Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : PAC Glue between Samba and the KDC
5 :
6 : Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
7 : Copyright (C) Simo Sorce <idra@samba.org> 2010
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 :
20 : You should have received a copy of the GNU General Public License
21 : along with this program. If not, see <http://www.gnu.org/licenses/>.
22 : */
23 :
24 : #include "lib/replace/replace.h"
25 : #include "lib/replace/system/kerberos.h"
26 : #include "lib/replace/system/filesys.h"
27 : #include "lib/util/debug.h"
28 : #include "lib/util/samba_util.h"
29 : #include "lib/util/talloc_stack.h"
30 :
31 : #include "auth/auth_sam_reply.h"
32 : #include "auth/kerberos/kerberos.h"
33 : #include "auth/kerberos/pac_utils.h"
34 : #include "auth/authn_policy.h"
35 : #include "libcli/security/security.h"
36 : #include "libds/common/flags.h"
37 : #include "librpc/gen_ndr/ndr_krb5pac.h"
38 : #include "param/param.h"
39 : #include "source4/auth/auth.h"
40 : #include "source4/dsdb/common/util.h"
41 : #include "source4/dsdb/samdb/samdb.h"
42 : #include "source4/kdc/authn_policy_util.h"
43 : #include "source4/kdc/samba_kdc.h"
44 : #include "source4/kdc/pac-glue.h"
45 : #include "source4/kdc/ad_claims.h"
46 : #include "source4/kdc/pac-blobs.h"
47 :
48 : #include <ldb.h>
49 :
50 : #undef DBGC_CLASS
51 : #define DBGC_CLASS DBGC_KERBEROS
52 :
53 : static
54 77392 : NTSTATUS samba_get_logon_info_pac_blob(TALLOC_CTX *mem_ctx,
55 : const struct auth_user_info_dc *info,
56 : const struct PAC_DOMAIN_GROUP_MEMBERSHIP *override_resource_groups,
57 : const enum auth_group_inclusion group_inclusion,
58 : DATA_BLOB *pac_data)
59 : {
60 77392 : TALLOC_CTX *tmp_ctx = NULL;
61 77392 : struct netr_SamInfo3 *info3 = NULL;
62 77392 : struct PAC_DOMAIN_GROUP_MEMBERSHIP *_resource_groups = NULL;
63 77392 : struct PAC_DOMAIN_GROUP_MEMBERSHIP **resource_groups = NULL;
64 77392 : union PAC_INFO pac_info = {};
65 2828 : enum ndr_err_code ndr_err;
66 77392 : NTSTATUS nt_status = NT_STATUS_OK;
67 :
68 77392 : *pac_data = data_blob_null;
69 :
70 77392 : tmp_ctx = talloc_new(mem_ctx);
71 77392 : if (tmp_ctx == NULL) {
72 0 : return NT_STATUS_NO_MEMORY;
73 : }
74 :
75 77392 : if (override_resource_groups == NULL) {
76 74559 : resource_groups = &_resource_groups;
77 5 : } else if (group_inclusion != AUTH_EXCLUDE_RESOURCE_GROUPS) {
78 : /*
79 : * It doesn't make sense to override resource groups if we claim
80 : * to want resource groups from user_info_dc.
81 : */
82 0 : DBG_ERR("supplied resource groups with invalid group inclusion parameter: %u\n",
83 : group_inclusion);
84 0 : nt_status = NT_STATUS_INVALID_PARAMETER;
85 0 : goto out;
86 : }
87 :
88 77392 : nt_status = auth_convert_user_info_dc_saminfo3(tmp_ctx, info,
89 : group_inclusion,
90 : &info3,
91 : resource_groups);
92 77392 : if (!NT_STATUS_IS_OK(nt_status)) {
93 0 : DBG_WARNING("Getting Samba info failed: %s\n",
94 : nt_errstr(nt_status));
95 0 : goto out;
96 : }
97 :
98 77392 : pac_info.logon_info.info = talloc_zero(tmp_ctx, struct PAC_LOGON_INFO);
99 77392 : if (!pac_info.logon_info.info) {
100 0 : nt_status = NT_STATUS_NO_MEMORY;
101 0 : goto out;
102 : }
103 :
104 77392 : pac_info.logon_info.info->info3 = *info3;
105 77392 : if (_resource_groups != NULL) {
106 16375 : pac_info.logon_info.info->resource_groups = *_resource_groups;
107 : }
108 :
109 77392 : if (override_resource_groups != NULL) {
110 5 : pac_info.logon_info.info->resource_groups = *override_resource_groups;
111 : }
112 :
113 77392 : if (group_inclusion != AUTH_EXCLUDE_RESOURCE_GROUPS) {
114 : /*
115 : * Set the resource groups flag based on whether any groups are
116 : * present. Otherwise, the flag is propagated from the
117 : * originating PAC.
118 : */
119 23584 : if (pac_info.logon_info.info->resource_groups.groups.count > 0) {
120 16375 : pac_info.logon_info.info->info3.base.user_flags |= NETLOGON_RESOURCE_GROUPS;
121 : } else {
122 7209 : pac_info.logon_info.info->info3.base.user_flags &= ~NETLOGON_RESOURCE_GROUPS;
123 : }
124 : }
125 :
126 77392 : ndr_err = ndr_push_union_blob(pac_data, mem_ctx, &pac_info,
127 : PAC_TYPE_LOGON_INFO,
128 : (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
129 77392 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
130 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
131 0 : DBG_WARNING("PAC_LOGON_INFO (presig) push failed: %s\n",
132 : nt_errstr(nt_status));
133 0 : goto out;
134 : }
135 :
136 77392 : out:
137 77392 : talloc_free(tmp_ctx);
138 77392 : return nt_status;
139 : }
140 :
141 : static
142 30226 : NTSTATUS samba_get_upn_info_pac_blob(TALLOC_CTX *mem_ctx,
143 : const struct auth_user_info_dc *info,
144 : DATA_BLOB *upn_data)
145 : {
146 30226 : TALLOC_CTX *tmp_ctx = NULL;
147 30226 : union PAC_INFO pac_upn = {};
148 1170 : enum ndr_err_code ndr_err;
149 30226 : NTSTATUS nt_status = NT_STATUS_OK;
150 1170 : bool ok;
151 :
152 30226 : *upn_data = data_blob_null;
153 :
154 30226 : tmp_ctx = talloc_new(mem_ctx);
155 30226 : if (tmp_ctx == NULL) {
156 0 : return NT_STATUS_NO_MEMORY;
157 : }
158 :
159 30226 : pac_upn.upn_dns_info.upn_name = info->info->user_principal_name;
160 59282 : pac_upn.upn_dns_info.dns_domain_name = strupper_talloc(tmp_ctx,
161 29056 : info->info->dns_domain_name);
162 30226 : if (pac_upn.upn_dns_info.dns_domain_name == NULL) {
163 0 : nt_status = NT_STATUS_NO_MEMORY;
164 0 : goto out;
165 : }
166 30226 : if (info->info->user_principal_constructed) {
167 29029 : pac_upn.upn_dns_info.flags |= PAC_UPN_DNS_FLAG_CONSTRUCTED;
168 : }
169 :
170 30226 : pac_upn.upn_dns_info.flags |= PAC_UPN_DNS_FLAG_HAS_SAM_NAME_AND_SID;
171 :
172 1170 : pac_upn.upn_dns_info.ex.sam_name_and_sid.samaccountname
173 30226 : = info->info->account_name;
174 :
175 1170 : pac_upn.upn_dns_info.ex.sam_name_and_sid.objectsid
176 30226 : = &info->sids[PRIMARY_USER_SID_INDEX].sid;
177 :
178 30226 : ndr_err = ndr_push_union_blob(upn_data, mem_ctx, &pac_upn,
179 : PAC_TYPE_UPN_DNS_INFO,
180 : (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
181 30226 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
182 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
183 0 : DBG_WARNING("PAC UPN_DNS_INFO (presig) push failed: %s\n",
184 : nt_errstr(nt_status));
185 0 : goto out;
186 : }
187 :
188 30226 : ok = data_blob_pad(mem_ctx, upn_data, 8);
189 30226 : if (!ok) {
190 0 : talloc_free(upn_data);
191 0 : nt_status = NT_STATUS_NO_MEMORY;
192 0 : goto out;
193 : }
194 :
195 30226 : out:
196 30226 : talloc_free(tmp_ctx);
197 30226 : return nt_status;
198 : }
199 :
200 : static
201 41 : NTSTATUS samba_get_cred_info_ndr_blob(TALLOC_CTX *mem_ctx,
202 : const struct ldb_message *msg,
203 : DATA_BLOB *cred_blob)
204 : {
205 0 : enum ndr_err_code ndr_err;
206 0 : NTSTATUS nt_status;
207 41 : struct samr_Password *lm_hash = NULL;
208 41 : struct samr_Password *nt_hash = NULL;
209 41 : struct PAC_CREDENTIAL_NTLM_SECPKG ntlm_secpkg = {
210 : .version = 0,
211 : };
212 41 : DATA_BLOB ntlm_blob = data_blob_null;
213 41 : struct PAC_CREDENTIAL_SUPPLEMENTAL_SECPKG secpkgs[1] = {{
214 : .credential_size = 0,
215 : }};
216 41 : struct PAC_CREDENTIAL_DATA cred_data = {
217 : .credential_count = 0,
218 : };
219 41 : struct PAC_CREDENTIAL_DATA_NDR cred_ndr = {};
220 :
221 41 : *cred_blob = data_blob_null;
222 :
223 41 : lm_hash = samdb_result_hash(mem_ctx, msg, "dBCSPwd");
224 41 : if (lm_hash != NULL) {
225 0 : bool zero = all_zero(lm_hash->hash, 16);
226 0 : if (zero) {
227 0 : lm_hash = NULL;
228 : }
229 : }
230 41 : if (lm_hash != NULL) {
231 0 : DBG_INFO("Passing LM password hash through credentials set\n");
232 0 : ntlm_secpkg.flags |= PAC_CREDENTIAL_NTLM_HAS_LM_HASH;
233 0 : ntlm_secpkg.lm_password = *lm_hash;
234 0 : ZERO_STRUCTP(lm_hash);
235 0 : TALLOC_FREE(lm_hash);
236 : }
237 :
238 41 : nt_hash = samdb_result_hash(mem_ctx, msg, "unicodePwd");
239 41 : if (nt_hash != NULL) {
240 41 : bool zero = all_zero(nt_hash->hash, 16);
241 41 : if (zero) {
242 0 : nt_hash = NULL;
243 : }
244 : }
245 41 : if (nt_hash != NULL) {
246 41 : DBG_INFO("Passing NT password hash through credentials set\n");
247 41 : ntlm_secpkg.flags |= PAC_CREDENTIAL_NTLM_HAS_NT_HASH;
248 41 : ntlm_secpkg.nt_password = *nt_hash;
249 41 : ZERO_STRUCTP(nt_hash);
250 41 : TALLOC_FREE(nt_hash);
251 : }
252 :
253 41 : if (ntlm_secpkg.flags == 0) {
254 0 : return NT_STATUS_OK;
255 : }
256 :
257 : #ifdef DEBUG_PASSWORD
258 41 : if (DEBUGLVL(11)) {
259 0 : NDR_PRINT_DEBUG(PAC_CREDENTIAL_NTLM_SECPKG, &ntlm_secpkg);
260 : }
261 : #endif
262 :
263 41 : ndr_err = ndr_push_struct_blob(&ntlm_blob, mem_ctx, &ntlm_secpkg,
264 : (ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_NTLM_SECPKG);
265 41 : ZERO_STRUCT(ntlm_secpkg);
266 41 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
267 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
268 0 : DBG_WARNING("PAC_CREDENTIAL_NTLM_SECPKG (presig) push failed: %s\n",
269 : nt_errstr(nt_status));
270 0 : return nt_status;
271 : }
272 :
273 41 : DBG_DEBUG("NTLM credential BLOB (len %zu) for user\n",
274 : ntlm_blob.length);
275 41 : dump_data_pw("PAC_CREDENTIAL_NTLM_SECPKG",
276 41 : ntlm_blob.data, ntlm_blob.length);
277 :
278 41 : secpkgs[0].package_name.string = discard_const_p(char, "NTLM");
279 41 : secpkgs[0].credential_size = ntlm_blob.length;
280 41 : secpkgs[0].credential = ntlm_blob.data;
281 :
282 41 : cred_data.credential_count = ARRAY_SIZE(secpkgs);
283 41 : cred_data.credentials = secpkgs;
284 :
285 : #ifdef DEBUG_PASSWORD
286 41 : if (DEBUGLVL(11)) {
287 0 : NDR_PRINT_DEBUG(PAC_CREDENTIAL_DATA, &cred_data);
288 : }
289 : #endif
290 :
291 41 : cred_ndr.ctr.data = &cred_data;
292 :
293 : #ifdef DEBUG_PASSWORD
294 41 : if (DEBUGLVL(11)) {
295 0 : NDR_PRINT_DEBUG(PAC_CREDENTIAL_DATA_NDR, &cred_ndr);
296 : }
297 : #endif
298 :
299 41 : ndr_err = ndr_push_struct_blob(cred_blob, mem_ctx, &cred_ndr,
300 : (ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_DATA_NDR);
301 41 : data_blob_clear(&ntlm_blob);
302 41 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
303 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
304 0 : DBG_WARNING("PAC_CREDENTIAL_DATA_NDR (presig) push failed: %s\n",
305 : nt_errstr(nt_status));
306 0 : return nt_status;
307 : }
308 :
309 41 : DBG_DEBUG("Created credential BLOB (len %zu) for user\n",
310 : cred_blob->length);
311 41 : dump_data_pw("PAC_CREDENTIAL_DATA_NDR",
312 41 : cred_blob->data, cred_blob->length);
313 :
314 41 : return NT_STATUS_OK;
315 : }
316 :
317 41 : krb5_error_code samba_kdc_encrypt_pac_credentials(krb5_context context,
318 : const krb5_keyblock *pkreplykey,
319 : const DATA_BLOB *cred_ndr_blob,
320 : TALLOC_CTX *mem_ctx,
321 : DATA_BLOB *cred_info_blob)
322 : {
323 : #ifdef SAMBA4_USES_HEIMDAL
324 0 : krb5_crypto cred_crypto;
325 0 : krb5_enctype cred_enctype;
326 0 : krb5_data cred_ndr_crypt;
327 41 : struct PAC_CREDENTIAL_INFO pac_cred_info = { .version = 0, };
328 0 : krb5_error_code ret;
329 0 : const char *krb5err;
330 0 : enum ndr_err_code ndr_err;
331 0 : NTSTATUS nt_status;
332 :
333 41 : *cred_info_blob = data_blob_null;
334 :
335 41 : ret = krb5_crypto_init(context, pkreplykey, ETYPE_NULL,
336 : &cred_crypto);
337 41 : if (ret != 0) {
338 0 : krb5err = krb5_get_error_message(context, ret);
339 0 : DBG_WARNING("Failed initializing cred data crypto: %s\n", krb5err);
340 0 : krb5_free_error_message(context, krb5err);
341 0 : return ret;
342 : }
343 :
344 41 : ret = krb5_crypto_getenctype(context, cred_crypto, &cred_enctype);
345 41 : if (ret != 0) {
346 0 : DBG_WARNING("Failed getting crypto type for key\n");
347 0 : krb5_crypto_destroy(context, cred_crypto);
348 0 : return ret;
349 : }
350 :
351 41 : DBG_DEBUG("Plain cred_ndr_blob (len %zu)\n",
352 : cred_ndr_blob->length);
353 41 : dump_data_pw("PAC_CREDENTIAL_DATA_NDR",
354 41 : cred_ndr_blob->data, cred_ndr_blob->length);
355 :
356 41 : ret = krb5_encrypt(context, cred_crypto,
357 : KRB5_KU_OTHER_ENCRYPTED,
358 41 : cred_ndr_blob->data, cred_ndr_blob->length,
359 : &cred_ndr_crypt);
360 41 : krb5_crypto_destroy(context, cred_crypto);
361 41 : if (ret != 0) {
362 0 : krb5err = krb5_get_error_message(context, ret);
363 0 : DBG_WARNING("Failed crypt of cred data: %s\n", krb5err);
364 0 : krb5_free_error_message(context, krb5err);
365 0 : return ret;
366 : }
367 :
368 41 : pac_cred_info.encryption_type = cred_enctype;
369 41 : pac_cred_info.encrypted_data.length = cred_ndr_crypt.length;
370 41 : pac_cred_info.encrypted_data.data = (uint8_t *)cred_ndr_crypt.data;
371 :
372 41 : if (DEBUGLVL(10)) {
373 0 : NDR_PRINT_DEBUG(PAC_CREDENTIAL_INFO, &pac_cred_info);
374 : }
375 :
376 41 : ndr_err = ndr_push_struct_blob(cred_info_blob, mem_ctx, &pac_cred_info,
377 : (ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_INFO);
378 41 : krb5_data_free(&cred_ndr_crypt);
379 41 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
380 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
381 0 : DBG_WARNING("PAC_CREDENTIAL_INFO (presig) push failed: %s\n",
382 : nt_errstr(nt_status));
383 0 : return KRB5KDC_ERR_SVC_UNAVAILABLE;
384 : }
385 :
386 41 : DBG_DEBUG("Encrypted credential BLOB (len %zu) with alg %"PRId32"\n",
