/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
* Copyright 2014 Nexenta Systems, Inc. All rights reserved.
*/
#include <sys/param.h>
#include <ldap.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/time.h>
#include <netdb.h>
#include <pthread.h>
#include <unistd.h>
#include <arpa/nameser.h>
#include <resolv.h>
#include <sys/synch.h>
#include <string.h>
#include <strings.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <assert.h>
#include <sasl/sasl.h>
#include <note.h>
#include <errno.h>
#include <cryptoutil.h>
#include <ads/dsgetdc.h>
#include <smbsrv/libsmbns.h>
#include <smbns_dyndns.h>
#include <smbns_krb.h>
#define SMB_ADS_AF_UNKNOWN(x) (((x)->ipaddr.a_family != AF_INET) && \
((x)->ipaddr.a_family != AF_INET6))
#define SMB_ADS_MAXBUFLEN 100
#define SMB_ADS_DN_MAX 300
#define SMB_ADS_MAXMSGLEN 512
#define SMB_ADS_COMPUTERS_CN "Computers"
#define SMB_ADS_COMPUTER_NUM_ATTR 8
#define SMB_ADS_SHARE_NUM_ATTR 3
#define SMB_ADS_SITE_MAX MAXHOSTNAMELEN
#define SMB_ADS_MSDCS_SRV_DC_RR "_ldap._tcp.dc._msdcs"
#define SMB_ADS_MSDCS_SRV_SITE_RR "_ldap._tcp.%s._sites.dc._msdcs"
/*
* domainControllerFunctionality
*
* This rootDSE attribute indicates the functional level of the DC.
*/
#define SMB_ADS_ATTR_DCLEVEL "domainControllerFunctionality"
#define SMB_ADS_DCLEVEL_W2K 0
#define SMB_ADS_DCLEVEL_W2K3 2
#define SMB_ADS_DCLEVEL_W2K8 3
#define SMB_ADS_DCLEVEL_W2K8_R2 4
/*
* msDs-supportedEncryptionTypes (Windows Server 2008 only)
*
* This attribute defines the encryption types supported by the system.
* Encryption Types:
* - DES cbc mode with CRC-32
* - DES cbc mode with RSA-MD5
* - ArcFour with HMAC/md5
* - AES-128
* - AES-256
*/
#define SMB_ADS_ATTR_ENCTYPES "msDs-supportedEncryptionTypes"
#define SMB_ADS_ENC_DES_CRC 1
#define SMB_ADS_ENC_DES_MD5 2
#define SMB_ADS_ENC_RC4 4
#define SMB_ADS_ENC_AES128 8
#define SMB_ADS_ENC_AES256 16
static krb5_enctype w2k8enctypes[] = {
ENCTYPE_AES256_CTS_HMAC_SHA1_96,
ENCTYPE_AES128_CTS_HMAC_SHA1_96,
ENCTYPE_ARCFOUR_HMAC,
ENCTYPE_DES_CBC_CRC,
ENCTYPE_DES_CBC_MD5,
};
static krb5_enctype pre_w2k8enctypes[] = {
ENCTYPE_ARCFOUR_HMAC,
ENCTYPE_DES_CBC_CRC,
ENCTYPE_DES_CBC_MD5,
};
#define SMB_ADS_ATTR_SAMACCT "sAMAccountName"
#define SMB_ADS_ATTR_UPN "userPrincipalName"
#define SMB_ADS_ATTR_SPN "servicePrincipalName"
#define SMB_ADS_ATTR_CTL "userAccountControl"
#define SMB_ADS_ATTR_DNSHOST "dNSHostName"
#define SMB_ADS_ATTR_KVNO "msDS-KeyVersionNumber"
#define SMB_ADS_ATTR_DN "distinguishedName"
/*
* UserAccountControl flags: manipulate user account properties.
*
* The hexadecimal value of the following property flags are based on MSDN
* article # 305144.
*/
#define SMB_ADS_USER_ACCT_CTL_SCRIPT 0x00000001
#define SMB_ADS_USER_ACCT_CTL_ACCOUNTDISABLE 0x00000002
#define SMB_ADS_USER_ACCT_CTL_HOMEDIR_REQUIRED 0x00000008
#define SMB_ADS_USER_ACCT_CTL_LOCKOUT 0x00000010
#define SMB_ADS_USER_ACCT_CTL_PASSWD_NOTREQD 0x00000020
#define SMB_ADS_USER_ACCT_CTL_PASSWD_CANT_CHANGE 0x00000040
#define SMB_ADS_USER_ACCT_CTL_ENCRYPTED_TEXT_PWD_ALLOWED 0x00000080
#define SMB_ADS_USER_ACCT_CTL_TMP_DUP_ACCT 0x00000100
#define SMB_ADS_USER_ACCT_CTL_NORMAL_ACCT 0x00000200
#define SMB_ADS_USER_ACCT_CTL_INTERDOMAIN_TRUST_ACCT 0x00000800
#define SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT 0x00001000
#define SMB_ADS_USER_ACCT_CTL_SRV_TRUST_ACCT 0x00002000
#define SMB_ADS_USER_ACCT_CTL_DONT_EXPIRE_PASSWD 0x00010000
#define SMB_ADS_USER_ACCT_CTL_MNS_LOGON_ACCT 0x00020000
#define SMB_ADS_USER_ACCT_CTL_SMARTCARD_REQUIRED 0x00040000
#define SMB_ADS_USER_ACCT_CTL_TRUSTED_FOR_DELEGATION 0x00080000
#define SMB_ADS_USER_ACCT_CTL_NOT_DELEGATED 0x00100000
#define SMB_ADS_USER_ACCT_CTL_USE_DES_KEY_ONLY 0x00200000
#define SMB_ADS_USER_ACCT_CTL_DONT_REQ_PREAUTH 0x00400000
#define SMB_ADS_USER_ACCT_CTL_PASSWD_EXPIRED 0x00800000
#define SMB_ADS_USER_ACCT_CTL_TRUSTED_TO_AUTH_FOR_DELEGATION 0x01000000
/*
* Length of "dc=" prefix.
*/
#define SMB_ADS_DN_PREFIX_LEN 3
static char *smb_ads_computer_objcls[] = {
"top", "person", "organizationalPerson",
"user", "computer", NULL
};
static char *smb_ads_share_objcls[] = {
"top", "leaf", "connectionPoint", "volume", NULL
};
/* Cached ADS server to communicate with */
static smb_ads_host_info_t *smb_ads_cached_host_info = NULL;
static mutex_t smb_ads_cached_host_mtx;
/*
* SMB ADS config cache is maintained to facilitate the detection of
* changes in configuration that is relevant to AD selection.
*/
typedef struct smb_ads_config {
char c_site[SMB_ADS_SITE_MAX];
mutex_t c_mtx;
} smb_ads_config_t;
static smb_ads_config_t smb_ads_cfg;
/* attribute/value pair */
typedef struct smb_ads_avpair {
char *avp_attr;
char *avp_val;
} smb_ads_avpair_t;
/* query status */
typedef enum smb_ads_qstat {
SMB_ADS_STAT_ERR = -2,
SMB_ADS_STAT_DUP,
SMB_ADS_STAT_NOT_FOUND,
SMB_ADS_STAT_FOUND
} smb_ads_qstat_t;
typedef struct smb_ads_host_list {
int ah_cnt;
smb_ads_host_info_t *ah_list;
} smb_ads_host_list_t;
static int smb_ads_open_main(smb_ads_handle_t **, char *, char *, char *);
static int smb_ads_add_computer(smb_ads_handle_t *, int, char *);
static int smb_ads_modify_computer(smb_ads_handle_t *, int, char *);
static int smb_ads_computer_op(smb_ads_handle_t *, int, int, char *);
static smb_ads_qstat_t smb_ads_lookup_computer_n_attr(smb_ads_handle_t *,
smb_ads_avpair_t *, int, char *);
static int smb_ads_update_computer_cntrl_attr(smb_ads_handle_t *, int, char *);
static krb5_kvno smb_ads_lookup_computer_attr_kvno(smb_ads_handle_t *, char *);
static void smb_ads_free_cached_host(void);
static int smb_ads_alloc_attr(LDAPMod **, int);
static void smb_ads_free_attr(LDAPMod **);
static int smb_ads_get_dc_level(smb_ads_handle_t *);
static smb_ads_qstat_t smb_ads_find_computer(smb_ads_handle_t *, char *);
static smb_ads_qstat_t smb_ads_getattr(LDAP *, LDAPMessage *,
smb_ads_avpair_t *);
static smb_ads_qstat_t smb_ads_get_qstat(smb_ads_handle_t *, LDAPMessage *,
smb_ads_avpair_t *);
static boolean_t smb_ads_is_same_domain(char *, char *);
static smb_ads_host_info_t *smb_ads_dup_host_info(smb_ads_host_info_t *);
static char *smb_ads_get_sharedn(const char *, const char *, const char *);
static krb5_enctype *smb_ads_get_enctypes(int, int *);
/*
* smb_ads_init
*
* Initializes the ADS config cache.
