2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
7 Copyright (C) Andrew Tridgell 2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "smbd/process_model.h"
26 #include "lib/tsocket/tsocket.h"
27 #include "lib/messaging/irpc.h"
28 #include "librpc/gen_ndr/ndr_irpc.h"
29 #include "librpc/gen_ndr/ndr_krb5pac.h"
30 #include "lib/socket/netif.h"
31 #include "param/param.h"
32 #include "kdc/kdc-server.h"
33 #include "kdc/kdc-proxy.h"
34 #include "kdc/kdc-glue.h"
35 #include "kdc/pac-glue.h"
36 #include "kdc/kpasswd-service.h"
37 #include "dsdb/samdb/samdb.h"
38 #include "auth/session.h"
39 #include "libds/common/roles.h"
43 NTSTATUS server_service_kdc_init(TALLOC_CTX *);
45 extern struct krb5plugin_windc_ftable windc_plugin_table;
48 Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
52 static kdc_code kdc_process(struct kdc_server *kdc,
56 struct tsocket_address *peer_addr,
57 struct tsocket_address *my_addr,
62 struct sockaddr_storage ss;
64 krb5_kdc_configuration *kdc_config =
65 (krb5_kdc_configuration *)kdc->private_data;
67 krb5_data_zero(&k5_reply);
69 krb5_kdc_update_time(NULL);
71 ret = tsocket_address_bsd_sockaddr(peer_addr, (struct sockaddr *) &ss,
72 sizeof(struct sockaddr_storage));
76 pa = tsocket_address_string(peer_addr, mem_ctx);
81 DEBUG(10,("Received KDC packet of length %lu from %s\n",
82 (long)input->length - 4, pa));
84 ret = krb5_kdc_process_krb5_request(kdc->smb_krb5_context->krb5_context,
86 input->data, input->length,
89 (struct sockaddr *) &ss,
92 *reply = data_blob(NULL, 0);
96 if (ret == HDB_ERR_NOT_FOUND_HERE) {
97 *reply = data_blob(NULL, 0);
98 return KDC_PROXY_REQUEST;
101 if (k5_reply.length) {
102 *reply = data_blob_talloc(mem_ctx, k5_reply.data, k5_reply.length);
103 krb5_data_free(&k5_reply);
105 *reply = data_blob(NULL, 0);
111 setup our listening sockets on the configured network interfaces
113 static NTSTATUS kdc_startup_interfaces(struct kdc_server *kdc,
114 struct loadparm_context *lp_ctx,
115 struct interface *ifaces,
116 const struct model_ops *model_ops)
119 TALLOC_CTX *tmp_ctx = talloc_new(kdc);
122 uint16_t kdc_port = lpcfg_krb5_port(lp_ctx);
123 uint16_t kpasswd_port = lpcfg_kpasswd_port(lp_ctx);
124 bool done_wildcard = false;
126 num_interfaces = iface_list_count(ifaces);
128 /* if we are allowing incoming packets from any address, then
129 we need to bind to the wildcard address */
130 if (!lpcfg_bind_interfaces_only(lp_ctx)) {
132 char **wcard = iface_list_wildcard(kdc);
133 NT_STATUS_HAVE_NO_MEMORY(wcard);
134 for (i=0; wcard[i]; i++) {
136 status = kdc_add_socket(kdc, model_ops,
137 "kdc", wcard[i], kdc_port,
139 if (NT_STATUS_IS_OK(status)) {
145 status = kdc_add_socket(kdc, model_ops,
146 "kpasswd", wcard[i], kpasswd_port,
147 kpasswd_process, false);
148 if (NT_STATUS_IS_OK(status)) {
154 if (num_binds == 0) {
155 return NT_STATUS_INVALID_PARAMETER_MIX;
157 done_wildcard = true;
160 for (i=0; i<num_interfaces; i++) {
161 const char *address = talloc_strdup(tmp_ctx, iface_list_n_ip(ifaces, i));
164 status = kdc_add_socket(kdc, model_ops,
165 "kdc", address, kdc_port,
166 kdc_process, done_wildcard);
167 NT_STATUS_NOT_OK_RETURN(status);
171 status = kdc_add_socket(kdc, model_ops,
172 "kpasswd", address, kpasswd_port,
173 kpasswd_process, done_wildcard);
174 NT_STATUS_NOT_OK_RETURN(status);
178 talloc_free(tmp_ctx);
183 static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg,
184 struct kdc_check_generic_kerberos *r)
186 struct PAC_Validate pac_validate;
188 struct PAC_SIGNATURE_DATA kdc_sig;
189 struct kdc_server *kdc = talloc_get_type(msg->private_data, struct kdc_server);
190 krb5_kdc_configuration *kdc_config =
191 (krb5_kdc_configuration *)kdc->private_data;
192 enum ndr_err_code ndr_err;
195 krb5_principal principal;
198 /* There is no reply to this request */
199 r->out.generic_reply = data_blob(NULL, 0);
201 ndr_err = ndr_pull_struct_blob(&r->in.generic_request, msg, &pac_validate,
202 (ndr_pull_flags_fn_t)ndr_pull_PAC_Validate);
203 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
204 return NT_STATUS_INVALID_PARAMETER;
207 if (pac_validate.MessageType != NETLOGON_GENERIC_KRB5_PAC_VALIDATE) {
208 /* We don't implement any other message types - such as certificate validation - yet */
209 return NT_STATUS_INVALID_PARAMETER;
212 if (pac_validate.ChecksumAndSignature.length != (pac_validate.ChecksumLength + pac_validate.SignatureLength)
