source4/kdc/pac-glue.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    PAC Glue between Samba and the KDC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "kdc/kdc.h"
  26 #include "include/ads.h"
  27 #include "lib/ldb/include/ldb.h"
  28 #include "heimdal/lib/krb5/krb5_locl.h"
  29 #include "librpc/gen_ndr/krb5pac.h"
  30 #include "auth/auth.h"
  31
  32 /* Given the right private pointer from hdb_ldb, get a PAC from the attached ldb messages */
  33 static krb5_error_code samba_get_pac(krb5_context context,
  34                                      struct hdb_ldb_private *private,
  35                                      krb5_principal client,
  36                                      krb5_keyblock *krbtgt_keyblock,
  37                                      krb5_keyblock *server_keyblock,
  38                                      time_t tgs_authtime,
  39                                      krb5_data *pac)
  40 {
  41         krb5_error_code ret;
  42         NTSTATUS nt_status;
  43         struct auth_serversupplied_info *server_info;
  44         DATA_BLOB tmp_blob;
  45         TALLOC_CTX *mem_ctx = talloc_named(private, 0, "samba_get_pac context");
  46
  47         if (!mem_ctx) {
  48                 return ENOMEM;
  49         }
  50
  51         nt_status = authsam_make_server_info(mem_ctx, private->samdb,
  52                                              private->msg,
  53                                              private->realm_ref_msg,
  54                                              data_blob(NULL, 0),
  55                                              data_blob(NULL, 0),
  56                                              &server_info);
  57         if (!NT_STATUS_IS_OK(nt_status)) {
  58                 DEBUG(0, ("Getting user info for PAC failed: %s\n",
  59                           nt_errstr(nt_status)));
  60                 return ENOMEM;
  61         }
  62
  63         ret = kerberos_create_pac(mem_ctx, server_info,
  64                                   context,
  65                                   krbtgt_keyblock,
  66                                   server_keyblock,
  67                                   client,
  68                                   tgs_authtime,
  69                                   &tmp_blob);
  70
  71         if (ret) {
  72                 DEBUG(1, ("PAC encoding failed: %s\n",
  73                           smb_get_krb5_error_message(context, ret, mem_ctx)));
  74                 talloc_free(mem_ctx);
  75                 return ret;
  76         }
  77
  78         ret = krb5_data_copy(pac, tmp_blob.data, tmp_blob.length);
  79         talloc_free(mem_ctx);
  80         return ret;
  81 }
  82
  83 /* Wrap the PAC in the right ASN.1.  Will always free 'pac', on success or failure */
  84 krb5_error_code wrap_pac(krb5_context context, krb5_data *pac, AuthorizationData **out)
  85 {
  86         krb5_error_code ret;
  87
  88         unsigned char *buf;
  89         size_t buf_size;
  90         size_t len;
  91
  92         AD_IF_RELEVANT if_relevant;
  93         AuthorizationData *auth_data;
  94
  95         if_relevant.len = 1;
  96         if_relevant.val = malloc(sizeof(*if_relevant.val));
  97         if (!if_relevant.val) {
  98                 krb5_data_free(pac);
  99                 *out = NULL;
 100                 return ENOMEM;
 101         }
 102
 103         if_relevant.val[0].ad_type = KRB5_AUTHDATA_WIN2K_PAC;
 104         if_relevant.val[0].ad_data.data = NULL;
 105         if_relevant.val[0].ad_data.length = 0;
 106
 107         /* pac.data will be freed with this */
 108         if_relevant.val[0].ad_data.data = pac->data;
 109         if_relevant.val[0].ad_data.length = pac->length;
 110
 111         ASN1_MALLOC_ENCODE(AuthorizationData, buf, buf_size, &if_relevant, &len, ret);
 112         free_AuthorizationData(&if_relevant);
 113         if (ret) {
 114                 *out = NULL;
 115                 return ret;
 116         }
 117
 118         auth_data = malloc(sizeof(*auth_data));
 119         if (!auth_data) {
 120                 free(buf);
 121                 *out = NULL;
 122                 return ret;
 123         }
 124         auth_data->len = 1;
 125         auth_data->val = malloc(sizeof(*auth_data->val));
 126         if (!auth_data->val) {
 127                 free(buf);
 128                 free(auth_data);
 129                 *out = NULL;
 130                 return ret;
 131         }
 132         auth_data->val[0].ad_type = KRB5_AUTHDATA_IF_RELEVANT;
 133         auth_data->val[0].ad_data.length = len;
 134         auth_data->val[0].ad_data.data = buf;
 135
 136         *out = auth_data;
 137         return 0;
 138 }
 139
 140
 141 /* Given a hdb_entry, create a PAC out of the private data
 142
 143    Don't create it if the client has the UF_NO_AUTH_DATA_REQUIRED bit
 144    set, or if they specificaly asked not to get it.
