source4/auth/kerberos/srv_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Kerberos utility functions
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23
  24 #include "includes.h"
  25 #include "auth/credentials/credentials.h"
  26 #include "system/kerberos.h"
  27 #include "auth/kerberos/kerberos.h"
  28 #include "auth/kerberos/kerberos_srv_keytab.h"
  29 #include "auth/kerberos/kerberos_util.h"
  30
  31 static void keytab_principals_free(krb5_context context, krb5_principal *set)
  32 {
  33         int i;
  34         for (i = 0; set[i] != NULL; i++) {
  35                 krb5_free_principal(context, set[i]);
  36         }
  37 }
  38
  39 static krb5_error_code principals_from_list(TALLOC_CTX *parent_ctx,
  40                                         const char *samAccountName,
  41                                         const char *realm,
  42                                         const char **SPNs, int num_SPNs,
  43                                         krb5_context context,
  44                                         krb5_principal **principals_out,
  45                                         const char **error_string)
  46 {
  47         unsigned int i;
  48         krb5_error_code ret;
  49         char *upper_realm;
  50         TALLOC_CTX *tmp_ctx;
  51         krb5_principal *principals = NULL;
  52         tmp_ctx = talloc_new(parent_ctx);
  53         if (!tmp_ctx) {
  54                 *error_string = "Cannot allocate tmp_ctx";
  55                 return ENOMEM;
  56         }
  57
  58         if (!realm) {
  59                 *error_string = "Cannot have a kerberos secret in "
  60                                 "secrets.ldb without a realm";
  61                 ret = EINVAL;
  62                 goto done;
  63         }
  64
  65         upper_realm = strupper_talloc(tmp_ctx, realm);
  66         if (!upper_realm) {
  67                 *error_string = "Cannot allocate full upper case realm";
  68                 ret = ENOMEM;
  69                 goto done;
  70         }
  71
  72         principals = talloc_zero_array(tmp_ctx, krb5_principal,
  73                                         num_SPNs ? (num_SPNs + 2) : 2);
  74
  75         for (i = 0; num_SPNs && i < num_SPNs; i++) {
  76                 ret = krb5_parse_name(context, SPNs[i], &principals[i]);
  77
  78                 if (ret) {
  79                         *error_string = smb_get_krb5_error_message(context, ret,
  80                                                                    parent_ctx);
  81                         goto done;
  82                 }
  83         }
  84
  85         if (samAccountName) {
  86                 ret = krb5_make_principal(context, &principals[i],
  87                                           upper_realm, samAccountName,
  88                                           NULL);
  89                 if (ret) {
  90                         *error_string = smb_get_krb5_error_message(context, ret,
  91                                                                    parent_ctx);
  92                         goto done;
  93                 }
  94         }
  95
  96 done:
  97         if (ret) {
  98                 keytab_principals_free(context, principals);
  99         } else {
 100                 *principals_out = talloc_steal(parent_ctx, principals);
 101         }
 102         talloc_free(tmp_ctx);
 103         return ret;
 104 }
 105
 106 static krb5_error_code salt_principal(TALLOC_CTX *parent_ctx,
 107                                 const char *samAccountName,
 108                                 const char *realm,
 109                                 const char *saltPrincipal,
 110                                 krb5_context context,
 111                                 krb5_principal *salt_princ,
 112                                 const char **error_string)
 113 {
 114
 115         krb5_error_code ret;
 116         char *machine_username;
 117         char *salt_body;
 118         char *lower_realm;
 119         char *upper_realm;
 120
 121         TALLOC_CTX *tmp_ctx;
 122
 123         if (saltPrincipal) {
 124                 ret = krb5_parse_name(context, saltPrincipal, salt_princ);
 125                 if (ret) {
 126                         *error_string = smb_get_krb5_error_message(
 127                                                 context, ret, parent_ctx);
 128                 }
 129                 return ret;
 130         }
 131
 132         if (!samAccountName) {
 133                 (*error_string) = "Cannot determine salt principal, no "
 134                                 "saltPrincipal or samAccountName specified";
 135                 return EINVAL;
 136         }
 137
 138         if (!realm) {
 139                 *error_string = "Cannot have a kerberos secret in "
 140                                 "secrets.ldb without a realm";
 141                 return EINVAL;
 142         }
 143
 144         tmp_ctx = talloc_new(parent_ctx);
 145         if (!tmp_ctx) {
 146                 *error_string = "Cannot allocate tmp_ctx";
