source3/libnet/libnet_dssync_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Guenther Deschner <gd@samba.org> 2008
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libnet/libnet.h"
  22
  23 #if defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC)
  24
  25 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx)
  26 {
  27         krb5_error_code ret = 0;
  28         struct libnet_keytab_context *keytab_ctx;
  29
  30         ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
  31         if (ret) {
  32                 return krb5_to_nt_status(ret);
  33         }
  34
  35         keytab_ctx->dns_domain_name = ctx->dns_domain_name;
  36         ctx->private_data = keytab_ctx;
  37
  38         return NT_STATUS_OK;
  39 }
  40
  41 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx)
  42 {
  43         NTSTATUS status = NT_STATUS_OK;
  44         krb5_error_code ret = 0;
  45         struct libnet_keytab_context *keytab_ctx =
  46                 (struct libnet_keytab_context *)ctx->private_data;
  47
  48         ret = libnet_keytab_add(keytab_ctx);
  49         if (ret) {
  50                 status = krb5_to_nt_status(ret);
  51                 ctx->error_message = talloc_asprintf(mem_ctx,
  52                         "Failed to add entries to keytab %s: %s",
  53                         keytab_ctx->keytab_name, error_message(ret));
  54                 goto done;
  55         }
  56
  57         ctx->result_message = talloc_asprintf(mem_ctx,
  58                 "Vampired %d accounts to keytab %s",
  59                 keytab_ctx->count,
  60                 keytab_ctx->keytab_name);
  61
  62 done:
  63         TALLOC_FREE(keytab_ctx);
  64         return status;
  65 }
  66
  67 /****************************************************************
  68 ****************************************************************/
  69
  70 static NTSTATUS parse_object(TALLOC_CTX *mem_ctx,
  71                              struct libnet_keytab_context *ctx,
  72                              struct drsuapi_DsReplicaObjectListItemEx *cur)
  73 {
  74         NTSTATUS status = NT_STATUS_OK;
  75         uchar nt_passwd[16];
  76         struct libnet_keytab_entry entry;
  77         DATA_BLOB *blob;
  78         int i = 0;
  79         struct drsuapi_DsReplicaAttribute *attr;
  80         bool got_pwd = false;
  81
  82         char *upn = NULL;
  83         char *name = NULL;
  84         uint32_t kvno = 0;
  85         uint32_t uacc = 0;
  86         uint32_t sam_type = 0;
  87
  88         uint32_t pwd_history_len = 0;
  89         uint8_t *pwd_history = NULL;
  90
  91         ZERO_STRUCT(nt_passwd);
  92
  93         for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
  94
  95                 attr = &cur->object.attribute_ctr.attributes[i];
  96
  97                 if (attr->value_ctr.num_values != 1) {
  98                         continue;
  99                 }
 100
 101                 if (!attr->value_ctr.values[0].blob) {
 102                         continue;
 103                 }
 104
 105                 blob = attr->value_ctr.values[0].blob;
 106
 107                 switch (attr->attid) {
 108                         case DRSUAPI_ATTRIBUTE_unicodePwd:
 109
 110                                 if (blob->length != 16) {
 111                                         break;
 112                                 }
 113
 114                                 memcpy(&nt_passwd, blob->data, 16);
 115                                 got_pwd = true;
 116
 117                                 /* pick the kvno from the meta_data version,
 118                                  * thanks, metze, for explaining this */
 119
 120                                 if (!cur->meta_data_ctr) {
 121                                         break;
 122                                 }
 123                                 if (cur->meta_data_ctr->count !=
 124                                     cur->object.attribute_ctr.num_attributes) {
 125                                         break;
 126                                 }
 127                                 kvno = cur->meta_data_ctr->meta_data[i].version;
 128                                 break;
 129                         case DRSUAPI_ATTRIBUTE_ntPwdHistory:
 130                                 pwd_history_len = blob->length / 16;
 131                                 pwd_history = blob->data;
 132                                 break;
 133                         case DRSUAPI_ATTRIBUTE_msDS_KeyVersionNumber:
 134                                 kvno = IVAL(blob->data, 0);
 135                                 break;
 136                         case DRSUAPI_ATTRIBUTE_userPrincipalName:
 137                                 pull_string_talloc(mem_ctx, NULL, 0, &upn,
 138                                                    blob->data, blob->length,
