source4/kdc/mit-kdb/kdb_samba_policies.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Samba KDB plugin for MIT Kerberos
   5
   6    Copyright (c) 2010      Simo Sorce <idra@samba.org>.
   7    Copyright (c) 2014      Andreas Schneider <asn@samba.org>
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24
  25 #include "system/kerberos.h"
  26
  27 #include <profile.h>
  28 #include <kdb.h>
  29
  30 #include "kdc/mit_samba.h"
  31 #include "kdb_samba.h"
  32
  33 /* FIXME: This is a krb5 function which is exported, but in no header */
  34 extern krb5_error_code decode_krb5_padata_sequence(const krb5_data *output,
  35                                                    krb5_pa_data ***rep);
  36
  37 static krb5_error_code ks_get_netbios_name(krb5_address **addrs, char **name)
  38 {
  39         char *nb_name = NULL;
  40         int len, i;
  41
  42         for (i = 0; addrs[i]; i++) {
  43                 if (addrs[i]->addrtype != ADDRTYPE_NETBIOS) {
  44                         continue;
  45                 }
  46                 len = MIN(addrs[i]->length, 15);
  47                 nb_name = strndup((const char *)addrs[i]->contents, len);
  48                 if (!nb_name) {
  49                         return ENOMEM;
  50                 }
  51                 break;
  52         }
  53
  54         if (nb_name) {
  55                 /* Strip space padding */
  56                 i = strlen(nb_name) - 1;
  57                 for (i = strlen(nb_name) - 1;
  58                      i > 0 && nb_name[i] == ' ';
  59                      i--) {
  60                         nb_name[i] = '\0';
  61                 }
  62         }
  63
  64         *name = nb_name;
  65
  66         return 0;
  67 }
  68
  69 krb5_error_code kdb_samba_db_check_policy_as(krb5_context context,
  70                                              krb5_kdc_req *kdcreq,
  71                                              krb5_db_entry *client,
  72                                              krb5_db_entry *server,
  73                                              krb5_timestamp kdc_time,
  74                                              const char **status,
  75                                              krb5_pa_data ***e_data_out)
  76 {
  77         struct mit_samba_context *mit_ctx;
  78         krb5_error_code code;
  79         char *client_name = NULL;
  80         char *server_name = NULL;
  81         char *netbios_name = NULL;
  82         char *realm = NULL;
  83         bool password_change = false;
  84         DATA_BLOB int_data = { NULL, 0 };
  85         krb5_data d;
  86         krb5_pa_data **e_data;
  87
  88         mit_ctx = ks_get_context(context);
  89         if (mit_ctx == NULL) {
  90                 return KRB5_KDB_DBNOTINITED;
  91         }
  92
  93         if (ks_is_kadmin(context, kdcreq->client)) {
  94                 return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
  95         }
  96
  97         if (krb5_princ_size(context, kdcreq->server) == 2 &&
  98             ks_is_kadmin_changepw(context, kdcreq->server)) {
  99                 code = krb5_get_default_realm(context, &realm);
 100                 if (code) {
 101                         goto done;
 102                 }
 103
 104                 if (ks_data_eq_string(kdcreq->server->realm, realm)) {
 105                         password_change = true;
 106                 }
 107         }
 108
 109         code = krb5_unparse_name(context, kdcreq->server, &server_name);
 110         if (code) {
 111                 goto done;
 112         }
 113
 114         code = krb5_unparse_name(context, kdcreq->client, &client_name);
 115         if (code) {
 116                 goto done;
 117         }
 118
 119         if (kdcreq->addresses) {
 120                 code = ks_get_netbios_name(kdcreq->addresses, &netbios_name);
 121                 if (code) {
 122                         goto done;
 123                 }
 124         }
 125
 126         code = mit_samba_check_client_access(mit_ctx,
 127                                              client,
 128                                              client_name,
 129                                              server,
 130                                              server_name,
 131                                              netbios_name,
 132                                              password_change,
 133                                              &int_data);
 134
 135         if (int_data.length && int_data.data) {
 136
 137                 /* make sure the mapped return code is returned - gd */
 138                 int code_tmp;
 139
 140                 d = ks_make_data(int_data.data, int_data.length);
 141
 142                 code_tmp = decode_krb5_padata_sequence(&d, &e_data);
 143                 if (code_tmp == 0) {
 144                         *e_data_out = e_data;
 145                 }
 146         }
 147 done:
 148         free(realm);
 149         free(server_name);
 150         free(client_name);
 151         free(netbios_name);
 152
 153         return code;
 154 }
 155
 156 static krb5_error_code ks_get_pac(krb5_context context,
 157                                   krb5_db_entry *client,
 158                                   krb5_keyblock *client_key,
 159                                   krb5_pac *pac)
 160 {
 161         struct mit_samba_context *mit_ctx;
 162         krb5_error_code code;
 163
 164         mit_ctx = ks_get_context(context);
 165         if (mit_ctx == NULL) {
