source4/kdc/kdc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    KDC Server startup
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
   7    Copyright (C) Andrew Tridgell        2005
   8    Copyright (C) Stefan Metzmacher      2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "smbd/service_task.h"
  26 #include "smbd/service.h"
  27 #include "smbd/service_stream.h"
  28 #include "smbd/process_model.h"
  29 #include "lib/events/events.h"
  30 #include "lib/socket/socket.h"
  31 #include "lib/tsocket/tsocket.h"
  32 #include "system/network.h"
  33 #include "../lib/util/dlinklist.h"
  34 #include "lib/messaging/irpc.h"
  35 #include "lib/stream/packet.h"
  36 #include "librpc/gen_ndr/samr.h"
  37 #include "librpc/gen_ndr/ndr_irpc.h"
  38 #include "librpc/gen_ndr/ndr_krb5pac.h"
  39 #include "lib/socket/netif.h"
  40 #include "param/param.h"
  41 #include "kdc/kdc.h"
  42 #include "librpc/gen_ndr/ndr_misc.h"
  43
  44
  45 /* Disgusting hack to get a mem_ctx and lp_ctx into the hdb plugin, when
  46  * used as a keytab */
  47 TALLOC_CTX *hdb_samba4_mem_ctx;
  48 struct tevent_context *hdb_samba4_ev_ctx;
  49 struct loadparm_context *hdb_samba4_lp_ctx;
  50
  51 typedef bool (*kdc_process_fn_t)(struct kdc_server *kdc,
  52                                  TALLOC_CTX *mem_ctx,
  53                                  DATA_BLOB *input,
  54                                  DATA_BLOB *reply,
  55                                  struct tsocket_address *peer_addr,
  56                                  struct tsocket_address *my_addr,
  57                                  int datagram);
  58
  59 /* hold information about one kdc socket */
  60 struct kdc_socket {
  61         struct kdc_server *kdc;
  62         struct tsocket_address *local_address;
  63         kdc_process_fn_t process;
  64 };
  65
  66 /*
  67   state of an open tcp connection
  68 */
  69 struct kdc_tcp_connection {
  70         /* stream connection we belong to */
  71         struct stream_connection *conn;
  72
  73         /* the kdc_server the connection belongs to */
  74         struct kdc_socket *kdc_socket;
  75
  76         struct tsocket_address *local_address;
  77         struct tsocket_address *remote_address;
  78
  79         struct packet_context *packet;
  80 };
  81
  82 static void kdc_tcp_terminate_connection(struct kdc_tcp_connection *kdcconn, const char *reason)
  83 {
  84         stream_terminate_connection(kdcconn->conn, reason);
  85 }
  86
  87 /*
  88   receive a full packet on a KDC connection
  89 */
  90 static NTSTATUS kdc_tcp_recv(void *private_data, DATA_BLOB blob)
  91 {
  92         struct kdc_tcp_connection *kdcconn = talloc_get_type(private_data,
  93                                                              struct kdc_tcp_connection);
  94         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
  95         TALLOC_CTX *tmp_ctx = talloc_new(kdcconn);
  96         int ret;
  97         DATA_BLOB input, reply;
  98         talloc_steal(tmp_ctx, blob.data);
  99
 100         /* Call krb5 */
 101         input = data_blob_const(blob.data + 4, blob.length - 4);
 102
 103         ret = kdcconn->kdc_socket->process(kdcconn->kdc_socket->kdc,
 104                                            tmp_ctx,
 105                                            &input,
 106                                            &reply,
 107                                            kdcconn->remote_address,
 108                                            kdcconn->local_address,
 109                                            0 /* Not datagram */);
 110         if (!ret) {
 111                 talloc_free(tmp_ctx);
 112                 return NT_STATUS_INTERNAL_ERROR;
 113         }
 114
 115         /* and now encode the reply */
 116         blob = data_blob_talloc(kdcconn, NULL, reply.length + 4);
 117         if (!blob.data) {
 118                 talloc_free(tmp_ctx);
 119                 return NT_STATUS_NO_MEMORY;
 120         }
 121
 122         RSIVAL(blob.data, 0, reply.length);
 123         memcpy(blob.data + 4, reply.data, reply.length);
 124
 125         status = packet_send(kdcconn->packet, blob);
 126         if (!NT_STATUS_IS_OK(status)) {
 127                 talloc_free(tmp_ctx);
 128                 return status;