 139                                                    STR_UNICODE);
 140                                 break;
 141                         case DRSUAPI_ATTRIBUTE_sAMAccountName:
 142                                 pull_string_talloc(mem_ctx, NULL, 0, &name,
 143                                                    blob->data, blob->length,
 144                                                    STR_UNICODE);
 145                                 break;
 146                         case DRSUAPI_ATTRIBUTE_sAMAccountType:
 147                                 sam_type = IVAL(blob->data, 0);
 148                                 break;
 149                         case DRSUAPI_ATTRIBUTE_userAccountControl:
 150                                 uacc = IVAL(blob->data, 0);
 151                                 break;
 152                         default:
 153                                 break;
 154                 }
 155         }
 156
 157         if (!got_pwd || !name) {
 158                 return NT_STATUS_OK;
 159         }
 160
 161         DEBUG(1,("#%02d: %s:%d, ", ctx->count, name, kvno));
 162         DEBUGADD(1,("sAMAccountType: 0x%08x, userAccountControl: 0x%08x ",
 163                 sam_type, uacc));
 164         if (upn) {
 165                 DEBUGADD(1,("upn: %s", upn));
 166         }
 167         DEBUGADD(1,("\n"));
 168
 169         entry.kvno = kvno;
 170         entry.name = talloc_strdup(mem_ctx, name);
 171         entry.principal = talloc_asprintf(mem_ctx, "%s@%s",
 172                                           name, ctx->dns_domain_name);
 173         entry.password = data_blob_talloc(mem_ctx, nt_passwd, 16);
 174         NT_STATUS_HAVE_NO_MEMORY(entry.name);
 175         NT_STATUS_HAVE_NO_MEMORY(entry.principal);
 176         NT_STATUS_HAVE_NO_MEMORY(entry.password.data);
 177
 178         ADD_TO_ARRAY(mem_ctx, struct libnet_keytab_entry, entry,
 179                      &ctx->entries, &ctx->count);
 180
 181         if ((kvno < 0) && (kvno < pwd_history_len)) {
 182                 return status;
 183         }
 184
 185         /* add password history */
 186
 187         /* skip first entry */
 188         if (got_pwd) {
 189                 kvno--;
 190                 i = 1;
 191         } else {
 192                 i = 0;
 193         }
 194
 195         for (; i<pwd_history_len; i++) {
 196
 197                 entry.kvno = kvno--;
 198                 entry.name = talloc_strdup(mem_ctx, name);
 199                 entry.principal = talloc_asprintf(mem_ctx, "%s@%s",
 200                                                   name, ctx->dns_domain_name);
 201                 entry.password = data_blob_talloc(mem_ctx, &pwd_history[i*16], 16);
 202                 NT_STATUS_HAVE_NO_MEMORY(entry.name);
 203                 NT_STATUS_HAVE_NO_MEMORY(entry.principal);
 204                 NT_STATUS_HAVE_NO_MEMORY(entry.password.data);
 205
 206                 ADD_TO_ARRAY(mem_ctx, struct libnet_keytab_entry, entry,
 207                              &ctx->entries, &ctx->count);
 208         }
 209
 210         return status;
 211 }
 212
 213 /****************************************************************
 214 ****************************************************************/
 215
 216 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
 217                                        TALLOC_CTX *mem_ctx,
 218                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
 219                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
 220 {
 221         NTSTATUS status = NT_STATUS_OK;
 222         struct libnet_keytab_context *keytab_ctx =
 223                 (struct libnet_keytab_context *)ctx->private_data;
 224
 225         for (; cur; cur = cur->next_object) {
 226                 status = parse_object(mem_ctx, keytab_ctx, cur);
 227                 if (!NT_STATUS_IS_OK(status)) {
 228                         goto out;
 229                 }
 230         }
 231
 232  out:
 233         return status;
 234 }
 235
 236 #else
 237
 238 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx)
 239 {
 240         return NT_STATUS_NOT_SUPPORTED;
 241 }
 242
 243 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx)
 244 {
 245         return NT_STATUS_NOT_SUPPORTED;
 246 }
 247
 248 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
 249                                        TALLOC_CTX *mem_ctx,
 250                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
 251                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
 252 {
 253         return NT_STATUS_NOT_SUPPORTED;
 254 }
 255 #endif /* defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC) */
 256
 257 const struct dssync_ops libnet_dssync_keytab_ops = {
 258         .startup                = keytab_startup,
 259         .process_objects        = keytab_process_objects,
 260         .finish                 = keytab_finish,
 261 };