source4/kdc/kdc-server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    KDC related functions
   5
   6    Copyright (c) 2005-2008 Andrew Bartlett <abartlet@samba.org>
   7    Copyright (c) 2005      Andrew Tridgell <tridge@samba.org>
   8    Copyright (c) 2005      Stefan Metzmacher <metze@samba.org>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "param/param.h"
  26 #include "smbd/process_model.h"
  27 #include "lib/tsocket/tsocket.h"
  28 #include "libcli/util/tstream.h"
  29 #include "kdc/kdc-server.h"
  30 #include "kdc/kdc-proxy.h"
  31 #include "lib/stream/packet.h"
  32
  33 /*
  34  * State of an open tcp connection
  35  */
  36 struct kdc_tcp_connection {
  37         /* stream connection we belong to */
  38         struct stream_connection *conn;
  39
  40         /* the kdc_server the connection belongs to */
  41         struct kdc_socket *kdc_socket;
  42
  43         struct tstream_context *tstream;
  44
  45         struct tevent_queue *send_queue;
  46 };
  47
  48 struct kdc_tcp_call {
  49         struct kdc_tcp_connection *kdc_conn;
  50         DATA_BLOB in;
  51         DATA_BLOB out;
  52         uint8_t out_hdr[4];
  53         struct iovec out_iov[2];
  54 };
  55
  56 struct kdc_udp_call {
  57         struct kdc_udp_socket *sock;
  58         struct tsocket_address *src;
  59         DATA_BLOB in;
  60         DATA_BLOB out;
  61 };
  62
  63 static void kdc_udp_call_proxy_done(struct tevent_req *subreq);
  64 static void kdc_udp_call_sendto_done(struct tevent_req *subreq);
  65
  66 static void kdc_tcp_call_writev_done(struct tevent_req *subreq);
  67 static void kdc_tcp_call_proxy_done(struct tevent_req *subreq);
  68
  69 static void kdc_tcp_terminate_connection(struct kdc_tcp_connection *kdc_conn,
  70                                          const char *reason)
  71 {
  72         stream_terminate_connection(kdc_conn->conn, reason);
  73 }
  74
  75 static NTSTATUS kdc_proxy_unavailable_error(struct kdc_server *kdc,
  76                                             TALLOC_CTX *mem_ctx,
  77                                             DATA_BLOB *out)
  78 {
  79         krb5_error_code code;
  80         krb5_data enc_error;
  81
  82         code = smb_krb5_mk_error(kdc->smb_krb5_context->krb5_context,
  83                                  KRB5KDC_ERR_SVC_UNAVAILABLE,
  84                                  NULL,
  85                                  NULL,
  86                                  &enc_error);
  87         if (code != 0) {
  88                 DBG_WARNING("Unable to form krb5 error reply\n");
  89                 return NT_STATUS_INTERNAL_ERROR;
  90         }
  91
  92         *out = data_blob_talloc(mem_ctx, enc_error.data, enc_error.length);
  93         kerberos_free_data_contents(kdc->smb_krb5_context->krb5_context,
  94                                     &enc_error);
  95         if (!out->data) {
  96                 return NT_STATUS_NO_MEMORY;
  97         }
  98
  99         return NT_STATUS_OK;
 100 }
 101
 102 static void kdc_udp_call_loop(struct tevent_req *subreq)
 103 {
 104         struct kdc_udp_socket *sock = tevent_req_callback_data(subreq,
 105                                       struct kdc_udp_socket);
 106         struct kdc_udp_call *call;
 107         uint8_t *buf;
 108         ssize_t len;
 109         int sys_errno;
 110         kdc_code ret;
 111
 112         call = talloc(sock, struct kdc_udp_call);
 113         if (call == NULL) {
 114                 talloc_free(call);
 115                 goto done;
 116         }
 117         call->sock = sock;
 118
 119         len = tdgram_recvfrom_recv(subreq, &sys_errno,
 120                                    call, &buf, &call->src);
 121         TALLOC_FREE(subreq);
 122         if (len == -1) {
 123                 talloc_free(call);
 124                 goto done;
 125         }
 126
 127         call->in.data = buf;
 128         call->in.length = len;
 129
 130         DEBUG(10,("Received krb5 UDP packet of length %lu from %s\n",
 131                  (long)call->in.length,
 132                  tsocket_address_string(call->src, call)));
 133
 134         /* Call krb5 */
 135         ret = sock->kdc_socket->process(sock->kdc_socket->kdc,
 136                                        call,
 137                                        &call->in,
 138                                        &call->out,
 139                                        call->src,
 140                                        sock->kdc_socket->local_address,