*/
void
smb_ads_init(void)
{
(void) mutex_lock(&smb_ads_cfg.c_mtx);
(void) smb_config_getstr(SMB_CI_ADS_SITE,
smb_ads_cfg.c_site, SMB_ADS_SITE_MAX);
(void) mutex_unlock(&smb_ads_cfg.c_mtx);
/* Force -lads to load, for dtrace. */
DsFreeDcInfo(NULL);
}
void
smb_ads_fini(void)
{
smb_ads_free_cached_host();
}
/*
* smb_ads_refresh
*
* This function will be called when smb/server SMF service is refreshed.
* (See smbd_join.c)
*
* Clearing the smb_ads_cached_host_info would allow the next DC
* discovery process to pick up an AD based on the new AD configuration.
*/
void
smb_ads_refresh(boolean_t force_rediscovery)
{
char new_site[SMB_ADS_SITE_MAX];
(void) smb_config_getstr(SMB_CI_ADS_SITE, new_site, SMB_ADS_SITE_MAX);
(void) mutex_lock(&smb_ads_cfg.c_mtx);
(void) strlcpy(smb_ads_cfg.c_site, new_site, SMB_ADS_SITE_MAX);
(void) mutex_unlock(&smb_ads_cfg.c_mtx);
smb_ads_free_cached_host();
if (force_rediscovery) {
(void) _DsForceRediscovery(NULL, 0);
}
}
/*
* smb_ads_build_unc_name
*
* Construct the UNC name of the share object in the format of
* \\hostname.domain\shareUNC
*
* Returns 0 on success, -1 on error.
*/
int
smb_ads_build_unc_name(char *unc_name, int maxlen,
const char *hostname, const char *shareUNC)
{
char my_domain[MAXHOSTNAMELEN];
if (smb_getfqdomainname(my_domain, sizeof (my_domain)) != 0)
return (-1);
(void) snprintf(unc_name, maxlen, "\\\\%s.%s\\%s",
hostname, my_domain, shareUNC);
return (0);
}
/*
* The cached ADS host is no longer valid if one of the following criteria
* is satisfied:
*
* 1) not in the specified domain
* 2) not the sought host (if specified)
* 3) not reachable
*
* The caller is responsible for acquiring the smb_ads_cached_host_mtx lock
* prior to calling this function.
*
* Return B_TRUE if the cache host is still valid. Otherwise, return B_FALSE.
*/
static boolean_t
smb_ads_validate_cache_host(char *domain)
{
if (!smb_ads_cached_host_info)
return (B_FALSE);
if (!smb_ads_is_same_domain(smb_ads_cached_host_info->name, domain))
return (B_FALSE);
return (B_TRUE);
}
/*
* smb_ads_match_hosts_same_domain
*
* Returns true, if the cached ADS host is in the same domain as the
* current (given) domain.
*/
static boolean_t
smb_ads_is_same_domain(char *cached_host_name, char *current_domain)
{
char *cached_host_domain;
if ((cached_host_name == NULL) || (current_domain == NULL))
return (B_FALSE);
cached_host_domain = strchr(cached_host_name, '.');
if (cached_host_domain == NULL)
return (B_FALSE);
++cached_host_domain;
if (smb_strcasecmp(cached_host_domain, current_domain, 0))
return (B_FALSE);
return (B_TRUE);
}
/*
* smb_ads_dup_host_info
*
* Duplicates the passed smb_ads_host_info_t structure.
* Caller must free memory allocated by this method.
*
* Returns a reference to the duplicated smb_ads_host_info_t structure.
* Returns NULL on error.
*/
static smb_ads_host_info_t *
smb_ads_dup_host_info(smb_ads_host_info_t *ads_host)
{
smb_ads_host_info_t *dup_host;
if (ads_host == NULL)
return (NULL);
dup_host = malloc(sizeof (smb_ads_host_info_t));
if (dup_host != NULL)
bcopy(ads_host, dup_host, sizeof (smb_ads_host_info_t));
return (dup_host);
}
/*
* smb_ads_find_host
*
* Finds an ADS host in a given domain.
*
* If the cached host is valid, it will be used. Otherwise, a DC will
* be selected based on the following criteria:
*
* 1) pdc (aka preferred DC) configuration
* 2) AD site configuration - the scope of the DNS lookup will be
* restricted to the specified site.
* 3) DC on the same subnet
* 4) DC with the lowest priority/highest weight
*
* The above items are listed in decreasing preference order. The selected
* DC must be online.
*
* If this function is called during domain join, the specified kpasswd server
* takes precedence over preferred DC, AD site, and so on.
*
* Parameters:
* domain: fully-qualified domain name.
*
* Returns:
* A copy of the cached host info is returned. The caller is responsible
* for deallocating the memory returned by this function.
*/
/*ARGSUSED*/
smb_ads_host_info_t *
smb_ads_find_host(char *domain)
{
smb_ads_host_info_t *host = NULL;
DOMAIN_CONTROLLER_INFO *dci = NULL;
struct sockaddr_storage *ss;
uint32_t flags = DS_DS_FLAG;
uint32_t status;
int tries;
(void) mutex_lock(&smb_ads_cached_host_mtx);
if (smb_ads_validate_cache_host(domain)) {
host = smb_ads_dup_host_info(smb_ads_cached_host_info);
(void) mutex_unlock(&smb_ads_cached_host_mtx);
return (host);
}
(void) mutex_unlock(&smb_ads_cached_host_mtx);
smb_ads_free_cached_host();
/*
* The _real_ DC Locator is over in idmapd.
* Door call over there to get it.
*/
tries = 15;
again:
status = _DsGetDcName(
NULL, /* ComputerName */
domain,
NULL, /* DomainGuid */
NULL, /* SiteName */
flags,
&dci);
switch (status) {
case 0:
break;
/*
* We can see these errors when joining a domain, if we race
* asking idmap for the DC before it knows the new domain.
*/
case NT_STATUS_NO_SUCH_DOMAIN: /* Specified domain unknown */
case NT_STATUS_INVALID_SERVER_STATE: /* not in domain mode. */
if (--tries > 0) {
(void) sleep(1);
goto again;
}
/* FALLTHROUGH */
case NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND:
case NT_STATUS_CANT_WAIT: /* timeout over in idmap */
default:
return (NULL);
}
host = calloc(1, sizeof (*host));
if (host == NULL)
goto out;
(void) strlcpy(host->name, dci->DomainControllerName, MAXHOSTNAMELEN);
ss = (void *)dci->_sockaddr;
switch (ss->ss_family) {
case AF_INET: {
struct sockaddr_in *sin = (void *)ss;
host->port = ntohs(sin->sin_port);
host->ipaddr.a_family = AF_INET;
(void) memcpy(&host->ipaddr.a_ipv4, &sin->sin_addr,
sizeof (in_addr_t));
break;
}
case AF_INET6: {
struct sockaddr_in6 *sin6 = (void *)ss;
host->port = ntohs(sin6->sin6_port);
host->ipaddr.a_family = AF_INET6;
(void) memcpy(&host->ipaddr.a_ipv6, &sin6->sin6_addr,
sizeof (in6_addr_t));
break;
}
default:
syslog(LOG_ERR, "no addr for DC %s",
dci->DomainControllerName);
free(host);
host = NULL;
goto out;
}
(void) mutex_lock(&smb_ads_cached_host_mtx);
if (!smb_ads_cached_host_info)
smb_ads_cached_host_info = smb_ads_dup_host_info(host);
host = smb_ads_dup_host_info(smb_ads_cached_host_info);
(void) mutex_unlock(&smb_ads_cached_host_mtx);
out:
DsFreeDcInfo(dci);
return (host);
}
/*
* Return the number of dots in a string.
