source4/auth/gensec/schannel_state.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    module to store/fetch session keys for the schannel server
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "lib/ldb/include/ldb.h"
  24 #include "lib/ldb/include/ldb_errors.h"
  25 #include "dsdb/samdb/samdb.h"
  26 #include "ldb_wrap.h"
  27 #include "util/util_ldb.h"
  28 #include "libcli/auth/libcli_auth.h"
  29 #include "auth/auth.h"
  30 #include "param/param.h"
  31
  32 /**
  33   connect to the schannel ldb
  34 */
  35 struct ldb_context *schannel_db_connect(TALLOC_CTX *mem_ctx, struct event_context *ev_ctx,
  36                                         struct loadparm_context *lp_ctx)
  37 {
  38         char *path;
  39         struct ldb_context *ldb;
  40         bool existed;
  41         const char *init_ldif =
  42                 "dn: @ATTRIBUTES\n" \
  43                 "computerName: CASE_INSENSITIVE\n" \
  44                 "flatname: CASE_INSENSITIVE\n";
  45
  46         path = smbd_tmp_path(mem_ctx, lp_ctx, "schannel.ldb");
  47         if (!path) {
  48                 return NULL;
  49         }
  50
  51         existed = file_exist(path);
  52
  53         ldb = ldb_wrap_connect(mem_ctx, ev_ctx, lp_ctx, path,
  54                                system_session(mem_ctx, lp_ctx),
  55                                NULL, LDB_FLG_NOSYNC, NULL);
  56         talloc_free(path);
  57         if (!ldb) {
  58                 return NULL;
  59         }
  60
  61         if (!existed) {
  62                 gendb_add_ldif(ldb, init_ldif);
  63         }
  64
  65         return ldb;
  66 }
  67
  68 /*
  69   remember an established session key for a netr server authentication
  70   use a simple ldb structure
  71 */
  72 NTSTATUS schannel_store_session_key_ldb(TALLOC_CTX *mem_ctx,
  73                                         struct ldb_context *ldb,
  74                                         struct creds_CredentialState *creds)
  75 {
  76         struct ldb_message *msg;
  77         struct ldb_val val, seed, client_state, server_state;
  78         char *f;
  79         char *sct;
  80         int ret;
  81
  82         f = talloc_asprintf(mem_ctx, "%u", (unsigned int)creds->negotiate_flags);
  83
  84         if (f == NULL) {
  85                 return NT_STATUS_NO_MEMORY;
  86         }
  87
  88         sct = talloc_asprintf(mem_ctx, "%u", (unsigned int)creds->secure_channel_type);
  89
  90         if (sct == NULL) {
  91                 return NT_STATUS_NO_MEMORY;
  92         }
  93
  94         msg = ldb_msg_new(ldb);
  95         if (msg == NULL) {
  96                 return NT_STATUS_NO_MEMORY;
  97         }
  98
  99         msg->dn = ldb_dn_new_fmt(msg, ldb, "computerName=%s", creds->computer_name);
 100         if ( ! msg->dn) {
 101                 return NT_STATUS_NO_MEMORY;
 102         }
 103
 104         val.data = creds->session_key;
 105         val.length = sizeof(creds->session_key);
 106
 107         seed.data = creds->seed.data;
 108         seed.length = sizeof(creds->seed.data);
 109
 110         client_state.data = creds->client.data;
 111         client_state.length = sizeof(creds->client.data);
 112         server_state.data = creds->server.data;
 113         server_state.length = sizeof(creds->server.data);
 114
 115         ldb_msg_add_string(msg, "objectClass", "schannelState");
 116         ldb_msg_add_value(msg, "sessionKey", &val, NULL);
 117         ldb_msg_add_value(msg, "seed", &seed, NULL);
 118         ldb_msg_add_value(msg, "clientState", &client_state, NULL);
 119         ldb_msg_add_value(msg, "serverState", &server_state, NULL);
 120         ldb_msg_add_string(msg, "negotiateFlags", f);
 121         ldb_msg_add_string(msg, "secureChannelType", sct);
