Changeset 988 for vendor/current/source4/kdc/hdb-samba4.c
- Timestamp:
- Nov 24, 2016, 1:14:11 PM (9 years ago)
- File:
-
- 1 edited
-
vendor/current/source4/kdc/hdb-samba4.c (modified) (9 diffs)
Legend:
- Unmodified
- Added
- Removed
-
vendor/current/source4/kdc/hdb-samba4.c
r740 r988 36 36 #include "kdc/kdc-glue.h" 37 37 #include "kdc/db-glue.h" 38 #include "auth/auth_sam.h" 39 #include <ldb.h> 40 #include "sdb.h" 41 #include "sdb_hdb.h" 38 42 39 43 static krb5_error_code hdb_samba4_open(krb5_context context, HDB *db, int flags, mode_t mode) … … 86 90 { 87 91 struct samba_kdc_db_context *kdc_db_ctx; 88 89 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 90 struct samba_kdc_db_context); 91 92 return samba_kdc_fetch(context, kdc_db_ctx, principal, flags, kvno, entry_ex); 92 struct sdb_entry_ex sdb_entry_ex = {}; 93 krb5_error_code code, ret; 94 95 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 96 struct samba_kdc_db_context); 97 98 ret = samba_kdc_fetch(context, 99 kdc_db_ctx, 100 principal, 101 flags, 102 kvno, 103 &sdb_entry_ex); 104 switch (ret) { 105 case 0: 106 code = 0; 107 break; 108 case SDB_ERR_WRONG_REALM: 109 /* 110 * If SDB_ERR_WRONG_REALM is returned we need to process the 111 * sdb_entry to fill the principal in the HDB entry. 112 */ 113 code = HDB_ERR_WRONG_REALM; 114 break; 115 case SDB_ERR_NOENTRY: 116 return HDB_ERR_NOENTRY; 117 default: 118 return HDB_ERR_NOT_FOUND_HERE; 119 } 120 121 ret = sdb_entry_ex_to_hdb_entry_ex(context, &sdb_entry_ex, entry_ex); 122 sdb_free_entry(&sdb_entry_ex); 123 124 if (code != 0 && ret != 0) { 125 code = ret; 126 } 127 128 return code; 93 129 } 94 130 … … 97 133 { 98 134 struct samba_kdc_db_context *kdc_db_ctx; 99 100 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 101 struct samba_kdc_db_context); 102 103 return samba_kdc_firstkey(context, kdc_db_ctx, entry); 135 struct sdb_entry_ex sdb_entry_ex = {}; 136 krb5_error_code ret; 137 138 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 139 struct samba_kdc_db_context); 140 141 ret = samba_kdc_firstkey(context, kdc_db_ctx, &sdb_entry_ex); 142 switch (ret) { 143 case 0: 144 break; 145 case SDB_ERR_WRONG_REALM: 146 return HDB_ERR_WRONG_REALM; 147 case SDB_ERR_NOENTRY: 148 return HDB_ERR_NOENTRY; 149 default: 150 return HDB_ERR_NOT_FOUND_HERE; 151 } 152 153 ret = sdb_entry_ex_to_hdb_entry_ex(context, &sdb_entry_ex, entry); 154 sdb_free_entry(&sdb_entry_ex); 155 return ret; 104 156 } 105 157 … … 108 160 { 109 161 struct samba_kdc_db_context *kdc_db_ctx; 110 111 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 112 struct samba_kdc_db_context); 113 114 return samba_kdc_nextkey(context, kdc_db_ctx, entry); 162 struct sdb_entry_ex sdb_entry_ex = {}; 163 krb5_error_code ret; 164 165 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 166 struct samba_kdc_db_context); 167 168 ret = samba_kdc_nextkey(context, kdc_db_ctx, &sdb_entry_ex); 169 switch (ret) { 170 case 0: 171 break; 172 case SDB_ERR_WRONG_REALM: 173 return HDB_ERR_WRONG_REALM; 174 case SDB_ERR_NOENTRY: 175 return HDB_ERR_NOENTRY; 