387 : cred_info_blob->length, pac_cred_info.encryption_type);
388 41 : dump_data_pw("PAC_CREDENTIAL_INFO",
389 41 : cred_info_blob->data, cred_info_blob->length);
390 :
391 41 : return 0;
392 : #else /* SAMBA4_USES_HEIMDAL */
393 0 : TALLOC_CTX *tmp_ctx = NULL;
394 : krb5_key cred_key;
395 : krb5_enctype cred_enctype;
396 0 : struct PAC_CREDENTIAL_INFO pac_cred_info = { .version = 0, };
397 0 : krb5_error_code code = 0;
398 : const char *krb5err;
399 : enum ndr_err_code ndr_err;
400 : NTSTATUS nt_status;
401 : krb5_data cred_ndr_data;
402 : krb5_enc_data cred_ndr_crypt;
403 0 : size_t enc_len = 0;
404 :
405 0 : *cred_info_blob = data_blob_null;
406 :
407 0 : tmp_ctx = talloc_new(mem_ctx);
408 0 : if (tmp_ctx == NULL) {
409 0 : return ENOMEM;
410 : }
411 :
412 0 : code = krb5_k_create_key(context,
413 : pkreplykey,
414 : &cred_key);
415 0 : if (code != 0) {
416 0 : krb5err = krb5_get_error_message(context, code);
417 0 : DBG_WARNING("Failed initializing cred data crypto: %s\n", krb5err);
418 0 : krb5_free_error_message(context, krb5err);
419 0 : goto out;
420 : }
421 :
422 0 : cred_enctype = krb5_k_key_enctype(context, cred_key);
423 :
424 0 : DBG_DEBUG("Plain cred_ndr_blob (len %zu)\n",
425 : cred_ndr_blob->length);
426 0 : dump_data_pw("PAC_CREDENTIAL_DATA_NDR",
427 0 : cred_ndr_blob->data, cred_ndr_blob->length);
428 :
429 0 : pac_cred_info.encryption_type = cred_enctype;
430 :
431 0 : cred_ndr_data = smb_krb5_data_from_blob(*cred_ndr_blob);
432 :
433 0 : code = krb5_c_encrypt_length(context,
434 : cred_enctype,
435 0 : cred_ndr_data.length,
436 : &enc_len);
437 0 : if (code != 0) {
438 0 : krb5err = krb5_get_error_message(context, code);
439 0 : DBG_WARNING("Failed initializing cred data crypto: %s\n", krb5err);
440 0 : krb5_free_error_message(context, krb5err);
441 0 : goto out;
442 : }
443 :
444 0 : pac_cred_info.encrypted_data = data_blob_talloc_zero(tmp_ctx, enc_len);
445 0 : if (pac_cred_info.encrypted_data.data == NULL) {
446 0 : DBG_ERR("Out of memory\n");
447 0 : code = ENOMEM;
448 0 : goto out;
449 : }
450 :
451 0 : cred_ndr_crypt.ciphertext = smb_krb5_data_from_blob(pac_cred_info.encrypted_data);
452 :
453 0 : code = krb5_k_encrypt(context,
454 : cred_key,
455 : KRB5_KU_OTHER_ENCRYPTED,
456 : NULL,
457 : &cred_ndr_data,
458 : &cred_ndr_crypt);
459 0 : krb5_k_free_key(context, cred_key);
460 0 : if (code != 0) {
461 0 : krb5err = krb5_get_error_message(context, code);
462 0 : DBG_WARNING("Failed crypt of cred data: %s\n", krb5err);
463 0 : krb5_free_error_message(context, krb5err);
464 0 : goto out;
465 : }
466 :
467 0 : if (DEBUGLVL(10)) {
468 0 : NDR_PRINT_DEBUG(PAC_CREDENTIAL_INFO, &pac_cred_info);
469 : }
470 :
471 0 : ndr_err = ndr_push_struct_blob(cred_info_blob, mem_ctx, &pac_cred_info,
472 : (ndr_push_flags_fn_t)ndr_push_PAC_CREDENTIAL_INFO);
473 0 : TALLOC_FREE(pac_cred_info.encrypted_data.data);
474 0 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
475 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
476 0 : DBG_WARNING("PAC_CREDENTIAL_INFO (presig) push failed: %s\n",
477 : nt_errstr(nt_status));
478 0 : code = KRB5KDC_ERR_SVC_UNAVAILABLE;
479 0 : goto out;
480 : }
481 :
482 0 : DBG_DEBUG("Encrypted credential BLOB (len %zu) with alg %"PRId32"\n",
483 : cred_info_blob->length, pac_cred_info.encryption_type);
484 0 : dump_data_pw("PAC_CREDENTIAL_INFO",
485 0 : cred_info_blob->data, cred_info_blob->length);
486 :
487 0 : out:
488 0 : talloc_free(tmp_ctx);
489 0 : return code;
490 : #endif /* SAMBA4_USES_HEIMDAL */
491 : }
492 :
493 :
494 : /**
495 : * @brief Create a PAC with the given blobs (logon, credentials, upn and
496 : * delegation).
497 : *
498 : * @param[in] context The KRB5 context to use.
499 : *
500 : * @param[in] logon_blob Fill the logon info PAC buffer with the given blob,
501 : * use NULL to ignore it.
502 : *
503 : * @param[in] cred_blob Fill the credentials info PAC buffer with the given
504 : * blob, use NULL to ignore it.
505 : *
506 : * @param[in] upn_blob Fill the UPN info PAC buffer with the given blob, use
507 : * NULL to ignore it.
508 : *
509 : * @param[in] deleg_blob Fill the delegation info PAC buffer with the given
510 : * blob, use NULL to ignore it.
511 : *
512 : * @param[in] client_claims_blob Fill the client claims info PAC buffer with the
513 : * given blob, use NULL to ignore it.
514 : *
515 : * @param[in] device_info_blob Fill the device info PAC buffer with the given
516 : * blob, use NULL to ignore it.
517 : *
518 : * @param[in] device_claims_blob Fill the device claims info PAC buffer with the given
519 : * blob, use NULL to ignore it.
520 : *
521 : * @param[in] pac The pac buffer to fill. This should be allocated with
522 : * krb5_pac_init() already.
523 : *
524 : * @returns 0 on success or a corresponding KRB5 error.
525 : */
526 30111 : krb5_error_code samba_make_krb5_pac(krb5_context context,
527 : const DATA_BLOB *logon_blob,
528 : const DATA_BLOB *cred_blob,
529 : const DATA_BLOB *upn_blob,
530 : const DATA_BLOB *pac_attrs_blob,
531 : const DATA_BLOB *requester_sid_blob,
532 : const DATA_BLOB *deleg_blob,
533 : const DATA_BLOB *client_claims_blob,
534 : const DATA_BLOB *device_info_blob,
535 : const DATA_BLOB *device_claims_blob,
536 : krb5_pac pac)
537 : {
538 1170 : krb5_data logon_data;
539 1170 : krb5_error_code ret;
540 30111 : char null_byte = '\0';
541 30111 : krb5_data null_data = smb_krb5_make_data(&null_byte, 0);
542 :
543 : /* The user account may be set not to want the PAC */
544 30111 : if (logon_blob == NULL) {
545 0 : return 0;
546 : }
547 :
548 30111 : logon_data = smb_krb5_data_from_blob(*logon_blob);
549 30111 : ret = krb5_pac_add_buffer(context, pac, PAC_TYPE_LOGON_INFO, &logon_data);
550 30111 : if (ret != 0) {
551 0 : return ret;
552 : }
553 :
554 30111 : if (device_info_blob != NULL) {
555 0 : krb5_data device_info_data = smb_krb5_data_from_blob(*device_info_blob);
556 0 : ret = krb5_pac_add_buffer(context, pac,
557 : PAC_TYPE_DEVICE_INFO,
558 : &device_info_data);
559 0 : if (ret != 0) {
560 0 : return ret;
561 : }
562 : }
563 :
564 30111 : if (client_claims_blob != NULL) {
565 1170 : krb5_data client_claims_data;
566 30111 : krb5_data *data = NULL;
567 :
568 30111 : if (client_claims_blob->length != 0) {
569 344 : client_claims_data = smb_krb5_data_from_blob(*client_claims_blob);
570 344 : data = &client_claims_data;
571 : } else {
572 28597 : data = &null_data;
573 : }
574 :
575 30111 : ret = krb5_pac_add_buffer(context, pac,
576 : PAC_TYPE_CLIENT_CLAIMS_INFO,
577 : data);
578 30111 : if (ret != 0) {
579 0 : return ret;
580 : }
581 : }
582 :
583 30111 : if (device_claims_blob != NULL) {
584 0 : krb5_data device_claims_data = smb_krb5_data_from_blob(*device_claims_blob);
585 0 : ret = krb5_pac_add_buffer(context, pac,
586 : PAC_TYPE_DEVICE_CLAIMS_INFO,
587 : &device_claims_data);
588 0 : if (ret != 0) {
589 0 : return ret;
590 : }
591 : }
592 :
593 30111 : if (cred_blob != NULL) {
594 41 : krb5_data cred_data = smb_krb5_data_from_blob(*cred_blob);
595 41 : ret = krb5_pac_add_buffer(context, pac,
596 : PAC_TYPE_CREDENTIAL_INFO,
597 : &cred_data);
598 41 : if (ret != 0) {
599 0 : return ret;
600 : }
601 : }
602 :
603 : #ifdef SAMBA4_USES_HEIMDAL
604 : /*
605 : * null_data will be filled by the generic KDC code in the caller
606 : * here we just add it in order to have it before
607 : * PAC_TYPE_UPN_DNS_INFO
608 : *
609 : * Not needed with MIT Kerberos - asn
610 : */
611 30111 : ret = krb5_pac_add_buffer(context, pac,
612 : PAC_TYPE_LOGON_NAME,
613 : &null_data);
614 30111 : if (ret != 0) {
615 0 : return ret;
616 : }
617 : #endif
618 :
619 30111 : if (upn_blob != NULL) {
620 30111 : krb5_data upn_data = smb_krb5_data_from_blob(*upn_blob);
621 30111 : ret = krb5_pac_add_buffer(context, pac,
622 : PAC_TYPE_UPN_DNS_INFO,
623 : &upn_data);
624 30111 : if (ret != 0) {
625 0 : return ret;
626 : }
627 : }
628 :
629 30111 : if (pac_attrs_blob != NULL) {
630 26888 : krb5_data pac_attrs_data = smb_krb5_data_from_blob(*pac_attrs_blob);
631 26888 : ret = krb5_pac_add_buffer(context, pac,
632 : PAC_TYPE_ATTRIBUTES_INFO,
633 : &pac_attrs_data);
634 26888 : if (ret != 0) {
635 0 : return ret;
636 : }
637 : }
638 :
639 30111 : if (requester_sid_blob != NULL) {
640 26888 : krb5_data requester_sid_data = smb_krb5_data_from_blob(*requester_sid_blob);
641 26888 : ret = krb5_pac_add_buffer(context, pac,
642 : PAC_TYPE_REQUESTER_SID,
643 : &requester_sid_data);
644 26888 : if (ret != 0) {
645 0 : return ret;
646 : }
647 : }
648 :
649 30111 : if (deleg_blob != NULL) {
650 0 : krb5_data deleg_data = smb_krb5_data_from_blob(*deleg_blob);
651 0 : ret = krb5_pac_add_buffer(context, pac,
652 : PAC_TYPE_CONSTRAINED_DELEGATION,
653 : &deleg_data);
654 0 : if (ret != 0) {
655 0 : return ret;
656 : }
657 : }
658 :
659 28941 : return ret;
660 : }
661 :
662 47281 : bool samba_princ_needs_pac(const struct samba_kdc_entry *skdc_entry)
663 : {
664 :
665 1658 : uint32_t userAccountControl;
666 :
667 : /* The service account may be set not to want the PAC */
668 47281 : userAccountControl = ldb_msg_find_attr_as_uint(skdc_entry->msg, "userAccountControl", 0);
669 47281 : if (userAccountControl & UF_NO_AUTH_DATA_REQUIRED) {
670 5 : return false;
671 : }
672 :
673 45618 : return true;
674 : }
675 :
676 20259 : static krb5_error_code samba_client_requested_pac(krb5_context context,
677 : const krb5_const_pac pac,
678 : TALLOC_CTX *mem_ctx,
679 : bool *requested_pac)
680 : {
681 623 : enum ndr_err_code ndr_err;
682 623 : krb5_data k5pac_attrs_in;
683 623 : DATA_BLOB pac_attrs_in;
684 623 : union PAC_INFO pac_attrs;
685 623 : krb5_error_code ret;
686 :
687 20259 : *requested_pac = true;
688 :
689 20259 : ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_ATTRIBUTES_INFO,
690 : &k5pac_attrs_in);
691 20259 : if (ret != 0) {
692 138 : return ret == ENOENT ? 0 : ret;
693 : }
694 :
695 20121 : pac_attrs_in = data_blob_const(k5pac_attrs_in.data,
696 0 : k5pac_attrs_in.length);
697 :
698 20121 : ndr_err = ndr_pull_union_blob(&pac_attrs_in, mem_ctx, &pac_attrs,
699 : PAC_TYPE_ATTRIBUTES_INFO,
700 : (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
701 20121 : smb_krb5_free_data_contents(context, &k5pac_attrs_in);
702 20121 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
703 0 : NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
704 0 : DBG_ERR("can't parse the PAC ATTRIBUTES_INFO: %s\n", nt_errstr(nt_status));
705 0 : return map_errno_from_nt_status(nt_status);
706 : }
707 :
708 20121 : if (pac_attrs.attributes_info.flags & (PAC_ATTRIBUTE_FLAG_PAC_WAS_GIVEN_IMPLICITLY
709 : | PAC_ATTRIBUTE_FLAG_PAC_WAS_REQUESTED)) {
710 20115 : *requested_pac = true;
711 : } else {
712 6 : *requested_pac = false;
713 : }
714 :
715 19498 : return 0;
716 : }
717 :
718 : /* Was the krbtgt in this DB (ie, should we check the incoming signature) and was it an RODC */
719 49153 : krb5_error_code samba_krbtgt_is_in_db(const struct samba_kdc_entry *p,
720 : bool *is_in_db,
721 : bool *is_trusted)
722 : {
723 1658 : NTSTATUS status;
724 1658 : krb5_error_code ret;
725 1658 : int rodc_krbtgt_number, trust_direction;
726 1658 : struct dom_sid sid;
727 1658 : uint32_t rid;
728 :
729 49153 : trust_direction = ldb_msg_find_attr_as_int(p->msg, "trustDirection", 0);
730 :
731 49153 : if (trust_direction != 0) {
732 : /* Domain trust - we cannot check the sig, but we trust it for a correct PAC
733 :
734 : This is exactly where we should flag for SID
735 : validation when we do inter-forest trusts
736 : */
737 49 : *is_trusted = true;
738 49 : *is_in_db = false;
739 49 : return 0;
740 : }
741 :
742 : /* The lack of password controls etc applies to krbtgt by
743 : * virtue of being that particular RID */
744 49104 : ret = samdb_result_dom_sid_buf(p->msg, "objectSid", &sid);
745 49104 : if (ret) {
746 0 : return ret;
747 : }
748 :
749 49104 : status = dom_sid_split_rid(NULL, &sid, NULL, &rid);
750 49104 : if (!NT_STATUS_IS_OK(status)) {
751 0 : return map_errno_from_nt_status(status);
752 : }
753 :
754 49104 : rodc_krbtgt_number = ldb_msg_find_attr_as_int(p->msg, "msDS-SecondaryKrbTgtNumber", -1);
755 :
756 49104 : if (p->kdc_db_ctx->my_krbtgt_number == 0) {
757 46711 : if (rid == DOMAIN_RID_KRBTGT) {
758 46485 : *is_trusted = true;
759 46485 : *is_in_db = true;
760 46485 : return 0;
761 226 : } else if (rodc_krbtgt_number != -1) {
762 226 : *is_in_db = true;
763 226 : *is_trusted = false;
764 226 : return 0;
765 : }
766 2393 : } else if ((rid != DOMAIN_RID_KRBTGT) && (rodc_krbtgt_number == p->kdc_db_ctx->my_krbtgt_number)) {
767 2393 : *is_trusted = true;
768 2393 : *is_in_db = true;
769 2393 : return 0;
770 0 : } else if (rid == DOMAIN_RID_KRBTGT) {
771 : /* krbtgt viewed from an RODC */
772 0 : *is_trusted = true;
773 0 : *is_in_db = false;
774 0 : return 0;
775 : }
776 :
777 : /* Another RODC */
778 0 : *is_trusted = false;
779 0 : *is_in_db = false;
780 0 : return 0;
781 : }
782 :
783 : /*
784 : * Because the KDC does not limit protocol transition, two new well-known SIDs
785 : * were introduced to give this control to the resource administrator. These
786 : * SIDs identify whether protocol transition has occurred, and can be used with
787 : * standard access control lists to grant or limit access as needed.
