source4/kdc/mit_samba.c

   1 /*
   2    MIT-Samba4 library
   3
   4    Copyright (c) 2010, Simo Sorce <idra@samba.org>
   5    Copyright (c) 2014-2015 Guenther Deschner <gd@samba.org>
   6    Copyright (c) 2014-2016 Andreas Schneider <asn@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #define TEVENT_DEPRECATED 1
  23
  24 #include "includes.h"
  25 #include "param/param.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "system/kerberos.h"
  28 #include <kdb.h>
  29 #include <kadm5/kadm_err.h>
  30 #include "kdc/sdb.h"
  31 #include "kdc/sdb_kdb.h"
  32 #include "auth/kerberos/kerberos.h"
  33 #include "auth/kerberos/pac_utils.h"
  34 #include "kdc/samba_kdc.h"
  35 #include "kdc/pac-glue.h"
  36 #include "kdc/db-glue.h"
  37 #include "auth/auth.h"
  38 #include "kdc/kpasswd_glue.h"
  39 #include "auth/auth_sam.h"
  40
  41 #include "mit_samba.h"
  42
  43 void mit_samba_context_free(struct mit_samba_context *ctx)
  44 {
  45         /* free heimdal's krb5_context */
  46         if (ctx->context) {
  47                 krb5_free_context(ctx->context);
  48         }
  49
  50         /* then free everything else */
  51         talloc_free(ctx);
  52 }
  53
  54 int mit_samba_context_init(struct mit_samba_context **_ctx)
  55 {
  56         NTSTATUS status;
  57         struct mit_samba_context *ctx;
  58         const char *s4_conf_file;
  59         int ret;
  60         struct samba_kdc_base_context base_ctx;
  61
  62         ctx = talloc_zero(NULL, struct mit_samba_context);
  63         if (!ctx) {
  64                 ret = ENOMEM;
  65                 goto done;
  66         }
  67
  68         base_ctx.ev_ctx = tevent_context_init(ctx);
  69         if (!base_ctx.ev_ctx) {
  70                 ret = ENOMEM;
  71                 goto done;
  72         }
  73         tevent_loop_allow_nesting(base_ctx.ev_ctx);
  74         base_ctx.lp_ctx = loadparm_init_global(false);
  75         if (!base_ctx.lp_ctx) {
  76                 ret = ENOMEM;
  77                 goto done;
  78         }
  79
  80         setup_logging("mitkdc", DEBUG_DEFAULT_STDOUT);
  81
  82         /* init s4 configuration */
  83         s4_conf_file = lpcfg_configfile(base_ctx.lp_ctx);
  84         if (s4_conf_file) {
  85                 lpcfg_load(base_ctx.lp_ctx, s4_conf_file);
  86         } else {
  87                 lpcfg_load_default(base_ctx.lp_ctx);
  88         }
  89
  90         status = samba_kdc_setup_db_ctx(ctx, &base_ctx, &ctx->db_ctx);
  91         if (!NT_STATUS_IS_OK(status)) {
  92                 ret = EINVAL;
  93                 goto done;
  94         }
  95
  96         /* init heimdal's krb_context and log facilities */
  97         ret = smb_krb5_init_context_basic(ctx,
  98                                           ctx->db_ctx->lp_ctx,
  99                                           &ctx->context);
 100         if (ret) {
 101                 goto done;
 102         }
 103
 104         ret = 0;
 105
 106 done:
 107         if (ret) {
 108                 mit_samba_context_free(ctx);
 109         } else {
 110                 *_ctx = ctx;
 111         }
 112         return ret;
 113 }
 114
 115 static krb5_error_code ks_is_tgs_principal(struct mit_samba_context *ctx,
 116                                            krb5_const_principal principal)
 117 {
 118         char *p;
 119         int eq = -1;
 120
 121         p = smb_krb5_principal_get_comp_string(ctx, ctx->context, principal, 0);
 122
 123         eq = krb5_princ_size(ctx->context, principal) == 2 &&
 124              (strcmp(p, KRB5_TGS_NAME) == 0);
 125
 126         talloc_free(p);
 127
 128         return eq;
 129 }
 130
 131 int mit_samba_generate_salt(krb5_data *salt)
 132 {
 133         if (salt == NULL) {
 134                 return EINVAL;
 135         }
 136
 137         salt->length = 16;
 138         salt->data = malloc(salt->length);
 139         if (salt->data == NULL) {
 140                 return ENOMEM;
 141         }
 142
 143         generate_random_buffer((uint8_t *)salt->data, salt->length);
 144
 145         return 0;
 146 }
 147
 148 int mit_samba_generate_random_password(krb5_data *pwd)
 149 {
 150         TALLOC_CTX *tmp_ctx;
 151         char *password;
 152
 153         if (pwd == NULL) {
 154                 return EINVAL;
 155         }
 156         pwd->length = 24;
 157
 158         tmp_ctx = talloc_named(NULL,
 159                                0,
 160                                "mit_samba_create_principal_password context");
 161         if (tmp_ctx == NULL) {
 162                 return ENOMEM;
 163         }
 164
 165         password = generate_random_password(tmp_ctx, pwd->length, pwd->length);
 166         if (password == NULL) {
 167                 talloc_free(tmp_ctx);
 168                 return ENOMEM;
 169         }
 170
 171         pwd->data = strdup(password);
 172         talloc_free(tmp_ctx);
 173         if (pwd->data == NULL) {
 174                 return ENOMEM;
 175         }
 176
 177         return 0;
 178 }
 179
 180 int mit_samba_get_principal(struct mit_samba_context *ctx,
 181                             krb5_const_principal principal,
 182                             unsigned int kflags,
 183                             krb5_db_entry **_kentry)
 184 {
 185         struct sdb_entry_ex sentry = {
 186                 .free_entry = NULL,
 187         };
 188         krb5_db_entry *kentry;
 189         int ret;
 190         int sflags = 0;
 191         krb5_principal referral_principal = NULL;
 192
 193         kentry = calloc(1, sizeof(krb5_db_entry));
 194         if (kentry == NULL) {
 195                 return ENOMEM;
 196         }
 197
 198         if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
 199                 sflags |= SDB_F_CANON;
 200         }
 201         if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY |
 202                       KRB5_KDB_FLAG_INCLUDE_PAC)) {
 203                 /*
 204                  * KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY is equal to
 205                  * SDB_F_FOR_AS_REQ
 206                  *
 207                  * We use ANY to also allow AS_REQ for service principal names
 208                  * This is supported by Windows.
