Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
authorAndrew Bartlett <abartlet@samba.org>
Tue, 27 May 2008 22:11:05 +0000 (08:11 +1000)
committerAndrew Bartlett <abartlet@samba.org>
Tue, 27 May 2008 22:11:05 +0000 (08:11 +1000)
It seems the format of main.mk changed in my sleep...

Conflicts:

source/main.mk

source/librpc/config.mk
source/librpc/idl/ntp_signd.idl [new file with mode: 0644]
source/main.mk
source/ntp_signd/config.mk [new file with mode: 0644]
source/ntp_signd/ntp_signd.c [new file with mode: 0644]

index a39f50411b1af913e2527581b3640679d2eea3c4..a83308d66be827066fc1a0b9bafe83ec85ad8321 100644 (file)
@@ -338,6 +338,13 @@ NDR_NBT_OBJ_FILES = $(gen_ndrsrcdir)/ndr_nbt.o
 
 PUBLIC_HEADERS += $(gen_ndrsrcdir)/nbt.h
 
+[SUBSYSTEM::NDR_NTP_SIGND]
+PUBLIC_DEPENDENCIES = LIBNDR 
+
+NDR_NTP_SIGND_OBJ_FILES = $(gen_ndrsrcdir)/ndr_ntp_signd.o
+
+PUBLIC_HEADERS += $(gen_ndrsrcdir)/ndr_ntp_signd.h
+
 [SUBSYSTEM::NDR_WINSREPL]
 PUBLIC_DEPENDENCIES = LIBNDR NDR_NBT
 
