source4/auth/kerberos/kerberos_pac.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Create and parse the krb5 PAC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005,2008
   7    Copyright (C) Andrew Tridgell 2001
   8    Copyright (C) Luke Howard 2002-2003
   9    Copyright (C) Stefan Metzmacher 2004-2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "system/kerberos.h"
  28 #include "auth/auth.h"
  29 #include "auth/kerberos/kerberos.h"
  30 #include "librpc/gen_ndr/ndr_krb5pac.h"
  31 #include <ldb.h>
  32 #include "auth/auth_sam_reply.h"
  33 #include "auth/kerberos/kerberos_util.h"
  34 #include "auth/kerberos/pac_utils.h"
  35
  36  krb5_error_code kerberos_encode_pac(TALLOC_CTX *mem_ctx,
  37                                     struct PAC_DATA *pac_data,
  38                                     krb5_context context,
  39                                     const krb5_keyblock *krbtgt_keyblock,
  40                                     const krb5_keyblock *service_keyblock,
  41                                     DATA_BLOB *pac)
  42 {
  43         NTSTATUS nt_status;
  44         krb5_error_code ret;
  45         enum ndr_err_code ndr_err;
  46         DATA_BLOB zero_blob = data_blob(NULL, 0);
  47         DATA_BLOB tmp_blob = data_blob(NULL, 0);
  48         struct PAC_SIGNATURE_DATA *kdc_checksum = NULL;
  49         struct PAC_SIGNATURE_DATA *srv_checksum = NULL;
  50         int i;
  51
  52         /* First, just get the keytypes filled in (and lengths right, eventually) */
  53         for (i=0; i < pac_data->num_buffers; i++) {
  54                 if (pac_data->buffers[i].type != PAC_TYPE_KDC_CHECKSUM) {
  55                         continue;
  56                 }
  57                 kdc_checksum = &pac_data->buffers[i].info->kdc_cksum,
  58                 ret = smb_krb5_make_pac_checksum(mem_ctx,
  59                                                  &zero_blob,
  60                                                  context,
  61                                                  krbtgt_keyblock,
  62                                                  &kdc_checksum->type,
  63                                                  &kdc_checksum->signature);
  64                 if (ret) {
  65                         DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
  66                                   smb_get_krb5_error_message(context, ret, mem_ctx)));
  67                         talloc_free(pac_data);
  68                         return ret;
  69                 }
  70         }
  71
  72         for (i=0; i < pac_data->num_buffers; i++) {
  73                 if (pac_data->buffers[i].type != PAC_TYPE_SRV_CHECKSUM) {
  74                         continue;
  75                 }
  76                 srv_checksum = &pac_data->buffers[i].info->srv_cksum;
  77                 ret = smb_krb5_make_pac_checksum(mem_ctx,
  78                                                  &zero_blob,
  79                                                  context,
  80                                                  service_keyblock,
  81                                                  &srv_checksum->type,
  82                                                  &srv_checksum->signature);
  83                 if (ret) {
  84                         DEBUG(2, ("making service PAC checksum failed: %s\n",
  85                                   smb_get_krb5_error_message(context, ret, mem_ctx)));
  86                         talloc_free(pac_data);
  87                         return ret;
  88                 }
  89         }
  90
  91         if (!kdc_checksum) {
  92                 DEBUG(2, ("Invalid PAC constructed for signing, no KDC checksum present!"));
  93                 return EINVAL;
  94         }
  95         if (!srv_checksum) {
  96                 DEBUG(2, ("Invalid PAC constructed for signing, no SRV checksum present!"));
  97                 return EINVAL;
  98         }
  99
 100         /* But wipe out the actual signatures */
 101         memset(kdc_checksum->signature.data, '\0', kdc_checksum->signature.length);
 102         memset(srv_checksum->signature.data, '\0', srv_checksum->signature.length);
 103
 104         ndr_err = ndr_push_struct_blob(&tmp_blob, mem_ctx,
 105                                        pac_data,
 106                                        (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
