4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 * Component: ldb update_keytabs module
25 * Description: Update keytabs whenever their matching secret record changes
27 * Author: Andrew Bartlett
31 #include "ldb/include/ldb_includes.h"
32 #include "auth/credentials/credentials.h"
33 #include "auth/credentials/credentials_krb5.h"
34 #include "system/kerberos.h"
37 struct cli_credentials *creds;
38 struct dn_list *prev, *next;
41 struct update_kt_private {
42 struct dn_list *changed_dns;
45 struct update_kt_ctx {
46 struct ldb_module *module;
47 struct ldb_request *req;
52 struct ldb_reply *op_reply;
56 static struct update_kt_ctx *update_kt_ctx_init(struct ldb_module *module,
57 struct ldb_request *req)
59 struct update_kt_ctx *ac;
61 ac = talloc_zero(req, struct update_kt_ctx);
73 /* FIXME: too many semi-async searches here for my taste, direct and indirect as
74 * cli_credentials_set_secrets() performs a sync ldb search.
75 * Just hope we are lucky and nothing breaks (using the tdb backend masks a lot
76 * of async issues). -SSS
78 static int add_modified(struct ldb_module *module, struct ldb_dn *dn, bool delete) {
79 struct update_kt_private *data = talloc_get_type(module->private_data, struct update_kt_private);
82 struct ldb_result *res;
83 const char *attrs[] = { NULL };
87 filter = talloc_asprintf(data, "(&(dn=%s)(&(objectClass=kerberosSecret)(privateKeytab=*)))",
88 ldb_dn_get_linearized(dn));
91 return LDB_ERR_OPERATIONS_ERROR;
94 ret = ldb_search(module->ldb, data, &res,
95 dn, LDB_SCOPE_BASE, attrs, "%s", filter);
96 if (ret != LDB_SUCCESS) {
101 if (res->count != 1) {
102 /* if it's not a kerberosSecret then we don't have anything to update */
109 item = talloc(data->changed_dns? (void *)data->changed_dns: (void *)data, struct dn_list);
112 ldb_oom(module->ldb);
113 return LDB_ERR_OPERATIONS_ERROR;
116 item->creds = cli_credentials_init(item);
118 DEBUG(1, ("cli_credentials_init failed!"));
120 ldb_oom(module->ldb);
121 return LDB_ERR_OPERATIONS_ERROR;
124 cli_credentials_set_conf(item->creds, ldb_get_opaque(module->ldb, "loadparm"));
125 status = cli_credentials_set_secrets(item->creds, ldb_get_event_context(module->ldb), ldb_get_opaque(module->ldb, "loadparm"), module->ldb, NULL, filter);
127 if (NT_STATUS_IS_OK(status)) {
129 /* Ensure we don't helpfully keep an old keytab entry */
130 cli_credentials_set_kvno(item->creds, cli_credentials_get_kvno(item->creds)+2);
132 cli_credentials_set_nt_hash(item->creds, NULL,
135 DLIST_ADD_END(data->changed_dns, item, struct dn_list *);
140 static int ukt_search_modified(struct update_kt_ctx *ac);
142 static int update_kt_op_callback(struct ldb_request *req,
143 struct ldb_reply *ares)
145 struct update_kt_ctx *ac;
148 ac = talloc_get_type(req->context, struct update_kt_ctx);
151 return ldb_module_done(ac->req, NULL, NULL,
152 LDB_ERR_OPERATIONS_ERROR);
154 if (ares->error != LDB_SUCCESS) {
155 return ldb_module_done(ac->req, ares->controls,
156 ares->response, ares->error);
159 if (ares->type != LDB_REPLY_DONE) {
160 ldb_set_errstring(ac->module->ldb, "Invalid request type!\n");
161 return ldb_module_done(ac->req, NULL, NULL,
162 LDB_ERR_OPERATIONS_ERROR);
166 return ldb_module_done(ac->req, ares->controls,
167 ares->response, LDB_SUCCESS);
170 ac->op_reply = talloc_steal(ac, ares);
172 ret = ukt_search_modified(ac);
173 if (ret != LDB_SUCCESS) {
174 return ldb_module_done(ac->req, NULL, NULL, ret);
180 static int ukt_del_op(struct update_kt_ctx *ac)
182 struct ldb_request *down_req;
185 ret = ldb_build_del_req(&down_req, ac->module->ldb, ac,
188 ac, update_kt_op_callback,
190 if (ret != LDB_SUCCESS) {
193 return ldb_next_request(ac->module, down_req);
196 static int ukt_search_modified_callback(struct ldb_request *req,
197 struct ldb_reply *ares)
199 struct update_kt_ctx *ac;
202 ac = talloc_get_type(req->context, struct update_kt_ctx);
205 return ldb_module_done(ac->req, NULL, NULL,
206 LDB_ERR_OPERATIONS_ERROR);
208 if (ares->error != LDB_SUCCESS) {
209 return ldb_module_done(ac->req, ares->controls,