*/
static int
smb_ads_count_dots(const char *s)
{
int ndots = 0;
while (*s) {
if (*s++ == '.')
ndots++;
}
return (ndots);
}
/*
* Convert a domain name in dot notation to distinguished name format,
* for example: sun.com -> dc=sun,dc=com.
*
* Returns a pointer to an allocated buffer containing the distinguished
* name.
*/
static char *
smb_ads_convert_domain(const char *domain_name)
{
const char *s;
char *dn_name;
char buf[2];
int ndots;
int len;
if (domain_name == NULL || *domain_name == 0)
return (NULL);
ndots = smb_ads_count_dots(domain_name);
++ndots;
len = strlen(domain_name) + (ndots * SMB_ADS_DN_PREFIX_LEN) + 1;
if ((dn_name = malloc(len)) == NULL)
return (NULL);
bzero(dn_name, len);
(void) strlcpy(dn_name, "dc=", len);
buf[1] = '\0';
s = domain_name;
while (*s) {
if (*s == '.') {
(void) strlcat(dn_name, ",dc=", len);
} else {
buf[0] = *s;
(void) strlcat(dn_name, buf, len);
}
++s;
}
return (dn_name);
}
/*
* smb_ads_free_cached_host
*
* Free the memory use by the global smb_ads_cached_host_info & set it to NULL.
*/
static void
smb_ads_free_cached_host(void)
{
(void) mutex_lock(&smb_ads_cached_host_mtx);
if (smb_ads_cached_host_info) {
free(smb_ads_cached_host_info);
smb_ads_cached_host_info = NULL;
}
(void) mutex_unlock(&smb_ads_cached_host_mtx);
}
/*
* smb_ads_open
* Open a LDAP connection to an ADS server if the system is in domain mode.
* Acquire both Kerberos TGT and LDAP service tickets for the host principal.
*
* This function should only be called after the system is successfully joined
* to a domain.
*/
smb_ads_handle_t *
smb_ads_open(void)
{
char domain[MAXHOSTNAMELEN];
smb_ads_handle_t *h;
smb_ads_status_t err;
if (smb_config_get_secmode() != SMB_SECMODE_DOMAIN)
return (NULL);
if (smb_getfqdomainname(domain, MAXHOSTNAMELEN) != 0)
return (NULL);
err = smb_ads_open_main(&h, domain, NULL, NULL);
if (err != 0) {
smb_ads_log_errmsg(err);
return (NULL);
}
return (h);
}
static int
smb_ads_saslcallback(LDAP *ld, unsigned flags, void *defaults, void *prompts)
{
NOTE(ARGUNUSED(ld, defaults));
sasl_interact_t *interact;
if (prompts == NULL || flags != LDAP_SASL_INTERACTIVE)
return (LDAP_PARAM_ERROR);
/* There should be no extra arguemnts for SASL/GSSAPI authentication */
for (interact = prompts; interact->id != SASL_CB_LIST_END;
interact++) {
interact->result = NULL;
interact->len = 0;
}
return (LDAP_SUCCESS);
}
/*
* smb_ads_open_main
* Open a LDAP connection to an ADS server.
* If ADS is enabled and the administrative username, password, and
* ADS domain are defined then query DNS to find an ADS server if this is the
* very first call to this routine. After an ADS server is found then this
* server will be used everytime this routine is called until the system is
* rebooted or the ADS server becomes unavailable then an ADS server will
* be queried again. After the connection is made then an ADS handle
* is created to be returned.
*
* After the LDAP connection, the LDAP version will be set to 3 using
* ldap_set_option().
*
* The LDAP connection is bound before the ADS handle is returned.
* Parameters:
* domain - fully-qualified domain name
* user - the user account for whom the Kerberos TGT ticket and ADS
* service tickets are acquired.
* password - password of the specified user
*
* Returns:
* NULL : can't connect to ADS server or other errors
* smb_ads_handle_t* : handle to ADS server
*/
static int
smb_ads_open_main(smb_ads_handle_t **hp, char *domain, char *user,
char *password)
{
smb_ads_handle_t *ah;
LDAP *ld;
int version = 3;
smb_ads_host_info_t *ads_host = NULL;
int err, rc;
*hp = NULL;
if (user != NULL) {
err = smb_kinit(domain, user, password);
if (err != 0)
return (err);
user = NULL;
password = NULL;
}
ads_host = smb_ads_find_host(domain);
if (ads_host == NULL)
return (SMB_ADS_CANT_LOCATE_DC);
ah = (smb_ads_handle_t *)malloc(sizeof (smb_ads_handle_t));
if (ah == NULL) {
free(ads_host);
return (ENOMEM);
}
(void) memset(ah, 0, sizeof (smb_ads_handle_t));
if ((ld = ldap_init(ads_host->name, ads_host->port)) == NULL) {
syslog(LOG_ERR, "smbns: ldap_init failed");
smb_ads_free_cached_host();
free(ah);
free(ads_host);
return (SMB_ADS_LDAP_INIT);
}
if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version)
!= LDAP_SUCCESS) {
smb_ads_free_cached_host();
free(ah);
free(ads_host);
(void) ldap_unbind(ld);
return (SMB_ADS_LDAP_SETOPT);
}
(void) ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
ah->ld = ld;
ah->domain = strdup(domain);
if (ah->domain == NULL) {
smb_ads_close(ah);
free(ads_host);
return (SMB_ADS_LDAP_SETOPT);
}
/*
* ah->domain is often used for generating service principal name.
* Convert it to lower case for RFC 4120 section 6.2.1 conformance.
*/
(void) smb_strlwr(ah->domain);
ah->domain_dn = smb_ads_convert_domain(domain);
if (ah->domain_dn == NULL) {
smb_ads_close(ah);
free(ads_host);
return (SMB_ADS_LDAP_SET_DOM);
}
ah->hostname = strdup(ads_host->name);
if (ah->hostname == NULL) {
smb_ads_close(ah);
free(ads_host);
return (ENOMEM);
}
(void) mutex_lock(&smb_ads_cfg.c_mtx);
if (*smb_ads_cfg.c_site != '\0') {
if ((ah->site = strdup(smb_ads_cfg.c_site)) == NULL) {
smb_ads_close(ah);
(void) mutex_unlock(&smb_ads_cfg.c_mtx);
free(ads_host);
return (ENOMEM);
}
} else {
ah->site = NULL;
}
(void) mutex_unlock(&smb_ads_cfg.c_mtx);
rc = ldap_sasl_interactive_bind_s(ah->ld, "", "GSSAPI", NULL, NULL,
LDAP_SASL_INTERACTIVE, &smb_ads_saslcallback, NULL);
if (rc != LDAP_SUCCESS) {
syslog(LOG_ERR, "smbns: ldap_sasl_..._bind_s failed (%s)",
ldap_err2string(rc));
smb_ads_close(ah);
free(ads_host);
return (SMB_ADS_LDAP_SASL_BIND);
}
free(ads_host);
*hp = ah;
return (SMB_ADS_SUCCESS);
}
/*
* smb_ads_close
* Close connection to ADS server and free memory allocated for ADS handle.
* LDAP unbind is called here.
* Parameters:
* ah: handle to ADS server
* Returns:
* void
*/
void
smb_ads_close(smb_ads_handle_t *ah)
{
if (ah == NULL)
return;
/* close and free connection resources */
if (ah->ld)
(void) ldap_unbind(ah->ld);
free(ah->domain);
free(ah->domain_dn);
free(ah->hostname);
free(ah->site);
free(ah);
}
/*
* smb_ads_alloc_attr
*
* Since the attrs is a null-terminated array, all elements
* in the array (except the last one) will point to allocated
* memory.