 129         }
 130
 131         /* the call isn't needed any more */
 132         talloc_free(tmp_ctx);
 133         return NT_STATUS_OK;
 134 }
 135
 136 /*
 137   receive some data on a KDC connection
 138 */
 139 static void kdc_tcp_recv_handler(struct stream_connection *conn, uint16_t flags)
 140 {
 141         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
 142                                                              struct kdc_tcp_connection);
 143         packet_recv(kdcconn->packet);
 144 }
 145
 146 /*
 147   called on a tcp recv error
 148 */
 149 static void kdc_tcp_recv_error(void *private_data, NTSTATUS status)
 150 {
 151         struct kdc_tcp_connection *kdcconn = talloc_get_type(private_data,
 152                                              struct kdc_tcp_connection);
 153         kdc_tcp_terminate_connection(kdcconn, nt_errstr(status));
 154 }
 155
 156 /*
 157   called when we can write to a connection
 158 */
 159 static void kdc_tcp_send(struct stream_connection *conn, uint16_t flags)
 160 {
 161         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
 162                                                              struct kdc_tcp_connection);
 163         packet_queue_run(kdcconn->packet);
 164 }
 165
 166 /**
 167    Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
 168    calling conventions
 169 */
 170
 171 static bool kdc_process(struct kdc_server *kdc,
 172                         TALLOC_CTX *mem_ctx,
 173                         DATA_BLOB *input,
 174                         DATA_BLOB *reply,
 175                         struct tsocket_address *peer_addr,
 176                         struct tsocket_address *my_addr,
 177                         int datagram_reply)
 178 {
 179         int ret;
 180         char *pa;
 181         struct sockaddr_storage ss;
 182         krb5_data k5_reply;
 183         krb5_data_zero(&k5_reply);
 184
 185         krb5_kdc_update_time(NULL);
 186
 187         ret = tsocket_address_bsd_sockaddr(peer_addr, (struct sockaddr *) &ss,
 188                                 sizeof(struct sockaddr_storage));
 189         if (ret < 0) {
 190                 return false;
 191         }
 192         pa = tsocket_address_string(peer_addr, mem_ctx);
 193         if (pa == NULL) {
 194                 return false;
 195         }
 196
 197         DEBUG(10,("Received KDC packet of length %lu from %s\n",
 198                                 (long)input->length - 4, pa));
 199
 200         ret = krb5_kdc_process_krb5_request(kdc->smb_krb5_context->krb5_context,
 201                                             kdc->config,
 202                                             input->data, input->length,
 203                                             &k5_reply,
 204                                             pa,
 205                                             (struct sockaddr *) &ss,
 206                                             datagram_reply);
 207         if (ret == -1) {
 208                 *reply = data_blob(NULL, 0);
 209                 return false;
 210         }
 211         if (k5_reply.length) {
 212                 *reply = data_blob_talloc(mem_ctx, k5_reply.data, k5_reply.length);
 213                 krb5_data_free(&k5_reply);
 214         } else {
 215                 *reply = data_blob(NULL, 0);
 216         }
 217         return true;
 218 }
 219
 220 /*
 221   called when we get a new connection
 222 */
 223 static void kdc_tcp_accept(struct stream_connection *conn)
 224 {
 225         struct kdc_socket *kdc_socket = talloc_get_type(conn->private_data, struct kdc_socket);
 226         struct kdc_tcp_connection *kdcconn;
 227         struct socket_address *src_addr;
 228         struct socket_address *my_addr;
 229         int ret;
 230
 231         kdcconn = talloc_zero(conn, struct kdc_tcp_connection);
 232         if (!kdcconn) {
 233                 stream_terminate_connection(conn, "kdc_tcp_accept: out of memory");
 234                 return;
 235         }
 236         kdcconn->conn           = conn;
 237         kdcconn->kdc_socket     = kdc_socket;
 238         conn->private_data    = kdcconn;
 239
 240         src_addr = socket_get_peer_addr(kdcconn->conn->socket, kdcconn);
 241         if (!src_addr) {