176 default: 177 return HDB_ERR_NOT_FOUND_HERE; 178 } 179 180 ret = sdb_entry_ex_to_hdb_entry_ex(context, &sdb_entry_ex, entry); 181 sdb_free_entry(&sdb_entry_ex); 182 return ret; 115 183 } 116 184 … … 122 190 123 191 static krb5_error_code 124 hdb_samba4_check_ identical_client_and_server(krb5_context context, HDB *db,192 hdb_samba4_check_constrained_delegation(krb5_context context, HDB *db, 125 193 hdb_entry_ex *entry, 126 194 krb5_const_principal target_principal) 127 195 { 128 196 struct samba_kdc_db_context *kdc_db_ctx; 129 130 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 131 struct samba_kdc_db_context); 132 133 return samba_kdc_check_identical_client_and_server(context, kdc_db_ctx, 134 entry, 135 target_principal); 197 struct samba_kdc_entry *skdc_entry; 198 krb5_error_code ret; 199 200 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 201 struct samba_kdc_db_context); 202 skdc_entry = talloc_get_type_abort(entry->ctx, 203 struct samba_kdc_entry); 204 205 ret = samba_kdc_check_s4u2proxy(context, kdc_db_ctx, 206 skdc_entry, 207 target_principal); 208 switch (ret) { 209 case 0: 210 break; 211 case SDB_ERR_WRONG_REALM: 212 ret = HDB_ERR_WRONG_REALM; 213 break; 214 case SDB_ERR_NOENTRY: 215 ret = HDB_ERR_NOENTRY; 216 break; 217 default: 218 ret = HDB_ERR_NOT_FOUND_HERE; 219 break; 220 } 221 222 return ret; 136 223 } 137 224 … … 142 229 { 143 230 struct samba_kdc_db_context *kdc_db_ctx; 144 145 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 146 struct samba_kdc_db_context); 147 148 return samba_kdc_check_pkinit_ms_upn_match(context, kdc_db_ctx, 149 entry, 150 certificate_principal); 231 struct samba_kdc_entry *skdc_entry; 232 krb5_error_code ret; 233 234 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 235 struct samba_kdc_db_context); 236 skdc_entry = talloc_get_type_abort(entry->ctx, 237 struct samba_kdc_entry); 238 239 ret = samba_kdc_check_pkinit_ms_upn_match(context, kdc_db_ctx, 240 skdc_entry, 241 certificate_principal); 242 switch (ret) { 243 case 0: 244 break; 245 case SDB_ERR_WRONG_REALM: 246 ret = HDB_ERR_WRONG_REALM; 247 break; 248 case SDB_ERR_NOENTRY: 249 ret = HDB_ERR_NOENTRY; 250 break; 251 default: 252 ret = HDB_ERR_NOT_FOUND_HERE; 253 break; 254 } 255 256 return ret; 257 } 258 259 static krb5_error_code 260 hdb_samba4_check_s4u2self(krb5_context context, HDB *db, 261 hdb_entry_ex *entry, 262 krb5_const_principal target_principal) 263 { 264 struct samba_kdc_db_context *kdc_db_ctx; 265 struct samba_kdc_entry *skdc_entry; 266 krb5_error_code ret; 267 268 kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 269 struct samba_kdc_db_context); 270 skdc_entry = talloc_get_type_abort(entry->ctx, 271 struct samba_kdc_entry); 272 273 ret = samba_kdc_check_s4u2self(context, kdc_db_ctx, 274 skdc_entry, 275 target_principal); 276 switch (ret) { 277 case 0: 278 break; 279 case SDB_ERR_WRONG_REALM: 280 ret = HDB_ERR_WRONG_REALM; 281 break; 282 case SDB_ERR_NOENTRY: 283 ret = HDB_ERR_NOENTRY; 284 break; 285 default: 286 ret = HDB_ERR_NOT_FOUND_HERE; 287 break; 288 } 289 