source4/kdc/kpasswdd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    kpasswd Server implementation
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7    Copyright (C) Andrew Tridgell        2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "smbd/service_task.h"
  26 #include "lib/events/events.h"
  27 #include "lib/socket/socket.h"
  28 #include "kdc/kdc.h"
  29 #include "system/network.h"
  30 #include "dlinklist.h"
  31 #include "lib/ldb/include/ldb.h"
  32 #include "heimdal/lib/krb5/krb5-private.h"
  33 #include "auth/auth.h"
  34
  35 /* hold information about one kdc socket */
  36 struct kpasswd_socket {
  37         struct socket_context *sock;
  38         struct kdc_server *kdc;
  39         struct fd_event *fde;
  40
  41         /* a queue of outgoing replies that have been deferred */
  42         struct kdc_reply *send_queue;
  43 };
  44
  45 /* Return true if there is a valid error packet formed in the error_blob */
  46 static BOOL kpasswdd_make_error_reply(struct kdc_server *kdc,
  47                                      TALLOC_CTX *mem_ctx,
  48                                      uint16_t result_code,
  49                                      const char *error_string,
  50                                      DATA_BLOB *error_blob)
  51 {
  52         char *error_string_utf8;
  53         ssize_t len;
  54
  55         DEBUG(result_code ? 3 : 10, ("kpasswdd: %s\n", error_string));
  56
  57         len = push_utf8_talloc(mem_ctx, &error_string_utf8, error_string);
  58         if (len == -1) {
  59                 return False;
  60         }
  61
  62         *error_blob = data_blob_talloc(mem_ctx, NULL, 2 + len + 1);
  63         if (!error_blob->data) {
  64                 return False;
  65         }
  66         RSSVAL(error_blob->data, 0, result_code);
  67         memcpy(error_blob->data + 2, error_string_utf8, len + 1);
  68         return True;
  69 }
  70
  71 /* Return true if there is a valid error packet formed in the error_blob */
  72 static BOOL kpasswdd_make_unauth_error_reply(struct kdc_server *kdc,
  73                                             TALLOC_CTX *mem_ctx,
  74                                             uint16_t result_code,
  75                                             const char *error_string,
  76                                             DATA_BLOB *error_blob)
  77 {
  78         BOOL ret;
  79         int kret;
  80         DATA_BLOB error_bytes;
  81         krb5_data k5_error_bytes, k5_error_blob;
  82         ret = kpasswdd_make_error_reply(kdc, mem_ctx, result_code, error_string,
  83                                        &error_bytes);
  84         if (!ret) {
  85                 return False;
  86         }
  87         k5_error_bytes.data = error_bytes.data;
  88         k5_error_bytes.length = error_bytes.length;
  89         kret = krb5_mk_error(kdc->smb_krb5_context->krb5_context,
  90                              result_code, NULL, &k5_error_bytes,
  91                              NULL, NULL, NULL, NULL, &k5_error_blob);
  92         if (kret) {
  93                 return False;
  94         }
  95         *error_blob = data_blob_talloc(mem_ctx, k5_error_blob.data, k5_error_blob.length);
  96         krb5_data_free(&k5_error_blob);
  97         if (!error_blob->data) {
  98                 return False;
  99         }
 100         return True;
 101 }
 102
 103 static BOOL kpasswd_make_pwchange_reply(struct kdc_server *kdc,
 104                                         TALLOC_CTX *mem_ctx,
 105                                         NTSTATUS status,
 106                                         enum samr_RejectReason reject_reason,
 107                                         struct samr_DomInfo1 *dominfo,
 108                                         DATA_BLOB *error_blob)
 109 {
 110         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
 111                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 112                                                 KRB5_KPASSWD_ACCESSDENIED,
 113                                                 "No such user when changing password",
 114                                                 error_blob);
 115         }
 116         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 117                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 118                                                 KRB5_KPASSWD_ACCESSDENIED,
 119                                                 "Not permitted to change password",
 120                                                 error_blob);
 121         }
 122         if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
 123                 const char *reject_string;
 124                 switch (reject_reason) {
 125                 case SAMR_REJECT_TOO_SHORT:
 126                         reject_string = talloc_asprintf(mem_ctx, "Password too short, password must be at least %d characters long",
 127                                                         dominfo->min_password_length);
 128                         break;
 129                 case SAMR_REJECT_COMPLEXITY:
 130                         reject_string = "Password does not meet complexity requirements";
 131                         break;
 132                 case SAMR_REJECT_OTHER:
 133                         reject_string = talloc_asprintf(mem_ctx, "Password must be at least %d characters long, and cannot match any of your %d previous passwords",
 134                                                         dominfo->min_password_length, dominfo->password_history_length);
 135                         break;
 136                 }
 137                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 138                                                 KRB5_KPASSWD_SOFTERROR,
 139                                                 reject_string,