*/
static int
smb_ads_alloc_attr(LDAPMod *attrs[], int num)
{
int i;
bzero(attrs, num * sizeof (LDAPMod *));
for (i = 0; i < (num - 1); i++) {
attrs[i] = (LDAPMod *)malloc(sizeof (LDAPMod));
if (attrs[i] == NULL) {
smb_ads_free_attr(attrs);
return (-1);
}
}
return (0);
}
/*
* smb_ads_free_attr
* Free memory allocated when publishing a share.
* Parameters:
* attrs: an array of LDAPMod pointers
* Returns:
* None
*/
static void
smb_ads_free_attr(LDAPMod *attrs[])
{
int i;
for (i = 0; attrs[i]; i++) {
free(attrs[i]);
}
}
/*
* Returns share DN in an allocated buffer. The format of the DN is
* cn=<sharename>,<container RDNs>,<domain DN>
*
* If the domain DN is not included in the container parameter,
* then it will be appended to create the share DN.
*
* The caller must free the allocated buffer.
*/
static char *
smb_ads_get_sharedn(const char *sharename, const char *container,
const char *domain_dn)
{
char *share_dn;
int rc, offset, container_len, domain_len;
boolean_t append_domain = B_TRUE;
container_len = strlen(container);
domain_len = strlen(domain_dn);
if (container_len >= domain_len) {
/* offset to last domain_len characters */
offset = container_len - domain_len;
if (smb_strcasecmp(container + offset,
domain_dn, domain_len) == 0)
append_domain = B_FALSE;
}
if (append_domain)
rc = asprintf(&share_dn, "cn=%s,%s,%s", sharename,
container, domain_dn);
else
rc = asprintf(&share_dn, "cn=%s,%s", sharename,
container);
return ((rc == -1) ? NULL : share_dn);
}
/*
* smb_ads_add_share
* Call by smb_ads_publish_share to create share object in ADS.
* This routine specifies the attributes of an ADS LDAP share object. The first
* attribute and values define the type of ADS object, the share object. The
* second attribute and value define the UNC of the share data for the share
* object. The LDAP synchronous add command is used to add the object into ADS.
* The container location to add the object needs to specified.
* Parameters:
* ah : handle to ADS server
* adsShareName: name of share object to be created in ADS
* shareUNC : share name on NetForce
* adsContainer: location in ADS to create share object
*
* Returns:
* -1 : error
* 0 : success
*/
int
smb_ads_add_share(smb_ads_handle_t *ah, const char *adsShareName,
const char *unc_name, const char *adsContainer)
{
LDAPMod *attrs[SMB_ADS_SHARE_NUM_ATTR];
int j = 0;
char *share_dn;
int ret;
char *unc_names[] = {(char *)unc_name, NULL};
if ((share_dn = smb_ads_get_sharedn(adsShareName, adsContainer,
ah->domain_dn)) == NULL)
return (-1);
if (smb_ads_alloc_attr(attrs, SMB_ADS_SHARE_NUM_ATTR) != 0) {
free(share_dn);
return (-1);
}
attrs[j]->mod_op = LDAP_MOD_ADD;
attrs[j]->mod_type = "objectClass";
attrs[j]->mod_values = smb_ads_share_objcls;
attrs[++j]->mod_op = LDAP_MOD_ADD;
attrs[j]->mod_type = "uNCName";
attrs[j]->mod_values = unc_names;
if ((ret = ldap_add_s(ah->ld, share_dn, attrs)) != LDAP_SUCCESS) {
if (ret == LDAP_NO_SUCH_OBJECT) {
syslog(LOG_ERR, "Failed to publish share %s in" \
" AD. Container does not exist: %s.\n",
adsShareName, share_dn);
} else {
syslog(LOG_ERR, "Failed to publish share %s in" \
" AD: %s (%s).\n", adsShareName, share_dn,
ldap_err2string(ret));
}
smb_ads_free_attr(attrs);
free(share_dn);
return (ret);
}
free(share_dn);
smb_ads_free_attr(attrs);
return (0);
}
/*
* smb_ads_del_share
* Call by smb_ads_remove_share to remove share object from ADS. The container
* location to remove the object needs to specified. The LDAP synchronous
* delete command is used.
* Parameters:
* ah : handle to ADS server
* adsShareName: name of share object in ADS to be removed
* adsContainer: location of share object in ADS
* Returns:
* -1 : error
* 0 : success
*/
static int
smb_ads_del_share(smb_ads_handle_t *ah, const char *adsShareName,
const char *adsContainer)
{
char *share_dn;
int ret;
if ((share_dn = smb_ads_get_sharedn(adsShareName, adsContainer,
ah->domain_dn)) == NULL)
return (-1);
if ((ret = ldap_delete_s(ah->ld, share_dn)) != LDAP_SUCCESS) {
smb_tracef("ldap_delete: %s", ldap_err2string(ret));
free(share_dn);
return (-1);
}
free(share_dn);
return (0);
}
/*
* smb_ads_escape_search_filter_chars
*
* This routine will escape the special characters found in a string
* that will later be passed to the ldap search filter.
*
* RFC 1960 - A String Representation of LDAP Search Filters
* 3. String Search Filter Definition
* If a value must contain one of the characters '*' OR '(' OR ')',
* these characters
* should be escaped by preceding them with the backslash '\' character.
*
* RFC 2252 - LDAP Attribute Syntax Definitions
* a backslash quoting mechanism is used to escape
* the following separator symbol character (such as "'", "$" or "#") if
* it should occur in that string.
*/
static int
smb_ads_escape_search_filter_chars(const char *src, char *dst)
{
int avail = SMB_ADS_MAXBUFLEN - 1; /* reserve a space for NULL char */
if (src == NULL || dst == NULL)
return (-1);
while (*src) {
if (!avail) {
*dst = 0;
return (-1);
}
switch (*src) {
case '\\':
case '\'':
case '$':
case '#':
case '*':
case '(':
case ')':
*dst++ = '\\';
avail--;
/* fall through */
default:
*dst++ = *src++;
avail--;
}
}
*dst = 0;
return (0);
}
/*
* smb_ads_lookup_share
* The search filter is set to search for a specific share name in the
* specified ADS container. The LDSAP synchronous search command is used.
* Parameters:
* ah : handle to ADS server
* adsShareName: name of share object in ADS to be searched
* adsContainer: location of share object in ADS
* Returns:
* -1 : error
* 0 : not found
* 1 : found
*/
int
smb_ads_lookup_share(smb_ads_handle_t *ah, const char *adsShareName,
const char *adsContainer, char *unc_name)
{
char *attrs[4], filter[SMB_ADS_MAXBUFLEN];
char *share_dn;
int ret;
LDAPMessage *res;
char tmpbuf[SMB_ADS_MAXBUFLEN];
if (adsShareName == NULL || adsContainer == NULL)
return (-1);
if ((share_dn = smb_ads_get_sharedn(adsShareName, adsContainer,
ah->domain_dn)) == NULL)
return (-1);
res = NULL;
attrs[0] = "cn";
attrs[1] = "objectClass";
attrs[2] = "uNCName";
attrs[3] = NULL;
if (smb_ads_escape_search_filter_chars(unc_name, tmpbuf) != 0) {
free(share_dn);
return (-1);
}
(void) snprintf(filter, sizeof (filter),
"(&(objectClass=volume)(uNCName=%s))", tmpbuf);
if ((ret = ldap_search_s(ah->ld, share_dn,
LDAP_SCOPE_BASE, filter, attrs, 0, &res)) != LDAP_SUCCESS) {
if (ret != LDAP_NO_SUCH_OBJECT)
smb_tracef("%s: ldap_search: %s", share_dn,
ldap_err2string(ret));
(void) ldap_msgfree(res);
free(share_dn);
return (0);
}
(void) free(share_dn);
/* no match is found */
if (ldap_count_entries(ah->ld, res) == 0) {
(void) ldap_msgfree(res);
return (0);
}
/* free the search results */
(void) ldap_msgfree(res);
return (1);
}
/*
* smb_ads_publish_share
* Publish share into ADS. If a share name already exist in ADS in the same
* container then the existing share object is removed before adding the new
* share object.
