source4/kdc/wdc-samba4.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    PAC Glue between Samba and the KDC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
   7    Copyright (C) Simo Sorce <idra@samba.org> 2010
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "kdc/kdc-glue.h"
  26 #include "kdc/db-glue.h"
  27 #include "kdc/pac-glue.h"
  28 #include "sdb.h"
  29 #include "sdb_hdb.h"
  30 #include "librpc/gen_ndr/auth.h"
  31
  32 /*
  33  * Given the right private pointer from hdb_samba4,
  34  * get a PAC from the attached ldb messages.
  35  *
  36  * For PKINIT we also get pk_reply_key and can add PAC_CREDENTIAL_INFO.
  37  */
  38 static krb5_error_code samba_wdc_get_pac(void *priv, krb5_context context,
  39                                          struct hdb_entry_ex *client,
  40                                          const krb5_keyblock *pk_reply_key,
  41                                          const krb5_boolean *pac_request,
  42                                          krb5_pac *pac)
  43 {
  44         TALLOC_CTX *mem_ctx;
  45         DATA_BLOB *logon_blob = NULL;
  46         DATA_BLOB *cred_ndr = NULL;
  47         DATA_BLOB **cred_ndr_ptr = NULL;
  48         DATA_BLOB _cred_blob = data_blob_null;
  49         DATA_BLOB *cred_blob = NULL;
  50         DATA_BLOB *upn_blob = NULL;
  51         DATA_BLOB *pac_attrs_blob = NULL;
  52         DATA_BLOB *requester_sid_blob = NULL;
  53         krb5_error_code ret;
  54         NTSTATUS nt_status;
  55         struct samba_kdc_entry *skdc_entry =
  56                 talloc_get_type_abort(client->ctx,
  57                 struct samba_kdc_entry);
  58
  59         mem_ctx = talloc_named(client->ctx, 0, "samba_get_pac context");
  60         if (!mem_ctx) {
  61                 return ENOMEM;
  62         }
  63
  64         if (pk_reply_key != NULL) {
  65                 cred_ndr_ptr = &cred_ndr;
  66         }
  67
  68         nt_status = samba_kdc_get_pac_blobs(mem_ctx, skdc_entry,
  69                                             &logon_blob,
  70                                             cred_ndr_ptr,
  71                                             &upn_blob,
  72                                             &pac_attrs_blob,
  73                                             pac_request,
  74                                             &requester_sid_blob,
  75                                             NULL);
  76         if (!NT_STATUS_IS_OK(nt_status)) {
  77                 talloc_free(mem_ctx);
  78                 return EINVAL;
  79         }
  80
  81         if (pk_reply_key != NULL && cred_ndr != NULL) {
  82                 ret = samba_kdc_encrypt_pac_credentials(context,
  83                                                         pk_reply_key,
  84                                                         cred_ndr,
  85                                                         mem_ctx,
  86                                                         &_cred_blob);
  87                 if (ret != 0) {
  88                         talloc_free(mem_ctx);
  89                         return ret;
  90                 }
  91                 cred_blob = &_cred_blob;
  92         }
  93
  94         ret = samba_make_krb5_pac(context, logon_blob, cred_blob,
  95                                   upn_blob, pac_attrs_blob,
  96                                   requester_sid_blob, NULL, pac);
  97
  98         talloc_free(mem_ctx);
  99         return ret;
 100 }
 101
 102 static krb5_error_code samba_wdc_get_pac_compat(void *priv, krb5_context context,
 103                                                 struct hdb_entry_ex *client,
 104                                                 const krb5_boolean *pac_request,
 105                                                 krb5_pac *pac)
 106 {
 107         return samba_wdc_get_pac(priv, context, client, NULL, pac_request, pac);
 108 }
 109
 110 static krb5_error_code samba_wdc_reget_pac2(krb5_context context,
