source3/libnet/libnet_dssync_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Guenther Deschner <gd@samba.org> 2008
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libnet/libnet.h"
  22 #include "librpc/gen_ndr/ndr_drsblobs.h"
  23
  24 #if defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC)
  25
  26 static NTSTATUS add_to_keytab_entries(TALLOC_CTX *mem_ctx,
  27                                       struct libnet_keytab_context *ctx,
  28                                       uint32_t kvno,
  29                                       const char *name,
  30                                       const char *prefix,
  31                                       DATA_BLOB blob)
  32 {
  33         struct libnet_keytab_entry entry;
  34
  35         entry.kvno = kvno;
  36         entry.name = talloc_strdup(mem_ctx, name);
  37         entry.principal = talloc_asprintf(mem_ctx, "%s%s%s@%s",
  38                                           prefix ? prefix : "",
  39                                           prefix ? "/" : "",
  40                                           name, ctx->dns_domain_name);
  41         entry.password = blob;
  42         NT_STATUS_HAVE_NO_MEMORY(entry.name);
  43         NT_STATUS_HAVE_NO_MEMORY(entry.principal);
  44         NT_STATUS_HAVE_NO_MEMORY(entry.password.data);
  45
  46         ADD_TO_ARRAY(mem_ctx, struct libnet_keytab_entry, entry,
  47                      &ctx->entries, &ctx->count);
  48         NT_STATUS_HAVE_NO_MEMORY(ctx->entries);
  49
  50         return NT_STATUS_OK;
  51 }
  52
  53 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
  54                                struct replUpToDateVectorBlob **pold_utdv)
  55 {
  56         krb5_error_code ret = 0;
  57         struct libnet_keytab_context *keytab_ctx;
  58         struct libnet_keytab_entry *entry;
  59         struct replUpToDateVectorBlob *old_utdv = NULL;
  60         char *principal;
  61
  62         ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
  63         if (ret) {
  64                 return krb5_to_nt_status(ret);
  65         }
  66
  67         keytab_ctx->dns_domain_name = ctx->dns_domain_name;
  68         ctx->private_data = keytab_ctx;
  69
  70         principal = talloc_asprintf(mem_ctx, "UTDV/%s@%s",
  71                                     ctx->nc_dn, ctx->dns_domain_name);
  72         NT_STATUS_HAVE_NO_MEMORY(principal);
  73
  74         entry = libnet_keytab_search(keytab_ctx, principal, 0, mem_ctx);
  75         if (entry) {
  76                 enum ndr_err_code ndr_err;
  77                 old_utdv = talloc(mem_ctx, struct replUpToDateVectorBlob);
  78
  79                 ndr_err = ndr_pull_struct_blob(&entry->password, old_utdv,
  80                                 old_utdv,
  81                                 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
  82                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  83                         NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
  84                         ctx->error_message = talloc_asprintf(mem_ctx,
  85                                         "Failed to pull UpToDateVector: %s",
  86                                         nt_errstr(status));
  87                         return status;
  88                 }
  89
  90                 if (DEBUGLEVEL >= 10) {
  91                         NDR_PRINT_DEBUG(replUpToDateVectorBlob, old_utdv);
  92                 }
  93         }
  94
  95         if (pold_utdv) {
  96                 *pold_utdv = old_utdv;
  97         }
  98
  99         return NT_STATUS_OK;
 100 }
 101
 102 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 103                               struct replUpToDateVectorBlob *new_utdv)
 104 {
 105         NTSTATUS status = NT_STATUS_OK;
 106         krb5_error_code ret = 0;
 107         struct libnet_keytab_context *keytab_ctx =
 108                 (struct libnet_keytab_context *)ctx->private_data;
 109
 110         if (new_utdv) {
 111                 enum ndr_err_code ndr_err;
 112                 DATA_BLOB blob;
 113
 114                 if (DEBUGLEVEL >= 10) {
 115                         NDR_PRINT_DEBUG(replUpToDateVectorBlob, new_utdv);
 116                 }
 117
 118                 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, new_utdv,
 119                                 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