diff --git a/source/librpc/idl/ntp_signd.idl b/source/librpc/idl/ntp_signd.idl
new file mode 100644 (file)
index 0000000..d94a0a3
--- /dev/null
@@ -0,0 +1,30 @@
+/*
+  NTP signing IRPC interface
+*/
+
+#include "idl_types.h"
+
+[
+  uuid("0da00951-5b6c-4488-9a89-750cac70920c"),
+  version(1.0),
+  pointer_default(unique)
+]
+interface ntp_signd
+{
+
+       typedef [flag(NDR_BIG_ENDIAN),public] struct {
+               uint32 version;
+               uint32 op;
+               uint32 packet_id;
+               [flag(NDR_LITTLE_ENDIAN)] uint32 key_id;
+               [flag(NDR_REMAINING)]   DATA_BLOB packet_to_sign;
+               
+       } sign_request;
+
+       typedef [flag(NDR_BIG_ENDIAN),public] struct samba_key_out {
+               uint32 version;
+               uint32 op;
+               uint32 packet_id;
+               [flag(NDR_REMAINING)]   DATA_BLOB signed_packet;
+       } signed_reply;
+}
\ No newline at end of file
index 4fd1502fae3650f6366df70cb9ff0250c2e04564..3f3aea87e67969ab5717ddc43e9d90d1db4db06e 100644 (file)
@@ -36,6 +36,7 @@ mkinclude winbind/config.mk
 mkinclude nbt_server/config.mk
 mkinclude wrepl_server/config.mk
 mkinclude cldap_server/config.mk
+mkinclude ntp_signd/config.mk
 mkinclude utils/net/config.mk
 mkinclude utils/config.mk
 mkinclude ntvfs/config.mk
diff --git a/source/ntp_signd/config.mk b/source/ntp_signd/config.mk
new file mode 100644 (file)
index 0000000..e8d0530
--- /dev/null
@@ -0,0 +1,14 @@
+# NTP_SIGND server subsystem
+
+#######################
+# Start SUBSYSTEM NTP_signd
+[MODULE::NTP_SIGND]
+INIT_FUNCTION = server_service_ntp_signd_init
+SUBSYSTEM = smbd
+PRIVATE_DEPENDENCIES = \
+               SAMDB NDR_NTP_SIGND
+# End SUBSYSTEM NTP_SIGND
+#######################
+
+NTP_SIGND_OBJ_FILES = $(addprefix $(ntp_signd_srcdir)/, ntp_signd.o)
+
diff --git a/source/ntp_signd/ntp_signd.c b/source/ntp_signd/ntp_signd.c
new file mode 100644 (file)
index 0000000..41a3df0
--- /dev/null
@@ -0,0 +1,260 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   NTP packet signing server
+
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
+   Copyright (C) Andrew Tridgell       2005
+   Copyright (C) Stefan Metzmacher     2005
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "smbd/service_task.h"
+#include "smbd/service.h"
+#include "smbd/service_stream.h"
+#include "smbd/process_model.h"
+#include "lib/stream/packet.h"
+#include "librpc/gen_ndr/ntp_signd.h"
+#include "param/param.h"
+#include "dsdb/samdb/samdb.h"
+#include "auth/auth.h"
+
+/*
+  top level context structure for the ntp_signd server
+*/
+struct ntp_signd_server {
+       struct task_server *task;
+       struct ldb_context *samdb;
+};
+
+/*
+  state of an open connection
+*/
+struct ntp_signd_connection {
+       /* stream connection we belong to */
+       struct stream_connection *conn;
+
+       /* the ntp_signd_server the connection belongs to */
+       struct ntp_signd_server *ntp_signd;
+
+       struct packet_context *packet;
+};
+
+static void ntp_signd_terminate_connection(struct ntp_signd_connection *ntp_signdconn, const char *reason)
+{
+       stream_terminate_connection(ntp_signdconn->conn, reason);
+}
+
+/*
+  receive a full packet on a NTP_SIGND connection
+*/
+static NTSTATUS ntp_signd_recv(void *private, DATA_BLOB blob)
+{
+       struct ntp_signd_connection *ntp_signdconn = talloc_get_type(private, 
+                                                            struct ntp_signd_connection);
+       NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+       TALLOC_CTX *tmp_ctx = talloc_new(ntp_signdconn);
+       DATA_BLOB input, reply;
+       const struct dom_sid *domain_sid;
+       struct dom_sid *sid;
+       struct sign_request sign_request;
+       enum ndr_err_code ndr_err;
+       struct ldb_result *res;
+       const char *attrs[] = { "unicodePwd", NULL };
+
+       talloc_steal(tmp_ctx, blob.data);
+
+       input = data_blob_const(blob.data + 4, blob.length - 4); 
+
+       ndr_err = ndr_pull_struct_blob_all(input, tmp_ctx, 
+                                          iconv_convenience,
+                                          &sign_request,
+                                          (ndr_pull_flags_fn_t)ndr_pull_sign_request);
+
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               DEBUG(1,("failed to parse ntp signing request\n"));
+               dump_data(1, input.data, input.length);
+               return ndr_map_error2ntstatus(ndr_err);
+       }
+
+       domain_sid = samdb_domain_sid(ntp_signdconn->ntp_signd->samdb);
+       if (!domain_sid) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+       
+       sid = dom_sid_add_rid(tmp_ctx, domain_sid, sign_request.key_id & 0x7FFFFFFF);
+       if (!sid) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       /* Sign packet */
+       ret = ldb_search_exp_format(ntp_signdconn->ntp_signd->samdb, tmp_ctx,
+                                   &res, samdb_base_dn(ntp_signdconn->ntp_signd->samdb),
+                                   LDB_SCOPE_SUBTREE, attrs, "(&(objectSid=%s)(objectClass=computer))");
+       if (ret != LDB_SUCCESS) {
+               return NT_STATUS_UNSUCCESSFUL;
+       }
+
+       if (res->count != 1) {
+               return NT_STATUS_NO_SUCH_USER;
+       }
+