 111                                             const krb5_principal delegated_proxy_principal,
 112                                             struct hdb_entry_ex *client,
 113                                             struct hdb_entry_ex *server,
 114                                             struct hdb_entry_ex *krbtgt,
 115                                             krb5_pac *pac,
 116                                             krb5_cksumtype ctype)
 117 {
 118         struct samba_kdc_entry *server_skdc_entry =
 119                 talloc_get_type_abort(server->ctx,
 120                 struct samba_kdc_entry);
 121         struct samba_kdc_entry *krbtgt_skdc_entry =
 122                 talloc_get_type_abort(krbtgt->ctx,
 123                 struct samba_kdc_entry);
 124         TALLOC_CTX *mem_ctx = talloc_named(server_skdc_entry,
 125                                            0,
 126                                            "samba_kdc_reget_pac2 context");
 127         krb5_pac new_pac = NULL;
 128         DATA_BLOB *pac_blob = NULL;
 129         DATA_BLOB *upn_blob = NULL;
 130         DATA_BLOB *requester_sid_blob = NULL;
 131         DATA_BLOB *deleg_blob = NULL;
 132         krb5_error_code ret;
 133         NTSTATUS nt_status;
 134         bool is_in_db, is_untrusted;
 135         bool is_krbtgt;
 136         size_t num_types = 0;
 137         uint32_t *types = NULL;
 138         uint32_t forced_next_type = 0;
 139         size_t i = 0;
 140         ssize_t logon_info_idx = -1;
 141         ssize_t delegation_idx = -1;
 142         ssize_t logon_name_idx = -1;
 143         ssize_t upn_dns_info_idx = -1;
 144         ssize_t srv_checksum_idx = -1;
 145         ssize_t kdc_checksum_idx = -1;
 146         ssize_t tkt_checksum_idx = -1;
 147         ssize_t attrs_info_idx = -1;
 148         ssize_t requester_sid_idx = -1;
 149
 150         if (!mem_ctx) {
 151                 return ENOMEM;
 152         }
 153
 154         if (client != NULL) {
 155                 struct samba_kdc_entry *client_skdc_entry = NULL;
 156
 157                 client_skdc_entry = talloc_get_type_abort(client->ctx,
 158                                                           struct samba_kdc_entry);
 159
 160                 /*
 161                  * Check the objectSID of the client and pac data are the same.
 162                  * Does a parse and SID check, but no crypto.
 163                  */
 164                 ret = samba_kdc_validate_pac_blob(context, client_skdc_entry, *pac);
 165                 if (ret != 0) {
 166                         talloc_free(mem_ctx);
 167                         return ret;
 168                 }
 169         }
 170
 171         /*
 172          * If the krbtgt was generated by an RODC, and we are not that
 173          * RODC, then we need to regenerate the PAC - we can't trust
 174          * it, and confirm that the RODC was permitted to print this ticket
 175          *
 176          * Becasue of the samba_kdc_validate_pac_blob() step we can be
 177          * sure that the record in 'client' matches the SID in the
 178          * original PAC.
 179          */
 180         ret = samba_krbtgt_is_in_db(krbtgt_skdc_entry, &is_in_db, &is_untrusted);
 181         if (ret != 0) {
 182                 talloc_free(mem_ctx);
 183                 return ret;
 184         }
 185
 186         if (delegated_proxy_principal != NULL) {
 187                 krb5_enctype etype;
 188                 Key *key = NULL;
 189
 190                 if (!is_in_db) {
 191                         /*
 192                          * The RODC-issued PAC was signed by a KDC entry that we
 193                          * don't have a key for. The server signature is not
 194                          * trustworthy, since it could have been created by the
 195                          * server we got the ticket from. We must not proceed as
 196                          * otherwise the ticket signature is unchecked.
