s3:libnet: accept empty realm for AD domains when only security=domain is set.
[samba.git] / source3 / libnet / libnet_samsync_keytab.c
1 /*
2    Unix SMB/CIFS implementation.
3    dump the remote SAM using rpc samsync operations
4
5    Copyright (C) Guenther Deschner 2008.
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smb_krb5.h"
23 #include "ads.h"
24 #include "libnet/libnet_keytab.h"
25 #include "libnet/libnet_samsync.h"
26 #include "krb5_env.h"
27
28 #if defined(HAVE_ADS)
29
30 /****************************************************************
31 ****************************************************************/
32
33 static NTSTATUS keytab_ad_connect(TALLOC_CTX *mem_ctx,
34                                   const char *domain_name,
35                                   const char *dc,
36                                   const char *username,
37                                   const char *password,
38                                   struct libnet_keytab_context *ctx)
39 {
40         ADS_STATUS ad_status;
41         ADS_STRUCT *ads;
42
43         ads = ads_init(NULL, domain_name, dc);
44         NT_STATUS_HAVE_NO_MEMORY(ads);
45
46         if (getenv(KRB5_ENV_CCNAME) == NULL) {
47                 setenv(KRB5_ENV_CCNAME, "MEMORY:libnet_samsync_keytab", 1);
48         }
49
50         ads->auth.user_name = SMB_STRDUP(username);
51         ads->auth.password = SMB_STRDUP(password);
52
53         ad_status = ads_connect_user_creds(ads);
54         if (!ADS_ERR_OK(ad_status)) {
55                 return NT_STATUS_UNSUCCESSFUL;
56         }
57
58         ctx->ads = ads;
59
60         ctx->dns_domain_name = talloc_strdup_upper(mem_ctx, ads->config.realm);
61         NT_STATUS_HAVE_NO_MEMORY(ctx->dns_domain_name);
62
63         return NT_STATUS_OK;
64 }
65
66 /****************************************************************
67 ****************************************************************/
68
69 static NTSTATUS fetch_sam_entry_keytab(TALLOC_CTX *mem_ctx,
70                                        enum netr_SamDatabaseID database_id,
71                                        uint32_t rid,
72                                        struct netr_DELTA_USER *r,
73                                        struct libnet_keytab_context *ctx)
74 {
75         NTSTATUS status;
76         uint32_t kvno = 0;
77         DATA_BLOB blob;
78
79         if (memcmp(r->ntpassword.hash, ctx->zero_buf, 16) == 0) {
80                 return NT_STATUS_OK;
81         }
82
83         kvno = ads_get_kvno(ctx->ads, r->account_name.string);
84         blob = data_blob_const(r->ntpassword.hash, 16);
85
86         status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx,
87                                                      kvno,
88                                                      r->account_name.string,
89                                                      NULL,
90                                                      ENCTYPE_ARCFOUR_HMAC,
91                                                      blob);
92         if (!NT_STATUS_IS_OK(status)) {
93                 return status;
94         }
95
96         return NT_STATUS_OK;
97 }
98
99 /****************************************************************
100 ****************************************************************/
101
102 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
103                             struct samsync_context *ctx,
104                             enum netr_SamDatabaseID database_id,
105                             uint64_t *sequence_num)
106 {
107         krb5_error_code ret = 0;
108         NTSTATUS status;
109         struct libnet_keytab_context *keytab_ctx = NULL;
110         struct libnet_keytab_entry *entry;
111         uint64_t old_sequence_num = 0;
112         const char *principal = NULL;
113         struct netr_DsRGetDCNameInfo *info = NULL;
114         const char *dc;
115
116         ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
117         if (ret) {
118                 return krb5_to_nt_status(ret);
119         }
120
121         status = dsgetdcname(mem_ctx, ctx->msg_ctx,
122                              ctx->domain_name, NULL, NULL, 0, &info);
123         if (!NT_STATUS_IS_OK(status)) {
124                 return status;
125         }
126
127         dc = strip_hostname(info->dc_unc);
128
129         keytab_ctx->clean_old_entries = ctx->clean_old_entries;
130         ctx->private_data = keytab_ctx;
131
132         status = keytab_ad_connect(mem_ctx,
133                                    ctx->domain_name,
134                                    dc,
135                                    ctx->username,
136                                    ctx->password,
137                                    keytab_ctx);
138         if (!NT_STATUS_IS_OK(status)) {
139                 TALLOC_FREE(keytab_ctx);
140                 return status;
141         }
142
143         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
144                                     keytab_ctx->dns_domain_name);
145         NT_STATUS_HAVE_NO_MEMORY(principal);
146
147         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
148                                      mem_ctx);
149         if (entry && (entry->password.length == 8)) {
150                 old_sequence_num = BVAL(entry->password.data, 0);
151         }
152
153         if (sequence_num) {
154                 *sequence_num = old_sequence_num;
155         }
156
157         return status;
158 }
159
160 /****************************************************************
161 ****************************************************************/
162
163 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
164                                          enum netr_SamDatabaseID database_id,
