source4/kdc/kdc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    KDC Server startup
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
   7    Copyright (C) Andrew Tridgell        2005
   8    Copyright (C) Stefan Metzmacher      2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "smbd/service_task.h"
  26 #include "smbd/service.h"
  27 #include "smbd/service_stream.h"
  28 #include "smbd/process_model.h"
  29 #include "lib/events/events.h"
  30 #include "lib/socket/socket.h"
  31 #include "lib/tsocket/tsocket.h"
  32 #include "libcli/util/tstream.h"
  33 #include "system/network.h"
  34 #include "../lib/util/dlinklist.h"
  35 #include "lib/messaging/irpc.h"
  36 #include "lib/stream/packet.h"
  37 #include "librpc/gen_ndr/samr.h"
  38 #include "librpc/gen_ndr/ndr_irpc.h"
  39 #include "librpc/gen_ndr/ndr_krb5pac.h"
  40 #include "lib/socket/netif.h"
  41 #include "param/param.h"
  42 #include "kdc/kdc.h"
  43 #include "librpc/gen_ndr/ndr_misc.h"
  44
  45
  46 /* Disgusting hack to get a mem_ctx and lp_ctx into the hdb plugin, when
  47  * used as a keytab */
  48 TALLOC_CTX *hdb_samba4_mem_ctx;
  49 struct tevent_context *hdb_samba4_ev_ctx;
  50 struct loadparm_context *hdb_samba4_lp_ctx;
  51
  52 typedef bool (*kdc_process_fn_t)(struct kdc_server *kdc,
  53                                  TALLOC_CTX *mem_ctx,
  54                                  DATA_BLOB *input,
  55                                  DATA_BLOB *reply,
  56                                  struct tsocket_address *peer_addr,
  57                                  struct tsocket_address *my_addr,
  58                                  int datagram);
  59
  60 /* hold information about one kdc socket */
  61 struct kdc_socket {
  62         struct kdc_server *kdc;
  63         struct tsocket_address *local_address;
  64         kdc_process_fn_t process;
  65 };
  66
  67 /*
  68   state of an open tcp connection
  69 */
  70 struct kdc_tcp_connection {
  71         /* stream connection we belong to */
  72         struct stream_connection *conn;
  73
  74         /* the kdc_server the connection belongs to */
  75         struct kdc_socket *kdc_socket;
  76
  77         struct tstream_context *tstream;
  78
  79         struct tevent_queue *send_queue;
  80 };
  81
  82 static void kdc_tcp_terminate_connection(struct kdc_tcp_connection *kdcconn, const char *reason)
  83 {
  84         stream_terminate_connection(kdcconn->conn, reason);
  85 }
  86
  87 static void kdc_tcp_recv(struct stream_connection *conn, uint16_t flags)
  88 {
  89         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
  90                                                              struct kdc_tcp_connection);
  91         /* this should never be triggered! */
  92         kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_recv: called");
  93 }
  94
  95 static void kdc_tcp_send(struct stream_connection *conn, uint16_t flags)
  96 {
  97         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
  98                                                              struct kdc_tcp_connection);
  99         /* this should never be triggered! */
 100         kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_send: called");
 101 }
 102
 103 /**
 104    Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
 105    calling conventions
 106 */
 107
 108 static bool kdc_process(struct kdc_server *kdc,
 109                         TALLOC_CTX *mem_ctx,
 110                         DATA_BLOB *input,
 111                         DATA_BLOB *reply,
 112                         struct tsocket_address *peer_addr,
 113                         struct tsocket_address *my_addr,
 114                         int datagram_reply)
 115 {
 116         int ret;
 117         char *pa;
 118         struct sockaddr_storage ss;
 119         krb5_data k5_reply;
 120         krb5_data_zero(&k5_reply);
 121
 122         krb5_kdc_update_time(NULL);
 123
 124         ret = tsocket_address_bsd_sockaddr(peer_addr, (struct sockaddr *) &ss,
 125                                 sizeof(struct sockaddr_storage));
 126         if (ret < 0) {
 127                 return false;
 128         }
 129         pa = tsocket_address_string(peer_addr, mem_ctx);
 130         if (pa == NULL) {
 131                 return false;
 132         }
 133
 134         DEBUG(10,("Received KDC packet of length %lu from %s\n",
 135                                 (long)input->length - 4, pa));
 136
 137         ret = krb5_kdc_process_krb5_request(kdc->smb_krb5_context->krb5_context,
 138                                             kdc->config,