290 return ret; 291 } 292 293 static krb5_error_code hdb_samba4_auth_status(krb5_context context, HDB *db, 294 hdb_entry_ex *entry, 295 int hdb_auth_status) 296 { 297 struct samba_kdc_db_context *kdc_db_ctx = talloc_get_type_abort(db->hdb_db, 298 struct samba_kdc_db_context); 299 struct samba_kdc_entry *p = talloc_get_type(entry->ctx, struct samba_kdc_entry); 300 301 struct ldb_dn *domain_dn = ldb_get_default_basedn(kdc_db_ctx->samdb); 302 303 if (hdb_auth_status == HDB_AUTH_WRONG_PASSWORD) { 304 authsam_update_bad_pwd_count(kdc_db_ctx->samdb, p->msg, domain_dn); 305 } else if (hdb_auth_status == HDB_AUTH_SUCCESS) { 306 authsam_logon_success_accounting(kdc_db_ctx->samdb, p->msg, 307 domain_dn, true); 308 } 309 return 0; 151 310 } 152 311 … … 162 321 NTSTATUS nt_status; 163 322 323 if (hdb_interface_version != HDB_INTERFACE_VERSION) { 324 krb5_set_error_message(context, EINVAL, "Heimdal HDB interface version mismatch between build-time and run-time libraries!"); 325 return NT_STATUS_ERROR_DS_INCOMPATIBLE_VERSION; 326 } 327 164 328 *db = talloc(base_ctx, HDB); 165 329 if (!*db) { … … 170 334 (*db)->hdb_master_key_set = 0; 171 335 (*db)->hdb_db = NULL; 172 (*db)->hdb_capability_flags = 0;336 (*db)->hdb_capability_flags = HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL; 173 337 174 338 nt_status = samba_kdc_setup_db_ctx(*db, base_ctx, &kdc_db_ctx); … … 197 361 (*db)->hdb_destroy = hdb_samba4_destroy; 198 362 199 (*db)->hdb_auth_status = NULL;200 (*db)->hdb_check_constrained_delegation = hdb_samba4_check_ identical_client_and_server;363 (*db)->hdb_auth_status = hdb_samba4_auth_status; 364 (*db)->hdb_check_constrained_delegation = hdb_samba4_check_constrained_delegation; 201 365 (*db)->hdb_check_pkinit_ms_upn_match = hdb_samba4_check_pkinit_ms_upn_match; 202 (*db)->hdb_check_s4u2self = hdb_samba4_check_ identical_client_and_server;366 (*db)->hdb_check_s4u2self = hdb_samba4_check_s4u2self; 203 367 204 368 return NT_STATUS_OK; 205 369 } 206 207 static krb5_error_code hdb_samba4_create(krb5_context context, struct HDB **db, const char *arg)208 {209 NTSTATUS nt_status;210 void *ptr;211 struct samba_kdc_base_context *base_ctx;212 213 if (sscanf(arg, "&%p", &ptr) != 1) {214 return EINVAL;215 }216 base_ctx = talloc_get_type_abort(ptr, struct samba_kdc_base_context);217 /* The global kdc_mem_ctx and kdc_lp_ctx, Disgusting, ugly hack, but it means one less private hook */218 nt_status = hdb_samba4_create_kdc(base_ctx, context, db);219 220 if (NT_STATUS_IS_OK(nt_status)) {221 return 0;222 }223 return EINVAL;224 }225 226 /* Only used in the hdb-backed keytab code227 * for a keytab of 'samba4&<address>', to find228 * kpasswd's key in the main DB, and to229 * copy all the keys into a file (libnet_keytab_export)230 *231 * The <address> is the string form of a pointer to a talloced struct hdb_samba_context232 */233 struct hdb_method hdb_samba4 = {234 .interface_version = HDB_INTERFACE_VERSION,235 .prefix = "samba4",236 .create = hdb_samba4_create237 };
Note:
See TracChangeset
for help on using the changeset viewer.