 120                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 121                         status = ndr_map_error2ntstatus(ndr_err);
 122                         ctx->error_message = talloc_asprintf(mem_ctx,
 123                                         "Failed to push UpToDateVector: %s",
 124                                         nt_errstr(status));
 125                         goto done;
 126                 }
 127
 128                 status = add_to_keytab_entries(mem_ctx, keytab_ctx, 0,
 129                                                ctx->nc_dn, "UTDV", blob);
 130                 if (!NT_STATUS_IS_OK(status)) {
 131                         goto done;
 132                 }
 133         }
 134
 135         ret = libnet_keytab_add(keytab_ctx);
 136         if (ret) {
 137                 status = krb5_to_nt_status(ret);
 138                 ctx->error_message = talloc_asprintf(mem_ctx,
 139                         "Failed to add entries to keytab %s: %s",
 140                         keytab_ctx->keytab_name, error_message(ret));
 141                 goto done;
 142         }
 143
 144         ctx->result_message = talloc_asprintf(mem_ctx,
 145                 "Vampired %d accounts to keytab %s",
 146                 keytab_ctx->count,
 147                 keytab_ctx->keytab_name);
 148
 149 done:
 150         TALLOC_FREE(keytab_ctx);
 151         return status;
 152 }
 153
 154 /****************************************************************
 155 ****************************************************************/
 156
 157 static NTSTATUS parse_object(TALLOC_CTX *mem_ctx,
 158                              struct libnet_keytab_context *ctx,
 159                              struct drsuapi_DsReplicaObjectListItemEx *cur)
 160 {
 161         NTSTATUS status = NT_STATUS_OK;
 162         uchar nt_passwd[16];
 163         DATA_BLOB *blob;
 164         int i = 0;
 165         struct drsuapi_DsReplicaAttribute *attr;
 166         bool got_pwd = false;
 167
 168         char *upn = NULL;
 169         char *name = NULL;
 170         uint32_t kvno = 0;
 171         uint32_t uacc = 0;
 172         uint32_t sam_type = 0;
 173
 174         uint32_t pwd_history_len = 0;
 175         uint8_t *pwd_history = NULL;
 176
 177         ZERO_STRUCT(nt_passwd);
 178
 179         for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
 180
 181                 attr = &cur->object.attribute_ctr.attributes[i];
 182
 183                 if (attr->value_ctr.num_values != 1) {
 184                         continue;
 185                 }
 186
 187                 if (!attr->value_ctr.values[0].blob) {
 188                         continue;
 189                 }
 190
 191                 blob = attr->value_ctr.values[0].blob;
 192
 193                 switch (attr->attid) {
 194                         case DRSUAPI_ATTRIBUTE_unicodePwd:
 195
 196                                 if (blob->length != 16) {
 197                                         break;
 198                                 }
 199
 200                                 memcpy(&nt_passwd, blob->data, 16);
 201                                 got_pwd = true;
 202
 203                                 /* pick the kvno from the meta_data version,
 204                                  * thanks, metze, for explaining this */
 205
 206                                 if (!cur->meta_data_ctr) {
 207                                         break;
 208                                 }
 209                                 if (cur->meta_data_ctr->count !=
 210                                     cur->object.attribute_ctr.num_attributes) {
 211                                         break;
 212                                 }
 213                                 kvno = cur->meta_data_ctr->meta_data[i].version;
 214                                 break;
 215                         case DRSUAPI_ATTRIBUTE_ntPwdHistory:
 216                                 pwd_history_len = blob->length / 16;
 217                                 pwd_history = blob->data;
 218                                 break;
 219                         case DRSUAPI_ATTRIBUTE_msDS_KeyVersionNumber:
 220                                 kvno = IVAL(blob->data, 0);
 221                                 break;
 222                         case DRSUAPI_ATTRIBUTE_userPrincipalName:
 223                                 pull_string_talloc(mem_ctx, NULL, 0, &upn,