* Parameters:
* ah : handle return from smb_ads_open
* adsShareName: name of share to be added to ADS directory
* shareUNC : name of share on client, can be NULL to use the same name
* as adsShareName
* adsContainer: location for share to be added in ADS directory, ie
* ou=share_folder
* uncType : use UNC_HOSTNAME to use hostname for UNC, use UNC_HOSTADDR
* to use host ip addr for UNC.
* Returns:
* -1 : error
* 0 : success
*/
int
smb_ads_publish_share(smb_ads_handle_t *ah, const char *adsShareName,
const char *shareUNC, const char *adsContainer, const char *hostname)
{
int ret;
char unc_name[SMB_ADS_MAXBUFLEN];
if (adsShareName == NULL || adsContainer == NULL)
return (-1);
if (shareUNC == 0 || *shareUNC == 0)
shareUNC = adsShareName;
if (smb_ads_build_unc_name(unc_name, sizeof (unc_name),
hostname, shareUNC) < 0)
return (-1);
ret = smb_ads_lookup_share(ah, adsShareName, adsContainer, unc_name);
switch (ret) {
case 1:
(void) smb_ads_del_share(ah, adsShareName, adsContainer);
ret = smb_ads_add_share(ah, adsShareName, unc_name,
adsContainer);
break;
case 0:
ret = smb_ads_add_share(ah, adsShareName, unc_name,
adsContainer);
if (ret == LDAP_ALREADY_EXISTS)
ret = -1;
break;
case -1:
default:
/* return with error code */
ret = -1;
}
return (ret);
}
/*
* smb_ads_remove_share
* Remove share from ADS. A search is done first before explicitly removing
* the share.
* Parameters:
* ah : handle return from smb_ads_open
* adsShareName: name of share to be removed from ADS directory
* adsContainer: location for share to be removed from ADS directory, ie
* ou=share_folder
* Returns:
* -1 : error
* 0 : success
*/
int
smb_ads_remove_share(smb_ads_handle_t *ah, const char *adsShareName,
const char *shareUNC, const char *adsContainer, const char *hostname)
{
int ret;
char unc_name[SMB_ADS_MAXBUFLEN];
if (adsShareName == NULL || adsContainer == NULL)
return (-1);
if (shareUNC == 0 || *shareUNC == 0)
shareUNC = adsShareName;
if (smb_ads_build_unc_name(unc_name, sizeof (unc_name),
hostname, shareUNC) < 0)
return (-1);
ret = smb_ads_lookup_share(ah, adsShareName, adsContainer, unc_name);
if (ret == 0)
return (0);
if (ret == -1)
return (-1);
return (smb_ads_del_share(ah, adsShareName, adsContainer));
}
/*
* smb_ads_get_default_comp_container_dn
*
* Build the distinguished name for the default computer conatiner (i.e. the
* pre-defined Computers container).
*/
static void
smb_ads_get_default_comp_container_dn(smb_ads_handle_t *ah, char *buf,
size_t buflen)
{
(void) snprintf(buf, buflen, "cn=%s,%s", SMB_ADS_COMPUTERS_CN,
ah->domain_dn);
}
/*
* smb_ads_get_default_comp_dn
*
* Build the distinguished name for this system.
*/
static void
smb_ads_get_default_comp_dn(smb_ads_handle_t *ah, char *buf, size_t buflen)
{
char nbname[NETBIOS_NAME_SZ];
char container_dn[SMB_ADS_DN_MAX];
(void) smb_getnetbiosname(nbname, sizeof (nbname));
smb_ads_get_default_comp_container_dn(ah, container_dn, SMB_ADS_DN_MAX);
(void) snprintf(buf, buflen, "cn=%s,%s", nbname, container_dn);
}
/*
* smb_ads_add_computer
*
* Returns 0 upon success. Otherwise, returns -1.
*/
static int
smb_ads_add_computer(smb_ads_handle_t *ah, int dclevel, char *dn)
{
return (smb_ads_computer_op(ah, LDAP_MOD_ADD, dclevel, dn));
}
/*
* smb_ads_modify_computer
*
* Returns 0 upon success. Otherwise, returns -1.
*/
static int
smb_ads_modify_computer(smb_ads_handle_t *ah, int dclevel, char *dn)
{
return (smb_ads_computer_op(ah, LDAP_MOD_REPLACE, dclevel, dn));
}
/*
* smb_ads_get_dc_level
*
* Returns the functional level of the DC upon success.
* Otherwise, -1 is returned.
*/
static int
smb_ads_get_dc_level(smb_ads_handle_t *ah)
{
LDAPMessage *res, *entry;
char *attr[2];
char **vals;
int rc = -1;
res = NULL;
attr[0] = SMB_ADS_ATTR_DCLEVEL;
attr[1] = NULL;
if (ldap_search_s(ah->ld, "", LDAP_SCOPE_BASE, NULL, attr,
0, &res) != LDAP_SUCCESS) {
(void) ldap_msgfree(res);
return (-1);
}
/* no match for the specified attribute is found */
if (ldap_count_entries(ah->ld, res) == 0) {
(void) ldap_msgfree(res);
return (-1);
}
entry = ldap_first_entry(ah->ld, res);
if (entry) {
if ((vals = ldap_get_values(ah->ld, entry,
SMB_ADS_ATTR_DCLEVEL)) == NULL) {
/*
* Observed the values aren't populated
* by the Windows 2000 server.
*/
(void) ldap_msgfree(res);
return (SMB_ADS_DCLEVEL_W2K);
}
if (vals[0] != NULL)
rc = atoi(vals[0]);
ldap_value_free(vals);
}
(void) ldap_msgfree(res);
return (rc);
}
/*
* The fully-qualified hostname returned by this function is often used for
* constructing service principal name. Return the fully-qualified hostname
* in lower case for RFC 4120 section 6.2.1 conformance.