 242                 kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_accept: out of memory");
 243                 return;
 244         }
 245
 246         my_addr = socket_get_my_addr(kdcconn->conn->socket, kdcconn);
 247         if (!my_addr) {
 248                 kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_accept: out of memory");
 249                 return;
 250         }
 251
 252         ret = tsocket_address_bsd_from_sockaddr(kdcconn,
 253                                                 src_addr->sockaddr,
 254                                                 src_addr->sockaddrlen,
 255                                                 &kdcconn->remote_address);
 256         if (ret < 0) {
 257                 kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_accept: out of memory");
 258                 return;
 259         }
 260
 261         ret = tsocket_address_bsd_from_sockaddr(kdcconn,
 262                                                 my_addr->sockaddr,
 263                                                 my_addr->sockaddrlen,
 264                                                 &kdcconn->local_address);
 265         if (ret < 0) {
 266                 kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_accept: out of memory");
 267                 return;
 268         }
 269
 270         TALLOC_FREE(src_addr);
 271         TALLOC_FREE(my_addr);
 272
 273         kdcconn->packet = packet_init(kdcconn);
 274         if (kdcconn->packet == NULL) {
 275                 kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_accept: out of memory");
 276                 return;
 277         }
 278         packet_set_private(kdcconn->packet, kdcconn);
 279         packet_set_socket(kdcconn->packet, conn->socket);
 280         packet_set_callback(kdcconn->packet, kdc_tcp_recv);
 281         packet_set_full_request(kdcconn->packet, packet_full_request_u32);
 282         packet_set_error_handler(kdcconn->packet, kdc_tcp_recv_error);
 283         packet_set_event_context(kdcconn->packet, conn->event.ctx);
 284         packet_set_fde(kdcconn->packet, conn->event.fde);
 285         packet_set_serialise(kdcconn->packet);
 286 }
 287
 288 static const struct stream_server_ops kdc_tcp_stream_ops = {
 289         .name                   = "kdc_tcp",
 290         .accept_connection      = kdc_tcp_accept,
 291         .recv_handler           = kdc_tcp_recv_handler,
 292         .send_handler           = kdc_tcp_send
 293 };
 294
 295 /* hold information about one kdc/kpasswd udp socket */
 296 struct kdc_udp_socket {
 297         struct kdc_socket *kdc_socket;
 298         struct tdgram_context *dgram;
 299         struct tevent_queue *send_queue;
 300 };
 301
 302 struct kdc_udp_call {
 303         struct tsocket_address *src;
 304         DATA_BLOB in;
 305         DATA_BLOB out;
 306 };
 307
 308 static void kdc_udp_call_sendto_done(struct tevent_req *subreq);
 309
 310 static void kdc_udp_call_loop(struct tevent_req *subreq)
 311 {
 312         struct kdc_udp_socket *sock = tevent_req_callback_data(subreq,
 313                                       struct kdc_udp_socket);
 314         struct kdc_udp_call *call;
 315         uint8_t *buf;
 316         ssize_t len;
 317         int sys_errno;
 318         int ret;
 319
 320         call = talloc(sock, struct kdc_udp_call);
 321         if (call == NULL) {
 322                 talloc_free(call);
 323                 goto done;
 324         }
 325
 326         len = tdgram_recvfrom_recv(subreq, &sys_errno,
 327                                    call, &buf, &call->src);
 328         TALLOC_FREE(subreq);
 329         if (len == -1) {
 330                 talloc_free(call);
 331                 goto done;
 332         }
 333
 334         call->in.data = buf;
 335         call->in.length = len;
 336
 337         DEBUG(10,("Received krb5 UDP packet of length %lu from %s\n",
 338                  (long)call->in.length,
 339                  tsocket_address_string(call->src, call)));
 340
 341         /* Call krb5 */
 342         ret = sock->kdc_socket->process(sock->kdc_socket->kdc,
 343                                         call,
 344                                         &call->in,
 345                                         &call->out,
