2 Unix SMB/CIFS implementation.
4 Copyright (C) Guenther Deschner <gd@samba.org> 2008
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "libnet/libnet.h"
22 #include "librpc/gen_ndr/ndr_drsblobs.h"
24 #if defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC)
26 static NTSTATUS add_to_keytab_entries(TALLOC_CTX *mem_ctx,
27 struct libnet_keytab_context *ctx,
31 const krb5_enctype enctype,
34 struct libnet_keytab_entry entry;
37 entry.name = talloc_strdup(mem_ctx, name);
38 entry.principal = talloc_asprintf(mem_ctx, "%s%s%s@%s",
41 name, ctx->dns_domain_name);
42 entry.enctype = enctype;
43 entry.password = blob;
44 NT_STATUS_HAVE_NO_MEMORY(entry.name);
45 NT_STATUS_HAVE_NO_MEMORY(entry.principal);
46 NT_STATUS_HAVE_NO_MEMORY(entry.password.data);
48 ADD_TO_ARRAY(mem_ctx, struct libnet_keytab_entry, entry,
49 &ctx->entries, &ctx->count);
50 NT_STATUS_HAVE_NO_MEMORY(ctx->entries);
55 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
56 struct replUpToDateVectorBlob **pold_utdv)
58 krb5_error_code ret = 0;
59 struct libnet_keytab_context *keytab_ctx;
60 struct libnet_keytab_entry *entry;
61 struct replUpToDateVectorBlob *old_utdv = NULL;
64 ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
66 return krb5_to_nt_status(ret);
69 keytab_ctx->dns_domain_name = ctx->dns_domain_name;
70 ctx->private_data = keytab_ctx;
72 principal = talloc_asprintf(mem_ctx, "UTDV/%s@%s",
73 ctx->nc_dn, ctx->dns_domain_name);
74 NT_STATUS_HAVE_NO_MEMORY(principal);
76 entry = libnet_keytab_search(keytab_ctx, principal, 0, mem_ctx);
78 enum ndr_err_code ndr_err;
79 old_utdv = talloc(mem_ctx, struct replUpToDateVectorBlob);
81 ndr_err = ndr_pull_struct_blob(&entry->password, old_utdv,
83 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
84 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
85 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
86 ctx->error_message = talloc_asprintf(mem_ctx,
87 "Failed to pull UpToDateVector: %s",
92 if (DEBUGLEVEL >= 10) {
93 NDR_PRINT_DEBUG(replUpToDateVectorBlob, old_utdv);
98 *pold_utdv = old_utdv;
104 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
105 struct replUpToDateVectorBlob *new_utdv)
107 NTSTATUS status = NT_STATUS_OK;
108 krb5_error_code ret = 0;
109 struct libnet_keytab_context *keytab_ctx =
110 (struct libnet_keytab_context *)ctx->private_data;
113 enum ndr_err_code ndr_err;
116 if (DEBUGLEVEL >= 10) {
117 NDR_PRINT_DEBUG(replUpToDateVectorBlob, new_utdv);
120 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, new_utdv,
121 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
122 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
123 status = ndr_map_error2ntstatus(ndr_err);
124 ctx->error_message = talloc_asprintf(mem_ctx,
125 "Failed to push UpToDateVector: %s",
130 status = add_to_keytab_entries(mem_ctx, keytab_ctx, 0,
133 if (!NT_STATUS_IS_OK(status)) {
138 ret = libnet_keytab_add(keytab_ctx);
140 status = krb5_to_nt_status(ret);
141 ctx->error_message = talloc_asprintf(mem_ctx,
142 "Failed to add entries to keytab %s: %s",
143 keytab_ctx->keytab_name, error_message(ret));
147 ctx->result_message = talloc_asprintf(mem_ctx,
148 "Vampired %d accounts to keytab %s",
150 keytab_ctx->keytab_name);
153 TALLOC_FREE(keytab_ctx);
157 /****************************************************************
158 ****************************************************************/
160 static NTSTATUS parse_object(TALLOC_CTX *mem_ctx,
161 struct libnet_keytab_context *ctx,