 145 */
 146
 147  krb5_error_code hdb_ldb_authz_data_as_req(krb5_context context, struct hdb_entry_ex *entry_ex,
 148                                            METHOD_DATA* pa_data_seq,
 149                                            time_t authtime,
 150                                            EncryptionKey *tgtkey,
 151                                            EncryptionKey *sessionkey,
 152                                            AuthorizationData **out)
 153 {
 154         krb5_error_code ret;
 155         int i;
 156         krb5_data pac;
 157         krb5_boolean pac_wanted = TRUE;
 158         unsigned int userAccountControl;
 159         struct PA_PAC_REQUEST pac_request;
 160         struct hdb_ldb_private *private = talloc_get_type(entry_ex->private, struct hdb_ldb_private);
 161
 162         /* The user account may be set not to want the PAC */
 163         userAccountControl = ldb_msg_find_uint(private->msg, "userAccountControl", 0);
 164         if (userAccountControl & UF_NO_AUTH_DATA_REQUIRED) {
 165                 *out = NULL;
 166                 return 0;
 167         }
 168
 169         /* The user may not want a PAC */
 170         for (i=0; i<pa_data_seq->len; i++) {
 171                 if (pa_data_seq->val[i].padata_type == KRB5_PADATA_PA_PAC_REQUEST) {
 172                         ret = decode_PA_PAC_REQUEST(pa_data_seq->val[i].padata_value.data,
 173                                                     pa_data_seq->val[i].padata_value.length,
 174                                                     &pac_request, NULL);
 175                         if (ret == 0) {
 176                                 pac_wanted = !!pac_request.include_pac;
 177                         }
 178                         free_PA_PAC_REQUEST(&pac_request);
 179                         break;
 180                 }
 181         }
 182
 183         if (!pac_wanted) {
 184                 *out = NULL;
 185                 return 0;
 186         }
 187
 188         /* Get PAC from Samba */
 189         ret = samba_get_pac(context,
 190                             private,
 191                             entry_ex->entry.principal,
 192                             tgtkey,
 193                             tgtkey,
 194                             authtime,
 195                             &pac);
 196
 197         if (ret) {
 198                 *out = NULL;
 199                 return ret;
 200         }
 201
 202         return wrap_pac(context, &pac, out);
 203 }
 204
 205 /* Resign (and reform, including possibly new groups) a PAC */
 206
 207  krb5_error_code hdb_ldb_authz_data_tgs_req(krb5_context context, struct hdb_entry_ex *entry_ex,
 208                                             krb5_principal client,
 209                                             AuthorizationData *in,
 210                                             time_t authtime,
 211                                             EncryptionKey *tgtkey,
 212                                             EncryptionKey *servicekey,
 213                                             EncryptionKey *sessionkey,
 214                                             AuthorizationData **out)
 215 {
 216         NTSTATUS nt_status;
 217         krb5_error_code ret;
 218
 219         unsigned int userAccountControl;
 220
 221         struct hdb_ldb_private *private = talloc_get_type(entry_ex->private, struct hdb_ldb_private);
 222         krb5_data k5pac_in, k5pac_out;
 223         DATA_BLOB pac_in, pac_out;
 224
 225         struct PAC_LOGON_INFO *logon_info;
 226         union netr_Validation validation;
 227         struct auth_serversupplied_info *server_info_out;
 228
 229         krb5_boolean found = FALSE;
 230         TALLOC_CTX *mem_ctx;
 231
 232         /* The service account may be set not to want the PAC */
 233         userAccountControl = ldb_msg_find_uint(private->msg, "userAccountControl", 0);
 234         if (userAccountControl & UF_NO_AUTH_DATA_REQUIRED) {
 235                 *out = NULL;
 236                 return 0;
 237         }
 238
 239         ret = _krb5_find_type_in_ad(context, KRB5_AUTHDATA_WIN2K_PAC,
 240                                     &k5pac_in, &found, sessionkey, in);
 241         if (ret || !found) {
 242                 *out = NULL;
 243                 return 0;
 244         }
 245
 246         mem_ctx = talloc_new(private);
 247         if (!mem_ctx) {
 248                 krb5_data_free(&k5pac_in);
 249                 *out = NULL;
 250                 return ENOMEM;
 251         }
 252
 253         pac_in = data_blob_talloc(mem_ctx, k5pac_in.data, k5pac_in.length);
 254         krb5_data_free(&k5pac_in);
 255         if (!pac_in.data) {
 256                 talloc_free(mem_ctx);
 257                 *out = NULL;