 197                          */
 198                         talloc_free(mem_ctx);
 199                         return HDB_ERR_NOT_FOUND_HERE;
 200                 }
 201
 202                 /* Fetch the correct key depending on the checksum type. */
 203                 if (ctype == CKSUMTYPE_HMAC_MD5) {
 204                         etype = ENCTYPE_ARCFOUR_HMAC;
 205                 } else {
 206                         ret = krb5_cksumtype_to_enctype(context,
 207                                                         ctype,
 208                                                         &etype);
 209                         if (ret != 0) {
 210                                 talloc_free(mem_ctx);
 211                                 return ret;
 212                         }
 213                 }
 214                 ret = hdb_enctype2key(context, &krbtgt->entry, etype, &key);
 215                 if (ret != 0) {
 216                         return ret;
 217                 }
 218
 219                 /* Check the KDC and ticket signatures. */
 220                 ret = krb5_pac_verify(context,
 221                                       *pac,
 222                                       0,
 223                                       NULL,
 224                                       NULL,
 225                                       &key->key);
 226                 if (ret != 0) {
 227                         DEBUG(1, ("PAC KDC signature failed to verify\n"));
 228                         talloc_free(mem_ctx);
 229                         return ret;
 230                 }
 231
 232                 deleg_blob = talloc_zero(mem_ctx, DATA_BLOB);
 233                 if (!deleg_blob) {
 234                         talloc_free(mem_ctx);
 235                         return ENOMEM;
 236                 }
 237
 238                 nt_status = samba_kdc_update_delegation_info_blob(mem_ctx,
 239                                         context, *pac,
 240                                         server->entry.principal,
 241                                         delegated_proxy_principal,
 242                                         deleg_blob);
 243                 if (!NT_STATUS_IS_OK(nt_status)) {
 244                         DEBUG(0, ("Building PAC failed: %s\n",
 245                                   nt_errstr(nt_status)));
 246                         talloc_free(mem_ctx);
 247                         return EINVAL;
 248                 }
 249         }
 250
 251         if (is_untrusted) {
 252                 struct samba_kdc_entry *client_skdc_entry = NULL;
 253                 struct auth_user_info_dc *user_info_dc = NULL;
 254                 WERROR werr;
 255
 256                 if (client == NULL) {
 257                         return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
 258                 }
 259
 260                 client_skdc_entry = talloc_get_type_abort(client->ctx,
 261                                                           struct samba_kdc_entry);
 262
 263                 nt_status = samba_kdc_get_pac_blobs(mem_ctx, client_skdc_entry,
 264                                                     &pac_blob, NULL, &upn_blob,
 265                                                     NULL, NULL, &requester_sid_blob,
 266                                                     &user_info_dc);
 267                 if (!NT_STATUS_IS_OK(nt_status)) {
 268                         talloc_free(mem_ctx);
 269                         return KRB5KDC_ERR_TGT_REVOKED;
 270                 }
 271
 272                 /*
 273                  * Now check if the SID list in the user_info_dc
 274                  * intersects correctly with the RODC allow/deny
 275                  * lists
 276                  */
 277
 278                 werr = samba_rodc_confirm_user_is_allowed(user_info_dc->num_sids,
 279                                                           user_info_dc->sids,
 280                                                           krbtgt_skdc_entry,
 281                                                           client_skdc_entry);
 282                 if (!W_ERROR_IS_OK(werr)) {
 283                         talloc_free(mem_ctx);
 284                         if (W_ERROR_EQUAL(werr, WERR_DOMAIN_CONTROLLER_NOT_FOUND)) {
 285                                 return KRB5KDC_ERR_POLICY;
 286                         } else {
 287                                 return KRB5KDC_ERR_TGT_REVOKED;
 288                         }
 289                 }
 290         }
 291
 292         if (!is_untrusted) {
 293                 pac_blob = talloc_zero(mem_ctx, DATA_BLOB);
 294                 if (!pac_blob) {
 295                         talloc_free(mem_ctx);
 296                         return ENOMEM;
 297                 }
 298
 299                 nt_status = samba_kdc_update_pac_blob(mem_ctx, context,
 300                                                       krbtgt_skdc_entry->kdc_db_ctx->samdb,
 301                                                       *pac, pac_blob,
 302                                                       NULL, NULL);
 303                 if (!NT_STATUS_IS_OK(nt_status)) {
 304                         DEBUG(0, ("Building PAC failed: %s\n",
 305                                   nt_errstr(nt_status)));
 306                         talloc_free(mem_ctx);
 307                         return EINVAL;
 308                 }
 309         }
 310
 311         /* Check the types of the given PAC */
 312         ret = krb5_pac_get_types(context, *pac, &num_types, &types);
 313         if (ret != 0) {
 314                 talloc_free(mem_ctx);
 315                 return ret;
 316         }
 317
 318         for (i = 0; i < num_types; i++) {
 319                 switch (types[i]) {
 320                 case PAC_TYPE_LOGON_INFO:
 321                         if (logon_info_idx != -1) {
 322                                 DEBUG(1, ("logon info type[%"PRIu32"] twice [%zd] and [%zu]: \n",
 323                                           types[i],
 324                                           logon_info_idx,
 325                                           i));
 326                                 SAFE_FREE(types);
 327                                 talloc_free(mem_ctx);
 328                                 return EINVAL;
 329                         }
 330                         logon_info_idx = i;
 331                         break;
 332                 case PAC_TYPE_CONSTRAINED_DELEGATION:
