2 Unix SMB/CIFS implementation.
4 Samba KDB plugin for MIT Kerberos
6 Copyright (c) 2010 Simo Sorce <idra@samba.org>.
7 Copyright (c) 2014 Andreas Schneider <asn@samba.org>
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "system/kerberos.h"
30 #include "kdc/mit_samba.h"
31 #include "kdb_samba.h"
33 /* FIXME: This is a krb5 function which is exported, but in no header */
34 extern krb5_error_code decode_krb5_padata_sequence(const krb5_data *output,
37 static krb5_error_code ks_get_netbios_name(krb5_address **addrs, char **name)
42 for (i = 0; addrs[i]; i++) {
43 if (addrs[i]->addrtype != ADDRTYPE_NETBIOS) {
46 len = MIN(addrs[i]->length, 15);
47 nb_name = strndup((const char *)addrs[i]->contents, len);
55 /* Strip space padding */
56 i = strlen(nb_name) - 1;
57 for (i = strlen(nb_name) - 1;
58 i > 0 && nb_name[i] == ' ';
69 krb5_error_code kdb_samba_db_check_policy_as(krb5_context context,
71 krb5_db_entry *client,
72 krb5_db_entry *server,
73 krb5_timestamp kdc_time,
75 krb5_pa_data ***e_data_out)
77 struct mit_samba_context *mit_ctx;
79 char *client_name = NULL;
80 char *server_name = NULL;
81 char *netbios_name = NULL;
83 bool password_change = false;
84 DATA_BLOB int_data = { NULL, 0 };
86 krb5_pa_data **e_data;
88 mit_ctx = ks_get_context(context);
89 if (mit_ctx == NULL) {
90 return KRB5_KDB_DBNOTINITED;
93 if (ks_is_kadmin(context, kdcreq->client)) {
94 return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
97 if (krb5_princ_size(context, kdcreq->server) == 2 &&
98 ks_is_kadmin_changepw(context, kdcreq->server)) {
99 code = krb5_get_default_realm(context, &realm);
104 if (ks_data_eq_string(kdcreq->server->realm, realm)) {
105 password_change = true;
109 code = krb5_unparse_name(context, kdcreq->server, &server_name);
114 code = krb5_unparse_name(context, kdcreq->client, &client_name);
119 if (kdcreq->addresses) {
120 code = ks_get_netbios_name(kdcreq->addresses, &netbios_name);
126 code = mit_samba_check_client_access(mit_ctx,
135 if (int_data.length && int_data.data) {
137 /* make sure the mapped return code is returned - gd */
140 d = ks_make_data(int_data.data, int_data.length);
142 code_tmp = decode_krb5_padata_sequence(&d, &e_data);
144 *e_data_out = e_data;
156 static krb5_error_code ks_get_pac(krb5_context context,
157 krb5_db_entry *client,
158 krb5_keyblock *client_key,
161 struct mit_samba_context *mit_ctx;
162 krb5_error_code code;
164 mit_ctx = ks_get_context(context);
165 if (mit_ctx == NULL) {
166 return KRB5_KDB_DBNOTINITED;
169 code = mit_samba_get_pac(mit_ctx,
181 static krb5_error_code ks_verify_pac(krb5_context context,
183 krb5_const_principal client_princ,
184 krb5_db_entry *client,
185 krb5_db_entry *server,
186 krb5_db_entry *krbtgt,
187 krb5_keyblock *server_key,
188 krb5_keyblock *krbtgt_key,
189 krb5_timestamp authtime,
190 krb5_authdata **tgt_auth_data,
193 struct mit_samba_context *mit_ctx;
194 krb5_authdata **authdata = NULL;
195 krb5_pac ipac = NULL;
196 DATA_BLOB logon_data = { NULL, 0 };
197 krb5_error_code code;
199 mit_ctx = ks_get_context(context);
200 if (mit_ctx == NULL) {
201 return KRB5_KDB_DBNOTINITED;
204 /* find the existing PAC, if present */
205 code = krb5_find_authdata(context,
208 KRB5_AUTHDATA_WIN2K_PAC,
215 if (authdata == NULL) {
219 SMB_ASSERT(authdata[0] != NULL);
221 if (authdata[1] != NULL) {
222 code = KRB5KDC_ERR_BADOPTION; /* XXX */
226 code = krb5_pac_parse(context,
227 authdata[0]->contents,
234 /* TODO: verify this is correct
236 * In the constrained delegation case, the PAC is from a service
237 * ticket rather than a TGT; we must verify the server and KDC
238 * signatures to assert that the server did not forge the PAC.