 346                                         call->src,
 347                                         sock->kdc_socket->local_address,
 348                                         1 /* Datagram */);
 349         if (!ret) {
 350                 talloc_free(call);
 351                 goto done;
 352         }
 353
 354         subreq = tdgram_sendto_queue_send(call,
 355                                           sock->kdc_socket->kdc->task->event_ctx,
 356                                           sock->dgram,
 357                                           sock->send_queue,
 358                                           call->out.data,
 359                                           call->out.length,
 360                                           call->src);
 361         if (subreq == NULL) {
 362                 talloc_free(call);
 363                 goto done;
 364         }
 365         tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call);
 366
 367 done:
 368         subreq = tdgram_recvfrom_send(sock,
 369                                       sock->kdc_socket->kdc->task->event_ctx,
 370                                       sock->dgram);
 371         if (subreq == NULL) {
 372                 task_server_terminate(sock->kdc_socket->kdc->task,
 373                                       "no memory for tdgram_recvfrom_send",
 374                                       true);
 375                 return;
 376         }
 377         tevent_req_set_callback(subreq, kdc_udp_call_loop, sock);
 378 }
 379
 380 static void kdc_udp_call_sendto_done(struct tevent_req *subreq)
 381 {
 382         struct kdc_udp_call *call = tevent_req_callback_data(subreq,
 383                                        struct kdc_udp_call);
 384         ssize_t ret;
 385         int sys_errno;
 386
 387         ret = tdgram_sendto_queue_recv(subreq, &sys_errno);
 388
 389         /* We don't care about errors */
 390
 391         talloc_free(call);
 392 }
 393
 394 /*
 395   start listening on the given address
 396 */
 397 static NTSTATUS kdc_add_socket(struct kdc_server *kdc,
 398                                const struct model_ops *model_ops,
 399                                const char *name,
 400                                const char *address,
 401                                uint16_t port,
 402                                kdc_process_fn_t process)
 403 {
 404         struct kdc_socket *kdc_socket;
 405         struct kdc_udp_socket *kdc_udp_socket;
 406         struct tevent_req *udpsubreq;
 407         NTSTATUS status;
 408         int ret;
 409
 410         kdc_socket = talloc(kdc, struct kdc_socket);
 411         NT_STATUS_HAVE_NO_MEMORY(kdc_socket);
 412
 413         kdc_socket->kdc = kdc;
 414         kdc_socket->process = process;
 415
 416         ret = tsocket_address_inet_from_strings(kdc_socket, "ip",
 417                                                 address, port,
 418                                                 &kdc_socket->local_address);
 419         if (ret != 0) {
 420                 status = map_nt_error_from_unix(errno);
 421                 return status;
 422         }
 423
 424         status = stream_setup_socket(kdc->task->event_ctx,
 425                                      kdc->task->lp_ctx,
 426                                      model_ops,
 427                                      &kdc_tcp_stream_ops,
 428                                      "ip", address, &port,
 429                                      lp_socket_options(kdc->task->lp_ctx),
 430                                      kdc_socket);
 431         if (!NT_STATUS_IS_OK(status)) {
 432                 DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
 433                          address, port, nt_errstr(status)));
 434                 talloc_free(kdc_socket);
 435                 return status;
 436         }
 437
 438         kdc_udp_socket = talloc(kdc_socket, struct kdc_udp_socket);
 439         NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket);
 440
 441         kdc_udp_socket->kdc_socket = kdc_socket;
 442
 443         ret = tdgram_inet_udp_socket(kdc_socket->local_address,
 444                                      NULL,
 445                                      kdc_udp_socket,
 446                                      &kdc_udp_socket->dgram);