+       /* Sign the NTP response with the unicodePwd */
+
+       /* Place it into the packet for the wire */
+
+       blob = data_blob_talloc(ntp_signdconn, NULL, reply.length + 4);
+       if (!blob.data) {
+               talloc_free(tmp_ctx);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       RSIVAL(blob.data, 0, reply.length);
+       memcpy(blob.data + 4, reply.data, reply.length);        
+
+       status = packet_send(ntp_signdconn->packet, blob);
+
+       /* the call isn't needed any more */
+       talloc_free(tmp_ctx);
+       return status;
+}
+
+/*
+  receive some data on a NTP_SIGND connection
+*/
+static void ntp_signd_recv_handler(struct stream_connection *conn, uint16_t flags)
+{
+       struct ntp_signd_connection *ntp_signdconn = talloc_get_type(conn->private, 
+                                                            struct ntp_signd_connection);
+       packet_recv(ntp_signdconn->packet);
+}
+
+/*
+  called on a tcp recv error
+*/
+static void ntp_signd_recv_error(void *private, NTSTATUS status)
+{
+       struct ntp_signd_connection *ntp_signdconn = talloc_get_type(private, struct ntp_signd_connection);
+       ntp_signd_terminate_connection(ntp_signdconn, nt_errstr(status));
+}
+
+/*
+  called when we can write to a connection
+*/
+static void ntp_signd_send(struct stream_connection *conn, uint16_t flags)
+{
+       struct ntp_signd_connection *ntp_signdconn = talloc_get_type(conn->private, 
+                                                            struct ntp_signd_connection);
+       packet_queue_run(ntp_signdconn->packet);
+}
+
+/*
+  called when we get a new connection
+*/
+static void ntp_signd_accept(struct stream_connection *conn)
+{
+       struct ntp_signd_server *ntp_signd = talloc_get_type(conn->private, struct ntp_signd_server);
+       struct ntp_signd_connection *ntp_signdconn;
+
+       ntp_signdconn = talloc_zero(conn, struct ntp_signd_connection);
+       if (!ntp_signdconn) {
+               stream_terminate_connection(conn, "ntp_signd_accept: out of memory");
+               return;
+       }
+       ntp_signdconn->conn      = conn;
+       ntp_signdconn->ntp_signd         = ntp_signd;
+       conn->private    = ntp_signdconn;
+
+       ntp_signdconn->packet = packet_init(ntp_signdconn);
+       if (ntp_signdconn->packet == NULL) {
+               ntp_signd_terminate_connection(ntp_signdconn, "ntp_signd_accept: out of memory");
+               return;
+       }
+       packet_set_private(ntp_signdconn->packet, ntp_signdconn);
+       packet_set_socket(ntp_signdconn->packet, conn->socket);
+       packet_set_callback(ntp_signdconn->packet, ntp_signd_recv);
+       packet_set_full_request(ntp_signdconn->packet, packet_full_request_u32);
+       packet_set_error_handler(ntp_signdconn->packet, ntp_signd_recv_error);
+       packet_set_event_context(ntp_signdconn->packet, conn->event.ctx);
+       packet_set_fde(ntp_signdconn->packet, conn->event.fde);
+       packet_set_serialise(ntp_signdconn->packet);
+}
+
+static const struct stream_server_ops ntp_signd_stream_ops = {
+       .name                   = "ntp_signd",
+       .accept_connection      = ntp_signd_accept,
+       .recv_handler           = ntp_signd_recv_handler,
+       .send_handler           = ntp_signd_send
+};
+
+/*
+  startup the ntp_signd task
+*/
+static void ntp_signd_task_init(struct task_server *task)
+{
+       struct ntp_signd_server *ntp_signd;
+       NTSTATUS status;
+
+       const struct model_ops *model_ops;
+
+       const char *address = "/tmp/ux_demo";
+
+       /* within the ntp_signd task we want to be a single process, so
+          ask for the single process model ops and pass these to the
+          stream_setup_socket() call. */
+       model_ops = process_model_byname("single");
+       if (!model_ops) {
+               DEBUG(0,("Can't find 'single' process model_ops\n"));
+               return;
+       }
+
+       status = stream_setup_socket(ntp_signd->task->event_ctx, 
+                                    ntp_signd->task->lp_ctx,
+                                    model_ops, 
+                                    &ntp_signd_stream_ops, 
+                                    "unix", address, NULL,
+                                    lp_socket_options(ntp_signd->task->lp_ctx), 
+                                    ntp_signd);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0,("Failed to bind to %s - %s\n",
+                        address, nt_errstr(status)));
+               return;
+       }
+
+       task_server_set_title(task, "task[ntp_signd]");
+
+       ntp_signd = talloc(task, struct ntp_signd_server);
+       if (ntp_signd == NULL) {
+               task_server_terminate(task, "ntp_signd: out of memory");
+               return;
+       }
+
+       ntp_signd->task = task;
+
+       ntp_signd->samdb = samdb_connect(ntp_signd, task->event_ctx, task->lp_ctx, anonymous_session(ntp_signd, task->event_ctx, task->lp_ctx));
+       if (ntp_signd->samdb == NULL) {
+               task_server_terminate(task, "ntp_signd failed to open samdb");
+               return;
+       }
+
+}
+
+
+/* called at smbd startup - register ourselves as a server service */
+NTSTATUS server_service_ntp_signd_init(void)
+{
+       return register_server_service("ntp_signd", ntp_signd_task_init);
+}