 333                         if (delegation_idx != -1) {
 334                                 DEBUG(1, ("constrained delegation type[%"PRIu32"] twice [%zd] and [%zu]: \n",
 335                                           types[i],
 336                                           delegation_idx,
 337                                           i));
 338                                 SAFE_FREE(types);
 339                                 talloc_free(mem_ctx);
 340                                 return EINVAL;
 341                         }
 342                         delegation_idx = i;
 343                         break;
 344                 case PAC_TYPE_LOGON_NAME:
 345                         if (logon_name_idx != -1) {
 346                                 DEBUG(1, ("logon name type[%"PRIu32"] twice [%zd] and [%zu]: \n",
 347                                           types[i],
 348                                           logon_name_idx,
 349                                           i));
 350                                 SAFE_FREE(types);
 351                                 talloc_free(mem_ctx);
 352                                 return EINVAL;
 353                         }
 354                         logon_name_idx = i;
 355                         break;
 356                 case PAC_TYPE_UPN_DNS_INFO:
 357                         if (upn_dns_info_idx != -1) {
 358                                 DEBUG(1, ("upn dns info type[%"PRIu32"] twice [%zd] and [%zu]: \n",
 359                                           types[i],
 360                                           upn_dns_info_idx,
 361                                           i));
 362                                 SAFE_FREE(types);
 363                                 talloc_free(mem_ctx);
 364                                 return EINVAL;
 365                         }
 366                         upn_dns_info_idx = i;
 367                         break;
 368                 case PAC_TYPE_SRV_CHECKSUM:
 369                         if (srv_checksum_idx != -1) {
 370                                 DEBUG(1, ("server checksum type[%"PRIu32"] twice [%zd] and [%zu]: \n",
 371                                           types[i],
 372                                           srv_checksum_idx,
 373                                           i));
 374                                 SAFE_FREE(types);
 375                                 talloc_free(mem_ctx);
 376                                 return EINVAL;
 377                         }
 378                         srv_checksum_idx = i;
 379                         break;
 380                 case PAC_TYPE_KDC_CHECKSUM:
 381                         if (kdc_checksum_idx != -1) {
 382                                 DEBUG(1, ("kdc checksum type[%"PRIu32"] twice [%zd] and [%zu]: \n",
 383                                           types[i],
 384                                           kdc_checksum_idx,
 385                                           i));
 386                                 SAFE_FREE(types);
 387                                 talloc_free(mem_ctx);
 388                                 return EINVAL;
 389                         }
 390                         kdc_checksum_idx = i;
 391                         break;
 392                 case PAC_TYPE_TICKET_CHECKSUM:
 393                         if (tkt_checksum_idx != -1) {
 394                                 DEBUG(1, ("ticket checksum type[%"PRIu32"] twice [%zd] and [%zu]: \n",
 395                                           types[i],
 396                                           tkt_checksum_idx,
 397                                           i));
 398                                 SAFE_FREE(types);
 399                                 talloc_free(mem_ctx);
 400                                 return EINVAL;
 401                         }
 402                         tkt_checksum_idx = i;
 403                         break;
 404                 case PAC_TYPE_ATTRIBUTES_INFO:
 405                         if (attrs_info_idx != -1) {
 406                                 DEBUG(1, ("attributes info type[%"PRIu32"] twice [%zd] and [%zu]: \n",
 407                                           types[i],
 408                                           attrs_info_idx,
 409                                           i));
 410                                 SAFE_FREE(types);
 411                                 talloc_free(mem_ctx);
 412                                 return EINVAL;
 413                         }
 414                         attrs_info_idx = i;
 415                         break;
 416                 case PAC_TYPE_REQUESTER_SID:
 417                         if (requester_sid_idx != -1) {
 418                                 DEBUG(1, ("requester sid type[%"PRIu32"] twice [%zd] and [%zu]: \n",
 419                                           types[i],
 420                                           requester_sid_idx,
 421                                           i));
 422                                 SAFE_FREE(types);
 423                                 talloc_free(mem_ctx);
 424                                 return EINVAL;
 425                         }
 426                         requester_sid_idx = i;
 427                         break;
 428                 default:
 429                         continue;
 430                 }
 431         }
 432
 433         if (logon_info_idx == -1) {
 434                 DEBUG(1, ("PAC_TYPE_LOGON_INFO missing\n"));
 435                 SAFE_FREE(types);
 436                 talloc_free(mem_ctx);
 437                 return EINVAL;
 438         }
 439         if (logon_name_idx == -1) {
 440                 DEBUG(1, ("PAC_TYPE_LOGON_NAME missing\n"));
 441                 SAFE_FREE(types);
 442                 talloc_free(mem_ctx);
 443                 return EINVAL;
 444         }
 445         if (srv_checksum_idx == -1) {
 446                 DEBUG(1, ("PAC_TYPE_SRV_CHECKSUM missing\n"));
 447                 SAFE_FREE(types);
 448                 talloc_free(mem_ctx);
 449                 return EINVAL;
 450         }
 451         if (kdc_checksum_idx == -1) {
 452                 DEBUG(1, ("PAC_TYPE_KDC_CHECKSUM missing\n"));
 453                 SAFE_FREE(types);
 454                 talloc_free(mem_ctx);
 455                 return EINVAL;
 456         }
 457
 458         /*
 459          * The server account may be set not to want the PAC.