*/
static int
smb_ads_getfqhostname(smb_ads_handle_t *ah, char *fqhost, int len)
{
if (smb_gethostname(fqhost, len, SMB_CASE_LOWER) != 0)
return (-1);
(void) snprintf(fqhost, len, "%s.%s", fqhost,
ah->domain);
return (0);
}
static int
smb_ads_computer_op(smb_ads_handle_t *ah, int op, int dclevel, char *dn)
{
LDAPMod *attrs[SMB_ADS_COMPUTER_NUM_ATTR];
char *sam_val[2];
char *ctl_val[2], *fqh_val[2];
char *encrypt_val[2];
int j = -1;
int ret, usrctl_flags = 0;
char sam_acct[SMB_SAMACCT_MAXLEN];
char fqhost[MAXHOSTNAMELEN];
char usrctl_buf[16];
char encrypt_buf[16];
int max;
smb_krb5_pn_set_t spn, upn;
if (smb_getsamaccount(sam_acct, sizeof (sam_acct)) != 0)
return (-1);
if (smb_ads_getfqhostname(ah, fqhost, MAXHOSTNAMELEN))
return (-1);
/* The SPN attribute is multi-valued and must be 1 or greater */
if (smb_krb5_get_pn_set(&spn, SMB_PN_SPN_ATTR, ah->domain) == 0)
return (-1);
/* The UPN attribute is single-valued and cannot be zero */
if (smb_krb5_get_pn_set(&upn, SMB_PN_UPN_ATTR, ah->domain) != 1) {
smb_krb5_free_pn_set(&spn);
smb_krb5_free_pn_set(&upn);
return (-1);
}
max = (SMB_ADS_COMPUTER_NUM_ATTR - ((op != LDAP_MOD_ADD) ? 1 : 0))
- (dclevel >= SMB_ADS_DCLEVEL_W2K8 ? 0 : 1);
if (smb_ads_alloc_attr(attrs, max) != 0) {
smb_krb5_free_pn_set(&spn);
smb_krb5_free_pn_set(&upn);
return (-1);
}
/* objectClass attribute is not modifiable. */
if (op == LDAP_MOD_ADD) {
attrs[++j]->mod_op = op;
attrs[j]->mod_type = "objectClass";
attrs[j]->mod_values = smb_ads_computer_objcls;
}
attrs[++j]->mod_op = op;
attrs[j]->mod_type = SMB_ADS_ATTR_SAMACCT;
sam_val[0] = sam_acct;
sam_val[1] = 0;
attrs[j]->mod_values = sam_val;
attrs[++j]->mod_op = op;
attrs[j]->mod_type = SMB_ADS_ATTR_UPN;
attrs[j]->mod_values = upn.s_pns;
attrs[++j]->mod_op = op;
attrs[j]->mod_type = SMB_ADS_ATTR_SPN;
attrs[j]->mod_values = spn.s_pns;
attrs[++j]->mod_op = op;
attrs[j]->mod_type = SMB_ADS_ATTR_CTL;
usrctl_flags |= (SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT |
SMB_ADS_USER_ACCT_CTL_PASSWD_NOTREQD |
SMB_ADS_USER_ACCT_CTL_ACCOUNTDISABLE);
(void) snprintf(usrctl_buf, sizeof (usrctl_buf), "%d", usrctl_flags);
ctl_val[0] = usrctl_buf;
ctl_val[1] = 0;
attrs[j]->mod_values = ctl_val;
attrs[++j]->mod_op = op;
attrs[j]->mod_type = SMB_ADS_ATTR_DNSHOST;
fqh_val[0] = fqhost;
fqh_val[1] = 0;
attrs[j]->mod_values = fqh_val;
/* enctypes support starting in Windows Server 2008 */
if (dclevel > SMB_ADS_DCLEVEL_W2K3) {
attrs[++j]->mod_op = op;
attrs[j]->mod_type = SMB_ADS_ATTR_ENCTYPES;
(void) snprintf(encrypt_buf, sizeof (encrypt_buf), "%d",
SMB_ADS_ENC_AES256 + SMB_ADS_ENC_AES128 + SMB_ADS_ENC_RC4 +
SMB_ADS_ENC_DES_MD5 + SMB_ADS_ENC_DES_CRC);
encrypt_val[0] = encrypt_buf;
encrypt_val[1] = 0;
attrs[j]->mod_values = encrypt_val;
}
switch (op) {
case LDAP_MOD_ADD:
if ((ret = ldap_add_s(ah->ld, dn, attrs)) != LDAP_SUCCESS) {
syslog(LOG_NOTICE, "ldap_add: %s",
ldap_err2string(ret));
ret = -1;
}
break;
case LDAP_MOD_REPLACE:
if ((ret = ldap_modify_s(ah->ld, dn, attrs)) != LDAP_SUCCESS) {
syslog(LOG_NOTICE, "ldap_modify: %s",
ldap_err2string(ret));
ret = -1;
}
break;
default:
ret = -1;
}
smb_ads_free_attr(attrs);
smb_krb5_free_pn_set(&spn);
smb_krb5_free_pn_set(&upn);
return (ret);
}
/*
* Delete an ADS computer account.
*/
static void
smb_ads_del_computer(smb_ads_handle_t *ah, char *dn)
{
int rc;
if ((rc = ldap_delete_s(ah->ld, dn)) != LDAP_SUCCESS)
smb_tracef("ldap_delete: %s", ldap_err2string(rc));
}
/*
* Gets the value of the given attribute.
*/
static smb_ads_qstat_t
smb_ads_getattr(LDAP *ld, LDAPMessage *entry, smb_ads_avpair_t *avpair)
{
char **vals;
smb_ads_qstat_t rc = SMB_ADS_STAT_FOUND;
assert(avpair);
avpair->avp_val = NULL;
vals = ldap_get_values(ld, entry, avpair->avp_attr);
if (!vals)
return (SMB_ADS_STAT_NOT_FOUND);
if (!vals[0]) {
ldap_value_free(vals);
return (SMB_ADS_STAT_NOT_FOUND);
}
avpair->avp_val = strdup(vals[0]);
if (!avpair->avp_val)
rc = SMB_ADS_STAT_ERR;
ldap_value_free(vals);
return (rc);
}
/*
* Process query's result.
*/
static smb_ads_qstat_t
smb_ads_get_qstat(smb_ads_handle_t *ah, LDAPMessage *res,
smb_ads_avpair_t *avpair)
{
char fqhost[MAXHOSTNAMELEN];
smb_ads_avpair_t dnshost_avp;
smb_ads_qstat_t rc = SMB_ADS_STAT_FOUND;
LDAPMessage *entry;
if (smb_ads_getfqhostname(ah, fqhost, MAXHOSTNAMELEN))
return (SMB_ADS_STAT_ERR);
if (ldap_count_entries(ah->ld, res) == 0)
return (SMB_ADS_STAT_NOT_FOUND);
if ((entry = ldap_first_entry(ah->ld, res)) == NULL)
return (SMB_ADS_STAT_ERR);
dnshost_avp.avp_attr = SMB_ADS_ATTR_DNSHOST;
rc = smb_ads_getattr(ah->ld, entry, &dnshost_avp);
switch (rc) {
case SMB_ADS_STAT_FOUND:
/*
* Returns SMB_ADS_STAT_DUP to avoid overwriting
* the computer account of another system whose
* NetBIOS name collides with that of the current
* system.
*/
if (strcasecmp(dnshost_avp.avp_val, fqhost))
rc = SMB_ADS_STAT_DUP;
free(dnshost_avp.avp_val);
break;
case SMB_ADS_STAT_NOT_FOUND:
/*
* Pre-created computer account doesn't have
* the dNSHostname attribute. It's been observed
* that the dNSHostname attribute is only set after
* a successful domain join.
* Returns SMB_ADS_STAT_FOUND as the account is
* pre-created for the current system.
*/
rc = SMB_ADS_STAT_FOUND;
break;
default:
break;
}
if (rc != SMB_ADS_STAT_FOUND)
return (rc);
if (avpair)
rc = smb_ads_getattr(ah->ld, entry, avpair);
return (rc);
}
/*
* smb_ads_lookup_computer_n_attr
*
* If avpair is NULL, checks the status of the specified computer account.
* Otherwise, looks up the value of the specified computer account's attribute.
* If found, the value field of the avpair will be allocated and set. The
* caller should free the allocated buffer.
*
* Return:
* SMB_ADS_STAT_FOUND - if both the computer and the specified attribute is
* found.
* SMB_ADS_STAT_NOT_FOUND - if either the computer or the specified attribute
* is not found.
* SMB_ADS_STAT_DUP - if the computer account is already used by other systems
* in the AD. This could happen if the hostname of multiple
* systems resolved to the same NetBIOS name.
* SMB_ADS_STAT_ERR - any failure.
*/
static smb_ads_qstat_t
smb_ads_lookup_computer_n_attr(smb_ads_handle_t *ah, smb_ads_avpair_t *avpair,
int scope, char *dn)
{
char *attrs[3], filter[SMB_ADS_MAXBUFLEN];
LDAPMessage *res;
char sam_acct[SMB_SAMACCT_MAXLEN], sam_acct2[SMB_SAMACCT_MAXLEN];
smb_ads_qstat_t rc;
if (smb_getsamaccount(sam_acct, sizeof (sam_acct)) != 0)
return (SMB_ADS_STAT_ERR);
res = NULL;
attrs[0] = SMB_ADS_ATTR_DNSHOST;
attrs[1] = NULL;
attrs[2] = NULL;
if (avpair) {
if (!avpair->avp_attr)
return (SMB_ADS_STAT_ERR);
attrs[1] = avpair->avp_attr;
}
if (smb_ads_escape_search_filter_chars(sam_acct, sam_acct2) != 0)
return (SMB_ADS_STAT_ERR);
(void) snprintf(filter, sizeof (filter),
"(&(objectClass=computer)(%s=%s))", SMB_ADS_ATTR_SAMACCT,
sam_acct2);
if (ldap_search_s(ah->ld, dn, scope, filter, attrs, 0,
&res) != LDAP_SUCCESS) {
(void) ldap_msgfree(res);
return (SMB_ADS_STAT_NOT_FOUND);
}
rc = smb_ads_get_qstat(ah, res, avpair);
/* free the search results */
(void) ldap_msgfree(res);
return (rc);
}
/*
* smb_ads_find_computer
*
* Starts by searching for the system's AD computer object in the default
* container (i.e. cn=Computers). If not found, searches the entire directory.