788 : *
789 : * https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview
790 : */
791 30251 : NTSTATUS samba_kdc_add_asserted_identity(enum samba_asserted_identity ai,
792 : struct auth_user_info_dc *user_info_dc)
793 : {
794 30251 : const struct dom_sid *ai_sid = NULL;
795 :
796 30251 : switch (ai) {
797 652 : case SAMBA_ASSERTED_IDENTITY_SERVICE:
798 652 : ai_sid = &global_sid_Asserted_Identity_Service;
799 652 : break;
800 29599 : case SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY:
801 29599 : ai_sid = &global_sid_Asserted_Identity_Authentication_Authority;
802 29599 : break;
803 0 : case SAMBA_ASSERTED_IDENTITY_IGNORE:
804 0 : return NT_STATUS_OK;
805 0 : default:
806 0 : return NT_STATUS_INVALID_PARAMETER;
807 : }
808 :
809 30251 : return add_sid_to_array_attrs_unique(
810 : user_info_dc,
811 : ai_sid,
812 : SE_GROUP_DEFAULT_FLAGS,
813 : &user_info_dc->sids,
814 : &user_info_dc->num_sids);
815 : }
816 :
817 30280 : NTSTATUS samba_kdc_add_claims_valid(struct auth_user_info_dc *user_info_dc)
818 : {
819 30280 : return add_sid_to_array_attrs_unique(
820 : user_info_dc,
821 : &global_sid_Claims_Valid,
822 : SE_GROUP_DEFAULT_FLAGS,
823 : &user_info_dc->sids,
824 : &user_info_dc->num_sids);
825 : }
826 :
827 73 : static NTSTATUS samba_kdc_add_compounded_auth(struct auth_user_info_dc *user_info_dc)
828 : {
829 73 : return add_sid_to_array_attrs_unique(
830 : user_info_dc,
831 : &global_sid_Compounded_Authentication,
832 : SE_GROUP_DEFAULT_FLAGS,
833 : &user_info_dc->sids,
834 : &user_info_dc->num_sids);
835 : }
836 :
837 192106 : bool samba_kdc_entry_is_trust(const struct samba_kdc_entry *entry)
838 : {
839 192106 : return entry != NULL && entry->is_trust;
840 : }
841 :
842 : /*
843 : * Return true if this entry has an associated PAC issued or signed by a KDC
844 : * that our KDC trusts. We trust the main krbtgt account, but we don’t trust any
845 : * RODC krbtgt besides ourselves.
846 : */
847 437379 : bool samba_krb5_pac_is_trusted(const struct samba_kdc_entry_pac pac)
848 : {
849 437379 : if (pac.pac == NULL) {
850 0 : return false;
851 : }
852 :
853 : #ifdef HAVE_KRB5_PAC_IS_TRUSTED /* Heimdal */
854 437379 : return krb5_pac_is_trusted(pac.pac);
855 : #else /* MIT */
856 0 : return pac.pac_is_trusted;
857 : #endif /* HAVE_KRB5_PAC_IS_TRUSTED */
858 : }
859 :
860 : #ifdef HAVE_KRB5_PAC_IS_TRUSTED /* Heimdal */
861 239444 : struct samba_kdc_entry_pac samba_kdc_entry_pac(krb5_const_pac pac,
862 : struct samba_kdc_entry *entry,
863 : bool is_from_trust)
864 : {
865 239444 : return (struct samba_kdc_entry_pac) {
866 : .entry = entry,
867 : .pac = pac,
868 : .is_from_trust = is_from_trust,
869 : };
870 : }
871 : #else /* MIT */
872 0 : struct samba_kdc_entry_pac samba_kdc_entry_pac_from_trusted(krb5_const_pac pac,
873 : struct samba_kdc_entry *entry,
874 : bool is_from_trust,
875 : bool is_trusted)
876 : {
877 0 : return (struct samba_kdc_entry_pac) {
878 : .entry = entry,
879 : .pac = pac,
880 : .is_from_trust = is_from_trust,
881 : .pac_is_trusted = is_trusted,
882 : };
883 : }
884 : #endif /* HAVE_KRB5_PAC_IS_TRUSTED */
885 :
886 49048 : static bool samba_kdc_entry_pac_issued_by_trust(const struct samba_kdc_entry_pac entry)
887 : {
888 49048 : return entry.pac != NULL && entry.is_from_trust;
889 : }
890 :
891 30226 : NTSTATUS samba_kdc_get_logon_info_blob(TALLOC_CTX *mem_ctx,
892 : const struct auth_user_info_dc *user_info_dc,
893 : const enum auth_group_inclusion group_inclusion,
894 : DATA_BLOB **_logon_info_blob)
895 : {
896 30226 : DATA_BLOB *logon_blob = NULL;
897 1170 : NTSTATUS nt_status;
898 :
899 30226 : *_logon_info_blob = NULL;
900 :
901 30226 : logon_blob = talloc_zero(mem_ctx, DATA_BLOB);
902 30226 : if (logon_blob == NULL) {
903 0 : return NT_STATUS_NO_MEMORY;
904 : }
905 :
906 30226 : nt_status = samba_get_logon_info_pac_blob(logon_blob,
907 : user_info_dc,
908 : NULL,
909 : group_inclusion,
910 : logon_blob);
911 30226 : if (!NT_STATUS_IS_OK(nt_status)) {
912 0 : DBG_ERR("Building PAC LOGON INFO failed: %s\n",
913 : nt_errstr(nt_status));
914 0 : talloc_free(logon_blob);
915 0 : return nt_status;
916 : }
917 :
918 30226 : *_logon_info_blob = logon_blob;
919 :
920 30226 : return NT_STATUS_OK;
921 : }
922 :
923 41 : NTSTATUS samba_kdc_get_cred_ndr_blob(TALLOC_CTX *mem_ctx,
924 : const struct samba_kdc_entry *p,
925 : DATA_BLOB **_cred_ndr_blob)
926 : {
927 41 : DATA_BLOB *cred_blob = NULL;
928 0 : NTSTATUS nt_status;
929 :
930 41 : SMB_ASSERT(_cred_ndr_blob != NULL);
931 :
932 41 : *_cred_ndr_blob = NULL;
933 :
934 41 : cred_blob = talloc_zero(mem_ctx, DATA_BLOB);
935 41 : if (cred_blob == NULL) {
936 0 : return NT_STATUS_NO_MEMORY;
937 : }
938 :
939 41 : nt_status = samba_get_cred_info_ndr_blob(cred_blob,
940 41 : p->msg,
941 : cred_blob);
942 41 : if (!NT_STATUS_IS_OK(nt_status)) {
943 0 : DBG_ERR("Building PAC CRED INFO failed: %s\n",
944 : nt_errstr(nt_status));
945 0 : talloc_free(cred_blob);
946 0 : return nt_status;
947 : }
948 :
949 41 : *_cred_ndr_blob = cred_blob;
950 :
951 41 : return NT_STATUS_OK;
952 : }
953 :
954 30226 : NTSTATUS samba_kdc_get_upn_info_blob(TALLOC_CTX *mem_ctx,
955 : const struct auth_user_info_dc *user_info_dc,
956 : DATA_BLOB **_upn_info_blob)
957 : {
958 30226 : DATA_BLOB *upn_blob = NULL;
959 1170 : NTSTATUS nt_status;
960 :
961 30226 : *_upn_info_blob = NULL;
962 :
963 30226 : upn_blob = talloc_zero(mem_ctx, DATA_BLOB);
964 30226 : if (upn_blob == NULL) {
965 0 : return NT_STATUS_NO_MEMORY;
966 : }
967 :
968 30226 : nt_status = samba_get_upn_info_pac_blob(upn_blob,
969 : user_info_dc,
970 : upn_blob);
971 30226 : if (!NT_STATUS_IS_OK(nt_status)) {
972 0 : DBG_ERR("Building PAC UPN INFO failed: %s\n",
973 : nt_errstr(nt_status));
974 0 : talloc_free(upn_blob);
975 0 : return nt_status;
976 : }
977 :
978 30226 : *_upn_info_blob = upn_blob;
979 :
980 30226 : return NT_STATUS_OK;
981 : }
982 :
983 26888 : NTSTATUS samba_kdc_get_pac_attrs_blob(TALLOC_CTX *mem_ctx,
984 : uint64_t pac_attributes,
985 : DATA_BLOB **_pac_attrs_blob)
986 : {
987 26888 : DATA_BLOB *pac_attrs_blob = NULL;
988 26888 : union PAC_INFO pac_attrs = {};
989 1170 : enum ndr_err_code ndr_err;
990 1170 : NTSTATUS nt_status;
991 :
992 26888 : SMB_ASSERT(_pac_attrs_blob != NULL);
993 :
994 26888 : *_pac_attrs_blob = NULL;
995 :
996 26888 : pac_attrs_blob = talloc_zero(mem_ctx, DATA_BLOB);
997 26888 : if (pac_attrs_blob == NULL) {
998 0 : return NT_STATUS_NO_MEMORY;
999 : }
1000 :
1001 : /* Set the length of the flags in bits. */
1002 26888 : pac_attrs.attributes_info.flags_length = 2;
1003 26888 : pac_attrs.attributes_info.flags = pac_attributes;
1004 :
1005 26888 : ndr_err = ndr_push_union_blob(pac_attrs_blob, pac_attrs_blob, &pac_attrs,
1006 : PAC_TYPE_ATTRIBUTES_INFO,
1007 : (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
1008 26888 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1009 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
1010 0 : DBG_WARNING("PAC ATTRIBUTES_INFO (presig) push failed: %s\n",
1011 : nt_errstr(nt_status));
1012 0 : DBG_ERR("Building PAC ATTRIBUTES failed: %s\n",
1013 : nt_errstr(nt_status));
1014 :
1015 0 : talloc_free(pac_attrs_blob);
1016 0 : return nt_status;
1017 : }
1018 :
1019 26888 : *_pac_attrs_blob = pac_attrs_blob;
1020 :
1021 26888 : return NT_STATUS_OK;
1022 : }
1023 :
1024 26906 : NTSTATUS samba_kdc_get_requester_sid_blob(TALLOC_CTX *mem_ctx,
1025 : const struct auth_user_info_dc *user_info_dc,
1026 : DATA_BLOB **_requester_sid_blob)
1027 : {
1028 26906 : DATA_BLOB *requester_sid_blob = NULL;
1029 1170 : NTSTATUS nt_status;
1030 :
1031 26906 : SMB_ASSERT(_requester_sid_blob != NULL);
1032 :
1033 26906 : *_requester_sid_blob = NULL;
1034 :
1035 26906 : requester_sid_blob = talloc_zero(mem_ctx, DATA_BLOB);
1036 26906 : if (requester_sid_blob == NULL) {
1037 0 : return NT_STATUS_NO_MEMORY;
1038 : }
1039 :
1040 26906 : if (user_info_dc->num_sids > 0) {
1041 26906 : union PAC_INFO pac_requester_sid = {};
1042 1170 : enum ndr_err_code ndr_err;
1043 :
1044 26906 : pac_requester_sid.requester_sid.sid = user_info_dc->sids[PRIMARY_USER_SID_INDEX].sid;
1045 :
1046 26906 : ndr_err = ndr_push_union_blob(requester_sid_blob, requester_sid_blob,
1047 : &pac_requester_sid,
1048 : PAC_TYPE_REQUESTER_SID,
1049 : (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
1050 26906 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1051 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
1052 0 : DBG_WARNING("PAC_REQUESTER_SID (presig) push failed: %s\n",
1053 : nt_errstr(nt_status));
1054 0 : DBG_ERR("Building PAC REQUESTER SID failed: %s\n",
1055 : nt_errstr(nt_status));
1056 :
1057 0 : talloc_free(requester_sid_blob);
1058 0 : return nt_status;
1059 : }
1060 : }
1061 :
1062 26906 : *_requester_sid_blob = requester_sid_blob;
1063 :
1064 26906 : return NT_STATUS_OK;
1065 : }
1066 :
1067 115 : NTSTATUS samba_kdc_get_claims_blob(TALLOC_CTX *mem_ctx,
1068 : struct samba_kdc_entry *p,
1069 : const DATA_BLOB **_claims_blob)
1070 : {
1071 115 : DATA_BLOB *claims_blob = NULL;
1072 115 : struct claims_data *claims_data = NULL;
1073 0 : NTSTATUS nt_status;
1074 0 : int ret;
1075 :
1076 115 : SMB_ASSERT(_claims_blob != NULL);
1077 :
1078 115 : *_claims_blob = NULL;
1079 :
1080 115 : claims_blob = talloc_zero(mem_ctx, DATA_BLOB);
1081 115 : if (claims_blob == NULL) {
1082 0 : return NT_STATUS_NO_MEMORY;
1083 : }
1084 :
1085 115 : ret = samba_kdc_get_claims_data_from_db(p->kdc_db_ctx->samdb,
1086 : p,
1087 : &claims_data);
1088 115 : if (ret != LDB_SUCCESS) {
1089 0 : nt_status = dsdb_ldb_err_to_ntstatus(ret);
1090 0 : DBG_ERR("Building claims failed: %s\n",
1091 : nt_errstr(nt_status));
1092 0 : talloc_free(claims_blob);
1093 0 : return nt_status;
1094 : }
1095 :
1096 115 : nt_status = claims_data_encoded_claims_set(claims_blob,
1097 : claims_data,
1098 : claims_blob);
1099 115 : if (!NT_STATUS_IS_OK(nt_status)) {
1100 0 : talloc_free(claims_blob);
1101 0 : return nt_status;
1102 : }
1103 :
1104 115 : *_claims_blob = claims_blob;
1105 :
1106 115 : return NT_STATUS_OK;
1107 : }
1108 :
1109 80614 : krb5_error_code samba_kdc_get_user_info_from_db(TALLOC_CTX *mem_ctx,
1110 : struct ldb_context *samdb,
1111 : struct samba_kdc_entry *entry,
1112 : const struct ldb_message *msg,
1113 : const struct auth_user_info_dc **info_out)
1114 : {
1115 2925 : NTSTATUS nt_status;
1116 :
1117 80614 : if (samdb == NULL) {
1118 0 : return EINVAL;
1119 : }
1120 :
1121 80614 : if (msg == NULL) {
1122 0 : return EINVAL;
1123 : }
1124 :
1125 80614 : if (info_out == NULL) {
1126 0 : return EINVAL;
1127 : }
1128 :
1129 80614 : if (entry == NULL) {
1130 0 : return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
1131 : }
1132 :
1133 80614 : *info_out = NULL;
1134 :
1135 80614 : if (entry->info_from_db == NULL) {
1136 50972 : struct auth_user_info_dc *info_from_db = NULL;
1137 50972 : struct loadparm_context *lp_ctx = entry->kdc_db_ctx->lp_ctx;
1138 :
1139 50972 : nt_status = authsam_make_user_info_dc(entry,
1140 : samdb,
1141 : lpcfg_netbios_name(lp_ctx),
1142 : lpcfg_sam_name(lp_ctx),
1143 : lpcfg_sam_dnsname(lp_ctx),
1144 : entry->realm_dn,
1145 : msg,
1146 : data_blob_null,
1147 : data_blob_null,
1148 : &info_from_db);
1149 50972 : if (!NT_STATUS_IS_OK(nt_status)) {
1150 0 : DBG_ERR("Getting user info for PAC failed: %s\n",
1151 : nt_errstr(nt_status));
1152 : /* NT_STATUS_OBJECT_NAME_NOT_FOUND is mapped to ENOENT. */
1153 0 : return map_errno_from_nt_status(nt_status);
1154 : }
1155 :
1156 50972 : entry->info_from_db = info_from_db;
1157 : }
1158 :
1159 80614 : *info_out = entry->info_from_db;
1160 :
1161 80614 : return 0;
1162 : }
1163 :
1164 : /*
1165 : * Check whether a PAC contains the Authentication Authority Asserted Identity
1166 : * SID.
