source3/libnet/libnet_samsync_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    dump the remote SAM using rpc samsync operations
   4
   5    Copyright (C) Guenther Deschner 2008.
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smb_krb5.h"
  23 #include "ads.h"
  24 #include "libnet/libnet_keytab.h"
  25 #include "libnet/libnet_samsync.h"
  26 #include "krb5_env.h"
  27
  28 #if defined(HAVE_ADS)
  29
  30 /****************************************************************
  31 ****************************************************************/
  32
  33 static NTSTATUS keytab_ad_connect(TALLOC_CTX *mem_ctx,
  34                                   const char *domain_name,
  35                                   const char *username,
  36                                   const char *password,
  37                                   struct libnet_keytab_context *ctx)
  38 {
  39         NTSTATUS status;
  40         ADS_STATUS ad_status;
  41         ADS_STRUCT *ads;
  42         struct netr_DsRGetDCNameInfo *info = NULL;
  43         const char *dc;
  44
  45         status = dsgetdcname(mem_ctx, NULL, domain_name, NULL, NULL, 0, &info);
  46         if (!NT_STATUS_IS_OK(status)) {
  47                 return status;
  48         }
  49
  50         dc = strip_hostname(info->dc_unc);
  51
  52         ads = ads_init(NULL, domain_name, dc);
  53         NT_STATUS_HAVE_NO_MEMORY(ads);
  54
  55         if (getenv(KRB5_ENV_CCNAME) == NULL) {
  56                 setenv(KRB5_ENV_CCNAME, "MEMORY:libnet_samsync_keytab", 1);
  57         }
  58
  59         ads->auth.user_name = SMB_STRDUP(username);
  60         ads->auth.password = SMB_STRDUP(password);
  61
  62         ad_status = ads_connect_user_creds(ads);
  63         if (!ADS_ERR_OK(ad_status)) {
  64                 return NT_STATUS_UNSUCCESSFUL;
  65         }
  66
  67         ctx->ads = ads;
  68
  69         ctx->dns_domain_name = talloc_strdup_upper(mem_ctx, ads->config.realm);
  70         NT_STATUS_HAVE_NO_MEMORY(ctx->dns_domain_name);
  71
  72         return NT_STATUS_OK;
  73 }
  74
  75 /****************************************************************
  76 ****************************************************************/
  77
  78 static NTSTATUS fetch_sam_entry_keytab(TALLOC_CTX *mem_ctx,
  79                                        enum netr_SamDatabaseID database_id,
  80                                        uint32_t rid,
  81                                        struct netr_DELTA_USER *r,
  82                                        struct libnet_keytab_context *ctx)
  83 {
  84         NTSTATUS status;
  85         uint32_t kvno = 0;
  86         DATA_BLOB blob;
  87
  88         if (memcmp(r->ntpassword.hash, ctx->zero_buf, 16) == 0) {
  89                 return NT_STATUS_OK;
  90         }
  91
  92         kvno = ads_get_kvno(ctx->ads, r->account_name.string);
  93         blob = data_blob_const(r->ntpassword.hash, 16);
  94
  95         status = libnet_keytab_add_to_keytab_entries(mem_ctx, ctx,
  96                                                      kvno,
  97                                                      r->account_name.string,
  98                                                      NULL,
  99                                                      ENCTYPE_ARCFOUR_HMAC,
 100                                                      blob);
 101         if (!NT_STATUS_IS_OK(status)) {
 102                 return status;
 103         }
 104
 105         return NT_STATUS_OK;
 106 }
 107
 108 /****************************************************************
 109 ****************************************************************/
 110
 111 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
 112                             struct samsync_context *ctx,
 113                             enum netr_SamDatabaseID database_id,
 114                             uint64_t *sequence_num)
 115 {
 116         krb5_error_code ret = 0;
 117         NTSTATUS status;
 118         struct libnet_keytab_context *keytab_ctx = NULL;
 119         struct libnet_keytab_entry *entry;
 120         uint64_t old_sequence_num = 0;
 121         const char *principal = NULL;
 122
 123         ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
 124         if (ret) {
 125                 return krb5_to_nt_status(ret);
 126         }
 127
 128         keytab_ctx->clean_old_entries = ctx->clean_old_entries;
 129         ctx->private_data = keytab_ctx;
 130
 131         status = keytab_ad_connect(mem_ctx,
 132                                    ctx->domain_name,
 133                                    ctx->username,
 134                                    ctx->password,
 135                                    keytab_ctx);
 136         if (!NT_STATUS_IS_OK(status)) {
 137                 TALLOC_FREE(keytab_ctx);
 138                 return status;
 139         }
 140
 141         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
 142                                     keytab_ctx->dns_domain_name);
 143         NT_STATUS_HAVE_NO_MEMORY(principal);
 144
 145         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
 146                                      mem_ctx);
 147         if (entry && (entry->password.length == 8)) {
 148                 old_sequence_num = BVAL(entry->password.data, 0);
 149         }
 150
 151         if (sequence_num) {
 152                 *sequence_num = old_sequence_num;
 153         }
 154
 155         return status;
 156 }
 157
 158 /****************************************************************
 159 ****************************************************************/
 160
 161 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
 162                                          enum netr_SamDatabaseID database_id,
 163                                          struct netr_DELTA_ENUM_ARRAY *r,
