s4-kdc: Migrate to tsocket_address.
[ira/wip.git] / source4 / kdc / kdc.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    KDC Server startup
5
6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
7    Copyright (C) Andrew Tridgell        2005
8    Copyright (C) Stefan Metzmacher      2005
9
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License as published by
12    the Free Software Foundation; either version 3 of the License, or
13    (at your option) any later version.
14    
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19    
20    You should have received a copy of the GNU General Public License
21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "smbd/service_task.h"
26 #include "smbd/service.h"
27 #include "smbd/service_stream.h"
28 #include "smbd/process_model.h"
29 #include "lib/events/events.h"
30 #include "lib/socket/socket.h"
31 #include "lib/tsocket/tsocket.h"
32 #include "system/network.h"
33 #include "../lib/util/dlinklist.h"
34 #include "lib/messaging/irpc.h"
35 #include "lib/stream/packet.h"
36 #include "librpc/gen_ndr/samr.h"
37 #include "librpc/gen_ndr/ndr_irpc.h"
38 #include "librpc/gen_ndr/ndr_krb5pac.h"
39 #include "lib/socket/netif.h"
40 #include "param/param.h"
41 #include "kdc/kdc.h"
42 #include "librpc/gen_ndr/ndr_misc.h"
43
44
45 /* Disgusting hack to get a mem_ctx and lp_ctx into the hdb plugin, when 
46  * used as a keytab */
47 TALLOC_CTX *hdb_samba4_mem_ctx;
48 struct tevent_context *hdb_samba4_ev_ctx;
49 struct loadparm_context *hdb_samba4_lp_ctx;
50
51 /* hold all the info needed to send a reply */
52 struct kdc_reply {
53         struct kdc_reply *next, *prev;
54         struct socket_address *dest;
55         DATA_BLOB packet;
56 };
57
58 typedef bool (*kdc_process_fn_t)(struct kdc_server *kdc,
59                                  TALLOC_CTX *mem_ctx, 
60                                  DATA_BLOB *input, 
61                                  DATA_BLOB *reply,
62                                  struct tsocket_address *peer_addr,
63                                  struct tsocket_address *my_addr,
64                                  int datagram);
65
66 /* hold information about one kdc socket */
67 struct kdc_socket {
68         struct socket_context *sock;
69         struct kdc_server *kdc;
70         struct tevent_fd *fde;
71
72         /* a queue of outgoing replies that have been deferred */
73         struct kdc_reply *send_queue;
74
75         kdc_process_fn_t process;
76 };
77 /*
78   state of an open tcp connection
79 */
80 struct kdc_tcp_connection {
81         /* stream connection we belong to */
82         struct stream_connection *conn;
83
84         /* the kdc_server the connection belongs to */
85         struct kdc_server *kdc;
86
87         struct packet_context *packet;
88
89         kdc_process_fn_t process;
90 };
91
92 /*
93   handle fd send events on a KDC socket
94 */
95 static void kdc_send_handler(struct kdc_socket *kdc_socket)
96 {
97         while (kdc_socket->send_queue) {
98                 struct kdc_reply *rep = kdc_socket->send_queue;
99                 NTSTATUS status;
100                 size_t sendlen;
101
102                 status = socket_sendto(kdc_socket->sock, &rep->packet, &sendlen,
103                                        rep->dest);
104                 if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
105                         break;
106                 }
107                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_BUFFER_SIZE)) {
108                         /* Replace with a krb err, response to big */
109                 }
110                 
111                 DLIST_REMOVE(kdc_socket->send_queue, rep);
112                 talloc_free(rep);
113         }
114
115         if (kdc_socket->send_queue == NULL) {
116                 EVENT_FD_NOT_WRITEABLE(kdc_socket->fde);
117         }
118 }
119
120
121 /*
122   handle fd recv events on a KDC socket
123 */
124 static void kdc_recv_handler(struct kdc_socket *kdc_socket)
125 {
126         NTSTATUS status;
127         TALLOC_CTX *tmp_ctx = talloc_new(kdc_socket);
128         DATA_BLOB blob;
129         struct kdc_reply *rep;
130         DATA_BLOB reply;
131         size_t nread, dsize;
132         struct socket_address *src;
133         struct socket_address *my_addr;
134         struct tsocket_address *tsrcaddr;
