2 Unix SMB/CIFS implementation.
3 dump the remote SAM using rpc samsync operations
5 Copyright (C) Guenther Deschner 2008.
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libnet/libnet_keytab.h"
25 #include "libnet/libnet_samsync.h"
29 /****************************************************************
30 ****************************************************************/
32 static NTSTATUS keytab_ad_connect(TALLOC_CTX *mem_ctx,
33 const char *domain_name,
36 struct libnet_keytab_context *ctx)
41 struct netr_DsRGetDCNameInfo *info = NULL;
44 status = dsgetdcname(mem_ctx, NULL, domain_name, NULL, NULL, 0, &info);
45 if (!NT_STATUS_IS_OK(status)) {
49 dc = strip_hostname(info->dc_unc);
51 ads = ads_init(NULL, domain_name, dc);
52 NT_STATUS_HAVE_NO_MEMORY(ads);
54 if (getenv(KRB5_ENV_CCNAME) == NULL) {
55 setenv(KRB5_ENV_CCNAME, "MEMORY:libnet_samsync_keytab", 1);
58 ads->auth.user_name = SMB_STRDUP(username);
59 ads->auth.password = SMB_STRDUP(password);
61 ad_status = ads_connect_user_creds(ads);
62 if (!ADS_ERR_OK(ad_status)) {
63 return NT_STATUS_UNSUCCESSFUL;
68 ctx->dns_domain_name = talloc_strdup_upper(mem_ctx, ads->config.realm);
69 NT_STATUS_HAVE_NO_MEMORY(ctx->dns_domain_name);
74 /****************************************************************
75 ****************************************************************/
77 static NTSTATUS fetch_sam_entry_keytab(TALLOC_CTX *mem_ctx,
78 enum netr_SamDatabaseID database_id,
80 struct netr_DELTA_USER *r,
81 struct libnet_keytab_context *ctx)
87 if (memcmp(r->ntpassword.hash, ctx->zero_buf, 16) == 0) {
91 kvno = ads_get_kvno(ctx->ads, r->account_name.string);
92 blob = data_blob_const(r->ntpassword.hash, 16);
94 status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx,
96 r->account_name.string,
100 if (!NT_STATUS_IS_OK(status)) {
107 /****************************************************************
108 ****************************************************************/
110 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
111 struct samsync_context *ctx,
112 enum netr_SamDatabaseID database_id,
113 uint64_t *sequence_num)
115 krb5_error_code ret = 0;
117 struct libnet_keytab_context *keytab_ctx = NULL;
118 struct libnet_keytab_entry *entry;
119 uint64_t old_sequence_num = 0;
120 const char *principal = NULL;
122 ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
124 return krb5_to_nt_status(ret);
127 keytab_ctx->clean_old_entries = ctx->clean_old_entries;
128 ctx->private_data = keytab_ctx;
130 status = keytab_ad_connect(mem_ctx,
135 if (!NT_STATUS_IS_OK(status)) {
136 TALLOC_FREE(keytab_ctx);
140 principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
141 keytab_ctx->dns_domain_name);
142 NT_STATUS_HAVE_NO_MEMORY(principal);
144 entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
146 if (entry && (entry->password.length == 8)) {
147 old_sequence_num = BVAL(entry->password.data, 0);
151 *sequence_num = old_sequence_num;
157 /****************************************************************
158 ****************************************************************/
160 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
161 enum netr_SamDatabaseID database_id,
162 struct netr_DELTA_ENUM_ARRAY *r,
163 uint64_t *sequence_num,
164 struct samsync_context *ctx)
166 struct libnet_keytab_context *keytab_ctx =
167 (struct libnet_keytab_context *)ctx->private_data;
169 NTSTATUS status = NT_STATUS_OK;
172 for (i = 0; i < r->num_deltas; i++) {
174 switch (r->delta_enum[i].delta_type) {
175 case NETR_DELTA_USER:
177 case NETR_DELTA_DOMAIN:
180 r->delta_enum[i].delta_union.domain->sequence_num;
183 case NETR_DELTA_MODIFY_COUNT:
186 *r->delta_enum[i].delta_union.modified_count;
193 status = fetch_sam_entry_keytab(mem_ctx, database_id,
194 r->delta_enum[i].delta_id_union.rid,
195 r->delta_enum[i].delta_union.user,
197 if (!NT_STATUS_IS_OK(status)) {
205 /****************************************************************
206 ****************************************************************/
208 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
209 struct samsync_context *ctx,
210 enum netr_SamDatabaseID database_id,
211 uint64_t sequence_num)
213 struct libnet_keytab_context *keytab_ctx =
214 (struct libnet_keytab_context *)ctx->private_data;
217 struct libnet_keytab_entry *entry;
218 uint64_t old_sequence_num = 0;
219 const char *principal = NULL;
221 principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
222 keytab_ctx->dns_domain_name);
223 NT_STATUS_HAVE_NO_MEMORY(principal);
226 entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
228 if (entry && (entry->password.length == 8)) {
229 old_sequence_num = BVAL(entry->password.data, 0);
233 if (sequence_num > old_sequence_num) {
235 blob = data_blob_talloc_zero(mem_ctx, 8);
236 SBVAL(blob.data, 0, sequence_num);
238 status = libnet_keytab_add_to_keytab_entries(mem_ctx, keytab_ctx,
244 if (!NT_STATUS_IS_OK(status)) {
249 ret = libnet_keytab_add(keytab_ctx);
251 status = krb5_to_nt_status(ret);
252 ctx->error_message = talloc_asprintf(ctx,
253 "Failed to add entries to keytab %s: %s",
254 keytab_ctx->keytab_name, error_message(ret));
255 TALLOC_FREE(keytab_ctx);
259 ctx->result_message = talloc_asprintf(ctx,
260 "Vampired %d accounts to keytab %s",
262 keytab_ctx->keytab_name);
264 status = NT_STATUS_OK;
267 TALLOC_FREE(keytab_ctx);
274 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
275 struct samsync_context *ctx,
276 enum netr_SamDatabaseID database_id,
277 uint64_t *sequence_num)
279 return NT_STATUS_NOT_SUPPORTED;
282 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
283 enum netr_SamDatabaseID database_id,
284 struct netr_DELTA_ENUM_ARRAY *r,
285 uint64_t *sequence_num,
286 struct samsync_context *ctx)
288 return NT_STATUS_NOT_SUPPORTED;
291 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
292 struct samsync_context *ctx,
293 enum netr_SamDatabaseID database_id,
294 uint64_t sequence_num)
296 return NT_STATUS_NOT_SUPPORTED;
299 #endif /* defined(HAVE_ADS) */
301 const struct samsync_ops libnet_samsync_keytab_ops = {
302 .startup = init_keytab,
303 .process_objects = fetch_sam_entries_keytab,
304 .finish = close_keytab