 209                  */
 210                 sflags |= SDB_F_GET_ANY|SDB_F_FOR_AS_REQ;
 211         } else if (ks_is_tgs_principal(ctx, principal)) {
 212                 sflags |= SDB_F_GET_KRBTGT;
 213         } else {
 214                 sflags |= SDB_F_GET_SERVER|SDB_F_FOR_TGS_REQ;
 215         }
 216
 217         /* always set this or the created_by data will not be populated by samba's
 218          * backend and we will fail to parse the entry later */
 219         sflags |= SDB_F_ADMIN_DATA;
 220
 221
 222 fetch_referral_principal:
 223         ret = samba_kdc_fetch(ctx->context, ctx->db_ctx,
 224                               principal, sflags, 0, &sentry);
 225         switch (ret) {
 226         case 0:
 227                 break;
 228         case SDB_ERR_NOENTRY:
 229                 ret = KRB5_KDB_NOENTRY;
 230                 goto done;
 231         case SDB_ERR_WRONG_REALM: {
 232                 char *dest_realm = NULL;
 233                 const char *our_realm = lpcfg_realm(ctx->db_ctx->lp_ctx);
 234
 235                 if (sflags & SDB_F_FOR_AS_REQ) {
 236                         /*
 237                          * If this is a request for a TGT, we are done. The KDC
 238                          * will return the correct error to the client.
 239                          */
 240                         ret = 0;
 241                         break;
 242                 }
 243
 244                 if (referral_principal != NULL) {
 245                         sdb_free_entry(&sentry);
 246                         ret = KRB5_KDB_NOENTRY;
 247                         goto done;
 248                 }
 249
 250                 /*
 251                  * We get a TGS request
 252                  *
 253                  *     cifs/dc7.SAMBA2008R2.EXAMPLE.COM@ADDOM.SAMBA.EXAMPLE.COM
 254                  *
 255                  * to our DC for the realm
 256                  *
 257                  *     ADDOM.SAMBA.EXAMPLE.COM
 258                  *
 259                  * We look up if we have and entry in the database and get an
 260                  * entry with the pricipal:
 261                  *
 262                  *     cifs/dc7.SAMBA2008R2.EXAMPLE.COM@SAMBA2008R2.EXAMPLE.COM
 263                  *
 264                  * and the error: SDB_ERR_WRONG_REALM.
 265                  *
 266                  * In the case of a TGS-REQ we need to return a referral ticket
 267                  * fo the next trust hop to the client. This ticket will have
 268                  * the following principal:
 269                  *
 270                  *     krbtgt/SAMBA2008R2.EXAMPLE.COM@ADDOM.SAMBA.EXAMPLE.COM
 271                  *
 272                  * We just redo the lookup in the database with the referral
 273                  * principal and return success.