 166                 return KRB5_KDB_DBNOTINITED;
 167         }
 168
 169         code = mit_samba_get_pac(mit_ctx,
 170                                  context,
 171                                  client,
 172                                  client_key,
 173                                  pac);
 174         if (code != 0) {
 175                 return code;
 176         }
 177
 178         return code;
 179 }
 180
 181 static krb5_error_code ks_verify_pac(krb5_context context,
 182                                      unsigned int flags,
 183                                      krb5_const_principal client_princ,
 184                                      krb5_db_entry *client,
 185                                      krb5_keyblock *server_key,
 186                                      krb5_keyblock *krbtgt_key,
 187                                      krb5_timestamp authtime,
 188                                      krb5_authdata **tgt_auth_data,
 189                                      krb5_pac *pac)
 190 {
 191         struct mit_samba_context *mit_ctx;
 192         krb5_authdata **authdata = NULL;
 193         krb5_pac ipac = NULL;
 194         DATA_BLOB pac_data = { NULL, 0 };
 195         DATA_BLOB logon_data = { NULL, 0 };
 196         krb5_data data;
 197         krb5_error_code code;
 198
 199         mit_ctx = ks_get_context(context);
 200         if (mit_ctx == NULL) {
 201                 return KRB5_KDB_DBNOTINITED;
 202         }
 203
 204         /* find the existing PAC, if present */
 205         code = krb5_find_authdata(context,
 206                                   tgt_auth_data,
 207                                   NULL,
 208                                   KRB5_AUTHDATA_WIN2K_PAC,
 209                                   &authdata);
 210         if (code != 0) {
 211                 return code;
 212         }
 213
 214         /* no pac data */
 215         if (authdata == NULL) {
 216                 return 0;
 217         }
 218
 219         SMB_ASSERT(authdata[0] != NULL);
 220
 221         if (authdata[1] != NULL) {
 222                 code = KRB5KDC_ERR_BADOPTION; /* XXX */
 223                 goto done;
 224         }
 225
 226         code = krb5_pac_parse(context,
 227                               authdata[0]->contents,
 228                               authdata[0]->length,
 229                               &ipac);
 230         if (code != 0) {
 231                 goto done;
 232         }
 233
 234         /* TODO: verify this is correct
 235          *
 236          * In the constrained delegation case, the PAC is from a service
 237          * ticket rather than a TGT; we must verify the server and KDC
 238          * signatures to assert that the server did not forge the PAC.
 239          */
 240         if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
 241                 code = krb5_pac_verify(context,
 242                                        ipac,
 243                                        authtime,
 244                                        client_princ,
 245                                        server_key,
 246                                        krbtgt_key);
 247         } else {
 248                 code = krb5_pac_verify(context,
 249                                        ipac,
 250                                        authtime,
 251                                        client_princ,
 252                                        krbtgt_key,
 253                                        NULL);
 254         }
 255         if (code != 0) {
 256                 goto done;
 257         }
 258
 259         /* check and update PAC */
 260         pac_data.data = authdata[0]->contents;
 261         pac_data.length = authdata[0]->length;
 262
 263         code = mit_samba_update_pac_data(mit_ctx,
 264                                          client,
 265                                          &pac_data,
 266                                          &logon_data);
 267         if (code != 0) {
 268                 goto done;
 269         }
 270
 271         code = krb5_pac_init(context, pac);
 272         if (code != 0) {
 273                 goto done;
 274         }
 275
 276         data = ks_make_data(logon_data.data, logon_data.length);
 277
 278         code = krb5_pac_add_buffer(context, *pac, PAC_LOGON_INFO, &data);
 279         if (code != 0) {
 280                 goto done;
 281         }
 282
 283 done:
 284         krb5_free_authdata(context, authdata);
 285         krb5_pac_free(context, ipac);
 286         free(logon_data.data);
 287
 288         return code;
 289 }
 290
 291 krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
 292                                             unsigned int flags,
 293                                             krb5_const_principal client_princ,
 294                                             krb5_db_entry *client,
 295                                             krb5_db_entry *server,
 296                                             krb5_db_entry *krbtgt,
 297                                             krb5_keyblock *client_key,
 298                                             krb5_keyblock *server_key,
 299                                             krb5_keyblock *krbtgt_key,
 300                                             krb5_keyblock *session_key,
 301                                             krb5_timestamp authtime,
 302                                             krb5_authdata **tgt_auth_data,