 140                                                 error_blob);
 141         }
 142         if (!NT_STATUS_IS_OK(status)) {
 143                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 144                                                  KRB5_KPASSWD_HARDERROR,
 145                                                  talloc_asprintf(mem_ctx, "failed to set password: %s", nt_errstr(status)),
 146                                                  error_blob);
 147
 148         }
 149         return kpasswdd_make_error_reply(kdc, mem_ctx, KRB5_KPASSWD_SUCCESS,
 150                                         "Password changed",
 151                                         error_blob);
 152 }
 153
 154 /*
 155    A user password change
 156
 157    Return true if there is a valid error packet (or sucess) formed in
 158    the error_blob
 159 */
 160 static BOOL kpasswdd_change_password(struct kdc_server *kdc,
 161                                      TALLOC_CTX *mem_ctx,
 162                                      struct auth_session_info *session_info,
 163                                      const char *password,
 164                                      DATA_BLOB *reply)
 165 {
 166         NTSTATUS status;
 167         enum samr_RejectReason reject_reason;
 168         struct samr_DomInfo1 *dominfo;
 169         struct ldb_context *samdb;
 170
 171         samdb = samdb_connect(mem_ctx, system_session(mem_ctx));
 172         if (!samdb) {
 173                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 174                                                 KRB5_KPASSWD_HARDERROR,
 175                                                 "Failed to open samdb",
 176                                                 reply);
 177         }
 178
 179         DEBUG(3, ("Changing password of %s\n", dom_sid_string(mem_ctx, session_info->security_token->user_sid)));
 180
 181         /* User password change */
 182         status = samdb_set_password_sid(samdb, mem_ctx,
 183                                         session_info->security_token->user_sid,
 184                                         password, NULL, NULL,
 185                                         True, /* this is a user password change */
 186                                         True, /* run restriction tests */
 187                                         &reject_reason,
 188                                         &dominfo);
 189         return kpasswd_make_pwchange_reply(kdc, mem_ctx,
 190                                            status,
 191                                            reject_reason,
 192                                            dominfo,
 193                                            reply);
 194
 195 }
 196
 197 static BOOL kpasswd_process_request(struct kdc_server *kdc,
 198                                     TALLOC_CTX *mem_ctx,
 199                                     struct gensec_security *gensec_security,
 200                                     uint16_t version,
 201                                     DATA_BLOB *input,
 202                                     DATA_BLOB *reply)
 203 {
 204         NTSTATUS status;
 205         enum samr_RejectReason reject_reason;
 206         struct samr_DomInfo1 *dominfo;
 207         struct ldb_context *samdb;
 208         struct auth_session_info *session_info;
 209         struct ldb_message *msg = ldb_msg_new(gensec_security);
 210         krb5_context context = kdc->smb_krb5_context->krb5_context;
 211         int ret;
 212         if (!samdb || !msg) {
 213                 return False;
 214         }
 215
 216         if (!NT_STATUS_IS_OK(gensec_session_info(gensec_security,
 217                                                  &session_info))) {
 218                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 219                                                 KRB5_KPASSWD_HARDERROR,
 220                                                 "gensec_session_info failed!",
 221                                                 reply);
 222         }
 223
 224         switch (version) {
 225         case KRB5_KPASSWD_VERS_CHANGEPW:
 226         {
 227                 char *password = talloc_strndup(mem_ctx, input->data, input->length);
 228                 if (!password) {
 229                         return False;
 230                 }
 231                 return kpasswdd_change_password(kdc, mem_ctx, session_info,
 232                                                 password, reply);
 233                 break;
 234         }
 235         case KRB5_KPASSWD_VERS_SETPW:
 236         {
 237                 size_t len;
 238                 ChangePasswdDataMS chpw;
 239                 char *password;
 240                 krb5_principal principal;
 241                 char *set_password_on_princ;
 242                 struct ldb_dn *set_password_on_dn;
 243
 244                 samdb = samdb_connect(gensec_security, session_info);
 245
 246                 ret = decode_ChangePasswdDataMS(input->data, input->length,
 247                                                 &chpw, &len);
 248                 if (ret) {
 249                         return kpasswdd_make_error_reply(kdc, mem_ctx,
 250                                                         KRB5_KPASSWD_MALFORMED,
 251                                                         "failed to decode password change structure",
 252                                                         reply);
 253                 }
 254
 255                 password = talloc_strndup(mem_ctx, chpw.newpasswd.data,
 256                                           chpw.newpasswd.length);
 257                 if (!password) {
 258                         free_ChangePasswdDataMS(&chpw);
 259                         return False;
 260                 }