 141                                        1 /* Datagram */);
 142         if (ret == KDC_ERROR) {
 143                 talloc_free(call);
 144                 goto done;
 145         }
 146
 147         if (ret == KDC_PROXY_REQUEST) {
 148                 uint16_t port;
 149
 150                 if (!sock->kdc_socket->kdc->am_rodc) {
 151                         DEBUG(0,("kdc_udp_call_loop: proxying requested when not RODC"));
 152                         talloc_free(call);
 153                         goto done;
 154                 }
 155
 156                 port = tsocket_address_inet_port(sock->kdc_socket->local_address);
 157
 158                 subreq = kdc_udp_proxy_send(call,
 159                                             sock->kdc_socket->kdc->task->event_ctx,
 160                                             sock->kdc_socket->kdc,
 161                                             port,
 162                                             call->in);
 163                 if (subreq == NULL) {
 164                         talloc_free(call);
 165                         goto done;
 166                 }
 167                 tevent_req_set_callback(subreq, kdc_udp_call_proxy_done, call);
 168                 goto done;
 169         }
 170
 171         subreq = tdgram_sendto_queue_send(call,
 172                                           sock->kdc_socket->kdc->task->event_ctx,
 173                                           sock->dgram,
 174                                           sock->send_queue,
 175                                           call->out.data,
 176                                           call->out.length,
 177                                           call->src);
 178         if (subreq == NULL) {
 179                 talloc_free(call);
 180                 goto done;
 181         }
 182         tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call);
 183
 184 done:
 185         subreq = tdgram_recvfrom_send(sock,
 186                                       sock->kdc_socket->kdc->task->event_ctx,
 187                                       sock->dgram);
 188         if (subreq == NULL) {
 189                 task_server_terminate(sock->kdc_socket->kdc->task,
 190                                       "no memory for tdgram_recvfrom_send",
 191                                       true);
 192                 return;
 193         }
 194         tevent_req_set_callback(subreq, kdc_udp_call_loop, sock);
 195 }
 196
 197 static void kdc_udp_call_proxy_done(struct tevent_req *subreq)
 198 {
 199         struct kdc_udp_call *call =
 200                 tevent_req_callback_data(subreq,
 201                 struct kdc_udp_call);
 202         NTSTATUS status;
 203
 204         status = kdc_udp_proxy_recv(subreq, call, &call->out);
 205         TALLOC_FREE(subreq);
 206         if (!NT_STATUS_IS_OK(status)) {
 207                 /* generate an error packet */
 208                 status = kdc_proxy_unavailable_error(call->sock->kdc_socket->kdc,
 209                                                      call, &call->out);
 210         }
 211
 212         if (!NT_STATUS_IS_OK(status)) {
 213                 talloc_free(call);
 214                 return;
 215         }
 216
 217         subreq = tdgram_sendto_queue_send(call,
 218                                           call->sock->kdc_socket->kdc->task->event_ctx,
 219                                           call->sock->dgram,
 220                                           call->sock->send_queue,
 221                                           call->out.data,
 222                                           call->out.length,
 223                                           call->src);
 224         if (subreq == NULL) {
 225                 talloc_free(call);
 226                 return;
 227         }
 228
 229         tevent_req_set_callback(subreq, kdc_udp_call_sendto_done, call);
 230 }
 231
 232 static void kdc_udp_call_sendto_done(struct tevent_req *subreq)
 233 {
 234         struct kdc_udp_call *call = tevent_req_callback_data(subreq,
 235                                        struct kdc_udp_call);
 236         int sys_errno;
 237
 238         tdgram_sendto_queue_recv(subreq, &sys_errno);
 239
 240         /* We don't care about errors */
 241
 242         talloc_free(call);
 243 }
 244
 245 static void kdc_tcp_call_loop(struct tevent_req *subreq)
 246 {
 247         struct kdc_tcp_connection *kdc_conn = tevent_req_callback_data(subreq,
 248                                       struct kdc_tcp_connection);
 249         struct kdc_tcp_call *call;
