libsmbns/common/smbns_ksetpwd.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <unistd.h>
#include <ctype.h>
#include <errno.h>
#include <syslog.h>
#include <netdb.h>
#include <sys/param.h>
#include <kerberosv5/krb5.h>
#include <kerberosv5/com_err.h>

#include <smbsrv/libsmb.h>
#include <smbns_krb.h>

/*
 * Kerberized services available on the system.
 */
static smb_krb5_pn_t smb_krb5_pn_tab[] = {
    /*
     * Service keys are salted with the SMB_KRB_PN_ID_ID_SALT prinipal
     * name.
     */
    {SMB_KRB5_PN_ID_SALT,       SMB_PN_SVC_HOST,    SMB_PN_SALT},

    /* CIFS SPNs. (HOST, CIFS, ...) */
    {SMB_KRB5_PN_ID_HOST_FQHN,  SMB_PN_SVC_HOST,
        SMB_PN_KEYTAB_ENTRY | SMB_PN_SPN_ATTR | SMB_PN_UPN_ATTR},
    {SMB_KRB5_PN_ID_HOST_SHORT, SMB_PN_SVC_HOST,
        SMB_PN_KEYTAB_ENTRY | SMB_PN_SPN_ATTR},
    {SMB_KRB5_PN_ID_CIFS_FQHN,  SMB_PN_SVC_CIFS,
        SMB_PN_KEYTAB_ENTRY | SMB_PN_SPN_ATTR},
    {SMB_KRB5_PN_ID_CIFS_SHORT, SMB_PN_SVC_CIFS,
        SMB_PN_KEYTAB_ENTRY | SMB_PN_SPN_ATTR},
    {SMB_KRB5_PN_ID_MACHINE,    NULL,
        SMB_PN_KEYTAB_ENTRY},

    /* NFS */
    {SMB_KRB5_PN_ID_NFS_FQHN,   SMB_PN_SVC_NFS,
        SMB_PN_KEYTAB_ENTRY | SMB_PN_SPN_ATTR},

    /* HTTP */
    {SMB_KRB5_PN_ID_HTTP_FQHN,  SMB_PN_SVC_HTTP,
        SMB_PN_KEYTAB_ENTRY | SMB_PN_SPN_ATTR},

    /* ROOT */
    {SMB_KRB5_PN_ID_ROOT_FQHN,  SMB_PN_SVC_ROOT,
        SMB_PN_KEYTAB_ENTRY | SMB_PN_SPN_ATTR},
};

#define SMB_KRB5_SPN_TAB_SZ \
    (sizeof (smb_krb5_pn_tab) / sizeof (smb_krb5_pn_tab[0]))

#define SMB_KRB5_MAX_BUFLEN 128

static int smb_krb5_kt_open(krb5_context, char *, krb5_keytab *);
static int smb_krb5_kt_addkey(krb5_context, krb5_keytab, const krb5_principal,
    krb5_enctype, krb5_kvno, const krb5_data *, const char *);
static int smb_krb5_spn_count(uint32_t);
static smb_krb5_pn_t *smb_krb5_lookup_pn(smb_krb5_pn_id_t);
static char *smb_krb5_get_pn_by_id(smb_krb5_pn_id_t, uint32_t,
    const char *);
static int smb_krb5_get_kprinc(krb5_context, smb_krb5_pn_id_t, uint32_t,
    const char *, krb5_principal *);


/*
 * Generates a null-terminated array of principal names that
 * represents the list of the available Kerberized services
 * of the specified type (SPN attribute, UPN attribute, or
 * keytab entry).
 *
 * Returns the number of principal names returned via the 1st
 * output parameter (i.e. vals).
 *
 * Caller must invoke smb_krb5_free_spns to free the allocated
 * memory when finished.
 */
uint32_t
smb_krb5_get_pn_set(smb_krb5_pn_set_t *set, uint32_t type, char *fqdn)
{
    int cnt, i;
    smb_krb5_pn_t *tabent;

    if (!set || !fqdn)
        return (0);

    bzero(set, sizeof (smb_krb5_pn_set_t));
    cnt = smb_krb5_spn_count(type);
    set->s_pns = (char **)calloc(cnt + 1, sizeof (char *));

    if (set->s_pns == NULL)
        return (0);

    for (i = 0, set->s_cnt = 0; i < SMB_KRB5_SPN_TAB_SZ; i++) {
        tabent = &smb_krb5_pn_tab[i];

        if (set->s_cnt == cnt)
            break;

        if ((tabent->p_flags & type) != type)
            continue;

        set->s_pns[set->s_cnt] = smb_krb5_get_pn_by_id(tabent->p_id,
            type, fqdn);
        if (set->s_pns[set->s_cnt] == NULL) {
            syslog(LOG_ERR, "smbns_ksetpwd: failed to obtain "
                "principal names: possible transient memory "
                "shortage");
            smb_krb5_free_pn_set(set);
            return (0);
        }

