source4/kdc/mit-kdb/kdb_samba_policies.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Samba KDB plugin for MIT Kerberos
   5
   6    Copyright (c) 2010      Simo Sorce <idra@samba.org>.
   7    Copyright (c) 2014      Andreas Schneider <asn@samba.org>
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24
  25 #include "system/kerberos.h"
  26
  27 #include <profile.h>
  28 #include <kdb.h>
  29
  30 #include "kdc/mit_samba.h"
  31 #include "kdb_samba.h"
  32
  33 /* FIXME: This is a krb5 function which is exported, but in no header */
  34 extern krb5_error_code decode_krb5_padata_sequence(const krb5_data *output,
  35                                                    krb5_pa_data ***rep);
  36
  37 static krb5_error_code ks_get_netbios_name(krb5_address **addrs, char **name)
  38 {
  39         char *nb_name = NULL;
  40         int len, i;
  41
  42         for (i = 0; addrs[i]; i++) {
  43                 if (addrs[i]->addrtype != ADDRTYPE_NETBIOS) {
  44                         continue;
  45                 }
  46                 len = MIN(addrs[i]->length, 15);
  47                 nb_name = strndup((const char *)addrs[i]->contents, len);
  48                 if (!nb_name) {
  49                         return ENOMEM;
  50                 }
  51                 break;
  52         }
  53
  54         if (nb_name) {
  55                 /* Strip space padding */
  56                 i = strlen(nb_name) - 1;
  57                 for (i = strlen(nb_name) - 1;
  58                      i > 0 && nb_name[i] == ' ';
  59                      i--) {
  60                         nb_name[i] = '\0';
  61                 }
  62         }
  63
  64         *name = nb_name;
  65
  66         return 0;
  67 }
  68
  69 krb5_error_code kdb_samba_db_check_policy_as(krb5_context context,
  70                                              krb5_kdc_req *kdcreq,
  71                                              krb5_db_entry *client,
  72                                              krb5_db_entry *server,
  73                                              krb5_timestamp kdc_time,
  74                                              const char **status,
  75                                              krb5_pa_data ***e_data_out)
  76 {
  77         struct mit_samba_context *mit_ctx;
  78         krb5_error_code code;
  79         char *client_name = NULL;
  80         char *server_name = NULL;
  81         char *netbios_name = NULL;
  82         char *realm = NULL;
  83         bool password_change = false;
  84         DATA_BLOB int_data = { NULL, 0 };
  85         krb5_data d;
  86         krb5_pa_data **e_data;
  87
  88         mit_ctx = ks_get_context(context);
  89         if (mit_ctx == NULL) {
  90                 return KRB5_KDB_DBNOTINITED;
  91         }
  92
  93         if (krb5_princ_size(context, kdcreq->server) == 2 &&
  94             ks_is_kadmin_changepw(context, kdcreq->server)) {
  95                 code = krb5_get_default_realm(context, &realm);
  96                 if (code) {
  97                         goto done;
  98                 }
  99
 100                 if (ks_data_eq_string(kdcreq->server->realm, realm)) {
 101                         password_change = true;
 102                 }
 103         }
 104
 105         code = krb5_unparse_name(context, kdcreq->server, &server_name);
 106         if (code) {
 107                 goto done;
 108         }
 109
 110         code = krb5_unparse_name(context, kdcreq->client, &client_name);
 111         if (code) {
 112                 goto done;
 113         }
 114
 115         if (kdcreq->addresses) {
 116                 code = ks_get_netbios_name(kdcreq->addresses, &netbios_name);
 117                 if (code) {
 118                         goto done;
 119                 }
 120         }
 121
 122         code = mit_samba_check_client_access(mit_ctx,
 123                                              client,
 124                                              client_name,
 125                                              server,
 126                                              server_name,
 127                                              netbios_name,
 128                                              password_change,