1167 : */
1168 169 : static krb5_error_code samba_kdc_pac_contains_asserted_identity(
1169 : krb5_context context,
1170 : const struct samba_kdc_entry_pac entry,
1171 : bool *contains_out)
1172 : {
1173 169 : TALLOC_CTX *frame = NULL;
1174 169 : struct auth_user_info_dc *info = NULL;
1175 169 : krb5_error_code ret = 0;
1176 :
1177 169 : if (contains_out == NULL) {
1178 0 : ret = EINVAL;
1179 0 : goto out;
1180 : }
1181 169 : *contains_out = false;
1182 :
1183 169 : frame = talloc_stackframe();
1184 :
1185 : /*
1186 : * Extract our info from the PAC. This does a bit of unnecessary work,
1187 : * setting up fields we don’t care about — we only want the SIDs.
1188 : */
1189 169 : ret = kerberos_pac_to_user_info_dc(frame,
1190 169 : entry.pac,
1191 : context,
1192 : &info,
1193 : AUTH_EXCLUDE_RESOURCE_GROUPS,
1194 : NULL /* pac_srv_sig */,
1195 : NULL /* pac_kdc_sig */,
1196 : /* Ignore the resource groups. */
1197 : NULL /* resource_groups */);
1198 169 : if (ret) {
1199 0 : const char *krb5err = krb5_get_error_message(context, ret);
1200 0 : DBG_ERR("kerberos_pac_to_user_info_dc failed: %s\n",
1201 : krb5err != NULL ? krb5err : "?");
1202 0 : krb5_free_error_message(context, krb5err);
1203 :
1204 0 : goto out;
1205 : }
1206 :
1207 : /* Determine whether the PAC contains the Asserted Identity SID. */
1208 169 : *contains_out = sid_attrs_contains_sid(
1209 169 : info->sids,
1210 169 : info->num_sids,
1211 : &global_sid_Asserted_Identity_Authentication_Authority);
1212 :
1213 169 : out:
1214 169 : talloc_free(frame);
1215 169 : return ret;
1216 : }
1217 :
1218 47970 : static krb5_error_code samba_kdc_get_user_info_from_pac(TALLOC_CTX *mem_ctx,
1219 : krb5_context context,
1220 : struct ldb_context *samdb,
1221 : const struct samba_kdc_entry_pac entry,
1222 : const struct auth_user_info_dc **info_out,
1223 : const struct PAC_DOMAIN_GROUP_MEMBERSHIP **resource_groups_out)
1224 : {
1225 47970 : TALLOC_CTX *frame = NULL;
1226 47970 : struct auth_user_info_dc *info = NULL;
1227 47970 : struct PAC_DOMAIN_GROUP_MEMBERSHIP *resource_groups = NULL;
1228 47970 : krb5_error_code ret = 0;
1229 1658 : NTSTATUS nt_status;
1230 :
1231 47970 : if (samdb == NULL) {
1232 0 : ret = EINVAL;
1233 0 : goto out;
1234 : }
1235 :
1236 47970 : if (!samba_krb5_pac_is_trusted(entry)) {
1237 0 : ret = EINVAL;
1238 0 : goto out;
1239 : }
1240 :
1241 47970 : if (info_out == NULL) {
1242 0 : ret = EINVAL;
1243 0 : goto out;
1244 : }
1245 :
1246 47970 : *info_out = NULL;
1247 47970 : if (resource_groups_out != NULL) {
1248 26902 : *resource_groups_out = NULL;
1249 : }
1250 :
1251 47970 : if (entry.entry == NULL || entry.entry->info_from_pac == NULL) {
1252 47940 : frame = talloc_stackframe();
1253 :
1254 49598 : ret = kerberos_pac_to_user_info_dc(frame,
1255 47940 : entry.pac,
1256 : context,
1257 : &info,
1258 : AUTH_EXCLUDE_RESOURCE_GROUPS,
1259 : NULL,
1260 : NULL,
1261 : &resource_groups);
1262 47940 : if (ret) {
1263 0 : const char *krb5err = krb5_get_error_message(context, ret);
1264 0 : DBG_ERR("kerberos_pac_to_user_info_dc failed: %s\n",
1265 : krb5err != NULL ? krb5err : "?");
1266 0 : krb5_free_error_message(context, krb5err);
1267 :
1268 0 : goto out;
1269 : }
1270 :
1271 : /*
1272 : * We need to expand group memberships within our local domain,
1273 : * as the token might be generated by a trusted domain.
1274 : */
1275 47940 : nt_status = authsam_update_user_info_dc(frame,
1276 : samdb,
1277 : info);
1278 47940 : if (!NT_STATUS_IS_OK(nt_status)) {
1279 0 : DBG_ERR("authsam_update_user_info_dc failed: %s\n",
1280 : nt_errstr(nt_status));
1281 :
1282 0 : ret = map_errno_from_nt_status(nt_status);
1283 0 : goto out;
1284 : }
1285 :
1286 47940 : if (entry.entry != NULL) {
1287 47890 : entry.entry->info_from_pac = talloc_steal(entry.entry, info);
1288 47890 : entry.entry->resource_groups_from_pac = talloc_steal(entry.entry, resource_groups);
1289 : }
1290 : }
1291 :
1292 :
1293 47970 : if (entry.entry != NULL) {
1294 : /* Note: the caller does not own this! */
1295 47920 : *info_out = entry.entry->info_from_pac;
1296 :
1297 47920 : if (resource_groups_out != NULL) {
1298 : /* Note: the caller does not own this! */
1299 26902 : *resource_groups_out = entry.entry->resource_groups_from_pac;
1300 : }
1301 : } else {
1302 50 : *info_out = talloc_steal(mem_ctx, info);
1303 :
1304 50 : if (resource_groups_out != NULL) {
1305 0 : *resource_groups_out = talloc_steal(mem_ctx, resource_groups);
1306 : }
1307 : }
1308 :
1309 50 : out:
1310 47970 : talloc_free(frame);
1311 47970 : return ret;
1312 : }
1313 :
1314 48139 : krb5_error_code samba_kdc_get_user_info_dc(TALLOC_CTX *mem_ctx,
1315 : krb5_context context,
1316 : struct ldb_context *samdb,
1317 : const struct samba_kdc_entry_pac entry,
1318 : const struct auth_user_info_dc **info_out,
1319 : const struct PAC_DOMAIN_GROUP_MEMBERSHIP **resource_groups_out)
1320 : {
1321 48139 : const struct auth_user_info_dc *info = NULL;
1322 48139 : struct auth_user_info_dc *info_shallow_copy = NULL;
1323 48139 : bool pac_contains_asserted_identity = false;
1324 48139 : krb5_error_code ret = 0;
1325 1658 : NTSTATUS nt_status;
1326 :
1327 48139 : *info_out = NULL;
1328 48139 : if (resource_groups_out != NULL) {
1329 26920 : *resource_groups_out = NULL;
1330 : }
1331 :
1332 48139 : if (samba_krb5_pac_is_trusted(entry)) {
1333 47970 : return samba_kdc_get_user_info_from_pac(mem_ctx,
1334 : context,
1335 : samdb,
1336 : entry,
1337 : info_out,
1338 : resource_groups_out);
1339 : }
1340 :
1341 169 : if (entry.entry == NULL) {
1342 0 : return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
1343 : }
1344 :
1345 : /*
1346 : * In this case the RWDC discards the PAC an RODC generated.
1347 : * Windows adds the asserted_identity in this case too.
1348 : *
1349 : * Note that SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION
1350 : * generates KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN.
1351 : * So we can always use
1352 : * SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY
1353 : * here.
1354 : */
1355 169 : ret = samba_kdc_get_user_info_from_db(mem_ctx,
1356 : samdb,
1357 169 : entry.entry,
1358 169 : entry.entry->msg,
1359 : &info);
1360 169 : if (ret) {
1361 0 : const char *krb5err = krb5_get_error_message(context, ret);
1362 0 : DBG_ERR("samba_kdc_get_user_info_from_db: %s\n",
1363 : krb5err != NULL ? krb5err : "?");
1364 0 : krb5_free_error_message(context, krb5err);
1365 :
1366 0 : return KRB5KDC_ERR_TGT_REVOKED;
1367 : }
1368 :
1369 : /* Make a shallow copy of the user_info_dc structure. */
1370 169 : nt_status = authsam_shallow_copy_user_info_dc(mem_ctx,
1371 : info,
1372 : &info_shallow_copy);
1373 169 : info = NULL;
1374 :
1375 169 : if (!NT_STATUS_IS_OK(nt_status)) {
1376 0 : DBG_ERR("Failed to allocate user_info_dc SIDs: %s\n",
1377 : nt_errstr(nt_status));
1378 0 : return map_errno_from_nt_status(nt_status);
1379 : }
1380 :
1381 : /* Determine whether the PAC contains the Asserted Identity SID. */
1382 169 : ret = samba_kdc_pac_contains_asserted_identity(
1383 : context, entry, &pac_contains_asserted_identity);
1384 169 : if (ret) {
1385 0 : return ret;
1386 : }
1387 :
1388 169 : if (pac_contains_asserted_identity) {
1389 140 : nt_status = samba_kdc_add_asserted_identity(
1390 : SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY,
1391 : info_shallow_copy);
1392 140 : if (!NT_STATUS_IS_OK(nt_status)) {
1393 0 : DBG_ERR("Failed to add asserted identity: %s\n",
1394 : nt_errstr(nt_status));
1395 0 : TALLOC_FREE(info_shallow_copy);
1396 0 : return KRB5KDC_ERR_TGT_REVOKED;
1397 : }
1398 : }
1399 :
1400 169 : nt_status = samba_kdc_add_claims_valid(info_shallow_copy);
1401 169 : if (!NT_STATUS_IS_OK(nt_status)) {
1402 0 : DBG_ERR("Failed to add Claims Valid: %s\n",
1403 : nt_errstr(nt_status));
1404 0 : TALLOC_FREE(info_shallow_copy);
1405 0 : return KRB5KDC_ERR_TGT_REVOKED;
1406 : }
1407 :
1408 169 : *info_out = info_shallow_copy;
1409 :
1410 169 : return 0;
1411 : }
1412 :
1413 152 : static NTSTATUS samba_kdc_update_delegation_info_blob(TALLOC_CTX *mem_ctx,
1414 : krb5_context context,
1415 : const krb5_const_pac pac,
1416 : const krb5_const_principal server_principal,
1417 : const krb5_const_principal proxy_principal,
1418 : DATA_BLOB *new_blob)
1419 : {
1420 152 : krb5_data old_data = {};
1421 0 : DATA_BLOB old_blob;
1422 0 : krb5_error_code ret;
1423 152 : NTSTATUS nt_status = NT_STATUS_OK;
1424 0 : enum ndr_err_code ndr_err;
1425 152 : union PAC_INFO info = {};
1426 152 : struct PAC_CONSTRAINED_DELEGATION _d = {};
1427 152 : struct PAC_CONSTRAINED_DELEGATION *d = NULL;
1428 152 : char *server = NULL;
1429 152 : char *proxy = NULL;
1430 0 : uint32_t i;
1431 152 : TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1432 :
1433 152 : if (tmp_ctx == NULL) {
1434 0 : nt_status = NT_STATUS_NO_MEMORY;
1435 0 : goto out;
1436 : }
1437 :
1438 152 : ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_CONSTRAINED_DELEGATION, &old_data);
1439 152 : if (ret == ENOENT) {
1440 : /* OK. */
1441 3 : } else if (ret) {
1442 0 : nt_status = NT_STATUS_UNSUCCESSFUL;
1443 0 : goto out;
1444 : }
1445 :
1446 152 : old_blob.length = old_data.length;
1447 152 : old_blob.data = (uint8_t *)old_data.data;
1448 :
1449 152 : if (old_blob.length > 0) {
1450 3 : ndr_err = ndr_pull_union_blob(&old_blob, tmp_ctx,
1451 : &info, PAC_TYPE_CONSTRAINED_DELEGATION,
1452 : (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
1453 3 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1454 0 : smb_krb5_free_data_contents(context, &old_data);
1455 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
1456 0 : DBG_ERR("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status));
1457 0 : goto out;
1458 : }
1459 : } else {
1460 149 : info.constrained_delegation.info = &_d;
1461 : }
1462 152 : smb_krb5_free_data_contents(context, &old_data);
1463 :
1464 152 : ret = krb5_unparse_name_flags(context, server_principal,
1465 : KRB5_PRINCIPAL_UNPARSE_NO_REALM, &server);
1466 152 : if (ret) {
1467 0 : nt_status = NT_STATUS_INTERNAL_ERROR;
1468 0 : goto out;
1469 : }
1470 :
1471 152 : ret = krb5_unparse_name(context, proxy_principal, &proxy);
1472 152 : if (ret) {
1473 0 : SAFE_FREE(server);
1474 0 : nt_status = NT_STATUS_INTERNAL_ERROR;
1475 0 : goto out;
1476 : }
1477 :
1478 152 : d = info.constrained_delegation.info;
1479 152 : i = d->num_transited_services;
1480 152 : d->proxy_target.string = server;
1481 152 : d->transited_services = talloc_realloc(mem_ctx, d->transited_services,
1482 : struct lsa_String, i + 1);
1483 152 : if (d->transited_services == NULL) {
1484 0 : SAFE_FREE(server);
1485 0 : SAFE_FREE(proxy);
1486 0 : nt_status = NT_STATUS_INTERNAL_ERROR;
1487 0 : goto out;
1488 : }
1489 152 : d->transited_services[i].string = proxy;
1490 152 : d->num_transited_services = i + 1;
1491 :
1492 152 : ndr_err = ndr_push_union_blob(new_blob, mem_ctx,
1493 : &info, PAC_TYPE_CONSTRAINED_DELEGATION,
1494 : (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
1495 152 : SAFE_FREE(server);
1496 152 : SAFE_FREE(proxy);
1497 152 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1498 0 : smb_krb5_free_data_contents(context, &old_data);
1499 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
1500 0 : DBG_ERR("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status));
1501 0 : goto out;
1502 : }
1503 :
1504 152 : out:
1505 152 : talloc_free(tmp_ctx);
1506 152 : return nt_status;
1507 : }
1508 :
1509 : /* function to map policy errors */
1510 40 : krb5_error_code samba_kdc_map_policy_err(NTSTATUS nt_status)
1511 : {
1512 0 : krb5_error_code ret;
1513 :
1514 40 : if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_MUST_CHANGE))
1515 4 : ret = KRB5KDC_ERR_KEY_EXP;
1516 36 : else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_EXPIRED))
1517 0 : ret = KRB5KDC_ERR_KEY_EXP;
1518 36 : else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_EXPIRED))
1519 0 : ret = KRB5KDC_ERR_CLIENT_REVOKED;
1520 36 : else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_DISABLED))
1521 5 : ret = KRB5KDC_ERR_CLIENT_REVOKED;
1522 31 : else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_LOGON_HOURS))
1523 4 : ret = KRB5KDC_ERR_CLIENT_REVOKED;
1524 27 : else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_LOCKED_OUT))
1525 27 : ret = KRB5KDC_ERR_CLIENT_REVOKED;
1526 0 : else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_WORKSTATION))
1527 0 : ret = KRB5KDC_ERR_POLICY;
1528 : else
1529 0 : ret = KRB5KDC_ERR_POLICY;
1530 :
1531 40 : return ret;
1532 : }
1533 :
1534 : /* Given a kdc entry, consult the account_ok routine in auth/auth_sam.c
1535 : * for consistency */
1536 47792 : NTSTATUS samba_kdc_check_client_access(struct samba_kdc_entry *kdc_entry,
1537 : const char *client_name,
1538 : const char *workstation,
1539 : bool password_change)
1540 : {
1541 1755 : TALLOC_CTX *tmp_ctx;
1542 1755 : NTSTATUS nt_status;
1543 :
1544 47792 : tmp_ctx = talloc_named(NULL, 0, "samba_kdc_check_client_access");
1545 47792 : if (!tmp_ctx) {
1546 0 : return NT_STATUS_NO_MEMORY;
1547 : }
1548 :
1549 : /* we allow all kinds of trusts here */
1550 47792 : nt_status = authsam_account_ok(tmp_ctx,
1551 47792 : kdc_entry->kdc_db_ctx->samdb,
1552 : MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
1553 : MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
1554 : kdc_entry->realm_dn, kdc_entry->msg,
1555 : workstation, client_name,
1556 : true, password_change);
1557 :
1558 47792 : kdc_entry->reject_status = nt_status;
1559 47792 : talloc_free(tmp_ctx);
1560 47792 : return nt_status;
1561 : }
1562 :
1563 49062 : static krb5_error_code samba_get_requester_sid(TALLOC_CTX *mem_ctx,
1564 : krb5_const_pac pac,
1565 : krb5_context context,
1566 : struct dom_sid *sid)
1567 : {
1568 1658 : NTSTATUS nt_status;
1569 1658 : enum ndr_err_code ndr_err;
1570 49062 : krb5_error_code ret = 0;
1571 :
1572 1658 : DATA_BLOB pac_requester_sid_in;
1573 1658 : krb5_data k5pac_requester_sid_in;
1574 :
1575 1658 : union PAC_INFO info;
1576 :
1577 49062 : TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1578 49062 : if (tmp_ctx == NULL) {
1579 0 : ret = ENOMEM;
1580 0 : goto out;
1581 : }
1582 :
1583 49062 : ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_REQUESTER_SID,
1584 : &k5pac_requester_sid_in);
1585 49062 : if (ret != 0) {
1586 164 : goto out;
1587 : }
1588 :
1589 48898 : pac_requester_sid_in = data_blob_const(k5pac_requester_sid_in.data,
1590 0 : k5pac_requester_sid_in.length);
1591 :
1592 48898 : ndr_err = ndr_pull_union_blob(&pac_requester_sid_in, tmp_ctx, &info,
1593 : PAC_TYPE_REQUESTER_SID,
1594 : (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
1595 48898 : smb_krb5_free_data_contents(context, &k5pac_requester_sid_in);
1596 48898 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1597 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
1598 0 : DBG_ERR("can't parse the PAC REQUESTER_SID: %s\n", nt_errstr(nt_status));
1599 0 : ret = map_errno_from_nt_status(nt_status);
1600 0 : goto out;
1601 : }
1602 :
1603 48898 : *sid = info.requester_sid.sid;
1604 :
1605 49062 : out:
1606 49062 : talloc_free(tmp_ctx);
1607 49062 : return ret;
1608 : }
1609 :
1610 : /* Does a parse and SID check, but no crypto. */
1611 49062 : static krb5_error_code samba_kdc_validate_pac_blob(
1612 : krb5_context context,
1613 : const struct samba_kdc_entry_pac client)
1614 : {
1615 49062 : TALLOC_CTX *frame = talloc_stackframe();
1616 49062 : struct auth_user_info_dc *pac_user_info = NULL;
1617 1658 : struct dom_sid client_sid;
1618 1658 : struct dom_sid pac_sid;
1619 1658 : krb5_error_code code;
1620 1658 : bool ok;
1621 :
1622 : /*
1623 : * First, try to get the SID from the requester SID buffer in the PAC.