 274                  */
 275                 dest_realm = smb_krb5_principal_get_realm(ctx->context,
 276                                                           sentry.entry.principal);
 277                 sdb_free_entry(&sentry);
 278                 if (dest_realm == NULL) {
 279                         ret = KRB5_KDB_NOENTRY;
 280                         goto done;
 281                 }
 282
 283                 ret = smb_krb5_make_principal(ctx->context,
 284                                               &referral_principal,
 285                                               our_realm,
 286                                               KRB5_TGS_NAME,
 287                                               dest_realm,
 288                                               NULL);
 289                 SAFE_FREE(dest_realm);
 290                 if (ret != 0) {
 291                         goto done;
 292                 }
 293
 294                 principal = referral_principal;
 295                 goto fetch_referral_principal;
 296         }
 297         case SDB_ERR_NOT_FOUND_HERE:
 298                 /* FIXME: RODC support */
 299         default:
 300                 goto done;
 301         }
 302
 303         ret = sdb_entry_ex_to_kdb_entry_ex(ctx->context, &sentry, kentry);
 304
 305         sdb_free_entry(&sentry);
 306
 307 done:
 308         krb5_free_principal(ctx->context, referral_principal);
 309         referral_principal = NULL;
 310
 311         if (ret) {
 312                 free(kentry);
 313         } else {
 314                 *_kentry = kentry;
 315         }
 316         return ret;
 317 }
 318
 319 int mit_samba_get_firstkey(struct mit_samba_context *ctx,
 320                            krb5_db_entry **_kentry)
 321 {
 322         struct sdb_entry_ex sentry = {
 323                 .free_entry = NULL,
 324         };
 325         krb5_db_entry *kentry;
 326         int ret;
 327
 328         kentry = malloc(sizeof(krb5_db_entry));
 329         if (kentry == NULL) {
 330                 return ENOMEM;
 331         }
 332
 333         ret = samba_kdc_firstkey(ctx->context, ctx->db_ctx, &sentry);
 334         switch (ret) {
 335         case 0:
 336                 break;
 337         case SDB_ERR_NOENTRY:
 338                 free(kentry);
 339                 return KRB5_KDB_NOENTRY;
 340         case SDB_ERR_NOT_FOUND_HERE:
 341                 /* FIXME: RODC support */
 342         default:
 343                 free(kentry);
 344                 return ret;
 345         }
 346
 347         ret = sdb_entry_ex_to_kdb_entry_ex(ctx->context, &sentry, kentry);
 348
 349         sdb_free_entry(&sentry);
 350
 351         if (ret) {
 352                 free(kentry);
 353         } else {
 354                 *_kentry = kentry;
 355         }
 356         return ret;
 357 }
 358
 359 int mit_samba_get_nextkey(struct mit_samba_context *ctx,
 360                           krb5_db_entry **_kentry)
 361 {
 362         struct sdb_entry_ex sentry = {
 363                 .free_entry = NULL,
 364         };
 365         krb5_db_entry *kentry;
 366         int ret;
 367
 368         kentry = malloc(sizeof(krb5_db_entry));
 369         if (kentry == NULL) {
 370                 return ENOMEM;
 371         }
 372
 373         ret = samba_kdc_nextkey(ctx->context, ctx->db_ctx, &sentry);
 374         switch (ret) {
 375         case 0:
 376                 break;
 377         case SDB_ERR_NOENTRY:
 378                 free(kentry);
 379                 return KRB5_KDB_NOENTRY;
 380         case SDB_ERR_NOT_FOUND_HERE:
 381                 /* FIXME: RODC support */
 382         default:
 383                 free(kentry);
 384                 return ret;
 385         }
 386
 387         ret = sdb_entry_ex_to_kdb_entry_ex(ctx->context, &sentry, kentry);
 388
 389         sdb_free_entry(&sentry);
 390
 391         if (ret) {
 392                 free(kentry);
 393         } else {
 394                 *_kentry = kentry;
 395         }
 396         return ret;
 397 }
 398
 399 int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
 400                       krb5_context context,
 401                       krb5_db_entry *client,
 402                       krb5_keyblock *client_key,
 403                       krb5_pac *pac)
 404 {
 405         TALLOC_CTX *tmp_ctx;
 406         DATA_BLOB *logon_info_blob = NULL;
 407         DATA_BLOB *upn_dns_info_blob = NULL;
 408         DATA_BLOB *cred_ndr = NULL;
 409         DATA_BLOB **cred_ndr_ptr = NULL;
 410         DATA_BLOB cred_blob = data_blob_null;
 411         DATA_BLOB *pcred_blob = NULL;
 412         NTSTATUS nt_status;
 413         krb5_error_code code;
 414         struct samba_kdc_entry *skdc_entry;
 415
 416         skdc_entry = talloc_get_type_abort(client->e_data,
 417                                            struct samba_kdc_entry);
 418
 419         tmp_ctx = talloc_named(smb_ctx,
 420                                0,
 421                                "mit_samba_get_pac_data_blobs context");
 422         if (tmp_ctx == NULL) {
 423                 return ENOMEM;
 424         }
 425
 426 #if 0 /* TODO Find out if this is a pkinit_reply key */
 427         /* Check if we have a PREAUTH key */
 428         if (client_key != NULL) {
 429                 cred_ndr_ptr = &cred_ndr;
 430         }
 431 #endif
 432
 433         nt_status = samba_kdc_get_pac_blobs(tmp_ctx,
 434                                             skdc_entry,
 435                                             &logon_info_blob,
 436                                             cred_ndr_ptr,
 437                                             &upn_dns_info_blob);
 438         if (!NT_STATUS_IS_OK(nt_status)) {
 439                 talloc_free(tmp_ctx);
 440                 return EINVAL;
 441         }
 442
 443         if (cred_ndr != NULL) {
 444                 code = samba_kdc_encrypt_pac_credentials(context,
 445                                                          client_key,