135         struct tsocket_address *tmyaddr;
136         int ret;
137
138         status = socket_pending(kdc_socket->sock, &dsize);
139         if (!NT_STATUS_IS_OK(status)) {
140                 talloc_free(tmp_ctx);
141                 return;
142         }
143
144         blob = data_blob_talloc(tmp_ctx, NULL, dsize);
145         if (blob.data == NULL) {
146                 /* hope this is a temporary low memory condition */
147                 talloc_free(tmp_ctx);
148                 return;
149         }
150
151         status = socket_recvfrom(kdc_socket->sock, blob.data, blob.length, &nread,
152                                  tmp_ctx, &src);
153         if (!NT_STATUS_IS_OK(status)) {
154                 talloc_free(tmp_ctx);
155                 return;
156         }
157         blob.length = nread;
158         
159         DEBUG(10,("Received krb5 UDP packet of length %lu from %s:%u\n", 
160                  (long)blob.length, src->addr, (uint16_t)src->port));
161         
162         my_addr = socket_get_my_addr(kdc_socket->sock, tmp_ctx);
163         if (!my_addr) {
164                 talloc_free(tmp_ctx);
165                 return;
166         }
167
168         ret = tsocket_address_bsd_from_sockaddr(tmp_ctx, src->sockaddr,
169                                 src->sockaddrlen, &tsrcaddr);
170         if (ret < 0) {
171                 talloc_free(tmp_ctx);
172                 return;
173         }
174
175         ret = tsocket_address_bsd_from_sockaddr(tmp_ctx, my_addr->sockaddr,
176                                 my_addr->sockaddrlen, &tmyaddr);
177         if (ret < 0) {
178                 talloc_free(tmp_ctx);
179                 return;
180         }
181
182         /* Call krb5 */
183         ret = kdc_socket->process(kdc_socket->kdc, 
184                                   tmp_ctx, 
185                                   &blob,  
186                                   &reply,
187                                   tsrcaddr,
188                                   tmyaddr,
189                                   1 /* Datagram */);
190         if (!ret) {
191                 talloc_free(tmp_ctx);
192                 return;
193         }
194
195         /* queue a pending reply */
196         rep = talloc(kdc_socket, struct kdc_reply);
197         if (rep == NULL) {
198                 talloc_free(tmp_ctx);
199                 return;
200         }
201         rep->dest         = talloc_steal(rep, src);
202         rep->packet       = reply;
203         talloc_steal(rep, reply.data);
204
205         if (rep->packet.data == NULL) {
206                 talloc_free(rep);
207                 talloc_free(tmp_ctx);
208                 return;
209         }
210
211         DLIST_ADD_END(kdc_socket->send_queue, rep, struct kdc_reply *);
212         EVENT_FD_WRITEABLE(kdc_socket->fde);
213         talloc_free(tmp_ctx);
214 }
215
216 /*
217   handle fd events on a KDC socket
218 */
219 static void kdc_socket_handler(struct tevent_context *ev, struct tevent_fd *fde,
220                                uint16_t flags, void *private_data)
221 {
222         struct kdc_socket *kdc_socket = talloc_get_type(private_data, struct kdc_socket);
223         if (flags & EVENT_FD_WRITE) {
224                 kdc_send_handler(kdc_socket);
225         } 
226         if (flags & EVENT_FD_READ) {
227                 kdc_recv_handler(kdc_socket);
228         }
229 }
230
231 static void kdc_tcp_terminate_connection(struct kdc_tcp_connection *kdcconn, const char *reason)
232 {
233         stream_terminate_connection(kdcconn->conn, reason);
234 }
235
236 /*
237   receive a full packet on a KDC connection
238 */
239 static NTSTATUS kdc_tcp_recv(void *private_data, DATA_BLOB blob)
240 {
241         struct kdc_tcp_connection *kdcconn = talloc_get_type(private_data,
242                                                              struct kdc_tcp_connection);
243         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
244         TALLOC_CTX *tmp_ctx = talloc_new(kdcconn);
245         int ret;
246         DATA_BLOB input, reply;
247         struct socket_address *src_addr;
248         struct socket_address *my_addr;
249         struct tsocket_address *tsrcaddr;
250         struct tsocket_address *tmyaddr;
251
252         talloc_steal(tmp_ctx, blob.data);