1624 : */
1625 49062 : code = samba_get_requester_sid(frame, client.pac, context, &pac_sid);
1626 :
1627 49062 : if (code == ENOENT) {
1628 : /*
1629 : * If the requester SID buffer isn't present, fall back to the
1630 : * SID in the LOGON_INFO PAC buffer.
1631 : */
1632 164 : code = kerberos_pac_to_user_info_dc(frame,
1633 164 : client.pac,
1634 : context,
1635 : &pac_user_info,
1636 : AUTH_EXCLUDE_RESOURCE_GROUPS,
1637 : NULL,
1638 : NULL,
1639 : NULL);
1640 164 : if (code != 0) {
1641 0 : goto out;
1642 : }
1643 :
1644 164 : if (pac_user_info->num_sids == 0) {
1645 0 : code = EINVAL;
1646 0 : goto out;
1647 : }
1648 :
1649 164 : pac_sid = pac_user_info->sids[PRIMARY_USER_SID_INDEX].sid;
1650 48898 : } else if (code != 0) {
1651 0 : goto out;
1652 : }
1653 :
1654 49062 : code = samdb_result_dom_sid_buf(client.entry->msg,
1655 : "objectSid",
1656 : &client_sid);
1657 49062 : if (code) {
1658 0 : goto out;
1659 : }
1660 :
1661 49062 : ok = dom_sid_equal(&pac_sid, &client_sid);
1662 49062 : if (!ok) {
1663 0 : struct dom_sid_buf buf1;
1664 0 : struct dom_sid_buf buf2;
1665 :
1666 38 : DBG_ERR("SID mismatch between PAC and looked up client: "
1667 : "PAC[%s] != CLI[%s]\n",
1668 : dom_sid_str_buf(&pac_sid, &buf1),
1669 : dom_sid_str_buf(&client_sid, &buf2));
1670 38 : code = KRB5KDC_ERR_TGT_REVOKED;
1671 38 : goto out;
1672 : }
1673 :
1674 47366 : code = 0;
1675 49062 : out:
1676 49062 : TALLOC_FREE(frame);
1677 49062 : return code;
1678 : }
1679 :
1680 :
1681 : /*
1682 : * In the RODC case, to confirm that the returned user is permitted to
1683 : * be replicated to the KDC (krbgtgt_xxx user) represented by *rodc
1684 : */
1685 210 : static WERROR samba_rodc_confirm_user_is_allowed(uint32_t num_object_sids,
1686 : const struct dom_sid *object_sids,
1687 : const struct samba_kdc_entry *rodc,
1688 : const struct samba_kdc_entry *object)
1689 : {
1690 0 : int ret;
1691 0 : WERROR werr;
1692 210 : TALLOC_CTX *frame = talloc_stackframe();
1693 210 : const char *rodc_attrs[] = { "msDS-KrbTgtLink",
1694 : "msDS-NeverRevealGroup",
1695 : "msDS-RevealOnDemandGroup",
1696 : "userAccountControl",
1697 : "objectSid",
1698 : NULL };
1699 210 : struct ldb_result *rodc_machine_account = NULL;
1700 210 : struct ldb_dn *rodc_machine_account_dn = samdb_result_dn(rodc->kdc_db_ctx->samdb,
1701 : frame,
1702 210 : rodc->msg,
1703 : "msDS-KrbTgtLinkBL",
1704 : NULL);
1705 210 : const struct dom_sid *rodc_machine_account_sid = NULL;
1706 :
1707 210 : if (rodc_machine_account_dn == NULL) {
1708 6 : DBG_ERR("krbtgt account %s has no msDS-KrbTgtLinkBL to find RODC machine account for allow/deny list\n",
1709 : ldb_dn_get_linearized(rodc->msg->dn));
1710 6 : TALLOC_FREE(frame);
1711 6 : return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1712 : }
1713 :
1714 : /*
1715 : * Follow the link and get the RODC account (the krbtgt
1716 : * account is the krbtgt_XXX account, but the
1717 : * msDS-NeverRevealGroup and msDS-RevealOnDemandGroup is on
1718 : * the RODC$ account)
1719 : *
1720 : * We need DSDB_SEARCH_SHOW_EXTENDED_DN as we get a SID lists
1721 : * out of the extended DNs
1722 : */
1723 :
1724 204 : ret = dsdb_search_dn(rodc->kdc_db_ctx->samdb,
1725 : frame,
1726 : &rodc_machine_account,
1727 : rodc_machine_account_dn,
1728 : rodc_attrs,
1729 : DSDB_SEARCH_SHOW_EXTENDED_DN);
1730 204 : if (ret != LDB_SUCCESS) {
1731 0 : DBG_ERR("Failed to fetch RODC machine account %s pointed to by %s to check allow/deny list: %s\n",
1732 : ldb_dn_get_linearized(rodc_machine_account_dn),
1733 : ldb_dn_get_linearized(rodc->msg->dn),
1734 : ldb_errstring(rodc->kdc_db_ctx->samdb));
1735 0 : TALLOC_FREE(frame);
1736 0 : return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1737 : }
1738 :
1739 204 : if (rodc_machine_account->count != 1) {
1740 0 : DBG_ERR("Failed to fetch RODC machine account %s pointed to by %s to check allow/deny list: (%d)\n",
1741 : ldb_dn_get_linearized(rodc_machine_account_dn),
1742 : ldb_dn_get_linearized(rodc->msg->dn),
1743 : rodc_machine_account->count);
1744 0 : TALLOC_FREE(frame);
1745 0 : return WERR_DS_DRA_BAD_DN;
1746 : }
1747 :
1748 : /* if the object SID is equal to the user_sid, allow */
1749 204 : rodc_machine_account_sid = samdb_result_dom_sid(frame,
1750 204 : rodc_machine_account->msgs[0],
1751 : "objectSid");
1752 204 : if (rodc_machine_account_sid == NULL) {
1753 0 : TALLOC_FREE(frame);
1754 0 : return WERR_DS_DRA_BAD_DN;
1755 : }
1756 :
1757 204 : werr = samdb_confirm_rodc_allowed_to_repl_to_sid_list(rodc->kdc_db_ctx->samdb,
1758 : rodc_machine_account_sid,
1759 204 : rodc_machine_account->msgs[0],
1760 204 : object->msg,
1761 : num_object_sids,
1762 : object_sids);
1763 :
1764 204 : TALLOC_FREE(frame);
1765 204 : return werr;
1766 : }
1767 :
1768 : /*
1769 : * Perform an access check for the client attempting to authenticate to the
1770 : * server. ‘client_info’ must be talloc-allocated so that we can make a
1771 : * reference to it.
1772 : */
1773 153 : krb5_error_code samba_kdc_allowed_to_authenticate_to(TALLOC_CTX *mem_ctx,
1774 : struct ldb_context *samdb,
1775 : struct loadparm_context *lp_ctx,
1776 : const struct samba_kdc_entry *client,
1777 : const struct auth_user_info_dc *client_info,
1778 : const struct auth_user_info_dc *device_info,
1779 : const struct auth_claims auth_claims,
1780 : const struct samba_kdc_entry *server,
1781 : struct authn_audit_info **server_audit_info_out,
1782 : NTSTATUS *status_out)
1783 : {
1784 153 : krb5_error_code ret = 0;
1785 0 : NTSTATUS status;
1786 0 : _UNUSED_ NTSTATUS _status;
1787 153 : struct dom_sid server_sid = {};
1788 153 : const struct authn_server_policy *server_policy = server->server_policy;
1789 :
1790 153 : if (status_out != NULL) {
1791 153 : *status_out = NT_STATUS_OK;
1792 : }
1793 :
1794 153 : ret = samdb_result_dom_sid_buf(server->msg, "objectSid", &server_sid);
1795 153 : if (ret) {
1796 : /*
1797 : * Ignore the return status — we are already in an error path,
1798 : * and overwriting the real error code with the audit info
1799 : * status is unhelpful.
1800 : */
1801 0 : _status = authn_server_policy_audit_info(mem_ctx,
1802 : server_policy,
1803 : client_info,
1804 : AUTHN_AUDIT_EVENT_OTHER_ERROR,
1805 : AUTHN_AUDIT_REASON_NONE,
1806 : dsdb_ldb_err_to_ntstatus(ret),
1807 : server_audit_info_out);
1808 0 : goto out;
1809 : }
1810 :
1811 153 : if (dom_sid_equal(&client_info->sids[PRIMARY_USER_SID_INDEX].sid, &server_sid)) {
1812 : /* Authenticating to ourselves is always allowed. */
1813 8 : status = authn_server_policy_audit_info(mem_ctx,
1814 : server_policy,
1815 : client_info,
1816 : AUTHN_AUDIT_EVENT_OK,
1817 : AUTHN_AUDIT_REASON_NONE,
1818 : NT_STATUS_OK,
1819 : server_audit_info_out);
1820 8 : if (!NT_STATUS_IS_OK(status)) {
1821 0 : ret = KRB5KRB_ERR_GENERIC;
1822 : }
1823 8 : goto out;
1824 : }
1825 :
1826 145 : status = authn_policy_authenticate_to_service(mem_ctx,
1827 : samdb,
1828 : lp_ctx,
1829 : AUTHN_POLICY_AUTH_TYPE_KERBEROS,
1830 : client_info,
1831 : device_info,
1832 : auth_claims,
1833 : server_policy,
1834 145 : (struct authn_policy_flags) { .force_compounded_authentication = true },
1835 : server_audit_info_out);
1836 145 : if (!NT_STATUS_IS_OK(status)) {
1837 57 : if (status_out != NULL) {
1838 57 : *status_out = status;
1839 : }
1840 57 : if (NT_STATUS_EQUAL(status, NT_STATUS_AUTHENTICATION_FIREWALL_FAILED)) {
1841 56 : ret = KRB5KDC_ERR_POLICY;
1842 1 : } else if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
1843 1 : ret = KRB5KDC_ERR_POLICY;
1844 : } else {
1845 0 : ret = KRB5KRB_ERR_GENERIC;
1846 : }
1847 : }
1848 :
1849 88 : out:
1850 153 : return ret;
1851 : }
1852 :
1853 94 : static krb5_error_code samba_kdc_add_domain_group_sid(struct PAC_DEVICE_INFO *info,
1854 : const struct netr_SidAttr *sid)
1855 : {
1856 0 : uint32_t i;
1857 0 : uint32_t rid;
1858 0 : NTSTATUS status;
1859 :
1860 94 : uint32_t domain_group_count = info->domain_group_count;
1861 94 : struct PAC_DOMAIN_GROUP_MEMBERSHIP *domain_group = NULL;
1862 94 : struct samr_RidWithAttribute *rids = NULL;
1863 :
1864 131 : for (i = 0; i < domain_group_count; ++i) {
1865 52 : struct PAC_DOMAIN_GROUP_MEMBERSHIP *this_domain_group
1866 52 : = &info->domain_groups[i];
1867 :
1868 52 : if (dom_sid_in_domain(this_domain_group->domain_sid, sid->sid)) {
1869 15 : domain_group = this_domain_group;
1870 15 : break;
1871 : }
1872 : }
1873 :
1874 94 : if (domain_group == NULL) {
1875 79 : struct PAC_DOMAIN_GROUP_MEMBERSHIP *domain_groups = NULL;
1876 :
1877 79 : if (domain_group_count == UINT32_MAX) {
1878 0 : return EINVAL;
1879 : }
1880 :
1881 79 : domain_groups = talloc_realloc(
1882 : info,
1883 : info->domain_groups,
1884 : struct PAC_DOMAIN_GROUP_MEMBERSHIP,
1885 : domain_group_count + 1);
1886 79 : if (domain_groups == NULL) {
1887 0 : return ENOMEM;
1888 : }
1889 :
1890 79 : info->domain_groups = domain_groups;
1891 :
1892 79 : domain_group = &info->domain_groups[domain_group_count++];
1893 79 : *domain_group = (struct PAC_DOMAIN_GROUP_MEMBERSHIP) {};
1894 :
1895 79 : status = dom_sid_split_rid(info->domain_groups,
1896 79 : sid->sid,
1897 : &domain_group->domain_sid,
1898 : &rid);
1899 79 : if (!NT_STATUS_IS_OK(status)) {
1900 0 : return map_errno_from_nt_status(status);
1901 : }
1902 : } else {
1903 15 : status = dom_sid_split_rid(NULL,
1904 15 : sid->sid,
1905 : NULL,
1906 : &rid);
1907 15 : if (!NT_STATUS_IS_OK(status)) {
1908 0 : return map_errno_from_nt_status(status);
1909 : }
1910 : }
1911 :
1912 94 : if (domain_group->groups.count == UINT32_MAX) {
1913 0 : return EINVAL;
1914 : }
1915 :
1916 94 : rids = talloc_realloc(info->domain_groups,
1917 : domain_group->groups.rids,
1918 : struct samr_RidWithAttribute,
1919 : domain_group->groups.count + 1);
1920 94 : if (rids == NULL) {
1921 0 : return ENOMEM;
1922 : }
1923 :
1924 94 : domain_group->groups.rids = rids;
1925 :
1926 94 : domain_group->groups.rids[domain_group->groups.count] = (struct samr_RidWithAttribute) {
1927 : .rid = rid,
1928 94 : .attributes = sid->attributes,
1929 : };
1930 :
1931 94 : ++domain_group->groups.count;
1932 :
1933 94 : info->domain_group_count = domain_group_count;
1934 :
1935 94 : return 0;
1936 : }
1937 :
1938 73 : static krb5_error_code samba_kdc_make_device_info(TALLOC_CTX *mem_ctx,
1939 : const struct netr_SamInfo3 *info3,
1940 : struct PAC_DOMAIN_GROUP_MEMBERSHIP *resource_groups,
1941 : union PAC_INFO *info)
1942 : {
1943 73 : TALLOC_CTX *tmp_ctx = NULL;
1944 73 : struct PAC_DEVICE_INFO *device_info = NULL;
1945 0 : uint32_t i;
1946 73 : krb5_error_code ret = 0;
1947 :
1948 73 : *info = (union PAC_INFO) {};
1949 :
1950 73 : info->device_info.info = NULL;
1951 :
1952 73 : tmp_ctx = talloc_new(mem_ctx);
1953 73 : if (tmp_ctx == NULL) {
1954 0 : return ENOMEM;
1955 : }
1956 :
1957 73 : device_info = talloc(tmp_ctx, struct PAC_DEVICE_INFO);
1958 73 : if (device_info == NULL) {
1959 0 : ret = ENOMEM;
1960 0 : goto out;
1961 : }
1962 :
1963 73 : device_info->rid = info3->base.rid;
1964 73 : device_info->primary_gid = info3->base.primary_gid;
1965 73 : device_info->domain_sid = info3->base.domain_sid;
1966 73 : device_info->groups = info3->base.groups;
1967 :
1968 73 : device_info->sid_count = 0;
1969 73 : device_info->sids = NULL;
1970 :
1971 73 : if (resource_groups != NULL) {
1972 : /*
1973 : * The account's resource groups all belong to the same domain,
1974 : * so we can add them all in one go.