165                                          struct netr_DELTA_ENUM_ARRAY *r,
166                                          uint64_t *sequence_num,
167                                          struct samsync_context *ctx)
168 {
169         struct libnet_keytab_context *keytab_ctx =
170                 (struct libnet_keytab_context *)ctx->private_data;
171
172         NTSTATUS status = NT_STATUS_OK;
173         int i;
174
175         for (i = 0; i < r->num_deltas; i++) {
176
177                 switch (r->delta_enum[i].delta_type) {
178                 case NETR_DELTA_USER:
179                         break;
180                 case NETR_DELTA_DOMAIN:
181                         if (sequence_num) {
182                                 *sequence_num =
183                                         r->delta_enum[i].delta_union.domain->sequence_num;
184                         }
185                         continue;
186                 case NETR_DELTA_MODIFY_COUNT:
187                         if (sequence_num) {
188                                 *sequence_num =
189                                         *r->delta_enum[i].delta_union.modified_count;
190                         }
191                         continue;
192                 default:
193                         continue;
194                 }
195
196                 status = fetch_sam_entry_keytab(mem_ctx, database_id,
197                                                 r->delta_enum[i].delta_id_union.rid,
198                                                 r->delta_enum[i].delta_union.user,
199                                                 keytab_ctx);
200                 if (!NT_STATUS_IS_OK(status)) {
201                         goto out;
202                 }
203         }
204  out:
205         return status;
206 }
207
208 /****************************************************************
209 ****************************************************************/
210
211 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
212                              struct samsync_context *ctx,
213                              enum netr_SamDatabaseID database_id,
214                              uint64_t sequence_num)
215 {
216         struct libnet_keytab_context *keytab_ctx =
217                 (struct libnet_keytab_context *)ctx->private_data;
218         krb5_error_code ret;
219         NTSTATUS status;
220         struct libnet_keytab_entry *entry;
221         uint64_t old_sequence_num = 0;
222         const char *principal = NULL;
223
224         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
225                                     keytab_ctx->dns_domain_name);
226         NT_STATUS_HAVE_NO_MEMORY(principal);
227
228
229         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
230                                      mem_ctx);
231         if (entry && (entry->password.length == 8)) {
232                 old_sequence_num = BVAL(entry->password.data, 0);
233         }
234
235
236         if (sequence_num > old_sequence_num) {
237                 DATA_BLOB blob;
238                 blob = data_blob_talloc_zero(mem_ctx, 8);
239                 SBVAL(blob.data, 0, sequence_num);
240
241                 status = libnet_keytab_add_to_keytab_entries(mem_ctx, keytab_ctx,
242                                                              0,
243                                                              "SEQUENCE_NUM",
244                                                              NULL,
245                                                              ENCTYPE_NULL,
246                                                              blob);
247                 if (!NT_STATUS_IS_OK(status)) {
248                         goto done;
249                 }
250         }
251
252         ret = libnet_keytab_add(keytab_ctx);
253         if (ret) {
254                 status = krb5_to_nt_status(ret);
255                 ctx->error_message = talloc_asprintf(ctx,
256                         "Failed to add entries to keytab %s: %s",
257                         keytab_ctx->keytab_name, error_message(ret));
258                 TALLOC_FREE(keytab_ctx);
259                 return status;
260         }
261
262         ctx->result_message = talloc_asprintf(ctx,
263                 "Vampired %d accounts to keytab %s",
264                 keytab_ctx->count,
265                 keytab_ctx->keytab_name);
266
267         status = NT_STATUS_OK;
268
269  done:
270         TALLOC_FREE(keytab_ctx);
271
272         return status;
273 }
274
275 #else
276
277 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
278                             struct samsync_context *ctx,
279                             enum netr_SamDatabaseID database_id,
280                             uint64_t *sequence_num)
281 {
282         return NT_STATUS_NOT_SUPPORTED;
283 }
284
285 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
286                                          enum netr_SamDatabaseID database_id,
287                                          struct netr_DELTA_ENUM_ARRAY *r,
288                                          uint64_t *sequence_num,
289                                          struct samsync_context *ctx)
290 {
291         return NT_STATUS_NOT_SUPPORTED;
292 }
293
294 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
295                              struct samsync_context *ctx,
296                              enum netr_SamDatabaseID database_id,
297                              uint64_t sequence_num)
298 {
299         return NT_STATUS_NOT_SUPPORTED;
300 }
301
302 #endif /* defined(HAVE_ADS) */
303
304 const struct samsync_ops libnet_samsync_keytab_ops = {
305         .startup                = init_keytab,
306         .process_objects        = fetch_sam_entries_keytab,
307         .finish                 = close_keytab
308 };