source3/libnet/libnet_dssync_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Guenther Deschner <gd@samba.org> 2008
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libnet/libnet.h"
  22 #include "librpc/gen_ndr/ndr_drsblobs.h"
  23
  24 #if defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC)
  25
  26 static NTSTATUS add_to_keytab_entries(TALLOC_CTX *mem_ctx,
  27                                       struct libnet_keytab_context *ctx,
  28                                       uint32_t kvno,
  29                                       const char *name,
  30                                       const char *prefix,
  31                                       const krb5_enctype enctype,
  32                                       DATA_BLOB blob)
  33 {
  34         struct libnet_keytab_entry entry;
  35
  36         entry.kvno = kvno;
  37         entry.name = talloc_strdup(mem_ctx, name);
  38         entry.principal = talloc_asprintf(mem_ctx, "%s%s%s@%s",
  39                                           prefix ? prefix : "",
  40                                           prefix ? "/" : "",
  41                                           name, ctx->dns_domain_name);
  42         entry.enctype = enctype;
  43         entry.password = blob;
  44         NT_STATUS_HAVE_NO_MEMORY(entry.name);
  45         NT_STATUS_HAVE_NO_MEMORY(entry.principal);
  46         NT_STATUS_HAVE_NO_MEMORY(entry.password.data);
  47
  48         ADD_TO_ARRAY(mem_ctx, struct libnet_keytab_entry, entry,
  49                      &ctx->entries, &ctx->count);
  50         NT_STATUS_HAVE_NO_MEMORY(ctx->entries);
  51
  52         return NT_STATUS_OK;
  53 }
  54
  55 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
  56                                struct replUpToDateVectorBlob **pold_utdv)
  57 {
  58         krb5_error_code ret = 0;
  59         struct libnet_keytab_context *keytab_ctx;
  60         struct libnet_keytab_entry *entry;
  61         struct replUpToDateVectorBlob *old_utdv = NULL;
  62         char *principal;
  63
  64         ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
  65         if (ret) {
  66                 return krb5_to_nt_status(ret);
  67         }
  68
  69         keytab_ctx->dns_domain_name = ctx->dns_domain_name;
  70         ctx->private_data = keytab_ctx;
  71
  72         principal = talloc_asprintf(mem_ctx, "UTDV/%s@%s",
  73                                     ctx->nc_dn, ctx->dns_domain_name);
  74         NT_STATUS_HAVE_NO_MEMORY(principal);
  75
  76         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_ARCFOUR_HMAC,
  77                                      mem_ctx);
  78         if (entry) {
  79                 enum ndr_err_code ndr_err;
  80                 old_utdv = talloc(mem_ctx, struct replUpToDateVectorBlob);
  81
  82                 ndr_err = ndr_pull_struct_blob(&entry->password, old_utdv,
  83                                 old_utdv,
  84                                 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
  85                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  86                         NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
  87                         ctx->error_message = talloc_asprintf(mem_ctx,
  88                                         "Failed to pull UpToDateVector: %s",
  89                                         nt_errstr(status));
  90                         return status;
  91                 }
  92
  93                 if (DEBUGLEVEL >= 10) {
  94                         NDR_PRINT_DEBUG(replUpToDateVectorBlob, old_utdv);
  95                 }
  96         }
  97
  98         if (pold_utdv) {
  99                 *pold_utdv = old_utdv;
 100         }
 101
 102         return NT_STATUS_OK;
 103 }
 104
 105 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 106                               struct replUpToDateVectorBlob *new_utdv)
 107 {
 108         NTSTATUS status = NT_STATUS_OK;
 109         krb5_error_code ret = 0;
 110         struct libnet_keytab_context *keytab_ctx =
 111                 (struct libnet_keytab_context *)ctx->private_data;
 112
 113         if (new_utdv) {
 114                 enum ndr_err_code ndr_err;
 115                 DATA_BLOB blob;
 116                 char *principal;
 117
 118                 if (DEBUGLEVEL >= 10) {
 119                         NDR_PRINT_DEBUG(replUpToDateVectorBlob, new_utdv);
 120                 }
 121
 122                 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, new_utdv,
 123                                 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
 124                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 125                         status = ndr_map_error2ntstatus(ndr_err);
 126                         ctx->error_message = talloc_asprintf(mem_ctx,
 127                                         "Failed to push UpToDateVector: %s",
 128                                         nt_errstr(status));
 129                         goto done;
 130                 }
 131
 132                 status = add_to_keytab_entries(mem_ctx, keytab_ctx, 0,
 133                                                ctx->nc_dn, "UTDV",
 134                                                ENCTYPE_ARCFOUR_HMAC,