1975 : */
1976 1 : device_info->domain_group_count = 1;
1977 1 : device_info->domain_groups = talloc_move(device_info, &resource_groups);
1978 : } else {
1979 72 : device_info->domain_group_count = 0;
1980 72 : device_info->domain_groups = NULL;
1981 : }
1982 :
1983 245 : for (i = 0; i < info3->sidcount; ++i) {
1984 172 : const struct netr_SidAttr *device_sid = &info3->sids[i];
1985 :
1986 172 : if (dom_sid_has_account_domain(device_sid->sid)) {
1987 68 : ret = samba_kdc_add_domain_group_sid(device_info, device_sid);
1988 68 : if (ret != 0) {
1989 0 : goto out;
1990 : }
1991 : } else {
1992 104 : device_info->sids = talloc_realloc(device_info, device_info->sids,
1993 : struct netr_SidAttr,
1994 : device_info->sid_count + 1);
1995 104 : if (device_info->sids == NULL) {
1996 0 : ret = ENOMEM;
1997 0 : goto out;
1998 : }
1999 :
2000 104 : device_info->sids[device_info->sid_count].sid = dom_sid_dup(device_info->sids, device_sid->sid);
2001 104 : if (device_info->sids[device_info->sid_count].sid == NULL) {
2002 0 : ret = ENOMEM;
2003 0 : goto out;
2004 : }
2005 :
2006 104 : device_info->sids[device_info->sid_count].attributes = device_sid->attributes;
2007 :
2008 104 : ++device_info->sid_count;
2009 : }
2010 : }
2011 :
2012 73 : info->device_info.info = talloc_steal(mem_ctx, device_info);
2013 :
2014 73 : out:
2015 73 : talloc_free(tmp_ctx);
2016 73 : return ret;
2017 : }
2018 :
2019 64 : static krb5_error_code samba_kdc_update_device_info(TALLOC_CTX *mem_ctx,
2020 : struct ldb_context *samdb,
2021 : const union PAC_INFO *logon_info,
2022 : struct PAC_DEVICE_INFO *device_info)
2023 : {
2024 0 : NTSTATUS nt_status;
2025 64 : struct auth_user_info_dc *device_info_dc = NULL;
2026 0 : union netr_Validation validation;
2027 0 : uint32_t i;
2028 0 : uint32_t num_existing_sids;
2029 :
2030 : /*
2031 : * This does a bit of unnecessary work, setting up fields we don't care
2032 : * about -- we only want the SIDs.
2033 : */
2034 64 : validation.sam3 = &logon_info->logon_info.info->info3;
2035 64 : nt_status = make_user_info_dc_netlogon_validation(mem_ctx, "", 3, &validation,
2036 : true, /* This user was authenticated */
2037 : &device_info_dc);
2038 64 : if (!NT_STATUS_IS_OK(nt_status)) {
2039 0 : return map_errno_from_nt_status(nt_status);
2040 : }
2041 :
2042 64 : num_existing_sids = device_info_dc->num_sids;
2043 :
2044 : /*
2045 : * We need to expand group memberships within our local domain,
2046 : * as the token might be generated by a trusted domain.
2047 : */
2048 64 : nt_status = authsam_update_user_info_dc(mem_ctx,
2049 : samdb,
2050 : device_info_dc);
2051 64 : if (!NT_STATUS_IS_OK(nt_status)) {
2052 0 : return map_errno_from_nt_status(nt_status);
2053 : }
2054 :
2055 90 : for (i = num_existing_sids; i < device_info_dc->num_sids; ++i) {
2056 26 : struct auth_SidAttr *device_sid = &device_info_dc->sids[i];
2057 26 : const struct netr_SidAttr sid = (struct netr_SidAttr) {
2058 26 : .sid = &device_sid->sid,
2059 26 : .attributes = device_sid->attrs,
2060 : };
2061 :
2062 26 : krb5_error_code ret = samba_kdc_add_domain_group_sid(device_info, &sid);
2063 26 : if (ret != 0) {
2064 0 : return ret;
2065 : }
2066 : }
2067 :
2068 64 : return 0;
2069 : }
2070 :
2071 73 : static krb5_error_code samba_kdc_get_device_info_pac_blob(TALLOC_CTX *mem_ctx,
2072 : union PAC_INFO *info,
2073 : DATA_BLOB **_device_info_blob)
2074 : {
2075 73 : DATA_BLOB *device_info_blob = NULL;
2076 0 : enum ndr_err_code ndr_err;
2077 :
2078 73 : *_device_info_blob = NULL;
2079 :
2080 73 : device_info_blob = talloc_zero(mem_ctx, DATA_BLOB);
2081 73 : if (device_info_blob == NULL) {
2082 0 : DBG_ERR("Out of memory\n");
2083 0 : return ENOMEM;
2084 : }
2085 :
2086 73 : ndr_err = ndr_push_union_blob(device_info_blob, device_info_blob,
2087 : info, PAC_TYPE_DEVICE_INFO,
2088 : (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
2089 73 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2090 0 : NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2091 0 : DBG_WARNING("PAC_DEVICE_INFO (presig) push failed: %s\n",
2092 : nt_errstr(nt_status));
2093 0 : talloc_free(device_info_blob);
2094 0 : return map_errno_from_nt_status(nt_status);
2095 : }
2096 :
2097 73 : *_device_info_blob = device_info_blob;
2098 :
2099 73 : return 0;
2100 : }
2101 :
2102 64 : static krb5_error_code samba_kdc_create_device_info_blob(TALLOC_CTX *mem_ctx,
2103 : krb5_context context,
2104 : struct ldb_context *samdb,
2105 : const krb5_const_pac device_pac,
2106 : DATA_BLOB **device_info_blob)
2107 : {
2108 64 : TALLOC_CTX *frame = NULL;
2109 0 : krb5_data device_logon_info;
2110 64 : krb5_error_code code = EINVAL;
2111 0 : NTSTATUS nt_status;
2112 :
2113 0 : union PAC_INFO info;
2114 0 : enum ndr_err_code ndr_err;
2115 0 : DATA_BLOB device_logon_info_blob;
2116 :
2117 0 : union PAC_INFO logon_info;
2118 :
2119 64 : code = krb5_pac_get_buffer(context, device_pac,
2120 : PAC_TYPE_LOGON_INFO,
2121 : &device_logon_info);
2122 64 : if (code != 0) {
2123 0 : if (code == ENOENT) {
2124 0 : DBG_ERR("Device PAC is missing LOGON_INFO\n");
2125 : } else {
2126 0 : DBG_ERR("Error getting LOGON_INFO from device PAC\n");
2127 : }
2128 0 : return code;
2129 : }
2130 :
2131 64 : frame = talloc_stackframe();
2132 :
2133 64 : device_logon_info_blob = data_blob_const(device_logon_info.data,
2134 0 : device_logon_info.length);
2135 :
2136 64 : ndr_err = ndr_pull_union_blob(&device_logon_info_blob, frame, &logon_info,
2137 : PAC_TYPE_LOGON_INFO,
2138 : (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
2139 64 : smb_krb5_free_data_contents(context, &device_logon_info);
2140 64 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2141 0 : nt_status = ndr_map_error2ntstatus(ndr_err);
2142 0 : DBG_ERR("can't parse device PAC LOGON_INFO: %s\n",
2143 : nt_errstr(nt_status));
2144 0 : talloc_free(frame);
2145 0 : return map_errno_from_nt_status(nt_status);
2146 : }
2147 :
2148 : /*
2149 : * When creating the device info structure, existing resource groups are
2150 : * discarded.
2151 : */
2152 64 : code = samba_kdc_make_device_info(frame,
2153 64 : &logon_info.logon_info.info->info3,
2154 : NULL, /* resource_groups */
2155 : &info);
2156 64 : if (code != 0) {
2157 0 : talloc_free(frame);
2158 0 : return code;
2159 : }
2160 :
2161 64 : code = samba_kdc_update_device_info(frame,
2162 : samdb,
2163 : &logon_info,
2164 : info.device_info.info);
2165 64 : if (code != 0) {
2166 0 : talloc_free(frame);
2167 0 : return code;
2168 : }
2169 :
2170 64 : code = samba_kdc_get_device_info_pac_blob(mem_ctx,
2171 : &info,
2172 : device_info_blob);
2173 :
2174 64 : talloc_free(frame);
2175 64 : return code;
2176 : }
2177 :
2178 9 : static krb5_error_code samba_kdc_get_device_info_blob(TALLOC_CTX *mem_ctx,
2179 : krb5_context context,
2180 : struct ldb_context *samdb,
2181 : const struct samba_kdc_entry_pac device,
2182 : DATA_BLOB **device_info_blob)
2183 : {
2184 9 : TALLOC_CTX *frame = NULL;
2185 9 : krb5_error_code code = EINVAL;
2186 0 : NTSTATUS nt_status;
2187 :
2188 9 : const struct auth_user_info_dc *device_info = NULL;
2189 9 : struct netr_SamInfo3 *info3 = NULL;
2190 9 : struct PAC_DOMAIN_GROUP_MEMBERSHIP *resource_groups = NULL;
2191 :
2192 0 : union PAC_INFO info;
2193 :
2194 9 : frame = talloc_stackframe();
2195 :
2196 9 : code = samba_kdc_get_user_info_dc(frame,
2197 : context,
2198 : samdb,
2199 : device,
2200 : &device_info,
2201 : NULL /* resource_groups_out */);
2202 9 : if (code) {
2203 0 : const char *krb5_err = krb5_get_error_message(context, code);
2204 0 : DBG_ERR("samba_kdc_get_user_info_dc failed: %s\n",
2205 : krb5_err != NULL ? krb5_err : "<unknown>");
2206 0 : krb5_free_error_message(context, krb5_err);
2207 :
2208 0 : talloc_free(frame);
2209 0 : return KRB5KDC_ERR_TGT_REVOKED;
2210 : }
2211 :
2212 9 : nt_status = auth_convert_user_info_dc_saminfo3(frame, device_info,
2213 : AUTH_INCLUDE_RESOURCE_GROUPS_COMPRESSED,
2214 : &info3,
2215 : &resource_groups);
2216 9 : if (!NT_STATUS_IS_OK(nt_status)) {
2217 0 : DBG_WARNING("Getting Samba info failed: %s\n",
2218 : nt_errstr(nt_status));
2219 0 : talloc_free(frame);
2220 0 : return nt_status_to_krb5(nt_status);
2221 : }
2222 :
2223 9 : code = samba_kdc_make_device_info(frame,
2224 : info3,
2225 : resource_groups,
2226 : &info);
2227 9 : if (code != 0) {
2228 0 : talloc_free(frame);
2229 0 : return code;
2230 : }
2231 :
2232 9 : code = samba_kdc_get_device_info_pac_blob(mem_ctx,
2233 : &info,
2234 : device_info_blob);
2235 :
2236 9 : talloc_free(frame);
2237 9 : return code;
2238 : }
2239 :
2240 : /**
2241 : * @brief Verify a PAC
2242 : *
2243 : * @param mem_ctx A talloc memory context
2244 : *
2245 : * @param context A krb5 context
2246 : *
2247 : * @param samdb An open samdb connection.
2248 : *
2249 : * @param flags Bitwise OR'ed flags
2250 : *
2251 : * @param client The client samba kdc PAC entry.
2252 :
2253 : * @param krbtgt The krbtgt samba kdc entry.
2254 : *
2255 : * @return A Kerberos error code.
2256 : */
2257 49112 : krb5_error_code samba_kdc_verify_pac(TALLOC_CTX *mem_ctx,
2258 : krb5_context context,
2259 : struct ldb_context *samdb,
2260 : uint32_t flags,
2261 : const struct samba_kdc_entry_pac client,
2262 : const struct samba_kdc_entry *krbtgt)
2263 : {
2264 49112 : TALLOC_CTX *tmp_ctx = NULL;
2265 49112 : struct pac_blobs *pac_blobs = NULL;
2266 49112 : krb5_error_code code = EINVAL;
2267 :
2268 49112 : tmp_ctx = talloc_new(mem_ctx);
2269 49112 : if (tmp_ctx == NULL) {
2270 0 : code = ENOMEM;
2271 0 : goto done;
2272 : }
2273 :
2274 49112 : if (client.entry != NULL) {
2275 : /*
2276 : * Check the objectSID of the client and pac data are the same.
2277 : * Does a parse and SID check, but no crypto.
2278 : */
2279 49062 : code = samba_kdc_validate_pac_blob(context, client);
2280 49062 : if (code != 0) {
2281 38 : goto done;
2282 : }
2283 : }
2284 :
2285 49074 : if (!samba_krb5_pac_is_trusted(client)) {
2286 210 : const struct auth_user_info_dc *user_info_dc = NULL;
2287 0 : WERROR werr;
2288 :
2289 210 : struct dom_sid *object_sids = NULL;
2290 0 : uint32_t j;
2291 :
2292 210 : if (client.entry == NULL) {
2293 0 : code = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
2294 32 : goto done;
2295 : }
2296 :
2297 210 : code = samba_kdc_get_user_info_from_db(tmp_ctx,
2298 : samdb,
2299 210 : client.entry,
2300 210 : client.entry->msg,
2301 : &user_info_dc);
2302 210 : if (code) {
2303 0 : const char *krb5_err = krb5_get_error_message(context, code);
2304 0 : DBG_ERR("Getting user info for PAC failed: %s\n",
2305 : krb5_err != NULL ? krb5_err : "<unknown>");
2306 0 : krb5_free_error_message(context, krb5_err);
2307 :
2308 0 : code = KRB5KDC_ERR_TGT_REVOKED;
2309 0 : goto done;
2310 : }
2311 :
2312 : /*
2313 : * Check if the SID list in the user_info_dc intersects
2314 : * correctly with the RODC allow/deny lists.
2315 : */
2316 210 : object_sids = talloc_array(tmp_ctx, struct dom_sid, user_info_dc->num_sids);
2317 210 : if (object_sids == NULL) {
2318 0 : code = ENOMEM;
2319 0 : goto done;
2320 : }
2321 :
2322 930 : for (j = 0; j < user_info_dc->num_sids; ++j) {
2323 720 : object_sids[j] = user_info_dc->sids[j].sid;
2324 : }
2325 :
2326 210 : werr = samba_rodc_confirm_user_is_allowed(user_info_dc->num_sids,
2327 : object_sids,
2328 : krbtgt,
2329 210 : client.entry);
2330 210 : if (!W_ERROR_IS_OK(werr)) {
2331 30 : code = KRB5KDC_ERR_TGT_REVOKED;
2332 30 : if (W_ERROR_EQUAL(werr,
2333 : WERR_DOMAIN_CONTROLLER_NOT_FOUND)) {
2334 12 : code = KRB5KDC_ERR_POLICY;
2335 : }
2336 30 : goto done;
2337 : }
2338 :
2339 : /*
2340 : * The RODC PAC data isn't trusted for authorization as it may
2341 : * be stale. The only thing meaningful we can do with an RODC
2342 : * account on a full DC is exchange the RODC TGT for a 'real'
2343 : * TGT.
2344 : *
2345 : * So we match Windows (at least server 2022) and
2346 : * don't allow S4U2Self.
2347 : *
2348 : * https://lists.samba.org/archive/cifs-protocol/2022-April/003673.html
2349 : */
2350 180 : if (flags & SAMBA_KDC_FLAG_PROTOCOL_TRANSITION) {
2351 2 : code = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
2352 2 : goto done;
2353 : }
2354 : }
2355 :
2356 : /* Check the types of the given PAC */
2357 :
2358 50700 : code = pac_blobs_from_krb5_pac(tmp_ctx,
2359 : context,
2360 49042 : client.pac,
2361 : &pac_blobs);
2362 49042 : if (code != 0) {
2363 0 : goto done;
2364 : }
2365 :
2366 49042 : code = pac_blobs_ensure_exists(pac_blobs,
2367 : PAC_TYPE_LOGON_INFO);
2368 49042 : if (code != 0) {
2369 0 : goto done;
2370 : }
2371 :
2372 49042 : code = pac_blobs_ensure_exists(pac_blobs,
2373 : PAC_TYPE_LOGON_NAME);
2374 49042 : if (code != 0) {
2375 0 : goto done;
2376 : }
2377 :
2378 49042 : code = pac_blobs_ensure_exists(pac_blobs,
2379 : PAC_TYPE_SRV_CHECKSUM);
2380 49042 : if (code != 0) {
2381 0 : goto done;
2382 : }
2383 :
2384 49042 : code = pac_blobs_ensure_exists(pac_blobs,
2385 : PAC_TYPE_KDC_CHECKSUM);
2386 49042 : if (code != 0) {
2387 0 : goto done;
2388 : }
2389 :
2390 49042 : if (!(flags & SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION)) {
2391 48887 : code = pac_blobs_ensure_exists(pac_blobs,
2392 : PAC_TYPE_REQUESTER_SID);
2393 48887 : if (code != 0) {
2394 6 : code = KRB5KDC_ERR_TGT_REVOKED;
2395 6 : goto done;
2396 : }
2397 : }
2398 :
2399 47378 : code = 0;
2400 :
2401 49112 : done:
2402 49112 : talloc_free(tmp_ctx);
2403 :
2404 49112 : return code;
2405 : }
2406 :
2407 : /**
2408 : * @brief Update a PAC
2409 : *
2410 : * @param mem_ctx A talloc memory context
2411 : *
2412 : * @param context A krb5 context
2413 : *
2414 : * @param samdb An open samdb connection.