 447         if (ret != 0) {
 448                 status = map_nt_error_from_unix(errno);
 449                 DEBUG(0,("Failed to bind to %s:%u UDP - %s\n",
 450                          address, port, nt_errstr(status)));
 451                 return status;
 452         }
 453
 454         kdc_udp_socket->send_queue = tevent_queue_create(kdc_udp_socket,
 455                                                          "kdc_udp_send_queue");
 456         NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket->send_queue);
 457
 458         udpsubreq = tdgram_recvfrom_send(kdc_udp_socket,
 459                                          kdc->task->event_ctx,
 460                                          kdc_udp_socket->dgram);
 461         NT_STATUS_HAVE_NO_MEMORY(udpsubreq);
 462         tevent_req_set_callback(udpsubreq, kdc_udp_call_loop, kdc_udp_socket);
 463
 464         return NT_STATUS_OK;
 465 }
 466
 467
 468 /*
 469   setup our listening sockets on the configured network interfaces
 470 */
 471 static NTSTATUS kdc_startup_interfaces(struct kdc_server *kdc, struct loadparm_context *lp_ctx,
 472                                        struct interface *ifaces)
 473 {
 474         const struct model_ops *model_ops;
 475         int num_interfaces;
 476         TALLOC_CTX *tmp_ctx = talloc_new(kdc);
 477         NTSTATUS status;
 478         int i;
 479
 480         /* within the kdc task we want to be a single process, so
 481            ask for the single process model ops and pass these to the
 482            stream_setup_socket() call. */
 483         model_ops = process_model_startup(kdc->task->event_ctx, "single");
 484         if (!model_ops) {
 485                 DEBUG(0,("Can't find 'single' process model_ops\n"));
 486                 return NT_STATUS_INTERNAL_ERROR;
 487         }
 488
 489         num_interfaces = iface_count(ifaces);
 490
 491         for (i=0; i<num_interfaces; i++) {
 492                 const char *address = talloc_strdup(tmp_ctx, iface_n_ip(ifaces, i));
 493                 uint16_t kdc_port = lp_krb5_port(lp_ctx);
 494                 uint16_t kpasswd_port = lp_kpasswd_port(lp_ctx);
 495
 496                 if (kdc_port) {
 497                         status = kdc_add_socket(kdc, model_ops,
 498                                         "kdc", address, kdc_port,
 499                                         kdc_process);
 500                         NT_STATUS_NOT_OK_RETURN(status);
 501                 }
 502
 503                 if (kpasswd_port) {
 504                         status = kdc_add_socket(kdc, model_ops,
 505                                         "kpasswd", address, kpasswd_port,
 506                                         kpasswdd_process);
 507                         NT_STATUS_NOT_OK_RETURN(status);
 508                 }
 509         }
 510
 511         talloc_free(tmp_ctx);
 512
 513         return NT_STATUS_OK;
 514 }
 515
 516
 517 static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg,
 518                                  struct kdc_check_generic_kerberos *r)
 519 {
 520         struct PAC_Validate pac_validate;
 521         DATA_BLOB srv_sig;
 522         struct PAC_SIGNATURE_DATA kdc_sig;
 523         struct kdc_server *kdc = talloc_get_type(msg->private_data, struct kdc_server);
 524         enum ndr_err_code ndr_err;
 525         krb5_enctype etype;
 526         int ret;
 527         hdb_entry_ex ent;
 528         krb5_principal principal;
 529         krb5_keyblock keyblock;
 530         Key *key;
 531
 532         /* There is no reply to this request */
 533         r->out.generic_reply = data_blob(NULL, 0);
 534
 535         ndr_err = ndr_pull_struct_blob(&r->in.generic_request, msg,
 536                                        lp_iconv_convenience(kdc->task->lp_ctx),
 537                                        &pac_validate,
 538                                        (ndr_pull_flags_fn_t)ndr_pull_PAC_Validate);
 539         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 540                 return NT_STATUS_INVALID_PARAMETER;
 541         }
 542
 543         if (pac_validate.MessageType != 3) {
 544                 /* We don't implement any other message types - such as certificate validation - yet */