 446                                                          cred_ndr,
 447                                                          tmp_ctx,
 448                                                          &cred_blob);
 449                 if (code != 0) {
 450                         talloc_free(tmp_ctx);
 451                         return code;
 452                 }
 453                 pcred_blob = &cred_blob;
 454         }
 455
 456         code = samba_make_krb5_pac(context,
 457                                    logon_info_blob,
 458                                    pcred_blob,
 459                                    upn_dns_info_blob,
 460                                    NULL,
 461                                    pac);
 462
 463         talloc_free(tmp_ctx);
 464         return code;
 465 }
 466
 467 krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
 468                                     krb5_context context,
 469                                     int flags,
 470                                     krb5_const_principal client_principal,
 471                                     krb5_db_entry *client,
 472                                     krb5_db_entry *server,
 473                                     krb5_db_entry *krbtgt,
 474                                     krb5_keyblock *krbtgt_keyblock,
 475                                     krb5_pac *pac)
 476 {
 477         TALLOC_CTX *tmp_ctx;
 478         krb5_error_code code;
 479         NTSTATUS nt_status;
 480         DATA_BLOB *pac_blob = NULL;
 481         DATA_BLOB *upn_blob = NULL;
 482         DATA_BLOB *deleg_blob = NULL;
 483         struct samba_kdc_entry *client_skdc_entry = NULL;
 484         struct samba_kdc_entry *krbtgt_skdc_entry;
 485         bool is_in_db = false;
 486         bool is_untrusted = false;
 487         size_t num_types = 0;
 488         uint32_t *types = NULL;
 489         uint32_t forced_next_type = 0;
 490         size_t i = 0;
 491         ssize_t logon_info_idx = -1;
 492         ssize_t delegation_idx = -1;
 493         ssize_t logon_name_idx = -1;
 494         ssize_t upn_dns_info_idx = -1;
 495         ssize_t srv_checksum_idx = -1;
 496         ssize_t kdc_checksum_idx = -1;
 497         krb5_pac new_pac = NULL;
 498         bool ok;
 499
 500         if (client != NULL) {
 501                 client_skdc_entry =
 502                         talloc_get_type_abort(client->e_data,
 503                                               struct samba_kdc_entry);
 504
 505                 /* The user account may be set not to want the PAC */
 506                 ok = samba_princ_needs_pac(client_skdc_entry);
 507                 if (!ok) {
 508                         return EINVAL;
 509                 }
 510         }
 511
 512         if (krbtgt == NULL) {
 513                 return EINVAL;
 514         }
 515         krbtgt_skdc_entry =
 516                 talloc_get_type_abort(krbtgt->e_data,
 517                                       struct samba_kdc_entry);
 518
 519         tmp_ctx = talloc_named(ctx, 0, "mit_samba_reget_pac context");
 520         if (tmp_ctx == NULL) {
 521                 return ENOMEM;
 522         }
 523
 524         code = samba_krbtgt_is_in_db(krbtgt_skdc_entry,
 525                                      &is_in_db,
 526                                      &is_untrusted);
 527         if (code != 0) {
 528                 goto done;
 529         }
 530
 531         if (is_untrusted) {
 532                 if (client == NULL) {
 533                         code = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
 534                         goto done;
 535                 }
 536
 537                 nt_status = samba_kdc_get_pac_blobs(tmp_ctx,
 538                                                     client_skdc_entry,
 539                                                     &pac_blob,
 540                                                     NULL,
 541                                                     &upn_blob);
 542                 if (!NT_STATUS_IS_OK(nt_status)) {
 543                         code = EINVAL;
 544                         goto done;
 545                 }
 546         } else {
 547                 struct PAC_SIGNATURE_DATA *pac_srv_sig;
 548                 struct PAC_SIGNATURE_DATA *pac_kdc_sig;
 549
 550                 pac_blob = talloc_zero(tmp_ctx, DATA_BLOB);
 551                 if (pac_blob == NULL) {
 552                         code = ENOMEM;
 553                         goto done;
 554                 }
 555
 556                 pac_srv_sig = talloc_zero(tmp_ctx, struct PAC_SIGNATURE_DATA);
 557                 if (pac_srv_sig == NULL) {
 558                         code = ENOMEM;
 559                         goto done;
 560                 }
 561
 562                 pac_kdc_sig = talloc_zero(tmp_ctx, struct PAC_SIGNATURE_DATA);
 563                 if (pac_kdc_sig == NULL) {
 564                         code = ENOMEM;
 565                         goto done;
 566                 }
 567
 568                 nt_status = samba_kdc_update_pac_blob(tmp_ctx,
 569                                                       context,
 570                                                       *pac,
 571                                                       pac_blob,
 572                                                       pac_srv_sig,
 573                                                       pac_kdc_sig);
 574                 if (!NT_STATUS_IS_OK(nt_status)) {
 575                         DEBUG(0, ("Update PAC blob failed: %s\n",
 576                                   nt_errstr(nt_status)));
 577                         code = EINVAL;
 578                         goto done;
 579                 }
 580
 581                 if (is_in_db) {
 582                         /*
 583                          * Now check the KDC signature, fetching the correct
 584                          * key based on the enc type.