213 || pac_validate.ChecksumAndSignature.length < pac_validate.ChecksumLength
214 || pac_validate.ChecksumAndSignature.length < pac_validate.SignatureLength ) {
215 return NT_STATUS_INVALID_PARAMETER;
218 srv_sig = data_blob_const(pac_validate.ChecksumAndSignature.data,
219 pac_validate.ChecksumLength);
221 ret = krb5_make_principal(kdc->smb_krb5_context->krb5_context, &principal,
222 lpcfg_realm(kdc->task->lp_ctx),
223 "krbtgt", lpcfg_realm(kdc->task->lp_ctx),
227 return NT_STATUS_NO_MEMORY;
230 ret = kdc_config->db[0]->hdb_fetch_kvno(kdc->smb_krb5_context->krb5_context,
233 HDB_F_GET_KRBTGT | HDB_F_DECRYPT,
238 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
239 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
241 return NT_STATUS_LOGON_FAILURE;
244 kdc_sig.type = pac_validate.SignatureType;
245 kdc_sig.signature = data_blob_const(&pac_validate.ChecksumAndSignature.data[pac_validate.ChecksumLength],
246 pac_validate.SignatureLength);
248 ret = kdc_check_pac(kdc->smb_krb5_context->krb5_context, srv_sig, &kdc_sig, &ent);
250 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
251 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
254 return NT_STATUS_LOGON_FAILURE;
264 static NTSTATUS kdc_task_init(struct task_server *task)
266 struct kdc_server *kdc;
267 krb5_kdc_configuration *kdc_config = NULL;
270 struct interface *ifaces;
273 switch (lpcfg_server_role(task->lp_ctx)) {
274 case ROLE_STANDALONE:
275 task_server_terminate(task, "kdc: no KDC required in standalone configuration", false);
276 return NT_STATUS_INVALID_DOMAIN_ROLE;
277 case ROLE_DOMAIN_MEMBER:
278 task_server_terminate(task, "kdc: no KDC required in member server configuration", false);
279 return NT_STATUS_INVALID_DOMAIN_ROLE;
280 case ROLE_DOMAIN_PDC:
281 case ROLE_DOMAIN_BDC:
282 task_server_terminate(task, "Cannot start KDC as a 'classic Samba' DC", true);
283 return NT_STATUS_INVALID_DOMAIN_ROLE;
284 case ROLE_ACTIVE_DIRECTORY_DC:
285 /* Yes, we want a KDC */
289 load_interface_list(task, task->lp_ctx, &ifaces);
291 if (iface_list_count(ifaces) == 0) {
292 task_server_terminate(task, "kdc: no network interfaces configured", false);
293 return NT_STATUS_UNSUCCESSFUL;
296 task_server_set_title(task, "task[kdc]");
298 kdc = talloc_zero(task, struct kdc_server);
300 task_server_terminate(task, "kdc: out of memory", true);
301 return NT_STATUS_NO_MEMORY;
307 /* get a samdb connection */
308 kdc->samdb = samdb_connect(kdc,
309 kdc->task->event_ctx,
311 system_session(kdc->task->lp_ctx),
315 DEBUG(1,("kdc_task_init: unable to connect to samdb\n"));
316 task_server_terminate(task, "kdc: krb5_init_context samdb connect failed", true);
317 return NT_STATUS_UNSUCCESSFUL;
320 ldb_ret = samdb_rodc(kdc->samdb, &kdc->am_rodc);
321 if (ldb_ret != LDB_SUCCESS) {
322 DEBUG(1, ("kdc_task_init: Cannot determine if we are an RODC: %s\n",
323 ldb_errstring(kdc->samdb)));
324 task_server_terminate(task, "kdc: krb5_init_context samdb RODC connect failed", true);
325 return NT_STATUS_UNSUCCESSFUL;
328 kdc->proxy_timeout = lpcfg_parm_int(kdc->task->lp_ctx, NULL, "kdc", "proxy timeout", 5);
330 initialize_krb5_error_table();
332 ret = smb_krb5_init_context(kdc, task->lp_ctx, &kdc->smb_krb5_context);
334 DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n",
335 error_message(ret)));
336 task_server_terminate(task, "kdc: krb5_init_context failed", true);
337 return NT_STATUS_UNSUCCESSFUL;
340 krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r);
342 ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context,
345 task_server_terminate(task, "kdc: failed to get KDC configuration", true);
346 return NT_STATUS_UNSUCCESSFUL;
349 kdc_config->logf = (krb5_log_facility *)kdc->smb_krb5_context->pvt_log_data;
350 kdc_config->db = talloc(kdc, struct HDB *);
351 if (!kdc_config->db) {
352 task_server_terminate(task, "kdc: out of memory", true);
353 return NT_STATUS_UNSUCCESSFUL;
355 kdc_config->num_db = 1;
358 * This restores the behavior before
359 * commit 255e3e18e00f717d99f3bc57c8a8895ff624f3c3
360 * s4:heimdal: import lorikeet-heimdal-201107150856
361 * (commit 48936803fae4a2fb362c79365d31f420c917b85b)
363 * as_use_strongest_session_key,preauth_use_strongest_session_key
364 * and tgs_use_strongest_session_key are input to the
365 * _kdc_find_etype() function. The old bahavior is in
366 * the use_strongest_session_key=FALSE code path.