 250         NTSTATUS status;
 251         kdc_code ret;
 252
 253         call = talloc(kdc_conn, struct kdc_tcp_call);
 254         if (call == NULL) {
 255                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
 256                                 "no memory for kdc_tcp_call");
 257                 return;
 258         }
 259         call->kdc_conn = kdc_conn;
 260
 261         status = tstream_read_pdu_blob_recv(subreq,
 262                                             call,
 263                                             &call->in);
 264         TALLOC_FREE(subreq);
 265         if (!NT_STATUS_IS_OK(status)) {
 266                 const char *reason;
 267
 268                 reason = talloc_asprintf(call, "kdc_tcp_call_loop: "
 269                                          "tstream_read_pdu_blob_recv() - %s",
 270                                          nt_errstr(status));
 271                 if (!reason) {
 272                         reason = nt_errstr(status);
 273                 }
 274
 275                 kdc_tcp_terminate_connection(kdc_conn, reason);
 276                 return;
 277         }
 278
 279         DEBUG(10,("Received krb5 TCP packet of length %lu from %s\n",
 280                  (long) call->in.length,
 281                  tsocket_address_string(kdc_conn->conn->remote_address, call)));
 282
 283         /* skip length header */
 284         call->in.data +=4;
 285         call->in.length -= 4;
 286
 287         /* Call krb5 */
 288         ret = kdc_conn->kdc_socket->process(kdc_conn->kdc_socket->kdc,
 289                                            call,
 290                                            &call->in,
 291                                            &call->out,
 292                                            kdc_conn->conn->remote_address,
 293                                            kdc_conn->conn->local_address,
 294                                            0 /* Stream */);
 295         if (ret == KDC_ERROR) {
 296                 kdc_tcp_terminate_connection(kdc_conn,
 297                                 "kdc_tcp_call_loop: process function failed");
 298                 return;
 299         }
 300
 301         if (ret == KDC_PROXY_REQUEST) {
 302                 uint16_t port;
 303
 304                 if (!kdc_conn->kdc_socket->kdc->am_rodc) {
 305                         kdc_tcp_terminate_connection(kdc_conn,
 306                                                      "kdc_tcp_call_loop: proxying requested when not RODC");
 307                         return;
 308                 }
 309                 port = tsocket_address_inet_port(kdc_conn->conn->local_address);
 310
 311                 subreq = kdc_tcp_proxy_send(call,
 312                                             kdc_conn->conn->event.ctx,
 313                                             kdc_conn->kdc_socket->kdc,
 314                                             port,
 315                                             call->in);
 316                 if (subreq == NULL) {
 317                         kdc_tcp_terminate_connection(kdc_conn,
 318                                 "kdc_tcp_call_loop: kdc_tcp_proxy_send failed");
 319                         return;
 320                 }
 321                 tevent_req_set_callback(subreq, kdc_tcp_call_proxy_done, call);
 322                 return;
 323         }
 324
 325         /* First add the length of the out buffer */
 326         RSIVAL(call->out_hdr, 0, call->out.length);
 327         call->out_iov[0].iov_base = (char *) call->out_hdr;
 328         call->out_iov[0].iov_len = 4;
 329
 330         call->out_iov[1].iov_base = (char *) call->out.data;
 331         call->out_iov[1].iov_len = call->out.length;
 332
 333         subreq = tstream_writev_queue_send(call,
 334                                            kdc_conn->conn->event.ctx,
 335                                            kdc_conn->tstream,
 336                                            kdc_conn->send_queue,
 337                                            call->out_iov, 2);
 338         if (subreq == NULL) {
 339                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
 340                                 "no memory for tstream_writev_queue_send");
 341                 return;
 342         }
 343         tevent_req_set_callback(subreq, kdc_tcp_call_writev_done, call);
 344
 345         /*
 346          * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
 347          * packet_full_request_u32 provides the pdu length then.