2415 : *
2416 : * @param lp_ctx A loadparm context.
2417 : *
2418 : * @param flags Bitwise OR'ed flags
2419 : *
2420 : * @param device_pac_is_trusted Whether the device's PAC was issued by a trusted server,
2421 : * as opposed to an RODC.
2422 : *
2423 : * @param client The client samba kdc PAC entry.
2424 : *
2425 : * @param server_principal The server principal
2426 : *
2427 : * @param server The server samba kdc entry.
2428 : *
2429 : * @param delegated_proxy_principal The delegated proxy principal used for
2430 : * updating the constrained delegation PAC
2431 : * buffer.
2432 : *
2433 : * @param delegated_proxy The delegated proxy kdc PAC entry.
2434 : *
2435 : * @param device The computer's samba kdc PAC entry; used for compound
2436 : * authentication.
2437 : *
2438 : * @param new_pac The new already allocated PAC
2439 : *
2440 : * @return A Kerberos error code. If no PAC should be returned, the code will be
2441 : * ENOATTR!
2442 : */
2443 47338 : krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx,
2444 : krb5_context context,
2445 : struct ldb_context *samdb,
2446 : struct loadparm_context *lp_ctx,
2447 : uint32_t flags,
2448 : const struct samba_kdc_entry_pac client,
2449 : const krb5_const_principal server_principal,
2450 : const struct samba_kdc_entry *server,
2451 : const krb5_const_principal delegated_proxy_principal,
2452 : const struct samba_kdc_entry_pac delegated_proxy,
2453 : const struct samba_kdc_entry_pac device,
2454 : krb5_pac new_pac,
2455 : struct authn_audit_info **server_audit_info_out,
2456 : NTSTATUS *status_out)
2457 : {
2458 47338 : TALLOC_CTX *tmp_ctx = NULL;
2459 47338 : krb5_error_code code = EINVAL;
2460 1658 : NTSTATUS nt_status;
2461 47338 : DATA_BLOB *pac_blob = NULL;
2462 47338 : DATA_BLOB *upn_blob = NULL;
2463 47338 : DATA_BLOB *deleg_blob = NULL;
2464 47338 : DATA_BLOB *requester_sid_blob = NULL;
2465 47338 : const DATA_BLOB *client_claims_blob = NULL;
2466 47338 : DATA_BLOB device_claims_blob = {};
2467 47338 : const DATA_BLOB *device_claims_blob_ptr = NULL;
2468 47338 : struct auth_claims auth_claims = {};
2469 47338 : DATA_BLOB *device_info_blob = NULL;
2470 47338 : bool is_tgs = false;
2471 47338 : bool server_restrictions_present = false;
2472 47338 : struct pac_blobs *pac_blobs = NULL;
2473 47338 : const struct auth_user_info_dc *user_info_dc_const = NULL;
2474 47338 : struct auth_user_info_dc *user_info_dc_shallow_copy = NULL;
2475 47338 : const struct PAC_DOMAIN_GROUP_MEMBERSHIP *_resource_groups = NULL;
2476 1658 : enum auth_group_inclusion group_inclusion;
2477 1658 : bool compounded_auth;
2478 47338 : size_t i = 0;
2479 :
2480 47338 : if (server_audit_info_out != NULL) {
2481 47338 : *server_audit_info_out = NULL;
2482 : }
2483 :
2484 47338 : if (status_out != NULL) {
2485 47338 : *status_out = NT_STATUS_OK;
2486 : }
2487 :
2488 47338 : tmp_ctx = talloc_new(mem_ctx);
2489 47338 : if (tmp_ctx == NULL) {
2490 0 : code = ENOMEM;
2491 0 : goto done;
2492 : }
2493 :
2494 : {
2495 47338 : int result = smb_krb5_principal_is_tgs(context, server_principal);
2496 47338 : if (result == -1) {
2497 0 : code = ENOMEM;
2498 0 : goto done;
2499 : }
2500 :
2501 47338 : is_tgs = result;
2502 : }
2503 :
2504 47338 : server_restrictions_present = !is_tgs && authn_policy_restrictions_present(server->server_policy);
2505 :
2506 : /* Only include resource groups in a service ticket. */
2507 47338 : if (is_tgs) {
2508 25885 : group_inclusion = AUTH_EXCLUDE_RESOURCE_GROUPS;
2509 20418 : } else if (server->supported_enctypes & KERB_ENCTYPE_RESOURCE_SID_COMPRESSION_DISABLED) {
2510 21 : group_inclusion = AUTH_INCLUDE_RESOURCE_GROUPS;
2511 : } else {
2512 20397 : group_inclusion = AUTH_INCLUDE_RESOURCE_GROUPS_COMPRESSED;
2513 : }
2514 :
2515 281 : compounded_auth = device.entry != NULL && !is_tgs
2516 47619 : && server->supported_enctypes & KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED;
2517 :
2518 47338 : if (compounded_auth || (server_restrictions_present && device.entry != NULL)) {
2519 : /*
2520 : * [MS-KILE] 3.3.5.7.4 Compound Identity: the client claims from
2521 : * the device PAC become the device claims in the new PAC.
2522 : */
2523 211 : code = samba_kdc_get_claims_data(tmp_ctx,
2524 : context,
2525 : samdb,
2526 : device,
2527 : &auth_claims.device_claims);
2528 211 : if (code) {
2529 0 : goto done;
2530 : }
2531 :
2532 211 : if (compounded_auth) {
2533 73 : nt_status = claims_data_encoded_claims_set(tmp_ctx,
2534 : auth_claims.device_claims,
2535 : &device_claims_blob);
2536 73 : if (!NT_STATUS_IS_OK(nt_status)) {
2537 0 : DBG_ERR("claims_data_encoded_claims_set failed: %s\n",
2538 : nt_errstr(nt_status));
2539 0 : code = map_errno_from_nt_status(nt_status);
2540 0 : goto done;
2541 : }
2542 :
2543 73 : device_claims_blob_ptr = &device_claims_blob;
2544 :
2545 73 : if (samba_krb5_pac_is_trusted(device)) {
2546 64 : code = samba_kdc_create_device_info_blob(tmp_ctx,
2547 : context,
2548 : samdb,
2549 64 : device.pac,
2550 : &device_info_blob);
2551 64 : if (code != 0) {
2552 0 : goto done;
2553 : }
2554 : } else {
2555 : /* Don't trust an RODC‐issued PAC; regenerate the device info. */
2556 9 : code = samba_kdc_get_device_info_blob(tmp_ctx,
2557 : context,
2558 : samdb,
2559 : device,
2560 : &device_info_blob);
2561 9 : if (code != 0) {
2562 0 : goto done;
2563 : }
2564 : }
2565 : }
2566 : }
2567 :
2568 47338 : if (delegated_proxy_principal != NULL) {
2569 152 : deleg_blob = talloc_zero(tmp_ctx, DATA_BLOB);
2570 152 : if (deleg_blob == NULL) {
2571 0 : code = ENOMEM;
2572 0 : goto done;
2573 : }
2574 :
2575 152 : nt_status = samba_kdc_update_delegation_info_blob(
2576 : deleg_blob,
2577 : context,
2578 152 : client.pac,
2579 : server_principal,
2580 : delegated_proxy_principal,
2581 : deleg_blob);
2582 152 : if (!NT_STATUS_IS_OK(nt_status)) {
2583 0 : DBG_ERR("update delegation info blob failed: %s\n",
2584 : nt_errstr(nt_status));
2585 0 : code = map_errno_from_nt_status(nt_status);
2586 0 : goto done;
2587 : }
2588 : }
2589 :
2590 : /*
2591 : * If we are creating a TGT, resource groups from our domain are not to
2592 : * be put into the PAC. Instead, we take the resource groups directly
2593 : * from the original PAC and copy them unmodified into the new one.
2594 : */
2595 47961 : code = samba_kdc_get_user_info_dc(tmp_ctx,
2596 : context,
2597 : samdb,
2598 : client,
2599 : &user_info_dc_const,
2600 : is_tgs ? &_resource_groups : NULL);
2601 47338 : if (code != 0) {
2602 0 : const char *err_str = krb5_get_error_message(context, code);
2603 0 : DBG_ERR("samba_kdc_get_user_info_dc failed: %s\n",
2604 : err_str != NULL ? err_str : "<unknown>");
2605 0 : krb5_free_error_message(context, err_str);
2606 :
2607 0 : goto done;
2608 : }
2609 :
2610 : /*
2611 : * Enforce the AllowedToAuthenticateTo part of an authentication policy,
2612 : * if one is present.
2613 : */
2614 47338 : if (server_restrictions_present) {
2615 0 : struct samba_kdc_entry_pac auth_entry;
2616 152 : const struct auth_user_info_dc *auth_user_info_dc = NULL;
2617 152 : const struct auth_user_info_dc *device_info = NULL;
2618 :
2619 152 : if (delegated_proxy.entry != NULL) {
2620 34 : auth_entry = delegated_proxy;
2621 :
2622 34 : code = samba_kdc_get_user_info_dc(tmp_ctx,
2623 : context,
2624 : samdb,
2625 : delegated_proxy,
2626 : &auth_user_info_dc,
2627 : NULL /* resource_groups_out */);
2628 34 : if (code) {
2629 57 : goto done;
2630 : }
2631 : } else {
2632 118 : auth_entry = client;
2633 118 : auth_user_info_dc = user_info_dc_const;
2634 : }
2635 :
2636 : /* Fetch the user’s claims. */
2637 152 : code = samba_kdc_get_claims_data(tmp_ctx,
2638 : context,
2639 : samdb,
2640 : auth_entry,
2641 : &auth_claims.user_claims);
2642 152 : if (code) {
2643 0 : goto done;
2644 : }
2645 :
2646 152 : if (device.entry != NULL) {
2647 146 : code = samba_kdc_get_user_info_dc(tmp_ctx,
2648 : context,
2649 : samdb,
2650 : device,
2651 : &device_info,
2652 : NULL /* resource_groups_out */);
2653 146 : if (code) {
2654 0 : goto done;
2655 : }
2656 : }
2657 :
2658 : /*
2659 : * Allocate the audit info and output status on to the parent
2660 : * mem_ctx, not the temporary context.
2661 : */
2662 152 : code = samba_kdc_allowed_to_authenticate_to(mem_ctx,
2663 : samdb,
2664 : lp_ctx,
2665 152 : auth_entry.entry,
2666 : auth_user_info_dc,
2667 : device_info,
2668 : auth_claims,
2669 : server,
2670 : server_audit_info_out,
2671 : status_out);
2672 152 : if (code) {
2673 57 : goto done;
2674 : }
2675 : }
2676 :
2677 47281 : if (compounded_auth) {
2678 : /* Make a shallow copy of the user_info_dc structure. */
2679 73 : nt_status = authsam_shallow_copy_user_info_dc(tmp_ctx,
2680 : user_info_dc_const,
2681 : &user_info_dc_shallow_copy);
2682 73 : user_info_dc_const = NULL;
2683 :
2684 73 : if (!NT_STATUS_IS_OK(nt_status)) {
2685 0 : DBG_ERR("Failed to copy user_info_dc: %s\n",
2686 : nt_errstr(nt_status));
2687 :
2688 0 : code = KRB5KDC_ERR_TGT_REVOKED;
2689 0 : goto done;
2690 : }
2691 :
2692 73 : nt_status = samba_kdc_add_compounded_auth(user_info_dc_shallow_copy);
2693 73 : if (!NT_STATUS_IS_OK(nt_status)) {
2694 0 : DBG_ERR("Failed to add Compounded Authentication: %s\n",
2695 : nt_errstr(nt_status));
2696 :
2697 0 : code = KRB5KDC_ERR_TGT_REVOKED;
2698 0 : goto done;
2699 : }
2700 :
2701 : /* We can now set back to the const, it will not be modified */
2702 73 : user_info_dc_const = user_info_dc_shallow_copy;
2703 : }
2704 :
2705 47281 : if (samba_krb5_pac_is_trusted(client)) {
2706 47166 : pac_blob = talloc_zero(tmp_ctx, DATA_BLOB);
2707 47166 : if (pac_blob == NULL) {
2708 0 : code = ENOMEM;
2709 0 : goto done;
2710 : }
2711 :
2712 47166 : nt_status = samba_get_logon_info_pac_blob(tmp_ctx,
2713 : user_info_dc_const,
2714 : _resource_groups,
2715 : group_inclusion,
2716 : pac_blob);
2717 47166 : if (!NT_STATUS_IS_OK(nt_status)) {
2718 0 : DBG_ERR("samba_get_logon_info_pac_blob failed: %s\n",
2719 : nt_errstr(nt_status));
2720 :
2721 0 : code = map_errno_from_nt_status(nt_status);
2722 0 : goto done;
2723 : }
2724 :
2725 : /*
2726 : * TODO: we need claim translation over trusts,
2727 : * for now we just clear them...
2728 : */
2729 48824 : if (samba_kdc_entry_pac_issued_by_trust(client)) {
2730 49 : client_claims_blob = &data_blob_null;
2731 : }
2732 : } else {
2733 115 : nt_status = samba_kdc_get_logon_info_blob(tmp_ctx,
2734 : user_info_dc_const,
2735 : group_inclusion,
2736 : &pac_blob);
2737 115 : if (!NT_STATUS_IS_OK(nt_status)) {
2738 0 : DBG_ERR("samba_kdc_get_logon_info_blob failed: %s\n",
2739 : nt_errstr(nt_status));
2740 0 : code = KRB5KDC_ERR_TGT_REVOKED;
2741 0 : goto done;
2742 : }
2743 :
2744 115 : nt_status = samba_kdc_get_upn_info_blob(tmp_ctx,
2745 : user_info_dc_const,
2746 : &upn_blob);
2747 115 : if (!NT_STATUS_IS_OK(nt_status)) {
2748 0 : DBG_ERR("samba_kdc_get_upn_info_blob failed: %s\n",
2749 : nt_errstr(nt_status));
2750 0 : code = KRB5KDC_ERR_TGT_REVOKED;
2751 0 : goto done;
2752 : }
2753 :
2754 115 : if (is_tgs) {
2755 18 : nt_status = samba_kdc_get_requester_sid_blob(tmp_ctx,
2756 : user_info_dc_const,
2757 : &requester_sid_blob);
2758 18 : if (!NT_STATUS_IS_OK(nt_status)) {
2759 0 : DBG_ERR("samba_kdc_get_requester_sid_blob failed: %s\n",
2760 : nt_errstr(nt_status));
2761 0 : code = KRB5KDC_ERR_TGT_REVOKED;
2762 0 : goto done;
2763 : }
2764 : }
2765 :
2766 : /* Don't trust RODC-issued claims. Regenerate them. */
2767 115 : nt_status = samba_kdc_get_claims_blob(tmp_ctx,
2768 115 : client.entry,
2769 : &client_claims_blob);
2770 115 : if (!NT_STATUS_IS_OK(nt_status)) {
2771 0 : DBG_ERR("samba_kdc_get_claims_blob failed: %s\n",
2772 : nt_errstr(nt_status));
2773 0 : code = map_errno_from_nt_status(nt_status);
2774 0 : goto done;
2775 : }
2776 : }
2777 :
2778 : /* Check the types of the given PAC */
2779 47281 : code = pac_blobs_from_krb5_pac(tmp_ctx,
2780 : context,
2781 45623 : client.pac,
2782 : &pac_blobs);
2783 47281 : if (code != 0) {
2784 0 : goto done;
2785 : }
2786 :
2787 47281 : code = pac_blobs_replace_existing(pac_blobs,
2788 : PAC_TYPE_LOGON_INFO,
2789 : pac_blob);
2790 47281 : if (code != 0) {
2791 0 : goto done;
2792 : }
2793 :
2794 : #ifdef SAMBA4_USES_HEIMDAL
2795 : /* Not needed with MIT Kerberos */
2796 47281 : code = pac_blobs_replace_existing(pac_blobs,
2797 : PAC_TYPE_LOGON_NAME,
2798 : &data_blob_null);
2799 47281 : if (code != 0) {
2800 0 : goto done;
2801 : }
2802 :
2803 47281 : code = pac_blobs_replace_existing(pac_blobs,
2804 : PAC_TYPE_SRV_CHECKSUM,
2805 : &data_blob_null);
2806 47281 : if (code != 0) {
2807 0 : goto done;
2808 : }
2809 :
2810 47281 : code = pac_blobs_replace_existing(pac_blobs,
2811 : PAC_TYPE_KDC_CHECKSUM,
2812 : &data_blob_null);
2813 47281 : if (code != 0) {
2814 0 : goto done;
2815 : }
2816 : #endif
2817 :
2818 47281 : code = pac_blobs_add_blob(pac_blobs,
2819 : PAC_TYPE_CONSTRAINED_DELEGATION,
2820 : deleg_blob);
2821 47281 : if (code != 0) {
2822 0 : goto done;
2823 : }
2824 :
2825 47281 : code = pac_blobs_add_blob(pac_blobs,
2826 : PAC_TYPE_UPN_DNS_INFO,
2827 : upn_blob);
2828 47281 : if (code != 0) {
2829 0 : goto done;
2830 : }
2831 :
2832 47281 : code = pac_blobs_add_blob(pac_blobs,
2833 : PAC_TYPE_CLIENT_CLAIMS_INFO,
2834 : client_claims_blob);
2835 47281 : if (code != 0) {
2836 0 : goto done;
2837 : }
2838 :
2839 47281 : code = pac_blobs_add_blob(pac_blobs,
2840 : PAC_TYPE_DEVICE_INFO,
2841 : device_info_blob);
2842 47281 : if (code != 0) {
2843 0 : goto done;
2844 : }
2845 :
2846 47281 : code = pac_blobs_add_blob(pac_blobs,
2847 : PAC_TYPE_DEVICE_CLAIMS_INFO,
2848 : device_claims_blob_ptr);
2849 47281 : if (code != 0) {
2850 0 : goto done;
2851 : }
2852 :
2853 47281 : if (!samba_krb5_pac_is_trusted(client) || !is_tgs) {
2854 20379 : pac_blobs_remove_blob(pac_blobs,
2855 : PAC_TYPE_ATTRIBUTES_INFO);
2856 : }
2857 :
2858 47281 : if (!is_tgs) {
2859 20361 : pac_blobs_remove_blob(pac_blobs,
2860 : PAC_TYPE_REQUESTER_SID);
2861 : }
2862 :
2863 47281 : code = pac_blobs_add_blob(pac_blobs,
2864 : PAC_TYPE_REQUESTER_SID,
2865 : requester_sid_blob);
2866 47281 : if (code != 0) {
2867 0 : goto done;
2868 : }
2869 :
2870 : /*
2871 : * The server account may be set not to want the PAC.