 460          *
 461          * While this is wasteful if the above cacluations were done
 462          * and now thrown away, this is cleaner as we do any ticket
 463          * signature checking etc always.
 464          *
 465          * UF_NO_AUTH_DATA_REQUIRED is the rare case and most of the
 466          * time (eg not accepting a ticket from the RODC) we do not
 467          * need to re-generate anything anyway.
 468          */
 469         if (!samba_princ_needs_pac(server_skdc_entry)) {
 470                 ret = 0;
 471                 new_pac = NULL;
 472                 goto out;
 473         }
 474
 475         is_krbtgt = krb5_principal_is_krbtgt(context, server->entry.principal);
 476
 477         if (!is_untrusted && !is_krbtgt) {
 478                 /*
 479                  * The client may have requested no PAC when obtaining the
 480                  * TGT.
 481                  */
 482                 bool requested_pac;
 483                 ret = samba_client_requested_pac(context, pac, mem_ctx,
 484                                                  &requested_pac);
 485                 if (ret != 0 || !requested_pac) {
 486                         new_pac = NULL;
 487                         goto out;
 488                 }
 489         }
 490
 491         /* Otherwise build an updated PAC */
 492         ret = krb5_pac_init(context, &new_pac);
 493         if (ret != 0) {
 494                 new_pac = NULL;
 495                 goto out;
 496         }
 497
 498         for (i = 0;;) {
 499                 const uint8_t zero_byte = 0;
 500                 krb5_data type_data;
 501                 DATA_BLOB type_blob = data_blob_null;
 502                 uint32_t type;
 503
 504                 if (forced_next_type != 0) {
 505                         /*
 506                          * We need to inject possible missing types
 507                          */
 508                         type = forced_next_type;
 509                         forced_next_type = 0;
 510                 } else if (i < num_types) {
 511                         type = types[i];
 512                         i++;
 513                 } else {
 514                         break;
 515                 }
 516
 517                 switch (type) {
 518                 case PAC_TYPE_LOGON_INFO:
 519                         type_blob = *pac_blob;
 520
 521                         if (delegation_idx == -1 && deleg_blob != NULL) {
 522                                 /* inject CONSTRAINED_DELEGATION behind */
 523                                 forced_next_type = PAC_TYPE_CONSTRAINED_DELEGATION;
 524                         }
 525                         break;
 526                 case PAC_TYPE_CONSTRAINED_DELEGATION:
 527                         if (deleg_blob != NULL) {
 528                                 type_blob = *deleg_blob;
 529                         }
 530                         break;
 531                 case PAC_TYPE_CREDENTIAL_INFO:
 532                         /*
 533                          * Note that we copy the credential blob,
 534                          * as it's only usable with the PKINIT based
 535                          * AS-REP reply key, it's only available on the
 536                          * host which did the AS-REQ/AS-REP exchange.
 537                          *
 538                          * This matches Windows 2008R2...
 539                          */
 540                         break;
 541                 case PAC_TYPE_LOGON_NAME:
 542                         /*
 543                          * this is generated in the main KDC code
 544                          * we just add a place holder here.
 545                          */
 546                         type_blob = data_blob_const(&zero_byte, 1);
 547
 548                         if (upn_dns_info_idx == -1 && upn_blob != NULL) {
 549                                 /* inject UPN_DNS_INFO behind */
 550                                 forced_next_type = PAC_TYPE_UPN_DNS_INFO;
 551                         }
 552                         break;
 553                 case PAC_TYPE_UPN_DNS_INFO:
 554                         /*
 555                          * Replace in the RODC case, otherwise
 556                          * upn_blob is NULL and we just copy.