 164                                          uint64_t *sequence_num,
 165                                          struct samsync_context *ctx)
 166 {
 167         struct libnet_keytab_context *keytab_ctx =
 168                 (struct libnet_keytab_context *)ctx->private_data;
 169
 170         NTSTATUS status = NT_STATUS_OK;
 171         int i;
 172
 173         for (i = 0; i < r->num_deltas; i++) {
 174
 175                 switch (r->delta_enum[i].delta_type) {
 176                 case NETR_DELTA_USER:
 177                         break;
 178                 case NETR_DELTA_DOMAIN:
 179                         if (sequence_num) {
 180                                 *sequence_num =
 181                                         r->delta_enum[i].delta_union.domain->sequence_num;
 182                         }
 183                         continue;
 184                 case NETR_DELTA_MODIFY_COUNT:
 185                         if (sequence_num) {
 186                                 *sequence_num =
 187                                         *r->delta_enum[i].delta_union.modified_count;
 188                         }
 189                         continue;
 190                 default:
 191                         continue;
 192                 }
 193
 194                 status = fetch_sam_entry_keytab(mem_ctx, database_id,
 195                                                 r->delta_enum[i].delta_id_union.rid,
 196                                                 r->delta_enum[i].delta_union.user,
 197                                                 keytab_ctx);
 198                 if (!NT_STATUS_IS_OK(status)) {
 199                         goto out;
 200                 }
 201         }
 202  out:
 203         return status;
 204 }
 205
 206 /****************************************************************
 207 ****************************************************************/
 208
 209 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
 210                              struct samsync_context *ctx,
 211                              enum netr_SamDatabaseID database_id,
 212                              uint64_t sequence_num)
 213 {
 214         struct libnet_keytab_context *keytab_ctx =
 215                 (struct libnet_keytab_context *)ctx->private_data;
 216         krb5_error_code ret;
 217         NTSTATUS status;
 218         struct libnet_keytab_entry *entry;
 219         uint64_t old_sequence_num = 0;
 220         const char *principal = NULL;
 221
 222         principal = talloc_asprintf(mem_ctx, "SEQUENCE_NUM@%s",
 223                                     keytab_ctx->dns_domain_name);
 224         NT_STATUS_HAVE_NO_MEMORY(principal);
 225
 226
 227         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
 228                                      mem_ctx);
 229         if (entry && (entry->password.length == 8)) {
 230                 old_sequence_num = BVAL(entry->password.data, 0);
 231         }
 232
 233
 234         if (sequence_num > old_sequence_num) {
 235                 DATA_BLOB blob;
 236                 blob = data_blob_talloc_zero(mem_ctx, 8);
 237                 SBVAL(blob.data, 0, sequence_num);
 238
 239                 status = libnet_keytab_add_to_keytab_entries(mem_ctx, keytab_ctx,
 240                                                              0,
 241                                                              "SEQUENCE_NUM",
 242                                                              NULL,
 243                                                              ENCTYPE_NULL,
 244                                                              blob);
 245                 if (!NT_STATUS_IS_OK(status)) {
 246                         goto done;
 247                 }
 248         }
 249
 250         ret = libnet_keytab_add(keytab_ctx);
 251         if (ret) {
 252                 status = krb5_to_nt_status(ret);
 253                 ctx->error_message = talloc_asprintf(ctx,
 254                         "Failed to add entries to keytab %s: %s",
 255                         keytab_ctx->keytab_name, error_message(ret));
 256                 TALLOC_FREE(keytab_ctx);
 257                 return status;
 258         }
 259
 260         ctx->result_message = talloc_asprintf(ctx,
 261                 "Vampired %d accounts to keytab %s",
 262                 keytab_ctx->count,
 263                 keytab_ctx->keytab_name);
 264
 265         status = NT_STATUS_OK;
 266
 267  done:
 268         TALLOC_FREE(keytab_ctx);
 269
 270         return status;
 271 }
 272
 273 #else
 274
 275 static NTSTATUS init_keytab(TALLOC_CTX *mem_ctx,
 276                             struct samsync_context *ctx,
 277                             enum netr_SamDatabaseID database_id,
 278                             uint64_t *sequence_num)
 279 {
 280         return NT_STATUS_NOT_SUPPORTED;
 281 }
 282
 283 static NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
 284                                          enum netr_SamDatabaseID database_id,
 285                                          struct netr_DELTA_ENUM_ARRAY *r,
 286                                          uint64_t *sequence_num,
 287                                          struct samsync_context *ctx)
 288 {
 289         return NT_STATUS_NOT_SUPPORTED;
 290 }
 291
 292 static NTSTATUS close_keytab(TALLOC_CTX *mem_ctx,
 293                              struct samsync_context *ctx,
 294                              enum netr_SamDatabaseID database_id,
 295                              uint64_t sequence_num)
 296 {
 297         return NT_STATUS_NOT_SUPPORTED;
 298 }
 299
 300 #endif /* defined(HAVE_ADS) */
 301
 302 const struct samsync_ops libnet_samsync_keytab_ops = {
 303         .startup                = init_keytab,
 304         .process_objects        = fetch_sam_entries_keytab,
 305         .finish                 = close_keytab
 306 };