 545                 return NT_STATUS_INVALID_PARAMETER;
 546         }
 547
 548         if (pac_validate.ChecksumAndSignature.length != (pac_validate.ChecksumLength + pac_validate.SignatureLength)
 549             || pac_validate.ChecksumAndSignature.length < pac_validate.ChecksumLength
 550             || pac_validate.ChecksumAndSignature.length < pac_validate.SignatureLength ) {
 551                 return NT_STATUS_INVALID_PARAMETER;
 552         }
 553
 554         srv_sig = data_blob_const(pac_validate.ChecksumAndSignature.data,
 555                                   pac_validate.ChecksumLength);
 556
 557         if (pac_validate.SignatureType == CKSUMTYPE_HMAC_MD5) {
 558                 etype = ETYPE_ARCFOUR_HMAC_MD5;
 559         } else {
 560                 ret = krb5_cksumtype_to_enctype(kdc->smb_krb5_context->krb5_context, pac_validate.SignatureType,
 561                                                 &etype);
 562                 if (ret != 0) {
 563                         return NT_STATUS_LOGON_FAILURE;
 564                 }
 565         }
 566
 567         ret = krb5_make_principal(kdc->smb_krb5_context->krb5_context, &principal,
 568                                   lp_realm(kdc->task->lp_ctx),
 569                                   "krbtgt", lp_realm(kdc->task->lp_ctx),
 570                                   NULL);
 571
 572         if (ret != 0) {
 573                 return NT_STATUS_NO_MEMORY;
 574         }
 575
 576         ret = kdc->config->db[0]->hdb_fetch(kdc->smb_krb5_context->krb5_context,
 577                                             kdc->config->db[0],
 578                                             principal,
 579                                             HDB_F_GET_KRBTGT | HDB_F_DECRYPT,
 580                                             &ent);
 581
 582         if (ret != 0) {
 583                 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
 584                 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
 585
 586                 return NT_STATUS_LOGON_FAILURE;
 587         }
 588
 589         ret = hdb_enctype2key(kdc->smb_krb5_context->krb5_context, &ent.entry, etype, &key);
 590
 591         if (ret != 0) {
 592                 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
 593                 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
 594                 return NT_STATUS_LOGON_FAILURE;
 595         }
 596
 597         keyblock = key->key;
 598
 599         kdc_sig.type = pac_validate.SignatureType;
 600         kdc_sig.signature = data_blob_const(&pac_validate.ChecksumAndSignature.data[pac_validate.ChecksumLength],
 601                                             pac_validate.SignatureLength);
 602         ret = check_pac_checksum(msg, srv_sig, &kdc_sig,
 603                            kdc->smb_krb5_context->krb5_context, &keyblock);
 604
 605         hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
 606         krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
 607
 608         if (ret != 0) {
 609                 return NT_STATUS_LOGON_FAILURE;
 610         }
 611
 612         return NT_STATUS_OK;
 613 }
 614
 615
 616 /*
 617   startup the kdc task
 618 */
 619 static void kdc_task_init(struct task_server *task)
 620 {
 621         struct kdc_server *kdc;
 622         NTSTATUS status;
 623         krb5_error_code ret;
 624         struct interface *ifaces;
 625
 626         switch (lp_server_role(task->lp_ctx)) {
 627         case ROLE_STANDALONE:
 628                 task_server_terminate(task, "kdc: no KDC required in standalone configuration", false);
 629                 return;
 630         case ROLE_DOMAIN_MEMBER:
 631                 task_server_terminate(task, "kdc: no KDC required in member server configuration", false);
 632                 return;
 633         case ROLE_DOMAIN_CONTROLLER:
 634                 /* Yes, we want a KDC */
 635                 break;
 636         }
 637
 638         load_interfaces(task, lp_interfaces(task->lp_ctx), &ifaces);
 639
 640         if (iface_count(ifaces) == 0) {
 641                 task_server_terminate(task, "kdc: no network interfaces configured", false);
 642                 return;
 643         }
 644
 645         task_server_set_title(task, "task[kdc]");
 646