 139                                             input->data, input->length,
 140                                             &k5_reply,
 141                                             pa,
 142                                             (struct sockaddr *) &ss,
 143                                             datagram_reply);
 144         if (ret == -1) {
 145                 *reply = data_blob(NULL, 0);
 146                 return false;
 147         }
 148         if (k5_reply.length) {
 149                 *reply = data_blob_talloc(mem_ctx, k5_reply.data, k5_reply.length);
 150                 krb5_data_free(&k5_reply);
 151         } else {
 152                 *reply = data_blob(NULL, 0);
 153         }
 154         return true;
 155 }
 156
 157 struct kdc_tcp_call {
 158         struct kdc_tcp_connection *kdc_conn;
 159         DATA_BLOB in;
 160         DATA_BLOB out;
 161         uint8_t out_hdr[4];
 162         struct iovec out_iov[2];
 163 };
 164
 165 static void kdc_tcp_call_writev_done(struct tevent_req *subreq);
 166
 167 static void kdc_tcp_call_loop(struct tevent_req *subreq)
 168 {
 169         struct kdc_tcp_connection *kdc_conn = tevent_req_callback_data(subreq,
 170                                       struct kdc_tcp_connection);
 171         struct kdc_tcp_call *call;
 172         NTSTATUS status;
 173         bool ok;
 174
 175         call = talloc(kdc_conn, struct kdc_tcp_call);
 176         if (call == NULL) {
 177                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
 178                                 "no memory for kdc_tcp_call");
 179                 return;
 180         }
 181         call->kdc_conn = kdc_conn;
 182
 183         status = tstream_read_pdu_blob_recv(subreq,
 184                                             call,
 185                                             &call->in);
 186         TALLOC_FREE(subreq);
 187         if (!NT_STATUS_IS_OK(status)) {
 188                 const char *reason;
 189
 190                 reason = talloc_asprintf(call, "kdc_tcp_call_loop: "
 191                                          "tstream_read_pdu_blob_recv() - %s",
 192                                          nt_errstr(status));
 193                 if (!reason) {
 194                         reason = nt_errstr(status);
 195                 }
 196
 197                 kdc_tcp_terminate_connection(kdc_conn, reason);
 198                 return;
 199         }
 200
 201         DEBUG(10,("Received krb5 TCP packet of length %lu from %s\n",
 202                  (long) call->in.length,
 203                  tsocket_address_string(kdc_conn->conn->remote_address, call)));
 204
 205         /* skip length header */
 206         call->in.data +=4;
 207         call->in.length -= 4;
 208
 209         /* Call krb5 */
 210         ok = kdc_conn->kdc_socket->process(kdc_conn->kdc_socket->kdc,
 211                                            call,
 212                                            &call->in,
 213                                            &call->out,
 214                                            kdc_conn->conn->remote_address,
 215                                            kdc_conn->conn->local_address,
 216                                            0 /* Stream */);
 217         if (!ok) {
 218                 kdc_tcp_terminate_connection(kdc_conn,
 219                                 "kdc_tcp_call_loop: process function failed");
 220                 return;
 221         }
 222
 223         /* First add the length of the out buffer */
 224         RSIVAL(call->out_hdr, 0, call->out.length);
 225         call->out_iov[0].iov_base = call->out_hdr;
 226         call->out_iov[0].iov_len = 4;
 227
 228         call->out_iov[1].iov_base = call->out.data;
 229         call->out_iov[1].iov_len = call->out.length;
 230
 231         subreq = tstream_writev_queue_send(call,
 232                                            kdc_conn->conn->event.ctx,
 233                                            kdc_conn->tstream,
 234                                            kdc_conn->send_queue,
 235                                            call->out_iov, 2);
 236         if (subreq == NULL) {
 237                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
 238                                 "no memory for tstream_writev_queue_send");
 239                 return;
 240         }
 241         tevent_req_set_callback(subreq, kdc_tcp_call_writev_done, call);
 242
 243         /*
 244          * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
 245          * packet_full_request_u32 provides the pdu length then.