 135                                                blob);
 136                 if (!NT_STATUS_IS_OK(status)) {
 137                         goto done;
 138                 }
 139
 140                 principal = talloc_asprintf(mem_ctx, "UTDV/%s@%s",
 141                                             ctx->nc_dn, ctx->dns_domain_name);
 142                 if (!principal) {
 143                         status = NT_STATUS_NO_MEMORY;
 144                         goto done;
 145                 }
 146
 147                 ret = libnet_keytab_remove_entries(keytab_ctx, principal,
 148                                                    0, ENCTYPE_ARCFOUR_HMAC);
 149                 if (ret) {
 150                         status = krb5_to_nt_status(ret);
 151                         ctx->error_message = talloc_asprintf(mem_ctx,
 152                                 "Failed to remove old UTDV entries from "
 153                                 "keytab %s: %s", keytab_ctx->keytab_name,
 154                                 error_message(ret));
 155                         goto done;
 156                 }
 157         }
 158
 159         ret = libnet_keytab_add(keytab_ctx);
 160         if (ret) {
 161                 status = krb5_to_nt_status(ret);
 162                 ctx->error_message = talloc_asprintf(mem_ctx,
 163                         "Failed to add entries to keytab %s: %s",
 164                         keytab_ctx->keytab_name, error_message(ret));
 165                 goto done;
 166         }
 167
 168         ctx->result_message = talloc_asprintf(mem_ctx,
 169                 "Vampired %d accounts to keytab %s",
 170                 keytab_ctx->count,
 171                 keytab_ctx->keytab_name);
 172
 173 done:
 174         TALLOC_FREE(keytab_ctx);
 175         return status;
 176 }
 177
 178 /****************************************************************
 179 ****************************************************************/
 180
 181 static NTSTATUS parse_object(TALLOC_CTX *mem_ctx,
 182                              struct libnet_keytab_context *ctx,
 183                              struct drsuapi_DsReplicaObjectListItemEx *cur)
 184 {
 185         NTSTATUS status = NT_STATUS_OK;
 186         uchar nt_passwd[16];
 187         DATA_BLOB *blob;
 188         int i = 0;
 189         struct drsuapi_DsReplicaAttribute *attr;
 190         bool got_pwd = false;
 191
 192         char *upn = NULL;
 193         char **spn = NULL;
 194         uint32_t num_spns = 0;
 195         char *name = NULL;
 196         uint32_t kvno = 0;
 197         uint32_t uacc = 0;
 198         uint32_t sam_type = 0;
 199
 200         uint32_t pwd_history_len = 0;
 201         uint8_t *pwd_history = NULL;
 202
 203         ZERO_STRUCT(nt_passwd);
 204
 205         for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
 206
 207                 attr = &cur->object.attribute_ctr.attributes[i];
 208
 209                 if (attr->attid == DRSUAPI_ATTRIBUTE_servicePrincipalName) {
 210                         uint32_t count;
 211                         num_spns = attr->value_ctr.num_values;
 212                         spn = TALLOC_ARRAY(mem_ctx, char *, num_spns);
 213                         for (count = 0; count < num_spns; count++) {
 214                                 blob = attr->value_ctr.values[count].blob;
 215                                 pull_string_talloc(spn, NULL, 0,
 216                                                    &spn[count],
 217                                                    blob->data, blob->length,
 218                                                    STR_UNICODE);
 219                         }
 220                 }
 221
 222                 if (attr->value_ctr.num_values != 1) {
 223                         continue;
 224                 }
 225
 226                 if (!attr->value_ctr.values[0].blob) {
 227                         continue;
 228                 }
 229
 230                 blob = attr->value_ctr.values[0].blob;
 231
 232                 switch (attr->attid) {
 233                         case DRSUAPI_ATTRIBUTE_unicodePwd:
 234
 235                                 if (blob->length != 16) {
 236                                         break;
 237                                 }
 238
 239                                 memcpy(&nt_passwd, blob->data, 16);
 240                                 got_pwd = true;
 241
 242                                 /* pick the kvno from the meta_data version,
 243                                  * thanks, metze, for explaining this */
 244
 245                                 if (!cur->meta_data_ctr) {
 246                                         break;
 247                                 }
 248                                 if (cur->meta_data_ctr->count !=
 249                                     cur->object.attribute_ctr.num_attributes) {
 250                                         break;
 251                                 }
 252                                 kvno = cur->meta_data_ctr->meta_data[i].version;
 253                                 break;
 254                         case DRSUAPI_ATTRIBUTE_ntPwdHistory:
 255                                 pwd_history_len = blob->length / 16;
 256                                 pwd_history = blob->data;