 261                 if ((chpw.targname && !chpw.targrealm)
 262                     || (!chpw.targname && chpw.targrealm)) {
 263                         return kpasswdd_make_error_reply(kdc, mem_ctx,
 264                                                         KRB5_KPASSWD_MALFORMED,
 265                                                         "Realm and principal must be both present, or neither present",
 266                                                         reply);
 267                 }
 268                 if (chpw.targname && chpw.targrealm) {
 269                         if (_krb5_principalname2krb5_principal(&principal, *chpw.targname,
 270                                                                *chpw.targrealm) != 0) {
 271                                 free_ChangePasswdDataMS(&chpw);
 272                                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 273                                                                 KRB5_KPASSWD_MALFORMED,
 274                                                                 "failed to extract principal to set",
 275                                                                 reply);
 276
 277                         }
 278                 } else {
 279                         free_ChangePasswdDataMS(&chpw);
 280                         return kpasswdd_change_password(kdc, mem_ctx, session_info,
 281                                                         password, reply);
 282                 }
 283                 free_ChangePasswdDataMS(&chpw);
 284
 285                 if (krb5_unparse_name(context, principal, &set_password_on_princ) != 0) {
 286                         krb5_free_principal(context, principal);
 287                         return kpasswdd_make_error_reply(kdc, mem_ctx,
 288                                                         KRB5_KPASSWD_MALFORMED,
 289                                                         "krb5_unparse_name failed!",
 290                                                         reply);
 291                 }
 292
 293                 krb5_free_principal(context, principal);
 294
 295                 status = crack_user_principal_name(samdb, mem_ctx,
 296                                                    set_password_on_princ,
 297                                                    &set_password_on_dn, NULL);
 298                 free(set_password_on_princ);
 299                 if (!NT_STATUS_IS_OK(status)) {
 300                         return kpasswd_make_pwchange_reply(kdc, mem_ctx,
 301                                                            status,
 302                                                            reject_reason,
 303                                                            dominfo,
 304                                                            reply);
 305                 }
 306
 307                 /* Admin password set */
 308                 status = samdb_set_password(samdb, mem_ctx,
 309                                             set_password_on_dn, NULL,
 310                                             msg, password, NULL, NULL,
 311                                             False, /* this is a user password change */
 312                                             True, /* run restriction tests */
 313                                             &reject_reason, &dominfo);
 314
 315                 return kpasswd_make_pwchange_reply(kdc, mem_ctx,
 316                                                    status,
 317                                                    reject_reason,
 318                                                    dominfo,
 319                                                    reply);
 320         }
 321         default:
 322                 return kpasswdd_make_error_reply(kdc, mem_ctx,
 323                                                 KRB5_KPASSWD_BAD_VERSION,
 324                                                 talloc_asprintf(mem_ctx,
 325                                                                 "Protocol version %u not supported",
 326                                                                 version),
 327                                                 reply);
 328         }
 329         return True;
 330 }
 331
 332 BOOL kpasswdd_process(struct kdc_server *kdc,
 333                       TALLOC_CTX *mem_ctx,
 334                       DATA_BLOB *input,
 335                       DATA_BLOB *reply,
 336                       const char *from,
 337                       int src_port)
 338 {
 339         BOOL ret;
 340         const uint16_t header_len = 6;
 341         uint16_t len;
 342         uint16_t ap_req_len;
 343         uint16_t krb_priv_len;
 344         uint16_t version;
 345         NTSTATUS nt_status;
 346         DATA_BLOB ap_req, krb_priv_req, krb_priv_rep, ap_rep;
 347         DATA_BLOB kpasswd_req, kpasswd_rep;
 348         struct cli_credentials *server_credentials;
 349         struct gensec_security *gensec_security;
 350         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 351
 352         if (!tmp_ctx) {
 353                 return False;
 354         }
 355
 356         if (input->length <= header_len) {
 357                 talloc_free(tmp_ctx);
 358                 return False;
 359         }
 360
 361         len = RSVAL(input->data, 0);
 362         if (input->length != len) {
 363                 talloc_free(tmp_ctx);
 364                 return False;
 365         }
 366
 367         version = RSVAL(input->data, 2);
 368         ap_req_len = RSVAL(input->data, 4);
 369         if ((ap_req_len >= len) || (ap_req_len + header_len) >= len) {
 370                 talloc_free(tmp_ctx);
 371                 return False;
 372         }
 373
 374         krb_priv_len = len - ap_req_len;
 375         ap_req = data_blob_const(&input->data[header_len], ap_req_len);