 557                          */
 558                         if (upn_blob != NULL) {
 559                                 type_blob = *upn_blob;
 560                         }
 561                         break;
 562                 case PAC_TYPE_SRV_CHECKSUM:
 563                         /*
 564                          * this are generated in the main KDC code
 565                          * we just add a place holder here.
 566                          */
 567                         type_blob = data_blob_const(&zero_byte, 1);
 568
 569                         if (requester_sid_idx == -1 && requester_sid_blob != NULL) {
 570                                 /* inject REQUESTER_SID behind */
 571                                 forced_next_type = PAC_TYPE_REQUESTER_SID;
 572                         }
 573                         break;
 574                 case PAC_TYPE_KDC_CHECKSUM:
 575                         /*
 576                          * this are generated in the main KDC code
 577                          * we just add a place holders here.
 578                          */
 579                         type_blob = data_blob_const(&zero_byte, 1);
 580                         break;
 581                 case PAC_TYPE_ATTRIBUTES_INFO:
 582                         if (is_krbtgt) {
 583                                 /* just copy... */
 584                                 break;
 585                         } else {
 586                                 continue;
 587                         }
 588                 case PAC_TYPE_REQUESTER_SID:
 589                         if (is_krbtgt) {
 590                                 /*
 591                                  * Replace in the RODC case, otherwise
 592                                  * requester_sid_blob is NULL and we just copy.
 593                                  */
 594                                 if (requester_sid_blob != NULL) {
 595                                         type_blob = *requester_sid_blob;
 596                                 }
 597                                 break;
 598                         } else {
 599                                 continue;
 600                         }
 601                 default:
 602                         /* just copy... */
 603                         break;
 604                 }
 605
 606                 if (type_blob.length != 0) {
 607                         ret = smb_krb5_copy_data_contents(&type_data,
 608                                                           type_blob.data,
 609                                                           type_blob.length);
 610                         if (ret != 0) {
 611                                 SAFE_FREE(types);
 612                                 krb5_pac_free(context, new_pac);
 613                                 talloc_free(mem_ctx);
 614                                 return ret;
 615                         }
 616                 } else {
 617                         ret = krb5_pac_get_buffer(context, *pac,
 618                                                   type, &type_data);
 619                         if (ret != 0) {
 620                                 SAFE_FREE(types);
 621                                 krb5_pac_free(context, new_pac);
 622                                 talloc_free(mem_ctx);
 623                                 return ret;
 624                         }
 625                 }
 626
 627                 ret = krb5_pac_add_buffer(context, new_pac,
 628                                           type, &type_data);
 629                 smb_krb5_free_data_contents(context, &type_data);
 630                 if (ret != 0) {
 631                         SAFE_FREE(types);
 632                         krb5_pac_free(context, new_pac);
 633                         talloc_free(mem_ctx);
 634                         return ret;
 635                 }
 636         }
 637
 638 out:
 639
 640         SAFE_FREE(types);
 641
 642         /* We now replace the pac */
 643         krb5_pac_free(context, *pac);
 644         *pac = new_pac;
 645
 646         talloc_free(mem_ctx);
 647         return ret;
 648 }
 649
 650 /* Resign (and reform, including possibly new groups) a PAC */
 651
 652 static krb5_error_code samba_wdc_reget_pac(void *priv, krb5_context context,
 653                                            const krb5_principal client_principal,
 654                                            const krb5_principal delegated_proxy_principal,
 655                                            struct hdb_entry_ex *client,
 656                                            struct hdb_entry_ex *server,
 657                                            struct hdb_entry_ex *krbtgt,
 658                                            krb5_pac *pac)
 659 {
 660         struct samba_kdc_entry *krbtgt_skdc_entry =
 661                 talloc_get_type_abort(krbtgt->ctx,
 662                                       struct samba_kdc_entry);
 663         krb5_error_code ret;
 664         krb5_cksumtype ctype = CKSUMTYPE_NONE;
 665         struct hdb_entry_ex signing_krbtgt_hdb;
 666
 667         if (delegated_proxy_principal) {
 668                 uint16_t rodc_id;
 669                 unsigned int my_krbtgt_number;
 670
 671                 /*
 672                  * We're using delegated_proxy_principal for the moment to
 673                  * indicate cases where the ticket was encrypted with the server
 674                  * key, and not a krbtgt key. This cannot be trusted, so we need
 675                  * to find a krbtgt key that signs the PAC in order to trust the
 676                  * ticket.