 585                          */
 586                         code = check_pac_checksum(pac_srv_sig->signature,
 587                                                   pac_kdc_sig,
 588                                                   context,
 589                                                   krbtgt_keyblock);
 590                         if (code != 0) {
 591                                 DBG_INFO("PAC KDC signature failed to verify\n");
 592                                 goto done;
 593                         }
 594                 }
 595         }
 596
 597         if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
 598                 deleg_blob = talloc_zero(tmp_ctx, DATA_BLOB);
 599                 if (deleg_blob == NULL) {
 600                         code = ENOMEM;
 601                         goto done;
 602                 }
 603
 604                 nt_status = samba_kdc_update_delegation_info_blob(tmp_ctx,
 605                                                                   context,
 606                                                                   *pac,
 607                                                                   server->princ,
 608                                                                   discard_const(client_principal),
 609                                                                   deleg_blob);
 610                 if (!NT_STATUS_IS_OK(nt_status)) {
 611                         DEBUG(0, ("Update delegation info failed: %s\n",
 612                                   nt_errstr(nt_status)));
 613                         code = EINVAL;
 614                         goto done;
 615                 }
 616         }
 617
 618         /* Check the types of the given PAC */
 619         code = krb5_pac_get_types(context, *pac, &num_types, &types);
 620         if (code != 0) {
 621                 goto done;
 622         }
 623
 624         for (i = 0; i < num_types; i++) {
 625                 switch (types[i]) {
 626                 case PAC_TYPE_LOGON_INFO:
 627                         if (logon_info_idx != -1) {
 628                                 DBG_WARNING("logon type[%u] twice [%zd] and [%zu]: \n",
 629                                             types[i],
 630                                             logon_info_idx,
 631                                             i);
 632                                 SAFE_FREE(types);
 633                                 code = EINVAL;
 634                                 goto done;
 635                         }
 636                         logon_info_idx = i;
 637                         break;
 638                 case PAC_TYPE_CONSTRAINED_DELEGATION:
 639                         if (delegation_idx != -1) {
 640                                 DBG_WARNING("logon type[%u] twice [%zd] and [%zu]: \n",
 641                                             types[i],
 642                                             delegation_idx,
 643                                             i);
 644                                 SAFE_FREE(types);
 645                                 code = EINVAL;
 646                                 goto done;
 647                         }
 648                         delegation_idx = i;
 649                         break;
 650                 case PAC_TYPE_LOGON_NAME:
 651                         if (logon_name_idx != -1) {
 652                                 DBG_WARNING("logon type[%u] twice [%zd] and [%zu]: \n",
 653                                             types[i],
 654                                             logon_name_idx,
 655                                             i);
 656                                 SAFE_FREE(types);
 657                                 code = EINVAL;
 658                                 goto done;
 659                         }
 660                         logon_name_idx = i;
 661                         break;
 662                 case PAC_TYPE_UPN_DNS_INFO:
 663                         if (upn_dns_info_idx != -1) {
 664                                 DBG_WARNING("logon type[%u] twice [%zd] and [%zu]: \n",
 665                                             types[i],
 666                                             upn_dns_info_idx,
 667                                             i);
 668                                 SAFE_FREE(types);
 669                                 code = EINVAL;
 670                                 goto done;
 671                         }
 672                         upn_dns_info_idx = i;
 673                         break;
 674                 case PAC_TYPE_SRV_CHECKSUM:
 675                         if (srv_checksum_idx != -1) {
 676                                 DBG_WARNING("logon type[%u] twice [%zd] and [%zu]: \n",
 677                                             types[i],
 678                                             srv_checksum_idx,
 679                                             i);
 680                                 SAFE_FREE(types);
 681                                 code = EINVAL;
 682                                 goto done;
 683                         }
 684                         srv_checksum_idx = i;
 685                         break;
 686                 case PAC_TYPE_KDC_CHECKSUM:
 687                         if (kdc_checksum_idx != -1) {
 688                                 DBG_WARNING("logon type[%u] twice [%zd] and [%zu]: \n",
 689                                             types[i],
 690                                             kdc_checksum_idx,
 691                                             i);
 692                                 SAFE_FREE(types);
 693                                 code = EINVAL;
 694                                 goto done;
 695                         }
 696                         kdc_checksum_idx = i;
 697                         break;
 698                 default:
 699                         continue;
 700                 }
 701         }
 702
 703         if (logon_info_idx == -1) {
 704                 DEBUG(1, ("PAC_TYPE_LOGON_INFO missing\n"));
 705                 SAFE_FREE(types);
 706                 code = EINVAL;
 707                 goto done;