 246          */
 247         subreq = tstream_read_pdu_blob_send(kdc_conn,
 248                                             kdc_conn->conn->event.ctx,
 249                                             kdc_conn->tstream,
 250                                             4, /* initial_read_size */
 251                                             packet_full_request_u32,
 252                                             kdc_conn);
 253         if (subreq == NULL) {
 254                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
 255                                 "no memory for tstream_read_pdu_blob_send");
 256                 return;
 257         }
 258         tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
 259 }
 260
 261 static void kdc_tcp_call_writev_done(struct tevent_req *subreq)
 262 {
 263         struct kdc_tcp_call *call = tevent_req_callback_data(subreq,
 264                         struct kdc_tcp_call);
 265         int sys_errno;
 266         int rc;
 267
 268         rc = tstream_writev_queue_recv(subreq, &sys_errno);
 269         TALLOC_FREE(subreq);
 270         if (rc == -1) {
 271                 const char *reason;
 272
 273                 reason = talloc_asprintf(call, "kdc_tcp_call_writev_done: "
 274                                          "tstream_writev_queue_recv() - %d:%s",
 275                                          sys_errno, strerror(sys_errno));
 276                 if (!reason) {
 277                         reason = "kdc_tcp_call_writev_done: tstream_writev_queue_recv() failed";
 278                 }
 279
 280                 kdc_tcp_terminate_connection(call->kdc_conn, reason);
 281                 return;
 282         }
 283
 284         /* We don't care about errors */
 285
 286         talloc_free(call);
 287 }
 288
 289 /*
 290   called when we get a new connection
 291 */
 292 static void kdc_tcp_accept(struct stream_connection *conn)
 293 {
 294         struct kdc_socket *kdc_socket;
 295         struct kdc_tcp_connection *kdc_conn;
 296         struct tevent_req *subreq;
 297         int rc;
 298
 299         kdc_conn = talloc_zero(conn, struct kdc_tcp_connection);
 300         if (kdc_conn == NULL) {
 301                 stream_terminate_connection(conn,
 302                                 "kdc_tcp_accept: out of memory");
 303                 return;
 304         }
 305
 306         kdc_conn->send_queue = tevent_queue_create(conn, "kdc_tcp_accept");
 307         if (kdc_conn->send_queue == NULL) {
 308                 stream_terminate_connection(conn,
 309                                 "kdc_tcp_accept: out of memory");
 310                 return;
 311         }
 312
 313         kdc_socket = talloc_get_type(conn->private_data, struct kdc_socket);
 314
 315         TALLOC_FREE(conn->event.fde);
 316
 317         rc = tstream_bsd_existing_socket(kdc_conn->tstream,
 318                         socket_get_fd(conn->socket),
 319                         &kdc_conn->tstream);
 320         if (rc < 0) {
 321                 stream_terminate_connection(conn,
 322                                 "kdc_tcp_accept: out of memory");
 323                 return;
 324         }
 325
 326         kdc_conn->conn = conn;
 327         kdc_conn->kdc_socket = kdc_socket;
 328         conn->private_data = kdc_conn;
 329
 330         /*
 331          * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
 332          * packet_full_request_u32 provides the pdu length then.
