", lpcfg_realm(kdc->task->lp_ctx),
826 NULL);
827
828 if (ret != 0) {
829 return NT_STATUS_NO_MEMORY;
830 }
831
832 ret = kdc->config->db[0]->hdb_fetch_kvno(kdc->smb_krb5_context->krb5_context,
833 kdc->config->db[0],
834 principal,
835 HDB_F_GET_KRBTGT | HDB_F_DECRYPT,
836 0,
837 &ent);
838
839 if (ret != 0) {
840 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
841 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
842
843 return NT_STATUS_LOGON_FAILURE;
844 }
845
846 ret = hdb_enctype2key(kdc->smb_krb5_context->krb5_context, &ent.entry, etype, &key);
847
848 if (ret != 0) {
849 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
850 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
851 return NT_STATUS_LOGON_FAILURE;
852 }
853
854 keyblock = key->key;
855
856 kdc_sig.type = pac_validate.SignatureType;
857 kdc_sig.signature = data_blob_const(&pac_validate.ChecksumAndSignature.data[pac_validate.ChecksumLength],
858 pac_validate.SignatureLength);
859 ret = check_pac_checksum(msg, srv_sig, &kdc_sig,
860 kdc->smb_krb5_context->krb5_context, &keyblock);
861
862 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
863 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
864
865 if (ret != 0) {
866 return NT_STATUS_LOGON_FAILURE;
867 }
868
869 return NT_STATUS_OK;
870}
871
872
873/*
874 startup the kdc task
875*/
876static void kdc_task_init(struct task_server *task)
877{
878 struct kdc_server *kdc;
879 NTSTATUS status;
880 krb5_error_code ret;
881 struct interface *ifaces;
882 int ldb_ret;
883
884 switch (lpcfg_server_role(task->lp_ctx)) {
885 case ROLE_STANDALONE:
886 task_server_terminate(task, "kdc: no KDC required in standalone configuration", false);
887 return;
888 case ROLE_DOMAIN_MEMBER:
889 task_server_terminate(task, "kdc: no KDC required in member server configuration", false);
890 return;
891 case ROLE_DOMAIN_CONTROLLER:
892 /* Yes, we want a KDC */
893 break;
894 }
895
896 load_interfaces(task, lpcfg_interfaces(task->lp_ctx), &ifaces);
897
898 if (iface_count(ifaces) == 0) {
899 task_server_terminate(task, "kdc: no network interfaces configured", false);
900 return;
901 }
902
903 task_server_set_title(task, "task[kdc]");
904
905 kdc = talloc_zero(task, struct kdc_server);
906 if (kdc == NULL) {
907 task_server_terminate(task, "kdc: out of memory", true);
908 return;
909 }
910
911 kdc->task = task;
912
913
914 /* get a samdb connection */
915 kdc->samdb = samdb_connect(kdc, kdc->task->event_ctx, kdc->task->lp_ctx,
916 system_session(kdc->task->lp_ctx), 0);
917 if (!kdc->samdb) {
918 DEBUG(1,("kdc_task_init: unable to connect to samdb\n"));
919 task_server_terminate(task, "kdc: krb5_init_context samdb connect failed", true);
920 return;
921 }
922
923 ldb_ret = samdb_rodc(kdc->samdb, &kdc->am_rodc);
924 if (ldb_ret != LDB_SUCCESS) {
925 DEBUG(1, ("kdc_task_init: Cannot determine if we are an RODC: %s\n",
926 ldb_errstring(kdc->samdb)));
927 task_server_terminate(task, "kdc: krb5_init_context samdb RODC connect failed", true);
928 return;
929 }
930
931 kdc->proxy_timeout = lpcfg_parm_int(kdc->task->lp_ctx, NULL, "kdc", "proxy timeout", 5);
932
933 initialize_krb5_error_table();
934
935 ret = smb_krb5_init_context(kdc, task->event_ctx, task->lp_ctx, &kdc->smb_krb5_context);
936 if (ret) {
937 DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n",
938 error_message(ret)));
939 task_server_terminate(task, "kdc: krb5_init_context failed", true);
940 return;
941 }
942
943 krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r);
944
945 ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context,
946 &kdc->config);
947 if(ret) {
948 task_server_terminate(task, "kdc: failed to get KDC configuration", true);
949 return;
950 }
951
952 kdc->config->logf = kdc->smb_krb5_context->logf;
953 kdc->config->db = talloc(kdc, struct HDB *);
954 if (!kdc->config->db) {
955 task_server_terminate(task, "kdc: out of memory", true);
956 return;
957 }
958 kdc->config->num_db = 1;
959
960 /* Register hdb-samba4 hooks for use as a keytab */
961
962 kdc->base_ctx = talloc_zero(kdc, struct samba_kdc_base_context);
963 if (!kdc->base_ctx) {
964 task_server_terminate(task, "kdc: out of memory", true);
965 return;
966 }
967
968 kdc->base_ctx->ev_ctx = task->event_ctx;
969 kdc->base_ctx->lp_ctx = task->lp_ctx;
970
971 status = hdb_samba4_create_kdc(kdc->base_ctx,
972 kdc->smb_krb5_context->krb5_context,
973 &kdc->config->db[0]);
974 if (!NT_STATUS_IS_OK(status)) {
975 task_server_terminate(task, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
976 return;
977 }
978
979 ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
980 PLUGIN_TYPE_DATA, "hdb",
981 &hdb_samba4);
982 if(ret) {
983 task_server_terminate(task, "kdc: failed to register hdb plugin", true);
984 return;
985 }
986
987 ret = krb5_kt_register(kdc->smb_krb5_context->krb5_context, &hdb_kt_ops);
988 if(ret) {
989 task_server_terminate(task, "kdc: failed to register keytab plugin", true);
990 return;
991 }
992
993 /* Register WinDC hooks */
994 ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
995 PLUGIN_TYPE_DATA, "windc",
996 &windc_plugin_table);
997 if(ret) {
998 task_server_terminate(task, "kdc: failed to register windc plugin", true);
999 return;
1000 }
1001
1002 ret = krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
1003
1004 if(ret) {
1005 task_server_terminate(task, "kdc: failed to init windc plugin", true);
1006 return;
1007 }
1008
1009 ret = krb5_kdc_pkinit_config(kdc->smb_krb5_context->krb5_context, kdc->config);
1010
1011 if(ret) {
1012 task_server_terminate(task, "kdc: failed to init kdc pkinit subsystem", true);
1013 return;
1014 }
1015
1016 /* start listening on the configured network interfaces */
1017 status = kdc_startup_interfaces(kdc, task->lp_ctx, ifaces);
1018 if (!NT_STATUS_IS_OK(status)) {
1019 task_server_terminate(task, "kdc failed to setup interfaces", true);
1020 return;
1021 }
1022
1023 status = IRPC_REGISTER(task->msg_ctx, irpc, KDC_CHECK_GENERIC_KERBEROS,
1024 kdc_check_generic_kerberos, kdc);
1025 if (!NT_STATUS_IS_OK(status)) {
1026 task_server_terminate(task, "kdc failed to setup monitoring", true);
1027 return;
1028 }
1029
1030 irpc_add_name(task->msg_ctx, "kdc_server");
1031}
1032
1033
1034/* called at smbd startup - register ourselves as a server service */
1035NTSTATUS server_service_kdc_init(void)
1036{
1037 return register_server_service("kdc", kdc_task_init);
1038}
Note: See TracBrowser for help on using the repository browser.