        set->s_cnt++;
    }

    if (set->s_cnt == 0)
        smb_krb5_free_pn_set(set);

    return (set->s_cnt);
}

void
smb_krb5_free_pn_set(smb_krb5_pn_set_t *set)
{
    int i;

    if (set == NULL || set->s_pns == NULL)
        return;

    for (i = 0; i < set->s_cnt; i++)
        free(set->s_pns[i]);

    free(set->s_pns);
    set->s_pns = NULL;
}

/*
 * Initialize the kerberos context.
 * Return 0 on success. Otherwise, return -1.
 */
int
smb_krb5_ctx_init(krb5_context *ctx)
{
    if (krb5_init_context(ctx) != 0)
        return (-1);

    return (0);
}

/*
 * Free the kerberos context.
 */
void
smb_krb5_ctx_fini(krb5_context ctx)
{
    krb5_free_context(ctx);
}

/*
 * Create an array of Kerberos Princiapls given an array of principal names.
 * Caller must free the allocated memory using smb_krb5_free_kprincs()
 * upon success.
 *
 * Returns 0 on success. Otherwise, returns -1.
 */
int
smb_krb5_get_kprincs(krb5_context ctx, char **names, size_t num,
    krb5_principal **krb5princs)
{
    int i;

    if ((*krb5princs = calloc(num, sizeof (krb5_principal *))) == NULL) {
        return (-1);
    }

    for (i = 0; i < num; i++) {
        if (krb5_parse_name(ctx, names[i], &(*krb5princs)[i]) != 0) {
            smb_krb5_free_kprincs(ctx, *krb5princs, i);
            return (-1);
        }
    }

    return (0);
}

void
smb_krb5_free_kprincs(krb5_context ctx, krb5_principal *krb5princs,
    size_t num)
{
    int i;

    for (i = 0; i < num; i++)
        krb5_free_principal(ctx, krb5princs[i]);

    free(krb5princs);
}

/*
 * Set the workstation trust account password.
 * Returns 0 on success.  Otherwise, returns non-zero value.
 */
int
smb_krb5_setpwd(krb5_context ctx, const char *fqdn, char *passwd)
{
    krb5_error_code code;
    krb5_ccache cc = NULL;
    int result_code = 0;
    krb5_data result_code_string, result_string;
    krb5_principal princ;
    char msg[SMB_KRB5_MAX_BUFLEN];

    if (smb_krb5_get_kprinc(ctx, SMB_KRB5_PN_ID_HOST_FQHN,
        SMB_PN_UPN_ATTR, fqdn, &princ) != 0)
        return (-1);

    (void) memset(&result_code_string, 0, sizeof (result_code_string));
    (void) memset(&result_string, 0, sizeof (result_string));

    if ((code = krb5_cc_default(ctx, &cc)) != 0) {
        (void) snprintf(msg, sizeof (msg), "smbns_ksetpwd: failed to "
            "find %s", SMB_CCACHE_PATH);
        smb_krb5_log_errmsg(ctx, msg, code);
        krb5_free_principal(ctx, princ);
        return (-1);
    }

    code = krb5_set_password_using_ccache(ctx, cc, passwd, princ,
        &result_code, &result_code_string, &result_string);

    (void) krb5_cc_close(ctx, cc);

    if (code != 0)
        smb_krb5_log_errmsg(ctx, "smbns_ksetpwd: KPASSWD protocol "
            "exchange failed", code);

    if (result_code != 0) {
        syslog(LOG_ERR, "smbns_ksetpwd: KPASSWD failed: rc=%d %.*s",
            result_code,
            result_code_string.length,
            result_code_string.data);
        if (code == 0)
            code = EACCES;
    }

    krb5_free_principal(ctx, princ);
    free(result_code_string.data);
    free(result_string.data);
    return (code);
}

/*
 * Open the keytab file for writing.
 * The keytab should be closed by calling krb5_kt_close().
 */
static int
smb_krb5_kt_open(krb5_context ctx, char *fname, krb5_keytab *kt)
{
    char *ktname;
    krb5_error_code code;
    int len;
    char msg[SMB_KRB5_MAX_BUFLEN];

    *kt = NULL;
    len = snprintf(NULL, 0, "WRFILE:%s", fname) + 1;
    if ((ktname = malloc(len)) == NULL) {
        syslog(LOG_ERR, "smbns_ksetpwd: unable to open keytab %s: "
            "possible transient memory shortage", fname);
        return (-1);
    }