 333          */
 334         subreq = tstream_read_pdu_blob_send(kdc_conn,
 335                                             kdc_conn->conn->event.ctx,
 336                                             kdc_conn->tstream,
 337                                             4, /* initial_read_size */
 338                                             packet_full_request_u32,
 339                                             kdc_conn);
 340         if (subreq == NULL) {
 341                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_accept: "
 342                                 "no memory for tstream_read_pdu_blob_send");
 343                 return;
 344         }
 345         tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
 346 }
 347
 348 static const struct stream_server_ops kdc_tcp_stream_ops = {
 349         .name                   = "kdc_tcp",
 350         .accept_connection      = kdc_tcp_accept,
 351         .recv_handler           = kdc_tcp_recv,
 352         .send_handler           = kdc_tcp_send
 353 };
 354
 355 /* hold information about one kdc/kpasswd udp socket */
 356 struct kdc_udp_socket {
 357         struct kdc_socket *kdc_socket;
 358         struct tdgram_context *dgram;
 359         struct tevent_queue *send_queue;
 360 };
 361
 362 struct kdc_udp_call {
 363         struct tsocket_address *src;
 364         DATA_BLOB in;
 365         DATA_BLOB out;
 366 };
 367
 368 static void kdc_udp_call_sendto_done(struct tevent_req *subreq);
 369
 370 static void kdc_udp_call_loop(struct tevent_req *subreq)
 371 {
 372         struct kdc_udp_socket *sock = tevent_req_callback_data(subreq,
 373                                       struct kdc_udp_socket);
 374         struct kdc_udp_call *call;
 375         uint8_t *buf;
 376         ssize_t len;
 377         int sys_errno;
 378         bool ok;
 379
 380         call = talloc(sock, struct kdc_udp_call);
 381         if (call == NULL) {
 382                 talloc_free(call);
 383                 goto done;
 384         }
 385
 386         len = tdgram_recvfrom_recv(subreq, &sys_errno,
 387                                    call, &buf, &call->src);
 388         TALLOC_FREE(subreq);
 389         if (len == -1) {
 390                 talloc_free(call);
 391                 goto done;
 392         }
 393
 394         call->in.data = buf;
 395         call->in.length = len;
 396
 397         DEBUG(10,("Received krb5 UDP packet of length %lu from %s\n",
 398                  (long)call->in.length,
 399                  tsocket_address_string(call->src, call)));
 400
 401         /* Call krb5 */
 402         ok = sock->kdc_socket->process(sock->kdc_socket->kdc,
 403                                        call,
 404                                        &call->in,
 405                                        &call->out,
 406                                        call->src,
 407                                        sock->kdc_socket->local_address,
 408                                        1 /* Datagram */);
 409         if (!ok) {
 410                 talloc_free(call);
 411                 goto done;
 412         }
 413
 414         subreq = tdgram_sendto_queue_send(call,
 415                                           sock->kdc_socket->kdc->task->event_ctx,
 416                                           sock->dgram,
 417                                           sock->send_queue,
 418                                           call->out.data,
 419                                           call->out.length,
 420                                           call->src);
 421         if (subreq == NULL) {
 422                 talloc_free(call);
 423                 goto done;
 424         }
 425         tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call);
 426
 427 done:
 428         subreq = tdgram_recvfrom_send(sock,
 429                                       sock->kdc_socket->kdc->task->event_ctx,
 430                                       sock->dgram);
 431         if (subreq == NULL) {
 432                 task_server_terminate(sock->kdc_socket->kdc->task,
 433                                       "no memory for tdgram_recvfrom_send",
 434                                       true);
 435                 return;
 436         }
 437         tevent_req_set_callback(subreq, kdc_udp_call_loop, sock);
 438 }
 439
 440 static void kdc_udp_call_sendto_done(struct tevent_req *subreq)
 441 {
 442         struct kdc_udp_call *call = tevent_req_callback_data(subreq,
 443                                        struct kdc_udp_call);
 444         ssize_t ret;
 445         int sys_errno;
 446
 447         ret = tdgram_sendto_queue_recv(subreq, &sys_errno);
 448
 449         /* We don't care about errors */
 450
 451         talloc_free(call);
 452 }
 453
 454 /*
 455   start listening on the given address
 456 */
 457 static NTSTATUS kdc_add_socket(struct kdc_server *kdc,
 458                                const struct model_ops *model_ops,