 129                                              &int_data);
 130
 131         if (int_data.length && int_data.data) {
 132
 133                 /* make sure the mapped return code is returned - gd */
 134                 int code_tmp;
 135
 136                 d = ks_make_data(int_data.data, int_data.length);
 137
 138                 code_tmp = decode_krb5_padata_sequence(&d, &e_data);
 139                 if (code_tmp == 0) {
 140                         *e_data_out = e_data;
 141                 }
 142         }
 143 done:
 144         free(realm);
 145         free(server_name);
 146         free(client_name);
 147         free(netbios_name);
 148
 149         return code;
 150 }
 151
 152 static krb5_error_code ks_get_pac(krb5_context context,
 153                                   krb5_db_entry *client,
 154                                   krb5_pac *pac)
 155 {
 156         struct mit_samba_context *mit_ctx;
 157         DATA_BLOB pac_data;
 158         krb5_data data;
 159         krb5_error_code code;
 160
 161         mit_ctx = ks_get_context(context);
 162         if (mit_ctx == NULL) {
 163                 return KRB5_KDB_DBNOTINITED;
 164         }
 165
 166         code = mit_samba_get_pac_data(mit_ctx,
 167                                       client,
 168                                       &pac_data);
 169         if (code != 0) {
 170                 return code;
 171         }
 172
 173         code = krb5_pac_init(context, pac);
 174         if (code != 0) {
 175                 goto done;
 176         }
 177
 178         data = ks_make_data(pac_data.data, pac_data.length);
 179
 180         code = krb5_pac_add_buffer(context, *pac, PAC_LOGON_INFO, &data);
 181         if (code != 0) {
 182                 goto done;
 183         }
 184
 185 done:
 186         free(pac_data.data);
 187         return code;
 188 }
 189
 190 static krb5_error_code ks_verify_pac(krb5_context context,
 191                                      unsigned int flags,
 192                                      krb5_const_principal client_princ,
 193                                      krb5_db_entry *client,
 194                                      krb5_keyblock *server_key,
 195                                      krb5_keyblock *krbtgt_key,
 196                                      krb5_timestamp authtime,
 197                                      krb5_authdata **tgt_auth_data,
 198                                      krb5_pac *pac)
 199 {
 200         struct mit_samba_context *mit_ctx;
 201         krb5_authdata **authdata = NULL;
 202         krb5_pac ipac = NULL;
 203         DATA_BLOB pac_data = { NULL, 0 };
 204         DATA_BLOB logon_data = { NULL, 0 };
 205         krb5_data data;
 206         krb5_error_code code;
 207
 208         mit_ctx = ks_get_context(context);
 209         if (mit_ctx == NULL) {
 210                 return KRB5_KDB_DBNOTINITED;
 211         }
 212
 213         /* find the existing PAC, if present */
 214         code = krb5_find_authdata(context,
 215                                   tgt_auth_data,
 216                                   NULL,
 217                                   KRB5_AUTHDATA_WIN2K_PAC,
 218                                   &authdata);
 219         if (code != 0) {
 220                 return code;
 221         }
 222
 223         /* no pac data */
 224         if (authdata == NULL) {
 225                 return 0;
 226         }
 227
 228         SMB_ASSERT(authdata[0] != NULL);
 229
 230         if (authdata[1] != NULL) {
 231                 code = KRB5KDC_ERR_BADOPTION; /* XXX */
 232                 goto done;
 233         }
 234
 235         code = krb5_pac_parse(context,
 236                               authdata[0]->contents,
 237                               authdata[0]->length,
 238                               &ipac);
 239         if (code != 0) {
 240                 goto done;
 241         }
 242
 243         /* TODO: verify this is correct
 244          *
 245          * In the constrained delegation case, the PAC is from a service
 246          * ticket rather than a TGT; we must verify the server and KDC
 247          * signatures to assert that the server did not forge the PAC.