    (void) snprintf(ktname, len, "WRFILE:%s", fname);

    if ((code = krb5_kt_resolve(ctx, ktname, kt)) != 0) {
        (void) snprintf(msg, sizeof (msg), "smbns_ksetpwd: %s", fname);
        smb_krb5_log_errmsg(ctx, msg, code);
        free(ktname);
        return (-1);
    }

    free(ktname);
    return (0);
}

/*
 * Populate the keytab with keys of the specified key version for the
 * specified set of krb5 principals.  All service keys will be salted by:
 * host/<truncated@15_lower_case_hostname>.<fqdn>@<REALM>
 */
int
smb_krb5_kt_populate(krb5_context ctx, const char *fqdn,
    krb5_principal *princs, int count, char *fname, krb5_kvno kvno,
    char *passwd, krb5_enctype *enctypes, int enctype_count)
{
    krb5_keytab kt = NULL;
    krb5_data salt;
    krb5_error_code code;
    krb5_principal salt_princ;
    int i, j;

    if (smb_krb5_kt_open(ctx, fname, &kt) != 0)
        return (-1);

    if (smb_krb5_get_kprinc(ctx, SMB_KRB5_PN_ID_SALT, SMB_PN_SALT,
        fqdn, &salt_princ) != 0) {
        (void) krb5_kt_close(ctx, kt);
        return (-1);
    }

    code = krb5_principal2salt(ctx, salt_princ, &salt);
    if (code != 0) {
        smb_krb5_log_errmsg(ctx, "smbns_ksetpwd: salt computation "
            "failed", code);
        krb5_free_principal(ctx, salt_princ);
        (void) krb5_kt_close(ctx, kt);
        return (-1);
    }

    for (j = 0; j < count; j++) {
        for (i = 0; i < enctype_count; i++) {
            if (smb_krb5_kt_addkey(ctx, kt, princs[j], enctypes[i],
                kvno, &salt, passwd) != 0) {
                krb5_free_principal(ctx, salt_princ);
                krb5_xfree(salt.data);
                (void) krb5_kt_close(ctx, kt);
                return (-1);
            }
        }

    }
    krb5_free_principal(ctx, salt_princ);
    krb5_xfree(salt.data);
    (void) krb5_kt_close(ctx, kt);
    return (0);
}

boolean_t
smb_krb5_kt_find(smb_krb5_pn_id_t id, const char *fqdn, char *fname)
{
    krb5_context ctx;
    krb5_keytab kt;
    krb5_keytab_entry entry;
    krb5_principal princ;
    char ktname[MAXPATHLEN];
    boolean_t found = B_FALSE;

    if (!fqdn || !fname)
        return (found);

    if (smb_krb5_ctx_init(&ctx) != 0)
        return (found);

    if (smb_krb5_get_kprinc(ctx, id, SMB_PN_KEYTAB_ENTRY, fqdn,
        &princ) != 0) {
        smb_krb5_ctx_fini(ctx);
        return (found);
    }

    (void) snprintf(ktname, MAXPATHLEN, "FILE:%s", fname);
    if (krb5_kt_resolve(ctx, ktname, &kt) == 0) {
        if (krb5_kt_get_entry(ctx, kt, princ, 0, 0, &entry) == 0) {
            found = B_TRUE;
            (void) krb5_kt_free_entry(ctx, &entry);
        }

        (void) krb5_kt_close(ctx, kt);
    }

    krb5_free_principal(ctx, princ);
    smb_krb5_ctx_fini(ctx);
    return (found);
}

/*
 * Add a key of the specified encryption type for the specified principal
 * to the keytab file.
 * Returns 0 on success. Otherwise, returns -1.
 */
static int
smb_krb5_kt_addkey(krb5_context ctx, krb5_keytab kt, const krb5_principal princ,
    krb5_enctype enctype, krb5_kvno kvno, const krb5_data *salt,
    const char *pw)
{
    krb5_keytab_entry *entry;
    krb5_data password;
    krb5_keyblock key;
    krb5_error_code code;
    char buf[SMB_KRB5_MAX_BUFLEN], msg[SMB_KRB5_MAX_BUFLEN];
    int rc = 0;

    if ((code = krb5_enctype_to_string(enctype, buf, sizeof (buf)))) {
        (void) snprintf(msg, sizeof (msg), "smbns_ksetpwd: unknown "
            "encryption type (%d)", enctype);
        smb_krb5_log_errmsg(ctx, msg, code);
        return (-1);
    }

    if ((entry = (krb5_keytab_entry *) malloc(sizeof (*entry))) == NULL) {
        syslog(LOG_ERR, "smbns_ksetpwd: possible transient "
            "memory shortage");
        return (-1);
    }

    (void) memset((char *)entry, 0, sizeof (*entry));

    password.length = strlen(pw);
    password.data = (char *)pw;

    code = krb5_c_string_to_key(ctx, enctype, &password, salt, &key);
    if (code != 0) {
        (void) snprintf(msg, sizeof (msg), "smbns_ksetpwd: failed to "
            "generate key (%d)", enctype);
        smb_krb5_log_errmsg(ctx, msg, code);
        free(entry);
        return (-1);
    }