* If found, 'dn' will be set to the distinguished name of the system's AD
* computer object.
*/
static smb_ads_qstat_t
smb_ads_find_computer(smb_ads_handle_t *ah, char *dn)
{
smb_ads_qstat_t stat;
smb_ads_avpair_t avpair;
avpair.avp_attr = SMB_ADS_ATTR_DN;
smb_ads_get_default_comp_container_dn(ah, dn, SMB_ADS_DN_MAX);
stat = smb_ads_lookup_computer_n_attr(ah, &avpair, LDAP_SCOPE_ONELEVEL,
dn);
if (stat == SMB_ADS_STAT_NOT_FOUND) {
(void) strlcpy(dn, ah->domain_dn, SMB_ADS_DN_MAX);
stat = smb_ads_lookup_computer_n_attr(ah, &avpair,
LDAP_SCOPE_SUBTREE, dn);
}
if (stat == SMB_ADS_STAT_FOUND) {
(void) strlcpy(dn, avpair.avp_val, SMB_ADS_DN_MAX);
free(avpair.avp_val);
}
return (stat);
}
/*
* smb_ads_update_computer_cntrl_attr
*
* Modify the user account control attribute of an existing computer
* object on AD.
*
* Returns LDAP error code.
*/
static int
smb_ads_update_computer_cntrl_attr(smb_ads_handle_t *ah, int flags, char *dn)
{
LDAPMod *attrs[2];
char *ctl_val[2];
int ret = 0;
char usrctl_buf[16];
if (smb_ads_alloc_attr(attrs, sizeof (attrs) / sizeof (LDAPMod *)) != 0)
return (LDAP_NO_MEMORY);
attrs[0]->mod_op = LDAP_MOD_REPLACE;
attrs[0]->mod_type = SMB_ADS_ATTR_CTL;
(void) snprintf(usrctl_buf, sizeof (usrctl_buf), "%d", flags);
ctl_val[0] = usrctl_buf;
ctl_val[1] = 0;
attrs[0]->mod_values = ctl_val;
if ((ret = ldap_modify_s(ah->ld, dn, attrs)) != LDAP_SUCCESS) {
syslog(LOG_NOTICE, "ldap_modify: %s", ldap_err2string(ret));
}
smb_ads_free_attr(attrs);
return (ret);
}
/*
* smb_ads_lookup_computer_attr_kvno
*
* Lookup the value of the Kerberos version number attribute of the computer
* account.
*/
static krb5_kvno
smb_ads_lookup_computer_attr_kvno(smb_ads_handle_t *ah, char *dn)
{
smb_ads_avpair_t avpair;
int kvno = 1;
avpair.avp_attr = SMB_ADS_ATTR_KVNO;
if (smb_ads_lookup_computer_n_attr(ah, &avpair,
LDAP_SCOPE_BASE, dn) == SMB_ADS_STAT_FOUND) {
kvno = atoi(avpair.avp_val);
free(avpair.avp_val);
}
return (kvno);
}
/*
* smb_ads_join
*
* Besides the NT-4 style domain join (using MS-RPC), CIFS server also
* provides the domain join using Kerberos Authentication, Keberos
* Change & Set password, and LDAP protocols. Basically, AD join
* operation would require the following tickets to be acquired for the
* the user account that is provided for the domain join.
*
* 1) a Keberos TGT ticket,
* 2) a ldap service ticket, and
* 3) kadmin/changpw service ticket
*
* The ADS client first sends a ldap search request to find out whether
* or not the workstation trust account already exists in the Active Directory.
* The existing computer object for this workstation will be removed and
* a new one will be added. The machine account password is randomly
* generated and set for the newly created computer object using KPASSWD
* protocol (See RFC 3244). Once the password is set, our ADS client
* finalizes the machine account by modifying the user acount control
* attribute of the computer object. Kerberos keys derived from the machine
* account password will be stored locally in /etc/krb5/krb5.keytab file.
* That would be needed while acquiring Kerberos TGT ticket for the host
* principal after the domain join operation.
*/
smb_ads_status_t
smb_ads_join(char *domain, char *user, char *usr_passwd, char *machine_passwd)
{
smb_ads_handle_t *ah = NULL;
krb5_context ctx = NULL;
krb5_principal *krb5princs = NULL;
krb5_kvno kvno;
boolean_t delete = B_TRUE;
smb_ads_status_t rc;
boolean_t new_acct;
int dclevel, num, usrctl_flags = 0;
smb_ads_qstat_t qstat;
char dn[SMB_ADS_DN_MAX];
char tmpfile[] = SMBNS_KRB5_KEYTAB_TMP;
int cnt, x;
smb_krb5_pn_set_t spns;
krb5_enctype *encptr;
rc = smb_ads_open_main(&ah, domain, user, usr_passwd);
if (rc != 0) {
smb_ccache_remove(SMB_CCACHE_PATH);
return (rc);
}
if ((dclevel = smb_ads_get_dc_level(ah)) == -1) {
smb_ads_close(ah);
smb_ccache_remove(SMB_CCACHE_PATH);
return (SMB_ADJOIN_ERR_GET_DCLEVEL);
}
qstat = smb_ads_find_computer(ah, dn);
switch (qstat) {
case SMB_ADS_STAT_FOUND:
new_acct = B_FALSE;
if (smb_ads_modify_computer(ah, dclevel, dn) != 0) {
smb_ads_close(ah);
smb_ccache_remove(SMB_CCACHE_PATH);
return (SMB_ADJOIN_ERR_MOD_TRUST_ACCT);
}
break;
case SMB_ADS_STAT_NOT_FOUND:
new_acct = B_TRUE;
smb_ads_get_default_comp_dn(ah, dn, SMB_ADS_DN_MAX);
if (smb_ads_add_computer(ah, dclevel, dn) != 0) {
smb_ads_close(ah);
smb_ccache_remove(SMB_CCACHE_PATH);
return (SMB_ADJOIN_ERR_ADD_TRUST_ACCT);
}
break;
default:
if (qstat == SMB_ADS_STAT_DUP)
rc = SMB_ADJOIN_ERR_DUP_TRUST_ACCT;
else
rc = SMB_ADJOIN_ERR_TRUST_ACCT;
smb_ads_close(ah);
smb_ccache_remove(SMB_CCACHE_PATH);
return (rc);
}
if (smb_krb5_ctx_init(&ctx) != 0) {
rc = SMB_ADJOIN_ERR_INIT_KRB_CTX;
goto adjoin_cleanup;
}
if (smb_krb5_get_pn_set(&spns, SMB_PN_KEYTAB_ENTRY, ah->domain) == 0) {
rc = SMB_ADJOIN_ERR_GET_SPNS;
goto adjoin_cleanup;
}
if (smb_krb5_get_kprincs(ctx, spns.s_pns, spns.s_cnt, &krb5princs)
!= 0) {
smb_krb5_free_pn_set(&spns);
rc = SMB_ADJOIN_ERR_GET_SPNS;
goto adjoin_cleanup;
}
cnt = spns.s_cnt;
smb_krb5_free_pn_set(&spns);
/* New machine_passwd was filled in by our caller. */
if (smb_krb5_setpwd(ctx, ah->domain, machine_passwd) != 0) {
rc = SMB_ADJOIN_ERR_KSETPWD;
goto adjoin_cleanup;
}
kvno = smb_ads_lookup_computer_attr_kvno(ah, dn);
/*
* Only members of Domain Admins and Enterprise Admins can set
* the TRUSTED_FOR_DELEGATION userAccountControl flag.
* Try to set this, but don't fail the join if we can't.
* Look into just removing this...