 647         kdc = talloc(task, struct kdc_server);
 648         if (kdc == NULL) {
 649                 task_server_terminate(task, "kdc: out of memory", true);
 650                 return;
 651         }
 652
 653         kdc->task = task;
 654
 655         initialize_krb5_error_table();
 656
 657         ret = smb_krb5_init_context(kdc, task->event_ctx, task->lp_ctx, &kdc->smb_krb5_context);
 658         if (ret) {
 659                 DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n",
 660                          error_message(ret)));
 661                 task_server_terminate(task, "kdc: krb5_init_context failed", true);
 662                 return;
 663         }
 664
 665         krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r);
 666
 667         ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context,
 668                                   &kdc->config);
 669         if(ret) {
 670                 task_server_terminate(task, "kdc: failed to get KDC configuration", true);
 671                 return;
 672         }
 673
 674         kdc->config->logf = kdc->smb_krb5_context->logf;
 675         kdc->config->db = talloc(kdc, struct HDB *);
 676         if (!kdc->config->db) {
 677                 task_server_terminate(task, "kdc: out of memory", true);
 678                 return;
 679         }
 680         kdc->config->num_db = 1;
 681
 682         status = hdb_samba4_create_kdc(kdc, task->event_ctx, task->lp_ctx,
 683                                        kdc->smb_krb5_context->krb5_context,
 684                                        &kdc->config->db[0]);
 685         if (!NT_STATUS_IS_OK(status)) {
 686                 task_server_terminate(task, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
 687                 return;
 688         }
 689
 690         /* Register hdb-samba4 hooks for use as a keytab */
 691
 692         kdc->hdb_samba4_context = talloc(kdc, struct hdb_samba4_context);
 693         if (!kdc->hdb_samba4_context) {
 694                 task_server_terminate(task, "kdc: out of memory", true);
 695                 return;
 696         }
 697
 698         kdc->hdb_samba4_context->ev_ctx = task->event_ctx;
 699         kdc->hdb_samba4_context->lp_ctx = task->lp_ctx;
 700
 701         ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
 702                                    PLUGIN_TYPE_DATA, "hdb",
 703                                    &hdb_samba4);
 704         if(ret) {
 705                 task_server_terminate(task, "kdc: failed to register hdb keytab", true);
 706                 return;
 707         }
 708
 709         ret = krb5_kt_register(kdc->smb_krb5_context->krb5_context, &hdb_kt_ops);
 710         if(ret) {
 711                 task_server_terminate(task, "kdc: failed to register hdb keytab", true);
 712                 return;
 713         }
 714
 715         /* Registar WinDC hooks */
 716         ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context,
 717                                    PLUGIN_TYPE_DATA, "windc",
 718                                    &windc_plugin_table);
 719         if(ret) {
 720                 task_server_terminate(task, "kdc: failed to register hdb keytab", true);
 721                 return;
 722         }
 723
 724         krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
 725
 726         /* start listening on the configured network interfaces */
 727         status = kdc_startup_interfaces(kdc, task->lp_ctx, ifaces);
 728         if (!NT_STATUS_IS_OK(status)) {
 729                 task_server_terminate(task, "kdc failed to setup interfaces", true);
 730                 return;
 731         }
 732
 733         status = IRPC_REGISTER(task->msg_ctx, irpc, KDC_CHECK_GENERIC_KERBEROS,
 734                                kdc_check_generic_kerberos, kdc);
 735         if (!NT_STATUS_IS_OK(status)) {
 736                 task_server_terminate(task, "nbtd failed to setup monitoring", true);
 737                 return;
 738         }
 739
 740         irpc_add_name(task->msg_ctx, "kdc_server");
 741 }
 742
 743
 744 /* called at smbd startup - register ourselves as a server service */
 745 NTSTATUS server_service_kdc_init(void)
 746 {
 747         return register_server_service("kdc", kdc_task_init);
 748 }