    (void) memcpy(&entry->key, &key, sizeof (krb5_keyblock));
    entry->vno = kvno;
    entry->principal = princ;

    if ((code = krb5_kt_add_entry(ctx, kt, entry)) != 0) {
        (void) snprintf(msg, sizeof (msg), "smbns_ksetpwd: failed to "
            "add key (%d)", enctype);
        smb_krb5_log_errmsg(ctx, msg, code);
        rc = -1;
    }

    free(entry);
    if (key.length)
        krb5_free_keyblock_contents(ctx, &key);
    return (rc);
}

static int
smb_krb5_spn_count(uint32_t type)
{
    int i, cnt;

    for (i = 0, cnt = 0; i < SMB_KRB5_SPN_TAB_SZ; i++) {
        if (smb_krb5_pn_tab[i].p_flags & type)
            cnt++;
    }

    return (cnt);
}

/*
 * Generate the Kerberos Principal given a principal name format and the
 * fully qualified domain name. On success, caller must free the allocated
 * memory by calling krb5_free_principal().
 */
static int
smb_krb5_get_kprinc(krb5_context ctx, smb_krb5_pn_id_t id, uint32_t type,
    const char *fqdn, krb5_principal *princ)
{
    char *buf;

    if ((buf = smb_krb5_get_pn_by_id(id, type, fqdn)) == NULL)
        return (-1);

    if (krb5_parse_name(ctx, buf, princ) != 0) {
        free(buf);
        return (-1);
    }

    free(buf);
    return (0);
}

/*
 * Looks up an entry in the principal name table given the ID.
 */
static smb_krb5_pn_t *
smb_krb5_lookup_pn(smb_krb5_pn_id_t id)
{
    int i;
    smb_krb5_pn_t *tabent;

    for (i = 0; i < SMB_KRB5_SPN_TAB_SZ; i++) {
        tabent = &smb_krb5_pn_tab[i];
        if (id == tabent->p_id)
            return (tabent);
    }

    return (NULL);
}

/*
 * Construct the principal name given an ID, the requested type, and the
 * fully-qualified name of the domain of which the principal is a member.
 */
static char *
smb_krb5_get_pn_by_id(smb_krb5_pn_id_t id, uint32_t type,
    const char *fqdn)
{
    char nbname[NETBIOS_NAME_SZ];
    char hostname[MAXHOSTNAMELEN];
    char *realm = NULL;
    smb_krb5_pn_t *pn;
    char *buf;

    (void) smb_getnetbiosname(nbname, NETBIOS_NAME_SZ);
    (void) smb_gethostname(hostname, MAXHOSTNAMELEN, SMB_CASE_LOWER);

    pn = smb_krb5_lookup_pn(id);

    /* detect inconsistent requested format and type */
    if ((type & pn->p_flags) != type)
        return (NULL);

    switch (id) {
    case SMB_KRB5_PN_ID_SALT:
        (void) asprintf(&buf, "%s/%s.%s",
            pn->p_svc, smb_strlwr(nbname), fqdn);
        break;

    case SMB_KRB5_PN_ID_HOST_FQHN:
    case SMB_KRB5_PN_ID_CIFS_FQHN:
    case SMB_KRB5_PN_ID_NFS_FQHN:
    case SMB_KRB5_PN_ID_HTTP_FQHN:
    case SMB_KRB5_PN_ID_ROOT_FQHN:
        (void) asprintf(&buf, "%s/%s.%s",
            pn->p_svc, hostname, fqdn);
        break;

    case SMB_KRB5_PN_ID_HOST_SHORT:
    case SMB_KRB5_PN_ID_CIFS_SHORT:
        (void) asprintf(&buf, "%s/%s",
            pn->p_svc, nbname);
        break;

    /*
     * SPN for the machine account, which is simply the
     * (short) machine name with a dollar sign appended.
     */
    case SMB_KRB5_PN_ID_MACHINE:
        (void) asprintf(&buf, "%s$", nbname);
        break;

    default:
        return (NULL);
    }

    /*
     * If the requested principal is either added to keytab / the machine
     * account as the UPN attribute or used for key salt generation,
     * the principal name must have the @<REALM> portion.
     */
    if (type & (SMB_PN_KEYTAB_ENTRY | SMB_PN_UPN_ATTR | SMB_PN_SALT)) {
        if ((realm = strdup(fqdn)) == NULL) {
            free(buf);
            return (NULL);
        }

        (void) smb_strupr(realm);
        if (buf != NULL) {
            char *tmp;

            (void) asprintf(&tmp, "%s@%s", buf,
                realm);
            free(buf);
            buf = tmp;
        }

        free(realm);
    }

    return (buf);
}