From 15b9e70ebcad41b2fff3462150bd81f6b64e0c33 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Thu, 27 Oct 2005 13:54:30 +0000 Subject: r11333: Push service principal lookups into the cracknames code, rather than in the hdb-ldb code. Andrew Bartlett (This used to be commit f71149c88d9648f5b2b1d1480dc8d45c551b0231) --- source4/kdc/hdb-ldb.c | 258 ++++++++++++++++++-------------------------------- 1 file changed, 92 insertions(+), 166 deletions(-) (limited to 'source4/kdc/hdb-ldb.c') diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c index 4100511a89..8a43a19251 100644 --- a/source4/kdc/hdb-ldb.c +++ b/source4/kdc/hdb-ldb.c @@ -622,84 +622,6 @@ static krb5_error_code LDB_lookup_realm(krb5_context context, struct ldb_context return 0; } -static krb5_error_code LDB_lookup_spn_alias(krb5_context context, struct ldb_context *ldb_ctx, - TALLOC_CTX *mem_ctx, - const struct ldb_dn *realm_dn, - const char *alias_from, - char **alias_to) -{ - int i; - int count; - struct ldb_message **msg; - struct ldb_message_element *spnmappings; - struct ldb_dn *service_dn = ldb_dn_string_compose(mem_ctx, realm_dn, - "CN=Directory Service,CN=Windows NT" - ",CN=Services,CN=Configuration"); - char *service_dn_str = ldb_dn_linearize(mem_ctx, service_dn); - const char *directory_attrs[] = { - "sPNMappings", - NULL - }; - - count = ldb_search(ldb_ctx, service_dn, LDB_SCOPE_BASE, "(objectClass=nTDSService)", - directory_attrs, &msg); - talloc_steal(mem_ctx, msg); - - if (count < 1) { - krb5_warnx(context, "ldb_search: dn: %s not found: %d", service_dn_str, count); - krb5_set_error_string(context, "ldb_search: dn: %s not found: %d", service_dn_str, count); - return HDB_ERR_NOENTRY; - } else if (count > 1) { - krb5_warnx(context, "ldb_search: dn: %s found %d times!", service_dn_str, count); - krb5_set_error_string(context, "ldb_search: dn: %s found %d times!", service_dn_str, count); - return HDB_ERR_NOENTRY; - } - - spnmappings = ldb_msg_find_element(msg[0], "sPNMappings"); - if (!spnmappings || spnmappings->num_values == 0) { - krb5_warnx(context, "ldb_search: dn: %s no sPNMappings attribute", service_dn_str); - krb5_set_error_string(context, "ldb_search: dn: %s no sPNMappings attribute", service_dn_str); - return HDB_ERR_NOENTRY; - } - - for (i = 0; i < spnmappings->num_values; i++) { - char *mapping, *p, *str; - mapping = talloc_strdup(mem_ctx, - (const char *)spnmappings->values[i].data); - if (!mapping) { - krb5_warnx(context, "LDB_lookup_spn_alias: ldb_search: dn: %s did not have an sPNMapping", service_dn_str); - krb5_set_error_string(context, "LDB_lookup_spn_alias: ldb_search: dn: %s did not have an sPNMapping", service_dn_str); - return HDB_ERR_NOENTRY; - } - - /* C string manipulation sucks */ - - p = strchr(mapping, '='); - if (!p) { - krb5_warnx(context, "ldb_search: dn: %s sPNMapping malformed: %s", - service_dn_str, mapping); - krb5_set_error_string(context, "ldb_search: dn: %s sPNMapping malformed: %s", - service_dn_str, mapping); - return HDB_ERR_NOENTRY; - } - p[0] = '\0'; - p++; - do { - str = p; - p = strchr(p, ','); - if (p) { - p[0] = '\0'; - p++; - } - if (strcasecmp(str, alias_from) == 0) { - *alias_to = mapping; - return 0; - } - } while (p); - } - krb5_warnx(context, "LDB_lookup_spn_alias: no alias for service %s applicable", alias_from); - return HDB_ERR_NOENTRY; -} static krb5_error_code LDB_open(krb5_context context, HDB *db, int flags, mode_t mode) { @@ -755,35 +677,8 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, /* Cludge, cludge cludge. If the realm part of krbtgt/realm, * is in our db, then direct the caller at our primary * krgtgt */ - - switch (ent_type) { - case HDB_ENT_TYPE_SERVER: - if (principal->name.name_string.len == 2 - && (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) == 0) - && (LDB_lookup_realm(context, (struct ldb_context *)db->hdb_db, - mem_ctx, principal->name.name_string.val[1], &realm_fixed_msg) == 0)) { - const char *dnsdomain = ldb_msg_find_string(realm_fixed_msg[0], "dnsDomain", NULL); - char *realm_fixed = strupper_talloc(mem_ctx, dnsdomain); - if (!realm_fixed) { - krb5_set_error_string(context, "strupper_talloc: out of memory"); - talloc_free(mem_ctx); - return ENOMEM; - } - free(principal->name.name_string.val[1]); - principal->name.name_string.val[1] = strdup(realm_fixed); - talloc_free(realm_fixed); - if (!principal->name.name_string.val[1]) { - krb5_set_error_string(context, "LDB_fetch: strdup() failed!"); - talloc_free(mem_ctx); - return ENOMEM; - } - ldb_ent_type = HDB_LDB_ENT_TYPE_KRBTGT; - break; - } else { - ldb_ent_type = HDB_LDB_ENT_TYPE_SERVER; - break; - } + switch (ent_type) { case HDB_ENT_TYPE_CLIENT: { int ldb_ret; @@ -829,6 +724,92 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, talloc_free(mem_ctx); return ret; } + case HDB_ENT_TYPE_SERVER: + if ((principal->name.name_string.len == 2) + && (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) == 0)) { + /* krbtgt case. Either us or a trusted realm */ + + } else if (principal->name.name_string.len >= 2) { + /* 'normal server' case */ + int ldb_ret; + NTSTATUS nt_status; + struct ldb_dn *user_dn, *domain_dn; + char *principal_string; + ldb_ent_type = HDB_LDB_ENT_TYPE_SERVER; + + ret = krb5_unparse_name_norealm(context, principal, &principal_string); + + if (ret != 0) { + talloc_free(mem_ctx); + return ret; + } + + /* At this point we may find the host is known to be + * in a different realm, so we should generate a + * referral instead */ + nt_status = crack_service_principal_name((struct ldb_context *)db->hdb_db, + mem_ctx, principal_string, + &user_dn, &domain_dn); + free(principal_string); + + if (!NT_STATUS_IS_OK(nt_status)) { + talloc_free(mem_ctx); + return HDB_ERR_NOENTRY; + } + + ldb_ret = gendb_search_dn((struct ldb_context *)db->hdb_db, + mem_ctx, user_dn, &msg, krb5_attrs); + + if (ldb_ret != 1) { + return HDB_ERR_NOENTRY; + } + + ldb_ret = gendb_search_dn((struct ldb_context *)db->hdb_db, + mem_ctx, domain_dn, &realm_msg, realm_attrs); + + if (ldb_ret != 1) { + return HDB_ERR_NOENTRY; + } + + ret = LDB_message2entry(context, db, mem_ctx, + principal, ldb_ent_type, + realm_msg[0], msg[0], entry); + talloc_free(mem_ctx); + return ret; + + } else { + /* server as client principal case, but we must not lookup userPrincipalNames */ + } + } + + switch (ent_type) { + case HDB_ENT_TYPE_SERVER: + if (principal->name.name_string.len == 2 + && (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) == 0) + && (LDB_lookup_realm(context, (struct ldb_context *)db->hdb_db, + mem_ctx, principal->name.name_string.val[1], &realm_fixed_msg) == 0)) { + const char *dnsdomain = ldb_msg_find_string(realm_fixed_msg[0], "dnsDomain", NULL); + char *realm_fixed = strupper_talloc(mem_ctx, dnsdomain); + if (!realm_fixed) { + krb5_set_error_string(context, "strupper_talloc: out of memory"); + talloc_free(mem_ctx); + return ENOMEM; + } + + free(principal->name.name_string.val[1]); + principal->name.name_string.val[1] = strdup(realm_fixed); + talloc_free(realm_fixed); + if (!principal->name.name_string.val[1]) { + krb5_set_error_string(context, "LDB_fetch: strdup() failed!"); + talloc_free(mem_ctx); + return ENOMEM; + } + ldb_ent_type = HDB_LDB_ENT_TYPE_KRBTGT; + break; + } else { + ldb_ent_type = HDB_LDB_ENT_TYPE_SERVER; + break; + } case HDB_ENT_TYPE_ANY: ldb_ent_type = HDB_LDB_ENT_TYPE_ANY; break; @@ -856,66 +837,11 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, principal, ldb_ent_type, realm_dn, &msg); if (ret != 0) { - char *alias_from = principal->name.name_string.val[0]; - char *alias_to; - Principal alias_principal; - - /* Try again with a servicePrincipal alias */ - if (ent_type != HDB_LDB_ENT_TYPE_SERVER && ent_type != HDB_LDB_ENT_TYPE_ANY) { - talloc_free(mem_ctx); - return ret; - } - if (principal->name.name_string.len < 2) { - krb5_warnx(context, "LDB_fetch: could not find principal in DB, alias not applicable"); - krb5_set_error_string(context, "LDB_fetch: could not find principal in DB, alias not applicable"); - talloc_free(mem_ctx); - return ret; - } - - /* Look for the list of aliases */ - ret = LDB_lookup_spn_alias(context, - (struct ldb_context *)db->hdb_db, mem_ctx, - realm_dn, alias_from, - &alias_to); - if (ret != 0) { - talloc_free(mem_ctx); - return ret; - } - - ret = copy_Principal(principal, &alias_principal); - if (ret != 0) { - krb5_warnx(context, "LDB_fetch: could not copy principal"); - krb5_set_error_string(context, "LDB_fetch: could not copy principal"); - talloc_free(mem_ctx); - return ret; - } - - /* ooh, very nasty playing around in the Principal... */ - free(alias_principal.name.name_string.val[0]); - alias_principal.name.name_string.val[0] = strdup(alias_to); - if (!alias_principal.name.name_string.val[0]) { - krb5_warnx(context, "LDB_fetch: strdup() failed"); - krb5_set_error_string(context, "LDB_fetch: strdup() failed"); - ret = ENOMEM; - talloc_free(mem_ctx); - free_Principal(&alias_principal); - return ret; - } - - ret = LDB_lookup_principal(context, (struct ldb_context *)db->hdb_db, - mem_ctx, - &alias_principal, ent_type, realm_dn, &msg); - free_Principal(&alias_principal); - - if (ret != 0) { - krb5_warnx(context, "LDB_fetch: could not find alias principal in DB"); - krb5_set_error_string(context, "LDB_fetch: could not find alias principal in DB"); - talloc_free(mem_ctx); - return ret; - } - - } - if (ret == 0) { + krb5_warnx(context, "LDB_fetch: could not find principal in DB"); + krb5_set_error_string(context, "LDB_fetch: could not find principal in DB"); + talloc_free(mem_ctx); + return ret; + } else { ret = LDB_message2entry(context, db, mem_ctx, principal, ldb_ent_type, realm_msg[0], msg[0], entry); -- cgit