 122         ldb_msg_add_string(msg, "accountName", creds->account_name);
 123         ldb_msg_add_string(msg, "computerName", creds->computer_name);
 124         ldb_msg_add_string(msg, "flatname", creds->domain);
 125         samdb_msg_add_dom_sid(ldb, mem_ctx, msg, "objectSid", creds->sid);
 126
 127         ldb_delete(ldb, msg->dn);
 128
 129         ret = ldb_add(ldb, msg);
 130
 131         if (ret != 0) {
 132                 DEBUG(0,("Unable to add %s to session key db - %s\n",
 133                          ldb_dn_get_linearized(msg->dn), ldb_errstring(ldb)));
 134                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 135         }
 136
 137         return NT_STATUS_OK;
 138 }
 139
 140 NTSTATUS schannel_store_session_key(TALLOC_CTX *mem_ctx,
 141                                     struct event_context *ev_ctx,
 142                                     struct loadparm_context *lp_ctx,
 143                                     struct creds_CredentialState *creds)
 144 {
 145         struct ldb_context *ldb;
 146         NTSTATUS nt_status;
 147         int ret;
 148
 149         ldb = schannel_db_connect(mem_ctx, ev_ctx, lp_ctx);
 150         if (!ldb) {
 151                 return NT_STATUS_ACCESS_DENIED;
 152         }
 153
 154         ret = ldb_transaction_start(ldb);
 155         if (ret != 0) {
 156                 talloc_free(ldb);
 157                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 158         }
 159
 160         nt_status = schannel_store_session_key_ldb(mem_ctx, ldb, creds);
 161
 162         if (NT_STATUS_IS_OK(nt_status)) {
 163                 ret = ldb_transaction_commit(ldb);
 164         } else {
 165                 ret = ldb_transaction_cancel(ldb);
 166         }
 167
 168         if (ret != 0) {
 169                 DEBUG(0,("Unable to commit adding credentials for %s to schannel key db - %s\n",
 170                          creds->computer_name, ldb_errstring(ldb)));
 171                 talloc_free(ldb);
 172                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 173         }
 174
 175         talloc_free(ldb);
 176         return nt_status;
 177 }
 178
 179 /*
 180   read back a credentials back for a computer
 181 */
 182 NTSTATUS schannel_fetch_session_key_ldb(TALLOC_CTX *mem_ctx,
 183                                         struct ldb_context *ldb,
 184                                         const char *computer_name,
 185                                         const char *domain,
 186                                         struct creds_CredentialState **creds)
 187 {
 188         struct ldb_result *res;
 189         int ret;
 190         const struct ldb_val *val;
 191
 192         *creds = talloc_zero(mem_ctx, struct creds_CredentialState);
 193         if (!*creds) {
 194                 return NT_STATUS_NO_MEMORY;
 195         }
 196
 197         ret = ldb_search_exp_fmt(ldb, mem_ctx, &res,
 198                                  NULL, LDB_SCOPE_SUBTREE, NULL,
 199                                 "(&(computerName=%s)(flatname=%s))", computer_name, domain);
 200         if (ret != LDB_SUCCESS) {
 201                 DEBUG(3,("schannel: Failed to find a record for client %s: %s\n", computer_name, ldb_errstring(ldb)));
 202                 return NT_STATUS_INVALID_HANDLE;
 203         }
 204         if (res->count != 1) {
 205                 DEBUG(3,("schannel: Failed to find a record for client: %s (found %d records)\n", computer_name, res->count));
 206                 talloc_free(res);
 207                 return NT_STATUS_INVALID_HANDLE;
 208         }
 209
 210         val = ldb_msg_find_ldb_val(res->msgs[0], "sessionKey");
 211         if (val == NULL || val->length != 16) {