 708         }
 709         if (logon_name_idx == -1) {
 710                 DEBUG(1, ("PAC_TYPE_LOGON_NAME missing\n"));
 711                 SAFE_FREE(types);
 712                 code = EINVAL;
 713                 goto done;
 714         }
 715         if (srv_checksum_idx == -1) {
 716                 DEBUG(1, ("PAC_TYPE_SRV_CHECKSUM missing\n"));
 717                 SAFE_FREE(types);
 718                 code = EINVAL;
 719                 goto done;
 720         }
 721         if (kdc_checksum_idx == -1) {
 722                 DEBUG(1, ("PAC_TYPE_KDC_CHECKSUM missing\n"));
 723                 SAFE_FREE(types);
 724                 code = EINVAL;
 725                 goto done;
 726         }
 727
 728         /* Build an updated PAC */
 729         code = krb5_pac_init(context, &new_pac);
 730         if (code != 0) {
 731                 SAFE_FREE(types);
 732                 goto done;
 733         }
 734
 735         for (i = 0;;) {
 736                 krb5_data type_data;
 737                 DATA_BLOB type_blob = data_blob_null;
 738                 uint32_t type;
 739
 740                 if (forced_next_type != 0) {
 741                         /*
 742                          * We need to inject possible missing types
 743                          */
 744                         type = forced_next_type;
 745                         forced_next_type = 0;
 746                 } else if (i < num_types) {
 747                         type = types[i];
 748                         i++;
 749                 } else {
 750                         break;
 751                 }
 752
 753                 switch (type) {
 754                 case PAC_TYPE_LOGON_INFO:
 755                         type_blob = *pac_blob;
 756
 757                         if (delegation_idx == -1 && deleg_blob != NULL) {
 758                                 /* inject CONSTRAINED_DELEGATION behind */
 759                                 forced_next_type = PAC_TYPE_CONSTRAINED_DELEGATION;
 760                         }
 761                         break;
 762                 case PAC_TYPE_CONSTRAINED_DELEGATION:
 763                         if (deleg_blob != NULL) {
 764                                 type_blob = *deleg_blob;
 765                         }
 766                         break;
 767                 case PAC_TYPE_CREDENTIAL_INFO:
 768                         /*
 769                          * Note that we copy the credential blob,
 770                          * as it's only usable with the PKINIT based
 771                          * AS-REP reply key, it's only available on the
 772                          * host which did the AS-REQ/AS-REP exchange.
 773                          *
 774                          * This matches Windows 2008R2...
 775                          */
 776                         break;
 777                 case PAC_TYPE_LOGON_NAME:
 778                         /*
 779                          * This is generated in the main KDC code
 780                          */
 781                         continue;
 782                 case PAC_TYPE_UPN_DNS_INFO:
 783                         /*
 784                          * Replace in the RODC case, otherwise
 785                          * upn_blob is NULL and we just copy.
 786                          */
 787                         if (upn_blob != NULL) {
 788                                 type_blob = *upn_blob;
 789                         }
 790                         break;
 791                 case PAC_TYPE_SRV_CHECKSUM:
 792                         /*
 793                          * This is generated in the main KDC code
 794                          */
 795                         continue;
 796                 case PAC_TYPE_KDC_CHECKSUM:
 797                         /*
 798                          * This is generated in the main KDC code
 799                          */
 800                         continue;
 801                 default:
 802                         /* just copy... */
 803                         break;
 804                 }
 805
 806                 if (type_blob.length != 0) {
 807                         code = smb_krb5_copy_data_contents(&type_data,
 808                                                            type_blob.data,
 809                                                            type_blob.length);
 810                         if (code != 0) {
 811                                 SAFE_FREE(types);
 812                                 krb5_pac_free(context, new_pac);
 813                                 goto done;
 814                         }
 815                 } else {
 816                         code = krb5_pac_get_buffer(context,
 817                                                    *pac,
 818                                                    type,
 819                                                    &type_data);
 820                         if (code != 0) {
 821                                 SAFE_FREE(types);
 822                                 krb5_pac_free(context, new_pac);
 823                                 goto done;
 824                         }
 825                 }
 826
 827                 code = krb5_pac_add_buffer(context,
 828                                            new_pac,
 829                                            type,
 830                                            &type_data);
 831                 smb_krb5_free_data_contents(context, &type_data);
 832                 if (code != 0) {
 833                         SAFE_FREE(types);
 834                         krb5_pac_free(context, new_pac);
 835                         goto done;
 836                 }
 837         }
 838
 839         SAFE_FREE(types);
 840
 841         /* We now replace the pac */
 842         krb5_pac_free(context, *pac);
 843         *pac = new_pac;
 844 done:
 845         talloc_free(tmp_ctx);
 846         return code;
 847 }
 848
 849 /* provide header, function is exported but there are no public headers */
 850
 851 krb5_error_code encode_krb5_padata_sequence(krb5_pa_data *const *rep, krb5_data **code);
 852
 853 /* this function allocates 'data' using malloc.