162 struct drsuapi_DsReplicaObjectListItemEx *cur)
164 NTSTATUS status = NT_STATUS_OK;
168 struct drsuapi_DsReplicaAttribute *attr;
169 bool got_pwd = false;
175 uint32_t sam_type = 0;
177 uint32_t pwd_history_len = 0;
178 uint8_t *pwd_history = NULL;
180 ZERO_STRUCT(nt_passwd);
182 for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
184 attr = &cur->object.attribute_ctr.attributes[i];
186 if (attr->value_ctr.num_values != 1) {
190 if (!attr->value_ctr.values[0].blob) {
194 blob = attr->value_ctr.values[0].blob;
196 switch (attr->attid) {
197 case DRSUAPI_ATTRIBUTE_unicodePwd:
199 if (blob->length != 16) {
203 memcpy(&nt_passwd, blob->data, 16);
206 /* pick the kvno from the meta_data version,
207 * thanks, metze, for explaining this */
209 if (!cur->meta_data_ctr) {
212 if (cur->meta_data_ctr->count !=
213 cur->object.attribute_ctr.num_attributes) {
216 kvno = cur->meta_data_ctr->meta_data[i].version;
218 case DRSUAPI_ATTRIBUTE_ntPwdHistory:
219 pwd_history_len = blob->length / 16;
220 pwd_history = blob->data;
222 case DRSUAPI_ATTRIBUTE_userPrincipalName:
223 pull_string_talloc(mem_ctx, NULL, 0, &upn,
224 blob->data, blob->length,
227 case DRSUAPI_ATTRIBUTE_sAMAccountName:
228 pull_string_talloc(mem_ctx, NULL, 0, &name,
229 blob->data, blob->length,
232 case DRSUAPI_ATTRIBUTE_sAMAccountType:
233 sam_type = IVAL(blob->data, 0);
235 case DRSUAPI_ATTRIBUTE_userAccountControl:
236 uacc = IVAL(blob->data, 0);
243 if (!got_pwd || !name) {
247 DEBUG(1,("#%02d: %s:%d, ", ctx->count, name, kvno));
248 DEBUGADD(1,("sAMAccountType: 0x%08x, userAccountControl: 0x%08x ",
251 DEBUGADD(1,("upn: %s", upn));
255 status = add_to_keytab_entries(mem_ctx, ctx, kvno, name, NULL,
256 ENCTYPE_ARCFOUR_HMAC,
257 data_blob_talloc(mem_ctx, nt_passwd, 16));
259 if (!NT_STATUS_IS_OK(status)) {
263 if ((kvno < 0) && (kvno < pwd_history_len)) {
267 /* add password history */
269 /* skip first entry */
277 for (; i<pwd_history_len; i++) {
278 status = add_to_keytab_entries(mem_ctx, ctx, kvno--, name, NULL,
279 ENCTYPE_ARCFOUR_HMAC,
280 data_blob_talloc(mem_ctx, &pwd_history[i*16], 16));
281 if (!NT_STATUS_IS_OK(status)) {
289 /****************************************************************
290 ****************************************************************/
292 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
294 struct drsuapi_DsReplicaObjectListItemEx *cur,
295 struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
297 NTSTATUS status = NT_STATUS_OK;
298 struct libnet_keytab_context *keytab_ctx =
299 (struct libnet_keytab_context *)ctx->private_data;
301 for (; cur; cur = cur->next_object) {
302 status = parse_object(mem_ctx, keytab_ctx, cur);
303 if (!NT_STATUS_IS_OK(status)) {
314 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
315 struct replUpToDateVectorBlob **pold_utdv)
317 return NT_STATUS_NOT_SUPPORTED;
320 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
321 struct replUpToDateVectorBlob *new_utdv)
323 return NT_STATUS_NOT_SUPPORTED;
326 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
328 struct drsuapi_DsReplicaObjectListItemEx *cur,
329 struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
331 return NT_STATUS_NOT_SUPPORTED;
333 #endif /* defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC) */
335 const struct dssync_ops libnet_dssync_keytab_ops = {
336 .startup = keytab_startup,
337 .process_objects = keytab_process_objects,
338 .finish = keytab_finish,