253
254         src_addr = socket_get_peer_addr(kdcconn->conn->socket, tmp_ctx);
255         if (!src_addr) {
256                 talloc_free(tmp_ctx);
257                 return NT_STATUS_NO_MEMORY;
258         }
259
260         my_addr = socket_get_my_addr(kdcconn->conn->socket, tmp_ctx);
261         if (!my_addr) {
262                 talloc_free(tmp_ctx);
263                 return NT_STATUS_NO_MEMORY;
264         }
265
266         ret = tsocket_address_bsd_from_sockaddr(tmp_ctx, src_addr->sockaddr,
267                                 src_addr->sockaddrlen, &tsrcaddr);
268         if (ret < 0) {
269                 talloc_free(tmp_ctx);
270                 return NT_STATUS_NO_MEMORY;
271         }
272
273         ret = tsocket_address_bsd_from_sockaddr(tmp_ctx, my_addr->sockaddr,
274                                 my_addr->sockaddrlen, &tmyaddr);
275         if (ret < 0) {
276                 talloc_free(tmp_ctx);
277                 return NT_STATUS_NO_MEMORY;
278         }
279
280         /* Call krb5 */
281         input = data_blob_const(blob.data + 4, blob.length - 4); 
282
283         ret = kdcconn->process(kdcconn->kdc, 
284                                tmp_ctx,
285                                &input,
286                                &reply,
287                                tsrcaddr,
288                                tmyaddr,
289                                0 /* Not datagram */);
290         if (!ret) {
291                 talloc_free(tmp_ctx);
292                 return NT_STATUS_INTERNAL_ERROR;
293         }
294
295         /* and now encode the reply */
296         blob = data_blob_talloc(kdcconn, NULL, reply.length + 4);
297         if (!blob.data) {
298                 talloc_free(tmp_ctx);
299                 return NT_STATUS_NO_MEMORY;
300         }
301
302         RSIVAL(blob.data, 0, reply.length);
303         memcpy(blob.data + 4, reply.data, reply.length);        
304
305         status = packet_send(kdcconn->packet, blob);
306         if (!NT_STATUS_IS_OK(status)) {
307                 talloc_free(tmp_ctx);
308                 return status;
309         }
310
311         /* the call isn't needed any more */
312         talloc_free(tmp_ctx);
313         return NT_STATUS_OK;
314 }
315
316 /*
317   receive some data on a KDC connection
318 */
319 static void kdc_tcp_recv_handler(struct stream_connection *conn, uint16_t flags)
320 {
321         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
322                                                              struct kdc_tcp_connection);
323         packet_recv(kdcconn->packet);
324 }
325
326 /*
327   called on a tcp recv error
328 */
329 static void kdc_tcp_recv_error(void *private_data, NTSTATUS status)
330 {
331         struct kdc_tcp_connection *kdcconn = talloc_get_type(private_data,
332                                              struct kdc_tcp_connection);
333         kdc_tcp_terminate_connection(kdcconn, nt_errstr(status));
334 }
335
336 /*
337   called when we can write to a connection
338 */
339 static void kdc_tcp_send(struct stream_connection *conn, uint16_t flags)
340 {
341         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
342                                                              struct kdc_tcp_connection);
343         packet_queue_run(kdcconn->packet);
344 }
345
346 /**
347    Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
348    calling conventions
349 */
350
351 static bool kdc_process(struct kdc_server *kdc,
352                         TALLOC_CTX *mem_ctx, 
353                         DATA_BLOB *input, 
354                         DATA_BLOB *reply,
355                         struct tsocket_address *peer_addr,
356                         struct tsocket_address *my_addr,
357                         int datagram_reply)
358 {
359         int ret;
360         char *pa;
361         struct sockaddr_storage ss;
362         krb5_data k5_reply;
363         krb5_data_zero(&k5_reply);
364
365         krb5_kdc_update_time(NULL);
366
367         ret = tsocket_address_bsd_sockaddr(peer_addr, (struct sockaddr *) &ss,
368                                 sizeof(struct sockaddr_storage));
369         if (ret < 0) {
370                 return false;
371         }
372         pa = tsocket_address_string(peer_addr, mem_ctx);
373         if (pa == NULL) {