 854  * The caller is responsible for freeing it */
 855 static void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data)
 856 {
 857         krb5_error_code ret = 0;
 858         krb5_pa_data pa, *ppa = NULL;
 859         krb5_data *d = NULL;
 860
 861         if (!e_data)
 862                 return;
 863
 864         e_data->data   = NULL;
 865         e_data->length = 0;
 866
 867         pa.magic                = KV5M_PA_DATA;
 868         pa.pa_type              = KRB5_PADATA_PW_SALT;
 869         pa.length               = 12;
 870         pa.contents             = malloc(pa.length);
 871         if (!pa.contents) {
 872                 return;
 873         }
 874
 875         SIVAL(pa.contents, 0, NT_STATUS_V(nt_status));
 876         SIVAL(pa.contents, 4, 0);
 877         SIVAL(pa.contents, 8, 1);
 878
 879         ppa = &pa;
 880
 881         ret = encode_krb5_padata_sequence(&ppa, &d);
 882         free(pa.contents);
 883         if (ret) {
 884                 return;
 885         }
 886
 887         e_data->data   = (uint8_t *)d->data;
 888         e_data->length = d->length;
 889
 890         /* free d, not d->data - gd */
 891         free(d);
 892
 893         return;
 894 }
 895
 896 int mit_samba_check_client_access(struct mit_samba_context *ctx,
 897                                   krb5_db_entry *client,
 898                                   const char *client_name,
 899                                   krb5_db_entry *server,
 900                                   const char *server_name,
 901                                   const char *netbios_name,
 902                                   bool password_change,
 903                                   DATA_BLOB *e_data)
 904 {
 905         struct samba_kdc_entry *skdc_entry;
 906         NTSTATUS nt_status;
 907
 908         skdc_entry = talloc_get_type(client->e_data, struct samba_kdc_entry);
 909
 910         nt_status = samba_kdc_check_client_access(skdc_entry,
 911                                                   client_name,
 912                                                   netbios_name,
 913                                                   password_change);
 914
 915         if (!NT_STATUS_IS_OK(nt_status)) {
 916                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) {
 917                         return ENOMEM;
 918                 }
 919
 920                 samba_kdc_build_edata_reply(nt_status, e_data);
 921
 922                 return samba_kdc_map_policy_err(nt_status);
 923         }
 924
 925         return 0;
 926 }
 927
 928 int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
 929                               krb5_db_entry *kentry,
 930                               const char *target_name,
 931                               bool is_nt_enterprise_name)
 932 {
 933 #if 1
 934         /*
 935          * This is disabled because mit_samba_update_pac_data() does not handle
 936          * S4U_DELEGATION_INFO
 937          */
 938
 939         return KRB5KDC_ERR_BADOPTION;
 940 #else
 941         krb5_principal target_principal;
 942         int flags = 0;
 943         int ret;
 944
 945         if (is_nt_enterprise_name) {
 946                 flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE;
 947         }
 948
 949         ret = krb5_parse_name_flags(ctx->context, target_name,
 950                                     flags, &target_principal);
 951         if (ret) {
 952                 return ret;
 953         }
 954
 955         ret = samba_kdc_check_s4u2proxy(ctx->context,
 956                                         ctx->db_ctx,
 957                                         skdc_entry,
 958                                         target_principal);
 959
 960         krb5_free_principal(ctx->context, target_principal);
 961
 962         return ret;
 963 #endif
 964 }
 965
 966 static krb5_error_code mit_samba_change_pwd_error(krb5_context context,
 967                                                   NTSTATUS result,
 968                                                   enum samPwdChangeReason reject_reason,
 969                                                   struct samr_DomInfo1 *dominfo)
 970 {
 971         krb5_error_code code = KADM5_PASS_Q_GENERIC;
 972
 973         if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
 974                 code = KADM5_BAD_PRINCIPAL;
 975                 krb5_set_error_message(context,
 976                                        code,
 977                                        "No such user when changing password");
 978         }
 979         if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
 980                 code = KADM5_PASS_Q_GENERIC;
 981                 krb5_set_error_message(context,
 982                                        code,
 983                                        "Not permitted to change password");
 984         }
 985         if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) &&
 986             dominfo != NULL) {
 987                 switch (reject_reason) {
 988                 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT:
 989                         code = KADM5_PASS_Q_TOOSHORT;
 990                         krb5_set_error_message(context,
 991                                                code,
 992                                                "Password too short, password "
 993                                                "must be at least %d characters "
 994                                                "long.",
 995                                                dominfo->min_password_length);
 996                         break;
 997                 case SAM_PWD_CHANGE_NOT_COMPLEX:
 998                         code = KADM5_PASS_Q_DICT;
 999                         krb5_set_error_message(context,
1000                                                code,
1001                                                "Password does not meet "
1002                                                "complexity requirements");
1003                         break;
1004                 case SAM_PWD_CHANGE_PWD_IN_HISTORY:
1005                         code = KADM5_PASS_TOOSOON;
1006                         krb5_set_error_message(context,
1007                                                code,
1008                                                "Password is already in password "
1009                                                "history. New password must not "