 677                  *
 678                  * The krbtgt passed in to this function refers to the krbtgt
 679                  * used to decrypt the ticket of the server requesting
 680                  * S4U2Proxy.
 681                  *
 682                  * When we implement service ticket renewal, we need to check
 683                  * the PAC, and this will need to be updated.
 684                  */
 685                 ret = krb5_pac_get_kdc_checksum_info(context,
 686                                                      *pac,
 687                                                      &ctype,
 688                                                      &rodc_id);
 689                 if (ret != 0) {
 690                         DEBUG(1, ("Failed to get PAC checksum info\n"));
 691                         return ret;
 692                 }
 693
 694                 /*
 695                  * We need to check the KDC and ticket signatures, fetching the
 696                  * correct key based on the enctype.
 697                  */
 698
 699                 my_krbtgt_number = krbtgt_skdc_entry->kdc_db_ctx->my_krbtgt_number;
 700
 701                 if (my_krbtgt_number != 0) {
 702                         /*
 703                          * If we are an RODC, and we are not the KDC that signed
 704                          * the evidence ticket, then we need to proxy the
 705                          * request.
 706                          */
 707                         if (rodc_id != my_krbtgt_number) {
 708                                 return HDB_ERR_NOT_FOUND_HERE;
 709                         }
 710                 } else {
 711                         /*
 712                          * If we are a DC, the ticket may have been signed by a
 713                          * different KDC than the one that issued the header
 714                          * ticket.
 715                          */
 716                         if (rodc_id != krbtgt->entry.kvno >> 16) {
 717                                 struct sdb_entry_ex signing_krbtgt_sdb;
 718
 719                                 /*
 720                                  * If we didn't sign the ticket, then return an
 721                                  * error.
 722                                  */
 723                                 if (rodc_id != 0) {
 724                                         return KRB5KRB_AP_ERR_MODIFIED;
 725                                 }
 726
 727                                 /*
 728                                  * Fetch our key from the database. To support
 729                                  * key rollover, we're going to need to try
 730                                  * multiple keys by trial and error. For now,
 731                                  * krbtgt keys aren't assumed to change.
 732                                  */
 733                                 ret = samba_kdc_fetch(context,
 734                                                       krbtgt_skdc_entry->kdc_db_ctx,
 735                                                       krbtgt->entry.principal,
 736                                                       SDB_F_GET_KRBTGT | SDB_F_CANON,
 737                                                       0,
 738                                                       &signing_krbtgt_sdb);
 739                                 if (ret != 0) {
 740                                         return ret;
 741                                 }
 742
 743                                 ret = sdb_entry_ex_to_hdb_entry_ex(context,
 744                                                                    &signing_krbtgt_sdb,
 745                                                                    &signing_krbtgt_hdb);
 746                                 sdb_free_entry(&signing_krbtgt_sdb);
 747                                 if (ret != 0) {
 748                                         return ret;
 749                                 }
 750
 751                                 /*
 752                                  * Replace the krbtgt entry with our own entry
 753                                  * for further processing.
 754                                  */
 755                                 krbtgt = &signing_krbtgt_hdb;
 756                         }
 757                 }
 758         }
 759
 760         ret = samba_wdc_reget_pac2(context,
 761                                    delegated_proxy_principal,
 762                                    client,
 763                                    server,
 764                                    krbtgt,
 765                                    pac,
 766                                    ctype);
 767
 768         if (krbtgt == &signing_krbtgt_hdb) {
 769                 hdb_free_entry(context, &signing_krbtgt_hdb);
 770         }
 771
 772         return ret;
 773 }
 774
 775 static char *get_netbios_name(TALLOC_CTX *mem_ctx, HostAddresses *addrs)
 776 {
 777         char *nb_name = NULL;
 778         size_t len;
 779         unsigned int i;
 780
 781         for (i = 0; addrs && i < addrs->len; i++) {
 782                 if (addrs->val[i].addr_type != KRB5_ADDRESS_NETBIOS) {
 783                         continue;
 784                 }
 785                 len = MIN(addrs->val[i].address.length, 15);
 786                 nb_name = talloc_strndup(mem_ctx,
 787                                          addrs->val[i].address.data, len);
 788                 if (nb_name) {
 789                         break;
 790                 }
 791         }
 792
 793         if ((nb_name == NULL) || (nb_name[0] == '\0')) {
 794                 return NULL;
 795         }
 796
 797         /* Strip space padding */
 798         for (len = strlen(nb_name) - 1;
 799              (len > 0) && (nb_name[len] == ' ');
 800              --len) {
 801                 nb_name[len] = '\0';
 802         }
 803
 804         return nb_name;
 805 }
 806
 807 static krb5_data fill_krb5_data(void *data, size_t length)
 808 {
 809         krb5_data kdata;
 810
 811         kdata.data = data;
 812         kdata.length = length;
 813
 814         return kdata;
 815 }
 816
 817 /* this function allocates 'data' using malloc.