 107         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 108                 nt_status = ndr_map_error2ntstatus(ndr_err);
 109                 DEBUG(1, ("PAC (presig) push failed: %s\n", nt_errstr(nt_status)));
 110                 talloc_free(pac_data);
 111                 return EINVAL;
 112         }
 113
 114         /* Then sign the result of the previous push, where the sig was zero'ed out */
 115         ret = smb_krb5_make_pac_checksum(mem_ctx,
 116                                          &tmp_blob,
 117                                          context,
 118                                          service_keyblock,
 119                                          &srv_checksum->type,
 120                                          &srv_checksum->signature);
 121
 122         /* Then sign Server checksum */
 123         ret = smb_krb5_make_pac_checksum(mem_ctx,
 124                                          &srv_checksum->signature,
 125                                          context,
 126                                          krbtgt_keyblock,
 127                                          &kdc_checksum->type,
 128                                          &kdc_checksum->signature);
 129         if (ret) {
 130                 DEBUG(2, ("making krbtgt PAC checksum failed: %s\n",
 131                           smb_get_krb5_error_message(context, ret, mem_ctx)));
 132                 talloc_free(pac_data);
 133                 return ret;
 134         }
 135
 136         /* And push it out again, this time to the world.  This relies on determanistic pointer values */
 137         ndr_err = ndr_push_struct_blob(&tmp_blob, mem_ctx,
 138                                        pac_data,
 139                                        (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
 140         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 141                 nt_status = ndr_map_error2ntstatus(ndr_err);
 142                 DEBUG(1, ("PAC (final) push failed: %s\n", nt_errstr(nt_status)));
 143                 talloc_free(pac_data);
 144                 return EINVAL;
 145         }
 146
 147         *pac = tmp_blob;
 148
 149         return ret;
 150 }
 151
 152
 153  krb5_error_code kerberos_create_pac(TALLOC_CTX *mem_ctx,
 154                                      struct auth_user_info_dc *user_info_dc,
 155                                      krb5_context context,
 156                                      const krb5_keyblock *krbtgt_keyblock,
 157                                      const krb5_keyblock *service_keyblock,
 158                                      krb5_principal client_principal,
 159                                      time_t tgs_authtime,
 160                                      DATA_BLOB *pac)
 161 {
 162         NTSTATUS nt_status;
 163         krb5_error_code ret;
 164         struct PAC_DATA *pac_data = talloc(mem_ctx, struct PAC_DATA);
 165         struct netr_SamInfo3 *sam3;
 166         union PAC_INFO *u_LOGON_INFO;
 167         struct PAC_LOGON_INFO *LOGON_INFO;
 168         union PAC_INFO *u_LOGON_NAME;
 169         struct PAC_LOGON_NAME *LOGON_NAME;
 170         union PAC_INFO *u_KDC_CHECKSUM;
 171         union PAC_INFO *u_SRV_CHECKSUM;
 172
 173         char *name;
 174
 175         enum {
 176                 PAC_BUF_LOGON_INFO = 0,
 177                 PAC_BUF_LOGON_NAME = 1,
 178                 PAC_BUF_SRV_CHECKSUM = 2,
 179                 PAC_BUF_KDC_CHECKSUM = 3,
 180                 PAC_BUF_NUM_BUFFERS = 4
 181         };
 182
 183         if (!pac_data) {
 184                 return ENOMEM;
 185         }
 186
 187         pac_data->num_buffers = PAC_BUF_NUM_BUFFERS;
 188         pac_data->version = 0;
 189
 190         pac_data->buffers = talloc_array(pac_data,
 191                                          struct PAC_BUFFER,
 192                                          pac_data->num_buffers);
 193         if (!pac_data->buffers) {
 194                 talloc_free(pac_data);
 195                 return ENOMEM;
 196         }
 197
 198         /* LOGON_INFO */
 199         u_LOGON_INFO = talloc_zero(pac_data->buffers, union PAC_INFO);
 200         if (!u_LOGON_INFO) {
 201                 talloc_free(pac_data);
 202                 return ENOMEM;
 203         }
 204         pac_data->buffers[PAC_BUF_LOGON_INFO].type = PAC_TYPE_LOGON_INFO;
 205         pac_data->buffers[PAC_BUF_LOGON_INFO].info = u_LOGON_INFO;