367 * (The only remaining difference in _kdc_find_etype()
368 * is the is_preauth parameter.)
370 * The old behavior in the _kdc_get_preferred_key()
371 * function is use_strongest_server_key=TRUE.
373 kdc_config->as_use_strongest_session_key = false;
374 kdc_config->preauth_use_strongest_session_key = false;
375 kdc_config->tgs_use_strongest_session_key = false;
376 kdc_config->use_strongest_server_key = true;
378 kdc_config->autodetect_referrals = false;
380 /* Register hdb-samba4 hooks for use as a keytab */
382 kdc->base_ctx = talloc_zero(kdc, struct samba_kdc_base_context);
383 if (!kdc->base_ctx) {
384 task_server_terminate(task, "kdc: out of memory", true);
385 return NT_STATUS_NO_MEMORY;
388 kdc->base_ctx->ev_ctx = task->event_ctx;
389 kdc->base_ctx->lp_ctx = task->lp_ctx;
390 kdc->base_ctx->msg_ctx = task->msg_ctx;
392 status = hdb_samba4_create_kdc(kdc->base_ctx,
393 kdc->smb_krb5_context->krb5_context,
395 if (!NT_STATUS_IS_OK(status)) {
396 task_server_terminate(task, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
400 ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
401 PLUGIN_TYPE_DATA, "hdb",
402 &hdb_samba4_interface);
404 task_server_terminate(task, "kdc: failed to register hdb plugin", true);
405 return NT_STATUS_UNSUCCESSFUL;
408 ret = krb5_kt_register(kdc->smb_krb5_context->krb5_context, &hdb_kt_ops);
410 task_server_terminate(task, "kdc: failed to register keytab plugin", true);
411 return NT_STATUS_UNSUCCESSFUL;
414 kdc->keytab_name = talloc_asprintf(kdc, "HDB:samba4&%p", kdc->base_ctx);
415 if (kdc->keytab_name == NULL) {
416 task_server_terminate(task,
417 "kdc: Failed to set keytab name",
419 return NT_STATUS_UNSUCCESSFUL;
422 /* Register WinDC hooks */
423 ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
424 PLUGIN_TYPE_DATA, "windc",
425 &windc_plugin_table);
427 task_server_terminate(task, "kdc: failed to register windc plugin", true);
428 return NT_STATUS_UNSUCCESSFUL;
431 ret = krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
434 task_server_terminate(task, "kdc: failed to init windc plugin", true);
435 return NT_STATUS_UNSUCCESSFUL;
438 ret = krb5_kdc_pkinit_config(kdc->smb_krb5_context->krb5_context, kdc_config);
441 task_server_terminate(task, "kdc: failed to init kdc pkinit subsystem", true);
442 return NT_STATUS_UNSUCCESSFUL;
444 kdc->private_data = kdc_config;
446 /* start listening on the configured network interfaces */
447 status = kdc_startup_interfaces(kdc, task->lp_ctx, ifaces,
449 if (!NT_STATUS_IS_OK(status)) {
450 task_server_terminate(task, "kdc failed to setup interfaces", true);
454 status = IRPC_REGISTER(task->msg_ctx, irpc, KDC_CHECK_GENERIC_KERBEROS,
455 kdc_check_generic_kerberos, kdc);
456 if (!NT_STATUS_IS_OK(status)) {
457 task_server_terminate(task, "kdc failed to setup monitoring", true);
461 irpc_add_name(task->msg_ctx, "kdc_server");
467 /* called at smbd startup - register ourselves as a server service */
468 NTSTATUS server_service_kdc_init(TALLOC_CTX *ctx)
470 static const struct service_details details = {
471 .inhibit_fork_on_accept = true,
473 * Need to prevent pre-forking on kdc.
474 * The task_init function is run on the master process only
475 * and the irpc process name is registered in it's event loop.
476 * The child worker processes initialise their event loops on
477 * fork, so are not listening for the irpc event.
479 * The master process does not wait on that event context
480 * the master process is responsible for managing the worker
481 * processes not performing work.
483 .inhibit_pre_fork = true,
484 .task_init = kdc_task_init,
487 return register_server_service(ctx, "kdc", &details);