240 if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
241 code = krb5_pac_verify(context,
248 code = krb5_pac_verify(context,
259 /* check and update PAC */
260 code = krb5_pac_parse(context,
261 authdata[0]->contents,
268 code = mit_samba_reget_pac(mit_ctx,
279 krb5_free_authdata(context, authdata);
280 krb5_pac_free(context, ipac);
281 free(logon_data.data);
286 krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
288 krb5_const_principal client_princ,
289 krb5_db_entry *client,
290 krb5_db_entry *server,
291 krb5_db_entry *krbtgt,
292 krb5_keyblock *client_key,
293 krb5_keyblock *server_key,
294 krb5_keyblock *krbtgt_key,
295 krb5_keyblock *session_key,
296 krb5_timestamp authtime,
297 krb5_authdata **tgt_auth_data,
298 krb5_authdata ***signed_auth_data)
300 krb5_const_principal ks_client_princ;
301 krb5_authdata **authdata = NULL;
302 krb5_boolean is_as_req;
303 krb5_error_code code;
307 /* Prefer canonicalised name from client entry */
308 if (client != NULL) {
309 ks_client_princ = client->princ;
311 ks_client_princ = client_princ;
314 is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
316 if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) {
317 code = ks_get_pac(context, client, client_key, &pac);
324 code = ks_verify_pac(context,
340 if (pac == NULL && client != NULL) {
342 code = ks_get_pac(context, client, client_key, &pac);
349 code = KRB5_KDB_DBTYPE_NOSUP;
353 code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
354 server_key, krbtgt_key, &pac_data);
356 DBG_ERR("krb5_pac_sign failed: %d\n", code);
360 authdata = calloc(2, sizeof(krb5_authdata *));
361 if (authdata == NULL) {
365 authdata[0] = malloc(sizeof(krb5_authdata));
366 if (authdata[0] == NULL) {
370 /* put in signed data */
371 authdata[0]->magic = KV5M_AUTHDATA;
372 authdata[0]->ad_type = KRB5_AUTHDATA_WIN2K_PAC;
373 authdata[0]->contents = (krb5_octet *)pac_data.data;
374 authdata[0]->length = pac_data.length;
376 code = krb5_encode_authdata_container(context,
377 KRB5_AUTHDATA_IF_RELEVANT,
387 krb5_pac_free(context, pac);
388 krb5_free_authdata(context, authdata);
393 krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
394 krb5_const_principal client,
395 const krb5_db_entry *server,
396 krb5_const_principal proxy)
398 struct mit_samba_context *mit_ctx;
401 * Names are quite odd and confusing in the current implementation.
402 * The following mappings should help understanding what is what.
403 * client -> client to impersonate
404 * server; -> delegating service
405 * proxy; -> target principal
407 krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server);
409 char *target_name = NULL;
411 krb5_error_code code;
413 mit_ctx = ks_get_context(context);
414 if (mit_ctx == NULL) {
415 return KRB5_KDB_DBNOTINITED;
418 code = krb5_unparse_name(context, proxy, &target_name);
423 is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL);
425 code = mit_samba_check_s4u2proxy(mit_ctx,
436 static void samba_bad_password_count(krb5_db_entry *client,
437 krb5_error_code error_code)
439 switch (error_code) {
441 mit_samba_zero_bad_password_count(client);
443 case KRB5KDC_ERR_PREAUTH_FAILED:
444 case KRB5KRB_AP_ERR_BAD_INTEGRITY:
445 mit_samba_update_bad_password_count(client);
450 #if KRB5_KDB_API_VERSION >= 9
451 void kdb_samba_db_audit_as_req(krb5_context context,
452 krb5_kdc_req *request,
453 const krb5_address *local_addr,
454 const krb5_address *remote_addr,
455 krb5_db_entry *client,
456 krb5_db_entry *server,
457 krb5_timestamp authtime,
458 krb5_error_code error_code)
460 samba_bad_password_count(client, error_code);
462 /* TODO: perform proper audit logging for addresses */
465 void kdb_samba_db_audit_as_req(krb5_context context,
466 krb5_kdc_req *request,
467 krb5_db_entry *client,
468 krb5_db_entry *server,
469 krb5_timestamp authtime,
470 krb5_error_code error_code)
472 samba_bad_password_count(client, error_code);