 147                 return ENOMEM;
 148         }
 149
 150         machine_username = talloc_strdup(tmp_ctx, samAccountName);
 151         if (!machine_username) {
 152                 *error_string = "Cannot duplicate samAccountName";
 153                 talloc_free(tmp_ctx);
 154                 return ENOMEM;
 155         }
 156
 157         if (machine_username[strlen(machine_username)-1] == '$') {
 158                 machine_username[strlen(machine_username)-1] = '\0';
 159         }
 160
 161         lower_realm = strlower_talloc(tmp_ctx, realm);
 162         if (!lower_realm) {
 163                 *error_string = "Cannot allocate to lower case realm";
 164                 talloc_free(tmp_ctx);
 165                 return ENOMEM;
 166         }
 167
 168         upper_realm = strupper_talloc(tmp_ctx, realm);
 169         if (!upper_realm) {
 170                 *error_string = "Cannot allocate to upper case realm";
 171                 talloc_free(tmp_ctx);
 172                 return ENOMEM;
 173         }
 174
 175         salt_body = talloc_asprintf(tmp_ctx, "%s.%s",
 176                                     machine_username, lower_realm);
 177         if (!salt_body) {
 178                 *error_string = "Cannot form salt principal body";
 179                 talloc_free(tmp_ctx);
 180                 return ENOMEM;
 181         }
 182
 183         ret = krb5_make_principal(context, salt_princ, upper_realm,
 184                                                 "host", salt_body, NULL);
 185         if (ret) {
 186                 *error_string = smb_get_krb5_error_message(context,
 187                                                            ret, parent_ctx);
 188         }
 189
 190         talloc_free(tmp_ctx);
 191         return ret;
 192 }
 193
 194 /* Translate between the Microsoft msDS-SupportedEncryptionTypes values
 195  * and the IETF encryption type values */
 196 static krb5_enctype ms_suptype_to_ietf_enctype(uint32_t enctype_bitmap)
 197 {
 198         switch (enctype_bitmap) {
 199         case ENC_CRC32:
 200                 return ENCTYPE_DES_CBC_CRC;
 201         case ENC_RSA_MD5:
 202                 return ENCTYPE_DES_CBC_MD5;
 203         case ENC_RC4_HMAC_MD5:
 204                 return ENCTYPE_ARCFOUR_HMAC_MD5;
 205         case ENC_HMAC_SHA1_96_AES128:
 206                 return ENCTYPE_AES128_CTS_HMAC_SHA1_96;
 207         case ENC_HMAC_SHA1_96_AES256:
 208                 return ENCTYPE_AES256_CTS_HMAC_SHA1_96;
 209         default:
 210                 return 0;
 211         }
 212 }
 213
 214 /* Return an array of krb5_enctype values */
 215 static krb5_error_code ms_suptypes_to_ietf_enctypes(TALLOC_CTX *mem_ctx,
 216                                                 uint32_t enctype_bitmap,
 217                                                 krb5_enctype **enctypes)
 218 {
 219         unsigned int i, j = 0;
 220         *enctypes = talloc_zero_array(mem_ctx, krb5_enctype,
 221                                         (8 * sizeof(enctype_bitmap)) + 1);
 222         if (!*enctypes) {
 223                 return ENOMEM;
 224         }
 225         for (i = 0; i < (8 * sizeof(enctype_bitmap)); i++) {
 226                 uint32_t bit_value = (1 << i) & enctype_bitmap;
 227                 if (bit_value & enctype_bitmap) {
 228                         (*enctypes)[j] = ms_suptype_to_ietf_enctype(bit_value);
 229                         if (!(*enctypes)[j]) {
 230                                 continue;
 231                         }
 232                         j++;
 233                 }
 234         }
 235         (*enctypes)[j] = 0;
 236         return 0;
 237 }
 238
 239 static krb5_error_code keytab_add_keys(TALLOC_CTX *parent_ctx,
 240                                        krb5_principal *principals,
 241                                        krb5_principal salt_princ,
 242                                        int kvno,
 243                                        const char *password_s,
 244                                        krb5_context context,
 245                                        krb5_enctype *enctypes,
 246                                        krb5_keytab keytab,
 247                                        const char **error_string)
 248 {
 249         unsigned int i, p;
 250         krb5_error_code ret;
 251         krb5_data password;
 252         char *unparsed;
 253
 254         password.data = discard_const_p(char *, password_s);
 255         password.length = strlen(password_s);
 256
 257         for (i = 0; enctypes[i]; i++) {
 258                 krb5_keytab_entry entry;
 259
 260                 ZERO_STRUCT(entry);
 261
 262                 ret = create_kerberos_key_from_string_direct(context,
 263                                                 salt_princ, &password,
 264                                                 &entry.keyblock, enctypes[i]);
 265                 if (ret != 0) {
 266                         return ret;
 267                 }
 268