 459                                const char *name,
 460                                const char *address,
 461                                uint16_t port,
 462                                kdc_process_fn_t process)
 463 {
 464         struct kdc_socket *kdc_socket;
 465         struct kdc_udp_socket *kdc_udp_socket;
 466         struct tevent_req *udpsubreq;
 467         NTSTATUS status;
 468         int ret;
 469
 470         kdc_socket = talloc(kdc, struct kdc_socket);
 471         NT_STATUS_HAVE_NO_MEMORY(kdc_socket);
 472
 473         kdc_socket->kdc = kdc;
 474         kdc_socket->process = process;
 475
 476         ret = tsocket_address_inet_from_strings(kdc_socket, "ip",
 477                                                 address, port,
 478                                                 &kdc_socket->local_address);
 479         if (ret != 0) {
 480                 status = map_nt_error_from_unix(errno);
 481                 return status;
 482         }
 483
 484         status = stream_setup_socket(kdc->task->event_ctx,
 485                                      kdc->task->lp_ctx,
 486                                      model_ops,
 487                                      &kdc_tcp_stream_ops,
 488                                      "ip", address, &port,
 489                                      lp_socket_options(kdc->task->lp_ctx),
 490                                      kdc_socket);
 491         if (!NT_STATUS_IS_OK(status)) {
 492                 DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
 493                          address, port, nt_errstr(status)));
 494                 talloc_free(kdc_socket);
 495                 return status;
 496         }
 497
 498         kdc_udp_socket = talloc(kdc_socket, struct kdc_udp_socket);
 499         NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket);
 500
 501         kdc_udp_socket->kdc_socket = kdc_socket;
 502
 503         ret = tdgram_inet_udp_socket(kdc_socket->local_address,
 504                                      NULL,
 505                                      kdc_udp_socket,
 506                                      &kdc_udp_socket->dgram);
 507         if (ret != 0) {
 508                 status = map_nt_error_from_unix(errno);
 509                 DEBUG(0,("Failed to bind to %s:%u UDP - %s\n",
 510                          address, port, nt_errstr(status)));
 511                 return status;
 512         }
 513
 514         kdc_udp_socket->send_queue = tevent_queue_create(kdc_udp_socket,
 515                                                          "kdc_udp_send_queue");
 516         NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket->send_queue);
 517
 518         udpsubreq = tdgram_recvfrom_send(kdc_udp_socket,
 519                                          kdc->task->event_ctx,
 520                                          kdc_udp_socket->dgram);
 521         NT_STATUS_HAVE_NO_MEMORY(udpsubreq);
 522         tevent_req_set_callback(udpsubreq, kdc_udp_call_loop, kdc_udp_socket);
 523
 524         return NT_STATUS_OK;
 525 }
 526
 527
 528 /*
 529   setup our listening sockets on the configured network interfaces
 530 */
 531 static NTSTATUS kdc_startup_interfaces(struct kdc_server *kdc, struct loadparm_context *lp_ctx,
 532                                        struct interface *ifaces)
 533 {
 534         const struct model_ops *model_ops;
 535         int num_interfaces;
 536         TALLOC_CTX *tmp_ctx = talloc_new(kdc);
 537         NTSTATUS status;
 538         int i;
 539
 540         /* within the kdc task we want to be a single process, so
 541            ask for the single process model ops and pass these to the
 542            stream_setup_socket() call. */
 543         model_ops = process_model_startup(kdc->task->event_ctx, "single");
 544         if (!model_ops) {
 545                 DEBUG(0,("Can't find 'single' process model_ops\n"));
 546                 return NT_STATUS_INTERNAL_ERROR;
 547         }
 548
 549         num_interfaces = iface_count(ifaces);
 550
 551         for (i=0; i<num_interfaces; i++) {
 552                 const char *address = talloc_strdup(tmp_ctx, iface_n_ip(ifaces, i));
 553                 uint16_t kdc_port = lp_krb5_port(lp_ctx);
 554                 uint16_t kpasswd_port = lp_kpasswd_port(lp_ctx);
 555
 556                 if (kdc_port) {
 557                         status = kdc_add_socket(kdc, model_ops,
 558                                         "kdc", address, kdc_port,
 559                                         kdc_process);
 560                         NT_STATUS_NOT_OK_RETURN(status);
 561                 }
 562
 563                 if (kpasswd_port) {
 564                         status = kdc_add_socket(kdc, model_ops,
 565                                         "kpasswd", address, kpasswd_port,
 566                                         kpasswdd_process);
 567                         NT_STATUS_NOT_OK_RETURN(status);
 568                 }
 569         }