374                 return false;
375         }
376
377         DEBUG(10,("Received KDC packet of length %lu from %s\n",
378                                 (long)input->length - 4, pa));
379
380         ret = krb5_kdc_process_krb5_request(kdc->smb_krb5_context->krb5_context, 
381                                             kdc->config,
382                                             input->data, input->length,
383                                             &k5_reply,
384                                             pa,
385                                             (struct sockaddr *) &ss,
386                                             datagram_reply);
387         if (ret == -1) {
388                 *reply = data_blob(NULL, 0);
389                 return false;
390         }
391         if (k5_reply.length) {
392                 *reply = data_blob_talloc(mem_ctx, k5_reply.data, k5_reply.length);
393                 krb5_data_free(&k5_reply);
394         } else {
395                 *reply = data_blob(NULL, 0);    
396         }
397         return true;
398 }
399
400 /*
401   called when we get a new connection
402 */
403 static void kdc_tcp_accept(struct stream_connection *conn)
404 {
405         struct kdc_socket *kdc_socket = talloc_get_type(conn->private_data, struct kdc_socket);
406         struct kdc_tcp_connection *kdcconn;
407
408         kdcconn = talloc_zero(conn, struct kdc_tcp_connection);
409         if (!kdcconn) {
410                 stream_terminate_connection(conn, "kdc_tcp_accept: out of memory");
411                 return;
412         }
413         kdcconn->conn    = conn;
414         kdcconn->kdc     = kdc_socket->kdc;
415         kdcconn->process = kdc_socket->process;
416         conn->private_data    = kdcconn;
417
418         kdcconn->packet = packet_init(kdcconn);
419         if (kdcconn->packet == NULL) {
420                 kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_accept: out of memory");
421                 return;
422         }
423         packet_set_private(kdcconn->packet, kdcconn);
424         packet_set_socket(kdcconn->packet, conn->socket);
425         packet_set_callback(kdcconn->packet, kdc_tcp_recv);
426         packet_set_full_request(kdcconn->packet, packet_full_request_u32);
427         packet_set_error_handler(kdcconn->packet, kdc_tcp_recv_error);
428         packet_set_event_context(kdcconn->packet, conn->event.ctx);
429         packet_set_fde(kdcconn->packet, conn->event.fde);
430         packet_set_serialise(kdcconn->packet);
431 }
432
433 static const struct stream_server_ops kdc_tcp_stream_ops = {
434         .name                   = "kdc_tcp",
435         .accept_connection      = kdc_tcp_accept,
436         .recv_handler           = kdc_tcp_recv_handler,
437         .send_handler           = kdc_tcp_send
438 };
439
440 /*
441   start listening on the given address
442 */
443 static NTSTATUS kdc_add_socket(struct kdc_server *kdc,
444                                const struct model_ops *model_ops,
445                                const char *name,
446                                const char *address,
447                                uint16_t port,
448                                kdc_process_fn_t process)
449 {
450         struct kdc_socket *kdc_socket;
451         struct socket_address *socket_address;
452         NTSTATUS status;
453
454         kdc_socket = talloc(kdc, struct kdc_socket);
455         NT_STATUS_HAVE_NO_MEMORY(kdc_socket);
456
457         status = socket_create("ip", SOCKET_TYPE_DGRAM, &kdc_socket->sock, 0);
458         if (!NT_STATUS_IS_OK(status)) {
459                 talloc_free(kdc_socket);
460                 return status;
461         }
462
463         kdc_socket->kdc = kdc;
464         kdc_socket->send_queue = NULL;
465         kdc_socket->process = process;
466
467         talloc_steal(kdc_socket, kdc_socket->sock);
468
469         kdc_socket->fde = event_add_fd(kdc->task->event_ctx, kdc, 
470                                            socket_get_fd(kdc_socket->sock), EVENT_FD_READ,
471                                            kdc_socket_handler, kdc_socket);
472         
473         socket_address = socket_address_from_strings(kdc_socket, kdc_socket->sock->backend_name, 
474                                                       address, port);