 258                 return ENOMEM;
 259         }
 260
 261         /* Parse the PAC again, for the logon info */
 262         nt_status = kerberos_pac_logon_info(mem_ctx, &logon_info,
 263                                             pac_in,
 264                                             context,
 265                                             tgtkey,
 266                                             tgtkey,
 267                                             client, authtime,
 268                                             &ret);
 269
 270         if (!NT_STATUS_IS_OK(nt_status)) {
 271                 DEBUG(1, ("Failed to parse PAC in TGT: %s/%s\n",
 272                           nt_errstr(nt_status), error_message(ret)));
 273                 talloc_free(mem_ctx);
 274                 *out = NULL;
 275                 return ret;
 276         }
 277
 278         /* Pull this right into the normal auth sysstem structures */
 279         validation.sam3 = &logon_info->info3;
 280         nt_status = make_server_info_netlogon_validation(mem_ctx,
 281                                                          "",
 282                                                          3, &validation,
 283                                                          &server_info_out);
 284         if (!NT_STATUS_IS_OK(nt_status)) {
 285                 talloc_free(mem_ctx);
 286                 *out = NULL;
 287                 return ENOMEM;
 288         }
 289
 290         /* And make a new PAC, possibly containing new groups */
 291         ret = kerberos_create_pac(mem_ctx,
 292                                   server_info_out,
 293                                   context,
 294                                   tgtkey,
 295                                   servicekey,
 296                                   client,
 297                                   authtime,
 298                                   &pac_out);
 299
 300         if (ret != 0) {
 301                 talloc_free(mem_ctx);
 302                 *out = NULL;
 303                 return ret;
 304         }
 305
 306         ret = krb5_data_copy(&k5pac_out, pac_out.data, pac_out.length);
 307         if (ret != 0) {
 308                 talloc_free(mem_ctx);
 309                 *out = NULL;
 310                 return ret;
 311         }
 312
 313         return wrap_pac(context, &k5pac_out, out);
 314 }
 315
 316 /* Given an hdb entry (and in particular it's private member), consult
 317  * the account_ok routine in auth/auth_sam.c for consistancy */
 318
 319  krb5_error_code hdb_ldb_check_client_access(krb5_context context, hdb_entry_ex *entry_ex,
 320                                             HostAddresses *addresses)
 321 {
 322         krb5_error_code ret;
 323         NTSTATUS nt_status;
 324         TALLOC_CTX *tmp_ctx = talloc_new(entry_ex->private);
 325         struct hdb_ldb_private *private = talloc_get_type(entry_ex->private, struct hdb_ldb_private);
 326         char *name, *workstation = NULL;
 327         int i;
 328
 329         if (!tmp_ctx) {
 330                 return ENOMEM;
 331         }
 332
 333         ret = krb5_unparse_name(context, entry_ex->entry.principal, &name);
 334         if (ret != 0) {
 335                 talloc_free(tmp_ctx);
 336                 return ret;
 337         }
 338
 339         for (i=0; i < addresses->len; i++) {
 340                 if (addresses->val->addr_type == KRB5_ADDRESS_NETBIOS) {
 341                         workstation = talloc_strndup(tmp_ctx, addresses->val->address.data, MIN(addresses->val->address.length, 15));
 342                         if (workstation) {
 343                                 break;
 344                         }
 345                 }
 346         }
 347
 348         /* Strip space padding */
 349         if (workstation) {
 350                 i = MIN(strlen(workstation), 15);
 351                 for (; i > 0 && workstation[i - 1] == ' '; i--) {
 352                         workstation[i - 1] = '\0';
 353                 }
 354         }
 355
 356         nt_status = authsam_account_ok(tmp_ctx,
 357                                        private->samdb,
 358                                        MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
 359                                        private->msg,
 360                                        private->realm_ref_msg,
 361                                        workstation,
 362                                        name);
 363         free(name);
 364
 365         /* TODO:  Need a more complete mapping of NTSTATUS to krb5kdc errors */
 366
 367         if (!NT_STATUS_IS_OK(nt_status)) {
 368                 return KRB5KDC_ERR_POLICY;
 369         }
 370         return 0;
 371 }
 372