 818  * The caller is responsible for freeing it */
 819 static void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data)
 820 {
 821         krb5_error_code ret = 0;
 822         PA_DATA pa;
 823         unsigned char *buf;
 824         size_t len;
 825
 826         if (!e_data)
 827                 return;
 828
 829         e_data->data   = NULL;
 830         e_data->length = 0;
 831
 832         pa.padata_type          = KRB5_PADATA_PW_SALT;
 833         pa.padata_value.length  = 12;
 834         pa.padata_value.data    = malloc(pa.padata_value.length);
 835         if (!pa.padata_value.data) {
 836                 e_data->length = 0;
 837                 e_data->data = NULL;
 838                 return;
 839         }
 840
 841         SIVAL(pa.padata_value.data, 0, NT_STATUS_V(nt_status));
 842         SIVAL(pa.padata_value.data, 4, 0);
 843         SIVAL(pa.padata_value.data, 8, 1);
 844
 845         ASN1_MALLOC_ENCODE(PA_DATA, buf, len, &pa, &len, ret);
 846         free(pa.padata_value.data);
 847         if (ret) {
 848                 return;
 849         }
 850
 851         e_data->data   = buf;
 852         e_data->length = len;
 853
 854         return;
 855 }
 856
 857
 858 static krb5_error_code samba_wdc_check_client_access(void *priv,
 859                                                      krb5_context context,
 860                                                      krb5_kdc_configuration *config,
 861                                                      hdb_entry_ex *client_ex, const char *client_name,
 862                                                      hdb_entry_ex *server_ex, const char *server_name,
 863                                                      KDC_REQ *req,
 864                                                      krb5_data *e_data)
 865 {
 866         struct samba_kdc_entry *kdc_entry;
 867         bool password_change;
 868         char *workstation;
 869         NTSTATUS nt_status;
 870
 871         kdc_entry = talloc_get_type(client_ex->ctx, struct samba_kdc_entry);
 872         password_change = (server_ex && server_ex->entry.flags.change_pw);
 873         workstation = get_netbios_name((TALLOC_CTX *)client_ex->ctx,
 874                                         req->req_body.addresses);
 875
 876         nt_status = samba_kdc_check_client_access(kdc_entry,
 877                                                   client_name,
 878                                                   workstation,
 879                                                   password_change);
 880
 881         if (!NT_STATUS_IS_OK(nt_status)) {
 882                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) {
 883                         return ENOMEM;
 884                 }
 885
 886                 if (e_data) {
 887                         DATA_BLOB data;
 888
 889                         samba_kdc_build_edata_reply(nt_status, &data);
 890                         *e_data = fill_krb5_data(data.data, data.length);
 891                 }
 892
 893                 return samba_kdc_map_policy_err(nt_status);
 894         }
 895
 896         /* Now do the standard Heimdal check */
 897         return kdc_check_flags(context, config,
 898                                client_ex, client_name,
 899                                server_ex, server_name,
 900                                req->msg_type == krb_as_req);
 901 }
 902
 903 static krb5_error_code samba_wdc_plugin_init(krb5_context context, void **ptr)
 904 {
 905         *ptr = NULL;
 906         return 0;
 907 }
 908
 909 static void samba_wdc_plugin_fini(void *ptr)
 910 {
 911         return;
 912 }
 913
 914 struct krb5plugin_windc_ftable windc_plugin_table = {
 915         .minor_version = KRB5_WINDC_PLUGIN_MINOR,
 916         .init = samba_wdc_plugin_init,
 917         .fini = samba_wdc_plugin_fini,
 918         .pac_generate = samba_wdc_get_pac_compat,
 919         .pac_verify = samba_wdc_reget_pac,
 920         .client_access = samba_wdc_check_client_access,
 921         .pac_pk_generate = samba_wdc_get_pac,
 922 };
 923
 924