 303                                             krb5_authdata ***signed_auth_data)
 304 {
 305         krb5_const_principal ks_client_princ;
 306         krb5_authdata **authdata = NULL;
 307         krb5_boolean is_as_req;
 308         krb5_error_code code;
 309         krb5_pac pac = NULL;
 310         krb5_data pac_data;
 311
 312         /* Prefer canonicalised name from client entry */
 313         if (client != NULL) {
 314                 ks_client_princ = client->princ;
 315         } else {
 316                 ks_client_princ = client_princ;
 317         }
 318
 319         is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
 320
 321         if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) {
 322                 code = ks_get_pac(context, client, client_key, &pac);
 323                 if (code != 0) {
 324                         goto done;
 325                 }
 326         }
 327
 328         if (!is_as_req) {
 329                 code = ks_verify_pac(context, flags, ks_client_princ, client,
 330                                 server_key, krbtgt_key, authtime,
 331                                 tgt_auth_data, &pac);
 332                 if (code != 0) {
 333                         goto done;
 334                 }
 335         }
 336
 337         if (pac == NULL && client != NULL) {
 338
 339                 code = ks_get_pac(context, client, client_key, &pac);
 340                 if (code != 0) {
 341                         goto done;
 342                 }
 343         }
 344
 345         if (pac == NULL) {
 346                 code = KRB5_KDB_DBTYPE_NOSUP;
 347                 goto done;
 348         }
 349
 350         code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
 351                         server_key, krbtgt_key, &pac_data);
 352         if (code != 0) {
 353                 goto done;
 354         }
 355
 356         authdata = calloc(2, sizeof(krb5_authdata *));
 357         if (authdata == NULL) {
 358                 goto done;
 359         }
 360
 361         authdata[0] = malloc(sizeof(krb5_authdata));
 362         if (authdata[0] == NULL) {
 363                 goto done;
 364         }
 365
 366         /* put in signed data */
 367         authdata[0]->magic = KV5M_AUTHDATA;
 368         authdata[0]->ad_type = KRB5_AUTHDATA_WIN2K_PAC;
 369         authdata[0]->contents = (krb5_octet *)pac_data.data;
 370         authdata[0]->length = pac_data.length;
 371
 372         code = krb5_encode_authdata_container(context,
 373                                               KRB5_AUTHDATA_IF_RELEVANT,
 374                                               authdata,
 375                                               signed_auth_data);
 376         if (code != 0) {
 377                 goto done;
 378         }
 379
 380         code = 0;
 381
 382 done:
 383         krb5_pac_free(context, pac);
 384         krb5_free_authdata(context, authdata);
 385
 386         return code;
 387 }
 388
 389 krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
 390                                                        krb5_const_principal client,
 391                                                        const krb5_db_entry *server,
 392                                                        krb5_const_principal proxy)
 393 {
 394         struct mit_samba_context *mit_ctx;
 395
 396         /*
 397          * Names are quite odd and confusing in the current implementation.
 398          * The following mappings should help understanding what is what.
 399          * client ->  client to impersonate
 400          * server; -> delegating service
 401          * proxy; -> target principal
 402          */
 403         krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server);
 404
 405         char *target_name = NULL;
 406         bool is_enterprise;
 407         krb5_error_code code;
 408
 409         mit_ctx = ks_get_context(context);
 410         if (mit_ctx == NULL) {
 411                 return KRB5_KDB_DBNOTINITED;
 412         }
 413
 414         code = krb5_unparse_name(context, proxy, &target_name);
 415         if (code) {
 416                 goto done;
 417         }
 418
 419         is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL);
 420
 421         code = mit_samba_check_s4u2proxy(mit_ctx,
 422                                          delegating_service,
 423                                          target_name,
 424                                          is_enterprise);
 425
 426 done:
 427         free(target_name);
 428         return code;
 429 }
 430
 431 void kdb_samba_db_audit_as_req(krb5_context context,
 432                                krb5_kdc_req *request,
 433                                krb5_db_entry *client,
 434                                krb5_db_entry *server,
 435                                krb5_timestamp authtime,
 436                                krb5_error_code error_code)
 437 {
 438         struct mit_samba_context *mit_ctx;
 439
 440         mit_ctx = ks_get_context(context);
 441         if (mit_ctx == NULL) {
 442                 return;
 443         }
 444
 445         switch (error_code) {
 446         case 0:
 447                 mit_samba_zero_bad_password_count(client);
 448                 break;
 449         case KRB5KDC_ERR_PREAUTH_FAILED:
 450         case KRB5KRB_AP_ERR_BAD_INTEGRITY:
 451                 mit_samba_update_bad_password_count(client);
 452                 break;
 453         }
 454 }