 248          */
 249         if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
 250                 code = krb5_pac_verify(context,
 251                                        ipac,
 252                                        authtime,
 253                                        client_princ,
 254                                        server_key,
 255                                        krbtgt_key);
 256         } else {
 257                 code = krb5_pac_verify(context,
 258                                        ipac,
 259                                        authtime,
 260                                        client_princ,
 261                                        krbtgt_key,
 262                                        NULL);
 263         }
 264         if (code != 0) {
 265                 goto done;
 266         }
 267
 268         /* check and update PAC */
 269         pac_data.data = authdata[0]->contents;
 270         pac_data.length = authdata[0]->length;
 271
 272         code = mit_samba_update_pac_data(mit_ctx,
 273                                          client,
 274                                          &pac_data,
 275                                          &logon_data);
 276         if (code != 0) {
 277                 goto done;
 278         }
 279
 280         code = krb5_pac_init(context, pac);
 281         if (code != 0) {
 282                 goto done;
 283         }
 284
 285         data = ks_make_data(logon_data.data, logon_data.length);
 286
 287         code = krb5_pac_add_buffer(context, *pac, PAC_LOGON_INFO, &data);
 288         if (code != 0) {
 289                 goto done;
 290         }
 291
 292 done:
 293         krb5_free_authdata(context, authdata);
 294         krb5_pac_free(context, ipac);
 295         free(logon_data.data);
 296
 297         return code;
 298 }
 299
 300 krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
 301                                             unsigned int flags,
 302                                             krb5_const_principal client_princ,
 303                                             krb5_db_entry *client,
 304                                             krb5_db_entry *server,
 305                                             krb5_db_entry *krbtgt,
 306                                             krb5_keyblock *client_key,
 307                                             krb5_keyblock *server_key,
 308                                             krb5_keyblock *krbtgt_key,
 309                                             krb5_keyblock *session_key,
 310                                             krb5_timestamp authtime,
 311                                             krb5_authdata **tgt_auth_data,
 312                                             krb5_authdata ***signed_auth_data)
 313 {
 314         krb5_const_principal ks_client_princ;
 315         krb5_authdata **authdata = NULL;
 316         krb5_boolean is_as_req;
 317         krb5_error_code code;
 318         krb5_pac pac = NULL;
 319         krb5_data pac_data;
 320
 321         /* Prefer canonicalised name from client entry */
 322         if (client != NULL) {
 323                 ks_client_princ = client->princ;
 324         } else {
 325                 ks_client_princ = client_princ;
 326         }
 327
 328         is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
 329
 330         if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) {
 331
 332                 code = ks_get_pac(context, client, &pac);
 333                 if (code != 0) {
 334                         goto done;
 335                 }
 336         }
 337
 338         if (!is_as_req) {
 339                 code = ks_verify_pac(context, flags, ks_client_princ, client,
 340                                 server_key, krbtgt_key, authtime,
 341                                 tgt_auth_data, &pac);
 342                 if (code != 0) {
 343                         goto done;
 344                 }
 345         }
 346
 347         if (pac == NULL && client != NULL) {
 348
 349                 code = ks_get_pac(context, client, &pac);
 350                 if (code != 0) {
 351                         goto done;
 352                 }
 353         }
 354
 355         if (pac == NULL) {
 356                 code = KRB5_KDB_DBTYPE_NOSUP;
 357                 goto done;
 358         }
 359
 360         code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
 361                         server_key, krbtgt_key, &pac_data);
 362         if (code != 0) {
 363                 goto done;
 364         }
 365
 366         authdata = malloc(2 * sizeof(krb5_authdata *));
 367         if (authdata == NULL) {
 368                 goto done;
 369         }
 370
 371         authdata[0] = malloc(sizeof(krb5_authdata));
 372         if (authdata[0] == NULL) {
 373                 goto done;
 374         }
 375
 376         /* put in signed data */
 377         authdata[0]->magic = KV5M_AUTHDATA;
 378         authdata[0]->ad_type = KRB5_AUTHDATA_WIN2K_PAC;
 379         authdata[0]->contents = (krb5_octet *)pac_data.data;
 380         authdata[0]->length = pac_data.length;
 381
 382         code = krb5_encode_authdata_container(context,
 383                                               KRB5_AUTHDATA_IF_RELEVANT,
 384                                               authdata,
 385                                               signed_auth_data);
 386         if (code != 0) {
 387                 goto done;
 388         }
 389
 390         code = 0;
 391
 392 done:
 393         krb5_pac_free(context, pac);
 394         krb5_free_authdata(context, authdata);
 395
 396         return code;
 397 }
 398
 399 krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
 400                                                        krb5_const_principal client,
 401                                                        const krb5_db_entry *server,
 402                                                        krb5_const_principal proxy)
 403 {
 404         struct mit_samba_context *mit_ctx;
 405
 406         /*
 407          * Names are quite odd and confusing in the current implementation.
 408          * The following mappings should help understanding what is what.
 409          * client ->  client to impersonate
 410          * server; -> delegating service
 411          * proxy; -> target principal
 412          */
 413         krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server);
 414
 415         char *target_name = NULL;
 416         bool is_enterprise;
 417         krb5_error_code code;
 418
 419         mit_ctx = ks_get_context(context);
 420         if (mit_ctx == NULL) {
 421                 return KRB5_KDB_DBNOTINITED;
 422         }
 423
 424         code = krb5_unparse_name(context, proxy, &target_name);
 425         if (code) {
 426                 goto done;
 427         }
 428
 429         is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL);
 430
 431         code = mit_samba_check_s4u2proxy(mit_ctx,
 432                                          delegating_service,
 433                                          target_name,
 434                                          is_enterprise);
 435
 436 done:
 437         free(target_name);
 438         return code;
 439 }