s3-krb5 Only build ADS support if arcfour-hmac-md5 is available
[samba.git] / source3 / libnet / libnet_samsync_keytab.c.orig
1 /*
2    Unix SMB/CIFS implementation.
3    dump the remote SAM using rpc samsync operations
4
5    Copyright (C) Guenther Deschner 2008.
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smb_krb5.h"
23 #include "ads.h"
24 #include "libnet/libnet_keytab.h"
25 #include "libnet/libnet_samsync.h"
26
27 #if defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC)
28
29 /****************************************************************
30 ****************************************************************/
31
32 static NTSTATUS keytab_ad_connect(TALLOC_CTX *mem_ctx,
33                                   const char *domain_name,
34                                   const char *username,
35                                   const char *password,
36                                   struct libnet_keytab_context *ctx)
37 {
38         NTSTATUS status;
39         ADS_STATUS ad_status;
40         ADS_STRUCT *ads;
41         struct netr_DsRGetDCNameInfo *info = NULL;
42         const char *dc;
43
44         status = dsgetdcname(mem_ctx, NULL, domain_name, NULL, NULL, 0, &info);
45         if (!NT_STATUS_IS_OK(status)) {
46                 return status;
47         }
48
49         dc = strip_hostname(info->dc_unc);
50
51         ads = ads_init(NULL, domain_name, dc);
52         NT_STATUS_HAVE_NO_MEMORY(ads);
53
54         if (getenv(KRB5_ENV_CCNAME) == NULL) {
55                 setenv(KRB5_ENV_CCNAME, "MEMORY:libnet_samsync_keytab", 1);
56         }
57
58         ads->auth.user_name = SMB_STRDUP(username);
59         ads->auth.password = SMB_STRDUP(password);
60
61         ad_status = ads_connect_user_creds(ads);
62         if (!ADS_ERR_OK(ad_status)) {
63                 return NT_STATUS_UNSUCCESSFUL;
64         }
65
66         ctx->ads = ads;
67
68         ctx->dns_domain_name = talloc_strdup_upper(mem_ctx, ads->config.realm);
69         NT_STATUS_HAVE_NO_MEMORY(ctx->dns_domain_name);
70
71         return NT_STATUS_OK;
72 }
73
74 /****************************************************************
75 ****************************************************************/
76
77 static NTSTATUS fetch_sam_entry_keytab(TALLOC_CTX *mem_ctx,
78                                        enum netr_SamDatabaseID database_id,
79                                        uint32_t rid,
80                                        struct netr_DELTA_USER *r,
81                                        struct libnet_keytab_context *ctx)
82 {
83         NTSTATUS status;
84         uint32_t kvno = 0;
85         DATA_BLOB blob;
86
87         if (memcmp(r->ntpassword.hash, ctx->zero_buf, 16) == 0) {
88                 return NT_STATUS_OK;
89         }
90
91         kvno = ads_get_kvno(ctx->ads, r->account_name.string);
92         blob = data_blob_const(r->ntpassword.hash, 16);
93
94         status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx,
95                                                      kvno,
96                                                      r->account_name.string,
97                                                      NULL,
98                                                      ENCTYPE_ARCFOUR_HMAC,
99                                                      blob);
100         if (!NT_STATUS_IS_OK(status)) {
101                 return status;
102         }
103
104         return NT_STATUS_OK;
105 }
106
107 /****************************************************************
108 ****************************************************************/
109
110 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
111                             struct samsync_context *ctx,
112                             enum netr_SamDatabaseID database_id,
113                             uint64_t *sequence_num)
114 {
115         krb5_error_code ret = 0;
116         NTSTATUS status;
117         struct libnet_keytab_context *keytab_ctx = NULL;
118         struct libnet_keytab_entry *entry;
119         uint64_t old_sequence_num = 0;
120         const char *principal = NULL;
121
122         ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
123         if (ret) {
124                 return krb5_to_nt_status(ret);
125         }
126
127         keytab_ctx->clean_old_entries = ctx->clean_old_entries;
128         ctx->private_data = keytab_ctx;
129
130         status = keytab_ad_connect(mem_ctx,
131                                    ctx->domain_name,
132                                    ctx->username,
133                                    ctx->password,
134                                    keytab_ctx);
135         if (!NT_STATUS_IS_OK(status)) {
136                 TALLOC_FREE(keytab_ctx);
137                 return status;
138         }
139
140         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
141                                     keytab_ctx->dns_domain_name);
142         NT_STATUS_HAVE_NO_MEMORY(principal);
143
144         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
145                                      mem_ctx);
146         if (entry && (entry->password.length == 8)) {
147                 old_sequence_num = BVAL(entry->password.data, 0);
148         }
149
150         if (sequence_num) {
151                 *sequence_num = old_sequence_num;
152         }
153
154         return status;
155 }
156
157 /****************************************************************
158 ****************************************************************/
159
160 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
161                                          enum netr_SamDatabaseID database_id,
162                                          struct netr_DELTA_ENUM_ARRAY *r,