1010                                                "match any of your %d previous "
1011                                                "passwords.",
1012                                                dominfo->password_history_length);
1013                         break;
1014                 default:
1015                         code = KADM5_PASS_Q_GENERIC;
1016                         krb5_set_error_message(context,
1017                                                code,
1018                                                "Password change rejected, "
1019                                                "password changes may not be "
1020                                                "permitted on this account, or "
1021                                                "the minimum password age may "
1022                                                "not have elapsed.");
1023                         break;
1024                 }
1025         }
1026
1027         return code;
1028 }
1029
1030 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
1031                                       char *pwd,
1032                                       krb5_db_entry *db_entry)
1033 {
1034         NTSTATUS status;
1035         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1036         TALLOC_CTX *tmp_ctx;
1037         DATA_BLOB password;
1038         enum samPwdChangeReason reject_reason;
1039         struct samr_DomInfo1 *dominfo;
1040         const char *error_string = NULL;
1041         struct auth_user_info_dc *user_info_dc;
1042         struct samba_kdc_entry *p;
1043         krb5_error_code code = 0;
1044
1045 #ifdef DEBUG_PASSWORD
1046         DEBUG(1,("mit_samba_kpasswd_change_password called with: %s\n", pwd));
1047 #endif
1048
1049         tmp_ctx = talloc_named(ctx, 0, "mit_samba_kpasswd_change_password");
1050         if (tmp_ctx == NULL) {
1051                 return ENOMEM;
1052         }
1053
1054         p = (struct samba_kdc_entry *)db_entry->e_data;
1055
1056         status = authsam_make_user_info_dc(tmp_ctx,
1057                                            ctx->db_ctx->samdb,
1058                                            lpcfg_netbios_name(ctx->db_ctx->lp_ctx),
1059                                            lpcfg_sam_name(ctx->db_ctx->lp_ctx),
1060                                            lpcfg_sam_dnsname(ctx->db_ctx->lp_ctx),
1061                                            p->realm_dn,
1062                                            p->msg,
1063                                            data_blob(NULL, 0),
1064                                            data_blob(NULL, 0),
1065                                            &user_info_dc);
1066         if (!NT_STATUS_IS_OK(status)) {
1067                 DEBUG(1,("authsam_make_user_info_dc failed: %s\n",
1068                         nt_errstr(status)));
1069                 talloc_free(tmp_ctx);
1070                 return EINVAL;
1071         }
1072
1073         status = auth_generate_session_info(tmp_ctx,
1074                                             ctx->db_ctx->lp_ctx,
1075                                             ctx->db_ctx->samdb,
1076                                             user_info_dc,
1077                                             0, /* session_info_flags */
1078                                             &ctx->session_info);
1079
1080         if (!NT_STATUS_IS_OK(status)) {
1081                 DEBUG(1,("auth_generate_session_info failed: %s\n",
1082                         nt_errstr(status)));
1083                 talloc_free(tmp_ctx);
1084                 return EINVAL;
1085         }
1086
1087         /* password is expected as UTF16 */
1088
1089         if (!convert_string_talloc(tmp_ctx, CH_UTF8, CH_UTF16,
1090                                    pwd, strlen(pwd),
1091                                    &password.data, &password.length)) {
1092                 DEBUG(1,("convert_string_talloc failed\n"));
1093                 talloc_free(tmp_ctx);
1094                 return EINVAL;
1095         }
1096
1097         status = samdb_kpasswd_change_password(tmp_ctx,
1098                                                ctx->db_ctx->lp_ctx,
1099                                                ctx->db_ctx->ev_ctx,
1100                                                ctx->db_ctx->samdb,
1101                                                ctx->session_info,
1102                                                &password,
1103                                                &reject_reason,
1104                                                &dominfo,
1105                                                &error_string,
1106                                                &result);
1107         if (!NT_STATUS_IS_OK(status)) {
1108                 DEBUG(1,("samdb_kpasswd_change_password failed: %s\n",
1109                         nt_errstr(status)));
1110                 code = KADM5_PASS_Q_GENERIC;
1111                 krb5_set_error_message(ctx->context, code, "%s", error_string);
1112                 goto out;
1113         }
1114
1115         if (!NT_STATUS_IS_OK(result)) {
1116                 code = mit_samba_change_pwd_error(ctx->context,
1117                                                   result,
1118                                                   reject_reason,
1119                                                   dominfo);
1120         }
1121
1122 out:
1123         talloc_free(tmp_ctx);
1124
1125         return code;
1126 }
1127
1128 void mit_samba_zero_bad_password_count(krb5_db_entry *db_entry)
1129 {
1130         struct samba_kdc_entry *p;
1131         struct ldb_dn *domain_dn;
1132
1133         p = (struct samba_kdc_entry *)db_entry->e_data;
1134
1135         domain_dn = ldb_get_default_basedn(p->kdc_db_ctx->samdb);
1136
1137         authsam_logon_success_accounting(p->kdc_db_ctx->samdb,
1138                                          p->msg,
1139                                          domain_dn,
1140                                          true);
1141 }
1142
1143
1144 void mit_samba_update_bad_password_count(krb5_db_entry *db_entry)
1145 {
1146         struct samba_kdc_entry *p;
1147
1148         p = (struct samba_kdc_entry *)db_entry->e_data;
1149
1150         authsam_update_bad_pwd_count(p->kdc_db_ctx->samdb,
1151                                      p->msg,
1152                                      ldb_get_default_basedn(p->kdc_db_ctx->samdb));
1153 }