 348          */
 349         subreq = tstream_read_pdu_blob_send(kdc_conn,
 350                                             kdc_conn->conn->event.ctx,
 351                                             kdc_conn->tstream,
 352                                             4, /* initial_read_size */
 353                                             packet_full_request_u32,
 354                                             kdc_conn);
 355         if (subreq == NULL) {
 356                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
 357                                 "no memory for tstream_read_pdu_blob_send");
 358                 return;
 359         }
 360         tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
 361 }
 362
 363 static void kdc_tcp_call_proxy_done(struct tevent_req *subreq)
 364 {
 365         struct kdc_tcp_call *call = tevent_req_callback_data(subreq,
 366                         struct kdc_tcp_call);
 367         struct kdc_tcp_connection *kdc_conn = call->kdc_conn;
 368         NTSTATUS status;
 369
 370         status = kdc_tcp_proxy_recv(subreq, call, &call->out);
 371         TALLOC_FREE(subreq);
 372         if (!NT_STATUS_IS_OK(status)) {
 373                 /* generate an error packet */
 374                 status = kdc_proxy_unavailable_error(kdc_conn->kdc_socket->kdc,
 375                                                      call, &call->out);
 376         }
 377
 378         if (!NT_STATUS_IS_OK(status)) {
 379                 const char *reason;
 380
 381                 reason = talloc_asprintf(call, "kdc_tcp_call_proxy_done: "
 382                                          "kdc_proxy_unavailable_error - %s",
 383                                          nt_errstr(status));
 384                 if (!reason) {
 385                         reason = "kdc_tcp_call_proxy_done: kdc_proxy_unavailable_error() failed";
 386                 }
 387
 388                 kdc_tcp_terminate_connection(call->kdc_conn, reason);
 389                 return;
 390         }
 391
 392         /* First add the length of the out buffer */
 393         RSIVAL(call->out_hdr, 0, call->out.length);
 394         call->out_iov[0].iov_base = (char *) call->out_hdr;
 395         call->out_iov[0].iov_len = 4;
 396
 397         call->out_iov[1].iov_base = (char *) call->out.data;
 398         call->out_iov[1].iov_len = call->out.length;
 399
 400         subreq = tstream_writev_queue_send(call,
 401                                            kdc_conn->conn->event.ctx,
 402                                            kdc_conn->tstream,
 403                                            kdc_conn->send_queue,
 404                                            call->out_iov, 2);
 405         if (subreq == NULL) {
 406                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
 407                                 "no memory for tstream_writev_queue_send");
 408                 return;
 409         }
 410         tevent_req_set_callback(subreq, kdc_tcp_call_writev_done, call);
 411
 412         /*
 413          * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
 414          * packet_full_request_u32 provides the pdu length then.