163                                          uint64_t *sequence_num,
164                                          struct samsync_context *ctx)
165 {
166         struct libnet_keytab_context *keytab_ctx =
167                 (struct libnet_keytab_context *)ctx->private_data;
168
169         NTSTATUS status = NT_STATUS_OK;
170         int i;
171
172         for (i = 0; i < r->num_deltas; i++) {
173
174                 switch (r->delta_enum[i].delta_type) {
175                 case NETR_DELTA_USER:
176                         break;
177                 case NETR_DELTA_DOMAIN:
178                         if (sequence_num) {
179                                 *sequence_num =
180                                         r->delta_enum[i].delta_union.domain->sequence_num;
181                         }
182                         continue;
183                 case NETR_DELTA_MODIFY_COUNT:
184                         if (sequence_num) {
185                                 *sequence_num =
186                                         *r->delta_enum[i].delta_union.modified_count;
187                         }
188                         continue;
189                 default:
190                         continue;
191                 }
192
193                 status = fetch_sam_entry_keytab(mem_ctx, database_id,
194                                                 r->delta_enum[i].delta_id_union.rid,
195                                                 r->delta_enum[i].delta_union.user,
196                                                 keytab_ctx);
197                 if (!NT_STATUS_IS_OK(status)) {
198                         goto out;
199                 }
200         }
201  out:
202         return status;
203 }
204
205 /****************************************************************
206 ****************************************************************/
207
208 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
209                              struct samsync_context *ctx,
210                              enum netr_SamDatabaseID database_id,
211                              uint64_t sequence_num)
212 {
213         struct libnet_keytab_context *keytab_ctx =
214                 (struct libnet_keytab_context *)ctx->private_data;
215         krb5_error_code ret;
216         NTSTATUS status;
217         struct libnet_keytab_entry *entry;
218         uint64_t old_sequence_num = 0;
219         const char *principal = NULL;
220
221         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
222                                     keytab_ctx->dns_domain_name);
223         NT_STATUS_HAVE_NO_MEMORY(principal);
224
225
226         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
227                                      mem_ctx);
228         if (entry && (entry->password.length == 8)) {
229                 old_sequence_num = BVAL(entry->password.data, 0);
230         }
231
232
233         if (sequence_num > old_sequence_num) {
234                 DATA_BLOB blob;
235                 blob = data_blob_talloc_zero(mem_ctx, 8);
236                 SBVAL(blob.data, 0, sequence_num);
237
238                 status = libnet_keytab_add_to_keytab_entries(mem_ctx, keytab_ctx,
239                                                              0,
240                                                              "SEQUENCE_NUM",
241                                                              NULL,
242                                                              ENCTYPE_NULL,
243                                                              blob);
244                 if (!NT_STATUS_IS_OK(status)) {
245                         goto done;
246                 }
247         }
248
249         ret = libnet_keytab_add(keytab_ctx);
250         if (ret) {
251                 status = krb5_to_nt_status(ret);
252                 ctx->error_message = talloc_asprintf(ctx,
253                         "Failed to add entries to keytab %s: %s",
254                         keytab_ctx->keytab_name, error_message(ret));
255                 TALLOC_FREE(keytab_ctx);
256                 return status;
257         }
258
259         ctx->result_message = talloc_asprintf(ctx,
260                 "Vampired %d accounts to keytab %s",
261                 keytab_ctx->count,
262                 keytab_ctx->keytab_name);
263
264         status = NT_STATUS_OK;
265
266  done:
267         TALLOC_FREE(keytab_ctx);
268
269         return status;
270 }
271
272 #else
273
274 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
275                             struct samsync_context *ctx,
276                             enum netr_SamDatabaseID database_id,
277                             uint64_t *sequence_num)
278 {
279         return NT_STATUS_NOT_SUPPORTED;
280 }
281
282 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
283                                          enum netr_SamDatabaseID database_id,
284                                          struct netr_DELTA_ENUM_ARRAY *r,
285                                          uint64_t *sequence_num,
286                                          struct samsync_context *ctx)
287 {
288         return NT_STATUS_NOT_SUPPORTED;
289 }
290
291 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
292                              struct samsync_context *ctx,
293                              enum netr_SamDatabaseID database_id,
294                              uint64_t sequence_num)
295 {
296         return NT_STATUS_NOT_SUPPORTED;
297 }
298
299 #endif /* defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC) */
300
301 const struct samsync_ops libnet_samsync_keytab_ops = {
302         .startup                = init_keytab,
303         .process_objects        = fetch_sam_entries_keytab,
304         .finish                 = close_keytab
305 };