 570
 571         talloc_free(tmp_ctx);
 572
 573         return NT_STATUS_OK;
 574 }
 575
 576
 577 static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg,
 578                                  struct kdc_check_generic_kerberos *r)
 579 {
 580         struct PAC_Validate pac_validate;
 581         DATA_BLOB srv_sig;
 582         struct PAC_SIGNATURE_DATA kdc_sig;
 583         struct kdc_server *kdc = talloc_get_type(msg->private_data, struct kdc_server);
 584         enum ndr_err_code ndr_err;
 585         krb5_enctype etype;
 586         int ret;
 587         hdb_entry_ex ent;
 588         krb5_principal principal;
 589         krb5_keyblock keyblock;
 590         Key *key;
 591
 592         /* There is no reply to this request */
 593         r->out.generic_reply = data_blob(NULL, 0);
 594
 595         ndr_err = ndr_pull_struct_blob(&r->in.generic_request, msg,
 596                                        lp_iconv_convenience(kdc->task->lp_ctx),
 597                                        &pac_validate,
 598                                        (ndr_pull_flags_fn_t)ndr_pull_PAC_Validate);
 599         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 600                 return NT_STATUS_INVALID_PARAMETER;
 601         }
 602
 603         if (pac_validate.MessageType != 3) {
 604                 /* We don't implement any other message types - such as certificate validation - yet */
 605                 return NT_STATUS_INVALID_PARAMETER;
 606         }
 607
 608         if (pac_validate.ChecksumAndSignature.length != (pac_validate.ChecksumLength + pac_validate.SignatureLength)
 609             || pac_validate.ChecksumAndSignature.length < pac_validate.ChecksumLength
 610             || pac_validate.ChecksumAndSignature.length < pac_validate.SignatureLength ) {
 611                 return NT_STATUS_INVALID_PARAMETER;
 612         }
 613
 614         srv_sig = data_blob_const(pac_validate.ChecksumAndSignature.data,
 615                                   pac_validate.ChecksumLength);
 616
 617         if (pac_validate.SignatureType == CKSUMTYPE_HMAC_MD5) {
 618                 etype = ETYPE_ARCFOUR_HMAC_MD5;
 619         } else {
 620                 ret = krb5_cksumtype_to_enctype(kdc->smb_krb5_context->krb5_context, pac_validate.SignatureType,
 621                                                 &etype);
 622                 if (ret != 0) {
 623                         return NT_STATUS_LOGON_FAILURE;
 624                 }
 625         }
 626
 627         ret = krb5_make_principal(kdc->smb_krb5_context->krb5_context, &principal,
 628                                   lp_realm(kdc->task->lp_ctx),
 629                                   "krbtgt", lp_realm(kdc->task->lp_ctx),
 630                                   NULL);
 631
 632         if (ret != 0) {
 633                 return NT_STATUS_NO_MEMORY;
 634         }
 635
 636         ret = kdc->config->db[0]->hdb_fetch(kdc->smb_krb5_context->krb5_context,
 637                                             kdc->config->db[0],
 638                                             principal,
 639                                             HDB_F_GET_KRBTGT | HDB_F_DECRYPT,
 640                                             &ent);
 641
 642         if (ret != 0) {
 643                 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
 644                 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
 645
 646                 return NT_STATUS_LOGON_FAILURE;
 647         }
 648
 649         ret = hdb_enctype2key(kdc->smb_krb5_context->krb5_context, &ent.entry, etype, &key);
 650
 651         if (ret != 0) {
 652                 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
 653                 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
 654                 return NT_STATUS_LOGON_FAILURE;
 655         }
 656
 657         keyblock = key->key;
 658
 659         kdc_sig.type = pac_validate.SignatureType;
 660         kdc_sig.signature = data_blob_const(&pac_validate.ChecksumAndSignature.data[pac_validate.ChecksumLength],
 661                                             pac_validate.SignatureLength);
 662         ret = check_pac_checksum(msg, srv_sig, &kdc_sig,
 663                            kdc->smb_krb5_context->krb5_context, &keyblock);
 664
 665         hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
 666         krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
 667
 668         if (ret != 0) {
 669                 return NT_STATUS_LOGON_FAILURE;
 670         }
 671
 672         return NT_STATUS_OK;
 673 }
 674
 675
 676 /*
 677   startup the kdc task
 678 */
 679 static void kdc_task_init(struct task_server *task)
 680 {
 681         struct kdc_server *kdc;
 682         NTSTATUS status;
 683         krb5_error_code ret;
 684         struct interface *ifaces;
 685
 686         switch (lp_server_role(task->lp_ctx)) {
 687         case ROLE_STANDALONE:
 688                 task_server_terminate(task, "kdc: no KDC required in standalone configuration", false);