 269                 entry.vno = kvno;
 270
 271                 for (p = 0; principals[p]; p++) {
 272                         unparsed = NULL;
 273                         entry.principal = principals[p];
 274                         ret = krb5_kt_add_entry(context, keytab, &entry);
 275                         if (ret != 0) {
 276                                 char *k5_error_string =
 277                                         smb_get_krb5_error_message(context,
 278                                                                    ret, NULL);
 279                                 krb5_unparse_name(context,
 280                                                 principals[p], &unparsed);
 281                                 *error_string = talloc_asprintf(parent_ctx,
 282                                         "Failed to add enctype %d entry for "
 283                                         "%s(kvno %d) to keytab: %s\n",
 284                                         (int)enctypes[i], unparsed,
 285                                         kvno, k5_error_string);
 286
 287                                 free(unparsed);
 288                                 talloc_free(k5_error_string);
 289                                 krb5_free_keyblock_contents(context,
 290                                                             &entry.keyblock);
 291                                 return ret;
 292                         }
 293
 294                         DEBUG(5, ("Added key (kvno %d) to keytab (enctype %d)\n",
 295                                   kvno, (int)enctypes[i]));
 296                 }
 297                 krb5_free_keyblock_contents(context, &entry.keyblock);
 298         }
 299         return 0;
 300 }
 301
 302 static krb5_error_code create_keytab(TALLOC_CTX *parent_ctx,
 303                                      const char *samAccountName,
 304                                      const char *realm,
 305                                      const char *saltPrincipal,
 306                                      int kvno,
 307                                      const char *new_secret,
 308                                      const char *old_secret,
 309                                      uint32_t supp_enctypes,
 310                                      krb5_principal *principals,
 311                                      krb5_context context,
 312                                      krb5_keytab keytab,
 313                                      bool add_old,
 314                                      const char **error_string)
 315 {
 316         krb5_error_code ret;
 317         krb5_principal salt_princ = NULL;
 318         krb5_enctype *enctypes;
 319         TALLOC_CTX *mem_ctx;
 320
 321         if (!new_secret) {
 322                 /* There is no password here, so nothing to do */
 323                 return 0;
 324         }
 325
 326         mem_ctx = talloc_new(parent_ctx);
 327         if (!mem_ctx) {
 328                 *error_string = "unable to allocate tmp_ctx for create_keytab";
 329                 return ENOMEM;
 330         }
 331
 332         /* The salt used to generate these entries may be different however,
 333          * fetch that */
 334         ret = salt_principal(mem_ctx, samAccountName, realm, saltPrincipal,
 335                              context, &salt_princ, error_string);
 336         if (ret) {
 337                 talloc_free(mem_ctx);
 338                 return ret;
 339         }
 340
 341         ret = ms_suptypes_to_ietf_enctypes(mem_ctx, supp_enctypes, &enctypes);
 342         if (ret) {
 343                 *error_string = talloc_asprintf(parent_ctx,
 344                                         "create_keytab: generating list of "
 345                                         "encryption types failed (%s)\n",
 346                                         smb_get_krb5_error_message(context,
 347                                                                 ret, mem_ctx));
 348                 goto done;
 349         }
 350
 351         ret = keytab_add_keys(mem_ctx, principals,
 352                               salt_princ, kvno, new_secret,
 353                               context, enctypes, keytab, error_string);
 354         if (ret) {
 355                 goto done;
 356         }
 357
 358         if (old_secret && add_old && kvno != 0) {
 359                 ret = keytab_add_keys(mem_ctx, principals,
 360                                       salt_princ, kvno - 1, old_secret,
 361                                       context, enctypes, keytab, error_string);
 362         }
 363
 364 done:
 365         krb5_free_principal(context, salt_princ);
 366         talloc_free(mem_ctx);
 367         return ret;
 368 }
 369
 370 /*
 371  * Walk the keytab, looking for entries of this principal name,
 372  * with KVNO other than current kvno -1.
 373  *
 374  * These entries are now stale,
 375  * we only keep the current and previous entries around.
 376  *
 377  * Inspired by the code in Samba3 for 'use kerberos keytab'.