475         NT_STATUS_HAVE_NO_MEMORY_AND_FREE(socket_address, kdc_socket);
476
477         status = socket_listen(kdc_socket->sock, socket_address, 0, 0);
478         if (!NT_STATUS_IS_OK(status)) {
479                 DEBUG(0,("Failed to bind to %s:%d UDP for %s - %s\n", 
480                          address, port, name, nt_errstr(status)));
481                 talloc_free(kdc_socket);
482                 return status;
483         }
484
485         status = stream_setup_socket(kdc->task->event_ctx, 
486                                      kdc->task->lp_ctx,
487                                      model_ops, 
488                                      &kdc_tcp_stream_ops, 
489                                      "ip", address, &port, 
490                                      lp_socket_options(kdc->task->lp_ctx), 
491                                      kdc_socket);
492         if (!NT_STATUS_IS_OK(status)) {
493                 DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
494                          address, port, nt_errstr(status)));
495                 talloc_free(kdc_socket);
496                 return status;
497         }
498
499         return NT_STATUS_OK;
500 }
501
502
503 /*
504   setup our listening sockets on the configured network interfaces
505 */
506 static NTSTATUS kdc_startup_interfaces(struct kdc_server *kdc, struct loadparm_context *lp_ctx,
507                                        struct interface *ifaces)
508 {
509         const struct model_ops *model_ops;
510         int num_interfaces;
511         TALLOC_CTX *tmp_ctx = talloc_new(kdc);
512         NTSTATUS status;
513         int i;
514
515         /* within the kdc task we want to be a single process, so
516            ask for the single process model ops and pass these to the
517            stream_setup_socket() call. */
518         model_ops = process_model_startup(kdc->task->event_ctx, "single");
519         if (!model_ops) {
520                 DEBUG(0,("Can't find 'single' process model_ops\n"));
521                 return NT_STATUS_INTERNAL_ERROR;
522         }
523
524         num_interfaces = iface_count(ifaces);
525         
526         for (i=0; i<num_interfaces; i++) {
527                 const char *address = talloc_strdup(tmp_ctx, iface_n_ip(ifaces, i));
528                 uint16_t kdc_port = lp_krb5_port(lp_ctx);
529                 uint16_t kpasswd_port = lp_kpasswd_port(lp_ctx);
530
531                 if (kdc_port) {
532                         status = kdc_add_socket(kdc, model_ops,
533                                         "kdc", address, kdc_port,
534                                         kdc_process);
535                         NT_STATUS_NOT_OK_RETURN(status);
536                 }
537
538                 if (kpasswd_port) {
539                         status = kdc_add_socket(kdc, model_ops,
540                                         "kpasswd", address, kpasswd_port,
541                                         kpasswdd_process);
542                         NT_STATUS_NOT_OK_RETURN(status);
543                 }
544         }
545
546         talloc_free(tmp_ctx);
547
548         return NT_STATUS_OK;
549 }
550
551
552 static NTSTATUS kdc_check_generic_kerberos(struct irpc_message *msg, 
553                                  struct kdc_check_generic_kerberos *r)
554 {
555         struct PAC_Validate pac_validate;
556         DATA_BLOB srv_sig;
557         struct PAC_SIGNATURE_DATA kdc_sig;
558         struct kdc_server *kdc = talloc_get_type(msg->private_data, struct kdc_server);
559         enum ndr_err_code ndr_err;
560         krb5_enctype etype;
561         int ret;
562         hdb_entry_ex ent;
563         krb5_principal principal;
564         krb5_keyblock keyblock;
565         Key *key;
566
567         /* There is no reply to this request */
568         r->out.generic_reply = data_blob(NULL, 0);
569
570         ndr_err = ndr_pull_struct_blob(&r->in.generic_request, msg, 
571                                        lp_iconv_convenience(kdc->task->lp_ctx), 
572                                        &pac_validate,
573                                        (ndr_pull_flags_fn_t)ndr_pull_PAC_Validate);
574         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
575                 return NT_STATUS_INVALID_PARAMETER;
576         }
577         