 212                 DEBUG(1,("schannel: record in schannel DB must contain a sessionKey of length 16, when searching for client: %s\n", computer_name));
 213                 talloc_free(res);
 214                 return NT_STATUS_INTERNAL_ERROR;
 215         }
 216
 217         memcpy((*creds)->session_key, val->data, 16);
 218
 219         val = ldb_msg_find_ldb_val(res->msgs[0], "seed");
 220         if (val == NULL || val->length != 8) {
 221                 DEBUG(1,("schannel: record in schannel DB must contain a vaid seed of length 8, when searching for client: %s\n", computer_name));
 222                 talloc_free(res);
 223                 return NT_STATUS_INTERNAL_ERROR;
 224         }
 225
 226         memcpy((*creds)->seed.data, val->data, 8);
 227
 228         val = ldb_msg_find_ldb_val(res->msgs[0], "clientState");
 229         if (val == NULL || val->length != 8) {
 230                 DEBUG(1,("schannel: record in schannel DB must contain a vaid clientState of length 8, when searching for client: %s\n", computer_name));
 231                 talloc_free(res);
 232                 return NT_STATUS_INTERNAL_ERROR;
 233         }
 234         memcpy((*creds)->client.data, val->data, 8);
 235
 236         val = ldb_msg_find_ldb_val(res->msgs[0], "serverState");
 237         if (val == NULL || val->length != 8) {
 238                 DEBUG(1,("schannel: record in schannel DB must contain a vaid serverState of length 8, when searching for client: %s\n", computer_name));
 239                 talloc_free(res);
 240                 return NT_STATUS_INTERNAL_ERROR;
 241         }
 242         memcpy((*creds)->server.data, val->data, 8);
 243
 244         (*creds)->negotiate_flags = ldb_msg_find_attr_as_int(res->msgs[0], "negotiateFlags", 0);
 245
 246         (*creds)->secure_channel_type = ldb_msg_find_attr_as_int(res->msgs[0], "secureChannelType", 0);
 247
 248         (*creds)->account_name = talloc_strdup(*creds, ldb_msg_find_attr_as_string(res->msgs[0], "accountName", NULL));
 249         if ((*creds)->account_name == NULL) {
 250                 talloc_free(res);
 251                 return NT_STATUS_NO_MEMORY;
 252         }
 253
 254         (*creds)->computer_name = talloc_strdup(*creds, ldb_msg_find_attr_as_string(res->msgs[0], "computerName", NULL));
 255         if ((*creds)->computer_name == NULL) {
 256                 talloc_free(res);
 257                 return NT_STATUS_NO_MEMORY;
 258         }
 259
 260         (*creds)->domain = talloc_strdup(*creds, ldb_msg_find_attr_as_string(res->msgs[0], "flatname", NULL));
 261         if ((*creds)->domain == NULL) {
 262                 talloc_free(res);
 263                 return NT_STATUS_NO_MEMORY;
 264         }
 265
 266         (*creds)->sid = samdb_result_dom_sid(*creds, res->msgs[0], "objectSid");
 267
 268         talloc_free(res);
 269         return NT_STATUS_OK;
 270 }
 271
 272 NTSTATUS schannel_fetch_session_key(TALLOC_CTX *mem_ctx,
 273                                     struct event_context *ev_ctx,
 274                                     struct loadparm_context *lp_ctx,
 275                                         const char *computer_name,
 276                                         const char *domain,
 277                                         struct creds_CredentialState **creds)
 278 {
 279         NTSTATUS nt_status;
 280         struct ldb_context *ldb;
 281
 282         ldb = schannel_db_connect(mem_ctx, ev_ctx, lp_ctx);
 283         if (!ldb) {
 284                 return NT_STATUS_ACCESS_DENIED;
 285         }
 286
 287         nt_status = schannel_fetch_session_key_ldb(mem_ctx, ldb,
 288                                                    computer_name, domain,
 289                                                    creds);
 290         talloc_free(ldb);
 291         return nt_status;
 292 }