 378  */
 379
 380 static krb5_error_code remove_old_entries(TALLOC_CTX *parent_ctx,
 381                                           int kvno,
 382                                           krb5_principal *principals,
 383                                           bool delete_all_kvno,
 384                                           krb5_context context,
 385                                           krb5_keytab keytab,
 386                                           bool *found_previous,
 387                                           const char **error_string)
 388 {
 389         krb5_error_code ret, ret2;
 390         krb5_kt_cursor cursor;
 391         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 392
 393         if (!mem_ctx) {
 394                 return ENOMEM;
 395         }
 396
 397         *found_previous = false;
 398
 399         /* for each entry in the keytab */
 400         ret = krb5_kt_start_seq_get(context, keytab, &cursor);
 401         switch (ret) {
 402         case 0:
 403                 break;
 404         case HEIM_ERR_OPNOTSUPP:
 405         case ENOENT:
 406         case KRB5_KT_END:
 407                 /* no point enumerating if there isn't anything here */
 408                 talloc_free(mem_ctx);
 409                 return 0;
 410         default:
 411                 *error_string = talloc_asprintf(parent_ctx,
 412                         "failed to open keytab for read of old entries: %s\n",
 413                         smb_get_krb5_error_message(context, ret, mem_ctx));
 414                 talloc_free(mem_ctx);
 415                 return ret;
 416         }
 417
 418         while (!ret) {
 419                 unsigned int i;
 420                 bool matched = false;
 421                 krb5_keytab_entry entry;
 422                 ret = krb5_kt_next_entry(context, keytab, &entry, &cursor);
 423                 if (ret) {
 424                         break;
 425                 }
 426                 for (i = 0; principals[i]; i++) {
 427                         /* if it matches our principal */
 428                         if (krb5_kt_compare(context, &entry,
 429                                             principals[i], 0, 0)) {
 430                                 matched = true;
 431                                 break;
 432                         }
 433                 }
 434
 435                 if (!matched) {
 436                         /* Free the entry,
 437                          * it wasn't the one we were looking for anyway */
 438                         krb5_kt_free_entry(context, &entry);
 439                         continue;
 440                 }
 441
 442                 /* delete it, if it is not kvno -1 */
 443                 if (entry.vno != (kvno - 1 )) {
 444                         /* Release the enumeration.  We are going to
 445                          * have to start this from the top again,
 446                          * because deletes during enumeration may not
 447                          * always be consistent.
 448                          *
 449                          * Also, the enumeration locks a FILE: keytab
 450                          */
 451
 452                         krb5_kt_end_seq_get(context, keytab, &cursor);
 453
 454                         ret = krb5_kt_remove_entry(context, keytab, &entry);
 455                         krb5_kt_free_entry(context, &entry);
 456
 457                         /* Deleted: Restart from the top */
 458                         ret2 = krb5_kt_start_seq_get(context, keytab, &cursor);
 459                         if (ret2) {
 460                                 krb5_kt_free_entry(context, &entry);
 461                                 DEBUG(1, ("failed to restart enumeration of keytab: %s\n",
 462                                           smb_get_krb5_error_message(context,
 463                                                                 ret, mem_ctx)));
 464
 465                                 talloc_free(mem_ctx);
 466                                 return ret2;
 467                         }
 468
 469                         if (ret) {
 470                                 break;
 471                         }
 472
 473                 } else {
 474                         *found_previous = true;
 475                 }
 476
 477                 /* Free the entry, we don't need it any more */
 478                 krb5_kt_free_entry(context, &entry);
 479         }
 480         krb5_kt_end_seq_get(context, keytab, &cursor);
 481
 482         switch (ret) {
 483         case 0:
 484                 break;
 485         case ENOENT:
 486         case KRB5_KT_END:
 487                 ret = 0;
 488                 break;
 489         default:
 490                 *error_string = talloc_asprintf(parent_ctx,
 491                         "failed in deleting old entries for principal: %s\n",
 492                         smb_get_krb5_error_message(context, ret, mem_ctx));
 493         }
 494         talloc_free(mem_ctx);
 495         return ret;
 496 }
 497
 498 krb5_error_code smb_krb5_update_keytab(TALLOC_CTX *parent_ctx,
 499                                 struct smb_krb5_context *smb_krb5_context,
 500                                 const char *keytab_name,
 501                                 const char *samAccountName,
 502                                 const char *realm,
 503                                 const char **SPNs,
 504                                 int num_SPNs,
 505                                 const char *saltPrincipal,
 506                                 const char *new_secret,