210 ares->response, ares->error);
213 switch (ares->type) {
214 case LDB_REPLY_ENTRY:
219 case LDB_REPLY_REFERRAL:
226 /* do the dirty sync job here :/ */
227 ret = add_modified(ac->module, ac->dn, ac->delete);
231 ret = ukt_del_op(ac);
232 if (ret != LDB_SUCCESS) {
233 return ldb_module_done(ac->req,
239 return ldb_module_done(ac->req, ac->op_reply->controls,
240 ac->op_reply->response, LDB_SUCCESS);
247 static int ukt_search_modified(struct update_kt_ctx *ac)
249 static const char * const attrs[] = { "distinguishedName", NULL };
250 struct ldb_request *search_req;
253 ret = ldb_build_search_req(&search_req, ac->module->ldb, ac,
254 ac->dn, LDB_SCOPE_BASE,
255 "(&(objectClass=kerberosSecret)"
256 "(privateKeytab=*))", attrs,
258 ac, ukt_search_modified_callback,
260 if (ret != LDB_SUCCESS) {
263 return ldb_next_request(ac->module, search_req);
268 static int update_kt_add(struct ldb_module *module, struct ldb_request *req)
270 struct update_kt_ctx *ac;
271 struct ldb_request *down_req;
274 ac = update_kt_ctx_init(module, req);
276 return LDB_ERR_OPERATIONS_ERROR;
279 ac->dn = req->op.add.message->dn;
281 ret = ldb_build_add_req(&down_req, module->ldb, ac,
284 ac, update_kt_op_callback,
286 if (ret != LDB_SUCCESS) {
290 return ldb_next_request(module, down_req);
294 static int update_kt_modify(struct ldb_module *module, struct ldb_request *req)
296 struct update_kt_ctx *ac;
297 struct ldb_request *down_req;
300 ac = update_kt_ctx_init(module, req);
302 return LDB_ERR_OPERATIONS_ERROR;
305 ac->dn = req->op.mod.message->dn;
307 ret = ldb_build_mod_req(&down_req, module->ldb, ac,
310 ac, update_kt_op_callback,
312 if (ret != LDB_SUCCESS) {
316 return ldb_next_request(module, down_req);
320 static int update_kt_delete(struct ldb_module *module, struct ldb_request *req)
322 struct update_kt_ctx *ac;
324 ac = update_kt_ctx_init(module, req);
326 return LDB_ERR_OPERATIONS_ERROR;
329 ac->dn = req->op.del.dn;
332 return ukt_search_modified(ac);
336 static int update_kt_rename(struct ldb_module *module, struct ldb_request *req)
338 struct update_kt_ctx *ac;
339 struct ldb_request *down_req;
342 ac = update_kt_ctx_init(module, req);
344 return LDB_ERR_OPERATIONS_ERROR;
347 ac->dn = req->op.rename.newdn;
349 ret = ldb_build_rename_req(&down_req, module->ldb, ac,
350 req->op.rename.olddn,
351 req->op.rename.newdn,
353 ac, update_kt_op_callback,
355 if (ret != LDB_SUCCESS) {
359 return ldb_next_request(module, down_req);
362 /* end a transaction */
363 static int update_kt_end_trans(struct ldb_module *module)
365 struct update_kt_private *data = talloc_get_type(module->private_data, struct update_kt_private);
368 for (p=data->changed_dns; p; p = p->next) {
370 kret = cli_credentials_update_keytab(p->creds, ldb_get_event_context(module->ldb), ldb_get_opaque(module->ldb, "loadparm"));
372 talloc_free(data->changed_dns);
373 data->changed_dns = NULL;
374 ldb_asprintf_errstring(module->ldb, "Failed to update keytab: %s", error_message(kret));
375 return LDB_ERR_OPERATIONS_ERROR;
379 talloc_free(data->changed_dns);
380 data->changed_dns = NULL;
382 return ldb_next_end_trans(module);
385 /* end a transaction */
386 static int update_kt_del_trans(struct ldb_module *module)
388 struct update_kt_private *data = talloc_get_type(module->private_data, struct update_kt_private);
390 talloc_free(data->changed_dns);
391 data->changed_dns = NULL;
393 return ldb_next_del_trans(module);
396 static int update_kt_init(struct ldb_module *module)
398 struct update_kt_private *data;
400 data = talloc(module, struct update_kt_private);
402 ldb_oom(module->ldb);
403 return LDB_ERR_OPERATIONS_ERROR;
406 module->private_data = data;
407 data->changed_dns = NULL;
409 return ldb_next_init(module);
412 _PUBLIC_ const struct ldb_module_ops ldb_update_keytab_module_ops = {
413 .name = "update_keytab",
414 .init_context = update_kt_init,
415 .add = update_kt_add,
416 .modify = update_kt_modify,
417 .rename = update_kt_rename,
418 .del = update_kt_delete,
419 .end_transaction = update_kt_end_trans,
420 .del_transaction = update_kt_del_trans,