578         if (pac_validate.MessageType != 3) {
579                 /* We don't implement any other message types - such as certificate validation - yet */
580                 return NT_STATUS_INVALID_PARAMETER;
581         }
582
583         if (pac_validate.ChecksumAndSignature.length != (pac_validate.ChecksumLength + pac_validate.SignatureLength)
584             || pac_validate.ChecksumAndSignature.length < pac_validate.ChecksumLength
585             || pac_validate.ChecksumAndSignature.length < pac_validate.SignatureLength ) {
586                 return NT_STATUS_INVALID_PARAMETER;
587         }
588         
589         srv_sig = data_blob_const(pac_validate.ChecksumAndSignature.data, 
590                                   pac_validate.ChecksumLength);
591         
592         if (pac_validate.SignatureType == CKSUMTYPE_HMAC_MD5) {
593                 etype = ETYPE_ARCFOUR_HMAC_MD5;
594         } else {
595                 ret = krb5_cksumtype_to_enctype(kdc->smb_krb5_context->krb5_context, pac_validate.SignatureType,
596                                                 &etype);
597                 if (ret != 0) {
598                         return NT_STATUS_LOGON_FAILURE;
599                 }
600         }
601
602         ret = krb5_make_principal(kdc->smb_krb5_context->krb5_context, &principal, 
603                                   lp_realm(kdc->task->lp_ctx),
604                                   "krbtgt", lp_realm(kdc->task->lp_ctx), 
605                                   NULL);
606
607         if (ret != 0) {
608                 return NT_STATUS_NO_MEMORY;
609         }
610
611         ret = kdc->config->db[0]->hdb_fetch(kdc->smb_krb5_context->krb5_context, 
612                                             kdc->config->db[0],
613                                             principal,
614                                             HDB_F_GET_KRBTGT | HDB_F_DECRYPT,
615                                             &ent);
616
617         if (ret != 0) {
618                 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
619                 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
620         
621                 return NT_STATUS_LOGON_FAILURE;
622         }
623         
624         ret = hdb_enctype2key(kdc->smb_krb5_context->krb5_context, &ent.entry, etype, &key);
625
626         if (ret != 0) {
627                 hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
628                 krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
629                 return NT_STATUS_LOGON_FAILURE;
630         }
631
632         keyblock = key->key;
633         
634         kdc_sig.type = pac_validate.SignatureType;
635         kdc_sig.signature = data_blob_const(&pac_validate.ChecksumAndSignature.data[pac_validate.ChecksumLength],
636                                             pac_validate.SignatureLength);
637         ret = check_pac_checksum(msg, srv_sig, &kdc_sig, 
638                            kdc->smb_krb5_context->krb5_context, &keyblock);
639
640         hdb_free_entry(kdc->smb_krb5_context->krb5_context, &ent);
641         krb5_free_principal(kdc->smb_krb5_context->krb5_context, principal);
642
643         if (ret != 0) {
644                 return NT_STATUS_LOGON_FAILURE;
645         }
646         
647         return NT_STATUS_OK;
648 }
649
650
651 /*
652   startup the kdc task
653 */
654 static void kdc_task_init(struct task_server *task)
655 {
656         struct kdc_server *kdc;
657         NTSTATUS status;
658         krb5_error_code ret;
659         struct interface *ifaces;
660
661         switch (lp_server_role(task->lp_ctx)) {
662         case ROLE_STANDALONE:
663                 task_server_terminate(task, "kdc: no KDC required in standalone configuration", false);
664                 return;
665         case ROLE_DOMAIN_MEMBER:
666                 task_server_terminate(task, "kdc: no KDC required in member server configuration", false);
667                 return;
668         case ROLE_DOMAIN_CONTROLLER:
669                 /* Yes, we want a KDC */
670                 break;
671         }
672
673         load_interfaces(task, lp_interfaces(task->lp_ctx), &ifaces);
674
675         if (iface_count(ifaces) == 0) {
676                 task_server_terminate(task, "kdc: no network interfaces configured", false);
677                 return;