 415          */
 416         subreq = tstream_read_pdu_blob_send(kdc_conn,
 417                                             kdc_conn->conn->event.ctx,
 418                                             kdc_conn->tstream,
 419                                             4, /* initial_read_size */
 420                                             packet_full_request_u32,
 421                                             kdc_conn);
 422         if (subreq == NULL) {
 423                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_call_loop: "
 424                                 "no memory for tstream_read_pdu_blob_send");
 425                 return;
 426         }
 427         tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
 428 }
 429
 430 static void kdc_tcp_call_writev_done(struct tevent_req *subreq)
 431 {
 432         struct kdc_tcp_call *call = tevent_req_callback_data(subreq,
 433                         struct kdc_tcp_call);
 434         int sys_errno;
 435         int rc;
 436
 437         rc = tstream_writev_queue_recv(subreq, &sys_errno);
 438         TALLOC_FREE(subreq);
 439         if (rc == -1) {
 440                 const char *reason;
 441
 442                 reason = talloc_asprintf(call, "kdc_tcp_call_writev_done: "
 443                                          "tstream_writev_queue_recv() - %d:%s",
 444                                          sys_errno, strerror(sys_errno));
 445                 if (!reason) {
 446                         reason = "kdc_tcp_call_writev_done: tstream_writev_queue_recv() failed";
 447                 }
 448
 449                 kdc_tcp_terminate_connection(call->kdc_conn, reason);
 450                 return;
 451         }
 452
 453         /* We don't care about errors */
 454
 455         talloc_free(call);
 456 }
 457
 458 /*
 459   called when we get a new connection
 460 */
 461 static void kdc_tcp_accept(struct stream_connection *conn)
 462 {
 463         struct kdc_socket *kdc_socket;
 464         struct kdc_tcp_connection *kdc_conn;
 465         struct tevent_req *subreq;
 466         int rc;
 467
 468         kdc_conn = talloc_zero(conn, struct kdc_tcp_connection);
 469         if (kdc_conn == NULL) {
 470                 stream_terminate_connection(conn,
 471                                 "kdc_tcp_accept: out of memory");
 472                 return;
 473         }
 474
 475         kdc_conn->send_queue = tevent_queue_create(conn, "kdc_tcp_accept");
 476         if (kdc_conn->send_queue == NULL) {
 477                 stream_terminate_connection(conn,
 478                                 "kdc_tcp_accept: out of memory");
 479                 return;
 480         }
 481
 482         kdc_socket = talloc_get_type(conn->private_data, struct kdc_socket);
 483
 484         TALLOC_FREE(conn->event.fde);
 485
 486         rc = tstream_bsd_existing_socket(kdc_conn,
 487                         socket_get_fd(conn->socket),
 488                         &kdc_conn->tstream);
 489         if (rc < 0) {
 490                 stream_terminate_connection(conn,
 491                                 "kdc_tcp_accept: out of memory");
 492                 return;
 493         }
 494
 495         kdc_conn->conn = conn;
 496         kdc_conn->kdc_socket = kdc_socket;
 497         conn->private_data = kdc_conn;
 498
 499         /*
 500          * The krb5 tcp pdu's has the length as 4 byte (initial_read_size),
 501          * packet_full_request_u32 provides the pdu length then.