2872 : *
2873 : * While this is wasteful if the above calculations were done
2874 : * and now thrown away, this is cleaner as we do any ticket
2875 : * signature checking etc always.
2876 : *
2877 : * UF_NO_AUTH_DATA_REQUIRED is the rare case and most of the
2878 : * time (eg not accepting a ticket from the RODC) we do not
2879 : * need to re-generate anything anyway.
2880 : */
2881 47281 : if (!samba_princ_needs_pac(server)) {
2882 5 : code = ENOATTR;
2883 5 : goto done;
2884 : }
2885 :
2886 47276 : if (samba_krb5_pac_is_trusted(client) && !is_tgs) {
2887 : /*
2888 : * The client may have requested no PAC when obtaining the
2889 : * TGT.
2890 : */
2891 20259 : bool requested_pac = false;
2892 :
2893 20259 : code = samba_client_requested_pac(context,
2894 19636 : client.pac,
2895 : tmp_ctx,
2896 : &requested_pac);
2897 20259 : if (code != 0 || !requested_pac) {
2898 6 : if (!requested_pac) {
2899 6 : code = ENOATTR;
2900 : }
2901 6 : goto done;
2902 : }
2903 : }
2904 :
2905 385333 : for (i = 0; i < pac_blobs->num_types; ++i) {
2906 12018 : krb5_data type_data;
2907 338063 : const DATA_BLOB *type_blob = pac_blobs->type_blobs[i].data;
2908 338063 : uint32_t type = pac_blobs->type_blobs[i].type;
2909 :
2910 12018 : static char null_byte = '\0';
2911 338063 : const krb5_data null_data = smb_krb5_make_data(&null_byte, 0);
2912 :
2913 : #ifndef SAMBA4_USES_HEIMDAL
2914 : /* Not needed with MIT Kerberos */
2915 0 : switch(type) {
2916 0 : case PAC_TYPE_LOGON_NAME:
2917 : case PAC_TYPE_SRV_CHECKSUM:
2918 : case PAC_TYPE_KDC_CHECKSUM:
2919 : case PAC_TYPE_FULL_CHECKSUM:
2920 0 : continue;
2921 0 : default:
2922 0 : break;
2923 : }
2924 : #endif
2925 :
2926 338063 : if (type_blob != NULL) {
2927 189660 : type_data = smb_krb5_data_from_blob(*type_blob);
2928 : /*
2929 : * Passing a NULL pointer into krb5_pac_add_buffer() is
2930 : * not allowed, so pass null_data instead if needed.
2931 : */
2932 189660 : code = krb5_pac_add_buffer(context,
2933 : new_pac,
2934 : type,
2935 189660 : (type_data.data != NULL) ? &type_data : &null_data);
2936 189660 : if (code != 0) {
2937 0 : goto done;
2938 : }
2939 148403 : } else if (samba_krb5_pac_is_trusted(client)) {
2940 : /*
2941 : * Convey the buffer from the original PAC if we can
2942 : * trust it.
2943 : */
2944 :
2945 148378 : code = krb5_pac_get_buffer(context,
2946 142992 : client.pac,
2947 : type,
2948 : &type_data);
2949 148378 : if (code != 0) {
2950 0 : goto done;
2951 : }
2952 : /*
2953 : * Passing a NULL pointer into krb5_pac_add_buffer() is
2954 : * not allowed, so pass null_data instead if needed.
2955 : */
2956 148378 : code = krb5_pac_add_buffer(context,
2957 : new_pac,
2958 : type,
2959 148378 : (type_data.data != NULL) ? &type_data : &null_data);
2960 148378 : smb_krb5_free_data_contents(context, &type_data);
2961 148378 : if (code != 0) {
2962 0 : goto done;
2963 : }
2964 : }
2965 : }
2966 :
2967 45612 : code = 0;
2968 47338 : done:
2969 47338 : TALLOC_FREE(tmp_ctx);
2970 47338 : return code;
2971 : }
2972 :
2973 975 : krb5_error_code samba_kdc_get_claims_data(TALLOC_CTX *mem_ctx,
2974 : krb5_context context,
2975 : struct ldb_context *samdb,
2976 : struct samba_kdc_entry_pac entry,
2977 : struct claims_data **claims_data_out)
2978 : {
2979 975 : if (samba_kdc_entry_pac_issued_by_trust(entry)) {
2980 0 : NTSTATUS status;
2981 :
2982 : /*
2983 : * TODO: we need claim translation over trusts; for now we just
2984 : * clear them…
2985 : */
2986 0 : status = claims_data_from_encoded_claims_set(mem_ctx,
2987 : NULL,
2988 : claims_data_out);
2989 0 : if (!NT_STATUS_IS_OK(status)) {
2990 0 : return map_errno_from_nt_status(status);
2991 : }
2992 :
2993 0 : return 0;
2994 : }
2995 :
2996 975 : if (samba_krb5_pac_is_trusted(entry)) {
2997 907 : return samba_kdc_get_claims_data_from_pac(mem_ctx,
2998 : context,
2999 : entry,
3000 : claims_data_out);
3001 : }
3002 :
3003 68 : return samba_kdc_get_claims_data_from_db(samdb,
3004 : entry.entry,
3005 : claims_data_out);
3006 : }
3007 :
3008 907 : krb5_error_code samba_kdc_get_claims_data_from_pac(TALLOC_CTX *mem_ctx,
3009 : krb5_context context,
3010 : struct samba_kdc_entry_pac entry,
3011 : struct claims_data **claims_data_out)
3012 : {
3013 907 : TALLOC_CTX *frame = NULL;
3014 907 : krb5_data claims_info = {};
3015 907 : struct claims_data *claims_data = NULL;
3016 907 : NTSTATUS status = NT_STATUS_OK;
3017 0 : krb5_error_code code;
3018 :
3019 907 : if (!samba_krb5_pac_is_trusted(entry)) {
3020 0 : code = EINVAL;
3021 0 : goto out;
3022 : }
3023 :
3024 907 : if (samba_kdc_entry_pac_issued_by_trust(entry)) {
3025 0 : code = EINVAL;
3026 0 : goto out;
3027 : }
3028 :
3029 907 : if (claims_data_out == NULL) {
3030 0 : code = EINVAL;
3031 0 : goto out;
3032 : }
3033 :
3034 907 : *claims_data_out = NULL;
3035 :
3036 907 : if (entry.entry != NULL && entry.entry->claims_from_pac_are_initialized) {
3037 : /* Note: the caller does not own this! */
3038 30 : *claims_data_out = entry.entry->claims_from_pac;
3039 30 : return 0;
3040 : }
3041 :
3042 877 : frame = talloc_stackframe();
3043 :
3044 : /* Fetch the claims from the PAC. */
3045 877 : code = krb5_pac_get_buffer(context, entry.pac,
3046 : PAC_TYPE_CLIENT_CLAIMS_INFO,
3047 : &claims_info);
3048 877 : if (code == ENOENT) {
3049 : /* OK. */
3050 877 : } else if (code != 0) {
3051 0 : DBG_ERR("Error getting CLIENT_CLAIMS_INFO from PAC\n");
3052 0 : goto out;
3053 877 : } else if (claims_info.length) {
3054 335 : DATA_BLOB claims_blob = data_blob_const(claims_info.data,
3055 0 : claims_info.length);
3056 :
3057 335 : status = claims_data_from_encoded_claims_set(frame,
3058 : &claims_blob,
3059 : &claims_data);
3060 335 : if (!NT_STATUS_IS_OK(status)) {
3061 0 : code = map_errno_from_nt_status(status);
3062 0 : goto out;
3063 : }
3064 : }
3065 :
3066 877 : if (entry.entry != NULL) {
3067 : /* Note: the caller does not own this! */
3068 877 : entry.entry->claims_from_pac = talloc_steal(entry.entry,
3069 : claims_data);
3070 877 : entry.entry->claims_from_pac_are_initialized = true;
3071 : } else {
3072 0 : talloc_steal(mem_ctx, claims_data);
3073 : }
3074 :
3075 877 : *claims_data_out = claims_data;
3076 :
3077 877 : out:
3078 877 : smb_krb5_free_data_contents(context, &claims_info);
3079 877 : talloc_free(frame);
3080 877 : return code;
3081 : }
3082 :
3083 30294 : krb5_error_code samba_kdc_get_claims_data_from_db(struct ldb_context *samdb,
3084 : struct samba_kdc_entry *entry,
3085 : struct claims_data **claims_data_out)
3086 : {
3087 30294 : TALLOC_CTX *frame = NULL;
3088 :
3089 30294 : struct claims_data *claims_data = NULL;
3090 30294 : struct CLAIMS_SET *claims_set = NULL;
3091 30294 : NTSTATUS status = NT_STATUS_OK;
3092 1170 : krb5_error_code code;
3093 :
3094 30294 : if (samdb == NULL) {
3095 0 : code = EINVAL;
3096 0 : goto out;
3097 : }
3098 :
3099 30294 : if (claims_data_out == NULL) {
3100 0 : code = EINVAL;
3101 0 : goto out;
3102 : }
3103 :
3104 30294 : if (entry == NULL) {
3105 0 : code = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
3106 0 : goto out;
3107 : }
3108 :
3109 30294 : *claims_data_out = NULL;
3110 :
3111 30294 : if (entry->claims_from_db_are_initialized) {
3112 : /* Note: the caller does not own this! */
3113 14 : *claims_data_out = entry->claims_from_db;
3114 14 : return 0;
3115 : }
3116 :
3117 30280 : frame = talloc_stackframe();
3118 :
3119 31450 : code = get_claims_set_for_principal(samdb,
3120 : frame,
3121 30280 : entry->msg,
3122 : &claims_set);
3123 30280 : if (code) {
3124 0 : DBG_ERR("Failed to fetch claims\n");
3125 0 : goto out;
3126 : }
3127 :
3128 30280 : if (claims_set != NULL) {
3129 352 : status = claims_data_from_claims_set(claims_data,
3130 : claims_set,
3131 : &claims_data);
3132 352 : if (!NT_STATUS_IS_OK(status)) {
3133 0 : code = map_errno_from_nt_status(status);
3134 0 : goto out;
3135 : }
3136 : }
3137 :
3138 30280 : entry->claims_from_db = talloc_steal(entry,
3139 : claims_data);
3140 30280 : entry->claims_from_db_are_initialized = true;
3141 :
3142 : /* Note: the caller does not own this! */
3143 30280 : *claims_data_out = entry->claims_from_db;
3144 :
3145 30280 : out:
3146 30280 : talloc_free(frame);
3147 30280 : return code;
3148 : }
3149 :
3150 48050 : krb5_error_code samba_kdc_check_device(TALLOC_CTX *mem_ctx,
3151 : krb5_context context,
3152 : struct ldb_context *samdb,
3153 : struct loadparm_context *lp_ctx,
3154 : const struct samba_kdc_entry_pac device,
3155 : const struct authn_kerberos_client_policy *client_policy,
3156 : struct authn_audit_info **client_audit_info_out,
3157 : NTSTATUS *status_out)
3158 : {
3159 48050 : TALLOC_CTX *frame = NULL;
3160 48050 : krb5_error_code code = 0;
3161 1755 : NTSTATUS nt_status;
3162 48050 : const struct auth_user_info_dc *device_info = NULL;
3163 48050 : struct authn_audit_info *client_audit_info = NULL;
3164 48050 : struct auth_claims auth_claims = {};
3165 :
3166 48050 : if (status_out != NULL) {
3167 48050 : *status_out = NT_STATUS_OK;
3168 : }
3169 :
3170 48050 : if (!authn_policy_device_restrictions_present(client_policy)) {
3171 45907 : return 0;
3172 : }
3173 :
3174 388 : if (device.entry == NULL || device.pac == NULL) {
3175 3 : NTSTATUS out_status = NT_STATUS_INVALID_WORKSTATION;
3176 :
3177 3 : nt_status = authn_kerberos_client_policy_audit_info(mem_ctx,
3178 : client_policy,
3179 : NULL /* client_info */,
3180 : AUTHN_AUDIT_EVENT_KERBEROS_DEVICE_RESTRICTION,
3181 : AUTHN_AUDIT_REASON_FAST_REQUIRED,
3182 : out_status,
3183 : client_audit_info_out);
3184 3 : if (!NT_STATUS_IS_OK(nt_status)) {
3185 0 : code = KRB5KRB_ERR_GENERIC;
3186 3 : } else if (authn_kerberos_client_policy_is_enforced(client_policy)) {
3187 2 : code = KRB5KDC_ERR_POLICY;
3188 :
3189 2 : if (status_out != NULL) {
3190 2 : *status_out = out_status;
3191 : }
3192 : } else {
3193 : /* OK. */
3194 1 : code = 0;
3195 : }
3196 :
3197 3 : goto out;
3198 : }
3199 :
3200 385 : frame = talloc_stackframe();
3201 :
3202 385 : code = samba_kdc_get_user_info_dc(frame,
3203 : context,
3204 : samdb,
3205 : device,
3206 : &device_info,
3207 : NULL);
3208 385 : if (code) {
3209 0 : goto out;
3210 : }
3211 :
3212 : /*
3213 : * The device claims become the *user* claims for the purpose of
3214 : * evaluating a conditional ACE expression.
3215 : */
3216 385 : code = samba_kdc_get_claims_data(frame,
3217 : context,
3218 : samdb,
3219 : device,
3220 : &auth_claims.user_claims);
3221 385 : if (code) {
3222 0 : goto out;
3223 : }
3224 :
3225 385 : nt_status = authn_policy_authenticate_from_device(frame,
3226 : samdb,
3227 : lp_ctx,
3228 : device_info,
3229 : auth_claims,
3230 : client_policy,
3231 : &client_audit_info);
3232 385 : if (client_audit_info != NULL) {
3233 385 : *client_audit_info_out = talloc_move(mem_ctx, &client_audit_info);
3234 : }
3235 385 : if (!NT_STATUS_IS_OK(nt_status)) {
3236 256 : if (NT_STATUS_EQUAL(nt_status, NT_STATUS_AUTHENTICATION_FIREWALL_FAILED)) {
3237 239 : code = KRB5KDC_ERR_POLICY;
3238 : } else {
3239 17 : code = KRB5KRB_ERR_GENERIC;
3240 : }
3241 :
3242 256 : goto out;
3243 : }
3244 :
3245 129 : out:
3246 388 : talloc_free(frame);
3247 388 : return code;
3248 : }
|