 206
 207         /* LOGON_NAME */
 208         u_LOGON_NAME = talloc_zero(pac_data->buffers, union PAC_INFO);
 209         if (!u_LOGON_NAME) {
 210                 talloc_free(pac_data);
 211                 return ENOMEM;
 212         }
 213         pac_data->buffers[PAC_BUF_LOGON_NAME].type = PAC_TYPE_LOGON_NAME;
 214         pac_data->buffers[PAC_BUF_LOGON_NAME].info = u_LOGON_NAME;
 215         LOGON_NAME = &u_LOGON_NAME->logon_name;
 216
 217         /* SRV_CHECKSUM */
 218         u_SRV_CHECKSUM = talloc_zero(pac_data->buffers, union PAC_INFO);
 219         if (!u_SRV_CHECKSUM) {
 220                 talloc_free(pac_data);
 221                 return ENOMEM;
 222         }
 223         pac_data->buffers[PAC_BUF_SRV_CHECKSUM].type = PAC_TYPE_SRV_CHECKSUM;
 224         pac_data->buffers[PAC_BUF_SRV_CHECKSUM].info = u_SRV_CHECKSUM;
 225
 226         /* KDC_CHECKSUM */
 227         u_KDC_CHECKSUM = talloc_zero(pac_data->buffers, union PAC_INFO);
 228         if (!u_KDC_CHECKSUM) {
 229                 talloc_free(pac_data);
 230                 return ENOMEM;
 231         }
 232         pac_data->buffers[PAC_BUF_KDC_CHECKSUM].type = PAC_TYPE_KDC_CHECKSUM;
 233         pac_data->buffers[PAC_BUF_KDC_CHECKSUM].info = u_KDC_CHECKSUM;
 234
 235         /* now the real work begins... */
 236
 237         LOGON_INFO = talloc_zero(u_LOGON_INFO, struct PAC_LOGON_INFO);
 238         if (!LOGON_INFO) {
 239                 talloc_free(pac_data);
 240                 return ENOMEM;
 241         }
 242         nt_status = auth_convert_user_info_dc_saminfo3(LOGON_INFO, user_info_dc, &sam3);
 243         if (!NT_STATUS_IS_OK(nt_status)) {
 244                 DEBUG(1, ("Getting Samba info failed: %s\n", nt_errstr(nt_status)));
 245                 talloc_free(pac_data);
 246                 return EINVAL;
 247         }
 248
 249         u_LOGON_INFO->logon_info.info           = LOGON_INFO;
 250         LOGON_INFO->info3 = *sam3;
 251
 252         ret = krb5_unparse_name_flags(context, client_principal,
 253                                       KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
 254         if (ret) {
 255                 return ret;
 256         }
 257         LOGON_NAME->account_name        = talloc_strdup(LOGON_NAME, name);
 258         free(name);
 259         /*
 260           this logon_time field is absolutely critical. This is what
 261           caused all our PAC troubles :-)
 262         */
 263         unix_to_nt_time(&LOGON_NAME->logon_time, tgs_authtime);
 264
 265         ret = kerberos_encode_pac(mem_ctx,
 266                                   pac_data,
 267                                   context,
 268                                   krbtgt_keyblock,
 269                                   service_keyblock,
 270                                   pac);
 271         talloc_free(pac_data);
 272         return ret;
 273 }
 274
 275 krb5_error_code kerberos_pac_to_user_info_dc(TALLOC_CTX *mem_ctx,
 276                                              krb5_pac pac,
 277                                              krb5_context context,
 278                                              struct auth_user_info_dc **user_info_dc,
 279                                              struct PAC_SIGNATURE_DATA *pac_srv_sig,
 280                                              struct PAC_SIGNATURE_DATA *pac_kdc_sig)
 281 {
 282         NTSTATUS nt_status;
 283         enum ndr_err_code ndr_err;
 284         krb5_error_code ret;
 285
 286         DATA_BLOB pac_logon_info_in, pac_srv_checksum_in, pac_kdc_checksum_in;
 287         krb5_data k5pac_logon_info_in, k5pac_srv_checksum_in, k5pac_kdc_checksum_in;
 288
 289         union PAC_INFO info;
 290         struct auth_user_info_dc *user_info_dc_out;
 291
 292         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 293
 294         if (!tmp_ctx) {
 295                 return ENOMEM;
 296         }
 297
 298         ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_LOGON_INFO, &k5pac_logon_info_in);
 299         if (ret != 0) {
 300                 talloc_free(tmp_ctx);
 301                 return EINVAL;
 302         }
 303
 304         pac_logon_info_in = data_blob_const(k5pac_logon_info_in.data, k5pac_logon_info_in.length);
 305
 306         ndr_err = ndr_pull_union_blob(&pac_logon_info_in, tmp_ctx, &info,
 307                                       PAC_TYPE_LOGON_INFO,