 376         krb_priv_req = data_blob_const(&input->data[header_len + ap_req_len], krb_priv_len);
 377
 378         nt_status = gensec_server_start(tmp_ctx, &gensec_security, kdc->task->event_ctx);
 379         if (!NT_STATUS_IS_OK(nt_status)) {
 380                 talloc_free(tmp_ctx);
 381                 return False;
 382         }
 383
 384         server_credentials
 385                 = cli_credentials_init(tmp_ctx);
 386         if (!server_credentials) {
 387                 DEBUG(1, ("Failed to init server credentials\n"));
 388                 return False;
 389         }
 390
 391         cli_credentials_set_conf(server_credentials);
 392         nt_status = cli_credentials_set_stored_principal(server_credentials, "kadmin/changepw");
 393         if (!NT_STATUS_IS_OK(nt_status)) {
 394                 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
 395                                                        KRB5_KPASSWD_HARDERROR,
 396                                                        talloc_asprintf(mem_ctx,
 397                                                                        "Failed to obtain server credentials for kadmin/changepw: %s\n",
 398                                                                        nt_errstr(nt_status)),
 399                                                        &krb_priv_rep);
 400                 ap_rep.length = 0;
 401                 if (ret) {
 402                         goto reply;
 403                 }
 404                 talloc_free(tmp_ctx);
 405                 return ret;
 406         }
 407
 408         gensec_set_credentials(gensec_security, server_credentials);
 409         gensec_want_feature(gensec_security, GENSEC_FEATURE_SEAL);
 410
 411         nt_status = gensec_start_mech_by_name(gensec_security, "krb5");
 412         if (!NT_STATUS_IS_OK(nt_status)) {
 413                 talloc_free(tmp_ctx);
 414                 return False;
 415         }
 416
 417         nt_status = gensec_update(gensec_security, tmp_ctx, ap_req, &ap_rep);
 418         if (!NT_STATUS_IS_OK(nt_status) && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 419
 420                 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
 421                                                        KRB5_KPASSWD_HARDERROR,
 422                                                        talloc_asprintf(mem_ctx,
 423                                                                        "gensec_update failed: %s",
 424                                                                        nt_errstr(nt_status)),
 425                                                        &krb_priv_rep);
 426                 ap_rep.length = 0;
 427                 if (ret) {
 428                         goto reply;
 429                 }
 430                 talloc_free(tmp_ctx);
 431                 return ret;
 432         }
 433
 434         nt_status = gensec_unwrap(gensec_security, tmp_ctx, &krb_priv_req, &kpasswd_req);
 435         if (!NT_STATUS_IS_OK(nt_status)) {
 436                 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
 437                                                        KRB5_KPASSWD_HARDERROR,
 438                                                        talloc_asprintf(mem_ctx,
 439                                                                        "gensec_unwrap failed: %s",
 440                                                                        nt_errstr(nt_status)),
 441                                                        &krb_priv_rep);
 442                 ap_rep.length = 0;
 443                 if (ret) {
 444                         goto reply;
 445                 }
 446                 talloc_free(tmp_ctx);
 447                 return ret;
 448         }
 449
 450         ret = kpasswd_process_request(kdc, tmp_ctx,
 451                                       gensec_security,
 452                                       version,
 453                                       &kpasswd_req, &kpasswd_rep);
 454         if (!ret) {
 455                 /* Argh! */
 456                 return False;
 457         }
 458
 459         nt_status = gensec_wrap(gensec_security, tmp_ctx,
 460                                 &kpasswd_rep, &krb_priv_rep);
 461         if (!NT_STATUS_IS_OK(nt_status)) {
 462                 ret = kpasswdd_make_unauth_error_reply(kdc, mem_ctx,
 463                                                        KRB5_KPASSWD_HARDERROR,
 464                                                        talloc_asprintf(mem_ctx,
 465                                                                        "gensec_wrap failed: %s",
 466                                                                        nt_errstr(nt_status)),
 467                                                        &krb_priv_rep);
 468                 ap_rep.length = 0;
 469                 if (ret) {
 470                         goto reply;
 471                 }
 472                 talloc_free(tmp_ctx);
 473                 return ret;
 474         }
 475
 476 reply:
 477         *reply = data_blob_talloc(mem_ctx, NULL, krb_priv_rep.length + ap_rep.length + header_len);
 478         if (!reply->data) {
 479                 return False;
 480         }
 481
 482         RSSVAL(reply->data, 0, reply->length);
 483         RSSVAL(reply->data, 2, 1); /* This is a version 1 reply, MS change/set or otherwise */
 484         RSSVAL(reply->data, 4, ap_rep.length);
 485         memcpy(reply->data + header_len,
 486                ap_rep.data,
 487                ap_rep.length);
 488         memcpy(reply->data + header_len + ap_rep.length,
 489                krb_priv_rep.data,
 490                krb_priv_rep.length);
 491
 492         talloc_free(tmp_ctx);
 493         return ret;
 494 }
 495