 502          */
 503         subreq = tstream_read_pdu_blob_send(kdc_conn,
 504                                             kdc_conn->conn->event.ctx,
 505                                             kdc_conn->tstream,
 506                                             4, /* initial_read_size */
 507                                             packet_full_request_u32,
 508                                             kdc_conn);
 509         if (subreq == NULL) {
 510                 kdc_tcp_terminate_connection(kdc_conn, "kdc_tcp_accept: "
 511                                 "no memory for tstream_read_pdu_blob_send");
 512                 return;
 513         }
 514         tevent_req_set_callback(subreq, kdc_tcp_call_loop, kdc_conn);
 515 }
 516
 517 static void kdc_tcp_recv(struct stream_connection *conn, uint16_t flags)
 518 {
 519         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
 520                                                              struct kdc_tcp_connection);
 521         /* this should never be triggered! */
 522         kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_recv: called");
 523 }
 524
 525 static void kdc_tcp_send(struct stream_connection *conn, uint16_t flags)
 526 {
 527         struct kdc_tcp_connection *kdcconn = talloc_get_type(conn->private_data,
 528                                                              struct kdc_tcp_connection);
 529         /* this should never be triggered! */
 530         kdc_tcp_terminate_connection(kdcconn, "kdc_tcp_send: called");
 531 }
 532
 533 static const struct stream_server_ops kdc_tcp_stream_ops = {
 534         .name                   = "kdc_tcp",
 535         .accept_connection      = kdc_tcp_accept,
 536         .recv_handler           = kdc_tcp_recv,
 537         .send_handler           = kdc_tcp_send
 538 };
 539
 540 /*
 541  * Start listening on the given address
 542  */
 543 NTSTATUS kdc_add_socket(struct kdc_server *kdc,
 544                         const struct model_ops *model_ops,
 545                         const char *name,
 546                         const char *address,
 547                         uint16_t port,
 548                         kdc_process_fn_t process,
 549                         bool udp_only)
 550 {
 551         struct kdc_socket *kdc_socket;
 552         struct kdc_udp_socket *kdc_udp_socket;
 553         struct tevent_req *udpsubreq;
 554         NTSTATUS status;
 555         int ret;
 556
 557         kdc_socket = talloc(kdc, struct kdc_socket);
 558         NT_STATUS_HAVE_NO_MEMORY(kdc_socket);
 559
 560         kdc_socket->kdc = kdc;
 561         kdc_socket->process = process;
 562
 563         ret = tsocket_address_inet_from_strings(kdc_socket, "ip",
 564                                                 address, port,
 565                                                 &kdc_socket->local_address);
 566         if (ret != 0) {
 567                 status = map_nt_error_from_unix_common(errno);
 568                 return status;
 569         }
 570
 571         if (!udp_only) {
 572                 status = stream_setup_socket(kdc->task,
 573                                              kdc->task->event_ctx,
 574                                              kdc->task->lp_ctx,
 575                                              model_ops,
 576                                              &kdc_tcp_stream_ops,
 577                                              "ip", address, &port,
 578                                              lpcfg_socket_options(kdc->task->lp_ctx),
 579                                              kdc_socket);
 580                 if (!NT_STATUS_IS_OK(status)) {
 581                         DEBUG(0,("Failed to bind to %s:%u TCP - %s\n",
 582                                  address, port, nt_errstr(status)));
 583                         talloc_free(kdc_socket);
 584                         return status;
 585                 }
 586         }
 587
 588         kdc_udp_socket = talloc(kdc_socket, struct kdc_udp_socket);
 589         NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket);
 590
 591         kdc_udp_socket->kdc_socket = kdc_socket;
 592
 593         ret = tdgram_inet_udp_socket(kdc_socket->local_address,
 594                                      NULL,
 595                                      kdc_udp_socket,
 596                                      &kdc_udp_socket->dgram);
 597         if (ret != 0) {
 598                 status = map_nt_error_from_unix_common(errno);
 599                 DEBUG(0,("Failed to bind to %s:%u UDP - %s\n",
 600                          address, port, nt_errstr(status)));
 601                 return status;
 602         }
 603
 604         kdc_udp_socket->send_queue = tevent_queue_create(kdc_udp_socket,
 605                                                          "kdc_udp_send_queue");
 606         NT_STATUS_HAVE_NO_MEMORY(kdc_udp_socket->send_queue);
 607
 608         udpsubreq = tdgram_recvfrom_send(kdc_udp_socket,
 609                                          kdc->task->event_ctx,
 610                                          kdc_udp_socket->dgram);
 611         NT_STATUS_HAVE_NO_MEMORY(udpsubreq);
 612         tevent_req_set_callback(udpsubreq, kdc_udp_call_loop, kdc_udp_socket);
 613
 614         return NT_STATUS_OK;
 615 }