 689                 return;
 690         case ROLE_DOMAIN_MEMBER:
 691                 task_server_terminate(task, "kdc: no KDC required in member server configuration", false);
 692                 return;
 693         case ROLE_DOMAIN_CONTROLLER:
 694                 /* Yes, we want a KDC */
 695                 break;
 696         }
 697
 698         load_interfaces(task, lp_interfaces(task->lp_ctx), &ifaces);
 699
 700         if (iface_count(ifaces) == 0) {
 701                 task_server_terminate(task, "kdc: no network interfaces configured", false);
 702                 return;
 703         }
 704
 705         task_server_set_title(task, "task[kdc]");
 706
 707         kdc = talloc(task, struct kdc_server);
 708         if (kdc == NULL) {
 709                 task_server_terminate(task, "kdc: out of memory", true);
 710                 return;
 711         }
 712
 713         kdc->task = task;
 714
 715         initialize_krb5_error_table();
 716
 717         ret = smb_krb5_init_context(kdc, task->event_ctx, task->lp_ctx, &kdc->smb_krb5_context);
 718         if (ret) {
 719                 DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n",
 720                          error_message(ret)));
 721                 task_server_terminate(task, "kdc: krb5_init_context failed", true);
 722                 return;
 723         }
 724
 725         krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r);
 726
 727         ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context,
 728                                   &kdc->config);
 729         if(ret) {
 730                 task_server_terminate(task, "kdc: failed to get KDC configuration", true);
 731                 return;
 732         }
 733
 734         kdc->config->logf = kdc->smb_krb5_context->logf;
 735         kdc->config->db = talloc(kdc, struct HDB *);
 736         if (!kdc->config->db) {
 737                 task_server_terminate(task, "kdc: out of memory", true);
 738                 return;
 739         }
 740         kdc->config->num_db = 1;
 741
 742         status = hdb_samba4_create_kdc(kdc, task->event_ctx, task->lp_ctx,
 743                                        kdc->smb_krb5_context->krb5_context,
 744                                        &kdc->config->db[0]);
 745         if (!NT_STATUS_IS_OK(status)) {
 746                 task_server_terminate(task, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
 747                 return;
 748         }
 749
 750         /* Register hdb-samba4 hooks for use as a keytab */
 751
 752         kdc->hdb_samba4_context = talloc(kdc, struct hdb_samba4_context);
 753         if (!kdc->hdb_samba4_context) {
 754                 task_server_terminate(task, "kdc: out of memory", true);
 755                 return;
 756         }
 757
 758         kdc->hdb_samba4_context->ev_ctx = task->event_ctx;
 759         kdc->hdb_samba4_context->lp_ctx = task->lp_ctx;
 760
 761         ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
 762                                    PLUGIN_TYPE_DATA, "hdb",
 763                                    &hdb_samba4);
 764         if(ret) {
 765                 task_server_terminate(task, "kdc: failed to register hdb keytab", true);
 766                 return;
 767         }
 768
 769         ret = krb5_kt_register(kdc->smb_krb5_context->krb5_context, &hdb_kt_ops);
 770         if(ret) {
 771                 task_server_terminate(task, "kdc: failed to register hdb keytab", true);
 772                 return;
 773         }
 774
 775         /* Registar WinDC hooks */
 776         ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
 777                                    PLUGIN_TYPE_DATA, "windc",
 778                                    &windc_plugin_table);
 779         if(ret) {
 780                 task_server_terminate(task, "kdc: failed to register hdb keytab", true);
 781                 return;
 782         }
 783
 784         krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
 785
 786         /* start listening on the configured network interfaces */
 787         status = kdc_startup_interfaces(kdc, task->lp_ctx, ifaces);
 788         if (!NT_STATUS_IS_OK(status)) {
 789                 task_server_terminate(task, "kdc failed to setup interfaces", true);
 790                 return;
 791         }
 792
 793         status = IRPC_REGISTER(task->msg_ctx, irpc, KDC_CHECK_GENERIC_KERBEROS,
 794                                kdc_check_generic_kerberos, kdc);
 795         if (!NT_STATUS_IS_OK(status)) {
 796                 task_server_terminate(task, "nbtd failed to setup monitoring", true);
 797                 return;
 798         }
 799
 800         irpc_add_name(task->msg_ctx, "kdc_server");
 801 }
 802
 803
 804 /* called at smbd startup - register ourselves as a server service */
 805 NTSTATUS server_service_kdc_init(void)
 806 {
 807         return register_server_service("kdc", kdc_task_init);
 808 }