 507                                 const char *old_secret,
 508                                 int kvno,
 509                                 uint32_t supp_enctypes,
 510                                 bool delete_all_kvno,
 511                                 const char **error_string)
 512 {
 513         krb5_error_code ret;
 514         bool found_previous;
 515         TALLOC_CTX *mem_ctx = talloc_new(NULL);
 516         struct keytab_container *keytab_container;
 517         krb5_principal *principals = NULL;
 518
 519         if (!keytab_name) {
 520                 return ENOENT;
 521         }
 522
 523         ret = smb_krb5_get_keytab_container(mem_ctx, smb_krb5_context,
 524                                         keytab_name, &keytab_container);
 525
 526         if (ret != 0) {
 527                 goto done;
 528         }
 529
 530         DEBUG(5, ("Opened keytab %s\n", keytab_name));
 531
 532         /* Get the principal we will store the new keytab entries under */
 533         ret = principals_from_list(mem_ctx,
 534                                   samAccountName, realm, SPNs, num_SPNs,
 535                                   smb_krb5_context->krb5_context,
 536                                   &principals, error_string);
 537
 538         if (ret != 0) {
 539                 *error_string = talloc_asprintf(parent_ctx,
 540                         "Failed to load principals from ldb message: %s\n",
 541                         *error_string);
 542                 goto done;
 543         }
 544
 545         ret = remove_old_entries(mem_ctx, kvno, principals, delete_all_kvno,
 546                                  smb_krb5_context->krb5_context,
 547                                  keytab_container->keytab,
 548                                  &found_previous, error_string);
 549         if (ret != 0) {
 550                 *error_string = talloc_asprintf(parent_ctx,
 551                         "Failed to remove old principals from keytab: %s\n",
 552                         *error_string);
 553                 goto done;
 554         }
 555
 556         if (!delete_all_kvno) {
 557                 /* Create a new keytab.  If during the cleanout we found
 558                  * entires for kvno -1, then don't try and duplicate them.
 559                  * Otherwise, add kvno, and kvno -1 */
 560
 561                 ret = create_keytab(mem_ctx,
 562                                     samAccountName, realm, saltPrincipal,
 563                                     kvno, new_secret, old_secret,
 564                                     supp_enctypes, principals,
 565                                     smb_krb5_context->krb5_context,
 566                                     keytab_container->keytab,
 567                                     found_previous ? false : true,
 568                                     error_string);
 569         }
 570
 571 done:
 572         keytab_principals_free(smb_krb5_context->krb5_context, principals);
 573         talloc_free(mem_ctx);
 574         return ret;
 575 }
 576
 577 krb5_error_code smb_krb5_create_memory_keytab(TALLOC_CTX *parent_ctx,
 578                                 struct cli_credentials *machine_account,
 579                                 struct smb_krb5_context *smb_krb5_context,
 580                                 struct keytab_container **keytab_container)
 581 {
 582         krb5_error_code ret;
 583         TALLOC_CTX *mem_ctx = talloc_new(parent_ctx);
 584         const char *rand_string;
 585         const char *keytab_name;
 586         const char *new_secret;
 587         const char *samAccountName;
 588         const char *realm;
 589         int kvno;
 590         const char *error_string;
 591         if (!mem_ctx) {
 592                 return ENOMEM;
 593         }
 594
 595         *keytab_container = talloc(mem_ctx, struct keytab_container);
 596
 597         rand_string = generate_random_str(mem_ctx, 16);
 598         if (!rand_string) {
 599                 talloc_free(mem_ctx);
 600                 return ENOMEM;
 601         }
 602
 603         keytab_name = talloc_asprintf(mem_ctx, "MEMORY:%s",
 604                                       rand_string);
 605         if (!keytab_name) {
 606                 talloc_free(mem_ctx);
 607                 return ENOMEM;
 608         }
 609
 610         ret = smb_krb5_get_keytab_container(mem_ctx, smb_krb5_context,
 611                                             keytab_name, keytab_container);
 612         if (ret) {
 613                 return ret;
 614         }
 615
 616         new_secret = cli_credentials_get_password(machine_account);
 617         samAccountName = cli_credentials_get_username(machine_account);
 618         realm = cli_credentials_get_realm(machine_account);
 619         kvno = cli_credentials_get_kvno(machine_account);
 620
 621         ret = smb_krb5_update_keytab(mem_ctx, smb_krb5_context,
 622                                      keytab_name, samAccountName, realm,
 623                                      NULL, 0, NULL, new_secret, NULL,
 624                                      kvno, ENC_ALL_TYPES,
 625                                      false, &error_string);
 626         if (ret == 0) {
 627                 talloc_steal(parent_ctx, *keytab_container);
 628         } else {
 629                 DEBUG(0, ("Failed to create in-memory keytab: %s\n",
 630                           error_string));
 631                 *keytab_container = NULL;
 632         }
 633         talloc_free(mem_ctx);
 634         return ret;
 635 }