 224                                                    blob->data, blob->length,
 225                                                    STR_UNICODE);
 226                                 break;
 227                         case DRSUAPI_ATTRIBUTE_sAMAccountName:
 228                                 pull_string_talloc(mem_ctx, NULL, 0, &name,
 229                                                    blob->data, blob->length,
 230                                                    STR_UNICODE);
 231                                 break;
 232                         case DRSUAPI_ATTRIBUTE_sAMAccountType:
 233                                 sam_type = IVAL(blob->data, 0);
 234                                 break;
 235                         case DRSUAPI_ATTRIBUTE_userAccountControl:
 236                                 uacc = IVAL(blob->data, 0);
 237                                 break;
 238                         default:
 239                                 break;
 240                 }
 241         }
 242
 243         if (!got_pwd || !name) {
 244                 return NT_STATUS_OK;
 245         }
 246
 247         DEBUG(1,("#%02d: %s:%d, ", ctx->count, name, kvno));
 248         DEBUGADD(1,("sAMAccountType: 0x%08x, userAccountControl: 0x%08x ",
 249                 sam_type, uacc));
 250         if (upn) {
 251                 DEBUGADD(1,("upn: %s", upn));
 252         }
 253         DEBUGADD(1,("\n"));
 254
 255         status = add_to_keytab_entries(mem_ctx, ctx, kvno, name, NULL,
 256                                        data_blob_talloc(mem_ctx, nt_passwd, 16));
 257
 258         if (!NT_STATUS_IS_OK(status)) {
 259                 return status;
 260         }
 261
 262         if ((kvno < 0) && (kvno < pwd_history_len)) {
 263                 return status;
 264         }
 265
 266         /* add password history */
 267
 268         /* skip first entry */
 269         if (got_pwd) {
 270                 kvno--;
 271                 i = 1;
 272         } else {
 273                 i = 0;
 274         }
 275
 276         for (; i<pwd_history_len; i++) {
 277                 status = add_to_keytab_entries(mem_ctx, ctx, kvno--, name, NULL,
 278                                 data_blob_talloc(mem_ctx, &pwd_history[i*16], 16));
 279                 if (!NT_STATUS_IS_OK(status)) {
 280                         break;
 281                 }
 282         }
 283
 284         return status;
 285 }
 286
 287 /****************************************************************
 288 ****************************************************************/
 289
 290 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
 291                                        TALLOC_CTX *mem_ctx,
 292                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
 293                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
 294 {
 295         NTSTATUS status = NT_STATUS_OK;
 296         struct libnet_keytab_context *keytab_ctx =
 297                 (struct libnet_keytab_context *)ctx->private_data;
 298
 299         for (; cur; cur = cur->next_object) {
 300                 status = parse_object(mem_ctx, keytab_ctx, cur);
 301                 if (!NT_STATUS_IS_OK(status)) {
 302                         goto out;
 303                 }
 304         }
 305
 306  out:
 307         return status;
 308 }
 309
 310 #else
 311
 312 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 313                                struct replUpToDateVectorBlob **pold_utdv)
 314 {
 315         return NT_STATUS_NOT_SUPPORTED;
 316 }
 317
 318 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 319                               struct replUpToDateVectorBlob *new_utdv)
 320 {
 321         return NT_STATUS_NOT_SUPPORTED;
 322 }
 323
 324 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
 325                                        TALLOC_CTX *mem_ctx,
 326                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
 327                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
 328 {
 329         return NT_STATUS_NOT_SUPPORTED;
 330 }
 331 #endif /* defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC) */
 332
 333 const struct dssync_ops libnet_dssync_keytab_ops = {
 334         .startup                = keytab_startup,
 335         .process_objects        = keytab_process_objects,
 336         .finish                 = keytab_finish,
 337 };