 308                                       (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
 309         kerberos_free_data_contents(context, &k5pac_logon_info_in);
 310         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err) || !info.logon_info.info) {
 311                 nt_status = ndr_map_error2ntstatus(ndr_err);
 312                 DEBUG(0,("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status)));
 313                 talloc_free(tmp_ctx);
 314                 return EINVAL;
 315         }
 316
 317         /* Pull this right into the normal auth sysstem structures */
 318         nt_status = make_user_info_dc_pac(mem_ctx,
 319                                          info.logon_info.info,
 320                                          &user_info_dc_out);
 321         if (!NT_STATUS_IS_OK(nt_status)) {
 322                 talloc_free(tmp_ctx);
 323                 return EINVAL;
 324         }
 325
 326         if (pac_srv_sig) {
 327                 ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_SRV_CHECKSUM, &k5pac_srv_checksum_in);
 328                 if (ret != 0) {
 329                         talloc_free(tmp_ctx);
 330                         return ret;
 331                 }
 332
 333                 pac_srv_checksum_in = data_blob_const(k5pac_srv_checksum_in.data, k5pac_srv_checksum_in.length);
 334
 335                 ndr_err = ndr_pull_struct_blob(&pac_srv_checksum_in, pac_srv_sig,
 336                                                pac_srv_sig,
 337                                                (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
 338                 kerberos_free_data_contents(context, &k5pac_srv_checksum_in);
 339                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 340                         nt_status = ndr_map_error2ntstatus(ndr_err);
 341                         DEBUG(0,("can't parse the KDC signature: %s\n",
 342                                  nt_errstr(nt_status)));
 343                         return EINVAL;
 344                 }
 345         }
 346
 347         if (pac_kdc_sig) {
 348                 ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_KDC_CHECKSUM, &k5pac_kdc_checksum_in);
 349                 if (ret != 0) {
 350                         talloc_free(tmp_ctx);
 351                         return ret;
 352                 }
 353
 354                 pac_kdc_checksum_in = data_blob_const(k5pac_kdc_checksum_in.data, k5pac_kdc_checksum_in.length);
 355
 356                 ndr_err = ndr_pull_struct_blob(&pac_kdc_checksum_in, pac_kdc_sig,
 357                                                pac_kdc_sig,
 358                                                (ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
 359                 kerberos_free_data_contents(context, &k5pac_kdc_checksum_in);
 360                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 361                         nt_status = ndr_map_error2ntstatus(ndr_err);
 362                         DEBUG(0,("can't parse the KDC signature: %s\n",
 363                                  nt_errstr(nt_status)));
 364                         return EINVAL;
 365                 }
 366         }
 367         *user_info_dc = user_info_dc_out;
 368
 369         return 0;
 370 }
 371
 372
 373 NTSTATUS kerberos_pac_blob_to_user_info_dc(TALLOC_CTX *mem_ctx,
 374                                            DATA_BLOB pac_blob,
 375                                            krb5_context context,
 376                                            struct auth_user_info_dc **user_info_dc,
 377                                            struct PAC_SIGNATURE_DATA *pac_srv_sig,
 378                                            struct PAC_SIGNATURE_DATA *pac_kdc_sig)
 379 {
 380         krb5_error_code ret;
 381         krb5_pac pac;
 382         ret = krb5_pac_parse(context,
 383                              pac_blob.data, pac_blob.length,
 384                              &pac);
 385         if (ret) {
 386                 return map_nt_error_from_unix_common(ret);
 387         }
 388
 389
 390         ret = kerberos_pac_to_user_info_dc(mem_ctx, pac, context, user_info_dc, pac_srv_sig, pac_kdc_sig);
 391         krb5_pac_free(context, pac);
 392         if (ret) {
 393                 return map_nt_error_from_unix_common(ret);
 394         }
 395         return NT_STATUS_OK;
 396 }