678         }
679
680         task_server_set_title(task, "task[kdc]");
681
682         kdc = talloc(task, struct kdc_server);
683         if (kdc == NULL) {
684                 task_server_terminate(task, "kdc: out of memory", true);
685                 return;
686         }
687
688         kdc->task = task;
689
690         initialize_krb5_error_table();
691
692         ret = smb_krb5_init_context(kdc, task->event_ctx, task->lp_ctx, &kdc->smb_krb5_context);
693         if (ret) {
694                 DEBUG(1,("kdc_task_init: krb5_init_context failed (%s)\n", 
695                          error_message(ret)));
696                 task_server_terminate(task, "kdc: krb5_init_context failed", true);
697                 return; 
698         }
699
700         krb5_add_et_list(kdc->smb_krb5_context->krb5_context, initialize_hdb_error_table_r);
701
702         ret = krb5_kdc_get_config(kdc->smb_krb5_context->krb5_context, 
703                                   &kdc->config);
704         if(ret) {
705                 task_server_terminate(task, "kdc: failed to get KDC configuration", true);
706                 return;
707         }
708  
709         kdc->config->logf = kdc->smb_krb5_context->logf;
710         kdc->config->db = talloc(kdc, struct HDB *);
711         if (!kdc->config->db) {
712                 task_server_terminate(task, "kdc: out of memory", true);
713                 return;
714         }
715         kdc->config->num_db = 1;
716                 
717         status = hdb_samba4_create_kdc(kdc, task->event_ctx, task->lp_ctx, 
718                                        kdc->smb_krb5_context->krb5_context, 
719                                        &kdc->config->db[0]);
720         if (!NT_STATUS_IS_OK(status)) {
721                 task_server_terminate(task, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
722                 return; 
723         }
724
725         /* Register hdb-samba4 hooks for use as a keytab */
726
727         kdc->hdb_samba4_context = talloc(kdc, struct hdb_samba4_context);
728         if (!kdc->hdb_samba4_context) {
729                 task_server_terminate(task, "kdc: out of memory", true);
730                 return; 
731         }
732
733         kdc->hdb_samba4_context->ev_ctx = task->event_ctx;
734         kdc->hdb_samba4_context->lp_ctx = task->lp_ctx;
735
736         ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context, 
737                                    PLUGIN_TYPE_DATA, "hdb",
738                                    &hdb_samba4);
739         if(ret) {
740                 task_server_terminate(task, "kdc: failed to register hdb keytab", true);
741                 return;
742         }
743
744         ret = krb5_kt_register(kdc->smb_krb5_context->krb5_context, &hdb_kt_ops);
745         if(ret) {
746                 task_server_terminate(task, "kdc: failed to register hdb keytab", true);
747                 return;
748         }
749
750         /* Registar WinDC hooks */
751         ret = krb5_plugin_register(kdc->smb_krb5_context->krb5_context, 
752                                    PLUGIN_TYPE_DATA, "windc",
753                                    &windc_plugin_table);
754         if(ret) {
755                 task_server_terminate(task, "kdc: failed to register hdb keytab", true);
756                 return;
757         }
758
759         krb5_kdc_windc_init(kdc->smb_krb5_context->krb5_context);
760
761         /* start listening on the configured network interfaces */
762         status = kdc_startup_interfaces(kdc, task->lp_ctx, ifaces);
763         if (!NT_STATUS_IS_OK(status)) {
764                 task_server_terminate(task, "kdc failed to setup interfaces", true);
765                 return;
766         }
767
768         status = IRPC_REGISTER(task->msg_ctx, irpc, KDC_CHECK_GENERIC_KERBEROS, 
769                                kdc_check_generic_kerberos, kdc);
770         if (!NT_STATUS_IS_OK(status)) {
771                 task_server_terminate(task, "nbtd failed to setup monitoring", true);
772                 return;
773         }
774
775         irpc_add_name(task->msg_ctx, "kdc_server");
776 }
777
778
779 /* called at smbd startup - register ourselves as a server service */
780 NTSTATUS server_service_kdc_init(void)
781 {
782         return register_server_service("kdc", kdc_task_init);
783 }