*/
usrctl_flags = (
SMB_ADS_USER_ACCT_CTL_WKSTATION_TRUST_ACCT |
SMB_ADS_USER_ACCT_CTL_TRUSTED_FOR_DELEGATION |
SMB_ADS_USER_ACCT_CTL_DONT_EXPIRE_PASSWD);
set_ctl_again:
x = smb_ads_update_computer_cntrl_attr(ah, usrctl_flags, dn);
if (x != LDAP_SUCCESS && (usrctl_flags &
SMB_ADS_USER_ACCT_CTL_TRUSTED_FOR_DELEGATION) != 0) {
syslog(LOG_NOTICE, "Unable to set the "
"TRUSTED_FOR_DELEGATION userAccountControl flag on the "
"machine account in Active Directory. It may be necessary "
"to set that via Active Directory administration.");
usrctl_flags &=
~SMB_ADS_USER_ACCT_CTL_TRUSTED_FOR_DELEGATION;
goto set_ctl_again;
}
if (x != LDAP_SUCCESS) {
rc = SMB_ADJOIN_ERR_UPDATE_CNTRL_ATTR;
goto adjoin_cleanup;
}
if (mktemp(tmpfile) == NULL) {
rc = SMB_ADJOIN_ERR_WRITE_KEYTAB;
goto adjoin_cleanup;
}
encptr = smb_ads_get_enctypes(dclevel, &num);
if (smb_krb5_kt_populate(ctx, ah->domain, krb5princs, cnt,
tmpfile, kvno, machine_passwd, encptr, num) != 0) {
rc = SMB_ADJOIN_ERR_WRITE_KEYTAB;
goto adjoin_cleanup;
}
delete = B_FALSE;
rc = SMB_ADS_SUCCESS;
adjoin_cleanup:
if (new_acct && delete)
smb_ads_del_computer(ah, dn);
if (rc != SMB_ADJOIN_ERR_INIT_KRB_CTX) {
if (rc != SMB_ADJOIN_ERR_GET_SPNS)
smb_krb5_free_kprincs(ctx, krb5princs, cnt);
smb_krb5_ctx_fini(ctx);
}
/* commit keytab file */
if (rc == SMB_ADS_SUCCESS) {
if (rename(tmpfile, SMBNS_KRB5_KEYTAB) != 0) {
(void) unlink(tmpfile);
rc = SMB_ADJOIN_ERR_COMMIT_KEYTAB;
}
} else {
(void) unlink(tmpfile);
}
smb_ads_close(ah);
smb_ccache_remove(SMB_CCACHE_PATH);
return (rc);
}
struct xlate_table {
int err;
const char const *msg;
};
static const struct xlate_table
adjoin_table[] = {
{ SMB_ADS_SUCCESS, "Success" },
{ SMB_ADS_KRB5_INIT_CTX,
"Failed creating a Kerberos context." },
{ SMB_ADS_KRB5_CC_DEFAULT,
"Failed to resolve default credential cache." },
{ SMB_ADS_KRB5_PARSE_PRINCIPAL,
"Failed parsing the user principal name." },
{ SMB_ADS_KRB5_GET_INIT_CREDS_PW,
"Failed getting initial credentials. (Wrong password?)" },
{ SMB_ADS_KRB5_CC_INITIALIZE,
"Failed initializing the credential cache." },
{ SMB_ADS_KRB5_CC_STORE_CRED,
"Failed to update the credential cache." },
{ SMB_ADS_CANT_LOCATE_DC,
"Failed to locate a domain controller." },
{ SMB_ADS_LDAP_INIT,
"Failed to create an LDAP handle." },
{ SMB_ADS_LDAP_SETOPT,
"Failed to set an LDAP option." },
{ SMB_ADS_LDAP_SET_DOM,
"Failed to set the LDAP handle DN." },
{ SMB_ADS_LDAP_SASL_BIND,
"Failed to bind the LDAP handle. "
"Usually indicates an authentication problem." },
{ SMB_ADJOIN_ERR_GEN_PWD,
"Failed to generate machine password." },
{ SMB_ADJOIN_ERR_GET_DCLEVEL, "Unknown functional level of "
"the domain controller. The rootDSE attribute named "
"\"domainControllerFunctionality\" is missing from the "
"Active Directory." },
{ SMB_ADJOIN_ERR_ADD_TRUST_ACCT, "Failed to create the "
"workstation trust account." },
{ SMB_ADJOIN_ERR_MOD_TRUST_ACCT, "Failed to modify the "
"workstation trust account." },
{ SMB_ADJOIN_ERR_DUP_TRUST_ACCT, "Failed to create the "
"workstation trust account because its name is already "
"in use." },
{ SMB_ADJOIN_ERR_TRUST_ACCT, "Error in querying the "
"workstation trust account" },
{ SMB_ADJOIN_ERR_INIT_KRB_CTX, "Failed to initialize Kerberos "
"context." },
{ SMB_ADJOIN_ERR_GET_SPNS, "Failed to get Kerberos "
"principals." },
{ SMB_ADJOIN_ERR_KSETPWD, "Failed to set machine password." },
{ SMB_ADJOIN_ERR_UPDATE_CNTRL_ATTR, "Failed to modify "
"userAccountControl attribute of the workstation trust "
"account." },
{ SMB_ADJOIN_ERR_WRITE_KEYTAB, "Error in writing to local "
"keytab file (i.e /etc/krb5/krb5.keytab)." },
{ SMB_ADJOIN_ERR_IDMAP_SET_DOMAIN, "Failed to update idmap "
"configuration." },
{ SMB_ADJOIN_ERR_IDMAP_REFRESH, "Failed to refresh idmap "
"service." },
{ SMB_ADJOIN_ERR_COMMIT_KEYTAB, "Failed to commit changes to "
"local keytab file (i.e. /etc/krb5/krb5.keytab)." },
{ SMB_ADJOIN_ERR_AUTH_NETLOGON,
"Failed to authenticate using the new computer account." },
{ SMB_ADJOIN_ERR_STORE_PROPS,
"Failed to store computer account information locally." },
{ 0, NULL }
};
/*
* smb_ads_strerror
*
* Lookup an error message for the specific adjoin error code.
*/
const char *
smb_ads_strerror(int err)
{
const struct xlate_table *xt;
if (err > 0 && err < SMB_ADS_ERRNO_GAP)
return (strerror(err));
for (xt = adjoin_table; xt->msg; xt++)
if (xt->err == err)
return (xt->msg);
return ("Unknown error code.");
}
void
smb_ads_log_errmsg(smb_ads_status_t err)
{
const char *s = smb_ads_strerror(err);
syslog(LOG_NOTICE, "%s", s);
}
/*
* smb_ads_lookup_msdcs
*
* If server argument is set, try to locate the specified DC.
* If it is set to empty string, locate any DCs in the specified domain.
* Returns the discovered DC via buf.
*
* fqdn - fully-qualified domain name
* dci - the name and address of the found DC
*/
uint32_t
smb_ads_lookup_msdcs(char *fqdn, smb_dcinfo_t *dci)
{
smb_ads_host_info_t *hinfo = NULL;
char ipstr[INET6_ADDRSTRLEN];
if (!fqdn || !dci)
return (NT_STATUS_INTERNAL_ERROR);
ipstr[0] = '\0';
if ((hinfo = smb_ads_find_host(fqdn)) == NULL)
return (NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND);
(void) smb_inet_ntop(&hinfo->ipaddr, ipstr,
SMB_IPSTRLEN(hinfo->ipaddr.a_family));
smb_tracef("msdcsLookupADS: %s [%s]", hinfo->name, ipstr);
(void) strlcpy(dci->dc_name, hinfo->name, sizeof (dci->dc_name));
dci->dc_addr = hinfo->ipaddr;
free(hinfo);
return (NT_STATUS_SUCCESS);
}
static krb5_enctype *
smb_ads_get_enctypes(int dclevel, int *num)
{
krb5_enctype *encptr;
if (dclevel >= SMB_ADS_DCLEVEL_W2K8) {
*num = sizeof (w2k8enctypes) / sizeof (krb5_enctype);
encptr = w2k8enctypes;
} else {
*num = sizeof (pre_w2k8enctypes) / sizeof (krb5_enctype);
encptr = pre_w2k8enctypes;
}
return (encptr);
}