 257                                 break;
 258                         case DRSUAPI_ATTRIBUTE_userPrincipalName:
 259                                 pull_string_talloc(mem_ctx, NULL, 0, &upn,
 260                                                    blob->data, blob->length,
 261                                                    STR_UNICODE);
 262                                 break;
 263                         case DRSUAPI_ATTRIBUTE_sAMAccountName:
 264                                 pull_string_talloc(mem_ctx, NULL, 0, &name,
 265                                                    blob->data, blob->length,
 266                                                    STR_UNICODE);
 267                                 break;
 268                         case DRSUAPI_ATTRIBUTE_sAMAccountType:
 269                                 sam_type = IVAL(blob->data, 0);
 270                                 break;
 271                         case DRSUAPI_ATTRIBUTE_userAccountControl:
 272                                 uacc = IVAL(blob->data, 0);
 273                                 break;
 274                         default:
 275                                 break;
 276                 }
 277         }
 278
 279         if (!name) {
 280                 DEBUG(10, ("no name (sAMAccountName) found - skipping.\n"));
 281                 return NT_STATUS_OK;
 282         }
 283
 284         if (!got_pwd) {
 285                 DEBUG(10, ("no password (unicodePwd) found - skipping.\n"));
 286                 return NT_STATUS_OK;
 287         }
 288
 289         DEBUG(1,("#%02d: %s:%d, ", ctx->count, name, kvno));
 290         DEBUGADD(1,("sAMAccountType: 0x%08x, userAccountControl: 0x%08x",
 291                 sam_type, uacc));
 292         if (upn) {
 293                 DEBUGADD(1,(", upn: %s", upn));
 294         }
 295         if (num_spns > 0) {
 296                 DEBUGADD(1, (", spns: ["));
 297                 for (i = 0; i < num_spns; i++) {
 298                         DEBUGADD(1, ("%s%s", spn[i],
 299                                      (i+1 == num_spns)?"]":", "));
 300                 }
 301         }
 302         DEBUGADD(1,("\n"));
 303
 304         status = add_to_keytab_entries(mem_ctx, ctx, kvno, name, NULL,
 305                                        ENCTYPE_ARCFOUR_HMAC,
 306                                        data_blob_talloc(mem_ctx, nt_passwd, 16));
 307
 308         if (!NT_STATUS_IS_OK(status)) {
 309                 return status;
 310         }
 311
 312         if ((kvno < 0) && (kvno < pwd_history_len)) {
 313                 return status;
 314         }
 315
 316         /* add password history */
 317
 318         /* skip first entry */
 319         if (got_pwd) {
 320                 kvno--;
 321                 i = 1;
 322         } else {
 323                 i = 0;
 324         }
 325
 326         for (; i<pwd_history_len; i++) {
 327                 status = add_to_keytab_entries(mem_ctx, ctx, kvno--, name, NULL,
 328                                 ENCTYPE_ARCFOUR_HMAC,
 329                                 data_blob_talloc(mem_ctx, &pwd_history[i*16], 16));
 330                 if (!NT_STATUS_IS_OK(status)) {
 331                         break;
 332                 }
 333         }
 334
 335         return status;
 336 }
 337
 338 /****************************************************************
 339 ****************************************************************/
 340
 341 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
 342                                        TALLOC_CTX *mem_ctx,
 343                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
 344                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
 345 {
 346         NTSTATUS status = NT_STATUS_OK;
 347         struct libnet_keytab_context *keytab_ctx =
 348                 (struct libnet_keytab_context *)ctx->private_data;
 349
 350         for (; cur; cur = cur->next_object) {
 351                 status = parse_object(mem_ctx, keytab_ctx, cur);
 352                 if (!NT_STATUS_IS_OK(status)) {
 353                         goto out;
 354                 }
 355         }
 356
 357  out:
 358         return status;
 359 }
 360
 361 #else
 362
 363 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 364                                struct replUpToDateVectorBlob **pold_utdv)
 365 {
 366         return NT_STATUS_NOT_SUPPORTED;
 367 }
 368
 369 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 370                               struct replUpToDateVectorBlob *new_utdv)
 371 {
 372         return NT_STATUS_NOT_SUPPORTED;
 373 }
 374
 375 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
 376                                        TALLOC_CTX *mem_ctx,
 377                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
 378                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
 379 {
 380         return NT_STATUS_NOT_SUPPORTED;
 381 }
 382 #endif /* defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC) */
 383
 384 const struct dssync_ops libnet_dssync_keytab_ops = {
 385         .startup                = keytab_startup,
 386         .process_objects        = keytab_process_objects,
 387         .finish                 = keytab_finish,
 388 };